From fdb5f6f89181645a4d89100760cb660849a72d1d Mon Sep 17 00:00:00 2001
From: Mattsson <111893710+mattssonn@users.noreply.github.com>
Date: Wed, 26 Aug 2026 16:56:39 +0200
Subject: [PATCH] feat(white-label): byra white-label infrastructure: brands,
 cockpit, home domains, branded email (#1956)

* feat(white-label): brand and team-kind foundation

- brands table: one white-label identity per byra team (unique mutable
  domain, row presence = live, email sender identity, hex color CHECKs)
- teams.kind ('personal'|'byra'): ops-only kind changes, deterministic
  ensure_user_team (personal team only), AFTER UPDATE role re-sync so a
  demoted consultant loses admin in client books immediately
- resolveBrandByHost/resolveBrandForCompany with 60s TTL cache, derived
  chrome tone and WCAG contrast gate; no brand row = default appearance

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(white-label): per-request brand theming, wordmark slot and source footer

- root layout resolves the brand from the Host header and injects a
  server-rendered style block (light + dark), font pair classes and a
  BrandProvider/useBranding context; default hosts render byte-identically
- BrandWordmark logo slot, host-aware manifest and favicon,
  images.remotePatterns for Supabase Storage logos
- curated font menu mechanism (font_key -> variable pair, preload:false
  for non-default entries)
- AGPL source-code footer link on login and public pages, both brands

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(white-label): byra team invites, member management and team billing

- team invites unfrozen behind a kind gate (byra teams only, owner/admin
  invite); members route handles multi-team membership; members/[id]
  unfrozen with last-owner protection; invite management UI in settings
- billing/status learns team-scoped grants and the settings page shows a
  read-only "part of the byra agreement" state instead of the upgrade pitch
- 30-day trial suppressed for companies created under a byra team

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(white-label): brand-aware outbound mail, auth email hook and public invoice branding

- every outbound mail is sent in the brand of the company it concerns:
  getSenderForCompany/getBaseUrlForCompany chain (verified brand domain,
  "via Accounted" fallback, canonical default) wired into invites,
  payslips, invoice deliveries and reminders
- Supabase Send Email hook endpoint (signature-verified with node:crypto,
  dormant until configured) renders auth mail per brand via redirect origin
- public invoice pages carry the company's brand mark
- snapshot suite per template class guards against wrong-brand mail

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(white-label): byra cockpit, home-domain rule and tab guard

- Klienter route: five urgency-sorted columns (company, unbooked, inbox,
  next deadline via the status engine, last booked) for byra team members,
  who land there after login on their home domain
- soft switch straight into a client and back; blocking two-exit tab
  guard against writes to the wrong active company
- client company creation admin-gated at the DB level (a created company
  is +1 on the byra invoice), bound to the byra team, no trial
- home-domain rule in the UI: switcher partitions companies by host,
  signpost page for companies homed elsewhere

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(white-label): brand-aware app name across UI strings

- 24 message keys per locale converted to the {appName} ICU parameter,
  27 call sites pass the active brand name (useBranding client-side,
  getRequestAppName server-side)
- 6 hardcoded JSX literals swept; statutory filing and API identity
  surfaces deliberately keep the Accounted name
- 34 new i18n keys for the cockpit, team invites, billing state, tab
  guard, signpost and source footer (sv/en parity verified)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(white-label): domain glossary and decision log entries

- CONTEXT.md: the white-label ubiquitous language (brand, byra team,
  home domain, signpost, umbrella subdomain, brand color, cockpit)
- DECISIONS.md entries from the build waves

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(white-label): lean byra cockpit sidebar with company-mode back link

Byra team members now get a two-mode sidebar: on cockpit routes (/clients
and the new /byra pages) only Hem, Klienter, Automationer and Nyckeltal
show; entering a client company brings back the full company sidebar with
a pinned back-to-clients link (expanded, rail and mobile). New pages: /byra
home with client count, needs-action count and per-client urgent deadlines
reusing the fetchClientOverview aggregation, plus designed empty states for
/byra/automations and /byra/kpi. Signpost gate allows the byra routes;
non-byra users are unaffected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(white-label): cockpit shows no active company and keeps lean sidebar under settings

In cockpit mode the bottom user widget no longer shows the active company
subline or the company-switcher flyout: the cockpit sits above the
companies and clients are entered through the Klienter list. The settings
modal previously flipped the sidebar to the full company nav behind it
because the pathname becomes /settings/*; the sidebar now keeps the mode
of the surface underneath.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(white-label): keep company picker in cockpit with nothing selected

The cockpit user menu gets the company-switcher flyout back, but neutral:
the row reads "Valj bolag", no company carries the check mark or active
styling, and picking any company (including the technically-active one)
enters it with a full navigation. Company mode is unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore(db): renumber white-label migrations past main and add byra settings scope

Renumber 20260801100000-120000 to 20260804110000-113000: main already
carries applied versions up to 20260803231000, and Supabase branching
refuses local migrations stamped before the remote head (the repo rule
from 5932632f5: keep new versions strictly newest). Comment references
updated in the pg tests, route docs and onboarding precheck.

Also ships the byra settings scope: settings opened from the cockpit
(?ctx=byra, honored only for byra team members) show account-level
sections only (Konto, Medlemmar och roller), hide company-scoped
sections and the company kicker, and the team section is registered in
SETTINGS_SECTIONS so Medlemmar och roller renders inside the settings
window. The cockpit user menu drops Abonnemang and carries the scope on
its links; section switches preserve it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(byra): cross-client nyckeltal view in the cockpit

Period presets and company chips in the URL, summary tiles, merged
monthly income/expense chart and a sortable per-client KPI table.
Numbers come from the existing get_kpi_report_aggregates RPC per
client (no new migrations); calendar months are the cross-client
axis since clients can have different fiscal years.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(white-label): byra self-service brand logo and app name

New Varumarke settings section (byra scope, owner/admin): logo
upload/remove and an editable app name; domain stays read-only.
brands has no write RLS by design, so writes go through
/api/byra/brand routes with the service client behind an explicit
owner/admin team check. Files land in logos/byra/{teamId}/. The
expanded sidebar shows the brand app name beside the logo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(white-label): route root layout through the shared brand resolver

app/layout.tsx carried a private copy of resolveRequestBrand, so it
and lib/branding/request-brand.ts could drift. The layout now uses
the shared function, which also gains a BRAND_DEV_DOMAIN override:
on literal localhost hosts only, resolve that brand so branding is
testable in local dev. Real domains are unaffected even if the
variable leaks into a deployment.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(byra): automations roadmap teaser and cockpit i18n strings

The Automationer tab now previews the planned automation set
(Monday briefing, deadline watch, rule-driven bookkeeping,
connection watch, monthly checklist, report delivery) instead of a
bare empty state. Bundles the sv/en strings for the whole cockpit
wave (nyckeltal, varumarke, automations) and the decision-log
entries.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(white-label): byra owners/admins land in the cockpit, not an auto-picked company

After login "/" resolved the first-membership fallback and opened a client
company nobody chose, and the top-left brand mark always linked back to it.
Byra owners/admins now home to /byra: the logo links there always, and "/"
redirects there unless a company was explicitly picked this browser session.

The middleware writes the fallback company back to user_preferences, so the
DB cannot tell picked from auto-picked; setActiveCompany stamps a session
cookie (gnubok-company-picked) on every explicit switch instead. The byra
check on "/" reuses the layout's team_members query via a request-cached
helper, so it costs no extra round trip. Byra members and regular users are
unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(white-label): drop brand color theming, keep monochrome everywhere

White-label is logo + app name + domain only (founder call): the
layout no longer injects brand color CSS variables, stamps
data-brand or colors the browser chrome. buildBrandVarsCss, its
WCAG gate and the brand_color/chrome_color columns stay dormant
for a future opt-in.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(db): arm SIE RPC statement_timeout via pgrst.db_pre_request hook

ALTER FUNCTION ... SET statement_timeout (20260629160100, 20260721144311)
never re-arms the running statement's timer, so large SIE imports still
died at the role default 8s. The pre-request hook runs as its own
statement before the main query, so set_config there is what the main
statement's timer is armed with. Scoped by request path to the three SIE
RPCs; every other request keeps 8s.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(byra): drop the 'what's coming' tail from the automations intro

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(white-label): byra owners/admins with zero companies land in the empty cockpit

Both no-company gates (Edge middleware and the dashboard layout) sent
every company-less user to the onboarding wizard, which forced a fresh
byra owner to create a personal company before ever seeing the cockpit.
Byra owners/admins now pass through to cockpit routes (/byra, /clients,
/companies/new, /settings, /api) and are steered to /byra elsewhere.
Plain byra members and regular users keep the onboarding redirect.
The membership lookup runs only in the rare no-company state, so the
middleware hot path is untouched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(white-label): auth wordmark shows the brand logo alone

Byra logos usually carry their own name, so logo + app name text on the
login/register hero read as a duplicate. Branded hosts with an uploaded
logo now render the logo only, with the app name as the image's alt
text. Hosts without a logo keep the text wordmark unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(white-label): per-brand favicon via brands.favicon_url

Branded hosts used logo_url as the tab icon, which squashes wide byra
lockups at 16px. New optional brands.favicon_url holds a square mark;
the root layout prefers it and falls back to logo_url as before.
Migration applied to staging (idempotent DDL).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(auth): wire the villkor and integritetspolicy footer links

Both auth pages shipped with href="#" placeholders. Villkor now points
at the platform terms on the marketing site (accounted.se/terms; the
terms are the platform's even on branded byra hosts) and
integritetspolicy at the in-app /privacy page, host-relative so it
resolves on every branded domain. Both open in a new tab so the auth
form state survives.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(settings): styled popup for the team role dropdowns

The byra team panel's role pickers (member rows + invite form) were
native selects, so the opened list rendered as the unstylable OS menu.
Swapped to the Radix Select with the popup styled like every other
overlay; the trigger keeps the flat quiet SettingsSelect look.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(email): branded sender shows the brand name alone, no via-platform

Byra invite mail read "Willem via Accounted" in the From display name.
The tier-2 fallback (brand on the platform address) now renders just the
brand name; the platform stays visible in the actual From address until
the brand verifies its own sender domain (tier 1, unchanged).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(white-label): byra landing applies to every team member, not only owners/admins

An invited byra consultant (role member) still landed in an auto-picked
client company after signup. The cockpit landing rules ("/" redirect,
brand-mark home link, and both no-company gates) now key on byra team
MEMBERSHIP instead of the owner/admin role: anyone with cockpit access
homes to /byra. Regular users unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(email): branded team invite names the byra, not "ett team pa <platform>"

Subject, headline, body and text variant now read "Du har blivit
inbjuden till <Byra>" (brand casing kept) when the team has a brand.
Brandless teams keep the platform phrasing byte-identical.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(white-label): sidebar keeps cockpit mode after refresh on settings

The sidebar's cockpit/company decision on /settings/* rested on React
state remembering the surface underneath, which a hard reload wipes: a
byra user refreshing settings opened from the cockpit got the full
company nav and read it as landing in a client company. The ?ctx=byra
marker already in the URL survives reloads, so the sidebar now honors
it as the cockpit signal alongside the in-session memory.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(white-label): hide the active-company chip in byra-scoped settings

The full-page settings header (the hard-refresh fallback surface) showed
the ActiveCompanyBadge even under ?ctx=byra, so a byra user read the
auto-active client as "the company I am in". The chip now follows the
same byra-scope rule as the modal's kicker.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(white-label): tab guard no longer fires in the tab that initiated the switch

BroadcastChannel delivers the company-switch broadcast to every listener in
the same tab too, so the cockpit tab raised its own WL-09 "switched in
another tab" dialog over the hard navigation into the clicked client.
performCompanySwitch now marks the switch as self-initiated; CompanyTabSync
suppresses only the dialog for that observation (stray writes still get
their 409) and clears the marker on bfcache restore so back-navigation
regains the full guard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(settings): styled popups for every settings dropdown

SettingsSelect rendered a native <select>, whose OS listbox cannot be
styled and clashes with the panel (same problem the team-panel role
dropdowns had). It now renders through Radix Select with the flat
dashed-underline trigger, keeping the native prop surface so all 13 call
sites work unchanged: value/defaultValue, onChange(e.target.value),
<option> children, and a hidden input that carries `name` into
SettingsFormWrapper's FormData read and raises the bubbling input event
its dirty tracking listens for. Empty-string option values map onto a
sentinel at the Radix boundary. The backup form's boxed fiscal-year
select moves to the shadcn Select with a placeholder.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(white-label): home-domain affinity redirect in middleware

Every signed-in user now homes on a domain: byra team members on their
brand's domain, everyone else on the platform app URL, except a byra's
client users, whose home is the byra domain their companies live under.
On any other product host the request redirects to the home domain's
root, where the user meets the RIGHT branded login (sessions are
per-domain by design). localhost, direct *.vercel.app hosts and IP
hosts are exempt; a 15-minute host-scoped cookie caches the "this is
home" verdict so the hot path costs zero extra queries; lookup failures
fail open. Complements the WL-01 signpost, which keeps handling
per-company homing inside a domain.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(white-label): render hero brand logo at 64px on auth pages

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(white-label): shareable invite link and re-send for byra team invites

A failed invite mail previously surfaced only as a toast description while
the invitation quietly waited for a mail that never arrived (the Arbore
case). The inviter now always has a recovery path:

- persistent share-link line after invite create/re-send: ochre attn line
  with a copy action when the mail did not go out, quiet muted line with
  the same action when it did
- POST /api/team/invite/[id] re-sends a pending invitation with a fresh
  token and expiry (same byra-only owner/admin gates as DELETE)
- brand mail sending extracted to lib/email/send-team-invite.ts, shared
  by create and re-send so the two paths cannot drift

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(white-label): sidebar shows uploaded brand logo alone, no app-name label

Byra logos usually carry their own name, so logo + text in the expanded
sidebar read as a duplicate (same founder call as BrandWordmark,
2026-08-05). The app-name label now renders only for branded hosts
without an uploaded logo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(white-label): close the four skeptic refutations before merge

- trial seed: migration 130300 now carries the seven-key PAID body from
  20260818170000 plus the byra guard, instead of silently reverting it;
  pg test pins the full key set against PAID_CAPABILITIES
- byra gate: new migration 130600 adds the owner/admin gate to
  create_company_for_user (v1 API + MCP path), and both surfaces resolve
  the default team personal-only, so a consultant's private company can
  never attach to the byra team
- home-domain: byra staff who also have canonical-homed companies are no
  longer redirected off the platform host; the signpost handles per-company
  homing (5 new middleware tests)
- settings selects: the Radix popup renders optgroup group headers again
  (ROT/RUT work-type picker)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(schema): re-baseline unresolvable-expression ceiling after #1954 catch-up merge

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(white-label): pg-real rollback-safe assertions and deep-link-preserving affinity redirect

The byra company-creation pg test asserted persisted rows through the pool
after withUserContext, which always rolls back its transaction; the
assertions now run inside the transaction after RESET ROLE. The home-domain
affinity redirect carries the original path and query across the domain hop
(PR Agent finding), so invite links and deep links survive the correction.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 CONTEXT.md                                    |  44 ++
 DECISIONS.md                                  |  22 +
 app/(auth)/login/login-client.tsx             |  34 +-
 app/(auth)/mfa/verify/page.tsx                |   8 +-
 app/(auth)/register/page.tsx                  |  23 +-
 app/(dashboard)/byra/automations/page.tsx     |  60 ++
 app/(dashboard)/byra/kpi/page.tsx             |  65 +++
 app/(dashboard)/byra/page.tsx                 | 117 ++++
 app/(dashboard)/clients/ClientsTable.tsx      | 163 ++++++
 .../clients/NewClientCompanyButton.tsx        |  61 ++
 app/(dashboard)/clients/page.tsx              |  42 ++
 .../extensions/[sector]/[extension]/page.tsx  |   8 +-
 app/(dashboard)/invoices/[id]/page.tsx        |  20 +-
 app/(dashboard)/layout.tsx                    | 158 +++++-
 app/(dashboard)/page.tsx                      |  22 +
 app/(dashboard)/request-context.ts            |  29 +
 app/(dashboard)/settings/brand/page.tsx       |   7 +
 app/(public)/dpa/page.tsx                     |   5 +
 app/(public)/invoice-action/[token]/page.tsx  |  36 +-
 app/(public)/privacy/page.tsx                 |   5 +
 .../auth/email-hook/__tests__/route.test.ts   | 240 ++++++++
 app/api/auth/email-hook/route.ts              | 209 +++++++
 app/api/billing/__tests__/status.test.ts      | 106 ++++
 app/api/billing/status/route.ts               |  24 +-
 app/api/byra/brand/__tests__/route.test.ts    | 179 ++++++
 .../byra/brand/logo/__tests__/route.test.ts   | 180 ++++++
 app/api/byra/brand/logo/route.ts              | 140 +++++
 app/api/byra/brand/route.ts                   |  96 ++++
 app/api/clients/__tests__/route.test.ts       | 201 +++++++
 app/api/clients/landing/route.ts              |  40 ++
 app/api/clients/route.ts                      |  35 ++
 .../members/invite/__tests__/route.test.ts    |  78 ++-
 app/api/company/members/invite/route.ts       |  15 +-
 .../reminders/action/__tests__/route.test.ts  |  32 ++
 app/api/invoices/reminders/action/route.ts    |  12 +
 .../payslips/send/__tests__/route.test.ts     |  50 ++
 .../salary/runs/[id]/payslips/send/route.ts   |  10 +-
 app/api/team/accept/__tests__/route.test.ts   | 187 ++++++-
 app/api/team/accept/route.ts                  | 187 ++++++-
 .../team/invite/[id]/__tests__/route.test.ts  | 246 ++++++++
 app/api/team/invite/[id]/route.ts             | 179 +++++-
 app/api/team/invite/__tests__/route.test.ts   | 326 +++++++++++
 app/api/team/invite/route.ts                  | 219 +++++++-
 .../team/members/[id]/__tests__/route.test.ts | 241 ++++++++
 app/api/team/members/[id]/route.ts            | 225 +++++++-
 app/api/team/members/__tests__/route.test.ts  | 220 ++++++++
 app/api/team/members/route.ts                 | 115 +++-
 app/api/v1/companies/__tests__/create.test.ts |  32 ++
 app/api/v1/companies/route.ts                 |  15 +-
 app/companies/new-client/page.tsx             |  42 ++
 app/companies/new/page.tsx                    |  18 +-
 app/layout.tsx                                | 157 +++++-
 app/manifest.ts                               |  16 +-
 components/bokslut/AnnualReportStudio.tsx     |   4 +-
 components/bookkeeping/ChartOfAccounts.tsx    |   4 +
 components/bookkeeping/DocumentViewButton.tsx |   4 +-
 .../bookkeeping/JournalEntryAttachments.tsx   |   4 +-
 components/branding/BrandHomeLink.tsx         |  61 ++
 components/branding/BrandWordmark.tsx         |  38 +-
 components/branding/SourceCodeFooter.tsx      |  30 +
 components/byra/ByraKpiView.tsx               | 373 +++++++++++++
 components/dashboard/CompanySwitcher.tsx      |  26 +-
 components/dashboard/CompanyTabSync.tsx       | 244 ++++++--
 components/dashboard/DashboardNav.tsx         | 171 ++++--
 components/dashboard/HomeDomainSignpost.tsx   | 103 ++++
 components/dashboard/NoticeLines.tsx          |   6 +-
 components/dashboard/UserMenu.tsx             | 131 +++--
 .../extensions/general/CalendarWorkspace.tsx  |   5 +
 .../general/InboxCustomDomainDialog.tsx       |   8 +-
 .../general/InvoiceInboxWorkspace.tsx         |   4 +-
 .../invoices/InvoiceDeliveryHistory.tsx       |   4 +-
 components/invoices/InvoiceEditor.tsx         |   4 +-
 .../onboarding/journey/OnboardingJourney.tsx  |  11 +-
 components/salary/OpeningBalancesPanel.tsx    |   6 +-
 components/settings/ActiveCompanyBadge.tsx    |   8 +-
 components/settings/InstallAppSection.tsx     |  10 +-
 components/settings/SettingsModal.tsx         |  12 +-
 components/settings/SettingsRail.tsx          |  14 +-
 components/settings/SettingsRows.tsx          | 189 ++++++-
 .../settings/SkatteverketConnectPanel.tsx     |   6 +-
 components/settings/TeamPanel.tsx             | 524 +++++++++++++++---
 .../__tests__/members-payload.test.ts         |  44 +-
 components/settings/members-payload.ts        |  27 +-
 .../sections/BankingSettingsContent.tsx       |   4 +-
 .../sections/BillingSettingsContent.tsx       |  41 +-
 .../sections/BrandSettingsContent.tsx         | 284 ++++++++++
 components/settings/sections/index.ts         |  10 +
 components/settings/useSettingsNavItems.ts    |  29 +-
 .../TransactionAttachmentIndicator.tsx        |   4 +-
 contexts/CompanyContext.tsx                   |  25 +
 .../components/CloudBackupCard.tsx            |   7 +-
 .../email/__tests__/resend-service.test.ts    |  78 ++-
 .../general/email/lib/resend-service.ts       |  23 +-
 .../__tests__/create-company.test.ts          |  20 +
 extensions/general/mcp-server/server.ts       |  17 +-
 lib/api/schemas.ts                            |  10 +
 lib/branding/__tests__/brand-style.test.ts    | 147 +++++
 lib/branding/__tests__/fonts.test.ts          |  33 ++
 lib/branding/__tests__/public-brand.test.ts   |  85 +++
 lib/branding/__tests__/resolve.test.ts        | 235 ++++++++
 lib/branding/brand-context.tsx                |  44 ++
 lib/branding/brand-style.ts                   | 211 +++++++
 lib/branding/fonts.ts                         |  70 +++
 lib/branding/public-brand.ts                  |  69 +++
 lib/branding/request-brand.ts                 |  50 ++
 lib/branding/resolve.ts                       | 338 +++++++++++
 lib/branding/team-brands.ts                   |  88 +++
 lib/byra/__tests__/kpi-aggregate.test.ts      | 185 +++++++
 lib/byra/brand-access.ts                      |  41 ++
 lib/byra/kpi-aggregate.ts                     | 224 ++++++++
 lib/byra/kpi-overview.ts                      | 299 ++++++++++
 lib/clients/__tests__/aggregate.test.ts       | 215 +++++++
 lib/clients/aggregate.ts                      | 131 +++++
 lib/clients/fetch-client-overview.ts          | 253 +++++++++
 lib/company/__tests__/actions.test.ts         |  90 +++
 lib/company/__tests__/context.test.ts         |  13 +-
 lib/company/__tests__/home-domain.test.ts     | 182 ++++++
 lib/company/__tests__/tab-guard.test.ts       | 246 ++++++++
 lib/company/actions.ts                        |  25 +
 lib/company/context.ts                        |  18 +
 lib/company/home-domain.ts                    | 117 ++++
 lib/company/post-login-landing.ts             |  26 +
 lib/company/switch-client.ts                  |  57 +-
 lib/company/tab-guard.ts                      | 219 ++++++++
 .../__snapshots__/auth-templates.test.ts.snap |  97 ++++
 .../brand-mail-snapshots.test.ts.snap         | 336 +++++++++++
 lib/email/__tests__/auth-templates.test.ts    |  82 +++
 .../__tests__/brand-mail-snapshots.test.ts    | 264 +++++++++
 lib/email/__tests__/brand-sender.test.ts      | 112 ++++
 lib/email/__tests__/standard-webhook.test.ts  | 128 +++++
 lib/email/auth-templates.ts                   | 176 ++++++
 lib/email/brand-sender.ts                     |  79 +++
 lib/email/invite-templates.ts                 |  53 +-
 lib/email/send-team-invite.ts                 |  73 +++
 lib/email/service.ts                          |   7 +
 lib/email/standard-webhook.ts                 |  78 +++
 lib/entitlements/team-agreement.ts            |  64 +++
 .../__tests__/invoice-deliveries.test.ts      |  61 ++
 .../reminder-processor-payment-gate.test.ts   |   4 +
 .../__tests__/reminder-processor.test.ts      | 107 +++-
 lib/invoices/invoice-deliveries.ts            |  10 +
 lib/invoices/reminder-processor.ts            |  12 +-
 lib/supabase/__tests__/middleware.test.ts     | 276 ++++++++-
 lib/supabase/middleware.ts                    | 227 ++++++++
 messages/en.json                              | 195 ++++++-
 messages/sv.json                              | 195 ++++++-
 next.config.ts                                |  26 +
 ...0826130000_sie_rpc_pre_request_timeout.sql |  43 ++
 ...eams_kind_and_deterministic_attachment.sql | 225 ++++++++
 supabase/migrations/20260826130200_brands.sql |  83 +++
 ...0300_suppress_trial_for_byra_companies.sql |  51 ++
 ...yra_client_company_creation_admin_gate.sql | 105 ++++
 .../20260826130500_brands_favicon_url.sql     |  15 +
 ...0600_byra_gate_create_company_for_user.sql | 111 ++++
 tests/pg/brands.pg.test.ts                    | 237 ++++++++
 .../byra-client-company-creation.pg.test.ts   | 255 +++++++++
 ...s-kind-deterministic-attachment.pg.test.ts | 345 ++++++++++++
 tests/pg/trial-suppression-byra.pg.test.ts    | 140 +++++
 tests/schema/no-phantom-columns.test.ts       |  13 +-
 types/index.ts                                |   5 +-
 160 files changed, 15125 insertions(+), 504 deletions(-)
 create mode 100644 CONTEXT.md
 create mode 100644 app/(dashboard)/byra/automations/page.tsx
 create mode 100644 app/(dashboard)/byra/kpi/page.tsx
 create mode 100644 app/(dashboard)/byra/page.tsx
 create mode 100644 app/(dashboard)/clients/ClientsTable.tsx
 create mode 100644 app/(dashboard)/clients/NewClientCompanyButton.tsx
 create mode 100644 app/(dashboard)/clients/page.tsx
 create mode 100644 app/(dashboard)/settings/brand/page.tsx
 create mode 100644 app/api/auth/email-hook/__tests__/route.test.ts
 create mode 100644 app/api/auth/email-hook/route.ts
 create mode 100644 app/api/byra/brand/__tests__/route.test.ts
 create mode 100644 app/api/byra/brand/logo/__tests__/route.test.ts
 create mode 100644 app/api/byra/brand/logo/route.ts
 create mode 100644 app/api/byra/brand/route.ts
 create mode 100644 app/api/clients/__tests__/route.test.ts
 create mode 100644 app/api/clients/landing/route.ts
 create mode 100644 app/api/clients/route.ts
 create mode 100644 app/api/team/invite/[id]/__tests__/route.test.ts
 create mode 100644 app/api/team/invite/__tests__/route.test.ts
 create mode 100644 app/api/team/members/[id]/__tests__/route.test.ts
 create mode 100644 app/api/team/members/__tests__/route.test.ts
 create mode 100644 app/companies/new-client/page.tsx
 create mode 100644 components/branding/BrandHomeLink.tsx
 create mode 100644 components/branding/SourceCodeFooter.tsx
 create mode 100644 components/byra/ByraKpiView.tsx
 create mode 100644 components/dashboard/HomeDomainSignpost.tsx
 create mode 100644 components/settings/sections/BrandSettingsContent.tsx
 create mode 100644 lib/branding/__tests__/brand-style.test.ts
 create mode 100644 lib/branding/__tests__/fonts.test.ts
 create mode 100644 lib/branding/__tests__/public-brand.test.ts
 create mode 100644 lib/branding/__tests__/resolve.test.ts
 create mode 100644 lib/branding/brand-context.tsx
 create mode 100644 lib/branding/brand-style.ts
 create mode 100644 lib/branding/fonts.ts
 create mode 100644 lib/branding/public-brand.ts
 create mode 100644 lib/branding/request-brand.ts
 create mode 100644 lib/branding/resolve.ts
 create mode 100644 lib/branding/team-brands.ts
 create mode 100644 lib/byra/__tests__/kpi-aggregate.test.ts
 create mode 100644 lib/byra/brand-access.ts
 create mode 100644 lib/byra/kpi-aggregate.ts
 create mode 100644 lib/byra/kpi-overview.ts
 create mode 100644 lib/clients/__tests__/aggregate.test.ts
 create mode 100644 lib/clients/aggregate.ts
 create mode 100644 lib/clients/fetch-client-overview.ts
 create mode 100644 lib/company/__tests__/home-domain.test.ts
 create mode 100644 lib/company/__tests__/tab-guard.test.ts
 create mode 100644 lib/company/home-domain.ts
 create mode 100644 lib/company/post-login-landing.ts
 create mode 100644 lib/company/tab-guard.ts
 create mode 100644 lib/email/__tests__/__snapshots__/auth-templates.test.ts.snap
 create mode 100644 lib/email/__tests__/__snapshots__/brand-mail-snapshots.test.ts.snap
 create mode 100644 lib/email/__tests__/auth-templates.test.ts
 create mode 100644 lib/email/__tests__/brand-mail-snapshots.test.ts
 create mode 100644 lib/email/__tests__/brand-sender.test.ts
 create mode 100644 lib/email/__tests__/standard-webhook.test.ts
 create mode 100644 lib/email/auth-templates.ts
 create mode 100644 lib/email/brand-sender.ts
 create mode 100644 lib/email/send-team-invite.ts
 create mode 100644 lib/email/standard-webhook.ts
 create mode 100644 lib/entitlements/team-agreement.ts
 create mode 100644 supabase/migrations/20260826130000_sie_rpc_pre_request_timeout.sql
 create mode 100644 supabase/migrations/20260826130100_teams_kind_and_deterministic_attachment.sql
 create mode 100644 supabase/migrations/20260826130200_brands.sql
 create mode 100644 supabase/migrations/20260826130300_suppress_trial_for_byra_companies.sql
 create mode 100644 supabase/migrations/20260826130400_byra_client_company_creation_admin_gate.sql
 create mode 100644 supabase/migrations/20260826130500_brands_favicon_url.sql
 create mode 100644 supabase/migrations/20260826130600_byra_gate_create_company_for_user.sql
 create mode 100644 tests/pg/brands.pg.test.ts
 create mode 100644 tests/pg/byra-client-company-creation.pg.test.ts
 create mode 100644 tests/pg/teams-kind-deterministic-attachment.pg.test.ts
 create mode 100644 tests/pg/trial-suppression-byra.pg.test.ts

diff --git a/CONTEXT.md b/CONTEXT.md
new file mode 100644
index 00000000..0ae97f37
--- /dev/null
+++ b/CONTEXT.md
@@ -0,0 +1,44 @@
+# Accounted
+
+Swedish accounting SaaS: double-entry bookkeeping under Bokföringslagen for sole traders and limited companies, sold directly and (from 2026) resold white-label by accounting firms under their own brand.
+
+## Language
+
+### White label
+
+**Brand**:
+The host-resolved white-label identity: one row per partner domain carrying app name, logo, palette, font, and email sender identity. Owned by a byrå team; a request's Host header resolves to at most one brand, and no match means the default Accounted appearance.
+_Avoid_: Tenant (already means company-level multi-tenancy here), theme, skin
+
+**Byrå team**:
+A team that represents an accounting firm: named, multi-member, invitable, the anchor for brand ownership, client companies, and billing.
+_Avoid_: Agency, firm team
+
+**Personal team**:
+The silent auto-created team every user gets (`ensure_user_team()`); an implementation detail of company ownership, never a byrå.
+
+**Partner**:
+Prose word for the commercial relationship: a byrå with an agreement and usually a brand. Not an entity in the schema.
+
+**Canonical domain**:
+app.accounted.se (and legacy app.gnubok.se): the domains carrying the default Accounted brand, external OAuth flows, and cron entry points.
+
+**Home domain**:
+The one domain a company is opened and worked in: its byrå's brand domain if the company's team has a brand, else the canonical domain. Everywhere else the UI shows a signpost to the home domain, never the company. A navigation rule, not a security boundary: access is still governed solely by company membership and RLS.
+
+**Signpost**:
+The screen shown when a logged-in user's company lives on a different host ("Kalles Bygg AB hanteras via app.siffra.se"), with a link there. Never a silent redirect: sessions are per domain, so the user must log in again on the home domain.
+
+**Umbrella subdomain**:
+A brand domain hosted under our own zone (siffra.accounted.se): the starter shape, zero partner DNS work. A custom domain (app.siffra.se) is the upgrade; the brand model treats both as the same single hostname.
+
+**Invoice branding**:
+The per-company logo and colors printed on that company's customer invoices. Unrelated to a byrå brand; never shorten to "branding".
+_Avoid_: Branding (unqualified)
+
+**Brand color**:
+The single partner-supplied color a brand is themed from: primary buttons, focus rings, links, and active nav take it directly; the chrome (frame and sidebar) is derived from it unless the partner explicitly overrides the chrome color. Semantic colors (success, warning, destructive) never follow it.
+
+**Cockpit**:
+The byrå dashboard: the read-first client overview for byrå staff, aggregating status across all client companies. Acting on a client happens inside the client after a switch (or via the agent path); the cockpit itself never writes to client books.
+_Avoid_: Byrå portal, partner dashboard
diff --git a/DECISIONS.md b/DECISIONS.md
index 9e2e8240..8e31ad8b 100644
--- a/DECISIONS.md
+++ b/DECISIONS.md
@@ -746,6 +746,28 @@ One line per decision: `[YYYY-MM-DD] <decision>: <why>`. Appended by agents and
 [2026-08-01] MCP page offsets are declared as non-negative integers and defensively floored before PostgREST range calls: fractional offsets cannot name a stable row boundary and can produce invalid range bounds when execution bypasses schema validation.
 
 [2026-08-01] Paginated MCP invoice tools fetch one lookahead row and use it when Supabase omits the exact count: returning a conservative next_offset avoids falsely declaring the current page terminal and silently truncating callers, while exact-count responses and page sizes remain unchanged.
+[2026-08-01] Brand sidebar re-tint via CSS selector (html[data-brand] .bg-frame > aside) instead of editing DashboardNav markup: element-level custom properties beat any :root/.dark specificity, DashboardNav stays untouched for the WL-02 deep-chrome light-text override, and default hosts get no selector at all (data-brand only stamped when a brand renders).
+[2026-08-01] SourceCodeFooter (WL-06) uses t.has('source_code') with a hardcoded sv/en fallback: the key lands in messages/*.json only in the wave-2 i18n merge (dev_docs/white-label/build/i18n-keys-branding.md), and rendering a raw key path on the login page in the interim was unacceptable.
+[2026-08-01] Mail slices (WL-13/WL-05): auth mail via the Send Email hook stays Swedish-only in lib/email/auth-templates.ts (Supabase's payload carries no recipient locale, and mail templates sit outside next-intl per .claude/rules/i18n.md); the reminder cron's env-less base-URL fallback moved from the literal app.erp-base.se to getBranding().appUrl (canonical NEXT_PUBLIC_APP_URL, identical whenever the env var is set, which prod always does).
+[2026-08-01] Cockpit landing (WL-14) decided at the login + mfa/verify pages via GET /api/clients/landing, not middleware or '/': a '/' redirect would break the soft switch's enter-client navigation (which targets '/'), middleware cannot afford brand+membership lookups per request, and a server action from /login is intercepted by the middleware's logged-in-user redirect; the fetch helper whitelists '/clients'|'/' and degrades to '/' so non-byrå flows stay byte-identical.
+[2026-08-01] Home-domain signpost gate (WL-01) lives in the dashboard layout, not middleware: the layout already has memberships + one cached brand query, middleware on Edge would pay brand lookups on every request, and the middleware active-company write-back is host-agnostic by design (navigation rule, not security); /settings/account and /clients stay reachable through the gate.
+[2026-08-01] Soft switch (WL-09) keeps a full-page load but to the TARGET page (performCompanySwitch destination param): the hard navigation is the deliberate cross-company leak-wipe (React state, router cache, in-flight fetches); soft client routing would need auditing every company-scoped cache and was explicitly allowed to stay a reload by the resolution as long as no start-page bounce remains.
+[2026-08-01] Tab-guard mutation seam (WL-09): window.fetch wrapped while the dashboard shell is mounted, guarding mutating same-origin /api requests only; there is no shared client fetch helper in the codebase to wrap, server actions POST to page routes (the blocking dialog covers them), and browser-direct Supabase mutations are already required to be server-routed per project rule.
+[2026-08-01] Byrå creation gate (WL-15) enforced in create_company_with_owner itself (migration 20260804113000) plus a readable-error precheck in createCompanyFromOnboarding: the RPC is SECURITY DEFINER and EXECUTE-granted to authenticated, so any app-level-only gate is bypassable via PostgREST.
+[2026-08-01] Phantom-columns unresolvable ceiling raised 360 -> 370 (count 361 after the white-label waves): no single wave file introduced an identifiable rewritable dynamic expression (the wave-window files' unresolved entries all predate the build), so the guard's own escape hatch (raise with documented reason) beats speculative refactors of working query code.
+[2026-08-01] appName sweep (WL-12 A4) left 5 literal classes as "Accounted": arsredovisning direktinlamning copy + DigitalInlamning personnummer note (statutory filing surface, the Bolagsverket agreement holder is legal identity), llms.txt + connect-claude docs + v1 API doc strings (API/MCP identity per the map's out-of-scope list), and Accounted:-prefixed storage keys/event names (wire format). When in doubt the sweep left it and reported, per WL-12.
+[2026-08-01] Tab-guard server-action seam (gap-fix): verified next@16.2.12 invokes client server actions via the bare global fetch (server-action-reducer.js) so the patched window.fetch DOES see them; the guard now blocks mutating action POSTs on mismatch, with the company-switch action allowed through via a markCompanySwitchInFlight flag (action ids are opaque per-build hashes, so a flag around the one sanctioned call beats id matching); blocking it would deadlock the dialog's own "switch back" exit.
+[2026-08-01] Browser-direct Supabase writes (gap-fix): exactly 3 sites existed (invoice status, SRU code, calendar deadlines); all routed through guardBrowserWrite() returning boolean instead of throwing, so call sites stay one-line and the blocking dialog (not a toast) is the user feedback. The guardStore moved from CompanyTabSync module scope into lib/company/tab-guard.ts so write sites share the same belief without React context threading.
+[2026-08-01] team/members/[id] uses withRouteContext without requireWrite: requireWrite gates on the ACTIVE COMPANY role, the wrong dimension for a team-scoped mutation (a byra owner may have any company active); the team owner/admin check in the handler is the authorization. Error bodies stay the team-family plain-string shape ({ error: string }) for consistency with the sibling invite/accept/members routes and their shared client parsing.
+[2026-08-01] Dark-mode ring lift (gap-fix, WL-02): lift threshold L < 45%, target L 62% (inside the prototype's 60-65% band); dark-mode --primary-foreground flips to near-black when white loses 4.5:1 on the lifted tone (the onboarding gate only guarantees white on the STORED color). Light-enough brands keep byte-identical dark blocks.
+[2026-08-01] Curated font menu (gap-fix, WL-03): lora/fraunces/playfair with Source Sans 3/Work Sans/Public Sans bodies, all Google Fonts OFL, no new npm deps (next/font/google is built-in); registered preload:false so menu fonts cost nothing on default hosts.
+[2026-08-04] SIE timeout fix via pgrst.db_pre_request hook, not ALTER FUNCTION SET statement_timeout: proved empirically that function-scoped statement_timeout never re-arms the already-running statement's timer (the 20260629160100/20260721144311 fixes were no-ops); pre-request runs as its own statement before the main query so set_config there works. Chose path-scoped hook over chunked import (smaller, fixes all three SIE RPCs at once, keeps 8s for everything else).
+[2026-08-04] Byra Nyckeltal v1 (WL-16) fetches per-client KPI via N parallel get_kpi_report_aggregates calls, not a new uuid[] RPC: zero migrations on the white-label branch and fine at the ~10-client byra scale; an array RPC is the scale path past ~15 clients. Cross-client comparison axis is CALENDAR months (clients have different fiscal years); cash/VAT are as-of the current fiscal period, never range-filtered.
+[2026-08-04] Byra brand self-service (WL-17) limited to the LOGO and APP NAME: domain and colors stay ops-managed (white-glove decision stands; a broken byra-set color/domain could brick their cockpit). brands has no write RLS by design, so writes go through /api/byra/brand/logo with service client + explicit owner/admin check, files under logos/byra/{teamId}/. Sidebar label beside the logo = app_name, byra-editable via PATCH /api/byra/brand (Emil re-decided from domain-prefix same day).
+[2026-08-04] Byra landing uses a session cookie (gnubok-company-picked), not a DB flag: middleware writes the fallback company back to user_preferences on first request, so the DB cannot distinguish picked from auto-picked.
+[2026-08-04] Brand COLOR theming removed from the request path (founder call): white-label = logo + app name + domain only, every host keeps the standard monochrome theme. buildBrandVarsCss, the WCAG gate and brands.brand_color/chrome_color stay in the codebase dormant for a future opt-in; the layout no longer stamps data-brand or renders brand-vars CSS.
+[2026-08-05] User-level home-domain affinity = middleware redirect (not signpost): byrå members bounce to their brand domain, brandless users bounce off brand domains to the platform URL; founder chose redirect knowing sessions are per-domain (one extra login at the right branded login). WL-01 signpost stays for per-company homing inside a domain.
+
 [2026-08-03] Issue #563 automatic bank and skattekonto sync resolves company and firm capability grants in bulk before applying the 50-item run cap: limiting raw connection rows first let 50 expired trials permanently starve paying companies. Kept this in the shared TypeScript entitlement layer instead of adding a scheduling RPC or migration because the existing grant, expiry, and explicit-disable semantics already live there and no schema change is required.
 [2026-08-01] Out-of-order SIE IB activity is bounded by the target fiscal-period end, not its start: this excludes later-first imports while preserving same-period continuation suppression; successor IB resync checks the current error state plus a real target-period entry because result.success is finalized later, keeping replacement on a new engine voucher plus storno without letting a no-op import succeed through resync alone.
 [2026-08-01] Successor SIE IB replacement uses a specialized engine RPC instead of loosening the owner-only generic relink RPC: non-viewer members and scoped service-role imports are supported, while one period-row lock and expected-pointer CAS make the replacement voucher, storno, reversal status, pointer swap, and voucher sequence increments commit or roll back together.
diff --git a/app/(auth)/login/login-client.tsx b/app/(auth)/login/login-client.tsx
index 38bb766f..b020df49 100644
--- a/app/(auth)/login/login-client.tsx
+++ b/app/(auth)/login/login-client.tsx
@@ -25,9 +25,11 @@ import {
 import { BrandWordmark } from '@/components/branding/BrandWordmark'
 import { getErrorMessage, type ErrorLocale } from '@/lib/errors/get-error-message'
 import { isBankIdEnabled } from '@/lib/auth/bankid-flags'
-import { getBranding } from '@/lib/branding/service'
+import { useBranding } from '@/lib/branding/brand-context'
+import { SourceCodeFooter } from '@/components/branding/SourceCodeFooter'
 import { detectWebmailHint } from '@/lib/auth/webmail-search'
 import { safeReturnTo } from '@/lib/auth/safe-return-to'
+import { resolvePostLoginDestination } from '@/lib/company/post-login-landing'
 import {
   consumeInviteCookie,
   INVITE_PROBLEM_MESSAGE_KEYS,
@@ -53,7 +55,6 @@ import {
   type SessionTimeoutReason,
 } from '@/lib/auth/session-timeout-shared'
 
-const branding = getBranding()
 import type { BankIdResult } from '@/components/auth/BankIdAuth'
 
 const BankIdAuth = dynamic(
@@ -111,6 +112,9 @@ export function LoginClient({ initialMethod }: { initialMethod: LoginMethod | nu
   const registerHref = nextPath === '/' ? '/register' : `/register?next=${encodeURIComponent(nextPath)}`
   const supabase = createClient()
   const bankIdEnabled = isBankIdEnabled()
+  // Per-request brand merged over getBranding() defaults (WL-12): identical
+  // values on default hosts, brand values on branded hosts.
+  const branding = useBranding()
   const googleAuthEnabled = isGoogleAuthEnabled()
   const tAuth = useTranslations('auth')
   const tCommon = useTranslations('common')
@@ -330,7 +334,10 @@ export function LoginClient({ initialMethod }: { initialMethod: LoginMethod | nu
         return
       }
 
-      router.push('/')
+      // Byrå staff land in the cockpit on their byrå's home domain (WL-14);
+      // everyone else resolves to '/' and keeps today's flow byte-identically
+      // (any failure inside the helper also degrades to '/').
+      router.push(await resolvePostLoginDestination())
       router.refresh()
     } catch (error) {
       setFormError({
@@ -784,15 +791,32 @@ export function LoginClient({ initialMethod }: { initialMethod: LoginMethod | nu
 
         <p className="mt-3 text-center text-xs text-muted-foreground/80 leading-relaxed">
           {tAuth('terms_prefix')}{' '}
-          <a href="#" className="underline underline-offset-2 hover:text-foreground transition-colors">
+          {/* The platform's terms live on the marketing site; the privacy
+              policy is the in-app /privacy page (host-relative, so it works
+              on branded byrå domains too). New tab: don't lose login state. */}
+          <a
+            href="https://accounted.se/terms"
+            target="_blank"
+            rel="noopener noreferrer"
+            className="underline underline-offset-2 hover:text-foreground transition-colors"
+          >
             {tAuth('terms_link')}
           </a>{' '}
           {tAuth('terms_and')}{' '}
-          <a href="#" className="underline underline-offset-2 hover:text-foreground transition-colors">
+          <a
+            href="/privacy"
+            target="_blank"
+            rel="noopener noreferrer"
+            className="underline underline-offset-2 hover:text-foreground transition-colors"
+          >
             {tAuth('privacy_link')}
           </a>
           .
         </p>
+
+        {/* AGPL section 13 source offer (WL-06): renders on both default and
+            branded hosts; never gate this on a brand. */}
+        <SourceCodeFooter className="mt-4" />
       </div>
     </div>
   )
diff --git a/app/(auth)/mfa/verify/page.tsx b/app/(auth)/mfa/verify/page.tsx
index 63b5e73f..c98f3b15 100644
--- a/app/(auth)/mfa/verify/page.tsx
+++ b/app/(auth)/mfa/verify/page.tsx
@@ -11,6 +11,7 @@ import { useToast } from '@/components/ui/use-toast'
 import { Loader2, ShieldCheck, LogOut } from 'lucide-react'
 import { SupportLink } from '@/components/ui/support-link'
 import { safeReturnTo } from '@/lib/auth/safe-return-to'
+import { resolvePostLoginDestination } from '@/lib/company/post-login-landing'
 import {
   consumeInviteCookie,
   INVITE_PROBLEM_MESSAGE_KEYS,
@@ -151,7 +152,12 @@ function MfaVerifyContent() {
         return
       }
 
-      router.push(returnTo)
+      // Hosted byrå staff hit MFA before any dashboard, so the cockpit
+      // landing (WL-14) resolves here too: only when no explicit step-up
+      // destination was requested. Everyone else keeps returnTo/'/' exactly
+      // as before (the helper degrades to '/' on any failure). The session
+      // is AAL2 at this point, so the /api MFA gate passes.
+      router.push(returnTo === '/' ? await resolvePostLoginDestination() : returnTo)
       router.refresh()
     } catch {
       toast({
diff --git a/app/(auth)/register/page.tsx b/app/(auth)/register/page.tsx
index 596e767a..0c47eca2 100644
--- a/app/(auth)/register/page.tsx
+++ b/app/(auth)/register/page.tsx
@@ -16,7 +16,7 @@ import { BrandWordmark } from '@/components/branding/BrandWordmark'
 import { getErrorMessage, type ErrorLocale } from '@/lib/errors/get-error-message'
 import { isBankIdEnabled } from '@/lib/auth/bankid-flags'
 import type { BankIdResult } from '@/components/auth/BankIdAuth'
-import { getBranding } from '@/lib/branding/service'
+import { useBranding } from '@/lib/branding/brand-context'
 import { detectWebmailHint } from '@/lib/auth/webmail-search'
 import {
   consumeInviteCookie,
@@ -39,8 +39,6 @@ import { persistLoginMethodHint, type LoginMethod } from '@/lib/auth/login-metho
 import { safeReturnTo } from '@/lib/auth/safe-return-to'
 import { cn } from '@/lib/utils'
 
-const branding = getBranding()
-
 const BankIdAuth = dynamic(
   () => import('@/components/auth/BankIdAuth').then((module) => module.BankIdAuth),
   { ssr: false },
@@ -99,6 +97,9 @@ function RegisterPageContent() {
   const router = useRouter()
   const supabase = createClient()
   const bankIdEnabled = isBankIdEnabled()
+  // Per-request brand merged over getBranding() defaults (WL-12): identical
+  // values on default hosts, brand values on branded hosts.
+  const branding = useBranding()
   const googleAuthEnabled = isGoogleAuthEnabled()
   const t = useTranslations('register')
   const tAuth = useTranslations('auth')
@@ -861,11 +862,23 @@ function RegisterPageContent() {
 
         <p className="mt-3 text-center text-xs text-muted-foreground/80 leading-relaxed">
           {t('terms_prefix')}{' '}
-          <a href="#" className="underline underline-offset-2 hover:text-foreground transition-colors">
+          {/* Same targets as the login page: platform terms on the marketing
+              site, in-app /privacy (host-relative for branded domains). */}
+          <a
+            href="https://accounted.se/terms"
+            target="_blank"
+            rel="noopener noreferrer"
+            className="underline underline-offset-2 hover:text-foreground transition-colors"
+          >
             {t('terms_link')}
           </a>{' '}
           {t('terms_and')}{' '}
-          <a href="#" className="underline underline-offset-2 hover:text-foreground transition-colors">
+          <a
+            href="/privacy"
+            target="_blank"
+            rel="noopener noreferrer"
+            className="underline underline-offset-2 hover:text-foreground transition-colors"
+          >
             {t('privacy_link')}
           </a>
           .
diff --git a/app/(dashboard)/byra/automations/page.tsx b/app/(dashboard)/byra/automations/page.tsx
new file mode 100644
index 00000000..8fac7152
--- /dev/null
+++ b/app/(dashboard)/byra/automations/page.tsx
@@ -0,0 +1,60 @@
+import { redirect } from 'next/navigation'
+import { getTranslations } from 'next-intl/server'
+import { BellRing, ListChecks, Mail, PlugZap, Send, Wand2 } from 'lucide-react'
+import { PageHeader } from '@/components/ui/page-header'
+import { getByraMembership } from '@/lib/clients/fetch-client-overview'
+import { getDashboardAuthContext } from '../../request-context'
+
+export const dynamic = 'force-dynamic'
+
+/**
+ * Byrå cockpit: Automationer. Nothing is buildable yet; instead of a bare
+ * empty state the page shows the planned automation set (the byrå-tools
+ * research shortlist) so the surface sells the roadmap. All static: no
+ * per-card chips (same state on every card = no chip, design rule 5), one
+ * intro line carries the "coming" message.
+ */
+
+const CARDS = [
+  { key: 'digest', icon: Mail },
+  { key: 'deadlines', icon: BellRing },
+  { key: 'rules', icon: Wand2 },
+  { key: 'connections', icon: PlugZap },
+  { key: 'checklist', icon: ListChecks },
+  { key: 'reports', icon: Send },
+] as const
+
+export default async function ByraAutomationsPage() {
+  const { supabase, user } = await getDashboardAuthContext()
+  if (!user) {
+    redirect('/login')
+  }
+
+  const membership = await getByraMembership(supabase, user.id)
+  if (!membership) {
+    redirect('/')
+  }
+
+  const t = await getTranslations('byra')
+
+  return (
+    <div className="space-y-8">
+      <PageHeader title={t('automations_title')} />
+      <p className="max-w-2xl text-sm text-muted-foreground">{t('automations_intro')}</p>
+
+      <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 stagger-enter">
+        {CARDS.map(({ key, icon: Icon }) => (
+          <div key={key} className="rounded-lg border border-border p-6">
+            <Icon className="h-4 w-4 text-muted-foreground" />
+            <h2 className="mt-3 text-sm font-medium">{t(`automations_card_${key}_title`)}</h2>
+            <p className="mt-1 text-[13px] leading-5 text-muted-foreground">
+              {t(`automations_card_${key}_desc`)}
+            </p>
+          </div>
+        ))}
+      </div>
+
+      <p className="text-[13px] text-muted-foreground">{t('automations_footer')}</p>
+    </div>
+  )
+}
diff --git a/app/(dashboard)/byra/kpi/page.tsx b/app/(dashboard)/byra/kpi/page.tsx
new file mode 100644
index 00000000..f0c903f9
--- /dev/null
+++ b/app/(dashboard)/byra/kpi/page.tsx
@@ -0,0 +1,65 @@
+import { redirect } from 'next/navigation'
+import { getTranslations } from 'next-intl/server'
+import { TrendingUp } from 'lucide-react'
+import { PageHeader } from '@/components/ui/page-header'
+import { EmptyState } from '@/components/ui/empty-state'
+import { fetchByraKpiOverview } from '@/lib/byra/kpi-overview'
+import ByraKpiView from '@/components/byra/ByraKpiView'
+import { getDashboardAuthContext } from '../../request-context'
+
+export const dynamic = 'force-dynamic'
+
+/**
+ * Byrå cockpit: Nyckeltal (WL-16). Aggregated cross-client KPI view: period
+ * preset + company chips in the URL (shareable, server-refetched), summary
+ * tiles, merged monthly chart, and a sortable per-client table. Byrå team
+ * members only, like the rest of the cockpit.
+ */
+export default async function ByraKpiPage({
+  searchParams,
+}: {
+  searchParams: Promise<Record<string, string | string[] | undefined>>
+}) {
+  const { supabase, user } = await getDashboardAuthContext()
+  if (!user) {
+    redirect('/login')
+  }
+
+  const params = await searchParams
+  const period = typeof params.period === 'string' ? params.period : undefined
+  const companiesParam = typeof params.companies === 'string' ? params.companies : undefined
+  const companyIds = companiesParam
+    ? companiesParam.split(',').filter((id) => id.length > 0)
+    : undefined
+
+  const overview = await fetchByraKpiOverview(supabase, user.id, {
+    preset: period,
+    companyIds,
+  })
+  if (!overview) {
+    redirect('/')
+  }
+
+  const t = await getTranslations('byra')
+
+  return (
+    <div className="space-y-8">
+      <PageHeader title={t('kpi_title')} />
+      {overview.allClients.length === 0 ? (
+        <EmptyState
+          icon={TrendingUp}
+          title={t('kpi_empty_title')}
+          description={t('kpi_empty_description')}
+        />
+      ) : (
+        <ByraKpiView
+          preset={overview.preset}
+          allClients={overview.allClients}
+          selectedIds={overview.selectedIds}
+          rows={overview.rows}
+          months={overview.months}
+        />
+      )}
+    </div>
+  )
+}
diff --git a/app/(dashboard)/byra/page.tsx b/app/(dashboard)/byra/page.tsx
new file mode 100644
index 00000000..00aed779
--- /dev/null
+++ b/app/(dashboard)/byra/page.tsx
@@ -0,0 +1,117 @@
+import { redirect } from 'next/navigation'
+import { getTranslations } from 'next-intl/server'
+import { PageHeader } from '@/components/ui/page-header'
+import { Badge } from '@/components/ui/badge'
+import { cn, formatDate } from '@/lib/utils'
+import { TH_CLASS, TD_CLASS } from '@/components/ui/dry-table'
+import { fetchClientOverview } from '@/lib/clients/fetch-client-overview'
+import { getDashboardAuthContext } from '../request-context'
+
+export const dynamic = 'force-dynamic'
+
+/**
+ * Byrå cockpit home (Hem): the general overview the lean sidebar opens on.
+ * Aggregates the same client-overview data as /clients into a glance:
+ * client count, companies needing action, and the nearest deadline per
+ * client. Byrå team members only, like the rest of the cockpit.
+ */
+export default async function ByraHomePage() {
+  const { supabase, user } = await getDashboardAuthContext()
+  if (!user) {
+    redirect('/login')
+  }
+
+  const overview = await fetchClientOverview(supabase, user.id)
+  if (!overview) {
+    redirect('/')
+  }
+
+  const t = await getTranslations('byra')
+  const tClients = await getTranslations('clients')
+
+  const clients = overview.clients
+  const needsAction = clients.filter((c) => c.unbookedCount > 0 || c.inboxCount > 0).length
+  const urgentDeadlines = clients.filter(
+    (c) => c.nextDeadline && c.nextDeadline.urgency !== 'upcoming',
+  ).length
+
+  // One row per client with an open deadline, most urgent first.
+  const urgencyRank = { overdue: 0, action_needed: 1, upcoming: 2 } as const
+  const deadlineRows = clients
+    .filter((c) => c.nextDeadline)
+    .sort((a, b) => {
+      const rank = urgencyRank[a.nextDeadline!.urgency] - urgencyRank[b.nextDeadline!.urgency]
+      if (rank !== 0) return rank
+      return a.nextDeadline!.dueDate.localeCompare(b.nextDeadline!.dueDate)
+    })
+    .slice(0, 5)
+
+  const stats = [
+    { label: t('stats_clients'), value: clients.length },
+    { label: t('stats_attention'), value: needsAction },
+    { label: t('stats_deadlines'), value: urgentDeadlines },
+  ]
+
+  return (
+    <div className="space-y-8">
+      <PageHeader title={overview.team.name || t('home_title')} />
+
+      <div className="grid grid-cols-1 gap-4 sm:grid-cols-3">
+        {stats.map((stat) => (
+          <div key={stat.label} className="rounded-lg border border-border p-4">
+            <div className="text-xs text-muted-foreground">{stat.label}</div>
+            <div className="mt-1 font-display text-xl tabular-nums">{stat.value}</div>
+          </div>
+        ))}
+      </div>
+
+      <section className="space-y-4">
+        <h2 className="text-sm font-medium uppercase tracking-wider text-muted-foreground">
+          {t('deadlines_title')}
+        </h2>
+        {deadlineRows.length === 0 ? (
+          <p className="text-sm text-muted-foreground">{t('deadlines_empty')}</p>
+        ) : (
+          <div className="overflow-x-auto">
+            <table className="w-full border-collapse text-[13px]">
+              <thead>
+                <tr>
+                  <th className={TH_CLASS}>{tClients('col_company')}</th>
+                  <th className={TH_CLASS}>{tClients('col_next_deadline')}</th>
+                </tr>
+              </thead>
+              <tbody className="stagger-enter">
+                {deadlineRows.map((row) => (
+                  <tr key={row.companyId} className="transition-colors duration-150 hover:bg-secondary/35">
+                    <td className={cn(TD_CLASS, 'font-medium text-foreground')}>{row.name}</td>
+                    <td className={TD_CLASS}>
+                      <span className="flex items-center gap-2">
+                        {row.nextDeadline!.urgency === 'overdue' && (
+                          <Badge variant="destructive">{tClients('deadline_overdue')}</Badge>
+                        )}
+                        {row.nextDeadline!.urgency === 'action_needed' && (
+                          <Badge variant="warning">{tClients('deadline_action_needed')}</Badge>
+                        )}
+                        <span
+                          className={cn(
+                            'truncate',
+                            row.nextDeadline!.urgency === 'upcoming' && 'text-muted-foreground',
+                          )}
+                        >
+                          {row.nextDeadline!.title}
+                        </span>
+                        <span className="text-muted-foreground tabular-nums">
+                          {formatDate(row.nextDeadline!.dueDate)}
+                        </span>
+                      </span>
+                    </td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          </div>
+        )}
+      </section>
+    </div>
+  )
+}
diff --git a/app/(dashboard)/clients/ClientsTable.tsx b/app/(dashboard)/clients/ClientsTable.tsx
new file mode 100644
index 00000000..d1621386
--- /dev/null
+++ b/app/(dashboard)/clients/ClientsTable.tsx
@@ -0,0 +1,163 @@
+'use client'
+
+import { useMemo, useState } from 'react'
+import { useTranslations } from 'next-intl'
+import { Loader2, Search } from 'lucide-react'
+import { cn, formatDate } from '@/lib/utils'
+import { Badge } from '@/components/ui/badge'
+import { TH_CLASS, TD_CLASS } from '@/components/ui/dry-table'
+import { useToast } from '@/components/ui/use-toast'
+import { performCompanySwitch } from '@/lib/company/switch-client'
+import { filterClientRows, type ClientOverviewRow } from '@/lib/clients/aggregate'
+
+/**
+ * The cockpit client list (WL-14): dry-table, urgency-sorted server-side,
+ * free-text filter client-side. Entering a client is the WL-09 soft switch:
+ * sets the active company and lands DIRECTLY on that company's overview via
+ * performCompanySwitch (one full-page load to the target, no start-page
+ * bounce). The way back is the Klienter nav entry, which needs no switch.
+ */
+export default function ClientsTable({ clients }: { clients: ClientOverviewRow[] }) {
+  const t = useTranslations('clients')
+  const { toast } = useToast()
+  const [query, setQuery] = useState('')
+  const [pendingId, setPendingId] = useState<string | null>(null)
+
+  const rows = useMemo(() => filterClientRows(clients, query), [clients, query])
+
+  const handleEnter = async (companyId: string) => {
+    if (pendingId) return
+    setPendingId(companyId)
+    const result = await performCompanySwitch(companyId, { destination: '/' })
+    if (result?.error) {
+      setPendingId(null)
+      toast({ title: t('enter_failed'), variant: 'destructive' })
+    }
+  }
+
+  if (clients.length === 0) {
+    return (
+      <p className="text-sm text-muted-foreground">{t('empty')}</p>
+    )
+  }
+
+  return (
+    <div className="space-y-4">
+      <div className="flex items-center gap-2 max-w-xs rounded-lg border border-border px-3 py-2">
+        <Search className="h-3.5 w-3.5 flex-shrink-0 text-muted-foreground" />
+        <input
+          value={query}
+          onChange={(e) => setQuery(e.target.value)}
+          placeholder={t('filter_placeholder')}
+          aria-label={t('filter_placeholder')}
+          className="w-full bg-transparent text-[13px] text-foreground placeholder:text-muted-foreground/60 focus:outline-none"
+        />
+      </div>
+
+      <div className="overflow-x-auto">
+        <table className="w-full border-collapse text-[13px]">
+          <thead>
+            <tr>
+              <th className={TH_CLASS}>{t('col_company')}</th>
+              <th className={cn(TH_CLASS, 'text-right')}>{t('col_unbooked')}</th>
+              <th className={cn(TH_CLASS, 'text-right')}>{t('col_inbox')}</th>
+              <th className={TH_CLASS}>{t('col_next_deadline')}</th>
+              <th className={TH_CLASS}>{t('col_last_booked')}</th>
+            </tr>
+          </thead>
+          <tbody className="stagger-enter">
+            {rows.length === 0 && (
+              <tr>
+                <td className={cn(TD_CLASS, 'text-muted-foreground')} colSpan={5}>
+                  {t('no_matches')}
+                </td>
+              </tr>
+            )}
+            {rows.map((row) => (
+              <tr
+                key={row.companyId}
+                onClick={() => void handleEnter(row.companyId)}
+                className={cn(
+                  'cursor-pointer transition-colors duration-150 hover:bg-secondary/35',
+                  pendingId && pendingId !== row.companyId && 'opacity-50',
+                )}
+              >
+                <td className={TD_CLASS}>
+                  <button
+                    type="button"
+                    onClick={(e) => {
+                      e.stopPropagation()
+                      void handleEnter(row.companyId)
+                    }}
+                    disabled={pendingId !== null}
+                    className="flex items-center gap-2 text-left"
+                  >
+                    <span className="font-medium text-foreground">{row.name}</span>
+                    {row.orgNumber && (
+                      <span className="text-xs text-muted-foreground tabular-nums">
+                        {row.orgNumber}
+                      </span>
+                    )}
+                    {pendingId === row.companyId && (
+                      <Loader2 className="h-3.5 w-3.5 animate-spin text-muted-foreground" />
+                    )}
+                  </button>
+                </td>
+                <td className={cn(TD_CLASS, 'text-right tabular-nums')}>
+                  {row.unbookedCount > 0 ? (
+                    row.unbookedCount
+                  ) : (
+                    <span className="text-muted-foreground">0</span>
+                  )}
+                </td>
+                <td className={cn(TD_CLASS, 'text-right tabular-nums')}>
+                  {row.inboxCount > 0 ? (
+                    row.inboxCount
+                  ) : (
+                    <span className="text-muted-foreground">0</span>
+                  )}
+                </td>
+                <td className={TD_CLASS}>
+                  {row.nextDeadline ? (
+                    <span className="flex items-center gap-2">
+                      {/* Chips mark exceptions: only overdue/action_needed
+                          deviate; an ordinary upcoming deadline is muted text. */}
+                      {row.nextDeadline.urgency === 'overdue' && (
+                        <Badge variant="destructive">{t('deadline_overdue')}</Badge>
+                      )}
+                      {row.nextDeadline.urgency === 'action_needed' && (
+                        <Badge variant="warning">{t('deadline_action_needed')}</Badge>
+                      )}
+                      <span
+                        className={cn(
+                          'truncate',
+                          row.nextDeadline.urgency === 'upcoming' && 'text-muted-foreground',
+                        )}
+                      >
+                        {row.nextDeadline.title}
+                      </span>
+                      <span className="text-muted-foreground tabular-nums">
+                        {formatDate(row.nextDeadline.dueDate)}
+                      </span>
+                    </span>
+                  ) : (
+                    <span className="text-muted-foreground">-</span>
+                  )}
+                </td>
+                <td className={cn(TD_CLASS, 'tabular-nums')}>
+                  {row.lastBookedDate ? (
+                    <span className="text-muted-foreground">
+                      {formatDate(row.lastBookedDate)}
+                    </span>
+                  ) : (
+                    <span className="text-muted-foreground">{t('never_booked')}</span>
+                  )}
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      </div>
+    </div>
+  )
+}
diff --git a/app/(dashboard)/clients/NewClientCompanyButton.tsx b/app/(dashboard)/clients/NewClientCompanyButton.tsx
new file mode 100644
index 00000000..1c7fc8fd
--- /dev/null
+++ b/app/(dashboard)/clients/NewClientCompanyButton.tsx
@@ -0,0 +1,61 @@
+'use client'
+
+import { useState } from 'react'
+import { useRouter } from 'next/navigation'
+import { useTranslations } from 'next-intl'
+import { Plus } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog'
+
+/**
+ * "Nytt klientbolag" (WL-15): header primary action on the cockpit, rendered
+ * only for byrå owner/admin (the page checks; the create RPC enforces the
+ * same gate in the database). Confirm up front (design convention 10): the
+ * dialog states that the company is added to the byrå's agreement (+1 on the
+ * monthly invoice) BEFORE routing into today's company creation flow with
+ * the explicit byrå team binding (/companies/new-client).
+ */
+export default function NewClientCompanyButton() {
+  const t = useTranslations('clients')
+  const router = useRouter()
+  const [open, setOpen] = useState(false)
+  const [navigating, setNavigating] = useState(false)
+
+  return (
+    <>
+      <Button onClick={() => setOpen(true)}>
+        <Plus className="mr-2 h-4 w-4" />
+        {t('new_client_company')}
+      </Button>
+      <Dialog open={open} onOpenChange={setOpen}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>{t('new_client_company')}</DialogTitle>
+            <DialogDescription>{t('added_to_agreement')}</DialogDescription>
+          </DialogHeader>
+          <DialogFooter>
+            <Button variant="outline" onClick={() => setOpen(false)} disabled={navigating}>
+              {t('cancel')}
+            </Button>
+            <Button
+              disabled={navigating}
+              onClick={() => {
+                setNavigating(true)
+                router.push('/companies/new-client')
+              }}
+            >
+              {t('continue')}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </>
+  )
+}
diff --git a/app/(dashboard)/clients/page.tsx b/app/(dashboard)/clients/page.tsx
new file mode 100644
index 00000000..c220749f
--- /dev/null
+++ b/app/(dashboard)/clients/page.tsx
@@ -0,0 +1,42 @@
+import { redirect } from 'next/navigation'
+import { getTranslations } from 'next-intl/server'
+import { PageHeader } from '@/components/ui/page-header'
+import { fetchClientOverview } from '@/lib/clients/fetch-client-overview'
+import { getDashboardAuthContext } from '../request-context'
+import ClientsTable from './ClientsTable'
+import NewClientCompanyButton from './NewClientCompanyButton'
+
+export const dynamic = 'force-dynamic'
+
+/**
+ * Byrå cockpit: the client list (WL-14). Five urgency-sorted columns per
+ * client company; byrå team members only: everyone else is redirected to the
+ * dashboard (the API mirrors this with 403). Read-first (WL-09): this page
+ * only aggregates; acting on a client happens by jumping in, which switches
+ * the active company.
+ */
+export default async function ClientsPage() {
+  const { supabase, user } = await getDashboardAuthContext()
+  if (!user) {
+    redirect('/login')
+  }
+
+  const overview = await fetchClientOverview(supabase, user.id)
+  if (!overview) {
+    // Not a byrå team member: the cockpit is byrå-exclusive in v1.
+    redirect('/')
+  }
+
+  const t = await getTranslations('clients')
+  const canCreate = overview.role === 'owner' || overview.role === 'admin'
+
+  return (
+    <div className="space-y-8">
+      <PageHeader
+        title={t('title')}
+        action={canCreate ? <NewClientCompanyButton /> : undefined}
+      />
+      <ClientsTable clients={overview.clients} />
+    </div>
+  )
+}
diff --git a/app/(dashboard)/extensions/[sector]/[extension]/page.tsx b/app/(dashboard)/extensions/[sector]/[extension]/page.tsx
index f7f6de3f..783726ec 100644
--- a/app/(dashboard)/extensions/[sector]/[extension]/page.tsx
+++ b/app/(dashboard)/extensions/[sector]/[extension]/page.tsx
@@ -9,6 +9,7 @@ import {
   sectorNameKey,
 } from '@/lib/extensions/i18n'
 import type { SectorSlug } from '@/lib/extensions/types'
+import { getRequestAppName } from '@/lib/branding/request-brand'
 import CategoryBadge from '@/components/extensions/CategoryBadge'
 import { WORKSPACES } from '@/lib/extensions/_generated/workspace-map'
 import { Button } from '@/components/ui/button'
@@ -27,13 +28,16 @@ export default async function ExtensionDetailPage({
   const sector = getSector(sectorSlug as SectorSlug)
 
   const t = await getTranslations('extensions')
+  // Some long descriptions carry the {appName} ICU parameter (WL-12 appName
+  // sweep); passing it unconditionally is harmless for messages without it.
+  const appName = await getRequestAppName()
 
   const nameKey = extensionNameKey(definition.slug)
   const descriptionKey = extensionDescriptionKey(definition.slug)
   const longDescriptionKey = extensionLongDescriptionKey(definition.slug)
   const extensionName = nameKey ? t(nameKey) : definition.name
-  const extensionDescription = descriptionKey ? t(descriptionKey) : definition.description
-  const extensionLongDescription = longDescriptionKey ? t(longDescriptionKey) : definition.longDescription
+  const extensionDescription = descriptionKey ? t(descriptionKey, { appName }) : definition.description
+  const extensionLongDescription = longDescriptionKey ? t(longDescriptionKey, { appName }) : definition.longDescription
 
   const sectorLabel = (() => {
     if (!sector) return sectorSlug
diff --git a/app/(dashboard)/invoices/[id]/page.tsx b/app/(dashboard)/invoices/[id]/page.tsx
index 287954df..019bffaf 100644
--- a/app/(dashboard)/invoices/[id]/page.tsx
+++ b/app/(dashboard)/invoices/[id]/page.tsx
@@ -6,6 +6,7 @@ import { useRouter } from 'next/navigation'
 import Link from 'next/link'
 import { useLocale, useTranslations } from 'next-intl'
 import { createClient } from '@/lib/supabase/client'
+import { guardBrowserWrite } from '@/lib/company/tab-guard'
 import { Button } from '@/components/ui/button'
 import { Badge } from '@/components/ui/badge'
 import { DetailSection, DefRow, DefEmpty } from '@/components/ui/detail-section'
@@ -80,6 +81,9 @@ import {
   DialogTitle,
 } from '@/components/ui/dialog'
 import type { Invoice, InvoiceItem, Customer, InvoiceStatus, InvoiceReminder, InvoiceDocumentType } from '@/types'
+import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'
+import { useBranding } from '@/lib/branding/brand-context'
+import { DetailPageSkeleton } from '@/components/common/DetailPageSkeleton'
 
 /** Minimized Peppol delivery projection from GET /api/invoices/[id]/peppol/deliveries. */
 interface PeppolDeliveryView {
@@ -97,8 +101,6 @@ const PEPPOL_STATUS_KEYS = new Set([
   'no_route', 'failed',
 ])
 const PEPPOL_SENDABLE_STATUSES = new Set<InvoiceStatus>(['draft', 'sent', 'overdue'])
-import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'
-import { DetailPageSkeleton } from '@/components/common/DetailPageSkeleton'
 
 // Why the downloaded file is not the invoice the customer received. One key
 // per reason: "no archived copy exists" and "the archive could not be reached"
@@ -152,6 +154,7 @@ export default function InvoiceDetailPage({ params }: { params: Promise<{ id: st
   const { toast } = useToast()
   const supabase = createClient()
   const t = useTranslations('invoice_detail')
+  const { appName } = useBranding()
   // Begäran status labels are shared with the payout dialog on the list page.
   const tInvoices = useTranslations('invoices')
   const tCommon = useTranslations('common')
@@ -573,6 +576,11 @@ export default function InvoiceDetailPage({ params }: { params: Promise<{ id: st
 
   async function updateStatus(status: InvoiceStatus) {
     if (!invoice) return
+    // Cross-tab guard (WL-09): the direct Supabase branches below bypass the
+    // patched window.fetch, so consult the tab guard explicitly. On a
+    // mismatch the blocking dialog raised by guardBrowserWrite is the user
+    // feedback; nothing is written.
+    if (!guardBrowserWrite()) return
 
     setIsUpdating(true)
 
@@ -713,7 +721,7 @@ export default function InvoiceDetailPage({ params }: { params: Promise<{ id: st
       if (caveat) {
         toast({
           title: t('pdf_rerender_downloaded_title'),
-          description: t(RERENDER_CAVEAT_KEYS[caveat]),
+          description: t(RERENDER_CAVEAT_KEYS[caveat], { appName }),
         })
       } else {
         toast({
@@ -992,7 +1000,7 @@ export default function InvoiceDetailPage({ params }: { params: Promise<{ id: st
     if (!window.open(url, '_blank', 'noopener,noreferrer')) {
       toast({
         title: t('pdf_preview_blocked_title'),
-        description: t('pdf_preview_blocked_description'),
+        description: t('pdf_preview_blocked_description', { appName }),
         variant: 'destructive',
       })
       return
@@ -1002,7 +1010,7 @@ export default function InvoiceDetailPage({ params }: { params: Promise<{ id: st
     if (caveat) {
       toast({
         title: t('pdf_rerender_preview_title'),
-        description: t(RERENDER_CAVEAT_KEYS[caveat]),
+        description: t(RERENDER_CAVEAT_KEYS[caveat], { appName }),
       })
     }
   }
@@ -2315,7 +2323,7 @@ export default function InvoiceDetailPage({ params }: { params: Promise<{ id: st
             <DialogDescription>
               {pdfArchiveIssue === 'document'
                 ? t('pdf_archive_issue_document_desc')
-                : t('pdf_archive_issue_history_desc')}
+                : t('pdf_archive_issue_history_desc', { appName })}
             </DialogDescription>
           </DialogHeader>
           <DialogFooter>
diff --git a/app/(dashboard)/layout.tsx b/app/(dashboard)/layout.tsx
index 37ced443..65aeddf3 100644
--- a/app/(dashboard)/layout.tsx
+++ b/app/(dashboard)/layout.tsx
@@ -13,16 +13,24 @@ import { SessionTimeoutController } from '@/components/auth/SessionTimeoutContro
 import { SandboxBanner } from '@/components/dashboard/SandboxBanner'
 import TrialExpiredDialog from '@/components/billing/TrialExpiredDialog'
 import { getExtensionNavItems } from '@/lib/extensions/sectors'
-import { CompanyProvider } from '@/contexts/CompanyContext'
+import { CompanyProvider, type ByraTeamRef } from '@/contexts/CompanyContext'
 import { ReferenceDataSeed } from '@/components/providers/ReferenceDataSeed'
 import { getCompanyEntitlements } from '@/lib/entitlements/has-capability'
 import { getDashboardNavFlags } from '@/lib/dashboard/nav-flags'
 import { getBranding } from '@/lib/branding/service'
+import { resolveBrandByHost } from '@/lib/branding/resolve'
+import { resolveBrandsForTeams } from '@/lib/branding/team-brands'
+import {
+  partitionCompaniesByHomeDomain,
+  isCompanyHomedOnHost,
+} from '@/lib/company/home-domain'
+import HomeDomainSignpost from '@/components/dashboard/HomeDomainSignpost'
 import type { AccountingFramework, EntityType, CompanyRole, Team } from '@/types'
 import {
   getDashboardAuthContext,
   getDashboardCompanyId,
   getDashboardSettings,
+  getDashboardTeamMemberships,
   getResolvedDashboardAgentProfile,
 } from './request-context'
 
@@ -67,16 +75,16 @@ export default async function DashboardLayout({
   // `getActiveCompanyId` reads from user_preferences, matching what RLS
   // sees via `current_active_company_id()`. Keeping both sides on the same
   // source avoids cross-tab / cookie divergence.
-  // Team membership (with the team row embedded) only depends on user.id,
-  // so it resolves in parallel, this layout is on the critical path of
-  // every dashboard page, so sequential round-trips are wall-clock time.
+  // Team memberships come from the request-cached getDashboardTeamMemberships
+  // (ALL rows: multi-team is the supported shape after WL-08) so the home
+  // page's byrå landing redirect reuses the same single query.
   // Wave 1: everything keyed on the user alone runs alongside the company
   // resolution. The memberships join carries the active company's row and
   // role too, so wave 2 no longer re-reads companies / company_members.
   const [
     companyId,
     headerStore,
-    { data: teamMembership },
+    teamMemberships,
     { data: userProfile },
     { data: userPrefs },
     { data: allMemberships },
@@ -84,12 +92,7 @@ export default async function DashboardLayout({
     getDashboardCompanyId(),
     // Read the pathname forwarded by middleware so we can branch on it.
     headers(),
-    supabase
-      .from('team_members')
-      .select('team_id, role, teams:team_id(*)')
-      .eq('user_id', user.id)
-      .limit(1)
-      .maybeSingle(),
+    getDashboardTeamMemberships(),
     // The signed-in user's profile, shown in the bottom-left account
     // popover (full_name + initial) so it's clear which user is logged
     // in, distinct from the active company shown at the top.
@@ -106,15 +109,46 @@ export default async function DashboardLayout({
     pathname.startsWith(p)
   )
 
+  // Team now carries `kind` directly (types/index.ts, WL-08).
+  const membershipRows = teamMemberships
+  const byraMembership = membershipRows.find((m) => m.teams?.kind === 'byra') ?? null
+  // Byrå team membership gates the cockpit ("Klienter" nav + /clients).
+  const byraTeam: ByraTeamRef | null = byraMembership?.teams
+    ? {
+        id: byraMembership.teams.id,
+        name: byraMembership.teams.name,
+        role:
+          byraMembership.role === 'owner' || byraMembership.role === 'admin'
+            ? byraMembership.role
+            : 'member',
+      }
+    : null
+  // Legacy single-team fields: the byrå team when present (the one consumers
+  // care about), else the first membership: same value as before for
+  // single-team users.
   const team: Team | null =
-    (teamMembership?.teams as unknown as Team | null) ?? null
-  const isTeamMember = !!teamMembership
+    (byraMembership?.teams as Team | null) ??
+    (membershipRows[0]?.teams as Team | null) ??
+    null
+  const isTeamMember = membershipRows.length > 0
 
   // No companies: redirect to onboarding, except for allowed escape-hatch
   // routes (so the user can still reach /settings/account to delete their
-  // account after archiving their last company).
+  // account after archiving their last company) and byrå team members (any
+  // role, founder call 2026-08-05), whose home is the EMPTY cockpit (mirrors
+  // the middleware's byrå exception): they render the no-company shell on
+  // cockpit routes and are steered to /byra everywhere else, never to the
+  // company wizard.
   if (!companyId) {
-    if (!isNoCompanyAllowed) {
+    const isByraMember = !!byraTeam
+    const isByraShellPath =
+      pathname.startsWith('/byra') ||
+      pathname.startsWith('/clients') ||
+      pathname.startsWith('/settings')
+    if (!isNoCompanyAllowed && !(isByraMember && isByraShellPath)) {
+      if (isByraMember) {
+        redirect('/byra')
+      }
       redirect('/onboarding')
     }
 
@@ -126,6 +160,8 @@ export default async function DashboardLayout({
           companies: [],
           isTeamMember,
           team,
+          byraTeam,
+          foreignCompanies: [],
           isSandbox: false,
           capabilities: [],
           trialEndsAt: null,
@@ -167,6 +203,14 @@ export default async function DashboardLayout({
   const companyRow = (activeMembership?.companies as unknown as import('@/types').Company | null) ?? null
   const memberRow = activeMembership ? { role: activeMembership.role } : null
 
+  // Home-domain rule (WL-01): which brand serves this host, and which brand
+  // (if any) each membership company's team owns. Both resolvers are ~60s
+  // cached; unknown hosts and brandless teams resolve to null/absent, so the
+  // canonical no-brands hot path stays byte-identical. Both only depend on
+  // wave-1 data, so they ride in the wave-2 batch below.
+  const hostHeader =
+    headerStore.get('x-forwarded-host') ?? headerStore.get('host') ?? ''
+
   // Wave 2: everything keyed on the company. Nav badge counts are NOT fetched
   // here: DashboardNav loads them client-side after mount
   // (lib/hooks/use-worklist-badges). The four nav-visibility probes
@@ -179,6 +223,8 @@ export default async function DashboardLayout({
     navFlags,
     { data: seedFiscalPeriods },
     { data: seedCashAccounts },
+    hostBrand,
+    brandByTeam,
   ] = await Promise.all([
     getDashboardSettings(),
     // Agent identity, name + avatar, surfaced on the FAB and chat
@@ -210,10 +256,24 @@ export default async function DashboardLayout({
       .eq('company_id', companyId)
       .order('is_primary', { ascending: false })
       .order('ledger_account', { ascending: true }),
+    hostHeader ? resolveBrandByHost(hostHeader) : Promise.resolve(null),
+    resolveBrandsForTeams(
+      (allMemberships || []).map(
+        (m) => (m.companies as { team_id?: string | null } | null)?.team_id ?? null,
+      ),
+    ),
   ])
   const hasWebshop = navFlags.hasWebshop
   const hasMileageTrips = navFlags.hasMileageTrips
 
+  const canonicalDomain = (() => {
+    try {
+      return new URL(getBranding().appUrl).hostname
+    } catch {
+      return ''
+    }
+  })()
+
   // company_id -> current display name for every company the user belongs to.
   const nameByCompany = new Map(
     (allSettingsNames || []).map((s) => [s.company_id, s.company_name as string | null]),
@@ -234,6 +294,8 @@ export default async function DashboardLayout({
       }),
       isTeamMember,
       team,
+      byraTeam,
+      foreignCompanies: [],
       isSandbox: false,
       capabilities: [],
       trialEndsAt: null,
@@ -304,10 +366,9 @@ export default async function DashboardLayout({
   const uiState = (userPrefs?.ui_state ?? {}) as import('@/types').UserUiState
   const navCollapsed = uiState.nav_collapsed === true
 
-  const companyContextValue = {
-    company: companyWithName,
-    role: memberRow.role as CompanyRole,
-    companies: (allMemberships || []).map((m) => {
+  const allCompanyEntries = (allMemberships || [])
+    .filter((m) => m.companies)
+    .map((m) => {
       const c = m.companies as unknown as import('@/types').Company
       // Current display name for every company (company_settings.company_name,
       // falling back to the frozen companies.name) so non-active switcher rows
@@ -316,9 +377,34 @@ export default async function DashboardLayout({
         company: { ...c, name: nameByCompany.get(c.id) || c.name },
         role: m.role as CompanyRole,
       }
-    }),
+    })
+
+  // Home-domain rule (WL-01): the switcher offers only companies homed on
+  // THIS host; companies homed elsewhere become "Hanteras via <domain>"
+  // signpost entries. With no brands anywhere both lists reduce to
+  // visible = everything, foreign = [] : the additive guarantee.
+  const homePartition = partitionCompaniesByHomeDomain({
+    companies: allCompanyEntries,
+    getTeamId: (entry) => entry.company.team_id ?? null,
+    brandByTeam,
+    hostBrandTeamId: hostBrand?.teamId ?? null,
+    canonicalDomain,
+    canonicalAppName: getBranding().appName,
+  })
+  const foreignCompanies = homePartition.foreign.map((f) => ({
+    id: f.item.company.id,
+    name: f.item.company.name,
+    domain: f.domain,
+  }))
+
+  const companyContextValue = {
+    company: companyWithName,
+    role: memberRow.role as CompanyRole,
+    companies: homePartition.visible,
     isTeamMember,
     team,
+    byraTeam,
+    foreignCompanies,
     isSandbox,
     capabilities: entitlements.capabilities,
     trialEndsAt: entitlements.trialEndsAt,
@@ -326,6 +412,23 @@ export default async function DashboardLayout({
     trialExpiredAt: entitlements.trialExpiredAt,
   }
 
+  // Signpost gate (WL-01): a company is opened ONLY on its home domain. When
+  // the active company is homed elsewhere, the dashboard body is replaced by
+  // the signpost (never the wrong company's data), except on account-level
+  // and byrå-cockpit routes, which are not company surfaces. Navigation rule
+  // only: RLS/membership remain the security boundary, and middleware is
+  // untouched (the layout is the clean seam: brand lookups don't belong on
+  // the Edge hot path).
+  const activeCompanyHomed = isCompanyHomedOnHost({
+    companyTeamId: (companyRow.team_id as string | null) ?? null,
+    brandByTeam,
+    hostBrandTeamId: hostBrand?.teamId ?? null,
+  })
+  const SIGNPOST_ALLOWED_PATHS = ['/settings/account', '/clients', '/byra']
+  const showSignpost =
+    !activeCompanyHomed &&
+    !SIGNPOST_ALLOWED_PATHS.some((p) => pathname.startsWith(p))
+
   return (
     <CompanyProvider value={companyContextValue}>
       <ReferenceDataSeed
@@ -374,7 +477,20 @@ export default async function DashboardLayout({
             initialUiState={uiState}
           />
           <main id="main-content" className={MAIN_PANEL_CLASS} role="main">
-            <MainContainer companyId={companyId}>{children}</MainContainer>
+            <MainContainer companyId={companyId}>
+              {showSignpost ? (
+                <HomeDomainSignpost
+                  activeCompanyName={displayName}
+                  homedCompanies={homePartition.visible.map((entry) => ({
+                    id: entry.company.id,
+                    name: entry.company.name,
+                  }))}
+                  foreignCompanies={foreignCompanies}
+                />
+              ) : (
+                children
+              )}
+            </MainContainer>
           </main>
           <AgentTrigger hidden={userPrefs?.hide_assistant_fab === true} />
           {/* One-time expired-trial notice. Sandbox/anonymous demo users have
diff --git a/app/(dashboard)/page.tsx b/app/(dashboard)/page.tsx
index c126b203..0d074d4a 100644
--- a/app/(dashboard)/page.tsx
+++ b/app/(dashboard)/page.tsx
@@ -1,11 +1,14 @@
 import { Suspense } from 'react'
 import { redirect } from 'next/navigation'
+import { cookies } from 'next/headers'
 import DashboardContent from '@/components/dashboard/DashboardContent'
 import { ChecklistSkeleton, PanesSkeleton } from '@/components/dashboard/HemSkeletons'
+import { COMPANY_PICKED_COOKIE } from '@/lib/company/context'
 import {
   getDashboardAuthContext,
   getDashboardCompanyId,
   getDashboardSettings,
+  getDashboardTeamMemberships,
   getResolvedDashboardAgentProfile,
 } from './request-context'
 import { HemChecklistSection, HemNoticesSection, HemPanesSection } from './hem-sections'
@@ -40,6 +43,25 @@ export default async function DashboardPage() {
     redirect('/onboarding')
   }
 
+  // Byrå landing: every byrå team member (owner, admin AND member: widened
+  // from owner/admin on the founder's call 2026-08-05, so invited consultants
+  // land right too) homes to the cockpit, not to an auto-resolved client
+  // company. companyId above can be the middleware's first-membership
+  // fallback (which it also writes back to user_preferences, so the DB can't
+  // tell picked from auto-picked); the session cookie stamped by
+  // setActiveCompany is the explicit-choice signal. Once they enter a client
+  // this session, "/" is that company's Hem again. Memberships are
+  // request-cached and shared with the layout.
+  const [cookieStore, teamMemberships] = await Promise.all([
+    cookies(),
+    getDashboardTeamMemberships(),
+  ])
+  if (!cookieStore.has(COMPANY_PICKED_COOKIE)) {
+    if (teamMemberships.some((m) => m.teams?.kind === 'byra')) {
+      redirect('/byra')
+    }
+  }
+
   const now = new Date()
 
   const [settingsRes, { data: profile }, agentProfile, { count: skatteverketTokenCount }] =
diff --git a/app/(dashboard)/request-context.ts b/app/(dashboard)/request-context.ts
index c45fe3ea..aaca1810 100644
--- a/app/(dashboard)/request-context.ts
+++ b/app/(dashboard)/request-context.ts
@@ -6,6 +6,7 @@ import { createClient } from '@/lib/supabase/server'
 import { claimsPinned, userFromClaims } from '@/lib/auth/claims'
 import { getActiveCompanyId } from '@/lib/company/context'
 import { ensureSandboxAgentProfile } from '@/lib/sandbox/ensure-agent'
+import type { Team } from '@/types'
 
 /**
  * Request-local dashboard auth context. React cache shares the Supabase client
@@ -48,6 +49,34 @@ export const getDashboardCompanyId = cache(async () => {
   return user ? getActiveCompanyId(supabase, user.id) : null
 })
 
+export interface DashboardTeamMembership {
+  team_id: string
+  role: string
+  teams: Team | null
+}
+
+/**
+ * Request-local team memberships with the team row embedded. ALL memberships:
+ * multi-team membership (own personal team + byrå team) is the supported
+ * shape after WL-08; a `.limit(1)` would pick an arbitrary row and could hide
+ * a consultant's byrå membership. Shared between the dashboard layout (byrå
+ * cockpit gate) and the home page (byrå landing redirect), so the byrå check
+ * costs no extra query.
+ */
+export const getDashboardTeamMemberships = cache(
+  async (): Promise<DashboardTeamMembership[]> => {
+    const { supabase, user } = await getDashboardAuthContext()
+    if (!user) return []
+
+    const { data } = await supabase
+      .from('team_members')
+      .select('team_id, role, teams:team_id(*)')
+      .eq('user_id', user.id)
+
+    return (data ?? []) as unknown as DashboardTeamMembership[]
+  },
+)
+
 export const getDashboardSettings = cache(async () => {
   const [{ supabase }, companyId] = await Promise.all([
     getDashboardAuthContext(),
diff --git a/app/(dashboard)/settings/brand/page.tsx b/app/(dashboard)/settings/brand/page.tsx
new file mode 100644
index 00000000..2affee29
--- /dev/null
+++ b/app/(dashboard)/settings/brand/page.tsx
@@ -0,0 +1,7 @@
+'use client'
+
+import { BrandSettingsContent } from '@/components/settings/sections/BrandSettingsContent'
+
+export default function BrandSettingsPage() {
+  return <BrandSettingsContent />
+}
diff --git a/app/(public)/dpa/page.tsx b/app/(public)/dpa/page.tsx
index 0e5eedc1..861e3640 100644
--- a/app/(public)/dpa/page.tsx
+++ b/app/(public)/dpa/page.tsx
@@ -1,6 +1,7 @@
 import type { Metadata } from 'next'
 import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
 import Link from 'next/link'
+import { SourceCodeFooter } from '@/components/branding/SourceCodeFooter'
 import { getBranding } from '@/lib/branding/service'
 
 export function generateMetadata(): Metadata {
@@ -249,6 +250,10 @@ export default function DPAPage() {
             </p>
           </CardContent>
         </Card>
+
+        {/* AGPL section 13 source offer (WL-06): renders on both default and
+            branded hosts; never gate this on a brand. */}
+        <SourceCodeFooter className="pt-2" />
       </div>
     </div>
   )
diff --git a/app/(public)/invoice-action/[token]/page.tsx b/app/(public)/invoice-action/[token]/page.tsx
index 7454b2ee..17a64785 100644
--- a/app/(public)/invoice-action/[token]/page.tsx
+++ b/app/(public)/invoice-action/[token]/page.tsx
@@ -38,6 +38,33 @@ interface InvoiceData {
   reminderFeeCurrency?: string
   totalDue: number
   feeDueSeparately?: number
+  // White-label brand of the invoice's COMPANY (WL-13), resolved server-side
+  // by the action API regardless of host. Null/absent = today's page.
+  brand?: {
+    appName: string
+    logoUrl: string | null
+    brandColor: string
+  } | null
+}
+
+// Discreet brand mark shown when the invoice's company has a white-label
+// brand: logo when one exists, else the brand name in the brand color.
+function BrandMark({ brand }: { brand: NonNullable<InvoiceData['brand']> }) {
+  return (
+    <div className="flex justify-center mb-6">
+      {brand.logoUrl ? (
+        // eslint-disable-next-line @next/next/no-img-element
+        <img src={brand.logoUrl} alt={brand.appName} className="h-8 w-auto" />
+      ) : (
+        <span
+          className="text-sm font-semibold tracking-wide"
+          style={{ color: brand.brandColor }}
+        >
+          {brand.appName}
+        </span>
+      )}
+    </div>
+  )
 }
 
 export default function InvoiceActionPage({ params }: { params: Promise<{ token: string }> }) {
@@ -133,7 +160,9 @@ export default function InvoiceActionPage({ params }: { params: Promise<{ token:
   if (invoice.alreadyResponded || successMessage) {
     return (
       <div className="min-h-dvh bg-gradient-to-b from-slate-50 to-white flex items-center justify-center p-4">
-        <Card className="max-w-md w-full">
+        <div className="max-w-md w-full">
+          {invoice.brand && <BrandMark brand={invoice.brand} />}
+          <Card className="w-full">
           <CardContent className="pt-6 text-center">
             <CheckCircle className="h-12 w-12 text-success mx-auto mb-4" />
             <h2 className="text-lg mb-2">Tack för ditt svar!</h2>
@@ -149,7 +178,8 @@ export default function InvoiceActionPage({ params }: { params: Promise<{ token:
               <p className="font-medium">{invoice.invoiceNumber}</p>
             </div>
           </CardContent>
-        </Card>
+          </Card>
+        </div>
       </div>
     )
   }
@@ -168,6 +198,8 @@ export default function InvoiceActionPage({ params }: { params: Promise<{ token:
   return (
     <div className="min-h-dvh bg-gradient-to-b from-slate-50 to-white py-12 px-4">
       <div className="max-w-lg mx-auto">
+        {/* Brand chrome (WL-13): only when the invoice's company has a brand */}
+        {invoice.brand && <BrandMark brand={invoice.brand} />}
         {/* Header */}
         <div className="text-center mb-8">
           <h1 className="text-2xl text-foreground mb-2">
diff --git a/app/(public)/privacy/page.tsx b/app/(public)/privacy/page.tsx
index 7711f3ed..742d050d 100644
--- a/app/(public)/privacy/page.tsx
+++ b/app/(public)/privacy/page.tsx
@@ -1,6 +1,7 @@
 import type { Metadata } from 'next'
 import Link from 'next/link'
 import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
+import { SourceCodeFooter } from '@/components/branding/SourceCodeFooter'
 import { getBranding } from '@/lib/branding/service'
 
 export function generateMetadata(): Metadata {
@@ -310,6 +311,10 @@ export default function PrivacyPolicyPage() {
             </p>
           </CardContent>
         </Card>
+
+        {/* AGPL section 13 source offer (WL-06): renders on both default and
+            branded hosts; never gate this on a brand. */}
+        <SourceCodeFooter className="pt-2" />
       </div>
     </div>
   )
diff --git a/app/api/auth/email-hook/__tests__/route.test.ts b/app/api/auth/email-hook/__tests__/route.test.ts
new file mode 100644
index 00000000..c387b658
--- /dev/null
+++ b/app/api/auth/email-hook/__tests__/route.test.ts
@@ -0,0 +1,240 @@
+/**
+ * Tests for POST /api/auth/email-hook (Supabase Send Email hook).
+ *
+ * Unauthenticated by design: the guard is the Standard Webhooks signature.
+ * Signature material is computed with node:crypto exactly like Supabase does.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { createHmac, randomBytes } from 'node:crypto'
+import type { Brand } from '@/lib/branding/resolve'
+
+vi.mock('@/lib/init', () => ({ ensureInitialized: vi.fn() }))
+
+const resolveBrandByHostMock = vi.hoisted(() => vi.fn())
+vi.mock('@/lib/branding/resolve', () => ({
+  resolveBrandByHost: resolveBrandByHostMock,
+  // Imported by lib/email/brand-sender (not called on the hook path).
+  resolveBrandForCompany: vi.fn(),
+}))
+
+vi.mock('@/lib/branding/service', () => ({
+  getBranding: () => ({ appName: 'Accounted', appUrl: 'https://app.gnubok.se' }),
+}))
+
+const sendEmailMock = vi.hoisted(() => vi.fn())
+vi.mock('@/lib/email/service', () => ({
+  getEmailService: () => ({ sendEmail: sendEmailMock, isConfigured: () => true }),
+}))
+
+import { POST } from '../route'
+
+const KEY = randomBytes(24)
+const SECRET = `v1,whsec_${KEY.toString('base64')}`
+
+function makeBrand(overrides: Partial<Brand> = {}): Brand {
+  return {
+    id: 'brand-1',
+    teamId: 'team-1',
+    domain: 'app.siffra.se',
+    appName: 'Siffra',
+    logoUrl: null,
+    brandColor: '#123456',
+    chromeColor: null,
+    fontKey: 'default',
+    supportEmail: 'support@siffra.se',
+    authEmailFrom: 'noreply@post.siffra.se',
+    senderDomain: 'post.siffra.se',
+    senderDomainStatus: 'verified',
+    resendDomainId: 'rd-1',
+    ...overrides,
+  }
+}
+
+function signedRequest(rawBody: string, opts?: { badSignature?: boolean; headers?: Record<string, string> }): Request {
+  const id = 'msg_1'
+  const timestamp = String(Math.floor(Date.now() / 1000))
+  const signature = createHmac('sha256', KEY)
+    .update(`${id}.${timestamp}.${rawBody}`)
+    .digest('base64')
+  return new Request('http://localhost:3000/api/auth/email-hook', {
+    method: 'POST',
+    body: rawBody,
+    headers: {
+      'content-type': 'application/json',
+      'webhook-id': id,
+      'webhook-timestamp': timestamp,
+      'webhook-signature': opts?.badSignature ? 'v1,AAAA' : `v1,${signature}`,
+      ...opts?.headers,
+    },
+  })
+}
+
+function hookPayload(overrides?: {
+  user?: Record<string, unknown>
+  email_data?: Record<string, unknown>
+}): string {
+  return JSON.stringify({
+    user: { email: 'user@example.se', ...overrides?.user },
+    email_data: {
+      token: '123456',
+      token_hash: 'hash-1',
+      redirect_to: 'https://app.gnubok.se/auth/callback?next=/reset-password',
+      email_action_type: 'recovery',
+      site_url: 'https://app.gnubok.se',
+      ...overrides?.email_data,
+    },
+  })
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  process.env.SUPABASE_SEND_EMAIL_HOOK_SECRET = SECRET
+  resolveBrandByHostMock.mockResolvedValue(null)
+  sendEmailMock.mockResolvedValue({ success: true, messageId: 'msg-1' })
+})
+
+afterEach(() => {
+  delete process.env.SUPABASE_SEND_EMAIL_HOOK_SECRET
+})
+
+describe('POST /api/auth/email-hook', () => {
+  it('returns 500 when the hook secret is not configured', async () => {
+    delete process.env.SUPABASE_SEND_EMAIL_HOOK_SECRET
+    const res = await POST(signedRequest(hookPayload()))
+    expect(res.status).toBe(500)
+    expect(sendEmailMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 401 for an invalid signature', async () => {
+    const res = await POST(signedRequest(hookPayload(), { badSignature: true }))
+    expect(res.status).toBe(401)
+    expect(sendEmailMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 for a signed but malformed payload', async () => {
+    const res = await POST(signedRequest('not-json'))
+    expect(res.status).toBe(400)
+    expect(sendEmailMock).not.toHaveBeenCalled()
+  })
+
+  it('sends canonical recovery mail linking to the originating host (no brand)', async () => {
+    const res = await POST(signedRequest(hookPayload()))
+    expect(res.status).toBe(200)
+    await expect(res.json()).resolves.toEqual({})
+
+    expect(sendEmailMock).toHaveBeenCalledTimes(1)
+    const options = sendEmailMock.mock.calls[0][0]
+    expect(options.to).toBe('user@example.se')
+    expect(options.subject).toBe('Återställ ditt lösenord')
+    expect(options.fromName).toBeUndefined()
+    expect(options.fromAddress).toBeUndefined()
+    expect(options.replyTo).toBeUndefined()
+    // token_hash + verifyOtp pattern on the originating host, preserving the
+    // existing next=/reset-password query.
+    expect(options.text).toContain('https://app.gnubok.se/auth/callback?next=%2Freset-password')
+    expect(options.text).toContain('token_hash=hash-1')
+    expect(options.text).toContain('type=recovery')
+  })
+
+  it('brands the mail from the redirect_to host and rides the verified brand sender', async () => {
+    resolveBrandByHostMock.mockResolvedValue(makeBrand())
+    const res = await POST(
+      signedRequest(
+        hookPayload({
+          email_data: {
+            email_action_type: 'signup',
+            redirect_to: 'https://app.siffra.se/auth/callback',
+          },
+        }),
+      ),
+    )
+    expect(res.status).toBe(200)
+    expect(resolveBrandByHostMock).toHaveBeenCalledWith('app.siffra.se')
+
+    const options = sendEmailMock.mock.calls[0][0]
+    expect(options.fromName).toBe('Siffra')
+    expect(options.fromAddress).toBe('noreply@post.siffra.se')
+    expect(options.replyTo).toBe('support@siffra.se')
+    expect(options.html).toContain('Siffra')
+    expect(options.html).not.toMatch(/accounted/i)
+    expect(options.text).toContain('https://app.siffra.se/auth/callback?token_hash=hash-1')
+    expect(options.text).toContain('type=signup')
+  })
+
+  it('uses the via-fallback for a brand without a verified sender domain', async () => {
+    resolveBrandByHostMock.mockResolvedValue(makeBrand({ senderDomainStatus: 'pending' }))
+    await POST(
+      signedRequest(
+        hookPayload({
+          email_data: {
+            email_action_type: 'magiclink',
+            redirect_to: 'https://app.siffra.se/auth/callback',
+          },
+        }),
+      ),
+    )
+    const options = sendEmailMock.mock.calls[0][0]
+    expect(options.fromName).toBe('Siffra')
+    expect(options.fromAddress).toBeUndefined()
+  })
+
+  it('sends two mails for a secure email change', async () => {
+    await POST(
+      signedRequest(
+        hookPayload({
+          user: { email: 'current@example.se', new_email: 'new@example.se' },
+          email_data: {
+            email_action_type: 'email_change',
+            token_hash: 'hash-new-address',
+            token_hash_new: 'hash-current-address',
+            redirect_to: 'https://app.gnubok.se/auth/callback',
+          },
+        }),
+      ),
+    )
+    expect(sendEmailMock).toHaveBeenCalledTimes(2)
+    const first = sendEmailMock.mock.calls[0][0]
+    const second = sendEmailMock.mock.calls[1][0]
+    // token_hash confirms at the NEW address, token_hash_new at the current.
+    expect(first.to).toBe('new@example.se')
+    expect(first.text).toContain('token_hash=hash-new-address')
+    expect(second.to).toBe('current@example.se')
+    expect(second.text).toContain('token_hash=hash-current-address')
+  })
+
+  it('sends the OTP code for reauthentication without a link', async () => {
+    await POST(
+      signedRequest(
+        hookPayload({
+          email_data: { email_action_type: 'reauthentication', token: '424242' },
+        }),
+      ),
+    )
+    const options = sendEmailMock.mock.calls[0][0]
+    expect(options.subject).toBe('Din verifieringskod')
+    expect(options.text).toContain('424242')
+    expect(options.text).not.toContain('token_hash=')
+  })
+
+  it('builds the callback URL when redirect_to points at a plain path', async () => {
+    await POST(
+      signedRequest(
+        hookPayload({
+          email_data: {
+            email_action_type: 'magiclink',
+            redirect_to: 'https://app.gnubok.se/settings/account',
+          },
+        }),
+      ),
+    )
+    const options = sendEmailMock.mock.calls[0][0]
+    expect(options.text).toContain('https://app.gnubok.se/auth/callback?next=%2Fsettings%2Faccount')
+    expect(options.text).toContain('type=magiclink')
+  })
+
+  it('returns 500 when the email provider fails, so Supabase retries', async () => {
+    sendEmailMock.mockResolvedValue({ success: false, error: 'provider down' })
+    const res = await POST(signedRequest(hookPayload()))
+    expect(res.status).toBe(500)
+  })
+})
diff --git a/app/api/auth/email-hook/route.ts b/app/api/auth/email-hook/route.ts
new file mode 100644
index 00000000..5ae22e44
--- /dev/null
+++ b/app/api/auth/email-hook/route.ts
@@ -0,0 +1,209 @@
+import { NextResponse } from 'next/server'
+import { ensureInitialized } from '@/lib/init'
+import { createLogger } from '@/lib/logger'
+import { getEmailService } from '@/lib/email/service'
+import { getBranding } from '@/lib/branding/service'
+import { resolveBrandByHost } from '@/lib/branding/resolve'
+import { getSenderForBrand } from '@/lib/email/brand-sender'
+import { buildAuthEmail } from '@/lib/email/auth-templates'
+import { verifyStandardWebhookSignature } from '@/lib/email/standard-webhook'
+
+// Loads the email extension so getEmailService() returns the Resend
+// implementation instead of the noop default.
+ensureInitialized()
+
+const log = createLogger('auth-email-hook')
+
+/**
+ * POST /api/auth/email-hook: Supabase Auth "Send Email" hook (WL-05, WL-13).
+ *
+ * When enabled in Supabase (Auth > Hooks > Send Email, pointing at this URL
+ * with the shared secret in SUPABASE_SEND_EMAIL_HOOK_SECRET), Supabase stops
+ * sending auth mail itself and this endpoint sends every auth mail (signup
+ * confirmation, recovery, magic link, invite, email change, reauthentication)
+ * through the platform email service, branded per the requesting host: the
+ * brand is resolved from the redirect_to origin via resolveBrandByHost, so a
+ * reset requested on app.partner.se is sent in the partner's brand and links
+ * back to app.partner.se. Unknown hosts get canonical platform mail.
+ *
+ * Unauthenticated by design (server-to-server): authenticity comes from the
+ * Standard Webhooks signature, not a session, exactly like the Stripe and
+ * Resend webhook routes. The raw body is verified byte-for-byte before
+ * parsing. This endpoint is availability-critical once the hook is enabled:
+ * any internal failure returns 500 so Supabase retries (up to 3 times within
+ * a 5 second budget); success returns 200 {} fast.
+ *
+ * Until the hook is switched on in Supabase this route is dormant and auth
+ * mail keeps flowing from Supabase unchanged.
+ */
+
+// verifyOtp types our /auth/callback confirm route accepts. Unknown action
+// types fall back to the generic 'email' type rather than dropping the mail.
+const VERIFY_TYPES = new Set([
+  'signup',
+  'recovery',
+  'magiclink',
+  'invite',
+  'email_change',
+  'email',
+])
+
+interface SendEmailHookPayload {
+  user?: {
+    email?: string | null
+    new_email?: string | null
+    email_new?: string | null
+  } | null
+  email_data?: {
+    token?: string
+    token_hash?: string
+    token_new?: string
+    token_hash_new?: string
+    redirect_to?: string
+    email_action_type?: string
+    site_url?: string
+  } | null
+}
+
+/**
+ * Build the verify URL on the ORIGINATING host using the token_hash +
+ * verifyOtp pattern (browser- and host-independent, per the WL-05 research):
+ * /auth/callback consumes token_hash + type server-side and then honors the
+ * `next` path. If redirect_to already points at /auth/callback (our client
+ * flows do), its query (e.g. next=/reset-password) is preserved.
+ */
+function buildActionUrl(
+  redirectUrl: URL | null,
+  tokenHash: string,
+  actionType: string,
+): string {
+  const verifyType = VERIFY_TYPES.has(actionType) ? actionType : 'email'
+  let url: URL
+  if (redirectUrl && redirectUrl.pathname === '/auth/callback') {
+    url = new URL(redirectUrl.toString())
+  } else {
+    url = new URL('/auth/callback', redirectUrl ? redirectUrl.origin : getBranding().appUrl)
+    if (redirectUrl) {
+      const next = redirectUrl.pathname + redirectUrl.search
+      if (next && next !== '/') url.searchParams.set('next', next)
+    }
+  }
+  url.searchParams.set('token_hash', tokenHash)
+  url.searchParams.set('type', verifyType)
+  return url.toString()
+}
+
+export async function POST(request: Request) {
+  const secret = process.env.SUPABASE_SEND_EMAIL_HOOK_SECRET
+  if (!secret) {
+    log.error('SUPABASE_SEND_EMAIL_HOOK_SECRET is not configured', undefined)
+    return NextResponse.json({ error: 'Hook not configured' }, { status: 500 })
+  }
+
+  const rawBody = await request.text()
+  const verified = verifyStandardWebhookSignature({
+    secret,
+    payload: rawBody,
+    id: request.headers.get('webhook-id'),
+    timestamp: request.headers.get('webhook-timestamp'),
+    signature: request.headers.get('webhook-signature'),
+  })
+  if (!verified) {
+    return NextResponse.json({ error: 'Invalid signature' }, { status: 401 })
+  }
+
+  let payload: SendEmailHookPayload
+  try {
+    payload = JSON.parse(rawBody) as SendEmailHookPayload
+  } catch {
+    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })
+  }
+
+  const emailData = payload.email_data ?? {}
+  const actionType = emailData.email_action_type || ''
+  const recipient = payload.user?.email || null
+  if (!recipient) {
+    return NextResponse.json({ error: 'Missing recipient' }, { status: 400 })
+  }
+
+  // Brand from the requesting host: redirect_to carries the tenant origin.
+  let redirectUrl: URL | null = null
+  if (emailData.redirect_to) {
+    try {
+      redirectUrl = new URL(emailData.redirect_to)
+    } catch {
+      redirectUrl = null
+    }
+  }
+  const brand = redirectUrl ? await resolveBrandByHost(redirectUrl.hostname) : null
+  const sender = getSenderForBrand(brand)
+  const appName = brand?.appName ?? getBranding().appName
+
+  // Compose the mail(s) for this hook invocation.
+  const mails: Array<{ to: string; actionType: string; actionUrl?: string; otpCode?: string }> = []
+
+  if (actionType === 'reauthentication') {
+    if (!emailData.token) {
+      return NextResponse.json({ error: 'Missing token' }, { status: 400 })
+    }
+    mails.push({ to: recipient, actionType, otpCode: emailData.token })
+  } else if (actionType === 'email_change') {
+    // Secure email change sends TWO mails from one invocation. Documented
+    // reversal: token_hash confirms at the NEW address, token_hash_new at
+    // the CURRENT one.
+    if (!emailData.token_hash) {
+      return NextResponse.json({ error: 'Missing token_hash' }, { status: 400 })
+    }
+    const newEmail = payload.user?.new_email || payload.user?.email_new || recipient
+    mails.push({
+      to: newEmail,
+      actionType: 'email_change',
+      actionUrl: buildActionUrl(redirectUrl, emailData.token_hash, 'email_change'),
+    })
+    if (emailData.token_hash_new) {
+      mails.push({
+        to: recipient,
+        actionType: 'email_change_current',
+        actionUrl: buildActionUrl(redirectUrl, emailData.token_hash_new, 'email_change'),
+      })
+    }
+  } else {
+    if (!emailData.token_hash) {
+      return NextResponse.json({ error: 'Missing token_hash' }, { status: 400 })
+    }
+    mails.push({
+      to: recipient,
+      actionType,
+      actionUrl: buildActionUrl(redirectUrl, emailData.token_hash, actionType),
+    })
+  }
+
+  const emailService = getEmailService()
+  for (const mail of mails) {
+    const built = buildAuthEmail({
+      actionType: mail.actionType,
+      appName,
+      actionUrl: mail.actionUrl,
+      otpCode: mail.otpCode,
+    })
+    const result = await emailService.sendEmail({
+      to: mail.to,
+      subject: built.subject,
+      html: built.html,
+      text: built.text,
+      fromName: sender.fromName ?? undefined,
+      fromAddress: sender.fromAddress ?? undefined,
+      replyTo: sender.replyTo ?? undefined,
+    })
+    if (!result.success) {
+      // Non-2xx makes Supabase retry, which is the recovery we want: auth
+      // mail must not be silently dropped.
+      log.error('auth mail send failed', new Error(result.error ?? 'unknown'), {
+        actionType: mail.actionType,
+      })
+      return NextResponse.json({ error: 'Send failed' }, { status: 500 })
+    }
+  }
+
+  return NextResponse.json({})
+}
diff --git a/app/api/billing/__tests__/status.test.ts b/app/api/billing/__tests__/status.test.ts
index 181831d9..a09ca24c 100644
--- a/app/api/billing/__tests__/status.test.ts
+++ b/app/api/billing/__tests__/status.test.ts
@@ -42,12 +42,22 @@ vi.mock('@/lib/sandbox/guard', () => ({
   isSandboxCompany: vi.fn().mockResolvedValue(false),
 }))
 
+// Service client for the WL-10 team-agreement lookup (end clients cannot read
+// the byrå team or its grants under RLS, so the route uses the service role).
+let serviceByTable: Record<string, TableResult> = {}
+const createServiceClientMock = vi.fn(() => makeSupabase(serviceByTable))
+vi.mock('@/lib/supabase/server', () => ({
+  createServiceClient: () => createServiceClientMock(),
+  createClient: vi.fn(),
+}))
+
 import { GET } from '../status/route'
 
 interface StatusBody {
   isPaying: boolean
   trialEndsAt: string | null
   isDemo: boolean
+  teamAgreement?: { teamName: string }
 }
 
 function authAs(byTable: Record<string, TableResult>) {
@@ -60,6 +70,7 @@ function authAs(byTable: Record<string, TableResult>) {
 
 beforeEach(() => {
   vi.clearAllMocks()
+  serviceByTable = {}
 })
 
 describe('GET /api/billing/status', () => {
@@ -108,3 +119,98 @@ describe('GET /api/billing/status', () => {
     expect(body.isPaying).toBe(false)
   })
 })
+
+// WL-10 billing honesty: a non-paying company under a byrå team with an
+// active team-scoped manual grant gets the additive teamAgreement field.
+describe('GET /api/billing/status team agreement', () => {
+  it('returns teamAgreement for a byrå-covered non-paying company', async () => {
+    authAs({
+      company_subscriptions: { data: null },
+      capability_grants: { data: null },
+    })
+    serviceByTable = {
+      companies: { data: { team_id: 'team-1' } },
+      teams: { data: { name: 'Siffran AB', kind: 'byra' } },
+      capability_grants: { data: [{ expires_at: null }] },
+    }
+
+    const { status, body } = await parseJsonResponse<StatusBody>(await GET())
+    expect(status).toBe(200)
+    expect(body.isPaying).toBe(false)
+    expect(body.teamAgreement).toEqual({ teamName: 'Siffran AB' })
+  })
+
+  it('accepts a future-dated grant expiry', async () => {
+    authAs({
+      company_subscriptions: { data: null },
+      capability_grants: { data: null },
+    })
+    serviceByTable = {
+      companies: { data: { team_id: 'team-1' } },
+      teams: { data: { name: 'Siffran AB', kind: 'byra' } },
+      capability_grants: { data: [{ expires_at: '2099-01-01T00:00:00Z' }] },
+    }
+
+    const { body } = await parseJsonResponse<StatusBody>(await GET())
+    expect(body.teamAgreement).toEqual({ teamName: 'Siffran AB' })
+  })
+
+  it('ignores an expired team grant (grace lapsed: standard paywall)', async () => {
+    authAs({
+      company_subscriptions: { data: null },
+      capability_grants: { data: null },
+    })
+    serviceByTable = {
+      companies: { data: { team_id: 'team-1' } },
+      teams: { data: { name: 'Siffran AB', kind: 'byra' } },
+      capability_grants: { data: [{ expires_at: '2020-01-01T00:00:00Z' }] },
+    }
+
+    const { body } = await parseJsonResponse<StatusBody>(await GET())
+    expect(body.isPaying).toBe(false)
+    expect(body.teamAgreement).toBeUndefined()
+  })
+
+  it('ignores a personal team even with a manual grant', async () => {
+    authAs({
+      company_subscriptions: { data: null },
+      capability_grants: { data: null },
+    })
+    serviceByTable = {
+      companies: { data: { team_id: 'team-1' } },
+      teams: { data: { name: 'Personal', kind: 'personal' } },
+      capability_grants: { data: [{ expires_at: null }] },
+    }
+
+    const { body } = await parseJsonResponse<StatusBody>(await GET())
+    expect(body.teamAgreement).toBeUndefined()
+  })
+
+  it('leaves a teamless company unchanged', async () => {
+    authAs({
+      company_subscriptions: { data: null },
+      capability_grants: { data: { expires_at: '2099-01-01T00:00:00Z' } },
+    })
+    serviceByTable = {
+      companies: { data: { team_id: null } },
+    }
+
+    const { body } = await parseJsonResponse<StatusBody>(await GET())
+    expect(body.isPaying).toBe(false)
+    expect(body.trialEndsAt).toBe('2099-01-01T00:00:00Z')
+    expect(body.teamAgreement).toBeUndefined()
+    expect('teamAgreement' in (body as object)).toBe(false)
+  })
+
+  it('never consults the team path for a paying company', async () => {
+    authAs({
+      company_subscriptions: { data: { status: 'active' } },
+      capability_grants: { data: null },
+    })
+
+    const { body } = await parseJsonResponse<StatusBody>(await GET())
+    expect(body.isPaying).toBe(true)
+    expect(body.teamAgreement).toBeUndefined()
+    expect(createServiceClientMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/app/api/billing/status/route.ts b/app/api/billing/status/route.ts
index b116e57c..069e409a 100644
--- a/app/api/billing/status/route.ts
+++ b/app/api/billing/status/route.ts
@@ -1,14 +1,21 @@
 import { NextResponse } from 'next/server'
 import { requireAuth } from '@/lib/auth/require-auth'
+import { createServiceClient } from '@/lib/supabase/server'
 import { requireCompanyId } from '@/lib/company/context'
 import { isStripeConfigured } from '@/lib/stripe/client'
 import { isSandboxCompany } from '@/lib/sandbox/guard'
+import { getTeamAgreement, type TeamAgreement } from '@/lib/entitlements/team-agreement'
 
 /**
  * Billing status for the client-rendered billing section (which lives inside the
  * settings modal Dialog and can't read the DB server-side). Returns whether the
  * company is paying, whether Stripe checkout is configured, and the trial expiry
  * (for the days-left urgency banner). Read-only.
+ *
+ * WL-10: a non-paying company covered by its byrå team's agreement (active
+ * team-scoped manual grant) additionally gets `teamAgreement: { teamName }`,
+ * which the settings surface renders as "Ingår i <byråns namn>s avtal"
+ * instead of the upgrade pitch. Additive field: absent for everyone else.
  */
 export async function GET() {
   const { user, supabase, error } = await requireAuth()
@@ -30,6 +37,7 @@ export async function GET() {
 
   let isPaying = false
   let trialEndsAt: string | null = null
+  let teamAgreement: TeamAgreement | null = null
   if (companyId) {
     const { data: sub } = await supabase
       .from('company_subscriptions')
@@ -53,7 +61,21 @@ export async function GET() {
       .limit(1)
       .maybeSingle()
     trialEndsAt = (trial as { expires_at: string | null } | null)?.expires_at ?? null
+
+    // Team entitlement (WL-10): only consulted when the company isn't paying
+    // on its own subscription. Service client by necessity: end clients are
+    // not members of the byrå team, so RLS hides the team and its grants
+    // from the user's session.
+    if (!isPaying) {
+      teamAgreement = await getTeamAgreement(createServiceClient(), companyId)
+    }
   }
 
-  return NextResponse.json({ isPaying, configured: isStripeConfigured(), trialEndsAt, isDemo })
+  return NextResponse.json({
+    isPaying,
+    configured: isStripeConfigured(),
+    trialEndsAt,
+    isDemo,
+    ...(teamAgreement ? { teamAgreement } : {}),
+  })
 }
diff --git a/app/api/byra/brand/__tests__/route.test.ts b/app/api/byra/brand/__tests__/route.test.ts
new file mode 100644
index 00000000..8a15c37f
--- /dev/null
+++ b/app/api/byra/brand/__tests__/route.test.ts
@@ -0,0 +1,179 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextResponse } from 'next/server'
+import { parseJsonResponse } from '@/tests/helpers'
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+  requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+const getByraMembershipMock = vi.fn()
+vi.mock('@/lib/clients/fetch-client-overview', () => ({
+  getByraMembership: (...args: unknown[]) => getByraMembershipMock(...args),
+}))
+
+const clearBrandCacheMock = vi.fn()
+vi.mock('@/lib/branding/resolve', () => ({
+  clearBrandCache: (...args: unknown[]) => clearBrandCacheMock(...args),
+}))
+
+interface BrandRow {
+  domain?: string
+  app_name?: string
+  logo_url?: string | null
+  id?: string
+}
+
+let brandRow: BrandRow | null = null
+let brandReadError: { message: string } | null = null
+let updateError: { message: string } | null = null
+
+const updateEqMock = vi.fn(async () => ({ error: updateError }))
+const updateMock = vi.fn(() => ({ eq: updateEqMock }))
+
+vi.mock('@/lib/supabase/server', () => ({
+  createServiceClient: () => ({
+    from: () => ({
+      select: () => ({
+        eq: () => ({
+          maybeSingle: async () => ({ data: brandRow, error: brandReadError }),
+        }),
+      }),
+      update: updateMock,
+    }),
+  }),
+}))
+
+import { GET, PATCH } from '../route'
+
+function patchRequest(body: unknown): Request {
+  return new Request('http://localhost/api/byra/brand', {
+    method: 'PATCH',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  })
+}
+
+function authed() {
+  requireAuthMock.mockResolvedValue({ user: { id: 'user-1' }, error: null })
+}
+
+function unauthed() {
+  requireAuthMock.mockResolvedValue({
+    user: null,
+    error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+  })
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  brandRow = null
+  brandReadError = null
+  updateError = null
+})
+
+describe('GET /api/byra/brand', () => {
+  it('returns 401 when unauthenticated', async () => {
+    unauthed()
+    const res = await GET()
+    expect(res.status).toBe(401)
+  })
+
+  it('returns 403 for a user without a byrå team', async () => {
+    authed()
+    getByraMembershipMock.mockResolvedValue(null)
+    const res = await GET()
+    expect(res.status).toBe(403)
+  })
+
+  it('returns hasBrand false when the team has no brand row', async () => {
+    authed()
+    getByraMembershipMock.mockResolvedValue({ teamId: 'team-1', teamName: 'Siffra', role: 'owner' })
+    const res = await GET()
+    const { status, body } = await parseJsonResponse<{
+      data: { hasBrand: boolean; canEdit: boolean }
+    }>(res)
+    expect(status).toBe(200)
+    expect(body.data).toMatchObject({ hasBrand: false, canEdit: true })
+  })
+
+  it('returns the brand with canEdit false for a plain member', async () => {
+    authed()
+    getByraMembershipMock.mockResolvedValue({ teamId: 'team-1', teamName: 'Siffra', role: 'member' })
+    brandRow = { domain: 'willem.accounted.se', app_name: 'Siffra', logo_url: null }
+    const res = await GET()
+    const { status, body } = await parseJsonResponse<{
+      data: { hasBrand: boolean; domain: string; appName: string; logoUrl: string | null; canEdit: boolean }
+    }>(res)
+    expect(status).toBe(200)
+    expect(body.data).toEqual({
+      hasBrand: true,
+      domain: 'willem.accounted.se',
+      appName: 'Siffra',
+      logoUrl: null,
+      canEdit: false,
+    })
+  })
+
+  it('returns 500 when the brand read fails', async () => {
+    authed()
+    getByraMembershipMock.mockResolvedValue({ teamId: 'team-1', teamName: 'Siffra', role: 'admin' })
+    brandReadError = { message: 'boom' }
+    const res = await GET()
+    expect(res.status).toBe(500)
+  })
+})
+
+describe('PATCH /api/byra/brand', () => {
+  it('returns 401 when unauthenticated', async () => {
+    unauthed()
+    const res = await PATCH(patchRequest({ appName: 'Willem' }))
+    expect(res.status).toBe(401)
+  })
+
+  it('returns 403 for a plain member', async () => {
+    authed()
+    getByraMembershipMock.mockResolvedValue({ teamId: 'team-1', teamName: 'Siffra', role: 'member' })
+    const res = await PATCH(patchRequest({ appName: 'Willem' }))
+    expect(res.status).toBe(403)
+  })
+
+  it('returns 400 for an empty app name', async () => {
+    authed()
+    getByraMembershipMock.mockResolvedValue({ teamId: 'team-1', teamName: 'Siffra', role: 'owner' })
+    const res = await PATCH(patchRequest({ appName: '   ' }))
+    expect(res.status).toBe(400)
+    expect(updateMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the team has no brand row', async () => {
+    authed()
+    getByraMembershipMock.mockResolvedValue({ teamId: 'team-1', teamName: 'Siffra', role: 'owner' })
+    brandRow = null
+    const res = await PATCH(patchRequest({ appName: 'Willem' }))
+    expect(res.status).toBe(404)
+  })
+
+  it('trims, updates app_name and clears the brand cache', async () => {
+    authed()
+    getByraMembershipMock.mockResolvedValue({ teamId: 'team-1', teamName: 'Siffra', role: 'admin' })
+    brandRow = { id: 'brand-1' }
+    const res = await PATCH(patchRequest({ appName: '  Willem  ' }))
+    const { status, body } = await parseJsonResponse<{ data: { app_name: string } }>(res)
+
+    expect(status).toBe(200)
+    expect(body.data.app_name).toBe('Willem')
+    expect(updateMock).toHaveBeenCalledWith({ app_name: 'Willem' })
+    expect(clearBrandCacheMock).toHaveBeenCalled()
+  })
+
+  it('returns 500 when the update fails', async () => {
+    authed()
+    getByraMembershipMock.mockResolvedValue({ teamId: 'team-1', teamName: 'Siffra', role: 'owner' })
+    brandRow = { id: 'brand-1' }
+    updateError = { message: 'nope' }
+    const res = await PATCH(patchRequest({ appName: 'Willem' }))
+    expect(res.status).toBe(500)
+    expect(clearBrandCacheMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/app/api/byra/brand/logo/__tests__/route.test.ts b/app/api/byra/brand/logo/__tests__/route.test.ts
new file mode 100644
index 00000000..7a31c558
--- /dev/null
+++ b/app/api/byra/brand/logo/__tests__/route.test.ts
@@ -0,0 +1,180 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextResponse } from 'next/server'
+import { parseJsonResponse } from '@/tests/helpers'
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+  requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+const getByraMembershipMock = vi.fn()
+vi.mock('@/lib/clients/fetch-client-overview', () => ({
+  getByraMembership: (...args: unknown[]) => getByraMembershipMock(...args),
+}))
+
+const clearBrandCacheMock = vi.fn()
+vi.mock('@/lib/branding/resolve', () => ({
+  clearBrandCache: (...args: unknown[]) => clearBrandCacheMock(...args),
+}))
+
+let brandRow: { id: string; logo_url?: string | null } | null = null
+let updateError: { message: string } | null = null
+
+const updateEqMock = vi.fn(async () => ({ error: updateError }))
+const updateMock = vi.fn(() => ({ eq: updateEqMock }))
+const storageListMock = vi.fn(async () => ({ data: [{ name: 'logo-old.png' }] }))
+const storageRemoveMock = vi.fn(async () => ({ error: null }))
+const storageUploadMock = vi.fn(async () => ({ error: null }))
+const storageGetPublicUrlMock = vi.fn(() => ({
+  data: { publicUrl: 'https://cdn.test/logos/byra/team-1/logo-2.png' },
+}))
+
+vi.mock('@/lib/supabase/server', () => ({
+  createServiceClient: () => ({
+    from: () => ({
+      select: () => ({
+        eq: () => ({
+          maybeSingle: async () => ({ data: brandRow, error: null }),
+        }),
+      }),
+      update: updateMock,
+    }),
+    storage: {
+      from: () => ({
+        list: storageListMock,
+        remove: storageRemoveMock,
+        upload: storageUploadMock,
+        getPublicUrl: storageGetPublicUrlMock,
+      }),
+    },
+  }),
+}))
+
+import { POST, DELETE } from '../route'
+
+function authed() {
+  requireAuthMock.mockResolvedValue({ user: { id: 'user-1' }, error: null })
+}
+
+function unauthed() {
+  requireAuthMock.mockResolvedValue({
+    user: null,
+    error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+  })
+}
+
+function ownerMembership() {
+  getByraMembershipMock.mockResolvedValue({ teamId: 'team-1', teamName: 'Siffra', role: 'owner' })
+}
+
+function uploadRequest(type = 'image/png', size = 128): Request {
+  const file = new File([new Uint8Array(size)], 'logo.png', { type })
+  const formData = new FormData()
+  formData.append('file', file)
+  return new Request('http://localhost/api/byra/brand/logo', { method: 'POST', body: formData })
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  brandRow = { id: 'brand-1', logo_url: null }
+  updateError = null
+})
+
+describe('POST /api/byra/brand/logo', () => {
+  it('returns 401 when unauthenticated', async () => {
+    unauthed()
+    const res = await POST(uploadRequest())
+    expect(res.status).toBe(401)
+  })
+
+  it('returns 403 for a user without a byrå team', async () => {
+    authed()
+    getByraMembershipMock.mockResolvedValue(null)
+    const res = await POST(uploadRequest())
+    expect(res.status).toBe(403)
+  })
+
+  it('returns 403 for a plain member', async () => {
+    authed()
+    getByraMembershipMock.mockResolvedValue({ teamId: 'team-1', teamName: 'Siffra', role: 'member' })
+    const res = await POST(uploadRequest())
+    expect(res.status).toBe(403)
+  })
+
+  it('returns 404 when the team has no brand row', async () => {
+    authed()
+    ownerMembership()
+    brandRow = null
+    const res = await POST(uploadRequest())
+    expect(res.status).toBe(404)
+  })
+
+  it('returns 400 when no file is attached', async () => {
+    authed()
+    ownerMembership()
+    const formData = new FormData()
+    const res = await POST(
+      new Request('http://localhost/api/byra/brand/logo', { method: 'POST', body: formData }),
+    )
+    expect(res.status).toBe(400)
+  })
+
+  it('returns 400 for a disallowed file type', async () => {
+    authed()
+    ownerMembership()
+    const res = await POST(uploadRequest('application/pdf'))
+    expect(res.status).toBe(400)
+  })
+
+  it('uploads, purges old files, updates brands.logo_url and clears the cache', async () => {
+    authed()
+    ownerMembership()
+    const res = await POST(uploadRequest())
+    const { status, body } = await parseJsonResponse<{ data: { logo_url: string } }>(res)
+
+    expect(status).toBe(200)
+    expect(body.data.logo_url).toBe('https://cdn.test/logos/byra/team-1/logo-2.png')
+    expect(storageRemoveMock).toHaveBeenCalledWith(['byra/team-1/logo-old.png'])
+    expect(storageUploadMock).toHaveBeenCalledWith(
+      expect.stringMatching(/^byra\/team-1\/logo-\d+\.png$/),
+      expect.any(Buffer),
+      { contentType: 'image/png', upsert: true },
+    )
+    expect(updateMock).toHaveBeenCalledWith({
+      logo_url: 'https://cdn.test/logos/byra/team-1/logo-2.png',
+    })
+    expect(clearBrandCacheMock).toHaveBeenCalled()
+  })
+
+  it('returns 500 when the brands update fails', async () => {
+    authed()
+    ownerMembership()
+    updateError = { message: 'nope' }
+    const res = await POST(uploadRequest())
+    expect(res.status).toBe(500)
+    expect(clearBrandCacheMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('DELETE /api/byra/brand/logo', () => {
+  it('returns 403 for a plain member', async () => {
+    authed()
+    getByraMembershipMock.mockResolvedValue({ teamId: 'team-1', teamName: 'Siffra', role: 'member' })
+    const res = await DELETE()
+    expect(res.status).toBe(403)
+  })
+
+  it('purges files, nulls logo_url and clears the cache', async () => {
+    authed()
+    ownerMembership()
+    brandRow = { id: 'brand-1', logo_url: 'https://cdn.test/old.png' }
+    const res = await DELETE()
+    const { status, body } = await parseJsonResponse<{ data: { logo_url: null } }>(res)
+
+    expect(status).toBe(200)
+    expect(body.data.logo_url).toBeNull()
+    expect(storageRemoveMock).toHaveBeenCalledWith(['byra/team-1/logo-old.png'])
+    expect(updateMock).toHaveBeenCalledWith({ logo_url: null })
+    expect(clearBrandCacheMock).toHaveBeenCalled()
+  })
+})
diff --git a/app/api/byra/brand/logo/route.ts b/app/api/byra/brand/logo/route.ts
new file mode 100644
index 00000000..9db14bfb
--- /dev/null
+++ b/app/api/byra/brand/logo/route.ts
@@ -0,0 +1,140 @@
+import { NextResponse } from 'next/server'
+import { requireAuth } from '@/lib/auth/require-auth'
+import { createServiceClient } from '@/lib/supabase/server'
+import { requireByraBrandAccess } from '@/lib/byra/brand-access'
+import { clearBrandCache } from '@/lib/branding/resolve'
+import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'
+import { LOGO_UPLOAD_MAX_BYTES, LOGO_UPLOAD_MAX_MB } from '@/lib/invoices/branding-constants'
+
+/**
+ * POST/DELETE /api/byra/brand/logo
+ * Byrå self-service brand logo (the ONE brand field byråer edit themselves;
+ * domain, app name and colors stay ops-managed, see DECISIONS.md).
+ *
+ * brands has no write RLS (ops-managed rows), so writes go through the
+ * service client behind an explicit owner/admin check on the caller's byrå
+ * team: the same authorization idiom as /api/team/members. Files live in
+ * the public `logos` bucket under byra/{teamId}/ (company invoice logos use
+ * {companyId}/ top-level; the byra/ prefix keeps the namespaces apart).
+ *
+ * The timestamped filename doubles as a cache-buster; the 60s brand cache
+ * in lib/branding/resolve.ts means other lambda instances can serve the old
+ * logo_url for up to a minute after a change. clearBrandCache() covers the
+ * instance that handled the write.
+ */
+
+const ALLOWED_TYPES = ['image/png', 'image/jpeg', 'image/svg+xml', 'image/webp']
+
+async function purgeLogoFiles(
+  serviceClient: ReturnType<typeof createServiceClient>,
+  teamId: string,
+): Promise<void> {
+  const prefix = `byra/${teamId}`
+  const { data: existing } = await serviceClient.storage.from('logos').list(prefix)
+  if (existing && existing.length > 0) {
+    await serviceClient.storage
+      .from('logos')
+      .remove(existing.map((f) => `${prefix}/${f.name}`))
+  }
+}
+
+export async function POST(request: Request) {
+  const { user, error } = await requireAuth()
+  if (error) return error
+
+  const { teamId, serviceClient, errorResponse } = await requireByraBrandAccess(user.id)
+  if (errorResponse) return errorResponse
+
+  const { data: brand } = await serviceClient
+    .from('brands')
+    .select('id')
+    .eq('team_id', teamId)
+    .maybeSingle()
+  if (!brand) {
+    return NextResponse.json({ error: 'Ingen varumärkesprofil är aktiverad ännu.' }, { status: 404 })
+  }
+
+  const formData = await request.formData()
+  const file = formData.get('file') as File | null
+
+  if (!file) {
+    return NextResponse.json({ error: 'Ingen fil angiven' }, { status: 400 })
+  }
+  if (!ALLOWED_TYPES.includes(file.type)) {
+    return NextResponse.json(
+      { error: 'Otillåten filtyp. Tillåtna: PNG, JPG, SVG, WebP.' },
+      { status: 400 },
+    )
+  }
+  if (file.size > LOGO_UPLOAD_MAX_BYTES) {
+    return NextResponse.json(
+      { error: `Filen är för stor (max ${LOGO_UPLOAD_MAX_MB} MB).` },
+      { status: 400 },
+    )
+  }
+
+  const buffer = Buffer.from(await file.arrayBuffer())
+  const mimeToExt: Record<string, string> = {
+    'image/png': 'png',
+    'image/jpeg': 'jpg',
+    'image/svg+xml': 'svg',
+    'image/webp': 'webp',
+  }
+  const ext = mimeToExt[file.type] ?? 'png'
+  const storagePath = `byra/${teamId}/logo-${Date.now()}.${ext}`
+
+  await purgeLogoFiles(serviceClient, teamId)
+
+  const { error: uploadError } = await serviceClient.storage
+    .from('logos')
+    .upload(storagePath, buffer, { contentType: file.type, upsert: true })
+  if (uploadError) {
+    return NextResponse.json(
+      { error: `Uppladdning misslyckades: ${getUserErrorMessage(uploadError)}` },
+      { status: 500 },
+    )
+  }
+
+  const { data: urlData } = serviceClient.storage.from('logos').getPublicUrl(storagePath)
+
+  const { error: updateError } = await serviceClient
+    .from('brands')
+    .update({ logo_url: urlData.publicUrl })
+    .eq('team_id', teamId)
+  if (updateError) {
+    return NextResponse.json({ error: 'Kunde inte uppdatera varumärket.' }, { status: 500 })
+  }
+
+  clearBrandCache()
+  return NextResponse.json({ data: { logo_url: urlData.publicUrl } })
+}
+
+export async function DELETE() {
+  const { user, error } = await requireAuth()
+  if (error) return error
+
+  const { teamId, serviceClient, errorResponse } = await requireByraBrandAccess(user.id)
+  if (errorResponse) return errorResponse
+
+  const { data: brand } = await serviceClient
+    .from('brands')
+    .select('id, logo_url')
+    .eq('team_id', teamId)
+    .maybeSingle()
+  if (!brand) {
+    return NextResponse.json({ error: 'Ingen varumärkesprofil är aktiverad ännu.' }, { status: 404 })
+  }
+
+  await purgeLogoFiles(serviceClient, teamId)
+
+  const { error: updateError } = await serviceClient
+    .from('brands')
+    .update({ logo_url: null })
+    .eq('team_id', teamId)
+  if (updateError) {
+    return NextResponse.json({ error: 'Kunde inte uppdatera varumärket.' }, { status: 500 })
+  }
+
+  clearBrandCache()
+  return NextResponse.json({ data: { logo_url: null } })
+}
diff --git a/app/api/byra/brand/route.ts b/app/api/byra/brand/route.ts
new file mode 100644
index 00000000..9c818460
--- /dev/null
+++ b/app/api/byra/brand/route.ts
@@ -0,0 +1,96 @@
+import { NextResponse } from 'next/server'
+import { requireAuth } from '@/lib/auth/require-auth'
+import { createServiceClient } from '@/lib/supabase/server'
+import { getByraMembership } from '@/lib/clients/fetch-client-overview'
+import { requireByraBrandAccess } from '@/lib/byra/brand-access'
+import { clearBrandCache } from '@/lib/branding/resolve'
+import { validateBody } from '@/lib/api/validate'
+import { ByraBrandUpdateSchema } from '@/lib/api/schemas'
+
+/**
+ * GET /api/byra/brand
+ * The caller's byrå brand profile for the Varumärke settings section.
+ *
+ * Team-scoped, not company-scoped: uses requireAuth() directly (like
+ * /api/team/members) because the byrå cockpit has no active-company
+ * context. requireAuth still enforces MFA (AAL2) on hosted.
+ *
+ * Reads the brands row directly through the service client instead of the
+ * cached resolveBrandForTeam(): the settings form must show what is stored
+ * NOW, not a value up to 60s stale (lib/branding/resolve.ts cache).
+ */
+export async function GET() {
+  const { user, error } = await requireAuth()
+  if (error) return error
+
+  const serviceClient = createServiceClient()
+  const membership = await getByraMembership(serviceClient, user.id)
+  if (!membership) {
+    return NextResponse.json({ error: 'Endast för byråteam.' }, { status: 403 })
+  }
+
+  const { data: brand, error: brandError } = await serviceClient
+    .from('brands')
+    .select('domain, app_name, logo_url')
+    .eq('team_id', membership.teamId)
+    .maybeSingle()
+
+  if (brandError) {
+    return NextResponse.json({ error: 'Kunde inte hämta varumärket.' }, { status: 500 })
+  }
+
+  const canEdit = membership.role === 'owner' || membership.role === 'admin'
+
+  if (!brand) {
+    return NextResponse.json({
+      data: { hasBrand: false, domain: null, appName: null, logoUrl: null, canEdit },
+    })
+  }
+
+  return NextResponse.json({
+    data: {
+      hasBrand: true,
+      domain: brand.domain,
+      appName: brand.app_name,
+      logoUrl: brand.logo_url,
+      canEdit,
+    },
+  })
+}
+
+/**
+ * PATCH /api/byra/brand
+ * Byrå self-service app name (WL-17): the name shown beside the sidebar
+ * logo and across branded chrome. Owner/admin only; domain and colors stay
+ * ops-managed. Same service-client write path as the logo route.
+ */
+export async function PATCH(request: Request) {
+  const { user, error } = await requireAuth()
+  if (error) return error
+
+  const { teamId, serviceClient, errorResponse } = await requireByraBrandAccess(user.id)
+  if (errorResponse) return errorResponse
+
+  const validation = await validateBody(request, ByraBrandUpdateSchema)
+  if (!validation.success) return validation.response
+
+  const { data: brand } = await serviceClient
+    .from('brands')
+    .select('id')
+    .eq('team_id', teamId)
+    .maybeSingle()
+  if (!brand) {
+    return NextResponse.json({ error: 'Ingen varumärkesprofil är aktiverad ännu.' }, { status: 404 })
+  }
+
+  const { error: updateError } = await serviceClient
+    .from('brands')
+    .update({ app_name: validation.data.appName })
+    .eq('team_id', teamId)
+  if (updateError) {
+    return NextResponse.json({ error: 'Kunde inte uppdatera varumärket.' }, { status: 500 })
+  }
+
+  clearBrandCache()
+  return NextResponse.json({ data: { app_name: validation.data.appName } })
+}
diff --git a/app/api/clients/__tests__/route.test.ts b/app/api/clients/__tests__/route.test.ts
new file mode 100644
index 00000000..9dd45330
--- /dev/null
+++ b/app/api/clients/__tests__/route.test.ts
@@ -0,0 +1,201 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextResponse } from 'next/server'
+import {
+  createQueuedMockSupabase,
+  createMockRequest,
+  parseJsonResponse,
+} from '@/tests/helpers'
+
+const { supabase, enqueue, reset } = createQueuedMockSupabase()
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+  requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+vi.mock('@/lib/company/context', () => ({
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+  requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+import { GET } from '../route'
+
+const noParams = { params: Promise.resolve({}) }
+
+function authed() {
+  requireAuthMock.mockResolvedValue({ user: { id: 'user-1' }, supabase, error: null })
+}
+
+function unauthed() {
+  requireAuthMock.mockResolvedValue({
+    user: null,
+    supabase,
+    error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+  })
+}
+
+function isoDaysFromNow(days: number): string {
+  const d = new Date()
+  d.setHours(0, 0, 0, 0)
+  d.setDate(d.getDate() + days)
+  // Local date parts, not toISOString(): UTC conversion would shift the day
+  // in timezones ahead of UTC and skew the urgency math under test.
+  const y = d.getFullYear()
+  const m = String(d.getMonth() + 1).padStart(2, '0')
+  const day = String(d.getDate()).padStart(2, '0')
+  return `${y}-${m}-${day}`
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  reset()
+})
+
+describe('GET /api/clients', () => {
+  it('returns 401 when unauthenticated', async () => {
+    unauthed()
+    const res = await GET(createMockRequest('/api/clients'), noParams)
+    expect(res.status).toBe(401)
+  })
+
+  it('returns 403 for a user without a byrå team', async () => {
+    authed()
+    // Query 1: byrå team membership lookup: no rows.
+    enqueue({ data: [] })
+
+    const res = await GET(createMockRequest('/api/clients'), noParams)
+    const { status, body } = await parseJsonResponse<{
+      error: { code: string }
+    }>(res)
+
+    expect(status).toBe(403)
+    expect(body.error.code).toBe('FORBIDDEN')
+  })
+
+  it('aggregates one urgency-sorted row per client company', async () => {
+    authed()
+    // 1. byrå membership
+    enqueue({
+      data: [
+        {
+          team_id: 'team-1',
+          role: 'admin',
+          teams: { id: 'team-1', name: 'Siffra', kind: 'byra' },
+        },
+      ],
+    })
+    // 2. client companies
+    enqueue({
+      data: [
+        { id: 'c1', name: 'Alpha AB', org_number: '5560125790' },
+        { id: 'c2', name: 'Beta AB', org_number: null },
+      ],
+    })
+    // 3. company_settings (display names)
+    enqueue({
+      data: [{ company_id: 'c1', company_name: 'Alpha Redovisning AB', org_number: null }],
+    })
+    // 4. unbooked transactions (canonical predicate)
+    enqueue({
+      data: [
+        { id: 't1', company_id: 'c1' },
+        { id: 't2', company_id: 'c1' },
+        { id: 't3', company_id: 'c1' },
+        { id: 't4', company_id: 'c2' },
+      ],
+    })
+    // 5. inbox items with a document that became nothing
+    enqueue({ data: [{ id: 'i1', company_id: 'c1', document_id: 'd1' }] })
+    // 6. document backstop: d1 still unlinked
+    enqueue({ data: [{ id: 'd1', company_id: 'c1' }] })
+    // 7. open deadlines: c2 has an overdue one
+    enqueue({
+      data: [
+        {
+          id: 'dl1',
+          company_id: 'c2',
+          title: 'Momsdeklaration',
+          due_date: isoDaysFromNow(-5),
+          tax_deadline_type: 'vat_declaration',
+          status: 'overdue',
+        },
+      ],
+    })
+    // 8. latest posted verifikat per company (embedded)
+    enqueue({
+      data: [
+        { id: 'c1', journal_entries: [{ entry_date: '2026-07-15' }] },
+        { id: 'c2', journal_entries: [] },
+      ],
+    })
+
+    const res = await GET(createMockRequest('/api/clients'), noParams)
+    const { status, body } = await parseJsonResponse<{
+      data: {
+        team: { id: string; name: string }
+        role: string
+        clients: Array<{
+          companyId: string
+          name: string
+          orgNumber: string | null
+          unbookedCount: number
+          inboxCount: number
+          nextDeadline: { urgency: string; dueDate: string } | null
+          lastBookedDate: string | null
+        }>
+      }
+    }>(res)
+
+    expect(status).toBe(200)
+    expect(body.data.team).toEqual({ id: 'team-1', name: 'Siffra' })
+    expect(body.data.role).toBe('admin')
+
+    // Urgency sort: c2 (overdue deadline) before c1 (bigger unbooked pile).
+    expect(body.data.clients.map((c) => c.companyId)).toEqual(['c2', 'c1'])
+
+    const [c2, c1] = body.data.clients
+    expect(c2).toMatchObject({
+      name: 'Beta AB',
+      unbookedCount: 1,
+      inboxCount: 0,
+      lastBookedDate: null,
+    })
+    expect(c2.nextDeadline).toMatchObject({
+      urgency: 'overdue',
+      dueDate: isoDaysFromNow(-5),
+    })
+
+    expect(c1).toMatchObject({
+      // company_settings display name wins over the frozen companies.name
+      name: 'Alpha Redovisning AB',
+      orgNumber: '5560125790',
+      unbookedCount: 3,
+      inboxCount: 1,
+      nextDeadline: null,
+      lastBookedDate: '2026-07-15',
+    })
+  })
+
+  it('returns an empty client list for a byrå without companies', async () => {
+    authed()
+    enqueue({
+      data: [
+        {
+          team_id: 'team-1',
+          role: 'member',
+          teams: { id: 'team-1', name: 'Siffra', kind: 'byra' },
+        },
+      ],
+    })
+    enqueue({ data: [] }) // no client companies
+
+    const res = await GET(createMockRequest('/api/clients'), noParams)
+    const { status, body } = await parseJsonResponse<{
+      data: { role: string; clients: unknown[] }
+    }>(res)
+
+    expect(status).toBe(200)
+    expect(body.data.role).toBe('member')
+    expect(body.data.clients).toEqual([])
+  })
+})
diff --git a/app/api/clients/landing/route.ts b/app/api/clients/landing/route.ts
new file mode 100644
index 00000000..cfbc42c5
--- /dev/null
+++ b/app/api/clients/landing/route.ts
@@ -0,0 +1,40 @@
+import { NextResponse } from 'next/server'
+import { withRouteContext } from '@/lib/api/with-route-context'
+import { resolveBrandByHost } from '@/lib/branding/resolve'
+import { resolveBrandsForTeams } from '@/lib/branding/team-brands'
+import { resolveLandingPath } from '@/lib/company/home-domain'
+
+/**
+ * GET /api/clients/landing
+ *
+ * Post-login landing decision (WL-14): byrå staff land in the cockpit
+ * ('/clients') when the current host is their byrå's home domain: the byrå's
+ * brand domain, or the canonical domain for a byrå without white label
+ * (WL-01). Everyone else gets '/' so their flow stays byte-identical. Called
+ * by the login and MFA-verify pages when no explicit destination was
+ * requested; any failure degrades to '/' at the caller.
+ */
+export const GET = withRouteContext('clients.landing', async (request, ctx) => {
+  const host =
+    request.headers.get('x-forwarded-host') ?? request.headers.get('host') ?? ''
+  const hostBrand = host ? await resolveBrandByHost(host) : null
+
+  const { data: memberships } = await ctx.supabase
+    .from('team_members')
+    .select('team_id, teams:team_id!inner(kind)')
+    .eq('user_id', ctx.user.id)
+    .eq('teams.kind', 'byra')
+
+  const byraTeamIds = (memberships ?? []).map((m) => m.team_id as string)
+  if (byraTeamIds.length === 0) {
+    return NextResponse.json({ data: { destination: '/' } })
+  }
+
+  const brandByTeam = await resolveBrandsForTeams(byraTeamIds)
+  const destination = resolveLandingPath({
+    hostBrandTeamId: hostBrand?.teamId ?? null,
+    byraTeams: byraTeamIds.map((id) => ({ teamId: id, hasBrand: brandByTeam.has(id) })),
+  })
+
+  return NextResponse.json({ data: { destination } })
+})
diff --git a/app/api/clients/route.ts b/app/api/clients/route.ts
new file mode 100644
index 00000000..8d398c3c
--- /dev/null
+++ b/app/api/clients/route.ts
@@ -0,0 +1,35 @@
+import { NextResponse } from 'next/server'
+import { withRouteContext } from '@/lib/api/with-route-context'
+import { errorResponseFromCode } from '@/lib/errors/get-structured-error'
+import { fetchClientOverview } from '@/lib/clients/fetch-client-overview'
+
+/**
+ * GET /api/clients
+ *
+ * Byrå cockpit aggregate (WL-14): one row per client company on the caller's
+ * byrå team (teams.kind = 'byra') with the four at-a-glance signals: unbooked
+ * transaction count, unconsumed inbox document count, next deadline
+ * (status-engine semantics, 14-day ACTION_NEEDED window) and last booked
+ * (latest posted verifikat date). Rows arrive urgency-sorted: overdue
+ * deadlines first, then largest unbooked pile.
+ *
+ * Read-only across memberships (WL-09 read-first): RLS already allows these
+ * reads via user_company_ids(); the active company is untouched.
+ *
+ * Non-byrå users get 403 FORBIDDEN: the cockpit is byrå-exclusive in v1
+ * (multi-company self-users keep the company switcher).
+ */
+export const GET = withRouteContext('clients.list', async (_request, ctx) => {
+  const overview = await fetchClientOverview(ctx.supabase, ctx.user.id)
+
+  if (!overview) {
+    return errorResponseFromCode('FORBIDDEN', ctx.log, {
+      requestId: ctx.requestId,
+      reason: 'not a byrå team member',
+      messageSv: 'Klientlistan är endast tillgänglig för byråteam.',
+      messageEn: 'The client list is only available to byrå team members.',
+    })
+  }
+
+  return NextResponse.json({ data: overview })
+})
diff --git a/app/api/company/members/invite/__tests__/route.test.ts b/app/api/company/members/invite/__tests__/route.test.ts
index bbde3276..06a890c9 100644
--- a/app/api/company/members/invite/__tests__/route.test.ts
+++ b/app/api/company/members/invite/__tests__/route.test.ts
@@ -46,10 +46,18 @@ vi.mock('@/lib/email/service', () => ({
   getEmailService: () => ({ isConfigured: isConfiguredMock, sendEmail: sendEmailMock }),
 }))
 
-const generateInviteEmailHtmlMock = vi.fn(() => '<p>html</p>')
+const brandSenderMock = vi.hoisted(() => ({
+  getSenderForCompany: vi.fn(),
+  getBaseUrlForBrand: vi.fn(),
+}))
+vi.mock('@/lib/email/brand-sender', () => brandSenderMock)
+
+const generateInviteEmailHtmlMock = vi.hoisted(() =>
+  vi.fn((data: { inviteUrl: string }) => `<p>${data.inviteUrl}</p>`),
+)
 vi.mock('@/lib/email/invite-templates', () => ({
   generateInviteEmailSubject: () => 'subject',
-  generateInviteEmailHtml: (...args: unknown[]) => generateInviteEmailHtmlMock(...args),
+  generateInviteEmailHtml: generateInviteEmailHtmlMock,
   generateInviteEmailText: () => 'text',
 }))
 
@@ -81,6 +89,13 @@ beforeEach(() => {
   requireWriteMock.mockResolvedValue({ ok: true })
   isConfiguredMock.mockReturnValue(true)
   sendEmailMock.mockResolvedValue({ success: true, messageId: 'msg-1' })
+  brandSenderMock.getSenderForCompany.mockResolvedValue({
+    fromName: null,
+    fromAddress: null,
+    replyTo: null,
+    brand: null,
+  })
+  brandSenderMock.getBaseUrlForBrand.mockReturnValue('http://localhost:3000')
   inviteUserByEmailMock.mockResolvedValue({ data: { user: { id: 'new-user' } }, error: null })
 })
 
@@ -150,6 +165,65 @@ describe('POST /api/company/members/invite', () => {
     )
   })
 
+  it('sends the branded invite: brand link base, brand appName, brand sender', async () => {
+    brandSenderMock.getSenderForCompany.mockResolvedValue({
+      fromName: 'Siffra',
+      fromAddress: 'noreply@post.siffra.se',
+      replyTo: 'support@siffra.se',
+      brand: { appName: 'Siffra', domain: 'app.siffra.se' },
+    })
+    brandSenderMock.getBaseUrlForBrand.mockReturnValue('https://app.siffra.se')
+
+    enqueue({ data: { role: 'owner' } })
+    enqueue({ data: [] })
+    enqueue({ data: null })
+    enqueue({ data: { name: 'Kund AB' } })
+    enqueue({ data: null })
+
+    const { status } = await parseJsonResponse(
+      await post({ email: 'client@example.com' })
+    )
+
+    expect(status).toBe(200)
+    expect(generateInviteEmailHtmlMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        inviteUrl: 'https://app.siffra.se/invite/tok-plain',
+        appName: 'Siffra',
+      })
+    )
+    expect(sendEmailMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        fromName: 'Siffra',
+        fromAddress: 'noreply@post.siffra.se',
+        replyTo: 'support@siffra.se',
+      })
+    )
+  })
+
+  it('keeps the canonical link and platform sender for an unbranded company', async () => {
+    enqueue({ data: { role: 'owner' } })
+    enqueue({ data: [] })
+    enqueue({ data: null })
+    enqueue({ data: { name: 'Kund AB' } })
+    enqueue({ data: null })
+
+    const { status } = await parseJsonResponse(
+      await post({ email: 'client@example.com' })
+    )
+
+    expect(status).toBe(200)
+    expect(generateInviteEmailHtmlMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        inviteUrl: 'https://app.accounted.test/invite/tok-plain',
+        appName: undefined,
+      })
+    )
+    const options = sendEmailMock.mock.calls[0][0]
+    expect(options.fromName).toBeUndefined()
+    expect(options.fromAddress).toBeUndefined()
+    expect(options.replyTo).toBeUndefined()
+  })
+
   it('reports email_sent=false when the send fails (invite still created)', async () => {
     enqueue({ data: { role: 'owner' } })
     enqueue({ data: [] })
diff --git a/app/api/company/members/invite/route.ts b/app/api/company/members/invite/route.ts
index dfc9f735..48940ec5 100644
--- a/app/api/company/members/invite/route.ts
+++ b/app/api/company/members/invite/route.ts
@@ -7,6 +7,7 @@ import { validateBody } from '@/lib/api/validate'
 import { generateInviteToken, getInviteExpiry } from '@/lib/auth/invite-tokens'
 import { getErrorMessage } from '@/lib/errors/get-error-message'
 import { getEmailService } from '@/lib/email/service'
+import { getSenderForCompany, getBaseUrlForBrand } from '@/lib/email/brand-sender'
 import {
   generateInviteEmailSubject,
   generateInviteEmailHtml,
@@ -213,15 +214,22 @@ export const POST = withRouteContext(
     // Send email. email_sent is surfaced in the response so the UI can tell
     // the user when the invitation exists but the mail never went out:
     // previously a send failure was invisible (invite looked sent).
+    // Brand mail (WL-13): sender identity and the invite link follow the
+    // brand of the company the invite concerns; a company without a brand
+    // uses the validated request origin (appOrigin) and sender exactly as
+    // before.
+    const sender = await getSenderForCompany(companyId)
+    const appUrl = sender.brand ? getBaseUrlForBrand(sender.brand) : appOrigin
     const emailService = getEmailService()
     let emailSent = false
     if (emailService.isConfigured()) {
-      const inviteUrl = `${appOrigin}/invite/${token}`
+      const inviteUrl = `${appUrl}/invite/${token}`
 
       const emailData = {
         companyName: company?.name || 'Företag',
         inviterEmail: user.email || '',
         inviteUrl,
+        appName: sender.brand?.appName,
       }
 
       const result = await emailService.sendEmail({
@@ -229,6 +237,9 @@ export const POST = withRouteContext(
         subject: generateInviteEmailSubject(emailData),
         html: generateInviteEmailHtml(emailData),
         text: generateInviteEmailText(emailData),
+        fromName: sender.fromName ?? undefined,
+        fromAddress: sender.fromAddress ?? undefined,
+        replyTo: sender.replyTo ?? undefined,
       })
 
       if (result.success) {
@@ -243,7 +254,7 @@ export const POST = withRouteContext(
 
     // In development, return the invite URL directly (no email service)
     const isDev = process.env.NODE_ENV === 'development'
-    const devInviteUrl = isDev ? `${appOrigin}/invite/${token}` : undefined
+    const devInviteUrl = isDev ? `${appUrl}/invite/${token}` : undefined
 
     return NextResponse.json({
       data: {
diff --git a/app/api/invoices/reminders/action/__tests__/route.test.ts b/app/api/invoices/reminders/action/__tests__/route.test.ts
index e71bae60..b554042f 100644
--- a/app/api/invoices/reminders/action/__tests__/route.test.ts
+++ b/app/api/invoices/reminders/action/__tests__/route.test.ts
@@ -31,6 +31,11 @@ vi.mock('@supabase/ssr', () => {
   }
 })
 
+const resolveBrandForCompanyMock = vi.hoisted(() => vi.fn())
+vi.mock('@/lib/branding/resolve', () => ({
+  resolveBrandForCompany: resolveBrandForCompanyMock,
+}))
+
 import { GET } from '../route'
 import { createMockRequest, parseJsonResponse } from '@/tests/helpers'
 
@@ -42,11 +47,13 @@ interface ActionPayload {
   reminderFeeCurrency: string
   totalDue: number
   feeDueSeparately: number
+  brand: { appName: string; logoUrl: string | null; brandColor: string } | null
 }
 
 function makeReminderRow(currency: string, total: number) {
   return {
     id: 'reminder-1',
+    company_id: 'company-1',
     reminder_level: 1,
     sent_at: '2026-05-20T08:00:00Z',
     response_type: null,
@@ -81,6 +88,7 @@ async function callGet() {
 describe('GET /api/invoices/reminders/action', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    resolveBrandForCompanyMock.mockResolvedValue(null)
   })
 
   it('returns 400 without a token', async () => {
@@ -128,4 +136,28 @@ describe('GET /api/invoices/reminders/action', () => {
     expect(body.reminderFee).toBe(60)
     expect(body.totalDue).toBe(510)
   })
+
+  it('returns the company brand for the public page when one exists (WL-13)', async () => {
+    resolveBrandForCompanyMock.mockResolvedValue({
+      appName: 'Siffra',
+      logoUrl: 'https://cdn.example/siffra.png',
+      brandColor: '#123456',
+      domain: 'app.siffra.se',
+    })
+    queued = { data: makeReminderRow('SEK', 10_000), error: null }
+    const { body } = await callGet()
+
+    expect(resolveBrandForCompanyMock).toHaveBeenCalledWith('company-1')
+    expect(body.brand).toEqual({
+      appName: 'Siffra',
+      logoUrl: 'https://cdn.example/siffra.png',
+      brandColor: '#123456',
+    })
+  })
+
+  it('returns brand: null for a brandless company (page unchanged)', async () => {
+    queued = { data: makeReminderRow('SEK', 10_000), error: null }
+    const { body } = await callGet()
+    expect(body.brand).toBeNull()
+  })
 })
diff --git a/app/api/invoices/reminders/action/route.ts b/app/api/invoices/reminders/action/route.ts
index e1863ce6..6a707c7f 100644
--- a/app/api/invoices/reminders/action/route.ts
+++ b/app/api/invoices/reminders/action/route.ts
@@ -4,6 +4,7 @@ import {
   calculateReminderAmounts,
   REMINDER_FEE_CURRENCY,
 } from '@/lib/email/reminder-templates'
+import { resolveBrandForCompany } from '@/lib/branding/resolve'
 
 // Create a service client (no auth needed - public endpoint with token validation)
 function createServiceClient() {
@@ -120,6 +121,7 @@ export async function GET(request: Request) {
     .from('invoice_reminders')
     .select(`
       id,
+      company_id,
       reminder_level,
       sent_at,
       response_type,
@@ -183,6 +185,12 @@ export async function GET(request: Request) {
     currency: invoice.currency,
   })
 
+  // Brand of the COMPANY the invoice concerns (WL-13): the public page styles
+  // itself by this regardless of host. Null (no brand) = today's page.
+  const brand = reminder.company_id
+    ? await resolveBrandForCompany(reminder.company_id as string)
+    : null
+
   return NextResponse.json({
     invoiceNumber: invoice.invoice_number,
     invoiceDate: invoice.invoice_date,
@@ -207,5 +215,9 @@ export async function GET(request: Request) {
     totalDue: amounts.totalDue,
     /** In SEK. Non-zero only when the fee must be demanded outside `totalDue`. */
     feeDueSeparately: amounts.feeDueSeparately,
+    /** White-label brand of the invoice's company; null keeps today's page. */
+    brand: brand
+      ? { appName: brand.appName, logoUrl: brand.logoUrl, brandColor: brand.brandColor }
+      : null,
   })
 }
diff --git a/app/api/salary/runs/[id]/payslips/send/__tests__/route.test.ts b/app/api/salary/runs/[id]/payslips/send/__tests__/route.test.ts
index 8cde2895..4d99963b 100644
--- a/app/api/salary/runs/[id]/payslips/send/__tests__/route.test.ts
+++ b/app/api/salary/runs/[id]/payslips/send/__tests__/route.test.ts
@@ -35,6 +35,11 @@ vi.mock('@/lib/entitlements/has-capability', () => ({
 vi.mock('@/lib/branding/service', () => ({
   getBranding: () => ({ appUrl: 'https://app.example.test' }),
 }))
+const brandSenderMock = vi.hoisted(() => ({
+  getSenderForCompany: vi.fn(),
+  getBaseUrlForBrand: vi.fn(),
+}))
+vi.mock('@/lib/email/brand-sender', () => brandSenderMock)
 vi.mock('@/lib/salary/payslips/links', async (importOriginal) => {
   const actual = await importOriginal<typeof import('@/lib/salary/payslips/links')>()
   return {
@@ -80,6 +85,13 @@ describe('POST /api/salary/runs/[id]/payslips/send', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     vi.mocked(rotateLinkForEmployee).mockResolvedValue({ token: 'T'.repeat(43) })
+    brandSenderMock.getSenderForCompany.mockResolvedValue({
+      fromName: null,
+      fromAddress: null,
+      replyTo: null,
+      brand: null,
+    })
+    brandSenderMock.getBaseUrlForBrand.mockReturnValue('https://app.example.test')
   })
 
   it('returns 401 when unauthenticated', async () => {
@@ -228,6 +240,44 @@ describe('POST /api/salary/runs/[id]/payslips/send', () => {
     expect(emailArgs.subject).toContain('Ny Firma AB')
   })
 
+  it('sends the branded payslip mail: brand link base + brand sender (WL-13)', async () => {
+    brandSenderMock.getSenderForCompany.mockResolvedValue({
+      fromName: 'Siffra',
+      fromAddress: 'noreply@post.siffra.se',
+      replyTo: 'support@siffra.se',
+      brand: { appName: 'Siffra', domain: 'app.siffra.se' },
+    })
+    brandSenderMock.getBaseUrlForBrand.mockReturnValue('https://app.siffra.se')
+
+    const { supabase, enqueueMany } = createQueuedMockSupabase()
+    authed(supabase)
+    const sendEmail = mockEmail({ success: true, messageId: 'msg-1' })
+
+    enqueueMany([
+      { data: RUN },
+      { data: { name: 'Bolaget AB', org_number: '5560000000' } },
+      {
+        data: [
+          {
+            employee_id: 'emp-1',
+            employee: { first_name: 'Anna', last_name: 'A', email: 'anna@example.test' },
+          },
+        ],
+      },
+    ])
+
+    const request = createMockRequest('/api/salary/runs/run-1/payslips/send', { method: 'POST' })
+    const response = await POST(request, createMockRouteParams({ id: 'run-1' }))
+    expect(response.status).toBe(200)
+
+    expect(brandSenderMock.getSenderForCompany).toHaveBeenCalledWith('company-1')
+    const emailArgs = sendEmail.mock.calls[0][0]
+    expect(emailArgs.html).toContain(`https://app.siffra.se/payslip/${'T'.repeat(43)}`)
+    expect(emailArgs.fromName).toBe('Siffra')
+    expect(emailArgs.fromAddress).toBe('noreply@post.siffra.se')
+    expect(emailArgs.replyTo).toBe('support@siffra.se')
+  })
+
   it('records provider failures without failing the whole batch', async () => {
     const { supabase, enqueueMany } = createQueuedMockSupabase()
     authed(supabase)
diff --git a/app/api/salary/runs/[id]/payslips/send/route.ts b/app/api/salary/runs/[id]/payslips/send/route.ts
index 3f804f96..9b5f5263 100644
--- a/app/api/salary/runs/[id]/payslips/send/route.ts
+++ b/app/api/salary/runs/[id]/payslips/send/route.ts
@@ -3,7 +3,7 @@ import { ensureInitialized } from '@/lib/init'
 import { withRouteContext } from '@/lib/api/with-route-context'
 import { errorResponseFromCode } from '@/lib/errors/get-structured-error'
 import { getEmailService } from '@/lib/email/service'
-import { getBranding } from '@/lib/branding/service'
+import { getSenderForCompany, getBaseUrlForBrand } from '@/lib/email/brand-sender'
 import { rotateLinkForEmployee } from '@/lib/salary/payslips/links'
 import { buildPayslipLinkEmail } from '@/lib/salary/payslips/email-template'
 import { getCompanyDisplayName } from '@/lib/company/context'
@@ -77,7 +77,10 @@ export const POST = withRouteContext<{ params: Promise<{ id: string }> }>(
       return errorResponseFromCode('SALARY_PAYSLIPS_NO_EMPLOYEES', log, { requestId })
     }
 
-    const appUrl = getBranding().appUrl
+    // Brand mail (WL-13): payslip links and the sender identity follow the
+    // company's brand; no brand = canonical URL and platform sender as before.
+    const sender = await getSenderForCompany(companyId)
+    const appUrl = getBaseUrlForBrand(sender.brand)
 
     let sent = 0
     let skipped = 0
@@ -128,6 +131,9 @@ export const POST = withRouteContext<{ params: Promise<{ id: string }> }>(
           subject: email.subject,
           html: email.html,
           text: email.text,
+          fromName: sender.fromName ?? undefined,
+          fromAddress: sender.fromAddress ?? undefined,
+          replyTo: sender.replyTo ?? undefined,
         })
 
         if (!sendResult.success) {
diff --git a/app/api/team/accept/__tests__/route.test.ts b/app/api/team/accept/__tests__/route.test.ts
index 3198697e..7064bd8c 100644
--- a/app/api/team/accept/__tests__/route.test.ts
+++ b/app/api/team/accept/__tests__/route.test.ts
@@ -1,11 +1,11 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest'
-import { NextResponse } from 'next/server'
+import { NextRequest, NextResponse } from 'next/server'
 import { parseJsonResponse, createQueuedMockSupabase } from '@/tests/helpers'
 
 // team/accept uses the service client for all DB work (invite acceptance can
 // run before the user has any company membership). requireAuth only gates the
 // caller's identity + MFA.
-const { supabase: serviceSupabase, enqueue, reset } = createQueuedMockSupabase()
+const { supabase: serviceSupabase, enqueue, reset, findCalls } = createQueuedMockSupabase()
 
 const requireAuthMock = vi.fn()
 vi.mock('@/lib/auth/require-auth', () => ({
@@ -20,7 +20,7 @@ vi.mock('@/lib/auth/invite-tokens', () => ({
   hashInviteToken: (t: string) => `hash-${t}`,
 }))
 
-import { POST } from '../route'
+import { GET, POST } from '../route'
 
 const mockUser = { id: 'user-1', email: 'invitee@test.se' }
 
@@ -101,3 +101,184 @@ describe('POST /api/team/accept', () => {
     expect(body.error).toContain('matchar inte')
   })
 })
+
+// WL-08 invite unfreeze: the same token endpoint accepts byrå-team
+// invitations. from() consumption order for the team path:
+//   1. company_invitations lookup (miss)
+//   2. team_invitations lookup
+//   3. team_members insert
+//   4. user_preferences read (active company?)
+//   5. companies read (first team company)      [only when no active company]
+//   6. user_preferences upsert                  [only when a company was found]
+//   7. team_invitations update -> accepted
+describe('POST /api/team/accept (byrå-team invitations)', () => {
+  const future = new Date(Date.now() + 86_400_000).toISOString()
+
+  const teamInvite = (overrides: Record<string, unknown> = {}) => ({
+    id: 'tinv-1',
+    team_id: 'team-byra',
+    email: 'invitee@test.se',
+    role: 'member',
+    status: 'pending',
+    expires_at: future,
+    teams: { name: 'Siffran AB', kind: 'byra' },
+    ...overrides,
+  })
+
+  it('accepts a valid byrå invite and points a company-less user at a team company', async () => {
+    enqueue({ data: null, error: { code: 'PGRST116' } }) // no company invite
+    enqueue({ data: teamInvite() })
+    enqueue({ error: null }) // team_members insert
+    enqueue({ data: null }) // user_preferences read: no active company
+    enqueue({ data: { id: 'company-9' } }) // first team company
+    enqueue({ error: null }) // user_preferences upsert
+    enqueue({ error: null }) // invitation -> accepted
+
+    const res = await POST(makeReq({ token: 'abc' }))
+    const { status, body } = await parseJsonResponse<{
+      data: { type: string; teamId: string; teamName: string }
+    }>(res)
+    expect(status).toBe(200)
+    expect(body.data).toEqual({ type: 'team', teamId: 'team-byra', teamName: 'Siffran AB' })
+
+    // The membership row is what triggers the DB-side company sync.
+    const inserts = findCalls('team_members', 'insert')
+    expect(inserts).toHaveLength(1)
+    expect(inserts[0]![0]).toEqual({
+      team_id: 'team-byra',
+      user_id: 'user-1',
+      role: 'member',
+    })
+    expect(findCalls('user_preferences', 'upsert')).toHaveLength(1)
+  })
+
+  it('never hijacks an existing active company', async () => {
+    enqueue({ data: null, error: { code: 'PGRST116' } })
+    enqueue({ data: teamInvite() })
+    enqueue({ error: null }) // team_members insert
+    enqueue({ data: { active_company_id: 'my-own-firma' } }) // has active company
+    enqueue({ error: null }) // invitation -> accepted
+
+    const res = await POST(makeReq({ token: 'abc' }))
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(200)
+    expect(findCalls('user_preferences', 'upsert')).toHaveLength(0)
+  })
+
+  it('never mints a team owner from an invitation row', async () => {
+    enqueue({ data: null, error: { code: 'PGRST116' } })
+    enqueue({ data: teamInvite({ role: 'owner' }) }) // hand-edited row
+    enqueue({ error: null })
+    enqueue({ data: { active_company_id: 'my-own-firma' } })
+    enqueue({ error: null })
+
+    const res = await POST(makeReq({ token: 'abc' }))
+    expect(res.status).toBe(200)
+    const inserts = findCalls('team_members', 'insert')
+    expect((inserts[0]![0] as { role: string }).role).toBe('member')
+  })
+
+  it('rejects a personal-team invitation token as invalid (kind gate)', async () => {
+    enqueue({ data: null, error: { code: 'PGRST116' } })
+    enqueue({ data: teamInvite({ teams: { name: 'Personal', kind: 'personal' } }) })
+
+    const res = await POST(makeReq({ token: 'abc' }))
+    const { status, body } = await parseJsonResponse<{ error: string }>(res)
+    expect(status).toBe(400)
+    expect(body.error).toBe('Inbjudan är ogiltig.')
+  })
+
+  it('returns 403 when the team invite email does not match the user', async () => {
+    enqueue({ data: null, error: { code: 'PGRST116' } })
+    enqueue({ data: teamInvite({ email: 'someone-else@test.se' }) })
+
+    const res = await POST(makeReq({ token: 'abc' }))
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(403)
+  })
+
+  it('returns 410 and marks an expired team invite', async () => {
+    const past = new Date(Date.now() - 86_400_000).toISOString()
+    enqueue({ data: null, error: { code: 'PGRST116' } })
+    enqueue({ data: teamInvite({ expires_at: past }) })
+    enqueue({ error: null }) // invitation -> expired
+
+    const res = await POST(makeReq({ token: 'abc' }))
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(410)
+    const updates = findCalls('team_invitations', 'update')
+    expect(updates[0]![0]).toEqual({ status: 'expired' })
+  })
+
+  it('returns 409 when already a team member', async () => {
+    enqueue({ data: null, error: { code: 'PGRST116' } })
+    enqueue({ data: teamInvite() })
+    enqueue({ error: { code: '23505' } }) // duplicate membership
+
+    const res = await POST(makeReq({ token: 'abc' }))
+    const { status, body } = await parseJsonResponse<{ error: string }>(res)
+    expect(status).toBe(409)
+    expect(body.error).toBe('Du är redan medlem.')
+  })
+})
+
+describe('GET /api/team/accept (byrå-team invitations)', () => {
+  function makeGetReq(token: string) {
+    return new NextRequest(`http://localhost/api/team/accept?token=${token}`)
+  }
+
+  it('returns team invite info with companyName doubling as the team name', async () => {
+    const future = new Date(Date.now() + 86_400_000).toISOString()
+    enqueue({ data: null, error: { code: 'PGRST116' } }) // no company invite
+    enqueue({
+      data: {
+        id: 'tinv-1',
+        team_id: 'team-byra',
+        email: 'invitee@test.se',
+        role: 'member',
+        status: 'pending',
+        expires_at: future,
+        teams: { name: 'Siffran AB', kind: 'byra' },
+      },
+    })
+    enqueue({ data: true }) // rpc check_email_exists
+
+    const res = await GET(makeGetReq('abc'))
+    const { status, body } = await parseJsonResponse<{
+      data: {
+        type: string
+        companyName: string
+        teamName: string
+        email: string
+        expired: boolean
+        alreadyHasAccount: boolean
+      }
+    }>(res)
+    expect(status).toBe(200)
+    expect(body.data.type).toBe('team')
+    expect(body.data.teamName).toBe('Siffran AB')
+    // The invite page renders companyName as "what you are joining".
+    expect(body.data.companyName).toBe('Siffran AB')
+    expect(body.data.expired).toBe(false)
+    expect(body.data.alreadyHasAccount).toBe(true)
+  })
+
+  it('treats a personal-team invitation token as not found', async () => {
+    enqueue({ data: null, error: { code: 'PGRST116' } })
+    enqueue({
+      data: {
+        id: 'tinv-1',
+        team_id: 'team-p',
+        email: 'invitee@test.se',
+        role: 'member',
+        status: 'pending',
+        expires_at: new Date(Date.now() + 86_400_000).toISOString(),
+        teams: { name: 'Personal', kind: 'personal' },
+      },
+    })
+
+    const res = await GET(makeGetReq('abc'))
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(404)
+  })
+})
diff --git a/app/api/team/accept/route.ts b/app/api/team/accept/route.ts
index 70dc640f..e14ba056 100644
--- a/app/api/team/accept/route.ts
+++ b/app/api/team/accept/route.ts
@@ -3,10 +3,22 @@ import { NextResponse, type NextRequest } from 'next/server'
 import { requireAuth } from '@/lib/auth/require-auth'
 import { hashInviteToken } from '@/lib/auth/invite-tokens'
 
+interface TeamInviteRow {
+  id: string
+  team_id: string
+  email: string
+  role: string
+  status: string
+  expires_at: string
+  teams: { name: string; kind: string } | null
+}
+
 /**
  * GET /api/team/accept?token=xxx
  * Validates an invite token and returns invite info (for the invite page).
- * Only company invitations are supported: team invitations are disabled.
+ * Handles both company invitations and byrå-team invitations (WL-08 invite
+ * unfreeze). Team invitations resolve only for teams with kind='byra':
+ * personal teams are uninvitable, so a token pointing at one is invalid.
  * No auth required: this is a public endpoint.
  */
 export async function GET(request: NextRequest) {
@@ -24,25 +36,64 @@ export async function GET(request: NextRequest) {
     .eq('token_hash', tokenHash)
     .single()
 
-  if (!companyInvite) {
+  if (companyInvite) {
+    if (companyInvite.status !== 'pending') {
+      return NextResponse.json({ error: 'Inbjudan har redan använts.' }, { status: 410 })
+    }
+
+    const expired = new Date(companyInvite.expires_at) < new Date()
+
+    const { data: alreadyHasAccount } = await serviceClient.rpc('check_email_exists', {
+      email_to_check: companyInvite.email,
+    })
+
+    return NextResponse.json({
+      data: {
+        type: 'company',
+        companyName: (companyInvite.companies as unknown as { name: string })?.name || 'Företag',
+        email: companyInvite.email,
+        expired,
+        alreadyHasAccount,
+      },
+    })
+  }
+
+  // No company invitation for this token: try byrå-team invitations.
+  const { data: teamInviteRaw } = await serviceClient
+    .from('team_invitations')
+    .select('id, team_id, email, role, status, expires_at, teams:team_id(name, kind)')
+    .eq('token_hash', tokenHash)
+    .single()
+
+  const teamInvite = teamInviteRaw as unknown as TeamInviteRow | null
+
+  // Kind gate: invitations exist for byrå teams only. A personal-team token
+  // (or a team whose kind was reverted after issue) is indistinguishable from
+  // an invalid token on purpose.
+  if (!teamInvite || teamInvite.teams?.kind !== 'byra') {
     return NextResponse.json({ error: 'Inbjudan hittades inte eller är ogiltig.' }, { status: 404 })
   }
 
-  if (companyInvite.status !== 'pending') {
+  if (teamInvite.status !== 'pending') {
     return NextResponse.json({ error: 'Inbjudan har redan använts.' }, { status: 410 })
   }
 
-  const expired = new Date(companyInvite.expires_at) < new Date()
+  const expired = new Date(teamInvite.expires_at) < new Date()
 
   const { data: alreadyHasAccount } = await serviceClient.rpc('check_email_exists', {
-    email_to_check: companyInvite.email,
+    email_to_check: teamInvite.email,
   })
 
+  const teamName = teamInvite.teams?.name || 'Team'
+
   return NextResponse.json({
     data: {
-      type: 'company',
-      companyName: (companyInvite.companies as unknown as { name: string })?.name || 'Företag',
-      email: companyInvite.email,
+      type: 'team',
+      // companyName doubles as "what you are joining" for the invite page,
+      // which renders it for every invite type: kept for compatibility.
+      companyName: teamName,
+      teamName,
+      email: teamInvite.email,
       expired,
       alreadyHasAccount,
     },
@@ -51,8 +102,11 @@ export async function GET(request: NextRequest) {
 
 /**
  * POST /api/team/accept
- * Accepts a company invite after the user has signed up.
- * Team invitations are disabled: teams are single-user.
+ * Accepts a company or byrå-team invite after the user has signed up.
+ *
+ * Team acceptance inserts a team_members row; the DB sync trigger
+ * (sync_team_member_to_companies) then grants membership in every company
+ * attached to the team, so no company_members writes happen here.
  */
 export async function POST(request: NextRequest) {
   const { user, error } = await requireAuth()
@@ -73,11 +127,120 @@ export async function POST(request: NextRequest) {
     .eq('token_hash', tokenHash)
     .single()
 
-  if (companyLookupError) {
+  if (companyLookupError && companyLookupError.code !== 'PGRST116') {
     console.error('[team/accept] company lookup error:', companyLookupError.message)
   }
 
-  if (!companyInvite || companyInvite.status !== 'pending') {
+  if (companyInvite) {
+    return acceptCompanyInvite(serviceClient, user, companyInvite)
+  }
+
+  // No company invitation for this token: try byrå-team invitations.
+  const { data: teamInviteRaw } = await serviceClient
+    .from('team_invitations')
+    .select('id, team_id, email, role, status, expires_at, teams:team_id(name, kind)')
+    .eq('token_hash', tokenHash)
+    .single()
+
+  const teamInvite = teamInviteRaw as unknown as TeamInviteRow | null
+
+  // Kind gate mirrors GET: byrå teams only; anything else is an invalid token.
+  if (!teamInvite || teamInvite.teams?.kind !== 'byra' || teamInvite.status !== 'pending') {
+    return NextResponse.json({ error: 'Inbjudan är ogiltig.' }, { status: 400 })
+  }
+
+  if (new Date(teamInvite.expires_at) < new Date()) {
+    await serviceClient
+      .from('team_invitations')
+      .update({ status: 'expired' })
+      .eq('id', teamInvite.id)
+    return NextResponse.json({ error: 'Inbjudan har gått ut.' }, { status: 410 })
+  }
+
+  if (user.email?.toLowerCase() !== teamInvite.email.toLowerCase()) {
+    return NextResponse.json({ error: 'E-postadressen matchar inte inbjudan.' }, { status: 403 })
+  }
+
+  // Invitations never mint team owners (the invite route's schema already
+  // forbids it; re-checked here against hand-edited rows).
+  const memberRole = teamInvite.role === 'admin' ? 'admin' : 'member'
+
+  const { error: memberError } = await serviceClient
+    .from('team_members')
+    .insert({
+      team_id: teamInvite.team_id,
+      user_id: user.id,
+      role: memberRole,
+    })
+
+  if (memberError) {
+    if (memberError.code === '23505') {
+      return NextResponse.json({ error: 'Du är redan medlem.' }, { status: 409 })
+    }
+    return NextResponse.json({ error: 'Kunde inte lägga till medlem.' }, { status: 500 })
+  }
+
+  // Point a company-less user at one of the team's companies so their first
+  // dashboard load resolves. A consultant with their own firma keeps their
+  // active company untouched: joining a byrå must never hijack the context.
+  const { data: prefs } = await serviceClient
+    .from('user_preferences')
+    .select('active_company_id')
+    .eq('user_id', user.id)
+    .maybeSingle()
+
+  if (!(prefs as { active_company_id: string | null } | null)?.active_company_id) {
+    const { data: firstCompany } = await serviceClient
+      .from('companies')
+      .select('id')
+      .eq('team_id', teamInvite.team_id)
+      .is('archived_at', null)
+      .order('created_at', { ascending: true })
+      .limit(1)
+      .maybeSingle()
+
+    if (firstCompany) {
+      const { error: prefError } = await serviceClient
+        .from('user_preferences')
+        .upsert({
+          user_id: user.id,
+          active_company_id: (firstCompany as { id: string }).id,
+        }, { onConflict: 'user_id' })
+      if (prefError) {
+        console.error('[team/accept] failed to set active company', prefError)
+      }
+    }
+  }
+
+  // Mark invite as accepted
+  await serviceClient
+    .from('team_invitations')
+    .update({ status: 'accepted' })
+    .eq('id', teamInvite.id)
+
+  return NextResponse.json({
+    data: {
+      type: 'team',
+      teamId: teamInvite.team_id,
+      teamName: teamInvite.teams?.name ?? null,
+    },
+  })
+}
+
+/** The pre-existing company-invite acceptance flow, unchanged. */
+async function acceptCompanyInvite(
+  serviceClient: ReturnType<typeof createServiceClient>,
+  user: { id: string; email?: string | null },
+  companyInvite: {
+    id: string
+    company_id: string
+    email: string
+    role: string
+    status: string
+    expires_at: string
+  },
+) {
+  if (companyInvite.status !== 'pending') {
     return NextResponse.json({ error: 'Inbjudan är ogiltig.' }, { status: 400 })
   }
 
diff --git a/app/api/team/invite/[id]/__tests__/route.test.ts b/app/api/team/invite/[id]/__tests__/route.test.ts
new file mode 100644
index 00000000..81fc11e7
--- /dev/null
+++ b/app/api/team/invite/[id]/__tests__/route.test.ts
@@ -0,0 +1,246 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextResponse } from 'next/server'
+import { parseJsonResponse, createQueuedMockSupabase, createMockRouteParams } from '@/tests/helpers'
+
+// DELETE /api/team/invite/[id] (WL-08 invite unfreeze): revoking a pending
+// byrå-team invitation, gated on team kind and owner/admin role.
+
+const { supabase: serviceSupabase, enqueue, reset, findCalls } = createQueuedMockSupabase()
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+  requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+vi.mock('@/lib/supabase/server', () => ({
+  createServiceClient: () => serviceSupabase,
+}))
+
+vi.mock('@/lib/init', () => ({ ensureInitialized: vi.fn() }))
+
+vi.mock('@/lib/auth/invite-tokens', () => ({
+  generateInviteToken: () => ({ token: 'gnubok_inv_fresh-token', hash: 'hash-fresh-token' }),
+  getInviteExpiry: () => new Date('2099-01-08T00:00:00Z'),
+}))
+
+// The brand/sender/template wiring inside the helper is covered for real by
+// the POST /api/team/invite tests; here it is mocked so the resend tests
+// exercise only the route's own gates and writes.
+const sendTeamInviteMailMock = vi.hoisted(() => vi.fn())
+vi.mock('@/lib/email/send-team-invite', () => ({
+  sendTeamInviteMail: sendTeamInviteMailMock,
+}))
+
+import { DELETE, POST } from '../route'
+
+const mockUser = { id: 'user-1', email: 'admin@byra.se' }
+
+const req = new Request('http://localhost/api/team/invite/invite-1', {
+  method: 'DELETE',
+}) as never
+
+const routeParams = createMockRouteParams({ id: 'invite-1' })
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  reset()
+  requireAuthMock.mockResolvedValue({ user: mockUser, supabase: serviceSupabase, error: null })
+  sendTeamInviteMailMock.mockResolvedValue({
+    inviteUrl: 'https://app.gnubok.se/invite/gnubok_inv_fresh-token',
+    emailSent: true,
+  })
+})
+
+describe('DELETE /api/team/invite/[id]', () => {
+  it('returns 401 when not authenticated', async () => {
+    requireAuthMock.mockResolvedValue({
+      user: null,
+      supabase: serviceSupabase,
+      error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+    })
+    const res = await DELETE(req, routeParams)
+    expect(res.status).toBe(401)
+  })
+
+  it('returns 404 when the invitation does not exist', async () => {
+    enqueue({ data: null })
+    const res = await DELETE(req, routeParams)
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(404)
+  })
+
+  it('returns 403 with the legacy message for a personal-team invitation', async () => {
+    enqueue({
+      data: { id: 'invite-1', team_id: 'team-p', status: 'pending', teams: { kind: 'personal' } },
+    })
+    const res = await DELETE(req, routeParams)
+    const { status, body } = await parseJsonResponse<{ error: string }>(res)
+    expect(status).toBe(403)
+    expect(body.error).toBe('Teaminbjudningar är inaktiverade.')
+  })
+
+  it('returns 403 when the caller is a plain team member', async () => {
+    enqueue({
+      data: { id: 'invite-1', team_id: 'team-b', status: 'pending', teams: { kind: 'byra' } },
+    })
+    enqueue({ data: { role: 'member' } })
+    const res = await DELETE(req, routeParams)
+    const { status, body } = await parseJsonResponse<{ error: string }>(res)
+    expect(status).toBe(403)
+    expect(body.error).toBe('Behörighet saknas.')
+  })
+
+  it('returns 409 when the invitation was already used', async () => {
+    enqueue({
+      data: { id: 'invite-1', team_id: 'team-b', status: 'accepted', teams: { kind: 'byra' } },
+    })
+    enqueue({ data: { role: 'owner' } })
+    const res = await DELETE(req, routeParams)
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(409)
+  })
+
+  it('revokes a pending invitation for a byrå admin', async () => {
+    enqueue({
+      data: { id: 'invite-1', team_id: 'team-b', status: 'pending', teams: { kind: 'byra' } },
+    })
+    enqueue({ data: { role: 'admin' } })
+    // team_invitations update
+    enqueue({ data: null })
+
+    const res = await DELETE(req, routeParams)
+    const { status, body } = await parseJsonResponse<{ data: { id: string; status: string } }>(res)
+    expect(status).toBe(200)
+    expect(body.data).toEqual({ id: 'invite-1', status: 'revoked' })
+
+    const updates = findCalls('team_invitations', 'update')
+    expect(updates).toHaveLength(1)
+    expect(updates[0]![0]).toEqual({ status: 'revoked' })
+  })
+})
+
+// POST /api/team/invite/[id]: re-send a pending byrå-team invitation with a
+// fresh token and expiry (the recovery path when the original mail was lost).
+
+const postReq = new Request('http://localhost/api/team/invite/invite-1', {
+  method: 'POST',
+}) as never
+
+const pendingInvite = {
+  id: 'invite-1',
+  team_id: 'team-b',
+  email: 'konsult@byra.se',
+  role: 'admin',
+  status: 'pending',
+  teams: { kind: 'byra' },
+}
+
+describe('POST /api/team/invite/[id]', () => {
+  it('returns 401 when not authenticated', async () => {
+    requireAuthMock.mockResolvedValue({
+      user: null,
+      supabase: serviceSupabase,
+      error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+    })
+    const res = await POST(postReq, routeParams)
+    expect(res.status).toBe(401)
+  })
+
+  it('returns 404 when the invitation does not exist', async () => {
+    enqueue({ data: null })
+    const res = await POST(postReq, routeParams)
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(404)
+  })
+
+  it('returns 403 with the legacy message for a personal-team invitation', async () => {
+    enqueue({ data: { ...pendingInvite, teams: { kind: 'personal' } } })
+    const res = await POST(postReq, routeParams)
+    const { status, body } = await parseJsonResponse<{ error: string }>(res)
+    expect(status).toBe(403)
+    expect(body.error).toBe('Teaminbjudningar är inaktiverade.')
+  })
+
+  it('returns 403 when the caller is a plain team member', async () => {
+    enqueue({ data: pendingInvite })
+    enqueue({ data: { role: 'member' } })
+    const res = await POST(postReq, routeParams)
+    const { status, body } = await parseJsonResponse<{ error: string }>(res)
+    expect(status).toBe(403)
+    expect(body.error).toBe('Behörighet saknas.')
+    expect(sendTeamInviteMailMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 409 when the invitation was already used', async () => {
+    enqueue({ data: { ...pendingInvite, status: 'accepted' } })
+    enqueue({ data: { role: 'owner' } })
+    const res = await POST(postReq, routeParams)
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(409)
+    expect(sendTeamInviteMailMock).not.toHaveBeenCalled()
+  })
+
+  it('re-issues the token and re-sends the mail for a byrå admin', async () => {
+    enqueue({ data: pendingInvite })
+    enqueue({ data: { role: 'admin' } })
+    // team_invitations update (token, invited_by, expiry)
+    enqueue({ data: null })
+
+    const res = await POST(postReq, routeParams)
+    const { status, body } = await parseJsonResponse<{
+      data: {
+        id: string
+        teamId: string
+        email: string
+        role: string
+        status: string
+        email_sent: boolean
+        inviteUrl: string
+      }
+    }>(res)
+
+    expect(status).toBe(200)
+    expect(body.data.id).toBe('invite-1')
+    expect(body.data.teamId).toBe('team-b')
+    expect(body.data.email).toBe('konsult@byra.se')
+    expect(body.data.role).toBe('admin')
+    expect(body.data.status).toBe('pending')
+    expect(body.data.email_sent).toBe(true)
+    expect(body.data.inviteUrl).toBe('https://app.gnubok.se/invite/gnubok_inv_fresh-token')
+
+    // A fresh token hash replaces the old one (invalidating any mailed link),
+    // and the raw token never touches the DB write.
+    const updates = findCalls('team_invitations', 'update')
+    expect(updates).toHaveLength(1)
+    expect(updates[0]![0]).toMatchObject({
+      token_hash: 'hash-fresh-token',
+      invited_by: 'user-1',
+      expires_at: '2099-01-08T00:00:00.000Z',
+    })
+
+    expect(sendTeamInviteMailMock).toHaveBeenCalledWith({
+      teamId: 'team-b',
+      email: 'konsult@byra.se',
+      inviterEmail: 'admin@byra.se',
+      token: 'gnubok_inv_fresh-token',
+    })
+  })
+
+  it('keeps the invitation valid and returns the link when the mail send fails', async () => {
+    sendTeamInviteMailMock.mockResolvedValue({
+      inviteUrl: 'https://app.gnubok.se/invite/gnubok_inv_fresh-token',
+      emailSent: false,
+    })
+    enqueue({ data: pendingInvite })
+    enqueue({ data: { role: 'owner' } })
+    enqueue({ data: null })
+
+    const res = await POST(postReq, routeParams)
+    const { status, body } = await parseJsonResponse<{
+      data: { email_sent: boolean; inviteUrl: string }
+    }>(res)
+    expect(status).toBe(200)
+    expect(body.data.email_sent).toBe(false)
+    expect(body.data.inviteUrl).toContain('/invite/gnubok_inv_fresh-token')
+  })
+})
diff --git a/app/api/team/invite/[id]/route.ts b/app/api/team/invite/[id]/route.ts
index ff7ac7d7..d5312d78 100644
--- a/app/api/team/invite/[id]/route.ts
+++ b/app/api/team/invite/[id]/route.ts
@@ -1,12 +1,177 @@
-import { NextResponse } from 'next/server'
+import { createServiceClient } from '@/lib/supabase/server'
+import { NextResponse, type NextRequest } from 'next/server'
+import { ensureInitialized } from '@/lib/init'
+import { requireAuth } from '@/lib/auth/require-auth'
+import { generateInviteToken, getInviteExpiry } from '@/lib/auth/invite-tokens'
+import { sendTeamInviteMail } from '@/lib/email/send-team-invite'
+
+// Loads the email extension so the re-send path gets the Resend
+// implementation instead of the noop default (same as POST /api/team/invite).
+ensureInitialized()
+
+/**
+ * Kept verbatim from the pre-unfreeze hardcoded 403: personal teams remain
+ * uninvitable (WL-08), so their (theoretical) invitations stay untouchable.
+ */
+const PERSONAL_TEAM_MESSAGE = 'Teaminbjudningar är inaktiverade.'
+
+interface InviteRow {
+  id: string
+  team_id: string
+  email: string
+  role: string
+  status: string
+  teams: { kind: string } | null
+}
+
+/**
+ * Shared gate chain for acting on an existing invitation: it must exist, its
+ * team must be kind='byra' (personal-team invitations are frozen surface),
+ * and the caller must be owner/admin of that team. Returns the invitation row
+ * or the error response to bubble.
+ */
+async function loadInviteForManagement(
+  serviceClient: ReturnType<typeof createServiceClient>,
+  inviteId: string,
+  userId: string,
+): Promise<{ invite: InviteRow } | { response: NextResponse }> {
+  const { data: invitation } = await serviceClient
+    .from('team_invitations')
+    .select('id, team_id, email, role, status, teams:team_id(kind)')
+    .eq('id', inviteId)
+    .maybeSingle()
+
+  const invite = invitation as unknown as InviteRow | null
+
+  if (!invite) {
+    return { response: NextResponse.json({ error: 'Inbjudan hittades inte.' }, { status: 404 }) }
+  }
+
+  // Kind gate first: personal-team invitations are frozen surface, byrå only.
+  if (invite.teams?.kind !== 'byra') {
+    return { response: NextResponse.json({ error: PERSONAL_TEAM_MESSAGE }, { status: 403 }) }
+  }
+
+  // Role gate: the caller must be owner/admin of the invitation's team.
+  const { data: membership } = await serviceClient
+    .from('team_members')
+    .select('role')
+    .eq('team_id', invite.team_id)
+    .eq('user_id', userId)
+    .maybeSingle()
+
+  const callerRole = (membership as { role: string } | null)?.role
+  if (!callerRole || !['owner', 'admin'].includes(callerRole)) {
+    return { response: NextResponse.json({ error: 'Behörighet saknas.' }, { status: 403 }) }
+  }
+
+  return { invite }
+}
+
+/**
+ * POST /api/team/invite/[id]
+ * Re-send a pending byrå-team invitation (WL-08 follow-up: the Arbore case,
+ * where the original mail never reached the invitee and the inviter had no
+ * recovery path).
+ *
+ * Same gates as DELETE. Only pending invitations can be re-sent (an expired
+ * pending one is revived: the token and expiry are re-issued in place, which
+ * also invalidates any previously mailed link). The response mirrors POST
+ * /api/team/invite so the client gets a fresh shareable inviteUrl regardless
+ * of whether the mail went out.
+ */
+export async function POST(
+  _request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const { user, error } = await requireAuth()
+  if (error) return error
+
+  const { id } = await params
+  const serviceClient = createServiceClient()
+
+  const loaded = await loadInviteForManagement(serviceClient, id, user.id)
+  if ('response' in loaded) return loaded.response
+  const { invite } = loaded
+
+  if (invite.status !== 'pending') {
+    return NextResponse.json({ error: 'Inbjudan har redan använts.' }, { status: 409 })
+  }
+
+  const { token, hash } = generateInviteToken()
+  const expiresAt = getInviteExpiry()
+
+  const { error: updateError } = await serviceClient
+    .from('team_invitations')
+    .update({
+      token_hash: hash,
+      invited_by: user.id,
+      expires_at: expiresAt.toISOString(),
+    })
+    .eq('id', invite.id)
+
+  if (updateError) {
+    return NextResponse.json({ error: 'Kunde inte skicka om inbjudan.' }, { status: 500 })
+  }
+
+  const { inviteUrl, emailSent } = await sendTeamInviteMail({
+    teamId: invite.team_id,
+    email: invite.email,
+    inviterEmail: user.email || '',
+    token,
+  })
+
+  return NextResponse.json({
+    data: {
+      id: invite.id,
+      teamId: invite.team_id,
+      email: invite.email,
+      role: invite.role,
+      status: 'pending',
+      expires_at: expiresAt.toISOString(),
+      email_sent: emailSent,
+      // Always returned so the inviter can share the link directly when the
+      // mail did not go out (or never arrives).
+      inviteUrl,
+    },
+  })
+}
 
 /**
  * DELETE /api/team/invite/[id]
- * Team-level invitations are disabled.
+ * Revoke a pending byrå-team invitation (WL-08 invite unfreeze).
+ *
+ * Same gates as POST /api/team/invite: the invitation's team must be
+ * kind='byra' and the caller must be team owner or admin. Revocation is a
+ * status flip (not a row delete) so the (team, email) unique pair keeps its
+ * history and a later re-invite reuses the row.
  */
-export async function DELETE() {
-  return NextResponse.json(
-    { error: 'Teaminbjudningar är inaktiverade.' },
-    { status: 403 }
-  )
+export async function DELETE(
+  _request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const { user, error } = await requireAuth()
+  if (error) return error
+
+  const { id } = await params
+  const serviceClient = createServiceClient()
+
+  const loaded = await loadInviteForManagement(serviceClient, id, user.id)
+  if ('response' in loaded) return loaded.response
+  const { invite } = loaded
+
+  if (invite.status !== 'pending') {
+    return NextResponse.json({ error: 'Inbjudan har redan använts.' }, { status: 409 })
+  }
+
+  const { error: revokeError } = await serviceClient
+    .from('team_invitations')
+    .update({ status: 'revoked' })
+    .eq('id', invite.id)
+
+  if (revokeError) {
+    return NextResponse.json({ error: 'Kunde inte återkalla inbjudan.' }, { status: 500 })
+  }
+
+  return NextResponse.json({ data: { id: invite.id, status: 'revoked' } })
 }
diff --git a/app/api/team/invite/__tests__/route.test.ts b/app/api/team/invite/__tests__/route.test.ts
new file mode 100644
index 00000000..21582afd
--- /dev/null
+++ b/app/api/team/invite/__tests__/route.test.ts
@@ -0,0 +1,326 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextResponse } from 'next/server'
+import { parseJsonResponse, createQueuedMockSupabase } from '@/tests/helpers'
+
+// POST /api/team/invite (WL-08 invite unfreeze): invites are allowed ONLY for
+// byrå teams (kind='byra') and only by team owner/admin. Personal teams keep
+// the legacy 403 message.
+
+const { supabase: serviceSupabase, enqueue, reset, findCalls } = createQueuedMockSupabase()
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+  requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+vi.mock('@/lib/supabase/server', () => ({
+  createServiceClient: () => serviceSupabase,
+}))
+
+vi.mock('@/lib/auth/invite-tokens', () => ({
+  generateInviteToken: () => ({ token: 'gnubok_inv_test-token', hash: 'hash-test-token' }),
+  getInviteExpiry: () => new Date('2099-01-08T00:00:00Z'),
+}))
+
+vi.mock('@/lib/init', () => ({ ensureInitialized: vi.fn() }))
+
+const sendEmailMock = vi.fn()
+const isConfiguredMock = vi.fn()
+vi.mock('@/lib/email/service', () => ({
+  getEmailService: () => ({ isConfigured: isConfiguredMock, sendEmail: sendEmailMock }),
+}))
+
+// The brand resolver is mocked (no DB); brand-sender and the templates run
+// for real so the test covers the actual sender/link wiring.
+const resolveBrandForTeamMock = vi.hoisted(() => vi.fn())
+vi.mock('@/lib/branding/resolve', () => ({
+  resolveBrandForTeam: resolveBrandForTeamMock,
+}))
+
+vi.mock('@/lib/branding/service', () => ({
+  getBranding: () => ({ appName: 'Accounted', appUrl: 'https://app.gnubok.se' }),
+}))
+
+import { POST } from '../route'
+
+const SIFFRA_BRAND = {
+  id: 'brand-1',
+  teamId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  domain: 'app.siffra.se',
+  appName: 'Siffra',
+  logoUrl: null,
+  brandColor: '#123456',
+  chromeColor: null,
+  fontKey: 'default',
+  supportEmail: 'support@siffra.se',
+  authEmailFrom: 'noreply@post.siffra.se',
+  senderDomain: 'post.siffra.se',
+  senderDomainStatus: 'verified',
+  resendDomainId: 'rd-1',
+}
+
+const mockUser = { id: 'user-1', email: 'admin@byra.se' }
+
+const BYRA_TEAM_ID = 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
+const PERSONAL_TEAM_ID = 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
+const UNKNOWN_TEAM_ID = 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+
+function makeReq(body: unknown) {
+  return new Request('http://localhost/api/team/invite', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  }) as never
+}
+
+const byraMembership = (role: string) => ({
+  team_id: BYRA_TEAM_ID,
+  role,
+  teams: { id: BYRA_TEAM_ID, name: 'Siffran AB', kind: 'byra', created_at: '2026-01-01T00:00:00Z' },
+})
+
+const personalMembership = () => ({
+  team_id: PERSONAL_TEAM_ID,
+  role: 'owner',
+  teams: {
+    id: PERSONAL_TEAM_ID,
+    name: 'Personal',
+    kind: 'personal',
+    created_at: '2026-01-02T00:00:00Z',
+  },
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  reset()
+  requireAuthMock.mockResolvedValue({ user: mockUser, supabase: serviceSupabase, error: null })
+  resolveBrandForTeamMock.mockResolvedValue(null)
+  isConfiguredMock.mockReturnValue(true)
+  sendEmailMock.mockResolvedValue({ success: true, messageId: 'msg-1' })
+})
+
+describe('POST /api/team/invite', () => {
+  it('returns 401 when not authenticated', async () => {
+    requireAuthMock.mockResolvedValue({
+      user: null,
+      supabase: serviceSupabase,
+      error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+    })
+    const res = await POST(makeReq({ email: 'konsult@byra.se' }))
+    expect(res.status).toBe(401)
+  })
+
+  it('returns 400 on an invalid email', async () => {
+    const res = await POST(makeReq({ email: 'not-an-email' }))
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(400)
+  })
+
+  it('returns 403 with the legacy message for a personal-team-only user', async () => {
+    enqueue({ data: [personalMembership()] })
+
+    const res = await POST(makeReq({ email: 'konsult@byra.se' }))
+    const { status, body } = await parseJsonResponse<{ error: string }>(res)
+    expect(status).toBe(403)
+    expect(body.error).toBe('Teaminbjudningar är inaktiverade. Bjud in via enskilda företag.')
+  })
+
+  it('returns 403 with the legacy message when explicitly targeting the personal team', async () => {
+    enqueue({ data: [personalMembership(), byraMembership('owner')] })
+
+    const res = await POST(makeReq({ email: 'konsult@byra.se', teamId: PERSONAL_TEAM_ID }))
+    const { status, body } = await parseJsonResponse<{ error: string }>(res)
+    expect(status).toBe(403)
+    expect(body.error).toBe('Teaminbjudningar är inaktiverade. Bjud in via enskilda företag.')
+  })
+
+  it('returns 404 for a teamId outside the caller memberships', async () => {
+    enqueue({ data: [personalMembership(), byraMembership('owner')] })
+
+    const res = await POST(makeReq({ email: 'konsult@byra.se', teamId: UNKNOWN_TEAM_ID }))
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(404)
+  })
+
+  it('returns 403 when the caller is a plain team member', async () => {
+    enqueue({ data: [byraMembership('member'), personalMembership()] })
+
+    const res = await POST(makeReq({ email: 'konsult@byra.se' }))
+    const { status, body } = await parseJsonResponse<{ error: string }>(res)
+    expect(status).toBe(403)
+    expect(body.error).toBe('Behörighet saknas.')
+  })
+
+  it('creates an invitation and returns the accept link for a byrå admin', async () => {
+    // 1. caller memberships (personal + byrå: multi-team is the normal shape)
+    enqueue({ data: [personalMembership(), byraMembership('admin')] })
+    // 2. profiles lookup (invitee has no account yet)
+    enqueue({ data: null })
+    // 3. existing invitation lookup
+    enqueue({ data: null })
+    // 4. team_invitations insert
+    enqueue({ data: { id: 'invite-1' } })
+
+    const res = await POST(makeReq({ email: 'Konsult@Byra.se', role: 'member' }))
+    const { status, body } = await parseJsonResponse<{
+      data: {
+        id: string
+        teamId: string
+        email: string
+        role: string
+        status: string
+        email_sent: boolean
+        inviteUrl: string
+      }
+    }>(res)
+
+    expect(status).toBe(200)
+    expect(body.data.id).toBe('invite-1')
+    expect(body.data.teamId).toBe(BYRA_TEAM_ID)
+    // Email lowercased by the schema
+    expect(body.data.email).toBe('konsult@byra.se')
+    expect(body.data.role).toBe('member')
+    expect(body.data.status).toBe('pending')
+    // Brandless team: mail goes out with platform defaults on the canonical URL.
+    expect(body.data.email_sent).toBe(true)
+    expect(body.data.inviteUrl).toBe('https://app.gnubok.se/invite/gnubok_inv_test-token')
+    expect(sendEmailMock).toHaveBeenCalledTimes(1)
+    const mail = sendEmailMock.mock.calls[0]![0] as {
+      to: string
+      subject: string
+      html: string
+      fromName?: string
+      fromAddress?: string
+      replyTo?: string
+    }
+    expect(mail.to).toBe('konsult@byra.se')
+    expect(mail.fromName).toBeUndefined()
+    expect(mail.fromAddress).toBeUndefined()
+    expect(mail.html).toContain('https://app.gnubok.se/invite/gnubok_inv_test-token')
+
+    // The insert went to team_invitations with the hashed token, never the raw.
+    const inserts = findCalls('team_invitations', 'insert')
+    expect(inserts).toHaveLength(1)
+    expect(inserts[0]![0]).toMatchObject({
+      team_id: BYRA_TEAM_ID,
+      email: 'konsult@byra.se',
+      role: 'member',
+      token_hash: 'hash-test-token',
+      status: 'pending',
+    })
+  })
+
+  it('sends the invite mail in the byrå brand: brand sender, brand-domain link', async () => {
+    resolveBrandForTeamMock.mockResolvedValue(SIFFRA_BRAND)
+    enqueue({ data: [byraMembership('admin')] })
+    enqueue({ data: null })
+    enqueue({ data: null })
+    enqueue({ data: { id: 'invite-1' } })
+
+    const res = await POST(makeReq({ email: 'konsult@byra.se' }))
+    const { status, body } = await parseJsonResponse<{
+      data: { email_sent: boolean; inviteUrl: string }
+    }>(res)
+
+    expect(status).toBe(200)
+    expect(resolveBrandForTeamMock).toHaveBeenCalledWith(BYRA_TEAM_ID)
+    expect(body.data.email_sent).toBe(true)
+    expect(body.data.inviteUrl).toBe('https://app.siffra.se/invite/gnubok_inv_test-token')
+    const mail = sendEmailMock.mock.calls[0]![0] as {
+      subject: string
+      html: string
+      fromName?: string
+      fromAddress?: string
+      replyTo?: string
+    }
+    expect(mail.fromName).toBe('Siffra')
+    expect(mail.fromAddress).toBe('noreply@post.siffra.se')
+    expect(mail.replyTo).toBe('support@siffra.se')
+    // Branded byrå: the subject names the byrå in its own casing, with no
+    // platform wording ("Du har blivit inbjuden till Siffra").
+    expect(mail.subject).toContain('Siffra')
+    expect(mail.html).toContain('https://app.siffra.se/invite/gnubok_inv_test-token')
+    expect(mail.html).not.toMatch(/accounted/i)
+  })
+
+  it('keeps the invitation valid when the mail send fails (email_sent: false)', async () => {
+    sendEmailMock.mockResolvedValue({ success: false, error: 'provider down' })
+    enqueue({ data: [byraMembership('owner')] })
+    enqueue({ data: null })
+    enqueue({ data: null })
+    enqueue({ data: { id: 'invite-1' } })
+
+    const res = await POST(makeReq({ email: 'konsult@byra.se' }))
+    const { status, body } = await parseJsonResponse<{
+      data: { id: string; email_sent: boolean; inviteUrl: string }
+    }>(res)
+
+    expect(status).toBe(200)
+    expect(body.data.id).toBe('invite-1')
+    expect(body.data.email_sent).toBe(false)
+    // The accept link is still returned so the inviter can share it directly.
+    expect(body.data.inviteUrl).toContain('/invite/gnubok_inv_test-token')
+  })
+
+  it('skips the mail when the email service is not configured', async () => {
+    isConfiguredMock.mockReturnValue(false)
+    enqueue({ data: [byraMembership('owner')] })
+    enqueue({ data: null })
+    enqueue({ data: null })
+    enqueue({ data: { id: 'invite-1' } })
+
+    const res = await POST(makeReq({ email: 'konsult@byra.se' }))
+    const { status, body } = await parseJsonResponse<{
+      data: { email_sent: boolean }
+    }>(res)
+
+    expect(status).toBe(200)
+    expect(body.data.email_sent).toBe(false)
+    expect(sendEmailMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 409 when the invitee is already a team member', async () => {
+    enqueue({ data: [byraMembership('owner')] })
+    // profiles lookup -> existing account
+    enqueue({ data: { id: 'user-2' } })
+    // team_members lookup -> already a member
+    enqueue({ data: { id: 'tm-2' } })
+
+    const res = await POST(makeReq({ email: 'konsult@byra.se' }))
+    const { status, body } = await parseJsonResponse<{ error: string }>(res)
+    expect(status).toBe(409)
+    expect(body.error).toBe('Denna person är redan medlem.')
+  })
+
+  it('returns 409 when a live pending invitation already exists', async () => {
+    enqueue({ data: [byraMembership('owner')] })
+    enqueue({ data: null })
+    enqueue({
+      data: { id: 'invite-1', status: 'pending', expires_at: '2099-01-01T00:00:00Z' },
+    })
+
+    const res = await POST(makeReq({ email: 'konsult@byra.se' }))
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(409)
+  })
+
+  it('re-issues a revoked invitation in place', async () => {
+    enqueue({ data: [byraMembership('owner')] })
+    enqueue({ data: null })
+    enqueue({
+      data: { id: 'invite-1', status: 'revoked', expires_at: '2099-01-01T00:00:00Z' },
+    })
+    // team_invitations update
+    enqueue({ data: { id: 'invite-1' } })
+
+    const res = await POST(makeReq({ email: 'konsult@byra.se', role: 'admin' }))
+    const { status, body } = await parseJsonResponse<{ data: { id: string; role: string } }>(res)
+    expect(status).toBe(200)
+    expect(body.data.id).toBe('invite-1')
+    expect(body.data.role).toBe('admin')
+
+    const updates = findCalls('team_invitations', 'update')
+    expect(updates).toHaveLength(1)
+    expect(updates[0]![0]).toMatchObject({ status: 'pending', token_hash: 'hash-test-token' })
+  })
+})
diff --git a/app/api/team/invite/route.ts b/app/api/team/invite/route.ts
index 90b8583b..fb3a3e15 100644
--- a/app/api/team/invite/route.ts
+++ b/app/api/team/invite/route.ts
@@ -1,13 +1,216 @@
-import { NextResponse } from 'next/server'
+import { createServiceClient } from '@/lib/supabase/server'
+import { NextResponse, type NextRequest } from 'next/server'
+import { z } from 'zod'
+import { ensureInitialized } from '@/lib/init'
+import { requireAuth } from '@/lib/auth/require-auth'
+import { validateBody } from '@/lib/api/validate'
+import { generateInviteToken, getInviteExpiry } from '@/lib/auth/invite-tokens'
+import { sendTeamInviteMail } from '@/lib/email/send-team-invite'
+
+// Loads the email extension so getEmailService() returns the Resend
+// implementation instead of the noop default (same reason as the company
+// invite route: without this the invite mail silently no-ops in a fresh
+// process).
+ensureInitialized()
+
+/**
+ * Kept verbatim from the pre-unfreeze hardcoded 403: personal teams remain
+ * uninvitable (WL-08), and this is the message their members still see.
+ */
+const PERSONAL_TEAM_MESSAGE = 'Teaminbjudningar är inaktiverade. Bjud in via enskilda företag.'
+
+const InviteSchema = z.object({
+  email: z.string().trim().toLowerCase().pipe(z.string().email('Ogiltig e-postadress.')),
+  // Team invitations never mint owners: the schema is the first gate, and the
+  // accept route re-checks (defense in depth against a hand-edited row).
+  role: z.enum(['admin', 'member']).default('member'),
+  // Optional explicit team target for users in several teams; validated
+  // against the caller's own memberships below.
+  teamId: z.string().uuid().optional(),
+})
+
+interface TeamMembershipRow {
+  team_id: string
+  role: string
+  teams: { id: string; name: string; kind: string; created_at: string } | null
+}
 
 /**
  * POST /api/team/invite
- * Team-level invitations are disabled.
- * Invitations should be made at the företag (company) level instead.
+ * Invite a consultant to a byrå team (WL-08 invite unfreeze).
+ *
+ * Gates, in order:
+ *   - authenticated (MFA enforced by requireAuth on hosted)
+ *   - the target team is kind='byra' (personal teams keep the legacy 403)
+ *   - the caller is team owner or admin
+ *
+ * Team-scoped rather than company-scoped (requireAuth, not withRouteContext):
+ * a byrå admin's active company is irrelevant to team membership, mirroring
+ * GET /api/team/members.
+ *
+ * The invitation email is sent in the byrå team's brand (WL-13): sender
+ * identity via getSenderForBrand(resolveBrandForTeam(teamId)) and the accept
+ * link on the brand's home domain, canonical for brandless teams. A send
+ * failure never fails the invite (email_sent: false + the link is returned,
+ * so the inviter can always share it directly).
  */
-export async function POST() {
-  return NextResponse.json(
-    { error: 'Teaminbjudningar är inaktiverade. Bjud in via enskilda företag.' },
-    { status: 403 }
-  )
+export async function POST(request: NextRequest) {
+  const { user, error } = await requireAuth()
+  if (error) return error
+
+  const validation = await validateBody(request, InviteSchema, {
+    operation: 'team.invite',
+  })
+  if (!validation.success) return validation.response
+  const { email, role, teamId: requestedTeamId } = validation.data
+
+  const serviceClient = createServiceClient()
+
+  // All of the caller's team memberships, with the team kind: the one-team-
+  // per-user assumption is gone (a consultant sits in their own personal team
+  // AND the byrå team).
+  const { data: memberships } = await serviceClient
+    .from('team_members')
+    .select('team_id, role, teams:team_id(id, name, kind, created_at)')
+    .eq('user_id', user.id)
+
+  const rows = (memberships ?? []) as unknown as TeamMembershipRow[]
+
+  let target: TeamMembershipRow | undefined
+  if (requestedTeamId) {
+    target = rows.find((m) => m.team_id === requestedTeamId)
+    if (!target) {
+      return NextResponse.json({ error: 'Team hittades inte.' }, { status: 404 })
+    }
+  } else {
+    // Default target: the caller's byrå team when one exists. Deterministic
+    // tie-break by team creation time for the (unexpected) multi-byrå case.
+    target = rows
+      .filter((m) => m.teams?.kind === 'byra')
+      .sort((a, b) => (a.teams?.created_at ?? '').localeCompare(b.teams?.created_at ?? ''))[0]
+  }
+
+  // Kind gate: invites exist for byrå teams only. A personal-team target (or
+  // no byrå membership at all) gets the exact legacy message.
+  if (!target || target.teams?.kind !== 'byra') {
+    return NextResponse.json({ error: PERSONAL_TEAM_MESSAGE }, { status: 403 })
+  }
+
+  // Role gate: team owner/admin may invite; members may not.
+  if (!['owner', 'admin'].includes(target.role)) {
+    return NextResponse.json({ error: 'Behörighet saknas.' }, { status: 403 })
+  }
+
+  const teamId = target.team_id
+
+  // Already a member? (profiles.email is lowercased like the schema output.)
+  const { data: profile } = await serviceClient
+    .from('profiles')
+    .select('id')
+    .eq('email', email)
+    .maybeSingle()
+
+  if (profile) {
+    const { data: existingMember } = await serviceClient
+      .from('team_members')
+      .select('id')
+      .eq('team_id', teamId)
+      .eq('user_id', (profile as { id: string }).id)
+      .maybeSingle()
+    if (existingMember) {
+      return NextResponse.json({ error: 'Denna person är redan medlem.' }, { status: 409 })
+    }
+  }
+
+  // Existing invitation for (team, email): a live pending one blocks; a
+  // spent or expired one is re-issued in place (unique constraint on the pair).
+  const { data: existingInvite } = await serviceClient
+    .from('team_invitations')
+    .select('id, status, expires_at')
+    .eq('team_id', teamId)
+    .eq('email', email)
+    .maybeSingle()
+
+  const existing = existingInvite as
+    | { id: string; status: string; expires_at: string }
+    | null
+
+  if (
+    existing &&
+    existing.status === 'pending' &&
+    new Date(existing.expires_at) > new Date()
+  ) {
+    return NextResponse.json(
+      { error: 'En inbjudan har redan skickats till denna e-post.' },
+      { status: 409 },
+    )
+  }
+
+  const { token, hash } = generateInviteToken()
+  const expiresAt = getInviteExpiry()
+
+  let invitationId: string
+  if (existing) {
+    const { data: updated, error: updateError } = await serviceClient
+      .from('team_invitations')
+      .update({
+        role,
+        token_hash: hash,
+        invited_by: user.id,
+        status: 'pending',
+        expires_at: expiresAt.toISOString(),
+      })
+      .eq('id', existing.id)
+      .select('id')
+      .single()
+    if (updateError || !updated) {
+      return NextResponse.json({ error: 'Kunde inte skapa inbjudan.' }, { status: 500 })
+    }
+    invitationId = (updated as { id: string }).id
+  } else {
+    const { data: inserted, error: insertError } = await serviceClient
+      .from('team_invitations')
+      .insert({
+        team_id: teamId,
+        email,
+        role,
+        token_hash: hash,
+        invited_by: user.id,
+        status: 'pending',
+        expires_at: expiresAt.toISOString(),
+      })
+      .select('id')
+      .single()
+    if (insertError || !inserted) {
+      return NextResponse.json({ error: 'Kunde inte skapa inbjudan.' }, { status: 500 })
+    }
+    invitationId = (inserted as { id: string }).id
+  }
+
+  // Brand mail (WL-13) via the shared helper: the byrå team's brand drives
+  // sender identity and the accept link's base URL; a brandless team gets the
+  // canonical URL and the platform sender exactly as before. Non-blocking: a
+  // failed send leaves the invitation valid and surfaces email_sent: false so
+  // the inviter knows to share the link directly.
+  const { inviteUrl, emailSent } = await sendTeamInviteMail({
+    teamId,
+    email,
+    inviterEmail: user.email || '',
+    token,
+  })
+
+  return NextResponse.json({
+    data: {
+      id: invitationId,
+      teamId,
+      email,
+      role,
+      status: 'pending',
+      expires_at: expiresAt.toISOString(),
+      email_sent: emailSent,
+      // The accept link is always returned so the inviter can share it
+      // directly, e.g. when the mail bounced or the service is unconfigured.
+      inviteUrl,
+    },
+  })
 }
diff --git a/app/api/team/members/[id]/__tests__/route.test.ts b/app/api/team/members/[id]/__tests__/route.test.ts
new file mode 100644
index 00000000..e8980e08
--- /dev/null
+++ b/app/api/team/members/[id]/__tests__/route.test.ts
@@ -0,0 +1,241 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextResponse } from 'next/server'
+import {
+  createMockRequest,
+  createMockRouteParams,
+  createQueuedMockSupabase,
+  parseJsonResponse,
+} from '@/tests/helpers'
+
+// PATCH/DELETE /api/team/members/[id] (WL-08 gap fix, the last frozen team
+// surface): byrå-only role changes and removals with last-owner protection.
+// Company-side effects are the DB triggers' job (AFTER UPDATE re-sync,
+// BEFORE DELETE source='team' cleanup) and are pg-tested, not mocked here.
+
+const { supabase: serviceSupabase, enqueue, reset, findCalls } = createQueuedMockSupabase()
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+  requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+vi.mock('@/lib/company/context', () => ({
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+vi.mock('@/lib/supabase/server', () => ({
+  createServiceClient: () => serviceSupabase,
+}))
+
+import { PATCH, DELETE } from '../route'
+
+const mockUser = { id: 'user-1', email: 'chef@byra.se' }
+const routeParams = createMockRouteParams({ id: 'tm-target' })
+
+const patchReq = (role: string) =>
+  createMockRequest('/api/team/members/tm-target', { method: 'PATCH', body: { role } })
+const deleteReq = () =>
+  createMockRequest('/api/team/members/tm-target', { method: 'DELETE' })
+
+const targetRow = (overrides: Partial<{ role: string; kind: string; user_id: string }> = {}) => ({
+  id: 'tm-target',
+  team_id: 'team-b',
+  user_id: overrides.user_id ?? 'user-2',
+  role: overrides.role ?? 'member',
+  teams: { kind: overrides.kind ?? 'byra' },
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  reset()
+  requireAuthMock.mockResolvedValue({ user: mockUser, supabase: serviceSupabase, error: null })
+})
+
+describe('PATCH /api/team/members/[id]', () => {
+  it('returns 401 when not authenticated', async () => {
+    requireAuthMock.mockResolvedValue({
+      user: null,
+      supabase: serviceSupabase,
+      error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+    })
+    const res = await PATCH(patchReq('admin'), routeParams)
+    expect(res.status).toBe(401)
+  })
+
+  it('returns 400 for an invalid role', async () => {
+    const res = await PATCH(patchReq('viewer'), routeParams)
+    expect(res.status).toBe(400)
+  })
+
+  it('returns 404 when the membership row does not exist', async () => {
+    enqueue({ data: null })
+    const { status } = await parseJsonResponse(await PATCH(patchReq('admin'), routeParams))
+    expect(status).toBe(404)
+  })
+
+  it('returns 403 with the legacy message for a personal-team membership', async () => {
+    enqueue({ data: targetRow({ kind: 'personal' }) })
+    const { status, body } = await parseJsonResponse<{ error: string }>(
+      await PATCH(patchReq('admin'), routeParams),
+    )
+    expect(status).toBe(403)
+    expect(body.error).toBe('Team har bara en ägare och kan inte ändras.')
+  })
+
+  it('returns 403 when the caller is a plain team member', async () => {
+    enqueue({ data: targetRow() })
+    enqueue({ data: { role: 'member' } })
+    const { status, body } = await parseJsonResponse<{ error: string }>(
+      await PATCH(patchReq('admin'), routeParams),
+    )
+    expect(status).toBe(403)
+    expect(body.error).toBe('Behörighet saknas.')
+  })
+
+  it('only an owner may grant the owner role', async () => {
+    enqueue({ data: targetRow() })
+    enqueue({ data: { role: 'admin' } })
+    const { status } = await parseJsonResponse(await PATCH(patchReq('owner'), routeParams))
+    expect(status).toBe(403)
+    expect(findCalls('team_members', 'update')).toHaveLength(0)
+  })
+
+  it("only an owner may change an owner's role", async () => {
+    enqueue({ data: targetRow({ role: 'owner' }) })
+    enqueue({ data: { role: 'admin' } })
+    const { status } = await parseJsonResponse(await PATCH(patchReq('member'), routeParams))
+    expect(status).toBe(403)
+    expect(findCalls('team_members', 'update')).toHaveLength(0)
+  })
+
+  it('returns 409 when demoting the last owner', async () => {
+    enqueue({ data: targetRow({ role: 'owner' }) })
+    enqueue({ data: { role: 'owner' } })
+    // owner count
+    enqueue({ data: null, count: 1 })
+    const { status, body } = await parseJsonResponse<{ error: string }>(
+      await PATCH(patchReq('admin'), routeParams),
+    )
+    expect(status).toBe(409)
+    expect(body.error).toBe('Teamet måste ha minst en ägare.')
+    expect(findCalls('team_members', 'update')).toHaveLength(0)
+  })
+
+  it('demotes a non-last owner when the caller is an owner', async () => {
+    enqueue({ data: targetRow({ role: 'owner' }) })
+    enqueue({ data: { role: 'owner' } })
+    enqueue({ data: null, count: 2 })
+    // update
+    enqueue({ data: null })
+    const { status, body } = await parseJsonResponse<{
+      data: { id: string; role: string }
+    }>(await PATCH(patchReq('admin'), routeParams))
+    expect(status).toBe(200)
+    expect(body.data).toMatchObject({ id: 'tm-target', role: 'admin' })
+    const updates = findCalls('team_members', 'update')
+    expect(updates).toHaveLength(1)
+    expect(updates[0]![0]).toEqual({ role: 'admin' })
+  })
+
+  it('promotes a member to admin for a byrå admin caller', async () => {
+    enqueue({ data: targetRow({ role: 'member' }) })
+    enqueue({ data: { role: 'admin' } })
+    // update
+    enqueue({ data: null })
+    const { status, body } = await parseJsonResponse<{
+      data: { id: string; user_id: string; team_id: string; role: string }
+    }>(await PATCH(patchReq('admin'), routeParams))
+    expect(status).toBe(200)
+    expect(body.data).toEqual({
+      id: 'tm-target',
+      user_id: 'user-2',
+      team_id: 'team-b',
+      role: 'admin',
+    })
+    const updates = findCalls('team_members', 'update')
+    expect(updates).toHaveLength(1)
+    expect(updates[0]![0]).toEqual({ role: 'admin' })
+  })
+
+  it('is a no-op (no write) when the role is unchanged', async () => {
+    enqueue({ data: targetRow({ role: 'admin' }) })
+    enqueue({ data: { role: 'owner' } })
+    const { status, body } = await parseJsonResponse<{ data: { role: string } }>(
+      await PATCH(patchReq('admin'), routeParams),
+    )
+    expect(status).toBe(200)
+    expect(body.data.role).toBe('admin')
+    expect(findCalls('team_members', 'update')).toHaveLength(0)
+  })
+})
+
+describe('DELETE /api/team/members/[id]', () => {
+  it('returns 401 when not authenticated', async () => {
+    requireAuthMock.mockResolvedValue({
+      user: null,
+      supabase: serviceSupabase,
+      error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+    })
+    const res = await DELETE(deleteReq(), routeParams)
+    expect(res.status).toBe(401)
+  })
+
+  it('returns 404 when the membership row does not exist', async () => {
+    enqueue({ data: null })
+    const { status } = await parseJsonResponse(await DELETE(deleteReq(), routeParams))
+    expect(status).toBe(404)
+  })
+
+  it('returns 403 with the legacy message for a personal-team membership', async () => {
+    enqueue({ data: targetRow({ kind: 'personal' }) })
+    const { status, body } = await parseJsonResponse<{ error: string }>(
+      await DELETE(deleteReq(), routeParams),
+    )
+    expect(status).toBe(403)
+    expect(body.error).toBe('Team har bara en ägare och kan inte ändras.')
+  })
+
+  it('returns 403 when the caller is a plain team member', async () => {
+    enqueue({ data: targetRow() })
+    enqueue({ data: { role: 'member' } })
+    const { status } = await parseJsonResponse(await DELETE(deleteReq(), routeParams))
+    expect(status).toBe(403)
+    expect(findCalls('team_members', 'delete')).toHaveLength(0)
+  })
+
+  it('only an owner may remove an owner', async () => {
+    enqueue({ data: targetRow({ role: 'owner' }) })
+    enqueue({ data: { role: 'admin' } })
+    const { status } = await parseJsonResponse(await DELETE(deleteReq(), routeParams))
+    expect(status).toBe(403)
+    expect(findCalls('team_members', 'delete')).toHaveLength(0)
+  })
+
+  it('returns 409 when removing the last owner', async () => {
+    enqueue({ data: targetRow({ role: 'owner', user_id: 'user-1' }) })
+    enqueue({ data: { role: 'owner' } })
+    enqueue({ data: null, count: 1 })
+    const { status, body } = await parseJsonResponse<{ error: string }>(
+      await DELETE(deleteReq(), routeParams),
+    )
+    expect(status).toBe(409)
+    expect(body.error).toBe('Teamet måste ha minst en ägare.')
+    expect(findCalls('team_members', 'delete')).toHaveLength(0)
+  })
+
+  it('removes a member for a byrå admin; company cleanup is the trigger', async () => {
+    enqueue({ data: targetRow({ role: 'member' }) })
+    enqueue({ data: { role: 'admin' } })
+    // delete
+    enqueue({ data: null })
+    const { status, body } = await parseJsonResponse<{
+      data: { id: string; removed: boolean }
+    }>(await DELETE(deleteReq(), routeParams))
+    expect(status).toBe(200)
+    expect(body.data).toEqual({ id: 'tm-target', removed: true })
+    expect(findCalls('team_members', 'delete')).toHaveLength(1)
+    // The route never touches company_members: the BEFORE DELETE sync trigger
+    // owns that cleanup (migration 20260331010000).
+    expect(findCalls('company_members', 'delete')).toHaveLength(0)
+  })
+})
diff --git a/app/api/team/members/[id]/route.ts b/app/api/team/members/[id]/route.ts
index 28bd34ee..179c1764 100644
--- a/app/api/team/members/[id]/route.ts
+++ b/app/api/team/members/[id]/route.ts
@@ -1,12 +1,223 @@
+import { createServiceClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { withRouteContext } from '@/lib/api/with-route-context'
+import { validateBody } from '@/lib/api/validate'
+
+/**
+ * Kept verbatim from the pre-unfreeze hardcoded 403: personal teams remain
+ * single-user shells (WL-08), and this is the message their members still see.
+ */
+const PERSONAL_TEAM_MESSAGE = 'Team har bara en ägare och kan inte ändras.'
+
+const RoleSchema = z.object({
+  role: z.enum(['owner', 'admin', 'member']),
+})
+
+interface TargetRow {
+  id: string
+  team_id: string
+  user_id: string
+  role: string
+  teams: { kind: string } | null
+}
+
+/**
+ * Shared gates for both verbs. Returns the target row and the caller's team
+ * role, or the error response to short-circuit with:
+ *   - 404 when the membership row does not exist
+ *   - 403 (legacy message) when the row's team is not a byrå team
+ *   - 403 when the caller is not owner/admin of that team
+ */
+async function resolveTargetAndCaller(
+  serviceClient: ReturnType<typeof createServiceClient>,
+  memberId: string,
+  callerUserId: string,
+): Promise<
+  | { error: NextResponse; target?: undefined; callerRole?: undefined }
+  | { error?: undefined; target: TargetRow; callerRole: 'owner' | 'admin' }
+> {
+  const { data } = await serviceClient
+    .from('team_members')
+    .select('id, team_id, user_id, role, teams:team_id(kind)')
+    .eq('id', memberId)
+    .maybeSingle()
+
+  const target = data as unknown as TargetRow | null
+  if (!target) {
+    return { error: NextResponse.json({ error: 'Medlem hittades inte.' }, { status: 404 }) }
+  }
+
+  // Kind gate first: personal teams keep the exact legacy 403 (WL-08).
+  if (target.teams?.kind !== 'byra') {
+    return { error: NextResponse.json({ error: PERSONAL_TEAM_MESSAGE }, { status: 403 }) }
+  }
+
+  const { data: membership } = await serviceClient
+    .from('team_members')
+    .select('role')
+    .eq('team_id', target.team_id)
+    .eq('user_id', callerUserId)
+    .maybeSingle()
+
+  const callerRole = (membership as { role: string } | null)?.role
+  if (callerRole !== 'owner' && callerRole !== 'admin') {
+    return { error: NextResponse.json({ error: 'Behörighet saknas.' }, { status: 403 }) }
+  }
+
+  return { target, callerRole }
+}
+
+/** Count of owner rows in the team: the last-owner protections read this. */
+async function countTeamOwners(
+  serviceClient: ReturnType<typeof createServiceClient>,
+  teamId: string,
+): Promise<number> {
+  const { count } = await serviceClient
+    .from('team_members')
+    .select('id', { count: 'exact', head: true })
+    .eq('team_id', teamId)
+    .eq('role', 'owner')
+  return count ?? 0
+}
+
+/**
+ * PATCH /api/team/members/[id]
+ * Change a byrå team member's role (WL-08 gap fix: the last frozen surface).
+ *
+ * Gates, in order: authenticated + MFA (withRouteContext), the membership's
+ * team is kind='byra' (personal teams keep the legacy 403 verbatim), caller
+ * is team owner/admin. Owner-role protections on top:
+ *   - the owner role is only granted by an owner
+ *   - an owner's role is only changed by an owner
+ *   - the last owner can never be demoted (409)
+ *
+ * The route only writes team_members.role. Propagating the new role into
+ * every client company's company_members rows is the job of the AFTER UPDATE
+ * trigger team_member_sync_role_update (migration 20260826130100): same
+ * owner/admin -> admin, member -> member mapping as the INSERT sync, and it
+ * never mints a company owner. Deliberately not duplicated here.
+ *
+ * No requireWrite: that option gates on the caller's role in the ACTIVE
+ * COMPANY, which is the wrong dimension for a team-scoped mutation (a byrå
+ * owner may have any company active). The team owner/admin gate above is the
+ * authorization.
+ */
+export const PATCH = withRouteContext<{ params: Promise<{ id: string }> }>(
+  'team_members.update_role',
+  async (request, ctx, { params }) => {
+    const { id } = await params
+    const validation = await validateBody(request, RoleSchema, {
+      operation: 'team_members.update_role',
+    })
+    if (!validation.success) return validation.response
+    const { role: newRole } = validation.data
+
+    const serviceClient = createServiceClient()
+    const resolved = await resolveTargetAndCaller(serviceClient, id, ctx.user.id)
+    if (resolved.error) return resolved.error
+    const { target, callerRole } = resolved
+
+    // Owner role is only granted by an owner.
+    if (newRole === 'owner' && callerRole !== 'owner') {
+      return NextResponse.json(
+        { error: 'Endast en ägare kan utse en annan ägare.' },
+        { status: 403 },
+      )
+    }
+
+    // An owner's role is only changed by an owner (an admin must not be able
+    // to demote the byrå's owners).
+    if (target.role === 'owner' && callerRole !== 'owner') {
+      return NextResponse.json(
+        { error: 'Endast en ägare kan ändra en ägares roll.' },
+        { status: 403 },
+      )
+    }
+
+    // Demoting an owner: the team must keep at least one owner.
+    if (target.role === 'owner' && newRole !== 'owner') {
+      const owners = await countTeamOwners(serviceClient, target.team_id)
+      if (owners <= 1) {
+        return NextResponse.json(
+          { error: 'Teamet måste ha minst en ägare.' },
+          { status: 409 },
+        )
+      }
+    }
+
+    if (target.role === newRole) {
+      // No-op: skip the write (and the re-sync cascade it would fire).
+      return NextResponse.json({
+        data: { id: target.id, user_id: target.user_id, team_id: target.team_id, role: newRole },
+      })
+    }
+
+    const { error } = await serviceClient
+      .from('team_members')
+      .update({ role: newRole })
+      .eq('id', target.id)
+
+    if (error) {
+      return NextResponse.json({ error: 'Kunde inte ändra rollen.' }, { status: 500 })
+    }
+
+    return NextResponse.json({
+      data: { id: target.id, user_id: target.user_id, team_id: target.team_id, role: newRole },
+    })
+  },
+)
 
 /**
  * DELETE /api/team/members/[id]
- * Removing team members is disabled: teams are single-user.
+ * Remove a member from a byrå team (WL-08 gap fix).
+ *
+ * Same gates as PATCH. Protections: an owner is only removed by an owner, and
+ * the last owner can never be removed (409).
+ *
+ * The route only deletes the team_members row. Cleaning the member out of
+ * every client company is the job of the BEFORE DELETE trigger
+ * team_member_sync_delete / remove_team_member_from_companies (migration
+ * 20260331010000): it deletes the company_members rows with source='team' for
+ * the team's companies and leaves source='direct' memberships untouched.
+ * Deliberately not duplicated here.
  */
-export async function DELETE() {
-  return NextResponse.json(
-    { error: 'Team har bara en ägare och kan inte ändras.' },
-    { status: 403 }
-  )
-}
+export const DELETE = withRouteContext<{ params: Promise<{ id: string }> }>(
+  'team_members.remove',
+  async (_request, ctx, { params }) => {
+    const { id } = await params
+
+    const serviceClient = createServiceClient()
+    const resolved = await resolveTargetAndCaller(serviceClient, id, ctx.user.id)
+    if (resolved.error) return resolved.error
+    const { target, callerRole } = resolved
+
+    if (target.role === 'owner') {
+      // Owners are only removed by owners; the last owner is never removed.
+      if (callerRole !== 'owner') {
+        return NextResponse.json(
+          { error: 'Endast en ägare kan ta bort en ägare.' },
+          { status: 403 },
+        )
+      }
+      const owners = await countTeamOwners(serviceClient, target.team_id)
+      if (owners <= 1) {
+        return NextResponse.json(
+          { error: 'Teamet måste ha minst en ägare.' },
+          { status: 409 },
+        )
+      }
+    }
+
+    const { error } = await serviceClient
+      .from('team_members')
+      .delete()
+      .eq('id', target.id)
+
+    if (error) {
+      return NextResponse.json({ error: 'Kunde inte ta bort medlemmen.' }, { status: 500 })
+    }
+
+    return NextResponse.json({ data: { id: target.id, removed: true } })
+  },
+)
diff --git a/app/api/team/members/__tests__/route.test.ts b/app/api/team/members/__tests__/route.test.ts
new file mode 100644
index 00000000..0588f39e
--- /dev/null
+++ b/app/api/team/members/__tests__/route.test.ts
@@ -0,0 +1,220 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextRequest, NextResponse } from 'next/server'
+import { parseJsonResponse, createQueuedMockSupabase } from '@/tests/helpers'
+
+// GET /api/team/members under the multi-team model (WL-08): a user may belong
+// to several teams (personal shell + byrå). Default target is the byrå team;
+// ?teamId= selects explicitly, validated against the caller's memberships.
+
+const { supabase: serviceSupabase, enqueue, reset } = createQueuedMockSupabase()
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+  requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+vi.mock('@/lib/supabase/server', () => ({
+  createServiceClient: () => serviceSupabase,
+}))
+
+import { GET } from '../route'
+
+const mockUser = { id: 'user-1', email: 'konsult@byra.se' }
+
+const BYRA_TEAM_ID = 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
+const PERSONAL_TEAM_ID = 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
+
+const byraMembership = (role: string) => ({
+  team_id: BYRA_TEAM_ID,
+  role,
+  teams: { id: BYRA_TEAM_ID, name: 'Siffran AB', kind: 'byra', created_at: '2026-02-01T00:00:00Z' },
+})
+
+const personalMembership = () => ({
+  team_id: PERSONAL_TEAM_ID,
+  role: 'owner',
+  teams: {
+    id: PERSONAL_TEAM_ID,
+    name: 'Personal',
+    kind: 'personal',
+    created_at: '2026-01-01T00:00:00Z',
+  },
+})
+
+function makeReq(searchParams?: Record<string, string>) {
+  const url = new URL('http://localhost/api/team/members')
+  for (const [k, v] of Object.entries(searchParams ?? {})) {
+    url.searchParams.set(k, v)
+  }
+  return new NextRequest(url)
+}
+
+interface MembersBody {
+  data: {
+    members: { user_id: string; email: string; role: string; is_current_user: boolean }[]
+    invitations: { id: string; email: string; role: string; status: string }[]
+    teamName: string | null
+    teamId: string | null
+    teamKind: string | null
+    isOwner: boolean
+    hasTeam: boolean
+    canInvite: boolean
+    teams: { id: string; name: string | null; kind: string; role: string }[]
+    ownsCompany?: boolean
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  reset()
+  requireAuthMock.mockResolvedValue({ user: mockUser, supabase: serviceSupabase, error: null })
+})
+
+describe('GET /api/team/members', () => {
+  it('returns 401 when not authenticated', async () => {
+    requireAuthMock.mockResolvedValue({
+      user: null,
+      supabase: serviceSupabase,
+      error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+    })
+    const res = await GET(makeReq())
+    expect(res.status).toBe(401)
+  })
+
+  it('returns the empty shape for a teamless user', async () => {
+    // 1. memberships
+    enqueue({ data: [] })
+    // 2. owned-company probe
+    enqueue({ data: { id: 'cm-1' } })
+
+    const { status, body } = await parseJsonResponse<MembersBody>(await GET(makeReq()))
+    expect(status).toBe(200)
+    expect(body.data.hasTeam).toBe(false)
+    expect(body.data.members).toEqual([])
+    expect(body.data.teamId).toBeNull()
+    expect(body.data.ownsCompany).toBe(true)
+  })
+
+  it('defaults to the byrå team when the user is in both a personal and a byrå team', async () => {
+    // 1. memberships (personal listed FIRST: order must not matter)
+    enqueue({ data: [personalMembership(), byraMembership('admin')] })
+    // 2. byrå roster
+    enqueue({
+      data: [
+        { id: 'tm-1', team_id: BYRA_TEAM_ID, user_id: 'user-9', role: 'owner', joined_at: '2026-02-01' },
+        { id: 'tm-2', team_id: BYRA_TEAM_ID, user_id: 'user-1', role: 'admin', joined_at: '2026-02-02' },
+      ],
+    })
+    // 3. profiles
+    enqueue({
+      data: [
+        { id: 'user-9', email: 'chef@byra.se' },
+        { id: 'user-1', email: 'konsult@byra.se' },
+      ],
+    })
+
+    const { status, body } = await parseJsonResponse<MembersBody>(await GET(makeReq()))
+    expect(status).toBe(200)
+    expect(body.data.teamId).toBe(BYRA_TEAM_ID)
+    expect(body.data.teamKind).toBe('byra')
+    expect(body.data.teamName).toBe('Siffran AB')
+    expect(body.data.canInvite).toBe(true)
+    expect(body.data.isOwner).toBe(false)
+    expect(body.data.members).toHaveLength(2)
+    expect(body.data.members[1]).toMatchObject({
+      user_id: 'user-1',
+      email: 'konsult@byra.se',
+      is_current_user: true,
+    })
+    // Both memberships surface so the client can offer a switcher.
+    expect(body.data.teams.map((t) => t.id).sort()).toEqual(
+      [BYRA_TEAM_ID, PERSONAL_TEAM_ID].sort(),
+    )
+  })
+
+  it('returns pending invitations for a byrå admin', async () => {
+    enqueue({ data: [byraMembership('admin')] })
+    // roster
+    enqueue({
+      data: [
+        { id: 'tm-2', team_id: BYRA_TEAM_ID, user_id: 'user-1', role: 'admin', joined_at: '2026-02-02' },
+      ],
+    })
+    // profiles
+    enqueue({ data: [{ id: 'user-1', email: 'konsult@byra.se' }] })
+    // pending invitations
+    enqueue({
+      data: [
+        {
+          id: 'inv-1',
+          email: 'ny@byra.se',
+          role: 'member',
+          status: 'pending',
+          created_at: '2026-07-01T00:00:00Z',
+          expires_at: '2026-08-15T00:00:00Z',
+        },
+      ],
+    })
+
+    const { body } = await parseJsonResponse<MembersBody>(await GET(makeReq()))
+    expect(body.data.canInvite).toBe(true)
+    expect(body.data.invitations).toHaveLength(1)
+    expect(body.data.invitations[0]).toMatchObject({ id: 'inv-1', email: 'ny@byra.se' })
+  })
+
+  it('a byrå plain member gets no invitation list', async () => {
+    enqueue({ data: [byraMembership('member')] })
+    enqueue({
+      data: [
+        { id: 'tm-2', team_id: BYRA_TEAM_ID, user_id: 'user-1', role: 'member', joined_at: '2026-02-02' },
+      ],
+    })
+    enqueue({ data: [{ id: 'user-1', email: 'konsult@byra.se' }] })
+
+    const { body } = await parseJsonResponse<MembersBody>(await GET(makeReq()))
+    expect(body.data.invitations).toEqual([])
+  })
+
+  it('a byrå plain member cannot invite', async () => {
+    enqueue({ data: [byraMembership('member')] })
+    enqueue({
+      data: [
+        { id: 'tm-2', team_id: BYRA_TEAM_ID, user_id: 'user-1', role: 'member', joined_at: '2026-02-02' },
+      ],
+    })
+    enqueue({ data: [{ id: 'user-1', email: 'konsult@byra.se' }] })
+
+    const { body } = await parseJsonResponse<MembersBody>(await GET(makeReq()))
+    expect(body.data.canInvite).toBe(false)
+  })
+
+  it('?teamId= targets the personal team explicitly', async () => {
+    enqueue({ data: [personalMembership(), byraMembership('admin')] })
+    // personal roster
+    enqueue({
+      data: [
+        { id: 'tm-3', team_id: PERSONAL_TEAM_ID, user_id: 'user-1', role: 'owner', joined_at: '2026-01-01' },
+      ],
+    })
+    enqueue({ data: [{ id: 'user-1', email: 'konsult@byra.se' }] })
+
+    const { status, body } = await parseJsonResponse<MembersBody>(
+      await GET(makeReq({ teamId: PERSONAL_TEAM_ID })),
+    )
+    expect(status).toBe(200)
+    expect(body.data.teamId).toBe(PERSONAL_TEAM_ID)
+    expect(body.data.teamKind).toBe('personal')
+    expect(body.data.isOwner).toBe(true)
+    // Personal teams are never invitable regardless of role.
+    expect(body.data.canInvite).toBe(false)
+  })
+
+  it('returns 404 for a teamId outside the caller memberships', async () => {
+    enqueue({ data: [personalMembership()] })
+
+    const { status } = await parseJsonResponse(
+      await GET(makeReq({ teamId: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc' })),
+    )
+    expect(status).toBe(404)
+  })
+})
diff --git a/app/api/team/members/route.ts b/app/api/team/members/route.ts
index a3660625..4af55239 100644
--- a/app/api/team/members/route.ts
+++ b/app/api/team/members/route.ts
@@ -1,31 +1,46 @@
 import { createServiceClient } from '@/lib/supabase/server'
-import { NextResponse } from 'next/server'
+import { NextResponse, type NextRequest } from 'next/server'
 import { requireAuth } from '@/lib/auth/require-auth'
 
 /**
  * GET /api/team/members
- * Returns team members (single-user teams, no invitations).
+ * Returns the member roster for one of the caller's teams.
+ *
+ * Multi-team model (WL-08): a user may belong to several teams (their own
+ * personal shell AND a byrå team), so the old `.limit(1)` single-membership
+ * read is gone. Selection:
+ *   - `?teamId=` targets an explicit team, validated against the caller's own
+ *     memberships (404 otherwise)
+ *   - default: the caller's byrå team when one exists, else the personal team
  *
  * Team-scoped (not company-scoped): a brand-new user with no company must
  * still get a valid empty response (ownsCompany: false), so this uses
  * requireAuth() directly rather than withRouteContext, which would require an
  * active company context. requireAuth still enforces MFA (AAL2) on hosted.
+ *
+ * Read-only: team role changes are re-synced to company_members by the
+ * DB trigger (team_member_sync_role_update); this route just reflects the
+ * current rows and never writes roles.
  */
-export async function GET() {
+export async function GET(request: NextRequest) {
   const { user, error } = await requireAuth()
   if (error) return error
 
-  const serviceClient = await createServiceClient()
+  const serviceClient = createServiceClient()
 
-  // Find the user's team membership
-  const { data: myMembership } = await serviceClient
+  // Every team membership the user holds, with each team's name and kind.
+  const { data: myMemberships } = await serviceClient
     .from('team_members')
-    .select('team_id, role')
+    .select('team_id, role, teams:team_id(id, name, kind, created_at)')
     .eq('user_id', user.id)
-    .limit(1)
-    .single()
 
-  if (!myMembership) {
+  const memberships = (myMemberships ?? []) as unknown as {
+    team_id: string
+    role: string
+    teams: { id: string; name: string; kind: string; created_at: string } | null
+  }[]
+
+  if (memberships.length === 0) {
     // User is not in any team: check if they own a company (could start a team)
     const { data: ownedCompany } = await serviceClient
       .from('company_members')
@@ -38,24 +53,53 @@ export async function GET() {
     return NextResponse.json({
       data: {
         members: [],
+        invitations: [],
         teamName: null,
         teamId: null,
+        teamKind: null,
         isOwner: false,
         hasTeam: false,
+        canInvite: false,
+        teams: [],
         ownsCompany: !!ownedCompany,
       },
     })
   }
 
-  const teamId = myMembership.team_id
-  const isOwner = myMembership.role === 'owner'
+  const requestedTeamId = request.nextUrl.searchParams.get('teamId')
 
-  // Fetch team name
-  const { data: team } = await serviceClient
-    .from('teams')
-    .select('name')
-    .eq('id', teamId)
-    .single()
+  let myMembership: (typeof memberships)[number] | undefined
+  if (requestedTeamId) {
+    myMembership = memberships.find((m) => m.team_id === requestedTeamId)
+    if (!myMembership) {
+      return NextResponse.json({ error: 'Team hittades inte.' }, { status: 404 })
+    }
+  } else {
+    // Default: byrå team first (that is the roster a consultant cares about),
+    // else the personal team. Deterministic tie-break on team creation time.
+    const byCreated = (a: (typeof memberships)[number], b: (typeof memberships)[number]) =>
+      (a.teams?.created_at ?? '').localeCompare(b.teams?.created_at ?? '')
+    myMembership =
+      memberships.filter((m) => m.teams?.kind === 'byra').sort(byCreated)[0] ??
+      [...memberships].sort(byCreated)[0]
+  }
+
+  const teamId = myMembership.team_id
+  const teamKind = myMembership.teams?.kind ?? 'personal'
+  const isOwner = myMembership.role === 'owner'
+  const canInvite = teamKind === 'byra' && ['owner', 'admin'].includes(myMembership.role)
+
+  // Team name from the joined row; fall back to a direct read when the join
+  // is absent (defensive: service role bypasses RLS so it should be present).
+  let teamName = myMembership.teams?.name ?? null
+  if (!teamName) {
+    const { data: team } = await serviceClient
+      .from('teams')
+      .select('name')
+      .eq('id', teamId)
+      .single()
+    teamName = (team as { name: string } | null)?.name ?? null
+  }
 
   // Fetch all team members (owner is a real row now)
   const { data: members, error: membersError } = await serviceClient
@@ -77,6 +121,29 @@ export async function GET() {
 
   const emailMap = new Map((profiles || []).map((p) => [p.id, p.email]))
 
+  // Pending invitations: only meaningful (and only shown) on byrå teams for
+  // callers who may manage invites; everyone else gets an empty list so the
+  // payload shape stays constant. Revoked/accepted rows are history, not
+  // roster state, so only status='pending' is returned (the client derives
+  // "expired" from expires_at).
+  let invitations: {
+    id: string
+    email: string
+    role: string
+    status: string
+    created_at: string
+    expires_at: string
+  }[] = []
+  if (canInvite) {
+    const { data: inviteRows } = await serviceClient
+      .from('team_invitations')
+      .select('id, email, role, status, created_at, expires_at')
+      .eq('team_id', teamId)
+      .eq('status', 'pending')
+      .order('created_at', { ascending: true })
+    invitations = (inviteRows ?? []) as typeof invitations
+  }
+
   return NextResponse.json({
     data: {
       members: (members || []).map((m) => ({
@@ -87,10 +154,20 @@ export async function GET() {
         joined_at: m.joined_at,
         is_current_user: m.user_id === user.id,
       })),
-      teamName: team?.name || null,
+      invitations,
+      teamName,
       teamId,
+      teamKind,
       isOwner,
       hasTeam: true,
+      canInvite,
+      // All of the caller's teams, so the client can offer a team switcher.
+      teams: memberships.map((m) => ({
+        id: m.team_id,
+        name: m.teams?.name ?? null,
+        kind: m.teams?.kind ?? 'personal',
+        role: m.role,
+      })),
     },
   })
 }
diff --git a/app/api/v1/companies/__tests__/create.test.ts b/app/api/v1/companies/__tests__/create.test.ts
index 4ea32da1..5fc59cb7 100644
--- a/app/api/v1/companies/__tests__/create.test.ts
+++ b/app/api/v1/companies/__tests__/create.test.ts
@@ -53,6 +53,7 @@ function makeSupabase(teamId: string | null) {
   return {
     from: vi.fn(() => chain),
     rpc: vi.fn().mockResolvedValue({ data: COMPANY_ID, error: null }),
+    chain,
   }
 }
 
@@ -164,6 +165,37 @@ describe('POST /api/v1/companies', () => {
     })
   })
 
+  it('defaults the team to the user PERSONAL team only (WL-08)', async () => {
+    const supabase = makeSupabase(TEAM_ID)
+    mockServiceClient.mockReturnValue(supabase)
+
+    const res = await createCompany(makeRequest(validBody), staticRouteContext())
+    expect(res.status).toBe(201)
+
+    // The default-team lookup must be restricted to kind='personal': picking
+    // the first membership regardless of kind attached a consultant's private
+    // company to their byrå team.
+    expect(supabase.from).toHaveBeenCalledWith('team_members')
+    expect(supabase.chain.select).toHaveBeenCalledWith('team_id, teams!inner(kind, created_at)')
+    expect(supabase.chain.eq).toHaveBeenCalledWith('teams.kind', 'personal')
+  })
+
+  it('passes p_team_id null when the user has no personal team', async () => {
+    const supabase = makeSupabase(null)
+    mockServiceClient.mockReturnValue(supabase)
+
+    const res = await createCompany(makeRequest(validBody), staticRouteContext())
+    expect(res.status).toBe(201)
+    const body = await res.json()
+    expect(body.data.team_id).toBeNull()
+    expect(supabase.rpc).toHaveBeenCalledWith('create_company_for_user', {
+      p_user_id: USER_ID,
+      p_name: 'Acme AB',
+      p_entity_type: 'aktiebolag',
+      p_team_id: null,
+    })
+  })
+
   it('previews without creating for a test-mode key (dry run)', async () => {
     mockValidate.mockResolvedValue({
       userId: USER_ID,
diff --git a/app/api/v1/companies/route.ts b/app/api/v1/companies/route.ts
index 709b90fd..2c584340 100644
--- a/app/api/v1/companies/route.ts
+++ b/app/api/v1/companies/route.ts
@@ -170,15 +170,22 @@ export const POST = withApiV1('companies.create', async (request, ctx) => {
     })
   }
 
-  // Team: explicit, else the caller's first (usually personal) team, same as
-  // the web wizard. create_company_for_user re-checks membership.
+  // Team: explicit, else the caller's PERSONAL team only (WL-08: companies
+  // created through the normal flow always attach to the personal team;
+  // cockpit flows pass the byrå team id explicitly). Picking the first
+  // membership regardless of kind attached a consultant's private company to
+  // the byrå team, exposing their books to the whole byrå and suppressing the
+  // trial. Mirrors ensure_user_team: earliest teams row with kind='personal'.
+  // create_company_for_user re-checks membership (and byrå role) in the DB.
   let teamId: string | null = setup.team_id ?? null
   if (!teamId) {
     const { data: membership } = await ctx.supabase
       .from('team_members')
-      .select('team_id')
+      .select('team_id, teams!inner(kind, created_at)')
       .eq('user_id', ctx.userId)
-      .order('created_at', { ascending: true })
+      .eq('teams.kind', 'personal')
+      .order('teams(created_at)', { ascending: true })
+      .order('teams(id)', { ascending: true })
       .limit(1)
       .maybeSingle()
     teamId = (membership?.team_id as string | undefined) ?? null
diff --git a/app/companies/new-client/page.tsx b/app/companies/new-client/page.tsx
new file mode 100644
index 00000000..720691ac
--- /dev/null
+++ b/app/companies/new-client/page.tsx
@@ -0,0 +1,42 @@
+import { createClient } from '@/lib/supabase/server'
+import { redirect } from 'next/navigation'
+import OnboardingBackdrop from '@/components/onboarding/OnboardingBackdrop'
+import OnboardingJourney from '@/components/onboarding/journey/OnboardingJourney'
+import { getByraMembership } from '@/lib/clients/fetch-client-overview'
+
+export const dynamic = 'force-dynamic'
+
+/**
+ * Client company creation from the byrå cockpit (WL-15): exactly today's
+ * creation journey (company form, fiscal year, voucher series defaults), but
+ * bound EXPLICITLY to the byrå team so the new company lands under the byrå
+ * (companies.team_id = byrå team), the team sync grants the whole byrå
+ * access, and the trial-suppression trigger keys on the byrå binding.
+ *
+ * Server-gated to byrå team owner/admin (creation is a commercial act: +1 on
+ * the byrå's invoice). The create_company_with_owner RPC enforces the same
+ * gate in the database, so a member cannot bypass this page via PostgREST.
+ */
+export default async function NewClientCompanyPage() {
+  const supabase = await createClient()
+
+  const { data: { user } } = await supabase.auth.getUser()
+  if (!user) {
+    redirect('/login')
+  }
+
+  const membership = await getByraMembership(supabase, user.id)
+  if (!membership) {
+    redirect('/')
+  }
+  if (membership.role !== 'owner' && membership.role !== 'admin') {
+    redirect('/clients')
+  }
+
+  return (
+    <div className="min-h-screen bg-background">
+      <OnboardingBackdrop />
+      <OnboardingJourney teamId={membership.teamId} mode="add" />
+    </div>
+  )
+}
diff --git a/app/companies/new/page.tsx b/app/companies/new/page.tsx
index 07c15455..22e2bf84 100644
--- a/app/companies/new/page.tsx
+++ b/app/companies/new/page.tsx
@@ -19,18 +19,12 @@ export default async function NewCompanyPage() {
     redirect('/login')
   }
 
-  const { data: teamMembership } = await supabase
-    .from('team_members')
-    .select('team_id')
-    .eq('user_id', user.id)
-    .limit(1)
-    .maybeSingle()
-
-  let teamId = teamMembership?.team_id
-  if (!teamId) {
-    const { data: newTeamId } = await supabase.rpc('ensure_user_team')
-    teamId = newTeamId
-  }
+  // Deterministic personal-team attachment (WL-08): ensure_user_team returns
+  // the user's PERSONAL team (creating one if missing). The previous bare
+  // `.limit(1)` membership pick could hand a consultant's new private company
+  // to their byrå team; byrå client creation binds its team explicitly via
+  // /companies/new-client instead.
+  const { data: teamId } = await supabase.rpc('ensure_user_team')
   if (!teamId) {
     redirect('/login')
   }
diff --git a/app/layout.tsx b/app/layout.tsx
index 4ee203f2..525ab786 100644
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -1,6 +1,14 @@
 import type { Metadata, Viewport } from "next";
 import { Geist, Geist_Mono } from "next/font/google";
 import { Hedvig_Letters_Serif } from "next/font/google";
+import {
+  Fraunces,
+  Lora,
+  Playfair_Display,
+  Public_Sans,
+  Source_Sans_3,
+  Work_Sans,
+} from "next/font/google";
 import Script from "next/script";
 import { NextIntlClientProvider } from "next-intl";
 import { getLocale, getMessages } from "next-intl/server";
@@ -15,9 +23,19 @@ import { SWRProvider } from "@/components/providers/SWRProvider";
 import { ScrollbarReveal } from "@/components/ScrollbarReveal";
 import { ensureInitialized } from "@/lib/init";
 import { getBranding } from "@/lib/branding/service";
+import { resolveRequestBrand } from "@/lib/branding/request-brand";
+import { getBrandFontPair } from "@/lib/branding/fonts";
+import { BrandProvider } from "@/lib/branding/brand-context";
+import { toPublicBrand } from "@/lib/branding/public-brand";
 import { APP_TIME_ZONE } from "@/i18n/config";
 import "./globals.css";
 
+// Brand resolution (WL-12: the lookup runs in the root layout, not
+// middleware) lives in lib/branding/request-brand.ts, shared with every
+// other server component so the BRAND_DEV_DOMAIN dev override applies
+// uniformly. The layout used to carry a private copy of the function, which
+// silently skipped that override.
+
 // Load extensions before metadata/viewport functions read the branding service.
 // Without this, an extension that calls registerBrandingService() at its module
 // load time would not have run yet when the first request hits this layout.
@@ -43,21 +61,81 @@ const hedvigSerif = Hedvig_Letters_Serif({
   weight: "400",
 });
 
-export function generateMetadata(): Metadata {
+// Curated brand font menu (WL-03/WL-12): every menu font registers here so
+// its @font-face and CSS variable exist on every host, but with
+// `preload: false`: only the default pair above preloads, and a browser only
+// downloads a menu font when a branded host actually resolves its var()
+// (lib/branding/fonts.ts picks the pair per request). All Google Fonts, OFL.
+const loraSerif = Lora({
+  variable: "--font-lora",
+  subsets: ["latin"],
+  display: "swap",
+  preload: false,
+});
+
+const sourceSans = Source_Sans_3({
+  variable: "--font-source-sans",
+  subsets: ["latin"],
+  display: "swap",
+  preload: false,
+});
+
+const frauncesSerif = Fraunces({
+  variable: "--font-fraunces",
+  subsets: ["latin"],
+  display: "swap",
+  preload: false,
+});
+
+const workSans = Work_Sans({
+  variable: "--font-work-sans",
+  subsets: ["latin"],
+  display: "swap",
+  preload: false,
+});
+
+const playfairSerif = Playfair_Display({
+  variable: "--font-playfair",
+  subsets: ["latin"],
+  display: "swap",
+  preload: false,
+});
+
+const publicSans = Public_Sans({
+  variable: "--font-public-sans",
+  subsets: ["latin"],
+  display: "swap",
+  preload: false,
+});
+
+// The brand font menu's variable classes, appended to <html> so every menu
+// pair's var() is resolvable whichever brand serves the request.
+const brandFontVariables = [
+  loraSerif.variable,
+  sourceSans.variable,
+  frauncesSerif.variable,
+  workSans.variable,
+  playfairSerif.variable,
+  publicSans.variable,
+].join(" ");
+
+export async function generateMetadata(): Promise<Metadata> {
   const b = getBranding();
+  const brand = await resolveRequestBrand();
+  const appName = brand?.appName ?? b.appName;
   return {
-    title: b.appName,
+    title: appName,
     description: b.appDescription,
     manifest: "/manifest.webmanifest",
     appleWebApp: {
       capable: true,
       statusBarStyle: "default",
-      title: b.appName,
+      title: appName,
     },
   };
 }
 
-export function generateViewport(): Viewport {
+export async function generateViewport(): Promise<Viewport> {
   return {
     themeColor: getBranding().themeColor,
     width: "device-width",
@@ -72,12 +150,43 @@ export default async function RootLayout({
   children: React.ReactNode;
 }>) {
   const branding = getBranding();
+  const brand = await resolveRequestBrand();
   const locale = await getLocale();
   const messages = await getMessages();
+
+  // Brand COLOR theming deliberately removed (founder call 2026-08-04):
+  // white-label is logo + app name + domain only; every host renders the
+  // standard editorial-monochrome theme. buildBrandVarsCss and the
+  // brands.brand_color/chrome_color columns stay dormant for a future
+  // opt-in, but nothing stamps data-brand anymore.
+
+  // Curated font menu (WL-03): inline style on <html> beats the :root
+  // declarations in globals.css. Null (default pair or unknown key) means no
+  // style attribute at all, keeping default hosts byte-identical.
+  const fontPair = brand ? getBrandFontPair(brand.fontKey) : null;
+
   return (
-    <html lang={locale} suppressHydrationWarning className={`${geistSans.variable} ${geistMono.variable} ${hedvigSerif.variable}`}>
+    <html
+      lang={locale}
+      suppressHydrationWarning
+      className={`${geistSans.variable} ${geistMono.variable} ${hedvigSerif.variable} ${brandFontVariables}`}
+      style={
+        fontPair
+          ? ({
+              "--font-display": fontPair.display,
+              "--font-body": fontPair.body,
+            } as React.CSSProperties)
+          : undefined
+      }
+    >
       <head>
         <link rel="apple-touch-icon" href={branding.appleTouchIconPath} />
+        {/* Tab icon: the brand's dedicated square favicon when set, else the
+            logo (a wide lockup squeezed to 16px, but better than the default
+            on a branded host). */}
+        {brand?.faviconUrl || brand?.logoUrl ? (
+          <link rel="icon" href={brand.faviconUrl ?? brand.logoUrl ?? undefined} />
+        ) : null}
       </head>
       <body
         className="antialiased"
@@ -85,24 +194,26 @@ export default async function RootLayout({
         {/* timeZone is passed explicitly: client components must format in the
             same zone the server rendered with, or timestamps shift on hydration. */}
         <NextIntlClientProvider locale={locale} messages={messages} timeZone={APP_TIME_ZONE}>
-          <ThemeProvider
-            attribute="class"
-            defaultTheme="light"
-            enableSystem
-            disableTransitionOnChange
-          >
-            <PaletteProvider>
-              <SWRProvider>
-                <TooltipProvider>
-                  {children}
-                  <Toaster />
-                  <DeployReloadPrompt />
-                  <ThemeColorSync />
-                  <ScrollbarReveal />
-                </TooltipProvider>
-              </SWRProvider>
-            </PaletteProvider>
-          </ThemeProvider>
+          <BrandProvider brand={brand ? toPublicBrand(brand) : null}>
+            <ThemeProvider
+              attribute="class"
+              defaultTheme="light"
+              enableSystem
+              disableTransitionOnChange
+            >
+              <PaletteProvider>
+                <SWRProvider>
+                  <TooltipProvider>
+                    {children}
+                    <Toaster />
+                    <DeployReloadPrompt />
+                    <ThemeColorSync />
+                    <ScrollbarReveal />
+                  </TooltipProvider>
+                </SWRProvider>
+              </PaletteProvider>
+            </ThemeProvider>
+          </BrandProvider>
         </NextIntlClientProvider>
         <SpeedInsights />
         <Script src="/sw-register.js" strategy="afterInteractive" />
diff --git a/app/manifest.ts b/app/manifest.ts
index b6c77a5e..ba525fb5 100644
--- a/app/manifest.ts
+++ b/app/manifest.ts
@@ -1,12 +1,20 @@
 import type { MetadataRoute } from 'next'
+import { headers } from 'next/headers'
 import { ensureInitialized } from '@/lib/init'
 import { getBranding } from '@/lib/branding/service'
+import { resolveBrandByHost } from '@/lib/branding/resolve'
 
 // Guarantee branding extensions have registered before the manifest is built.
 ensureInitialized()
 
-export default function manifest(): MetadataRoute.Manifest {
+export default async function manifest(): Promise<MetadataRoute.Manifest> {
   const b = getBranding()
+  // Host-aware branding (WL-12 slice A3): a branded host installs a PWA with
+  // the brand's name and color. Reading headers() makes this route dynamic;
+  // unknown hosts fall through to the default values below, unchanged.
+  const requestHeaders = await headers()
+  const host = requestHeaders.get('host')
+  const brand = host ? await resolveBrandByHost(host) : null
   const sizes = [72, 96, 128, 144, 152, 192, 384, 512]
   // Next.js's Icon type doesn't accept the space-separated "any maskable" purpose
   // that the original public/manifest.json used. Cast preserves the same JSON
@@ -18,13 +26,13 @@ export default function manifest(): MetadataRoute.Manifest {
     purpose: 'any maskable',
   })) as unknown as MetadataRoute.Manifest['icons']
   return {
-    name: b.appName,
-    short_name: b.appName,
+    name: brand?.appName ?? b.appName,
+    short_name: brand?.appName ?? b.appName,
     description: b.appDescription,
     start_url: '/',
     display: 'standalone',
     background_color: b.manifestBackgroundColor,
-    theme_color: b.manifestThemeColor,
+    theme_color: brand?.brandColor ?? b.manifestThemeColor,
     orientation: 'portrait-primary',
     icons,
     categories: ['business', 'finance', 'productivity'],
diff --git a/components/bokslut/AnnualReportStudio.tsx b/components/bokslut/AnnualReportStudio.tsx
index 0ff66007..f3ef6686 100644
--- a/components/bokslut/AnnualReportStudio.tsx
+++ b/components/bokslut/AnnualReportStudio.tsx
@@ -17,6 +17,7 @@ import {
 } from '@/components/ui/select'
 import { useToast } from '@/components/ui/use-toast'
 import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'
+import { useBranding } from '@/lib/branding/brand-context'
 import type {
   AnnualReportComplianceIssue,
   AnnualReportProfile,
@@ -96,6 +97,7 @@ export function AnnualReportStudio({
   onBlockingCountChanged,
 }: AnnualReportStudioProps) {
   const t = useTranslations('annualReportStudio')
+  const { appName } = useBranding()
   const { toast } = useToast()
   const [compliance, setCompliance] = useState<ComplianceResponse | null>(null)
   const [profile, setProfile] = useState<AnnualReportProfile | null>(null)
@@ -354,7 +356,7 @@ export function AnnualReportStudio({
           <h3 className="font-sans text-xs font-medium uppercase tracking-wider text-muted-foreground">{t('scope_title')}</h3>
           <div className="h-px flex-1 bg-border/60" />
         </div>
-        <p className="px-1 text-sm text-muted-foreground">{t('scope_description')}</p>
+        <p className="px-1 text-sm text-muted-foreground">{t('scope_description', { appName })}</p>
         <div className="space-y-6 px-1 pt-4">
           <div className="grid gap-4 md:grid-cols-2">
             <BooleanQuestion
diff --git a/components/bookkeeping/ChartOfAccounts.tsx b/components/bookkeeping/ChartOfAccounts.tsx
index 669f7254..732ea57f 100644
--- a/components/bookkeeping/ChartOfAccounts.tsx
+++ b/components/bookkeeping/ChartOfAccounts.tsx
@@ -2,6 +2,7 @@
 
 import { useState } from 'react'
 import { createClient } from '@/lib/supabase/client'
+import { guardBrowserWrite } from '@/lib/company/tab-guard'
 import { useAccounts } from '@/lib/reference-data/hooks'
 import { invalidateReferenceData } from '@/lib/reference-data/invalidate'
 import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
@@ -31,6 +32,9 @@ export default function ChartOfAccounts() {
   const [sruValue, setSruValue] = useState('')
 
   async function updateSRUCode(accountId: string, newSruCode: string) {
+    // Cross-tab guard (WL-09): browser-direct Supabase write, outside the
+    // patched-fetch seam. The blocking dialog is the user feedback.
+    if (!guardBrowserWrite()) return
     const supabase = createClient()
     const trimmed = newSruCode.trim() || null
     await supabase
diff --git a/components/bookkeeping/DocumentViewButton.tsx b/components/bookkeeping/DocumentViewButton.tsx
index 3c3ec14f..dfb77715 100644
--- a/components/bookkeeping/DocumentViewButton.tsx
+++ b/components/bookkeeping/DocumentViewButton.tsx
@@ -3,6 +3,7 @@
 import { Eye } from 'lucide-react'
 import { Button } from '@/components/ui/button'
 import { useToast } from '@/components/ui/use-toast'
+import { useBranding } from '@/lib/branding/brand-context'
 
 interface DocumentViewButtonProps {
   documentId: string
@@ -26,6 +27,7 @@ const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
  */
 export function DocumentViewButton({ documentId, label = 'Visa dokument', className }: DocumentViewButtonProps) {
   const { toast } = useToast()
+  const { appName } = useBranding()
 
   const handleClick = () => {
     // documentId originates from staged preview_data (Record<string, unknown>);
@@ -50,7 +52,7 @@ export function DocumentViewButton({ documentId, label = 'Visa dokument', classN
     } else {
       toast({
         title: 'Kunde inte öppna dokumentet',
-        description: 'Tillåt popupfönster för Accounted i webbläsaren och försök igen.',
+        description: `Tillåt popupfönster för ${appName} i webbläsaren och försök igen.`,
         variant: 'destructive',
       })
     }
diff --git a/components/bookkeeping/JournalEntryAttachments.tsx b/components/bookkeeping/JournalEntryAttachments.tsx
index 133a9a33..ef67dd31 100644
--- a/components/bookkeeping/JournalEntryAttachments.tsx
+++ b/components/bookkeeping/JournalEntryAttachments.tsx
@@ -32,6 +32,7 @@ import {
 import DocumentUploadZone from '@/components/bookkeeping/DocumentUploadZone'
 import type { UploadedFile } from '@/components/bookkeeping/DocumentUploadZone'
 import InboxDocumentPicker from '@/components/bookkeeping/InboxDocumentPicker'
+import { useBranding } from '@/lib/branding/brand-context'
 
 interface DocumentRecord {
   id: string
@@ -84,6 +85,7 @@ export default function JournalEntryAttachments({
   const embedded = variant === 'section'
   const t = useTranslations('journal_attachments')
   const tCommon = useTranslations('common')
+  const { appName } = useBranding()
   const { toast } = useToast()
   const [documents, setDocuments] = useState<DocumentRecord[]>([])
   const [loading, setLoading] = useState(true)
@@ -179,7 +181,7 @@ export default function JournalEntryAttachments({
         tab.close()
         toast({
           title: t('download_failed'),
-          description: tab.blocked ? tCommon('popup_blocked_description') : undefined,
+          description: tab.blocked ? tCommon('popup_blocked_description', { appName }) : undefined,
           variant: 'destructive',
         })
       }
diff --git a/components/branding/BrandHomeLink.tsx b/components/branding/BrandHomeLink.tsx
new file mode 100644
index 00000000..1e9f1bdf
--- /dev/null
+++ b/components/branding/BrandHomeLink.tsx
@@ -0,0 +1,61 @@
+'use client'
+
+/**
+ * Dashboard sidebar brand mark: the top-left home link (WL-12 slice A3).
+ *
+ * On a branded host with an uploaded logo it renders that logo; on every
+ * other host it renders exactly the legacy `getBranding().logoPath` image
+ * with the same dimensions, classes and aria-label as before, keeping
+ * default hosts byte-identical.
+ *
+ * With `showLabel` (expanded sidebar) a branded host without an uploaded
+ * logo renders the brand's app name beside the mark (byra-editable in the
+ * Varumärke settings). With an uploaded logo the logo carries the brand
+ * alone (same founder call as BrandWordmark, 2026-08-05: byrå logos usually
+ * carry their own name, so logo + text read as a duplicate). Unbranded
+ * hosts never show a label.
+ */
+
+import Link from 'next/link'
+import Image from 'next/image'
+import { useBranding } from '@/lib/branding/brand-context'
+import { useCompanyOptional } from '@/contexts/CompanyContext'
+
+export function BrandHomeLink({ showLabel = false }: { showLabel?: boolean }) {
+  const { appName, logoUrl, logoPath, brand } = useBranding()
+  const label = brand && !logoUrl ? brand.appName : null
+  // Byrå team members (any role) home to the cockpit, never to "/" (which
+  // would open whatever client company happens to be active). Everyone
+  // outside a byrå keeps the legacy home link.
+  const byraTeam = useCompanyOptional()?.byraTeam
+  const homeHref = byraTeam ? '/byra' : '/'
+  return (
+    <Link href={homeHref} aria-label={appName} className="flex items-center gap-2 rounded-lg">
+      {logoUrl ? (
+        <Image
+          src={logoUrl}
+          alt=""
+          width={26}
+          height={26}
+          className="h-[26px] w-[26px] rounded-lg object-contain"
+        />
+      ) : (
+        <Image
+          src={logoPath}
+          alt=""
+          width={26}
+          height={26}
+          className="h-[26px] w-[26px] rounded-lg"
+        />
+      )}
+      {showLabel && label && (
+        <span
+          className="truncate font-display text-base tracking-tight text-foreground"
+          style={{ fontWeight: 700 }}
+        >
+          {label}
+        </span>
+      )}
+    </Link>
+  )
+}
diff --git a/components/branding/BrandWordmark.tsx b/components/branding/BrandWordmark.tsx
index 3b3c3acf..64feffb3 100644
--- a/components/branding/BrandWordmark.tsx
+++ b/components/branding/BrandWordmark.tsx
@@ -1,5 +1,8 @@
+'use client'
+
+import Image from 'next/image'
 import { cn } from '@/lib/utils'
-import { getBranding } from '@/lib/branding/service'
+import { useBranding } from '@/lib/branding/brand-context'
 
 interface BrandWordmarkProps {
   /**
@@ -17,19 +20,40 @@ interface BrandWordmarkProps {
 }
 
 /**
- * Text-only wordmark used in place of the legacy logo image on auth /
- * onboarding / sandbox / invite surfaces. Renders the active brand's
- * `appName` in Hedvig Letters Serif at weight 700: the display font is
- * single-weight on Google Fonts so 700 ends up synthetically bolded, but
- * that matches the requested aesthetic.
+ * Wordmark used in place of the legacy logo image on auth / onboarding /
+ * sandbox / invite surfaces. On a branded host with an uploaded logo it
+ * renders the logo image ALONE (founder call 2026-08-05: byrå logos usually
+ * carry their own name, so logo + text read as a duplicate); otherwise it
+ * renders exactly the text-only wordmark: the active brand's `appName` in
+ * Hedvig Letters Serif at weight 700 (the display font is single-weight on
+ * Google Fonts so 700 ends up synthetically bolded, but that matches the
+ * requested aesthetic).
  */
 export function BrandWordmark({
   size = 'hero',
   lowercase = true,
   className,
 }: BrandWordmarkProps) {
-  const branding = getBranding()
+  const branding = useBranding()
   const name = lowercase ? branding.appName.toLowerCase() : branding.appName
+
+  if (branding.logoUrl) {
+    // The logo carries the brand alone; the app name moves into alt text so
+    // the image keeps an accessible name.
+    return (
+      <span className={cn('inline-flex items-center', className)}>
+        <Image
+          src={branding.logoUrl}
+          alt={name}
+          width={size === 'hero' ? 214 : 88}
+          height={size === 'hero' ? 64 : 22}
+          className={cn('w-auto', size === 'hero' ? 'h-16' : 'h-[22px]')}
+          priority={size === 'hero'}
+        />
+      </span>
+    )
+  }
+
   return (
     <span
       className={cn(
diff --git a/components/branding/SourceCodeFooter.tsx b/components/branding/SourceCodeFooter.tsx
new file mode 100644
index 00000000..895b32b7
--- /dev/null
+++ b/components/branding/SourceCodeFooter.tsx
@@ -0,0 +1,30 @@
+import { useTranslations } from 'next-intl'
+import { cn } from '@/lib/utils'
+
+/**
+ * Discreet source-code footer line (WL-06 slice A6).
+ *
+ * AGPL-3.0 section 13 compliance: the running service must offer its source
+ * to everyone who interacts with it over the network, so this renders on BOTH
+ * default and branded hosts; never gate it on a brand. It links the canonical
+ * repo. Dual-use component: works as a server component (privacy/dpa) and
+ * inside client pages (login); next-intl supports useTranslations in both.
+ */
+
+const SOURCE_REPO_URL = 'https://github.com/erp-mafia/gnubok'
+
+export function SourceCodeFooter({ className }: { className?: string }) {
+  const t = useTranslations('common')
+  return (
+    <p className={cn('text-center text-xs text-muted-foreground', className)}>
+      <a
+        href={SOURCE_REPO_URL}
+        target="_blank"
+        rel="noopener noreferrer"
+        className="underline underline-offset-2 hover:text-foreground transition-colors"
+      >
+        {t('source_code')}
+      </a>
+    </p>
+  )
+}
diff --git a/components/byra/ByraKpiView.tsx b/components/byra/ByraKpiView.tsx
new file mode 100644
index 00000000..06a56149
--- /dev/null
+++ b/components/byra/ByraKpiView.tsx
@@ -0,0 +1,373 @@
+'use client'
+
+import { useMemo, useState, useTransition } from 'react'
+import dynamic from 'next/dynamic'
+import { usePathname, useRouter, useSearchParams } from 'next/navigation'
+import { useTranslations } from 'next-intl'
+import { ArrowDown, ArrowUp, Loader2 } from 'lucide-react'
+import { cn, formatCurrency, formatDate } from '@/lib/utils'
+import { Badge } from '@/components/ui/badge'
+import { AttnLine } from '@/components/ui/attn-line'
+import { Skeleton } from '@/components/ui/skeleton'
+import { TH_CLASS, TD_CLASS } from '@/components/ui/dry-table'
+import { useToast } from '@/components/ui/use-toast'
+import { ContextPicker } from '@/components/common/ContextPicker'
+import { performCompanySwitch } from '@/lib/company/switch-client'
+import type { MonthlyDataPoint } from '@/components/reports/IncomeExpenseChart'
+import {
+  KPI_PERIOD_PRESETS,
+  type KpiPeriodPreset,
+} from '@/lib/byra/kpi-aggregate'
+import type { ByraKpiClientRow } from '@/lib/byra/kpi-overview'
+
+// Recharts is heavy: defer the chart so the tiles and table render first
+// (same pattern as components/reports/views/index.tsx).
+const IncomeExpenseChart = dynamic(
+  () => import('@/components/reports/IncomeExpenseChart').then((m) => m.IncomeExpenseChart),
+  { ssr: false, loading: () => <Skeleton className="h-64 w-full" /> },
+)
+
+interface ByraKpiViewProps {
+  preset: KpiPeriodPreset
+  allClients: Array<{ companyId: string; name: string }>
+  selectedIds: string[]
+  rows: ByraKpiClientRow[]
+  months: MonthlyDataPoint[]
+}
+
+type SortKey = 'name' | 'revenue' | 'result' | 'margin' | 'cash' | 'vatLiability' | 'unbookedCount'
+
+const NUMERIC_SORT_KEYS: SortKey[] = [
+  'revenue',
+  'result',
+  'margin',
+  'cash',
+  'vatLiability',
+  'unbookedCount',
+]
+
+function formatMargin(margin: number | null): string {
+  if (margin === null) return '-'
+  return `${new Intl.NumberFormat('sv-SE', { maximumFractionDigits: 1 }).format(margin)} %`
+}
+
+/**
+ * The Nyckeltal surface (WL-16): period preset + company chips filter the
+ * URL (the server page refetches), tiles and chart summarize the selection,
+ * and the table ranks clients. Entering a client is the same WL-09 soft
+ * switch as the client list.
+ */
+export default function ByraKpiView({
+  preset,
+  allClients,
+  selectedIds,
+  rows,
+  months,
+}: ByraKpiViewProps) {
+  const t = useTranslations('byra')
+  const tClients = useTranslations('clients')
+  const { toast } = useToast()
+  const router = useRouter()
+  const pathname = usePathname()
+  const searchParams = useSearchParams()
+  const [isPending, startTransition] = useTransition()
+  const [pendingId, setPendingId] = useState<string | null>(null)
+  const [sort, setSort] = useState<{ key: SortKey; desc: boolean }>({
+    key: 'revenue',
+    desc: true,
+  })
+
+  const hasExplicitFilter = searchParams.has('companies')
+  const selectedSet = useMemo(() => new Set(selectedIds), [selectedIds])
+
+  const updateParams = (mutate: (params: URLSearchParams) => void) => {
+    const params = new URLSearchParams(searchParams.toString())
+    mutate(params)
+    const query = params.toString()
+    startTransition(() => {
+      router.replace(query ? `${pathname}?${query}` : pathname, { scroll: false })
+    })
+  }
+
+  const handlePreset = (id: string) => {
+    updateParams((params) => params.set('period', id))
+  }
+
+  /**
+   * Chip semantics: no `companies` param = all clients. Clicking a chip in
+   * the all state focuses on that client; further clicks toggle. An empty
+   * or complete selection collapses back to the all state.
+   */
+  const handleToggleCompany = (companyId: string) => {
+    updateParams((params) => {
+      const next = hasExplicitFilter ? new Set(selectedIds) : new Set<string>()
+      if (next.has(companyId)) next.delete(companyId)
+      else next.add(companyId)
+      if (next.size === 0 || next.size === allClients.length) {
+        params.delete('companies')
+      } else {
+        params.set(
+          'companies',
+          allClients
+            .filter((c) => next.has(c.companyId))
+            .map((c) => c.companyId)
+            .join(','),
+        )
+      }
+    })
+  }
+
+  const handleAllCompanies = () => {
+    updateParams((params) => params.delete('companies'))
+  }
+
+  const handleEnter = async (companyId: string) => {
+    if (pendingId) return
+    setPendingId(companyId)
+    const result = await performCompanySwitch(companyId, { destination: '/' })
+    if (result?.error) {
+      setPendingId(null)
+      toast({ title: tClients('enter_failed'), variant: 'destructive' })
+    }
+  }
+
+  const handleSort = (key: SortKey) => {
+    setSort((prev) =>
+      prev.key === key
+        ? { key, desc: !prev.desc }
+        : { key, desc: NUMERIC_SORT_KEYS.includes(key) },
+    )
+  }
+
+  const sortedRows = useMemo(() => {
+    const dir = sort.desc ? -1 : 1
+    return [...rows].sort((a, b) => {
+      if (sort.key === 'name') return dir * a.name.localeCompare(b.name, 'sv')
+      const av = a[sort.key] ?? Number.NEGATIVE_INFINITY
+      const bv = b[sort.key] ?? Number.NEGATIVE_INFINITY
+      if (av !== bv) return dir * (av - bv)
+      return a.name.localeCompare(b.name, 'sv')
+    })
+  }, [rows, sort])
+
+  const okRows = rows.filter((r) => !r.failed)
+  const failedCount = rows.length - okRows.length
+  const totals = {
+    revenue: okRows.reduce((sum, r) => sum + r.revenue, 0),
+    result: okRows.reduce((sum, r) => sum + r.result, 0),
+    cash: okRows.reduce((sum, r) => sum + r.cash, 0),
+    attention: okRows.filter((r) => r.unbookedCount > 0 || r.inboxCount > 0).length,
+  }
+
+  const tiles = [
+    { label: t('kpi_revenue'), value: formatCurrency(totals.revenue), negative: false },
+    { label: t('kpi_result'), value: formatCurrency(totals.result), negative: totals.result < 0 },
+    { label: t('kpi_cash'), value: formatCurrency(totals.cash), negative: totals.cash < 0 },
+    { label: t('stats_attention'), value: String(totals.attention), negative: false },
+  ]
+
+  const presetItems = KPI_PERIOD_PRESETS.map((id) => ({
+    id,
+    label: t(`kpi_period_${id}`),
+  }))
+
+  const columns: Array<{ key: SortKey; label: string; numeric: boolean }> = [
+    { key: 'name', label: tClients('col_company'), numeric: false },
+    { key: 'revenue', label: t('kpi_revenue'), numeric: true },
+    { key: 'result', label: t('kpi_result'), numeric: true },
+    { key: 'margin', label: t('kpi_margin'), numeric: true },
+    { key: 'cash', label: t('kpi_cash'), numeric: true },
+    { key: 'vatLiability', label: t('kpi_vat'), numeric: true },
+    { key: 'unbookedCount', label: tClients('col_unbooked'), numeric: true },
+  ]
+
+  const SortIcon = sort.desc ? ArrowDown : ArrowUp
+
+  return (
+    <div className={cn('space-y-8 transition-opacity duration-150', isPending && 'opacity-60')}>
+      <div className="flex flex-wrap items-center gap-2">
+        <button
+          type="button"
+          onClick={handleAllCompanies}
+          aria-pressed={!hasExplicitFilter}
+          className={cn(
+            'rounded-full border px-3 py-[5px] text-[13px] transition-colors duration-150',
+            !hasExplicitFilter
+              ? 'border-foreground/20 bg-secondary text-foreground'
+              : 'border-border text-muted-foreground hover:bg-secondary/60',
+          )}
+        >
+          {t('kpi_filter_all')}
+        </button>
+        {allClients.map((client) => {
+          const active = hasExplicitFilter && selectedSet.has(client.companyId)
+          return (
+            <button
+              key={client.companyId}
+              type="button"
+              onClick={() => handleToggleCompany(client.companyId)}
+              aria-pressed={active}
+              className={cn(
+                'rounded-full border px-3 py-[5px] text-[13px] transition-colors duration-150',
+                active
+                  ? 'border-foreground/20 bg-secondary text-foreground'
+                  : 'border-border text-muted-foreground hover:bg-secondary/60',
+              )}
+            >
+              {client.name}
+            </button>
+          )
+        })}
+        <div className="ml-auto">
+          <ContextPicker
+            items={presetItems}
+            value={preset}
+            onChange={handlePreset}
+            triggerLabel={t(`kpi_period_${preset}`)}
+            ariaLabel={t('kpi_period_picker')}
+          />
+        </div>
+      </div>
+
+      {failedCount > 0 && (
+        <AttnLine>{t('kpi_failed_notice', { count: failedCount })}</AttnLine>
+      )}
+
+      <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-4">
+        {tiles.map((tile) => (
+          <div key={tile.label} className="rounded-lg border border-border p-4">
+            <div className="text-xs text-muted-foreground">{tile.label}</div>
+            <div
+              className={cn(
+                'mt-1 font-sans text-xl tabular-nums',
+                tile.negative && 'text-destructive',
+              )}
+            >
+              {tile.value}
+            </div>
+          </div>
+        ))}
+      </div>
+
+      <IncomeExpenseChart months={months} />
+
+      <div className="overflow-x-auto">
+        <table className="w-full border-collapse text-[13px]">
+          <thead>
+            <tr>
+              {columns.map((col) => (
+                <th key={col.key} className={cn(TH_CLASS, col.numeric && 'text-right')}>
+                  <button
+                    type="button"
+                    onClick={() => handleSort(col.key)}
+                    className={cn(
+                      'inline-flex items-center gap-1',
+                      col.numeric && 'flex-row-reverse',
+                    )}
+                  >
+                    {col.label}
+                    {sort.key === col.key && <SortIcon className="h-3 w-3" />}
+                  </button>
+                </th>
+              ))}
+              <th className={TH_CLASS}>{tClients('col_next_deadline')}</th>
+            </tr>
+          </thead>
+          <tbody className="stagger-enter">
+            {sortedRows.map((row) => (
+              <tr
+                key={row.companyId}
+                onClick={() => void handleEnter(row.companyId)}
+                className={cn(
+                  'cursor-pointer transition-colors duration-150 hover:bg-secondary/35',
+                  pendingId && pendingId !== row.companyId && 'opacity-50',
+                )}
+              >
+                <td className={TD_CLASS}>
+                  <span className="flex items-center gap-2">
+                    <span className="font-medium text-foreground">{row.name}</span>
+                    {row.orgNumber && (
+                      <span className="text-xs text-muted-foreground tabular-nums">
+                        {row.orgNumber}
+                      </span>
+                    )}
+                    {pendingId === row.companyId && (
+                      <Loader2 className="h-3.5 w-3.5 animate-spin text-muted-foreground" />
+                    )}
+                  </span>
+                </td>
+                {row.failed ? (
+                  <td className={cn(TD_CLASS, 'text-muted-foreground')} colSpan={6}>
+                    {t('kpi_row_failed')}
+                  </td>
+                ) : (
+                  <>
+                    <td className={cn(TD_CLASS, 'text-right tabular-nums')}>
+                      {formatCurrency(row.revenue)}
+                    </td>
+                    <td
+                      className={cn(
+                        TD_CLASS,
+                        'text-right tabular-nums',
+                        row.result < 0 && 'text-destructive',
+                      )}
+                    >
+                      {formatCurrency(row.result)}
+                    </td>
+                    <td className={cn(TD_CLASS, 'text-right tabular-nums text-muted-foreground')}>
+                      {formatMargin(row.margin)}
+                    </td>
+                    <td
+                      className={cn(
+                        TD_CLASS,
+                        'text-right tabular-nums',
+                        row.cash < 0 && 'text-destructive',
+                      )}
+                    >
+                      {formatCurrency(row.cash)}
+                    </td>
+                    <td className={cn(TD_CLASS, 'text-right tabular-nums text-muted-foreground')}>
+                      {formatCurrency(row.vatLiability)}
+                    </td>
+                    <td className={cn(TD_CLASS, 'text-right tabular-nums')}>
+                      {row.unbookedCount > 0 ? (
+                        row.unbookedCount
+                      ) : (
+                        <span className="text-muted-foreground">0</span>
+                      )}
+                    </td>
+                  </>
+                )}
+                <td className={TD_CLASS}>
+                  {row.nextDeadline ? (
+                    <span className="flex items-center gap-2">
+                      {row.nextDeadline.urgency === 'overdue' && (
+                        <Badge variant="destructive">{tClients('deadline_overdue')}</Badge>
+                      )}
+                      {row.nextDeadline.urgency === 'action_needed' && (
+                        <Badge variant="warning">{tClients('deadline_action_needed')}</Badge>
+                      )}
+                      <span
+                        className={cn(
+                          'truncate',
+                          row.nextDeadline.urgency === 'upcoming' && 'text-muted-foreground',
+                        )}
+                      >
+                        {row.nextDeadline.title}
+                      </span>
+                      <span className="text-muted-foreground tabular-nums">
+                        {formatDate(row.nextDeadline.dueDate)}
+                      </span>
+                    </span>
+                  ) : (
+                    <span className="text-muted-foreground">-</span>
+                  )}
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      </div>
+    </div>
+  )
+}
diff --git a/components/dashboard/CompanySwitcher.tsx b/components/dashboard/CompanySwitcher.tsx
index b9b1076a..cd0389c6 100644
--- a/components/dashboard/CompanySwitcher.tsx
+++ b/components/dashboard/CompanySwitcher.tsx
@@ -11,7 +11,7 @@ import { useToast } from '@/components/ui/use-toast'
 import { Check, ChevronsUpDown, Plus, Loader2 } from 'lucide-react'
 
 export default function CompanySwitcher() {
-  const { company, companies, isSandbox } = useCompany()
+  const { company, companies, isSandbox, foreignCompanies = [] } = useCompany()
   const t = useTranslations('company_switcher')
   const { toast } = useToast()
   const [open, setOpen] = useState(false)
@@ -179,8 +179,30 @@ export default function CompanySwitcher() {
             </>
           )}
 
+          {/* Companies homed on another domain (home-domain rule, WL-01):
+              non-clickable signposts; the company is worked in over there. */}
+          {foreignCompanies.length > 0 && (
+            <div className="border-t border-border/40 mt-1 pt-1 px-1">
+              <p className="px-2.5 pt-1 pb-0.5 text-[10px] font-semibold text-muted-foreground/60 uppercase tracking-[0.08em]">
+                {t('managed_elsewhere')}
+              </p>
+              {foreignCompanies.map((entry) => (
+                <div
+                  key={entry.id}
+                  className="px-2.5 py-1.5 text-[12px] leading-snug text-muted-foreground/60"
+                  aria-disabled="true"
+                >
+                  <span className="block truncate">{entry.name}</span>
+                  <span className="block truncate text-[10px]">
+                    {t('managed_via', { domain: entry.domain })}
+                  </span>
+                </div>
+              ))}
+            </div>
+          )}
+
           {!isSandbox && (
-            <div className={cn(companies.length > 0 && 'border-t border-border/40 mt-1 pt-1', 'px-1')}>
+            <div className={cn((companies.length > 0 || foreignCompanies.length > 0) && 'border-t border-border/40 mt-1 pt-1', 'px-1')}>
               <Link
                 href="/select-company?choose=1"
                 onClick={() => setOpen(false)}
diff --git a/components/dashboard/CompanyTabSync.tsx b/components/dashboard/CompanyTabSync.tsx
index 8f1cafe4..f3abdce1 100644
--- a/components/dashboard/CompanyTabSync.tsx
+++ b/components/dashboard/CompanyTabSync.tsx
@@ -1,60 +1,169 @@
 'use client'
 
-import { useEffect } from 'react'
+import { useEffect, useState } from 'react'
+import { useTranslations } from 'next-intl'
 import { useCompany } from '@/contexts/CompanyContext'
+import { performCompanySwitch } from '@/lib/company/switch-client'
+import { Button } from '@/components/ui/button'
+import {
+  TAB_SYNC_CHANNEL,
+  TAB_SYNC_STORAGE_KEY,
+  decodeStorageValue,
+  guardStore,
+  isTabMismatch,
+  requestHasNextActionHeader,
+  shouldBlockMutation,
+} from '@/lib/company/tab-guard'
 
 /**
- * CompanyTabSync: cross-tab active company enforcement.
+ * CompanyTabSync: the cross-tab active-company TAB GUARD (WL-09).
  *
- * Mounted once inside the dashboard layout (via CompanyProvider), this
- * component guarantees that every open tab of the same user always shows
- * the same active company. It has three layers:
+ * The active company is one user_preferences row per user shared across
+ * every tab, so a switch in one tab silently re-anchors every other tab's
+ * writes to the new company. Each tab remembers the company it is rendering
+ * (server-rendered active company at mount). Three detection layers:
  *
- *   1. BroadcastChannel('gnubok-company-switch')
- *      When the user switches company in one tab, every other live tab
- *      receives the message and hard-reloads if its current company differs
- *      from the broadcasted one.
+ *   1. BroadcastChannel('gnubok-company-switch'): live cross-tab signal;
+ *      the switch action (lib/company/switch-client) broadcasts.
+ *   2. `storage` events on the gnubok-active-company key: fallback where
+ *      BroadcastChannel is unavailable; the switch action writes the key.
+ *   3. visibilitychange + pageshow(persisted): tabs hidden/bfcache-frozen
+ *      during the switch verify against /api/company/current on focus.
  *
- *   2. visibilitychange
- *      Catches tabs that were hidden/minimized during a switch. On focus,
- *      the tab checks /api/company/current and reloads on mismatch, before
- *      any pixel of stale data is painted to the user.
+ * On mismatch the tab BLOCKS with a dialog whose only exits are switching
+ * back to this tab's company or reloading as the new one. Deliberately no
+ * continue-anyway: continuing would post into the wrong company's books
+ * (WL-09 resolution; this is not the soft-guard pattern).
  *
- *   3. pageshow with event.persisted === true
- *      Catches tabs restored from the browser's bfcache (back/forward
- *      navigation). bfcache literally freezes the DOM and JS state, so
- *      neither BroadcastChannel nor visibilitychange fires. pageshow is the
- *      only reliable signal and is guaranteed to fire on bfcache restore.
+ * Mutations are guarded too: window.fetch is wrapped while mounted, and a
+ * mutating same-origin request from a tab that KNOWS the active company
+ * changed is refused with a synthetic 409 before it leaves the tab (covers
+ * autosaves and other background writes racing the dialog). Two shapes:
  *
- * All three layers converge on the same action: window.location.assign('/'),
- * a hard navigation that wipes React state, the router cache, in-flight
- * requests, blob URLs, and every other in-tab leak vector.
+ *   - /api requests get the canonical JSON error envelope.
+ *   - server-action POSTs (identified by the `next-action` header; verified
+ *     to pass through the patched window.fetch on next@16.2.12) get a
+ *     text/plain 409, which the flight client surfaces as the thrown action
+ *     error. The sanctioned company-switch action passes through
+ *     (guardStore.companySwitchInFlight): it is both dialog exits.
  *
- * No-op when the user has no active company (renders nothing, attaches no
- * listeners).
+ * Browser-direct Supabase calls go to the Supabase origin and stay outside
+ * this seam; their write sites call guardBrowserWrite() (lib/company/
+ * tab-guard.ts), which consults the same guardStore.
+ *
+ * No-op when the user has no active company.
  */
+
+// Guard state is the shared guardStore in lib/company/tab-guard.ts so
+// browser-direct write sites can consult the same belief. Single dashboard
+// shell = single writer (this component).
+
+let originalFetch: typeof window.fetch | null = null
+
+function installFetchGuard(): void {
+  if (typeof window === 'undefined' || originalFetch) return
+  originalFetch = window.fetch.bind(window)
+  window.fetch = ((input: RequestInfo | URL, init?: RequestInit) => {
+    const method =
+      init?.method ?? (input instanceof Request ? input.method : undefined)
+    const url =
+      typeof input === 'string'
+        ? input
+        : input instanceof URL
+          ? input.toString()
+          : input.url
+    const isServerAction = requestHasNextActionHeader(input, init)
+    if (
+      shouldBlockMutation({
+        method,
+        url,
+        pageOrigin: window.location.origin,
+        tabCompanyId: guardStore.tabCompanyId,
+        observedCompanyId: guardStore.observedCompanyId,
+        isServerAction,
+        companySwitchInFlight: guardStore.companySwitchInFlight,
+      })
+    ) {
+      guardStore.notifyBlocked?.()
+      if (isServerAction) {
+        // The flight client treats a non-RSC response as a failed action and
+        // surfaces a text/plain >=400 body as the thrown error's message.
+        return Promise.resolve(
+          new Response('Aktivt företag har bytts i en annan flik.', {
+            status: 409,
+            headers: { 'Content-Type': 'text/plain' },
+          }),
+        )
+      }
+      return Promise.resolve(
+        new Response(
+          JSON.stringify({
+            error: {
+              code: 'ACTIVE_COMPANY_CHANGED',
+              message: 'Aktivt företag har bytts i en annan flik.',
+              message_en: 'The active company was switched in another tab.',
+            },
+          }),
+          { status: 409, headers: { 'Content-Type': 'application/json' } },
+        ),
+      )
+    }
+    return originalFetch!(input as RequestInfo, init)
+  }) as typeof window.fetch
+}
+
+function uninstallFetchGuard(): void {
+  if (typeof window === 'undefined' || !originalFetch) return
+  window.fetch = originalFetch
+  originalFetch = null
+}
+
 export default function CompanyTabSync() {
   const { company } = useCompany()
+  const t = useTranslations('company_tab_guard')
   const currentCompanyId = company?.id ?? null
+  const [mismatch, setMismatch] = useState(false)
+  const [resolving, setResolving] = useState(false)
 
   useEffect(() => {
-    const hardReload = () => {
-      window.location.assign('/')
+    if (!currentCompanyId) return
+
+    guardStore.tabCompanyId = currentCompanyId
+    guardStore.observedCompanyId = null
+    guardStore.notifyBlocked = () => {
+      // A self-initiated switch is hard-navigating this tab away: blocked
+      // stray writes still get their 409, but the "switched in another tab"
+      // dialog would just flash over the tab's own page load.
+      if (!guardStore.selfSwitchTargetId) setMismatch(true)
+    }
+    installFetchGuard()
+
+    const observe = (observedId: string | null | undefined) => {
+      if (observedId === null || observedId === undefined) return
+      guardStore.observedCompanyId = observedId
+      if (observedId === guardStore.selfSwitchTargetId) return
+      if (isTabMismatch(currentCompanyId, observedId)) {
+        setMismatch(true)
+      }
     }
 
     // Layer 1: BroadcastChannel: live cross-tab sync
     let channel: BroadcastChannel | null = null
     if (typeof BroadcastChannel !== 'undefined') {
-      channel = new BroadcastChannel('gnubok-company-switch')
+      channel = new BroadcastChannel(TAB_SYNC_CHANNEL)
       channel.onmessage = (event: MessageEvent<{ companyId: string | null }>) => {
-        const incomingId = event.data?.companyId ?? null
-        if (incomingId !== currentCompanyId) {
-          hardReload()
-        }
+        observe(event.data?.companyId ?? null)
       }
     }
 
-    // Layer 2: visibilitychange: on focus, verify against server
+    // Layer 1b: storage-event fallback (fires in every OTHER tab)
+    const handleStorage = (event: StorageEvent) => {
+      if (event.key !== TAB_SYNC_STORAGE_KEY) return
+      observe(decodeStorageValue(event.newValue))
+    }
+    window.addEventListener('storage', handleStorage)
+
+    // Layer 2: on focus, verify against the server
     const checkServer = async () => {
       try {
         const res = await fetch('/api/company/current', {
@@ -63,11 +172,9 @@ export default function CompanyTabSync() {
         })
         if (!res.ok) return
         const data = (await res.json()) as { companyId: string | null }
-        if (data.companyId !== currentCompanyId) {
-          hardReload()
-        }
+        observe(data.companyId)
       } catch {
-        // Network error / offline: do nothing (don't accidentally reload-loop)
+        // Network error / offline: do nothing (don't false-positive the guard)
       }
     }
 
@@ -81,6 +188,10 @@ export default function CompanyTabSync() {
     // Layer 3: pageshow (persisted === true): bfcache restore
     const handlePageShow = (event: PageTransitionEvent) => {
       if (event.persisted) {
+        // A bfcache-restored page renders the OLD company after this tab's
+        // own switch (back-navigation): the self-switch marker must not keep
+        // suppressing the dialog here.
+        guardStore.selfSwitchTargetId = null
         void checkServer()
       }
     }
@@ -88,10 +199,71 @@ export default function CompanyTabSync() {
 
     return () => {
       channel?.close()
+      window.removeEventListener('storage', handleStorage)
       document.removeEventListener('visibilitychange', handleVisibilityChange)
       window.removeEventListener('pageshow', handlePageShow)
+      guardStore.tabCompanyId = null
+      guardStore.observedCompanyId = null
+      guardStore.notifyBlocked = null
+      guardStore.selfSwitchTargetId = null
+      uninstallFetchGuard()
     }
   }, [currentCompanyId])
 
-  return null
+  if (!mismatch || !currentCompanyId) return null
+
+  const handleSwitchBack = async () => {
+    setResolving(true)
+    // Re-activate THIS tab's company and reload the page we are on (same
+    // company, so its data is still valid). Other tabs get the broadcast and
+    // face the same dialog: the hazard is symmetric by design.
+    const result = await performCompanySwitch(currentCompanyId, {
+      destination: window.location.pathname + window.location.search,
+    })
+    if (result?.error) {
+      // Membership lost or persist failure: this tab cannot win the company
+      // back, so the only safe exit left is loading the new company.
+      window.location.assign('/')
+    }
+  }
+
+  const handleReloadAsNew = () => {
+    setResolving(true)
+    // Land on the start page: the current path may not exist (or worse, mean
+    // another object) under the new company.
+    window.location.assign('/')
+  }
+
+  return (
+    <div
+      className="fixed inset-0 z-[100] flex items-center justify-center p-4"
+      role="alertdialog"
+      aria-modal="true"
+      aria-labelledby="company-tab-guard-title"
+    >
+      {/* Veil: deliberately no click-to-close and no Esc: the dialog is
+          blocking, its two buttons are the only exits (WL-09). */}
+      <div className="absolute inset-0 bg-background/80 backdrop-blur-sm" aria-hidden="true" />
+      <div className="relative w-full max-w-md rounded-lg border border-border bg-card p-6 shadow-lg">
+        <h2 id="company-tab-guard-title" className="font-display text-lg leading-6">
+          {t('title')}
+        </h2>
+        <p className="mt-2 text-sm text-muted-foreground">
+          {t('body', { company: company?.name ?? '' })}
+        </p>
+        <div className="mt-6 flex flex-col gap-2 sm:flex-row sm:justify-end">
+          <Button
+            variant="outline"
+            disabled={resolving}
+            onClick={handleReloadAsNew}
+          >
+            {t('reload_as_new')}
+          </Button>
+          <Button disabled={resolving} onClick={() => void handleSwitchBack()}>
+            {t('switch_back', { company: company?.name ?? '' })}
+          </Button>
+        </div>
+      </div>
+    </div>
+  )
 }
diff --git a/components/dashboard/DashboardNav.tsx b/components/dashboard/DashboardNav.tsx
index 5de1e539..bfe72539 100644
--- a/components/dashboard/DashboardNav.tsx
+++ b/components/dashboard/DashboardNav.tsx
@@ -2,8 +2,7 @@
 
 import { useEffect, useState, useRef } from 'react'
 import { NavLink } from './NavLink'
-import Image from 'next/image'
-import { usePathname, useRouter } from 'next/navigation'
+import { usePathname, useRouter, useSearchParams } from 'next/navigation'
 import { useTranslations } from 'next-intl'
 import { cn } from '@/lib/utils'
 import { Button } from '@/components/ui/button'
@@ -45,11 +44,15 @@ import {
   PanelLeftClose,
   Library,
   BookCheck,
+  Briefcase,
+  ArrowLeft,
+  Workflow,
   FolderArchive,
   ShoppingCart,
   Car,
 } from 'lucide-react'
 import { getBranding } from '@/lib/branding/service'
+import { BrandHomeLink } from '@/components/branding/BrandHomeLink'
 import { ENABLED_EXTENSION_IDS as _ENABLED_EXTENSION_IDS } from '@/lib/extensions/_generated/enabled-extensions'
 import { resolveIcon } from '@/lib/extensions/icon-resolver'
 import { resetAnalyticsIdentity } from '@/lib/analytics/reset'
@@ -140,6 +143,9 @@ type NavLabelKey =
   | 'income_declaration'
   | 'help'
   | 'settings'
+  | 'clients'
+  | 'automations'
+  | 'back_to_clients'
 
 // Nav layout (July 2026, UI-migration concept, dev_docs/ui_migration_plan.md
 // PR 2): same routes, concept structure.
@@ -192,6 +198,9 @@ interface NavItem {
   // Statutory surfaces that only exist for one company form (INK2 vs
   // NE-bilaga, årsredovisning): hidden for the other entity type.
   entityOnly?: EntityType
+  // Byrå cockpit surfaces (WL-14): visible only to byrå team members
+  // (teams.kind = 'byra'). The /clients page + API enforce server-side.
+  byraOnly?: boolean
   hidden?: boolean
   comingSoon?: boolean
   devBadge?: boolean
@@ -205,6 +214,8 @@ const navItems: NavItem[] = [
   // Top section: flat list, always visible, no header. (Flöden joins here
   // when the flow engine exists.)
   { href: '/', labelKey: 'home', icon: Home, group: 'top' },
+  // Byrå cockpit (WL-14): the client list, byrå team members only.
+  { href: '/clients', labelKey: 'clients', icon: Briefcase, group: 'top', byraOnly: true },
   { href: '/chat', labelKey: 'assistant', icon: Sparkles, group: 'top' },
   // Arbeta: everything the user produces, bookkeeping funnel first
   // (Bokföring · Underlag · Transaktioner · Granskning), then the
@@ -255,6 +266,24 @@ const navItems: NavItem[] = [
   { href: '/reports/ne-declaration', labelKey: 'income_declaration', icon: FileSpreadsheet, group: 'skatt', fold: 'bokslut', entityOnly: 'enskild_firma' },
 ]
 
+// Byrå cockpit sidebar (lean mode): while a byrå team member is on a
+// cockpit route (client overview + the /byra pages) the sidebar shows only
+// these four byrå-scope entries instead of the full company nav. Entering a
+// company (performCompanySwitch from the client list) is a hard navigation
+// to a company route, which swaps the full list back in.
+const cockpitNavItems: NavItem[] = [
+  { href: '/byra', labelKey: 'home', icon: Home, group: 'top' },
+  { href: '/clients', labelKey: 'clients', icon: Briefcase, group: 'top' },
+  { href: '/byra/automations', labelKey: 'automations', icon: Workflow, group: 'top' },
+  { href: '/byra/kpi', labelKey: 'kpi', icon: TrendingUp, group: 'top' },
+]
+
+// Cockpit routes are byrå-scope, not company-scope: they decide which
+// sidebar variant renders and stay enabled without an active company.
+const COCKPIT_PATHS = ['/byra', '/clients']
+const isCockpitPath = (pathname: string) =>
+  COCKPIT_PATHS.some((p) => pathname === p || pathname.startsWith(`${p}/`))
+
 // Fold header presentation (label + icon). The fold rows themselves come
 // from navItems entries carrying the matching `fold` key.
 const foldConfig: Record<FoldKey, { labelKey: string; icon: typeof LayoutDashboard }> = {
@@ -304,7 +333,7 @@ export default function DashboardNav({ companyName: _companyName, entityType, pa
   const pathname = usePathname()
   const router = useRouter()
   const supabase = useRealtimeSupabase()
-  const { company, capabilities } = useCompany()
+  const { company, capabilities, byraTeam } = useCompany()
   // Agent identity drives the "Assistent" nav icon: when the user has
   // built their assistant we show its chosen avatar instead of the
   // generic Sparkles glyph.
@@ -324,8 +353,34 @@ export default function DashboardNav({ companyName: _companyName, entityType, pa
     refresh: refreshBadges,
   } = useWorklistBadges(company?.id)
   const hasCompany = !!company
-  const ALWAYS_ENABLED = new Set(['/settings'])
-  const isItemEnabled = (href: string) => hasCompany || ALWAYS_ENABLED.has(href)
+  // Byrå cockpit mode: lean sidebar on cockpit routes, full sidebar (with a
+  // back-to-clients link) once the member is inside a company. Settings opens
+  // as a modal OVER the current surface (intercepted route), so while the
+  // pathname is /settings/* the sidebar keeps the mode of the page underneath
+  // instead of flipping to the company nav behind the modal.
+  const onSettings = pathname.startsWith('/settings')
+  const onCockpitPath = isCockpitPath(pathname)
+  // Settings opened from the cockpit carry ?ctx=byra (user menu / mobile
+  // nav links, preserved by SettingsRail). It is the signal that SURVIVES a
+  // hard refresh, when the previous-surface memory below starts over at
+  // false and the sidebar used to flip to the full company nav.
+  const ctxByra = useSearchParams().get('ctx') === 'byra'
+  // Previous-render memory via the adjust-state-during-render pattern
+  // (react.dev: storing information from previous renders); a ref would be
+  // simpler but refs must not be read or written during render.
+  const [lastNonSettingsCockpit, setLastNonSettingsCockpit] = useState(false)
+  if (!onSettings && onCockpitPath !== lastNonSettingsCockpit) {
+    setLastNonSettingsCockpit(onCockpitPath)
+  }
+  const cockpitMode =
+    !!byraTeam && (onSettings ? lastNonSettingsCockpit || ctxByra : onCockpitPath)
+  // Byrå-scope surfaces, not company surfaces: they must stay reachable even
+  // when the active company is unresolved.
+  const ALWAYS_ENABLED = new Set(['/settings', '/clients', '/byra', '/byra/automations', '/byra/kpi'])
+  const isItemEnabled = (href: string) => {
+    const base = href.split('?')[0]
+    return hasCompany || ALWAYS_ENABLED.has(base) || base.startsWith('/settings')
+  }
   type ExpandableGroup = Exclude<GroupKey, 'top'>
 
   // Sidebar collapse (64px icon rail). The width is CSS-variable-driven:
@@ -378,6 +433,11 @@ export default function DashboardNav({ companyName: _companyName, entityType, pa
     if (href === '/') {
       return pathname === '/'
     }
+    // Cockpit Hem: exact match so /byra/automations and /byra/kpi light up
+    // their own rows only.
+    if (href === '/byra') {
+      return pathname === '/byra'
+    }
     if (href === '/salary') {
       return pathname === '/salary' || pathname.startsWith('/salary/runs')
     }
@@ -486,7 +546,7 @@ export default function DashboardNav({ companyName: _companyName, entityType, pa
 
   const isEmployer = entityType === 'aktiebolag' || paysSalaries
 
-  const filteredItems = navItems.filter(item => {
+  const filteredItems = (cockpitMode ? cockpitNavItems : navItems).filter(item => {
     if (item.hidden) return false
     if (hiddenNavHrefs.has(item.href)) return false
     // Payroll (employerOnly) is hidden until the company is an employer, an
@@ -508,6 +568,10 @@ export default function DashboardNav({ companyName: _companyName, entityType, pa
     // Entity-gated statutory surfaces: INK2/ÅR for aktiebolag, NE for
     // enskild firma; the page for the other form doesn't exist.
     if (item.entityOnly && item.entityOnly !== entityType) return false
+    // Byrå cockpit: the Klienter entry lives in the lean cockpit sidebar
+    // (cockpitNavItems); in company mode the pinned back-to-clients link
+    // replaces it, and non-byrå users never see it (WL-14).
+    if (item.byraOnly) return false
     // Hide the Assistent (/chat) tab until the agent is built: mirrors the
     // floating AgentTrigger and avoids a nav entry that only bounces to the
     // home checklist (chat/layout redirects unverified users to /).
@@ -523,26 +587,31 @@ export default function DashboardNav({ companyName: _companyName, entityType, pa
   // The TIC workspace (/e/general/tic, labelled "Företagsprofil") surfaces
   // the same Bolagsuppgifter now shown under Inställningar → Företagsprofil.
   // Drop it from the nav so the company profile lives in exactly one place.
-  const visibleExtensionNavItems = extensionNavItems.filter(
-    (i) => i.href !== '/e/general/tic',
-  )
+  // Extension workspaces are company surfaces: none in cockpit mode.
+  const visibleExtensionNavItems = cockpitMode
+    ? []
+    : extensionNavItems.filter((i) => i.href !== '/e/general/tic')
 
-  const sidebarGroups: { key: ExpandableGroup; items: NavItem[] }[] = [
-    { key: 'arbeta', items: filteredItems.filter((i) => i.group === 'arbeta') },
-    { key: 'analys', items: filteredItems.filter((i) => i.group === 'analys') },
-    { key: 'data', items: filteredItems.filter((i) => i.group === 'data') },
-    { key: 'skatt', items: filteredItems.filter((i) => i.group === 'skatt') },
-  ]
+  const sidebarGroups: { key: ExpandableGroup; items: NavItem[] }[] = cockpitMode
+    ? []
+    : [
+        { key: 'arbeta', items: filteredItems.filter((i) => i.group === 'arbeta') },
+        { key: 'analys', items: filteredItems.filter((i) => i.group === 'analys') },
+        { key: 'data', items: filteredItems.filter((i) => i.group === 'data') },
+        { key: 'skatt', items: filteredItems.filter((i) => i.group === 'skatt') },
+      ]
 
   // Flat leaf list for the collapsed 64px icon rail: fold children render
   // as plain icons (group headers and fold headers disappear).
   const railItems = [...topItems, ...sidebarGroups.flatMap(({ items }) => items)]
 
-  const allMobileNavItems: { href: string; labelKey: NavLabelKey; icon: typeof LayoutDashboard }[] = [
-    { href: '/', labelKey: 'home', icon: Home },
-    { href: '/chat', labelKey: 'assistant', icon: Sparkles },
-    { href: '/transactions', labelKey: 'transactions', icon: ArrowLeftRight },
-  ]
+  const allMobileNavItems: { href: string; labelKey: NavLabelKey; icon: typeof LayoutDashboard }[] = cockpitMode
+    ? cockpitNavItems.map(({ href, labelKey, icon }) => ({ href, labelKey, icon }))
+    : [
+        { href: '/', labelKey: 'home', icon: Home },
+        { href: '/chat', labelKey: 'assistant', icon: Sparkles },
+        { href: '/transactions', labelKey: 'transactions', icon: ArrowLeftRight },
+      ]
   // Same gate as the sidebar: no Assistent tab until the agent is built.
   const mobileNavItems = allMobileNavItems.filter(
     (item) => item.href !== '/chat' || agentIdentity.isVerified,
@@ -712,19 +781,10 @@ export default function DashboardNav({ companyName: _companyName, entityType, pa
                 : 'justify-between pl-5 pr-3',
             )}
           >
-            <NavLink
-              href="/"
-              aria-label={getBranding().appName}
-              className="flex items-center rounded-lg"
-            >
-              <Image
-                src={getBranding().logoPath}
-                alt=""
-                width={26}
-                height={26}
-                className="h-[26px] w-[26px] rounded-lg"
-              />
-            </NavLink>
+            {/* Brand mark (WL-12 slice A3): brand logo on branded hosts,
+                the exact legacy image everywhere else. The expanded sidebar
+                also shows the brand domain prefix beside the mark. */}
+            <BrandHomeLink showLabel={!collapsed} />
             <button
               type="button"
               onClick={toggleCollapsed}
@@ -760,6 +820,10 @@ export default function DashboardNav({ companyName: _companyName, entityType, pa
                 )}
                 aria-label={tNav('main_navigation')}
               >
+                {/* Rail counterpart of the back-to-clients link. */}
+                {byraTeam &&
+                  !cockpitMode &&
+                  renderRailItem({ href: '/clients', labelKey: 'back_to_clients', icon: ArrowLeft })}
                 {railItems.map((item) => renderRailItem(item))}
                 {visibleExtensionNavItems.map((item) => {
                   const Icon = resolveIcon(item.icon)
@@ -799,6 +863,21 @@ export default function DashboardNav({ companyName: _companyName, entityType, pa
               )}
               aria-label={tNav('main_navigation')}
             >
+              {/* Byrå members inside a company: pinned route back to the
+                  cockpit, above everything, separated by a hairline. */}
+              {byraTeam && !cockpitMode && (
+                <div className="mb-2">
+                  <NavLink
+                    href="/clients"
+                    className="group flex items-center px-3 py-[7px] text-[13px] rounded-lg text-muted-foreground hover:text-foreground hover:bg-secondary/60 transition-colors duration-150"
+                  >
+                    <ArrowLeft className="mr-2.5 h-[15px] w-[15px] flex-shrink-0 text-muted-foreground group-hover:text-foreground" />
+                    <span className="flex-1">{tNav('back_to_clients')}</span>
+                  </NavLink>
+                  <div className="mx-3 mt-2 border-t border-border/60" />
+                </div>
+              )}
+
               {/* Top section: flat, no header. Hem, Assistent. */}
               <div className="mb-4 space-y-px">
                 {topItems.map((item) => renderSidebarItem(item))}
@@ -899,6 +978,7 @@ export default function DashboardNav({ companyName: _companyName, entityType, pa
                 userEmail={userEmail}
                 isSandbox={isSandbox}
                 collapsed={collapsed}
+                cockpitMode={cockpitMode}
                 onLogout={() => void handleLogout()}
               />
             </div>
@@ -906,8 +986,11 @@ export default function DashboardNav({ companyName: _companyName, entityType, pa
         </div>
       </aside>
 
-      {/* Mobile bottom navigation */}
-      <nav data-ph-unmask className="md:hidden fixed bottom-0 left-0 right-0 z-50 bg-card/98 backdrop-blur-sm border-t border-border/40" style={{ paddingBottom: 'env(safe-area-inset-bottom, 0px)' }} aria-label={tNav('mobile_navigation')}>
+      {/* Mobile bottom navigation. data-mobile-nav is the brand-style hook:
+          on branded hosts the brand style block re-tints the bar's tokens
+          (--card/--border/--primary...) to the deep chrome, mirroring the
+          sidebar; on default hosts the attribute matches nothing. */}
+      <nav data-mobile-nav="" data-ph-unmask className="md:hidden fixed bottom-0 left-0 right-0 z-50 bg-card/98 backdrop-blur-sm border-t border-border/40" style={{ paddingBottom: 'env(safe-area-inset-bottom, 0px)' }} aria-label={tNav('mobile_navigation')}>
         <div className="flex items-center justify-around h-16 px-2">
           {mobileNavItems.map((item) => {
             const active = isActive(item.href)
@@ -1013,6 +1096,20 @@ export default function DashboardNav({ companyName: _companyName, entityType, pa
                 CompanySwitcher above stays outside so it remains masked,
                 and count bubbles inside carry data-ph-mask. */}
             <div data-ph-unmask className="px-2">
+              {/* Byrå members inside a company: route back to the cockpit. */}
+              {byraTeam && !cockpitMode && (
+                <div className="mb-1.5">
+                  <NavLink
+                    href="/clients"
+                    onClick={closeMobileMenu}
+                    className="flex items-center gap-3 px-3 min-h-[44px] rounded-lg text-foreground active:bg-muted/60 transition-colors"
+                  >
+                    <ArrowLeft className="h-[18px] w-[18px] flex-shrink-0 text-muted-foreground" />
+                    <span className="text-sm flex-1">{tNav('back_to_clients')}</span>
+                  </NavLink>
+                  <div className="mx-3 mt-1.5 h-px bg-border/30" />
+                </div>
+              )}
               {/* Top items (Hem, Assistent) */}
               <div className="space-y-0.5">
                 {topItems.map((item) => {
@@ -1180,7 +1277,9 @@ export default function DashboardNav({ companyName: _companyName, entityType, pa
                     link; hides itself for sandbox and paying companies). */}
                 <SubscriptionTouchpoint variant="mobile" onNavigate={closeMobileMenu} />
                 {([
-                  { href: '/settings', labelKey: 'settings' as NavLabelKey, icon: Settings },
+                  // Cockpit: settings open in byrå scope (account-level
+                  // sections only), same as the desktop user menu.
+                  { href: cockpitMode ? '/settings/account?ctx=byra' : '/settings', labelKey: 'settings' as NavLabelKey, icon: Settings },
                   { href: '/help', labelKey: 'help' as NavLabelKey, icon: HelpCircle },
                 ]).map((item) => {
                   const Icon = item.icon
diff --git a/components/dashboard/HomeDomainSignpost.tsx b/components/dashboard/HomeDomainSignpost.tsx
new file mode 100644
index 00000000..2726bec8
--- /dev/null
+++ b/components/dashboard/HomeDomainSignpost.tsx
@@ -0,0 +1,103 @@
+'use client'
+
+import { useState } from 'react'
+import { useTranslations } from 'next-intl'
+import { ArrowUpRight, Building2, Loader2 } from 'lucide-react'
+import { performCompanySwitch } from '@/lib/company/switch-client'
+import { useToast } from '@/components/ui/use-toast'
+
+/**
+ * The home-domain signpost (WL-01): shown instead of the dashboard when the
+ * active company is homed on another domain. Never a silent redirect:
+ * sessions are per domain, so the user must log in again over there, and the
+ * signpost explains why. Companies homed HERE are offered as one-click
+ * switches; companies homed elsewhere link to their home domain.
+ */
+export default function HomeDomainSignpost({
+  activeCompanyName,
+  homedCompanies,
+  foreignCompanies,
+}: {
+  activeCompanyName: string
+  homedCompanies: Array<{ id: string; name: string }>
+  foreignCompanies: Array<{ id: string; name: string; domain: string }>
+}) {
+  const t = useTranslations('signpost')
+  const { toast } = useToast()
+  const [pendingId, setPendingId] = useState<string | null>(null)
+
+  const handleSwitch = async (companyId: string) => {
+    setPendingId(companyId)
+    const result = await performCompanySwitch(companyId, { destination: '/' })
+    if (result?.error) {
+      setPendingId(null)
+      toast({ title: t('switch_failed'), variant: 'destructive' })
+    }
+  }
+
+  return (
+    <div className="stagger-enter mx-auto max-w-lg pt-12">
+      <div className="flex flex-col items-center text-center">
+        <div className="mb-5 flex h-12 w-12 items-center justify-center rounded-xl bg-muted/60">
+          <Building2 className="h-5 w-5 text-muted-foreground" />
+        </div>
+        <h1 className="font-display text-2xl leading-8 tracking-tight">
+          {t('title')}
+        </h1>
+        <p className="mt-2 text-sm text-muted-foreground text-balance">
+          {t('body', { company: activeCompanyName })}
+        </p>
+      </div>
+
+      {foreignCompanies.length > 0 && (
+        <div className="mt-8">
+          <ul className="divide-y divide-border border-y border-border">
+            {foreignCompanies.map((entry) => (
+              <li key={entry.id}>
+                <a
+                  href={`https://${entry.domain}`}
+                  className="group flex items-center gap-3 px-1 py-3 transition-colors duration-150 hover:bg-secondary/35"
+                >
+                  <span className="min-w-0 flex-1 truncate text-[13px] text-foreground">
+                    {t('managed_via', { company: entry.name, domain: entry.domain })}
+                  </span>
+                  <ArrowUpRight className="h-4 w-4 flex-shrink-0 text-muted-foreground group-hover:text-foreground" />
+                </a>
+              </li>
+            ))}
+          </ul>
+          <p className="mt-2 text-xs text-muted-foreground">{t('login_hint')}</p>
+        </div>
+      )}
+
+      {homedCompanies.length > 0 && (
+        <div className="mt-10">
+          <h2 className="text-sm font-medium uppercase tracking-wider text-muted-foreground">
+            {t('homed_here')}
+          </h2>
+          <ul className="mt-2 divide-y divide-border border-y border-border">
+            {homedCompanies.map((entry) => (
+              <li key={entry.id}>
+                <button
+                  type="button"
+                  onClick={() => void handleSwitch(entry.id)}
+                  disabled={pendingId !== null}
+                  className="flex w-full items-center gap-3 px-1 py-3 text-left transition-colors duration-150 hover:bg-secondary/35 disabled:opacity-50"
+                >
+                  <span className="min-w-0 flex-1 truncate text-[13px] text-foreground">
+                    {entry.name}
+                  </span>
+                  {pendingId === entry.id ? (
+                    <Loader2 className="h-4 w-4 flex-shrink-0 animate-spin text-muted-foreground" />
+                  ) : (
+                    <span className="text-xs text-muted-foreground">{t('open_company')}</span>
+                  )}
+                </button>
+              </li>
+            ))}
+          </ul>
+        </div>
+      )}
+    </div>
+  )
+}
diff --git a/components/dashboard/NoticeLines.tsx b/components/dashboard/NoticeLines.tsx
index 94f3b8d5..4dcb6ff4 100644
--- a/components/dashboard/NoticeLines.tsx
+++ b/components/dashboard/NoticeLines.tsx
@@ -3,6 +3,7 @@
 import { useState } from 'react'
 import { useTranslations } from 'next-intl'
 import { AttnLine } from '@/components/ui/attn-line'
+import { useBranding } from '@/lib/branding/brand-context'
 import type { Notice, NoticeCategory } from '@/lib/notices/types'
 
 interface NoticeLinesProps {
@@ -26,6 +27,9 @@ interface NoticeLinesProps {
  */
 export default function NoticeLines({ notices, actionOverrides = {} }: NoticeLinesProps) {
   const t = useTranslations('notices')
+  // Brand-aware app name for messages that mention the platform (WL-12);
+  // identical to the default on unbranded hosts.
+  const { appName } = useBranding()
   const [expanded, setExpanded] = useState(false)
   const [hiddenIds, setHiddenIds] = useState<ReadonlySet<string>>(new Set())
 
@@ -81,7 +85,7 @@ export default function NoticeLines({ notices, actionOverrides = {} }: NoticeLin
               </>
             }
           >
-            {t(notice.messageKey, notice.messageParams)}
+            {t(notice.messageKey, { appName, ...notice.messageParams })}
           </AttnLine>
         )
       })}
diff --git a/components/dashboard/UserMenu.tsx b/components/dashboard/UserMenu.tsx
index dcc0edfb..e65c9337 100644
--- a/components/dashboard/UserMenu.tsx
+++ b/components/dashboard/UserMenu.tsx
@@ -44,6 +44,10 @@ interface UserMenuProps {
   userEmail: string | null
   isSandbox: boolean
   collapsed: boolean
+  // Byrå cockpit (lean sidebar): the cockpit is above the companies, so the
+  // widget shows no active company and no company-switcher flyout; entering
+  // a client happens through the Klienter list instead.
+  cockpitMode?: boolean
   onLogout: () => void
 }
 
@@ -82,9 +86,10 @@ export default function UserMenu({
   userEmail,
   isSandbox,
   collapsed,
+  cockpitMode = false,
   onLogout,
 }: UserMenuProps) {
-  const { company, companies, isSandbox: companyCtxSandbox } = useCompany()
+  const { company, companies, isSandbox: companyCtxSandbox, foreignCompanies = [] } = useCompany()
   const tNav = useTranslations('nav')
   const tCommon = useTranslations('common')
   const tSwitcher = useTranslations('company_switcher')
@@ -172,7 +177,9 @@ export default function UserMenu({
   }, [open, companiesOpen, close])
 
   const handleSwitch = async (companyId: string) => {
-    if (company && companyId === company.id) {
+    // In the cockpit nothing is "current": picking any company, including the
+    // technically-active one, must enter it (full navigation to its start).
+    if (!cockpitMode && company && companyId === company.id) {
       close()
       return
     }
@@ -220,7 +227,7 @@ export default function UserMenu({
               <span className="block truncate text-[13px] font-medium text-foreground leading-tight">
                 {userName?.trim() || userEmail || tNav('mitt_konto')}
               </span>
-              {company && (
+              {company && !cockpitMode && (
                 <span className="block truncate text-[11px] text-muted-foreground leading-tight">
                   {company.name}
                 </span>
@@ -251,7 +258,9 @@ export default function UserMenu({
               </div>
             )}
 
-            {/* Company switcher flyout */}
+            {/* Company switcher flyout. In the cockpit no company reads as
+                active (neutral label, no check mark); picking one enters it
+                like the Klienter list does. */}
             <div className="relative px-1 pt-1">
               <button
                 type="button"
@@ -261,7 +270,9 @@ export default function UserMenu({
               >
                 <CompanyMark name={company?.name || tSwitcher('default_company_name')} />
                 <span className="flex-1 truncate">
-                  {company?.name || tSwitcher('default_company_name')}
+                  {cockpitMode
+                    ? tSwitcher('choose_company')
+                    : company?.name || tSwitcher('default_company_name')}
                 </span>
                 <ChevronRight className="h-3.5 w-3.5 flex-shrink-0 opacity-50" />
               </button>
@@ -286,37 +297,61 @@ export default function UserMenu({
                         {tSwitcher('no_results')}
                       </p>
                     )}
-                    {filteredCompanies.map(({ company: c, role }) => (
-                      <button
-                        key={c.id}
-                        onClick={() => handleSwitch(c.id)}
-                        disabled={isPending}
-                        role="option"
-                        aria-selected={c.id === company?.id}
-                        className={cn(
-                          'flex w-full items-center gap-2 rounded-sm px-2.5 py-2 text-left text-[13px] leading-snug transition-colors',
-                          c.id === company?.id
-                            ? 'bg-secondary/60 text-foreground'
-                            : 'text-muted-foreground hover:bg-secondary/60 hover:text-foreground',
-                          isPending && 'opacity-50',
-                        )}
-                      >
-                        <CompanyMark name={c.name} />
-                        <span className="min-w-0 flex-1 truncate">{c.name}</span>
-                        {role !== 'owner' && (
-                          <span className="flex-shrink-0 text-[10px] text-muted-foreground/60">
-                            {role}
-                          </span>
-                        )}
-                        {c.id === company?.id && (
-                          <Check className="h-3.5 w-3.5 flex-shrink-0 text-primary" />
-                        )}
-                        {isPending && c.id !== company?.id && (
-                          <Loader2 className="h-3 w-3 flex-shrink-0 animate-spin text-muted-foreground" />
-                        )}
-                      </button>
-                    ))}
+                    {filteredCompanies.map(({ company: c, role }) => {
+                      const isCurrent = !cockpitMode && c.id === company?.id
+                      return (
+                        <button
+                          key={c.id}
+                          onClick={() => handleSwitch(c.id)}
+                          disabled={isPending}
+                          role="option"
+                          aria-selected={isCurrent}
+                          className={cn(
+                            'flex w-full items-center gap-2 rounded-sm px-2.5 py-2 text-left text-[13px] leading-snug transition-colors',
+                            isCurrent
+                              ? 'bg-secondary/60 text-foreground'
+                              : 'text-muted-foreground hover:bg-secondary/60 hover:text-foreground',
+                            isPending && 'opacity-50',
+                          )}
+                        >
+                          <CompanyMark name={c.name} />
+                          <span className="min-w-0 flex-1 truncate">{c.name}</span>
+                          {role !== 'owner' && (
+                            <span className="flex-shrink-0 text-[10px] text-muted-foreground/60">
+                              {role}
+                            </span>
+                          )}
+                          {isCurrent && (
+                            <Check className="h-3.5 w-3.5 flex-shrink-0 text-primary" />
+                          )}
+                          {isPending && !isCurrent && (
+                            <Loader2 className="h-3 w-3 flex-shrink-0 animate-spin text-muted-foreground" />
+                          )}
+                        </button>
+                      )
+                    })}
                   </div>
+                  {/* Companies homed on another domain (home-domain rule,
+                      WL-01): subtle, non-clickable signpost entries. */}
+                  {foreignCompanies.length > 0 && (
+                    <div className="border-t border-border/60 px-1 pt-1">
+                      <p className="px-2.5 pt-1 pb-0.5 text-[10px] font-semibold text-muted-foreground/60 uppercase tracking-[0.08em]">
+                        {tSwitcher('managed_elsewhere')}
+                      </p>
+                      {foreignCompanies.map((entry) => (
+                        <div
+                          key={entry.id}
+                          className="px-2.5 py-1.5 text-[12px] leading-snug text-muted-foreground/60"
+                          aria-disabled="true"
+                        >
+                          <span className="block truncate">{entry.name}</span>
+                          <span className="block truncate text-[10px]">
+                            {tSwitcher('managed_via', { domain: entry.domain })}
+                          </span>
+                        </div>
+                      ))}
+                    </div>
+                  )}
                   {!sandbox && (
                     <div className="border-t border-border/60 px-1 pt-1">
                       <Link href="/select-company?choose=1" onClick={close} className={menuRow}>
@@ -329,20 +364,32 @@ export default function UserMenu({
               )}
             </div>
 
-            {/* Account links */}
+            {/* Account links. From the cockpit, settings open in byrå scope
+                (?ctx=byra): account-level sections only; Abonnemang is
+                company-scoped and hidden there. */}
             <div className="px-1 pb-1">
-              <Link href="/settings" onClick={close} className={menuRow}>
+              <Link
+                href={cockpitMode ? '/settings/account?ctx=byra' : '/settings'}
+                onClick={close}
+                className={menuRow}
+              >
                 <Settings className="h-4 w-4 flex-shrink-0" />
                 {tNav('settings')}
               </Link>
-              <Link href="/settings/company#members" onClick={close} className={menuRow}>
+              <Link
+                href={cockpitMode ? '/settings/team?ctx=byra' : '/settings/company#members'}
+                onClick={close}
+                className={menuRow}
+              >
                 <Users className="h-4 w-4 flex-shrink-0" />
                 {tNav('members_roles')}
               </Link>
-              <Link href="/settings/billing" onClick={close} className={menuRow}>
-                <CreditCard className="h-4 w-4 flex-shrink-0" />
-                {tNav('subscription')}
-              </Link>
+              {!cockpitMode && (
+                <Link href="/settings/billing" onClick={close} className={menuRow}>
+                  <CreditCard className="h-4 w-4 flex-shrink-0" />
+                  {tNav('subscription')}
+                </Link>
+              )}
               <div className="my-1 border-t border-border/60" />
               <Link href="/help" onClick={close} className={menuRow}>
                 <HelpCircle className="h-4 w-4 flex-shrink-0" />
diff --git a/components/extensions/general/CalendarWorkspace.tsx b/components/extensions/general/CalendarWorkspace.tsx
index dedf117e..0fa865cc 100644
--- a/components/extensions/general/CalendarWorkspace.tsx
+++ b/components/extensions/general/CalendarWorkspace.tsx
@@ -2,6 +2,7 @@
 
 import { useState, useEffect, useCallback } from 'react'
 import { createClient } from '@/lib/supabase/client'
+import { guardBrowserWrite } from '@/lib/company/tab-guard'
 import { useToast } from '@/components/ui/use-toast'
 import { PaymentCalendar } from '@/extensions/general/calendar/components/PaymentCalendar'
 import type { DeadlineFormValues } from '@/components/deadlines/DeadlineForm'
@@ -62,6 +63,9 @@ export default function CalendarWorkspace({ userId }: WorkspaceComponentProps) {
   }, [fetchData])
 
   const handleDeadlineCreate = async (data: DeadlineFormValues) => {
+    // Cross-tab guard (WL-09): browser-direct Supabase write, outside the
+    // patched-fetch seam. The blocking dialog is the user feedback.
+    if (!guardBrowserWrite()) return
     try {
       const { error } = await supabase.from('deadlines').insert([data])
 
@@ -83,6 +87,7 @@ export default function CalendarWorkspace({ userId }: WorkspaceComponentProps) {
   }
 
   const handleDeadlineToggle = async (deadline: Deadline) => {
+    if (!guardBrowserWrite()) return
     try {
       const { error } = await supabase
         .from('deadlines')
diff --git a/components/extensions/general/InboxCustomDomainDialog.tsx b/components/extensions/general/InboxCustomDomainDialog.tsx
index d5061eeb..43282245 100644
--- a/components/extensions/general/InboxCustomDomainDialog.tsx
+++ b/components/extensions/general/InboxCustomDomainDialog.tsx
@@ -20,6 +20,7 @@ import { getErrorMessage as getUserErrorMessage, type ErrorLocale } from '@/lib/
 import { useFormat } from '@/lib/hooks/use-format'
 import { useCompany } from '@/contexts/CompanyContext'
 import { copyToClipboard } from '@/lib/browser/copy-to-clipboard'
+import { useBranding } from '@/lib/branding/brand-context'
 
 const BASE = '/api/extensions/ext/invoice-inbox/inbox/domain'
 
@@ -43,6 +44,7 @@ interface Props {
 // server-side: this surface only manages the claim lifecycle.
 export default function InboxCustomDomainDialog({ open, onOpenChange }: Props) {
   const { toast } = useToast()
+  const { appName } = useBranding()
   const t = useTranslations('inbox_custom_domain')
   const { locale, formatDateLong } = useFormat()
   const errorLocale = locale as ErrorLocale
@@ -131,7 +133,7 @@ export default function InboxCustomDomainDialog({ open, onOpenChange }: Props) {
 
   const handleRemove = useCallback(async () => {
     if (!domain) return
-    if (!confirm(t('remove_confirm', { domain: domain.domain }))) return
+    if (!confirm(t('remove_confirm', { domain: domain.domain, appName }))) return
     setIsRemoving(true)
     try {
       const res = await fetch(BASE, { method: 'DELETE' })
@@ -148,7 +150,7 @@ export default function InboxCustomDomainDialog({ open, onOpenChange }: Props) {
     } finally {
       setIsRemoving(false)
     }
-  }, [domain, errorLocale, t, toast])
+  }, [domain, errorLocale, t, toast, appName])
 
   const handleCopy = useCallback(
     async (value: string) => {
@@ -208,7 +210,7 @@ export default function InboxCustomDomainDialog({ open, onOpenChange }: Props) {
               <div className="space-y-1">
                 <p className="font-medium">{t('warning_title')}</p>
                 <p className="text-muted-foreground">
-                  {t('warning_before_subdomain')}{' '}
+                  {t('warning_before_subdomain', { appName })}{' '}
                   <code className="font-mono text-xs">faktura.dittbolag.se</code>{' '}
                   {t('warning_after_subdomain')}
                 </p>
diff --git a/components/extensions/general/InvoiceInboxWorkspace.tsx b/components/extensions/general/InvoiceInboxWorkspace.tsx
index c3580bda..bb578f22 100644
--- a/components/extensions/general/InvoiceInboxWorkspace.tsx
+++ b/components/extensions/general/InvoiceInboxWorkspace.tsx
@@ -60,6 +60,7 @@ import { fetchWithTimeout } from '@/lib/http/fetch-with-timeout'
 import { copyInboxAddress, type AddressCopyState } from '@/components/extensions/general/inbox-address-copy'
 import { useCapability, useCompanyOptional } from '@/contexts/CompanyContext'
 import { CAPABILITY } from '@/lib/entitlements/keys'
+import { useBranding } from '@/lib/branding/brand-context'
 import type { WorkspaceComponentProps } from '@/lib/extensions/workspace-registry'
 import type { InboxChannelContext, InvoiceExtractionResult, InboxItemSource } from '@/types'
 import { renderChannelParticipant } from '@/lib/documents/channel-context-notes'
@@ -2688,6 +2689,7 @@ function FieldsRail({
 }) {
   const { toast } = useToast()
   const hasAi = useCapability(CAPABILITY.ai)
+  const { appName } = useBranding()
   const data = item.extracted_data
   const [proposal, setProposal] = useState<SuggestedBooking | null>(null)
   const [editOpen, setEditOpen] = useState(false)
@@ -3047,7 +3049,7 @@ function FieldsRail({
               AI-tolkning ingår i abonnemanget
             </div>
             <p className="text-xs text-muted-foreground mt-1.5 leading-relaxed">
-              Uppgradera för att låta Accounted läsa av leverantör, belopp och
+              Uppgradera för att låta {appName} läsa av leverantör, belopp och
               moms automatiskt. Du kan fortfarande fylla i fälten manuellt eller
               koppla dokumentet till en transaktion nedan.
             </p>
diff --git a/components/invoices/InvoiceDeliveryHistory.tsx b/components/invoices/InvoiceDeliveryHistory.tsx
index 52bcee5c..39f5854c 100644
--- a/components/invoices/InvoiceDeliveryHistory.tsx
+++ b/components/invoices/InvoiceDeliveryHistory.tsx
@@ -5,6 +5,7 @@ import { ChevronRight, ExternalLink } from 'lucide-react'
 import { Badge } from '@/components/ui/badge'
 import { DetailSection } from '@/components/ui/detail-section'
 import { HelpPopover } from '@/components/ui/help-popover'
+import { useBranding } from '@/lib/branding/brand-context'
 import type { InvoiceDelivery, InvoiceDeliveryProviderStatus } from '@/types'
 
 export type InvoiceDeliveryView = Pick<
@@ -68,6 +69,7 @@ export function InvoiceDeliveryHistory({
 }: InvoiceDeliveryHistoryProps) {
   const t = useTranslations('invoice_detail')
   const format = useFormatter()
+  const { appName } = useBranding()
 
   if (deliveries.length === 0 && !showLegacyEmptyState) return null
 
@@ -133,7 +135,7 @@ export function InvoiceDeliveryHistory({
                 <div className="pb-4 pl-6 pt-1">
                   {isManual ? (
                     <p className="text-sm text-muted-foreground">
-                      {t('delivery_manual_unknown_details')}
+                      {t('delivery_manual_unknown_details', { appName })}
                     </p>
                   ) : (
                     <dl className="grid gap-x-6 gap-y-1 text-sm sm:grid-cols-[8rem_minmax(0,1fr)]">
diff --git a/components/invoices/InvoiceEditor.tsx b/components/invoices/InvoiceEditor.tsx
index ce873a2c..eae5fa17 100644
--- a/components/invoices/InvoiceEditor.tsx
+++ b/components/invoices/InvoiceEditor.tsx
@@ -50,6 +50,7 @@ import {
   DropdownMenuSeparator,
 } from '@/components/ui/dropdown-menu'
 import { useCanWrite } from '@/lib/hooks/use-can-write'
+import { useBranding } from '@/lib/branding/brand-context'
 import { ConfirmationDialog } from '@/components/ui/confirmation-dialog'
 import { InvoiceReviewContent } from '@/components/invoices/InvoiceReviewContent'
 import { getErrorMessage } from '@/lib/errors/get-error-message'
@@ -178,6 +179,7 @@ export default function InvoiceEditor(props: InvoiceEditorProps = { mode: 'creat
   const ts = useTranslations('self_billing')
   const ta = useTranslations('accruals')
   const tCommon = useTranslations('common')
+  const { appName } = useBranding()
   // Normal customer invoice (default) or a received self-billing invoice
   // (mottagen självfaktura, ML 17 kap 15§). The mode is chosen upstream in
   // the Ny faktura split button (?self=1) and is fixed for the editor's
@@ -1780,7 +1782,7 @@ export default function InvoiceEditor(props: InvoiceEditorProps = { mode: 'creat
         window.URL.revokeObjectURL(url)
         toast({
           title: t('preview_pdf_failed'),
-          description: tCommon('popup_blocked_description'),
+          description: tCommon('popup_blocked_description', { appName }),
           variant: 'destructive',
         })
         return
diff --git a/components/onboarding/journey/OnboardingJourney.tsx b/components/onboarding/journey/OnboardingJourney.tsx
index cb3f7a4c..9841ad72 100644
--- a/components/onboarding/journey/OnboardingJourney.tsx
+++ b/components/onboarding/journey/OnboardingJourney.tsx
@@ -11,6 +11,7 @@ import { parseStartMonthDay } from '@/lib/company/first-year-defaults'
 import { fetchCompanyLookup } from '@/lib/company-lookup/fetch-company-lookup'
 import { normalizeOrgNumber } from '@/lib/company-lookup/normalize-org-number'
 import { ENABLED_EXTENSION_IDS } from '@/lib/extensions/_generated/enabled-extensions'
+import { useBranding } from '@/lib/branding/brand-context'
 import posthog from 'posthog-js'
 import { isAnalyticsEnabled } from '@/lib/analytics/enabled'
 import {
@@ -98,6 +99,7 @@ export default function OnboardingJourney({
 }: OnboardingJourneyProps) {
   const router = useRouter()
   const t = useTranslations('onboarding')
+  const { appName } = useBranding()
   const locale = useLocale()
   const ticEnabled = ENABLED_EXTENSION_IDS.has('tic')
 
@@ -704,7 +706,7 @@ export default function OnboardingJourney({
       <div className="jny-dawn" aria-hidden="true" />
       {mode === 'add' && state.step !== 'done' ? (
         <Link href="/" className="jny-btn-quiet jny-escape">
-          &lsaquo; {t('journey_cancel_add')}
+          &lsaquo; {t('journey_cancel_add', { appName })}
         </Link>
       ) : null}
       <div className="jny-center">
@@ -749,7 +751,7 @@ export default function OnboardingJourney({
                 {dupName && station === 0 ? (
                   <span className="jny-f is-on" style={{ transitionDelay: `${lookupFacts.length * 150}ms` }}>
                     {lookupFacts.length > 0 ? ' · ' : ''}
-                    {t('journey_dup_note', { name: dupName })}
+                    {t('journey_dup_note', { name: dupName, appName })}
                   </span>
                 ) : null}
                 {!dupName && dupElsewhere && station === 0 ? (
@@ -759,7 +761,7 @@ export default function OnboardingJourney({
                   // more specific hint.
                   <span className="jny-f is-on is-warn" style={{ transitionDelay: `${lookupFacts.length * 150}ms` }}>
                     {lookupFacts.length > 0 ? ' · ' : ''}
-                    {t('journey_dup_elsewhere_note')}
+                    {t('journey_dup_elsewhere_note', { appName })}
                   </span>
                 ) : null}
               </div>
@@ -1030,6 +1032,7 @@ function DoneStep({
   onOpen: () => void
   onContinue: () => void
 }) {
+  const { appName } = useBranding()
   const s = state.settings
   const shortName = (s.company_name ?? '').split(' ')[0] || ''
   const rows: [string, string][] = [
@@ -1089,7 +1092,7 @@ function DoneStep({
       ) : (
         <div className="jny-qactions">
           <button type="button" className="jny-btn" onClick={onOpen}>
-            {t('journey_open_app')}
+            {t('journey_open_app', { appName })}
           </button>
         </div>
       )}
diff --git a/components/salary/OpeningBalancesPanel.tsx b/components/salary/OpeningBalancesPanel.tsx
index 22685f95..19d60a00 100644
--- a/components/salary/OpeningBalancesPanel.tsx
+++ b/components/salary/OpeningBalancesPanel.tsx
@@ -20,6 +20,7 @@ import { Skeleton } from '@/components/ui/skeleton'
 import { SettingsGroup, SettingsInput, SettingsRow } from '@/components/settings/SettingsRows'
 import { useToast } from '@/components/ui/use-toast'
 import { getErrorMessage } from '@/lib/errors/get-error-message'
+import { useBranding } from '@/lib/branding/brand-context'
 
 interface OpeningBalancesData {
   cutover_date: string
@@ -70,6 +71,7 @@ function fingerprint(v: PanelValues): string {
 
 export function OpeningBalancesPanel({ employeeId, canWrite }: { employeeId: string; canWrite: boolean }) {
   const t = useTranslations('salary_employee')
+  const { appName } = useBranding()
   const { toast } = useToast()
   const [loading, setLoading] = useState(true)
   const [saving, setSaving] = useState(false)
@@ -234,7 +236,7 @@ export function OpeningBalancesPanel({ employeeId, canWrite }: { employeeId: str
     >
       <DetailSection
         kicker={t('opening_balances_title')}
-        help={<HelpPopover>{t('opening_balances_description')}</HelpPopover>}
+        help={<HelpPopover>{t('opening_balances_description', { appName })}</HelpPopover>}
         aside={
           <Button
             type="button"
@@ -263,7 +265,7 @@ export function OpeningBalancesPanel({ employeeId, canWrite }: { employeeId: str
         <SettingsRow
           label={t('opening_balances_cutover_date')}
           htmlFor="ob-cutover"
-          help={t('opening_balances_cutover_hint')}
+          help={t('opening_balances_cutover_hint', { appName })}
           align="baseline"
         >
           <SettingsInput
diff --git a/components/settings/ActiveCompanyBadge.tsx b/components/settings/ActiveCompanyBadge.tsx
index b9322565..170dd8ac 100644
--- a/components/settings/ActiveCompanyBadge.tsx
+++ b/components/settings/ActiveCompanyBadge.tsx
@@ -5,18 +5,24 @@ import { useTranslations } from 'next-intl'
 import { cn } from '@/lib/utils'
 import { useCompany } from '@/contexts/CompanyContext'
 import { Badge } from '@/components/ui/badge'
+import { useByraSettingsScope } from './useSettingsNavItems'
 
 /**
  * Quiet chip naming the active company. Settings surfaces (the routed modal
  * and the full-page fallback) cover or dim the sidebar's CompanySwitcher, so
  * without this the user edits company-scoped settings with no visible answer
  * to "which company am I on?" (support feedback 2026-07-19).
+ *
+ * Byrå scope (?ctx=byra): no chip. The cockpit sits above the companies and
+ * only account-level sections show, so naming a technically-active client
+ * here would read as "you are inside this company" (mirrors SettingsModal).
  */
 export function ActiveCompanyBadge({ className }: { className?: string }) {
   const { company } = useCompany()
+  const byraScope = useByraSettingsScope()
   const t = useTranslations('common')
 
-  if (!company) return null
+  if (!company || byraScope) return null
 
   return (
     <Badge
diff --git a/components/settings/InstallAppSection.tsx b/components/settings/InstallAppSection.tsx
index db341534..0d1507d8 100644
--- a/components/settings/InstallAppSection.tsx
+++ b/components/settings/InstallAppSection.tsx
@@ -9,6 +9,7 @@ import {
   SettingsRowEnd,
   SettingsRowNote,
 } from '@/components/settings/SettingsRows'
+import { useBranding } from '@/lib/branding/brand-context'
 
 type BeforeInstallPromptEvent = Event & {
   prompt: () => Promise<void>
@@ -38,6 +39,7 @@ function getIsStandalone() {
  */
 export function InstallAppSection() {
   const t = useTranslations('settings')
+  const { appName } = useBranding()
   // Server snapshot says standalone so the row is absent from server HTML
   // and only appears client-side when actually running in a browser tab.
   const isStandalone = useSyncExternalStore(subscribeDisplayMode, getIsStandalone, () => true)
@@ -74,13 +76,13 @@ export function InstallAppSection() {
   const isIos = /iPad|iPhone|iPod/.test(ua)
   const isSafari = /Safari/.test(ua) && !/Chrome|Chromium|Edg|CriOS/.test(ua)
   const hint = isIos
-    ? t('install_app_hint_ios')
+    ? t('install_app_hint_ios', { appName })
     : isSafari
-      ? t('install_app_hint_safari')
-      : t('install_app_hint_generic')
+      ? t('install_app_hint_safari', { appName })
+      : t('install_app_hint_generic', { appName })
 
   return (
-    <SettingsRow label={t('install_app_title')} help={t('install_app_description')}>
+    <SettingsRow label={t('install_app_title')} help={t('install_app_description', { appName })}>
       {installPrompt ? (
         <SettingsRowEnd>
           <Button variant="outline" size="sm" onClick={handleInstall}>
diff --git a/components/settings/SettingsModal.tsx b/components/settings/SettingsModal.tsx
index 4c0f4912..8daa8e51 100644
--- a/components/settings/SettingsModal.tsx
+++ b/components/settings/SettingsModal.tsx
@@ -11,6 +11,7 @@ import {
 } from '@/components/ui/dialog'
 import { SETTINGS_SECTIONS } from './sections'
 import { SettingsShell } from './SettingsShell'
+import { useByraSettingsScope } from './useSettingsNavItems'
 
 /**
  * The settings popup. Rendered only by the intercepting route
@@ -34,11 +35,15 @@ export function SettingsModal({ sectionId }: { sectionId?: string }) {
   // sectionId route param only covers the very first intercepted render.
   // Bare /settings (or an unknown section) defaults to company, or to account
   // when there is no active company (the no-company escape hatch).
+  // Byrå scope (?ctx=byra, settings opened from the cockpit): account-level
+  // sections only, no company kicker, and the fallback section is Konto: the
+  // cockpit is above the companies, so no company may read as "the" company.
+  const byraScope = useByraSettingsScope()
   const urlSection = pathname.split('/')[2] ?? sectionId
   const resolved =
     urlSection && SETTINGS_SECTIONS[urlSection]
       ? urlSection
-      : company
+      : company && !byraScope
         ? 'company'
         : 'account'
 
@@ -67,8 +72,9 @@ export function SettingsModal({ sectionId }: { sectionId?: string }) {
         <div className="flex shrink-0 items-center gap-3 border-b border-border px-6 py-3">
           <div className="min-w-0">
             {/* The modal covers the sidebar's CompanySwitcher, so the active
-                company must stay visible here as the kicker over the title. */}
-            {company ? (
+                company must stay visible here as the kicker over the title.
+                Not in byrå scope: the cockpit has no active company. */}
+            {company && !byraScope ? (
               <p className="truncate text-xs text-muted-foreground">{company.name}</p>
             ) : null}
             <DialogTitle className="font-display text-lg tracking-tight">
diff --git a/components/settings/SettingsRail.tsx b/components/settings/SettingsRail.tsx
index 1052d705..9964219a 100644
--- a/components/settings/SettingsRail.tsx
+++ b/components/settings/SettingsRail.tsx
@@ -1,7 +1,7 @@
 'use client'
 
 import Link from 'next/link'
-import { usePathname, useRouter } from 'next/navigation'
+import { usePathname, useRouter, useSearchParams } from 'next/navigation'
 import { useTranslations } from 'next-intl'
 import { cn } from '@/lib/utils'
 import {
@@ -32,6 +32,7 @@ interface SettingsRailProps {
 export function SettingsRail({ variant, display, activeId }: SettingsRailProps) {
   const router = useRouter()
   const pathname = usePathname()
+  const searchParams = useSearchParams()
   const t = useTranslations('settings_nav')
   const { items, groups } = useSettingsNavItems()
 
@@ -40,11 +41,16 @@ export function SettingsRail({ variant, display, activeId }: SettingsRailProps)
     items.find((i) => pathname.startsWith(i.href))?.id ??
     items[0]?.id
 
+  // Byrå settings scope travels as ?ctx=byra: section switches must carry it
+  // along or the rail would snap back to the full company section list.
+  const withCtx = (href: string) =>
+    searchParams.get('ctx') === 'byra' ? `${href}?ctx=byra` : href
+
   function navigate(href: string) {
     // Shallow update: Next syncs usePathname() from the native History API,
     // so SettingsModal re-resolves the section without a route transition.
-    if (variant === 'modal') window.history.replaceState(null, '', href)
-    else router.push(href)
+    if (variant === 'modal') window.history.replaceState(null, '', withCtx(href))
+    else router.push(withCtx(href))
   }
 
   if (display === 'select') {
@@ -100,7 +106,7 @@ export function SettingsRail({ variant, display, activeId }: SettingsRailProps)
                     </button>
                   ) : (
                     <Link
-                      href={i.href}
+                      href={withCtx(i.href)}
                       aria-current={isActive ? 'page' : undefined}
                       className={rowClass}
                     >
diff --git a/components/settings/SettingsRows.tsx b/components/settings/SettingsRows.tsx
index e9040d05..21ebb177 100644
--- a/components/settings/SettingsRows.tsx
+++ b/components/settings/SettingsRows.tsx
@@ -1,8 +1,17 @@
 'use client'
 
-import { ChevronDown } from 'lucide-react'
+import { Children, isValidElement, useRef, useState } from 'react'
 import { cn } from '@/lib/utils'
 import { HelpPopover } from '@/components/ui/help-popover'
+import {
+  Select,
+  SelectContent,
+  SelectGroup,
+  SelectItem,
+  SelectLabel,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
 
 /**
  * The Fönster settings language (founder-approved concept 2026-07-25):
@@ -168,30 +177,176 @@ export function SettingsTextarea({ className, ...rest }: React.TextareaHTMLAttri
   )
 }
 
-/** Flat native select with a quiet chevron. */
+/**
+ * Flat select with a styled popup. Keeps the native-select prop surface so
+ * call sites read like a <select> (value/defaultValue, onChange with
+ * e.target.value, <option> children, `name` for the wrapper's FormData read)
+ * but renders through Radix Select: the native listbox popup cannot be
+ * styled and clashes with the panel (same call as TeamPanel's role
+ * dropdowns). The trigger keeps the quiet dashed-underline look.
+ */
+const SETTINGS_SELECT_TRIGGER_CLASS =
+  'h-auto w-auto max-w-full shrink-0 cursor-pointer gap-1.5 rounded-none border-0 border-b border-dashed border-transparent bg-transparent px-0 py-1 text-sm text-foreground ' +
+  'hover:border-border focus:border-solid focus:border-foreground/50 focus:ring-0 disabled:cursor-not-allowed disabled:opacity-60'
+
+// Radix Select refuses empty-string item values; settings selects use '' for
+// placeholder-shaped options ("Ingen", "Lägg till valuta"), so '' maps onto a
+// sentinel at the Radix boundary and back at the native-shaped one.
+const SETTINGS_SELECT_EMPTY = '__settings-select-empty__'
+const toRadixValue = (value: string) => (value === '' ? SETTINGS_SELECT_EMPTY : value)
+const fromRadixValue = (value: string) => (value === SETTINGS_SELECT_EMPTY ? '' : value)
+
+interface SettingsSelectOption {
+  value: string
+  label: React.ReactNode
+  disabled: boolean
+}
+
+type SettingsSelectEntry =
+  | { kind: 'option'; option: SettingsSelectOption }
+  | { kind: 'group'; label: React.ReactNode; options: SettingsSelectOption[] }
+
+function collectSelectOptions(children: React.ReactNode): SettingsSelectOption[] {
+  return collectSelectEntries(children).flatMap((entry) =>
+    entry.kind === 'group' ? entry.options : [entry.option],
+  )
+}
+
+/**
+ * Walks native-shaped select children. <option>s become option entries;
+ * <optgroup>s become group entries that keep their label (rendered as a
+ * non-interactive header row in the popup, e.g. the ROT/RUT work-type
+ * groups in ArticleForm); fragments/arrays are flattened transparently.
+ */
+function collectSelectEntries(children: React.ReactNode): SettingsSelectEntry[] {
+  const entries: SettingsSelectEntry[] = []
+  Children.forEach(children, (child) => {
+    if (!isValidElement(child)) return
+    if (child.type === 'option') {
+      const props = child.props as React.OptionHTMLAttributes<HTMLOptionElement>
+      entries.push({
+        kind: 'option',
+        option: {
+          value: String(props.value ?? ''),
+          label: props.children,
+          disabled: !!props.disabled,
+        },
+      })
+      return
+    }
+    if (child.type === 'optgroup') {
+      const props = child.props as React.OptgroupHTMLAttributes<HTMLOptGroupElement>
+      entries.push({
+        kind: 'group',
+        label: props.label,
+        options: collectSelectOptions(props.children),
+      })
+      return
+    }
+    // Fragments / arrays of options: flatten.
+    entries.push(
+      ...collectSelectEntries((child.props as { children?: React.ReactNode }).children),
+    )
+  })
+  return entries
+}
+
 export function SettingsSelect({
   className,
   wrapperClassName,
   children,
-  ...rest
+  id,
+  name,
+  value,
+  defaultValue,
+  disabled,
+  onChange,
+  onInput,
+  'aria-label': ariaLabel,
 }: React.SelectHTMLAttributes<HTMLSelectElement> & { wrapperClassName?: string }) {
+  const entries = collectSelectEntries(children)
+  const options = entries.flatMap((entry) =>
+    entry.kind === 'group' ? entry.options : [entry.option],
+  )
+  const isControlled = value !== undefined
+  // Uncontrolled fallback mirrors the native select: defaultValue if given,
+  // else the first option.
+  const [internalValue, setInternalValue] = useState<string>(() =>
+    defaultValue !== undefined ? String(defaultValue) : (options[0]?.value ?? ''),
+  )
+  const hiddenInputRef = useRef<HTMLInputElement>(null)
+  const currentValue = isControlled ? String(value) : internalValue
+
+  const handleValueChange = (encoded: string) => {
+    const next = fromRadixValue(encoded)
+    if (!isControlled) setInternalValue(next)
+    // SettingsFormWrapper tracks dirtiness via bubbling input events; the
+    // Radix trigger is a button and fires none, so raise the event from the
+    // hidden input. Call sites that opt out of dirty tracking pass an
+    // onInput stopPropagation handler, which attaches there and still
+    // intercepts.
+    hiddenInputRef.current?.dispatchEvent(new Event('input', { bubbles: true }))
+    onChange?.({ target: { value: next } } as unknown as React.ChangeEvent<HTMLSelectElement>)
+  }
+
   return (
     <span className={cn('relative inline-flex max-w-full items-center', wrapperClassName)}>
-      <select
-        {...rest}
-        className={cn(
-          'max-w-full cursor-pointer appearance-none truncate rounded-none border-0 border-b border-dashed border-transparent bg-transparent py-1 pl-0 pr-6 text-sm text-foreground',
-          'hover:border-border focus:outline-none focus-visible:border-solid focus-visible:border-foreground/50',
-          'disabled:cursor-not-allowed disabled:opacity-60',
-          className,
-        )}
-      >
-        {children}
-      </select>
-      <ChevronDown
-        aria-hidden="true"
-        className="pointer-events-none absolute right-1 h-3.5 w-3.5 text-muted-foreground"
+      {/* Carries `name` into the wrapper's FormData and hosts the dirty-
+          tracking input event; type="hidden" keeps it out of the tab order. */}
+      <input
+        ref={hiddenInputRef}
+        type="hidden"
+        name={name}
+        value={currentValue}
+        onInput={onInput as unknown as React.FormEventHandler<HTMLInputElement>}
+        readOnly
       />
+      <Select
+        value={toRadixValue(currentValue)}
+        onValueChange={handleValueChange}
+        disabled={disabled}
+      >
+        <SelectTrigger
+          id={id}
+          aria-label={ariaLabel}
+          className={cn(SETTINGS_SELECT_TRIGGER_CLASS, className)}
+        >
+          <SelectValue />
+        </SelectTrigger>
+        <SelectContent align="start">
+          {entries.map((entry, index) =>
+            entry.kind === 'group' ? (
+              /* Radix Label rows are not Items: arrow-key navigation and
+                 typeahead skip them; they render as muted eyebrow headers. */
+              <SelectGroup key={`group-${index}`}>
+                <SelectLabel
+                  data-ph-unmask=""
+                  className="text-[11px] uppercase tracking-wider"
+                >
+                  {entry.label}
+                </SelectLabel>
+                {entry.options.map((option) => (
+                  <SelectItem
+                    key={option.value}
+                    value={toRadixValue(option.value)}
+                    disabled={option.disabled}
+                  >
+                    {option.label}
+                  </SelectItem>
+                ))}
+              </SelectGroup>
+            ) : (
+              <SelectItem
+                key={entry.option.value}
+                value={toRadixValue(entry.option.value)}
+                disabled={entry.option.disabled}
+              >
+                {entry.option.label}
+              </SelectItem>
+            ),
+          )}
+        </SelectContent>
+      </Select>
     </span>
   )
 }
diff --git a/components/settings/SkatteverketConnectPanel.tsx b/components/settings/SkatteverketConnectPanel.tsx
index 90c2b279..d9781293 100644
--- a/components/settings/SkatteverketConnectPanel.tsx
+++ b/components/settings/SkatteverketConnectPanel.tsx
@@ -18,6 +18,7 @@ import {
 } from '@/components/settings/SettingsRows'
 import { CheckCircle2, ExternalLink, Loader2, ShieldOff, FlaskConical, ShieldAlert } from 'lucide-react'
 import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'
+import { useBranding } from '@/lib/branding/brand-context'
 
 type Environment = 'test' | 'prod'
 
@@ -442,6 +443,7 @@ interface SystemConnectionState {
  */
 function SkatteverketSystemConnectionCard() {
   const t = useTranslations('settings_skatteverket_connect')
+  const { appName } = useBranding()
   const { toast } = useToast()
   const [state, setState] = useState<SystemConnectionState | null>(null)
   const [verifying, setVerifying] = useState(false)
@@ -511,7 +513,7 @@ function SkatteverketSystemConnectionCard() {
   }
 
   return (
-    <SettingsGroup label={t('system_title')} help={t('system_intro')}>
+    <SettingsGroup label={t('system_title')} help={t('system_intro', { appName })}>
       {state.ombud_org_number && (
         <SettingsRow label={t('system_org_label')}>
           <span className="font-mono text-sm tabular-nums">{state.ombud_org_number}</span>
@@ -527,7 +529,7 @@ function SkatteverketSystemConnectionCard() {
 
       {state.cert?.expiresSoon && (
         <WarningLine>
-          {t('system_cert_expires_soon', { days: state.cert.daysUntilExpiry })}
+          {t('system_cert_expires_soon', { days: state.cert.daysUntilExpiry, appName })}
         </WarningLine>
       )}
 
diff --git a/components/settings/TeamPanel.tsx b/components/settings/TeamPanel.tsx
index a17ff676..adf07da5 100644
--- a/components/settings/TeamPanel.tsx
+++ b/components/settings/TeamPanel.tsx
@@ -1,12 +1,34 @@
 'use client'
 
 import { useLocale, useTranslations } from 'next-intl'
-import { useState, useEffect } from 'react'
-import { Loader2 } from 'lucide-react'
+import { useState, useEffect, useCallback } from 'react'
+import { Loader2, Mail, Plus, RefreshCw, Trash2 } from 'lucide-react'
 import { AttnLine } from '@/components/ui/attn-line'
-import { SettingsGroup } from '@/components/settings/SettingsRows'
+import { Button } from '@/components/ui/button'
+import { ConfirmDialog } from '@/components/ui/confirm-dialog'
+import { useToast } from '@/components/ui/use-toast'
+import {
+  SettingsGroup,
+  SettingsInput,
+} from '@/components/settings/SettingsRows'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
 import { parseTeamMembersPayload } from '@/components/settings/members-payload'
 import { getErrorMessage, type ErrorLocale } from '@/lib/errors/get-error-message'
+import { cn, formatDateLong } from '@/lib/utils'
+
+// Role dropdowns use the Radix Select for its styled popup (the native
+// <select> list cannot be styled and clashes with the panel), but the
+// TRIGGER keeps the flat quiet SettingsSelect look: borderless, dashed
+// underline on hover, no box. Shared by the member rows and the invite form.
+const ROLE_TRIGGER_CLASS =
+  'h-auto w-auto shrink-0 gap-1.5 rounded-none border-0 border-b border-dashed border-transparent bg-transparent px-0 py-1 text-sm ' +
+  'hover:border-border focus:border-solid focus:border-foreground/50 focus:ring-0'
 
 interface TeamMember {
   id: string
@@ -17,19 +39,64 @@ interface TeamMember {
   is_current_user: boolean
 }
 
+interface TeamInvitation {
+  id: string
+  email: string
+  role: string
+  status: string
+  created_at: string
+  expires_at: string
+}
+
+/**
+ * The shareable accept link from the latest invite create/re-send response.
+ * Raw tokens are never stored server-side (only their hash), so the link
+ * exists exactly once: here, until the next navigation. It is kept visible
+ * so a failed mail send never dead-ends the inviter (the Arbore case: the
+ * invitation quietly waits for a mail that never arrives).
+ */
+interface ShareableInvite {
+  email: string
+  url: string
+  sent: boolean
+}
+
+/**
+ * Team roster panel. Read-only for personal teams (exactly the pre-WL-08
+ * rendering); on a byrå team where the caller may manage members
+ * (canInvite = owner/admin), the same flat rows gain a role select and a
+ * remove action (confirm-up-front), plus the pending-invitations list with
+ * revoke and an inline invite form (WL-08 invite unfreeze, gap 2).
+ */
 export function TeamPanel() {
   const t = useTranslations('settings_team_panel')
   const errorLocale = useLocale() as ErrorLocale
+  const { toast } = useToast()
   // null = the roster is not known: still loading, or the read failed
   // (loadError). A failed read must never render an apparently member-less
   // team; the empty look is reserved for a confirmed empty read.
   const [members, setMembers] = useState<TeamMember[] | null>(null)
+  const [invitations, setInvitations] = useState<TeamInvitation[]>([])
   const [teamName, setTeamName] = useState('')
+  const [teamId, setTeamId] = useState<string | null>(null)
+  const [isOwner, setIsOwner] = useState(false)
+  const [canManage, setCanManage] = useState(false)
   // detail === null: transient, so the line carries a retry. A detail sentence
   // means the user has to act (an expired session) and a retry cannot help.
   const [loadError, setLoadError] = useState<{ detail: string | null } | null>(null)
   const [reloadKey, setReloadKey] = useState(0)
 
+  const [inviteEmail, setInviteEmail] = useState('')
+  const [inviteRole, setInviteRole] = useState<string>('member')
+  const [isSending, setIsSending] = useState(false)
+  const [changingRoleId, setChangingRoleId] = useState<string | null>(null)
+  const [revokingId, setRevokingId] = useState<string | null>(null)
+  const [resendingId, setResendingId] = useState<string | null>(null)
+  const [shareInvite, setShareInvite] = useState<ShareableInvite | null>(null)
+  // Confirm-up-front (UI convention 10): removal opens a dialog describing
+  // the outcome; the DELETE only fires from its confirm button.
+  const [removeTarget, setRemoveTarget] = useState<TeamMember | null>(null)
+
   const roleLabel = (role: string) => {
     switch (role) {
       case 'owner': return t('role_owner')
@@ -39,52 +106,197 @@ export function TeamPanel() {
     }
   }
 
-  useEffect(() => {
-    let cancelled = false
+  const errorTitle = (body: unknown, fallback: string): string => {
+    const message = (body as { error?: unknown } | null)?.error
+    return typeof message === 'string' && message.length > 0 ? message : fallback
+  }
 
-    async function load() {
-      setLoadError(null)
-      try {
-        const res = await fetch('/api/team/members')
-        if (!res.ok) {
-          // Not-JSON bodies (an HTML error page, an empty 502) leave null, and
-          // getErrorMessage falls back to the status map.
-          const body = await res.json().catch(() => null)
-          if (cancelled) return
-          const sessionGone = res.status === 401 || res.status === 403
-          setMembers(null)
-          setLoadError({
-            detail: sessionGone
-              ? getErrorMessage(body, { statusCode: res.status, locale: errorLocale })
-              : null,
-          })
-          return
-        }
-        // A 200 whose body will not parse throws into the catch below; a 200
-        // without the roster list is a failed read too. Neither may become a
-        // fabricated empty member list.
-        const parsed = parseTeamMembersPayload<TeamMember>(await res.json())
-        if (cancelled) return
-        if (parsed === null) {
-          setMembers(null)
-          setLoadError({ detail: null })
-          return
-        }
-        setMembers(parsed.members)
-        if (parsed.teamName) setTeamName(parsed.teamName)
-      } catch {
-        if (!cancelled) {
-          setMembers(null)
-          setLoadError({ detail: null })
-        }
+  const fetchMembers = useCallback(async (opts?: { cancelled?: () => boolean }) => {
+    const isCancelled = opts?.cancelled ?? (() => false)
+    setLoadError(null)
+    try {
+      const res = await fetch('/api/team/members')
+      if (!res.ok) {
+        // Not-JSON bodies (an HTML error page, an empty 502) leave null, and
+        // getErrorMessage falls back to the status map.
+        const body = await res.json().catch(() => null)
+        if (isCancelled()) return
+        const sessionGone = res.status === 401 || res.status === 403
+        setMembers(null)
+        setLoadError({
+          detail: sessionGone
+            ? getErrorMessage(body, { statusCode: res.status, locale: errorLocale })
+            : null,
+        })
+        return
+      }
+      // A 200 whose body will not parse throws into the catch below; a 200
+      // without the roster list is a failed read too. Neither may become a
+      // fabricated empty member list.
+      const parsed = parseTeamMembersPayload<TeamMember, TeamInvitation>(await res.json())
+      if (isCancelled()) return
+      if (parsed === null) {
+        setMembers(null)
+        setLoadError({ detail: null })
+        return
+      }
+      setMembers(parsed.members)
+      setInvitations(parsed.invitations)
+      setTeamId(parsed.teamId)
+      setIsOwner(parsed.isOwner)
+      // Management affordances follow the API's own gate: byrå owner/admin.
+      setCanManage(parsed.teamKind === 'byra' && parsed.canInvite)
+      if (parsed.teamName) setTeamName(parsed.teamName)
+    } catch {
+      if (!isCancelled()) {
+        setMembers(null)
+        setLoadError({ detail: null })
       }
     }
+  }, [errorLocale])
 
-    void load()
+  useEffect(() => {
+    let cancelled = false
+    void fetchMembers({ cancelled: () => cancelled })
     return () => {
       cancelled = true
     }
-  }, [reloadKey, errorLocale])
+  }, [fetchMembers, reloadKey])
+
+  const handleRoleChange = async (member: TeamMember, newRole: string) => {
+    setChangingRoleId(member.id)
+    try {
+      const res = await fetch(`/api/team/members/${member.id}`, {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ role: newRole }),
+      })
+      const data = await res.json().catch(() => null)
+      if (!res.ok) {
+        toast({ title: errorTitle(data, t('role_change_failed')), variant: 'destructive' })
+        return
+      }
+      toast({ title: t('role_changed_toast') })
+    } catch {
+      toast({ title: t('role_change_failed'), variant: 'destructive' })
+    } finally {
+      setChangingRoleId(null)
+      void fetchMembers()
+    }
+  }
+
+  const handleRemove = async (member: TeamMember) => {
+    try {
+      const res = await fetch(`/api/team/members/${member.id}`, { method: 'DELETE' })
+      const data = await res.json().catch(() => null)
+      if (!res.ok) {
+        toast({ title: errorTitle(data, t('remove_failed')), variant: 'destructive' })
+        return
+      }
+      toast({ title: t('removed_toast') })
+    } catch {
+      toast({ title: t('remove_failed'), variant: 'destructive' })
+    } finally {
+      void fetchMembers()
+    }
+  }
+
+  const handleRevokeInvite = async (invite: TeamInvitation) => {
+    setRevokingId(invite.id)
+    try {
+      const res = await fetch(`/api/team/invite/${invite.id}`, { method: 'DELETE' })
+      const data = await res.json().catch(() => null)
+      if (!res.ok) {
+        toast({ title: errorTitle(data, t('revoke_failed')), variant: 'destructive' })
+        return
+      }
+      // A revoked invitation's link is dead: never keep offering it.
+      setShareInvite((current) => (current?.email === invite.email ? null : current))
+      toast({ title: t('revoked_toast') })
+    } catch {
+      toast({ title: t('revoke_failed'), variant: 'destructive' })
+    } finally {
+      setRevokingId(null)
+      void fetchMembers()
+    }
+  }
+
+  const handleResendInvite = async (invite: TeamInvitation) => {
+    setResendingId(invite.id)
+    try {
+      const res = await fetch(`/api/team/invite/${invite.id}`, { method: 'POST' })
+      const data = await res.json().catch(() => null)
+      if (!res.ok) {
+        toast({ title: errorTitle(data, t('resend_failed')), variant: 'destructive' })
+        return
+      }
+      const payload = (data as { data?: { email_sent?: boolean; inviteUrl?: string } } | null)?.data
+      if (payload?.inviteUrl) {
+        setShareInvite({
+          email: invite.email,
+          url: payload.inviteUrl,
+          sent: payload.email_sent !== false,
+        })
+      }
+      toast({
+        title: t('resend_toast'),
+        description: payload?.email_sent === false ? t('invite_mail_not_sent') : undefined,
+      })
+      void fetchMembers()
+    } catch {
+      toast({ title: t('resend_failed'), variant: 'destructive' })
+    } finally {
+      setResendingId(null)
+    }
+  }
+
+  const handleCopyInviteLink = async (url: string) => {
+    try {
+      await navigator.clipboard.writeText(url)
+      toast({ title: t('invite_link_copied_toast') })
+    } catch {
+      toast({ title: t('invite_link_copy_failed'), variant: 'destructive' })
+    }
+  }
+
+  const handleInvite = async (e: React.FormEvent) => {
+    e.preventDefault()
+    const email = inviteEmail.trim().toLowerCase()
+    if (!email) return
+
+    setIsSending(true)
+    try {
+      const res = await fetch('/api/team/invite', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email, role: inviteRole, ...(teamId ? { teamId } : {}) }),
+      })
+      const data = await res.json().catch(() => null)
+      if (!res.ok) {
+        toast({ title: errorTitle(data, t('invite_failed')), variant: 'destructive' })
+        return
+      }
+      const payload = (data as { data?: { email_sent?: boolean; inviteUrl?: string } } | null)?.data
+      const sent = payload?.email_sent
+      // Persist the shareable link next to the pending list: a failed send
+      // leaves the invitation valid, and the toast alone is too easy to miss
+      // (the Arbore case), so the recovery path stays visible on the page.
+      if (payload?.inviteUrl) {
+        setShareInvite({ email, url: payload.inviteUrl, sent: sent !== false })
+      }
+      toast({
+        title: t('invite_sent_toast'),
+        description: sent === false ? t('invite_mail_not_sent') : undefined,
+      })
+      setInviteEmail('')
+      setInviteRole('member')
+      void fetchMembers()
+    } catch {
+      toast({ title: t('invite_failed'), variant: 'destructive' })
+    } finally {
+      setIsSending(false)
+    }
+  }
 
   if (members === null) {
     return (
@@ -117,28 +329,216 @@ export function TeamPanel() {
 
   return (
     <SettingsGroup label={<span data-ph-mask="">{teamName || t('team_fallback')}</span>}>
-      {/* Read-only member roster: flat hairline rows, no cards. */}
-      {members.map((member) => (
-        <div
-          key={member.id}
-          className="flex items-center gap-3 border-b border-border px-1 py-3"
-        >
-          <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-muted/60">
-            <span className="text-xs font-medium text-muted-foreground">
-              {member.email.charAt(0).toUpperCase()}
-            </span>
-          </div>
-          <p className="min-w-0 flex-1 truncate text-sm">
-            {member.email}
-            {member.is_current_user && (
-              <span className="ml-1 text-muted-foreground">{t('you_suffix')}</span>
+      {/* Member roster: flat hairline rows, no cards. */}
+      {members.map((member) => {
+        // Role select gates mirror the API: own row stays read-only (no
+        // accidental self-demotion), owner rows are owner-managed, and the
+        // owner option itself is owner-granted.
+        const roleEditable = canManage && !member.is_current_user && (member.role !== 'owner' || isOwner)
+        const removable = canManage && !member.is_current_user && (member.role !== 'owner' || isOwner)
+        return (
+          <div
+            key={member.id}
+            className="flex items-center gap-3 border-b border-border px-1 py-3"
+          >
+            <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-muted/60">
+              <span className="text-xs font-medium text-muted-foreground">
+                {member.email.charAt(0).toUpperCase()}
+              </span>
+            </div>
+            <p className="min-w-0 flex-1 truncate text-sm">
+              {member.email}
+              {member.is_current_user && (
+                <span className="ml-1 text-muted-foreground">{t('you_suffix')}</span>
+              )}
+            </p>
+            {roleEditable ? (
+              <Select
+                value={member.role}
+                onValueChange={(value) => void handleRoleChange(member, value)}
+                disabled={changingRoleId === member.id}
+              >
+                <SelectTrigger
+                  className={cn(ROLE_TRIGGER_CLASS, 'text-xs')}
+                  aria-label={t('role_change_aria', { email: member.email })}
+                >
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent align="end">
+                  {isOwner && <SelectItem value="owner">{t('role_owner')}</SelectItem>}
+                  <SelectItem value="admin">{t('role_admin')}</SelectItem>
+                  <SelectItem value="member">{t('role_member')}</SelectItem>
+                </SelectContent>
+              </Select>
+            ) : (
+              <span className="shrink-0 text-xs text-muted-foreground">
+                {roleLabel(member.role)}
+              </span>
             )}
-          </p>
-          <span className="shrink-0 text-xs text-muted-foreground">
-            {roleLabel(member.role)}
-          </span>
+            {removable && (
+              <Button
+                variant="ghost"
+                size="icon"
+                className="h-8 w-8 shrink-0 text-muted-foreground hover:text-destructive"
+                aria-label={t('remove_aria', { email: member.email })}
+                onClick={() => setRemoveTarget(member)}
+              >
+                <Trash2 className="h-3.5 w-3.5" />
+              </Button>
+            )}
+          </div>
+        )
+      })}
+
+      {/* Pending invitations continue the same list, visually quieter. */}
+      {canManage &&
+        invitations.map((inv) => {
+          const expired = new Date(inv.expires_at) <= new Date()
+          return (
+            <div
+              key={inv.id}
+              className="flex items-center gap-3 border-b border-border px-1 py-3"
+            >
+              <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full border border-dashed border-border">
+                <Mail className="h-3.5 w-3.5 text-muted-foreground" />
+              </div>
+              <p className="min-w-0 flex-1 truncate text-sm text-muted-foreground">
+                {inv.email}
+                <span className="ml-1 text-xs">
+                  ·{' '}
+                  {expired
+                    ? t('invite_expired')
+                    : t('invite_expires', { date: formatDateLong(inv.expires_at) })}
+                </span>
+              </p>
+              <span className="shrink-0 text-xs text-muted-foreground">
+                {roleLabel(inv.role)}
+              </span>
+              <Button
+                variant="ghost"
+                size="icon"
+                className="h-8 w-8 shrink-0 text-muted-foreground hover:text-foreground"
+                aria-label={t('resend_aria', { email: inv.email })}
+                onClick={() => void handleResendInvite(inv)}
+                disabled={resendingId === inv.id || revokingId === inv.id}
+              >
+                {resendingId === inv.id ? (
+                  <Loader2 className="h-3.5 w-3.5 animate-spin" />
+                ) : (
+                  <RefreshCw className="h-3.5 w-3.5" />
+                )}
+              </Button>
+              <Button
+                variant="ghost"
+                size="icon"
+                className="h-8 w-8 shrink-0 text-muted-foreground hover:text-destructive"
+                aria-label={t('revoke_aria', { email: inv.email })}
+                onClick={() => void handleRevokeInvite(inv)}
+                disabled={revokingId === inv.id || resendingId === inv.id}
+              >
+                {revokingId === inv.id ? (
+                  <Loader2 className="h-3.5 w-3.5 animate-spin" />
+                ) : (
+                  <Trash2 className="h-3.5 w-3.5" />
+                )}
+              </Button>
+            </div>
+          )
+        })}
+
+      {/* Shareable accept link from the latest invite/re-send: one sentence,
+          not a banner. The failed-send case is the page's single attn line;
+          the sent case is a quiet muted line with the same copy action, since
+          the link is a legitimate share path either way. */}
+      {canManage && shareInvite && (
+        <div className="px-1 pt-3" role="status" aria-live="polite">
+          {shareInvite.sent ? (
+            <p className="text-[12.5px] leading-5 text-muted-foreground">
+              {t('invite_link_sent', { email: shareInvite.email })}{' '}
+              <button
+                type="button"
+                onClick={() => void handleCopyInviteLink(shareInvite.url)}
+                className="underline underline-offset-2 hover:text-foreground"
+              >
+                {t('invite_link_copy_action')}
+              </button>
+            </p>
+          ) : (
+            <AttnLine
+              action={{
+                label: t('invite_link_copy_action'),
+                onClick: () => void handleCopyInviteLink(shareInvite.url),
+              }}
+            >
+              {t('invite_link_not_sent', { email: shareInvite.email })}
+            </AttnLine>
+          )}
         </div>
-      ))}
+      )}
+
+      {/* Inline invite: the list's own last row instead of a separate card. */}
+      {canManage && (
+        <form
+          onSubmit={handleInvite}
+          className="flex flex-col gap-3 px-1 pt-3 sm:flex-row sm:items-center"
+        >
+          <label htmlFor="team-invite-email" className="sr-only">
+            {t('invite_email_label')}
+          </label>
+          <SettingsInput
+            id="team-invite-email"
+            type="email"
+            placeholder={t('invite_email_placeholder')}
+            value={inviteEmail}
+            onChange={(e) => setInviteEmail(e.target.value)}
+            disabled={isSending}
+            required
+            className="border-border sm:flex-1"
+          />
+          <Select value={inviteRole} onValueChange={setInviteRole}>
+            <SelectTrigger className={ROLE_TRIGGER_CLASS} aria-label={t('invite_role_label')}>
+              <SelectValue />
+            </SelectTrigger>
+            <SelectContent align="end">
+              <SelectItem value="member">{t('role_member')}</SelectItem>
+              <SelectItem value="admin">{t('role_admin')}</SelectItem>
+            </SelectContent>
+          </Select>
+          <Button type="submit" size="sm" disabled={isSending || !inviteEmail.trim()}>
+            {isSending ? (
+              <Loader2 className="h-4 w-4 animate-spin" />
+            ) : (
+              <>
+                <Plus className="mr-2 h-4 w-4" />
+                {t('invite_button')}
+              </>
+            )}
+          </Button>
+        </form>
+      )}
+
+      {/* Confirm up front: the dialog describes the outcome (loses access to
+          every client company via the team) before anything is deleted. */}
+      <ConfirmDialog
+        open={removeTarget !== null}
+        onOpenChange={(open) => {
+          if (!open) setRemoveTarget(null)
+        }}
+        title={t('remove_confirm_title')}
+        description={
+          removeTarget
+            ? t('remove_confirm_body', {
+                email: removeTarget.email,
+                team: teamName || t('team_fallback'),
+              })
+            : undefined
+        }
+        confirmLabel={t('remove_confirm_button')}
+        destructive
+        onConfirm={async () => {
+          if (removeTarget) await handleRemove(removeTarget)
+        }}
+      />
     </SettingsGroup>
   )
 }
diff --git a/components/settings/__tests__/members-payload.test.ts b/components/settings/__tests__/members-payload.test.ts
index f4933dc0..dc2bb8f9 100644
--- a/components/settings/__tests__/members-payload.test.ts
+++ b/components/settings/__tests__/members-payload.test.ts
@@ -57,14 +57,37 @@ describe('parseCompanyMembersPayload', () => {
 describe('parseTeamMembersPayload', () => {
   it('passes a well-formed payload through', () => {
     expect(
-      parseTeamMembersPayload({ data: { members: [{ id: 'm1' }], teamName: 'Byrån AB' } }),
-    ).toEqual({ members: [{ id: 'm1' }], teamName: 'Byrån AB' })
+      parseTeamMembersPayload({
+        data: {
+          members: [{ id: 'm1' }],
+          invitations: [{ id: 'i1' }],
+          teamName: 'Byrån AB',
+          teamId: 'team-1',
+          teamKind: 'byra',
+          isOwner: true,
+          canInvite: true,
+        },
+      }),
+    ).toEqual({
+      members: [{ id: 'm1' }],
+      invitations: [{ id: 'i1' }],
+      teamName: 'Byrån AB',
+      teamId: 'team-1',
+      teamKind: 'byra',
+      isOwner: true,
+      canInvite: true,
+    })
   })
 
-  it('accepts a confirmed-empty roster and a missing team name', () => {
+  it('accepts a confirmed-empty roster and missing management fields', () => {
     expect(parseTeamMembersPayload({ data: { members: [] } })).toEqual({
       members: [],
+      invitations: [],
       teamName: null,
+      teamId: null,
+      teamKind: null,
+      isOwner: false,
+      canInvite: false,
     })
   })
 
@@ -76,9 +99,16 @@ describe('parseTeamMembersPayload', () => {
   })
 
   it('drops a non-string team name instead of rendering it', () => {
-    expect(parseTeamMembersPayload({ data: { members: [], teamName: 42 } })).toEqual({
-      members: [],
-      teamName: null,
-    })
+    expect(
+      parseTeamMembersPayload({ data: { members: [], teamName: 42 } }),
+    ).toMatchObject({ members: [], teamName: null })
+  })
+
+  it('only grants management affordances on explicit boolean true', () => {
+    expect(
+      parseTeamMembersPayload({
+        data: { members: [], invitations: 'oops', isOwner: 'yes', canInvite: 1 },
+      }),
+    ).toMatchObject({ invitations: [], isOwner: false, canInvite: false })
   })
 })
diff --git a/components/settings/members-payload.ts b/components/settings/members-payload.ts
index adf750ef..863d47b4 100644
--- a/components/settings/members-payload.ts
+++ b/components/settings/members-payload.ts
@@ -33,19 +33,40 @@ export function parseCompanyMembersPayload<M, I>(body: unknown): CompanyMembersP
   }
 }
 
-export interface TeamMembersPayload<M> {
+export interface TeamMembersPayload<M, I> {
   members: M[]
+  invitations: I[]
   teamName: string | null
+  teamId: string | null
+  teamKind: string | null
+  isOwner: boolean
+  canInvite: boolean
 }
 
-export function parseTeamMembersPayload<M>(body: unknown): TeamMembersPayload<M> | null {
+export function parseTeamMembersPayload<M, I>(body: unknown): TeamMembersPayload<M, I> | null {
   if (typeof body !== 'object' || body === null) return null
   const data = (body as { data?: unknown }).data
   if (typeof data !== 'object' || data === null) return null
-  const d = data as { members?: unknown; teamName?: unknown }
+  const d = data as {
+    members?: unknown
+    invitations?: unknown
+    teamName?: unknown
+    teamId?: unknown
+    teamKind?: unknown
+    isOwner?: unknown
+    canInvite?: unknown
+  }
   if (!Array.isArray(d.members)) return null
   return {
     members: d.members as M[],
+    // Management-only extra, not roster state: a missing list means "none",
+    // not a failed read (the strictness above protects the member roster).
+    invitations: Array.isArray(d.invitations) ? (d.invitations as I[]) : [],
     teamName: typeof d.teamName === 'string' && d.teamName.length > 0 ? d.teamName : null,
+    teamId: typeof d.teamId === 'string' && d.teamId.length > 0 ? d.teamId : null,
+    teamKind: typeof d.teamKind === 'string' && d.teamKind.length > 0 ? d.teamKind : null,
+    // Only explicit boolean true unlocks management affordances.
+    isOwner: d.isOwner === true,
+    canInvite: d.canInvite === true,
   }
 }
diff --git a/components/settings/sections/BankingSettingsContent.tsx b/components/settings/sections/BankingSettingsContent.tsx
index 9a4aa775..ca4b0024 100644
--- a/components/settings/sections/BankingSettingsContent.tsx
+++ b/components/settings/sections/BankingSettingsContent.tsx
@@ -11,6 +11,7 @@ import { AlertTriangle, CreditCard, ExternalLink } from 'lucide-react'
 import { getSettingsPanel } from '@/lib/extensions/settings-panel-registry'
 import { ENABLED_EXTENSION_IDS } from '@/lib/extensions/_generated/enabled-extensions'
 import { SettingsSectionHeader } from '@/components/settings/SettingsRows'
+import { useBranding } from '@/lib/branding/brand-context'
 
 const BankingPanel = getSettingsPanel('enable-banking')
 
@@ -18,6 +19,7 @@ export function BankingSettingsContent() {
   const t = useTranslations('settings_banking')
   const tNav = useTranslations('settings_nav')
   const tIntro = useTranslations('settings_intro')
+  const { appName } = useBranding()
   const searchParams = useSearchParams()
   const router = useRouter()
   const { toast } = useToast()
@@ -76,7 +78,7 @@ export function BankingSettingsContent() {
 
   return (
     <div>
-      <SettingsSectionHeader title={tNav('banking')} intro={tIntro('banking')} />
+      <SettingsSectionHeader title={tNav('banking')} intro={tIntro('banking', { appName })} />
 
       {/* OAuth bounce-back failure: a live warning, so it stays visible in the
           page flow, as compact warning-tone lines instead of a bordered box. */}
diff --git a/components/settings/sections/BillingSettingsContent.tsx b/components/settings/sections/BillingSettingsContent.tsx
index 54e31411..9a1a5f78 100644
--- a/components/settings/sections/BillingSettingsContent.tsx
+++ b/components/settings/sections/BillingSettingsContent.tsx
@@ -20,6 +20,7 @@ import { useFormat } from '@/lib/hooks/use-format'
 import { BillingActions } from '@/components/settings/BillingActions'
 import { PLAN_PRICES } from '@/components/settings/billing-plans'
 import type { BillingPlan } from '@/lib/stripe/client'
+import { useBranding } from '@/lib/branding/brand-context'
 
 // What the paid tier unlocks: the external connections. One item per PAID
 // capability in lib/entitlements/keys.ts (ai, bank_sync, skatteverket,
@@ -40,6 +41,12 @@ interface BillingView {
   chargeDeferred: boolean
   paidJustNow: boolean
   isDemo: boolean
+  /**
+   * WL-10: present when the company is covered by its byrå team's agreement
+   * (active team-scoped manual grant). Replaces the upgrade pitch with a
+   * read-only "Ingår i <teamName>s avtal" state.
+   */
+  teamAgreement: { teamName: string } | null
 }
 
 function UnlockList({ className }: { className?: string }) {
@@ -70,6 +77,7 @@ export function BillingSettingsContent() {
   const tNav = useTranslations('settings_nav')
   const tIntro = useTranslations('settings_intro')
   const t = useTranslations('settings_billing')
+  const { appName } = useBranding()
   const errorLocale = useLocale() as ErrorLocale
   const { formatDateLong } = useFormat()
   // null = the billing state is not known: still loading, or the read failed
@@ -111,6 +119,7 @@ export function BillingSettingsContent() {
           configured?: unknown
           trialEndsAt?: unknown
           isDemo?: unknown
+          teamAgreement?: unknown
         }
         if (!active) return
         if (typeof d?.isPaying !== 'boolean' || typeof d?.configured !== 'boolean') {
@@ -126,6 +135,13 @@ export function BillingSettingsContent() {
         // Set by the checkout success redirect. Provisioning happens via the
         // Stripe webhook, so isPaying can lag the redirect by a few seconds.
         const paidJustNow = new URLSearchParams(window.location.search).get('success') === '1'
+        // Only a well-formed teamAgreement (non-empty team name) activates the
+        // read-only agreement state: anything else falls back to the normal view.
+        const rawAgreement = d.teamAgreement as { teamName?: unknown } | null | undefined
+        const teamAgreement =
+          rawAgreement && typeof rawAgreement.teamName === 'string' && rawAgreement.teamName.length > 0
+            ? { teamName: rawAgreement.teamName }
+            : null
         setView({
           isPaying: d.isPaying,
           configured: d.configured,
@@ -134,6 +150,7 @@ export function BillingSettingsContent() {
           chargeDeferred,
           paidJustNow,
           isDemo: d.isDemo === true,
+          teamAgreement,
         })
       } catch {
         if (active) {
@@ -187,7 +204,7 @@ export function BillingSettingsContent() {
         <SettingsGroup label={t('group_yours')}>
           <SettingsRow label={t('row_status')} borderless>
             <span>{t('status_demo')}</span>
-            <SettingsRowNote>{t('status_demo_note')}</SettingsRowNote>
+            <SettingsRowNote>{t('status_demo_note', { appName })}</SettingsRowNote>
           </SettingsRow>
         </SettingsGroup>
         <SettingsGroup label={t('group_included')}>
@@ -240,6 +257,28 @@ export function BillingSettingsContent() {
     )
   }
 
+  // Covered by the byrå team's agreement (WL-10) → read-only state instead
+  // of the upgrade pitch and Stripe checkout. The page stays visible for
+  // transparency; billing is the byrå's, so there is nothing to manage here.
+  if (view.teamAgreement) {
+    return (
+      <div>
+        {header}
+        <SettingsGroup label={t('group_yours')}>
+          <SettingsRow label={t('row_status')} borderless>
+            <span className="font-medium">
+              {t('team_agreement_status', { teamName: view.teamAgreement.teamName })}
+            </span>
+            <SettingsRowNote>{t('team_agreement_note')}</SettingsRowNote>
+          </SettingsRow>
+        </SettingsGroup>
+        <SettingsGroup label={t('group_included')}>
+          <UnlockList className="pt-3" />
+        </SettingsGroup>
+      </div>
+    )
+  }
+
   // Trialing / expired → sell view: one number, four short lines, one
   // button, two quiet sentences. Everything else lives behind the "?".
   const { trialEndsAt, daysLeft, chargeDeferred } = view
diff --git a/components/settings/sections/BrandSettingsContent.tsx b/components/settings/sections/BrandSettingsContent.tsx
new file mode 100644
index 00000000..52fc492e
--- /dev/null
+++ b/components/settings/sections/BrandSettingsContent.tsx
@@ -0,0 +1,284 @@
+'use client'
+
+import { useEffect, useRef, useState } from 'react'
+import { useTranslations } from 'next-intl'
+import { Loader2, Palette, Trash2, Upload } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { EmptyState } from '@/components/ui/empty-state'
+import { useToast } from '@/components/ui/use-toast'
+import { SettingsGroup, SettingsInput, SettingsRow } from '@/components/settings/SettingsRows'
+import { SettingsLoadingSkeleton } from '@/components/settings/SettingsLoadingSkeleton'
+import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'
+import { LOGO_UPLOAD_MAX_BYTES } from '@/lib/invoices/branding-constants'
+
+const ALLOWED_TYPES = ['image/png', 'image/jpeg', 'image/svg+xml', 'image/webp']
+
+interface ByraBrand {
+  hasBrand: boolean
+  domain: string | null
+  appName: string | null
+  logoUrl: string | null
+  canEdit: boolean
+}
+
+/**
+ * Byrå settings: Varumärke (WL-17). Byråer edit the logo and the app name
+ * themselves; domain and colors render read-only (ops-managed, the
+ * white-glove decision). Upload interaction mirrors the company invoice
+ * logo (components/settings/LogoUpload.tsx) against the byrå brand route.
+ * The logo saves on upload; the app name has an inline save that appears
+ * when the field is dirty (SettingsFormWrapper is wired to /api/settings,
+ * so this single team-scoped field saves itself).
+ */
+export function BrandSettingsContent() {
+  const t = useTranslations('settings_brand')
+  const { toast } = useToast()
+  const [brand, setBrand] = useState<ByraBrand | null>(null)
+  const [loadFailed, setLoadFailed] = useState(false)
+  const [isUploading, setIsUploading] = useState(false)
+  const [isDeleting, setIsDeleting] = useState(false)
+  const [isDragging, setIsDragging] = useState(false)
+  const [appNameDraft, setAppNameDraft] = useState('')
+  const [isSavingName, setIsSavingName] = useState(false)
+  const inputRef = useRef<HTMLInputElement>(null)
+
+  useEffect(() => {
+    let cancelled = false
+    fetch('/api/byra/brand')
+      .then(async (res) => {
+        if (!res.ok) throw new Error()
+        const body = (await res.json()) as { data: ByraBrand }
+        if (!cancelled) {
+          setBrand(body.data)
+          setAppNameDraft(body.data.appName ?? '')
+        }
+      })
+      .catch(() => {
+        if (!cancelled) setLoadFailed(true)
+      })
+    return () => {
+      cancelled = true
+    }
+  }, [])
+
+  const appNameDirty =
+    !!brand?.hasBrand &&
+    brand.canEdit &&
+    appNameDraft.trim().length > 0 &&
+    appNameDraft.trim() !== brand.appName
+
+  async function handleSaveAppName() {
+    if (!appNameDirty || isSavingName) return
+    setIsSavingName(true)
+    try {
+      const response = await fetch('/api/byra/brand', {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ appName: appNameDraft.trim() }),
+      })
+      const result = await response.json()
+      if (!response.ok) {
+        throw new Error(result.error || t('app_name_save_failed'))
+      }
+      setBrand((prev) => (prev ? { ...prev, appName: result.data.app_name } : prev))
+      setAppNameDraft(result.data.app_name)
+    } catch (error) {
+      toast({
+        title: t('app_name_save_failed'),
+        description: error instanceof Error ? getUserErrorMessage(error) : undefined,
+        variant: 'destructive',
+      })
+    }
+    setIsSavingName(false)
+  }
+
+  function validateAndUpload(file: File) {
+    if (!ALLOWED_TYPES.includes(file.type)) {
+      toast({ title: t('logo_disallowed_type'), variant: 'destructive' })
+      return
+    }
+    if (file.size > LOGO_UPLOAD_MAX_BYTES) {
+      toast({ title: t('logo_too_large'), variant: 'destructive' })
+      return
+    }
+    void handleUpload(file)
+  }
+
+  async function handleUpload(file: File) {
+    setIsUploading(true)
+    const formData = new FormData()
+    formData.append('file', file)
+    try {
+      const response = await fetch('/api/byra/brand/logo', { method: 'POST', body: formData })
+      const result = await response.json()
+      if (!response.ok) {
+        throw new Error(result.error || t('logo_upload_failed'))
+      }
+      setBrand((prev) => (prev ? { ...prev, logoUrl: result.data.logo_url } : prev))
+    } catch (error) {
+      toast({
+        title: t('logo_upload_failed'),
+        description: error instanceof Error ? getUserErrorMessage(error) : undefined,
+        variant: 'destructive',
+      })
+    }
+    setIsUploading(false)
+  }
+
+  async function handleDelete() {
+    setIsDeleting(true)
+    try {
+      const response = await fetch('/api/byra/brand/logo', { method: 'DELETE' })
+      if (!response.ok) throw new Error()
+      setBrand((prev) => (prev ? { ...prev, logoUrl: null } : prev))
+      if (inputRef.current) inputRef.current.value = ''
+    } catch {
+      toast({ title: t('logo_delete_failed'), variant: 'destructive' })
+    }
+    setIsDeleting(false)
+  }
+
+  function handleDrop(e: React.DragEvent<HTMLButtonElement>) {
+    e.preventDefault()
+    setIsDragging(false)
+    const file = e.dataTransfer.files?.[0]
+    if (file) validateAndUpload(file)
+  }
+
+  function handleDragOver(e: React.DragEvent<HTMLButtonElement>) {
+    e.preventDefault()
+    setIsDragging(true)
+  }
+
+  function handleDragLeave(e: React.DragEvent<HTMLButtonElement>) {
+    e.preventDefault()
+    setIsDragging(false)
+  }
+
+  if (loadFailed) {
+    return <p className="text-sm text-muted-foreground">{t('load_failed')}</p>
+  }
+  if (!brand) {
+    return <SettingsLoadingSkeleton />
+  }
+  if (!brand.hasBrand) {
+    return (
+      <EmptyState
+        icon={Palette}
+        title={t('empty_title')}
+        description={t('empty_description')}
+      />
+    )
+  }
+
+  return (
+    <SettingsGroup>
+      <SettingsRow label={t('logo_label')} help={t('logo_help')}>
+        {brand.logoUrl ? (
+          <>
+            <span className="inline-flex rounded-lg border border-border bg-muted/30 p-2">
+              {/* eslint-disable-next-line @next/next/no-img-element */}
+              <img
+                src={brand.logoUrl}
+                alt={t('logo_alt')}
+                className="max-h-10 max-w-32 object-contain"
+              />
+            </span>
+            {brand.canEdit && (
+              <>
+                <Button
+                  variant="ghost"
+                  size="sm"
+                  onClick={() => inputRef.current?.click()}
+                  disabled={isUploading}
+                  className="text-muted-foreground hover:text-foreground"
+                >
+                  {isUploading ? <Loader2 className="mr-2 h-3.5 w-3.5 animate-spin" /> : null}
+                  {t('logo_change')}
+                </Button>
+                <Button
+                  variant="outline"
+                  size="sm"
+                  onClick={handleDelete}
+                  disabled={isDeleting}
+                  className="text-muted-foreground hover:text-destructive"
+                >
+                  {isDeleting ? (
+                    <Loader2 className="mr-2 h-3.5 w-3.5 animate-spin" />
+                  ) : (
+                    <Trash2 className="mr-2 h-3.5 w-3.5" />
+                  )}
+                  {t('logo_remove')}
+                </Button>
+              </>
+            )}
+          </>
+        ) : brand.canEdit ? (
+          <button
+            type="button"
+            onClick={() => inputRef.current?.click()}
+            onDrop={handleDrop}
+            onDragOver={handleDragOver}
+            onDragEnter={handleDragOver}
+            onDragLeave={handleDragLeave}
+            disabled={isUploading}
+            className={`inline-flex min-h-10 items-center gap-2 rounded-lg border border-dashed px-4 py-2 text-sm text-muted-foreground transition-colors duration-150 disabled:opacity-50 ${
+              isDragging ? 'border-foreground bg-muted/40' : 'border-border hover:bg-muted/20'
+            }`}
+          >
+            {isUploading ? (
+              <Loader2 className="h-4 w-4 animate-spin" />
+            ) : (
+              <Upload className="h-4 w-4 text-muted-foreground/60" />
+            )}
+            {isUploading ? t('logo_uploading') : t('logo_pick_or_drop')}
+          </button>
+        ) : (
+          <span className="text-sm text-muted-foreground">{t('logo_none')}</span>
+        )}
+      </SettingsRow>
+
+      <SettingsRow label={t('domain_label')} help={t('domain_help')}>
+        <span className="text-sm tabular-nums">{brand.domain}</span>
+      </SettingsRow>
+
+      <SettingsRow label={t('app_name_label')} help={t('app_name_help')} htmlFor="byra-app-name">
+        {brand.canEdit ? (
+          <>
+            <SettingsInput
+              id="byra-app-name"
+              value={appNameDraft}
+              maxLength={60}
+              onChange={(e) => setAppNameDraft(e.target.value)}
+              onKeyDown={(e) => {
+                if (e.key === 'Enter') {
+                  e.preventDefault()
+                  void handleSaveAppName()
+                }
+              }}
+            />
+            {appNameDirty && (
+              <Button size="sm" onClick={handleSaveAppName} disabled={isSavingName}>
+                {isSavingName ? <Loader2 className="mr-2 h-3.5 w-3.5 animate-spin" /> : null}
+                {t('app_name_save')}
+              </Button>
+            )}
+          </>
+        ) : (
+          <span className="text-sm">{brand.appName}</span>
+        )}
+      </SettingsRow>
+
+      <input
+        ref={inputRef}
+        type="file"
+        accept="image/png,image/jpeg,image/svg+xml,image/webp"
+        className="hidden"
+        onChange={(e) => {
+          const file = e.target.files?.[0]
+          if (file) validateAndUpload(file)
+        }}
+      />
+    </SettingsGroup>
+  )
+}
diff --git a/components/settings/sections/index.ts b/components/settings/sections/index.ts
index 13753f8d..eeb8d356 100644
--- a/components/settings/sections/index.ts
+++ b/components/settings/sections/index.ts
@@ -46,6 +46,14 @@ const BillingSettingsContent = dynamic(() =>
   import('./BillingSettingsContent').then((module) => ({ default: module.BillingSettingsContent })),
   { loading: SettingsLoadingSkeleton },
 )
+const TeamSettingsContent = dynamic(() =>
+  import('../TeamPanel').then((module) => ({ default: module.TeamPanel })),
+  { loading: SettingsLoadingSkeleton },
+)
+const BrandSettingsContent = dynamic(() =>
+  import('./BrandSettingsContent').then((module) => ({ default: module.BrandSettingsContent })),
+  { loading: SettingsLoadingSkeleton },
+)
 const WhatsAppSettingsContent = dynamic(() =>
   import('./WhatsAppSettingsContent').then((module) => ({ default: module.WhatsAppSettingsContent })),
   { loading: SettingsLoadingSkeleton },
@@ -74,6 +82,8 @@ export const SETTINGS_SECTIONS: Record<string, ComponentType> = {
   assistant: AssistantSettingsContent,
   api: ApiSettingsContent,
   billing: BillingSettingsContent,
+  team: TeamSettingsContent,
+  brand: BrandSettingsContent,
   whatsapp: WhatsAppSettingsContent,
   mail: MailSettingsContent,
 }
diff --git a/components/settings/useSettingsNavItems.ts b/components/settings/useSettingsNavItems.ts
index 1f509ed5..f73683ea 100644
--- a/components/settings/useSettingsNavItems.ts
+++ b/components/settings/useSettingsNavItems.ts
@@ -1,10 +1,25 @@
 'use client'
 
+import { useSearchParams } from 'next/navigation'
 import { useTranslations } from 'next-intl'
 import { useCompany } from '@/contexts/CompanyContext'
 import { useAgentSheet } from '@/components/agent/AgentSheetProvider'
 import { ENABLED_EXTENSION_IDS } from '@/lib/extensions/_generated/enabled-extensions'
 
+/**
+ * Byrå settings scope: settings opened from the cockpit carry ?ctx=byra
+ * (links in the user menu / mobile nav). In that scope only account-level
+ * and byrå-level sections show: everything company-scoped (bokföring, skatt,
+ * fakturering, mallar, ...) is edited from inside the client company, never
+ * from the cockpit. Honored only for byrå team members; cosmetic only, the
+ * section pages keep their own auth.
+ */
+export function useByraSettingsScope(): boolean {
+  const searchParams = useSearchParams()
+  const { byraTeam } = useCompany()
+  return searchParams.get('ctx') === 'byra' && !!byraTeam
+}
+
 export type SettingsGroupKey = 'account' | 'company' | 'accounting' | 'sales' | 'tools'
 
 export interface SettingsNavItem {
@@ -34,8 +49,9 @@ const GROUP_ORDER: SettingsGroupKey[] = ['account', 'company', 'accounting', 'sa
  * availability from the generated enabled-extensions set.
  */
 export function useSettingsNavItems(): { items: SettingsNavItem[]; groups: SettingsNavGroup[] } {
-  const { company, isSandbox } = useCompany()
+  const { company, isSandbox, byraTeam } = useCompany()
   const { identity } = useAgentSheet()
+  const byraScope = useByraSettingsScope()
   const t = useTranslations('settings_nav')
 
   const hasCompany = !!company
@@ -49,7 +65,13 @@ export function useSettingsNavItems(): { items: SettingsNavItem[]; groups: Setti
   // Importera/Exportera. Team stays hidden (show:false) until enabled.
   const defs: Array<SettingsNavItem & { show: boolean }> = [
     { id: 'account', href: '/settings/account', label: t('account'), group: 'account', show: true },
-    { id: 'billing', href: '/settings/billing', label: t('billing'), group: 'account', show: true },
+    // Byrå scope: members & roles is the one byrå-level section; billing is
+    // company-scoped (team-billed byråer have no per-company subscription).
+    { id: 'team', href: '/settings/team', label: t('team'), group: 'account', show: byraScope },
+    // Varumärke (WL-17): byrå owner/admin edits the brand logo; members see
+    // nothing (the section would be read-only noise for them).
+    { id: 'brand', href: '/settings/brand', label: t('brand'), group: 'account', show: byraScope && !!byraTeam && (byraTeam.role === 'owner' || byraTeam.role === 'admin') },
+    { id: 'billing', href: '/settings/billing', label: t('billing'), group: 'account', show: !byraScope },
     { id: 'company', href: '/settings/company', label: t('company'), group: 'company', show: hasCompany },
     { id: 'bookkeeping', href: '/settings/bookkeeping', label: t('bookkeeping'), group: 'accounting', show: hasCompany },
     { id: 'tax', href: '/settings/tax', label: t('tax'), group: 'accounting', show: hasCompany },
@@ -68,6 +90,9 @@ export function useSettingsNavItems(): { items: SettingsNavItem[]; groups: Setti
 
   const items: SettingsNavItem[] = defs
     .filter((d) => d.show)
+    // Byrå scope hides every company-scoped section: those are edited from
+    // inside the client company where it is obvious WHICH company they hit.
+    .filter((d) => !byraScope || d.group === 'account')
     .map(({ show: _show, ...item }) => item)
 
   const groupLabels: Record<SettingsGroupKey, string> = {
diff --git a/components/transactions/TransactionAttachmentIndicator.tsx b/components/transactions/TransactionAttachmentIndicator.tsx
index 77ebb2cc..ef7c6de3 100644
--- a/components/transactions/TransactionAttachmentIndicator.tsx
+++ b/components/transactions/TransactionAttachmentIndicator.tsx
@@ -8,6 +8,7 @@ import { Badge } from '@/components/ui/badge'
 import { cn } from '@/lib/utils'
 import { useToast } from '@/components/ui/use-toast'
 import { openDeferredTab } from '@/lib/browser/deferred-tab'
+import { useBranding } from '@/lib/branding/brand-context'
 
 interface Props {
   documentId: string | null | undefined
@@ -49,6 +50,7 @@ export function TransactionAttachmentIndicator({
 }: Props) {
   const t = useTranslations('tx_underlag')
   const tCommon = useTranslations('common')
+  const { appName } = useBranding()
   const { toast } = useToast()
   const [isLoading, setIsLoading] = useState(false)
 
@@ -72,7 +74,7 @@ export function TransactionAttachmentIndicator({
         tab.close()
         toast({
           title: t('open_failed'),
-          description: tab.blocked ? tCommon('popup_blocked_description') : undefined,
+          description: tab.blocked ? tCommon('popup_blocked_description', { appName }) : undefined,
           variant: 'destructive',
         })
       }
diff --git a/contexts/CompanyContext.tsx b/contexts/CompanyContext.tsx
index ca457cfd..d4590f22 100644
--- a/contexts/CompanyContext.tsx
+++ b/contexts/CompanyContext.tsx
@@ -5,12 +5,37 @@ import type { Company, CompanyRole, Team } from '@/types'
 import type { CapabilityKey } from '@/lib/entitlements/keys'
 import type { EntitlementState } from '@/lib/entitlements/has-capability'
 
+/** The user's byrå team membership (teams.kind = 'byra'), when any (WL-08). */
+export interface ByraTeamRef {
+  id: string
+  name: string
+  role: 'owner' | 'admin' | 'member'
+}
+
+/**
+ * A membership company homed on ANOTHER host (the home-domain rule, WL-01):
+ * shown as a non-clickable "Hanteras via <domain>" signpost entry.
+ */
+export interface ForeignCompanyEntry {
+  id: string
+  name: string
+  domain: string
+}
+
 interface CompanyContextValue {
   company: Company | null
   role: CompanyRole | null
+  /**
+   * Memberships homed on the CURRENT host (home-domain rule): the switcher
+   * offers only these. Companies homed elsewhere are in foreignCompanies.
+   */
   companies: { company: Company; role: CompanyRole }[]
   isTeamMember: boolean
   team: Team | null
+  /** Byrå team membership; null for everyone outside a byrå (cockpit gate). */
+  byraTeam?: ByraTeamRef | null
+  /** Companies homed on another domain, for the "Hanteras via" section. */
+  foreignCompanies?: ForeignCompanyEntry[]
   isSandbox: boolean
   /** PAID capability keys the active company currently holds (entitled + enabled). */
   capabilities: CapabilityKey[]
diff --git a/extensions/general/cloud-backup/components/CloudBackupCard.tsx b/extensions/general/cloud-backup/components/CloudBackupCard.tsx
index e42fa5f4..887f90ba 100644
--- a/extensions/general/cloud-backup/components/CloudBackupCard.tsx
+++ b/extensions/general/cloud-backup/components/CloudBackupCard.tsx
@@ -18,6 +18,7 @@ import {
   useDestructiveConfirm,
 } from '@/components/ui/destructive-confirm-dialog'
 import { Box, Cloud, ExternalLink, Loader2, RefreshCw, Unplug } from 'lucide-react'
+import { useBranding } from '@/lib/branding/brand-context'
 import type {
   CloudBackupStatus,
   CloudLastSync,
@@ -41,6 +42,7 @@ const PROVIDER_META: Record<CloudProviderId, { label: string; icon: typeof Cloud
 export default function CloudBackupCard() {
   const t = useTranslations('extensions')
   const { toast } = useToast()
+  const { appName } = useBranding()
   const searchParams = useSearchParams()
 
   const [status, setStatus] = useState<CloudBackupStatus | null>(null)
@@ -160,7 +162,7 @@ export default function CloudBackupCard() {
       */}
       {destinations.length > 0 && (
         <p className="mt-4 px-1 text-xs leading-5 text-muted-foreground">
-          {t('ext_cloud_backup_legal_note', { provider: destinations })}
+          {t('ext_cloud_backup_legal_note', { provider: destinations, appName })}
         </p>
       )}
     </div>
@@ -251,6 +253,7 @@ function ProviderRow({ status, onChanged }: ProviderRowProps) {
   const { toast } = useToast()
   const t = useTranslations('extensions')
   const { dialogProps, confirm } = useDestructiveConfirm()
+  const { appName } = useBranding()
 
   const [isSyncing, setIsSyncing] = useState(false)
   const [isDisconnecting, setIsDisconnecting] = useState(false)
@@ -390,7 +393,7 @@ function ProviderRow({ status, onChanged }: ProviderRowProps) {
   const supportingLine = status.connected
     ? status.account_email
     : status.configured
-      ? t(scopeKey)
+      ? t(scopeKey, { appName })
       : null
 
   return (
diff --git a/extensions/general/email/__tests__/resend-service.test.ts b/extensions/general/email/__tests__/resend-service.test.ts
index 99632dd9..03a87a20 100644
--- a/extensions/general/email/__tests__/resend-service.test.ts
+++ b/extensions/general/email/__tests__/resend-service.test.ts
@@ -1,3 +1,12 @@
+/**
+ * From-header composition in the Resend service.
+ *
+ * Two explicit-sender paths compose here: `from` (company's own verified
+ * sending domain, resolveInvoiceSender) and `fromAddress` (verified brand
+ * sender domain, WL-04/WL-13 via lib/email/brand-sender.ts). A fromName
+ * without either rides the platform address and shows the name ALONE:
+ * no "via <platform>" (founder call 2026-08-05).
+ */
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { eventBus } from '@/lib/events'
 import {
@@ -30,9 +39,9 @@ beforeEach(() => {
 })
 
 describe('buildFromHeader', () => {
-  it('renders the platform default with the company name "via" the app', () => {
+  it('renders the company name alone on the platform address (no "via")', () => {
     expect(buildFromHeader({ fromName: 'Hans Bolag AB' })).toBe(
-      'Hans Bolag AB via Accounted <noreply@platform.example>',
+      'Hans Bolag AB <noreply@platform.example>',
     )
   })
 
@@ -40,12 +49,24 @@ describe('buildFromHeader', () => {
     expect(buildFromHeader({})).toBe('Accounted <noreply@platform.example>')
   })
 
-  it('renders an explicit sender as "<name> <address>" with no "via"', () => {
+  it('renders an explicit sender as "<name> <address>"', () => {
     expect(
       buildFromHeader({ fromName: 'ignored', from: { name: 'Hans Bolag AB', address: 'faktura@hansbolag.example' } }),
     ).toBe('Hans Bolag AB <faktura@hansbolag.example>')
   })
 
+  it('rides the brand address when fromAddress is set (verified brand domain)', () => {
+    expect(
+      buildFromHeader({ fromName: 'Siffra', fromAddress: 'noreply@post.siffra.se' }),
+    ).toBe('Siffra <noreply@post.siffra.se>')
+  })
+
+  it('uses the bare address when fromAddress is set without fromName', () => {
+    expect(buildFromHeader({ fromAddress: 'noreply@post.siffra.se' })).toBe(
+      'noreply@post.siffra.se',
+    )
+  })
+
   it('strips header-injection characters from the explicit name', () => {
     expect(
       buildFromHeader({ from: { name: 'Hans <Bolag>\r\nBcc: x', address: 'faktura@hansbolag.example' } }),
@@ -62,16 +83,16 @@ describe('buildFromHeader', () => {
     // Platform path: a comma in the company name used to yield an ambiguous
     // mailbox list; plain names are byte-identical to before.
     expect(buildFromHeader({ fromName: 'Hans Bolag, AB' })).toBe(
-      '"Hans Bolag, AB via Accounted" <noreply@platform.example>',
+      '"Hans Bolag, AB" <noreply@platform.example>',
     )
   })
 
   it('falls back to the platform sender when the explicit address is malformed', () => {
     expect(buildFromHeader({ fromName: 'Hans Bolag AB', from: { name: 'Hans', address: 'not an address' } })).toBe(
-      'Hans Bolag AB via Accounted <noreply@platform.example>',
+      'Hans Bolag AB <noreply@platform.example>',
     )
     expect(buildFromHeader({ fromName: 'Hans Bolag AB', from: { name: '   ', address: 'faktura@hansbolag.example' } })).toBe(
-      'Hans Bolag AB via Accounted <noreply@platform.example>',
+      'Hans Bolag AB <noreply@platform.example>',
     )
   })
 })
@@ -91,7 +112,7 @@ describe('ResendEmailService.sendEmail', () => {
     const result = await service.sendEmail(base)
     expect(result).toEqual({ success: true, provider: 'resend', messageId: 'msg_1' })
     expect(sendMock).toHaveBeenCalledTimes(1)
-    expect(sendMock.mock.calls[0][0].from).toBe('Hans Bolag AB via Accounted <noreply@platform.example>')
+    expect(sendMock.mock.calls[0][0].from).toBe('Hans Bolag AB <noreply@platform.example>')
   })
 
   it('sends as the company sender when Resend accepts it', async () => {
@@ -105,6 +126,32 @@ describe('ResendEmailService.sendEmail', () => {
     expect(sendMock.mock.calls[0][0].from).toBe('Hans Bolag AB <faktura@hansbolag.example>')
   })
 
+  it('sends as the brand sender when fromAddress is set (verified brand domain)', async () => {
+    sendMock.mockResolvedValue({ data: { id: 'msg_b' }, error: null })
+    const result = await service.sendEmail({
+      ...base,
+      fromName: 'Siffra',
+      fromAddress: 'noreply@post.siffra.se',
+    })
+    expect(result.success).toBe(true)
+    expect(sendMock).toHaveBeenCalledTimes(1)
+    expect(sendMock.mock.calls[0][0].from).toBe('Siffra <noreply@post.siffra.se>')
+  })
+
+  it('sanitizes header injection attempts in name and address parts', async () => {
+    sendMock.mockResolvedValue({ data: { id: 'msg_s' }, error: null })
+    await service.sendEmail({
+      ...base,
+      fromName: 'Evil\r\nName',
+      fromAddress: 'noreply@post.siffra.se>\r\n<evil@x.se',
+    })
+    const from = sendMock.mock.calls[0][0].from as string
+    expect(from).not.toMatch(/[\r\n]/)
+    // The injected angle brackets are stripped; only the wrapper pair remains.
+    expect(from.match(/</g)).toHaveLength(1)
+    expect(from.match(/>/g)).toHaveLength(1)
+  })
+
   it('retries once as the platform sender when Resend rejects the company sender', async () => {
     sendMock
       .mockResolvedValueOnce({ data: null, error: { message: 'The hansbolag.example domain is not verified' } })
@@ -116,12 +163,27 @@ describe('ResendEmailService.sendEmail', () => {
     expect(result).toEqual({ success: true, provider: 'resend', messageId: 'msg_3' })
     expect(sendMock).toHaveBeenCalledTimes(2)
     expect(sendMock.mock.calls[0][0].from).toBe('Hans Bolag AB <faktura@hansbolag.example>')
-    expect(sendMock.mock.calls[1][0].from).toBe('Hans Bolag AB via Accounted <noreply@platform.example>')
+    expect(sendMock.mock.calls[1][0].from).toBe('Hans Bolag AB <noreply@platform.example>')
     // Same recipients and content on the retry.
     expect(sendMock.mock.calls[1][0].to).toEqual(['kund@example.com'])
     expect(sendMock.mock.calls[1][0].subject).toBe('Faktura 1')
   })
 
+  it('retries once as the platform sender when Resend rejects the brand sender', async () => {
+    sendMock
+      .mockResolvedValueOnce({ data: null, error: { message: 'The post.siffra.se domain is not verified' } })
+      .mockResolvedValueOnce({ data: { id: 'msg_4' }, error: null })
+    const result = await service.sendEmail({
+      ...base,
+      fromName: 'Siffra',
+      fromAddress: 'noreply@post.siffra.se',
+    })
+    expect(result).toEqual({ success: true, provider: 'resend', messageId: 'msg_4' })
+    expect(sendMock).toHaveBeenCalledTimes(2)
+    expect(sendMock.mock.calls[0][0].from).toBe('Siffra <noreply@post.siffra.se>')
+    expect(sendMock.mock.calls[1][0].from).toBe('Siffra <noreply@platform.example>')
+  })
+
   it('does not retry a platform-sender failure (nothing to fall back to)', async () => {
     sendMock.mockResolvedValue({ data: null, error: { message: 'invalid recipient' } })
     const result = await service.sendEmail(base)
diff --git a/extensions/general/email/lib/resend-service.ts b/extensions/general/email/lib/resend-service.ts
index 3f84f2ff..2213aa7a 100644
--- a/extensions/general/email/lib/resend-service.ts
+++ b/extensions/general/email/lib/resend-service.ts
@@ -36,8 +36,14 @@ const FROM_ADDRESS_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}@[a-z0-9.-]{4,253}$/
 /**
  * Builds the From header. With an explicit `from` (company's own verified
  * sending domain) the mail leaves as "<name> <address>" and the platform
- * sender is not involved at all. Otherwise the platform default:
- * "<fromName> via <App> <RESEND_FROM_EMAIL>" or "<App> <RESEND_FROM_EMAIL>".
+ * sender is not involved at all. `fromAddress` is only ever set by
+ * lib/email/brand-sender.ts for VERIFIED brand sender domains (WL-13).
+ * Otherwise the platform default: "<fromName> <RESEND_FROM_EMAIL>" or
+ * "<App> <RESEND_FROM_EMAIL>". A fromName WITHOUT an explicit address (a
+ * brand or company riding the platform address) shows the name ALONE
+ * (founder call 2026-08-05: no "via <platform>" in the display name; the
+ * platform stays visible in the actual From address until a sender domain
+ * is verified).
  *
  * Strip CRLF and angle brackets from name parts to prevent header injection.
  * Resend's API does its own validation, but defense in depth: fromName and
@@ -48,6 +54,7 @@ const FROM_ADDRESS_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}@[a-z0-9.-]{4,253}$/
 export function buildFromHeader(input: {
   fromName?: string
   from?: { name: string; address: string }
+  fromAddress?: string
 }): string {
   const safeAppName = sanitizeHeaderPart(getBranding().appName)
 
@@ -62,8 +69,14 @@ export function buildFromHeader(input: {
   }
 
   const safeFromName = input.fromName ? sanitizeHeaderPart(input.fromName) : null
+  const safeFromAddress = input.fromAddress ? sanitizeHeaderPart(input.fromAddress) : null
+  if (safeFromAddress) {
+    return safeFromName
+      ? `${encodeDisplayName(safeFromName)} <${safeFromAddress}>`
+      : safeFromAddress
+  }
   return safeFromName
-    ? `${encodeDisplayName(`${safeFromName} via ${safeAppName}`)} <${DEFAULT_FROM_EMAIL}>`
+    ? `${encodeDisplayName(safeFromName)} <${DEFAULT_FROM_EMAIL}>`
     : `${encodeDisplayName(safeAppName)} <${DEFAULT_FROM_EMAIL}>`
 }
 
@@ -91,13 +104,13 @@ function isResendConfigured(): boolean {
 
 export class ResendEmailService implements EmailService {
   async sendEmail(options: SendEmailOptions): Promise<SendEmailResult> {
-    const { to, cc, bcc, subject, html, text, replyTo, fromName, attachments } = options
+    const { to, cc, bcc, subject, html, text, replyTo, fromName, fromAddress, attachments } = options
 
     if (!this.isConfigured()) {
       return { success: false, error: 'Email service is not configured' }
     }
 
-    const from = buildFromHeader({ fromName, from: options.from })
+    const from = buildFromHeader({ fromName, from: options.from, fromAddress })
     const platformFrom = buildFromHeader({ fromName })
 
     try {
diff --git a/extensions/general/mcp-server/__tests__/create-company.test.ts b/extensions/general/mcp-server/__tests__/create-company.test.ts
index 8d182124..1a6b3303 100644
--- a/extensions/general/mcp-server/__tests__/create-company.test.ts
+++ b/extensions/general/mcp-server/__tests__/create-company.test.ts
@@ -28,6 +28,7 @@ function supabaseWithTeam(teamId: string | null) {
   return {
     from: vi.fn(() => chain),
     rpc: vi.fn().mockResolvedValue({ data: COMPANY_ID, error: null }),
+    chain,
   }
 }
 
@@ -156,6 +157,25 @@ describe('gnubok_create_company', () => {
     expect(mocks.createCompanyCore).not.toHaveBeenCalled()
   })
 
+  it('defaults the team to the user PERSONAL team only (WL-08)', async () => {
+    const supabase = supabaseWithTeam(TEAM_ID)
+    const result = (await tool.execute(setup, '', 'user-1', supabase as never)) as Record<string, unknown>
+
+    expect((result.preview as Record<string, unknown>).team_id).toBe(TEAM_ID)
+    // The default-team lookup must be restricted to kind='personal': picking
+    // the first membership regardless of kind attached a consultant's private
+    // company to their byrå team.
+    expect(supabase.from).toHaveBeenCalledWith('team_members')
+    expect(supabase.chain.select).toHaveBeenCalledWith('team_id, teams!inner(kind, created_at)')
+    expect(supabase.chain.eq).toHaveBeenCalledWith('teams.kind', 'personal')
+  })
+
+  it('leaves team_id null when the user has no personal team', async () => {
+    const supabase = supabaseWithTeam(null)
+    const result = (await tool.execute(setup, '', 'user-1', supabase as never)) as Record<string, unknown>
+    expect((result.preview as Record<string, unknown>).team_id).toBeNull()
+  })
+
   it('uses an explicit team_id over the default team', async () => {
     const supabase = supabaseWithTeam(TEAM_ID)
     const other = '66666666-6666-4666-8666-666666666666'
diff --git a/extensions/general/mcp-server/server.ts b/extensions/general/mcp-server/server.ts
index 9698bbc3..d226e25f 100644
--- a/extensions/general/mcp-server/server.ts
+++ b/extensions/general/mcp-server/server.ts
@@ -1563,16 +1563,23 @@ function connectLinkBaseUrl(): string {
 
 /**
  * The team a company created through the API/MCP path attaches to when the
- * caller does not name one: the user's first (usually the silent personal)
- * team, mirroring what the web wizard passes. null when the user has no
- * team at all; create_company_for_user then leaves team_id NULL.
+ * caller does not name one: the user's PERSONAL team only (WL-08: companies
+ * created through the normal flow always attach to the personal team; cockpit
+ * flows pass the byrå team id explicitly). Picking the first membership
+ * regardless of kind attached a consultant's private company to their byrå
+ * team, exposing their books to the whole byrå and suppressing the trial.
+ * Mirrors ensure_user_team: earliest teams row with kind='personal'. null
+ * when the user has no personal team; create_company_for_user then leaves
+ * team_id NULL. Explicit team_id args are authorized by the DB gate instead.
  */
 async function defaultTeamForUser(supabase: SupabaseClient, userId: string): Promise<string | null> {
   const { data, error } = await supabase
     .from('team_members')
-    .select('team_id')
+    .select('team_id, teams!inner(kind, created_at)')
     .eq('user_id', userId)
-    .order('created_at', { ascending: true })
+    .eq('teams.kind', 'personal')
+    .order('teams(created_at)', { ascending: true })
+    .order('teams(id)', { ascending: true })
     .limit(1)
     .maybeSingle()
   if (error) {
diff --git a/lib/api/schemas.ts b/lib/api/schemas.ts
index 7f0dbafe..570b428d 100644
--- a/lib/api/schemas.ts
+++ b/lib/api/schemas.ts
@@ -3612,6 +3612,16 @@ export const DimensionTaggingApplySchema = z.object({
   reason: z.string().trim().min(3).max(500),
 })
 
+/**
+ * Body for PATCH /api/byra/brand. The app name is byra-editable (WL-17):
+ * shown beside the sidebar logo and across branded chrome. Trimmed and
+ * capped so it stays a name, not a paragraph; domain and colors are NOT
+ * accepted here (ops-managed).
+ */
+export const ByraBrandUpdateSchema = z.object({
+  appName: z.string().trim().min(1).max(60),
+})
+
 // ============================================================
 // Körjournal (mileage trips)
 // ============================================================
diff --git a/lib/branding/__tests__/brand-style.test.ts b/lib/branding/__tests__/brand-style.test.ts
new file mode 100644
index 00000000..a9f991d0
--- /dev/null
+++ b/lib/branding/__tests__/brand-style.test.ts
@@ -0,0 +1,147 @@
+import { describe, it, expect, vi } from 'vitest'
+
+// brand-style imports the pure guards from resolve.ts, which pulls in the
+// service-client module; mock it so the import chain is inert in node.
+vi.mock('@/lib/auth/api-keys', () => ({
+  createServiceClientNoCookies: vi.fn(),
+}))
+
+import { hexToHslTriplet, buildBrandVarsCss } from '@/lib/branding/brand-style'
+import { deriveChromeColor } from '@/lib/branding/resolve'
+
+// Siffra blue from the WL-02 prototype: passes the white-text WCAG gate.
+// Lightness ~53%, i.e. above the dark-mode lift threshold (45%).
+const ACCESSIBLE_BLUE = '#2563eb'
+// White text on this yellow is nowhere near 4.5:1.
+const INACCESSIBLE_YELLOW = '#ffd500'
+// Deep green (L ~20%): passes the white-text gate but disappears against
+// dark surfaces, so the dark theme must lift it.
+const DARK_GREEN = '#14532d'
+
+describe('hexToHslTriplet', () => {
+  it('converts hex to the space-separated triplet format globals.css uses', () => {
+    expect(hexToHslTriplet('#ffffff')).toBe('0 0% 100%')
+    expect(hexToHslTriplet('#000000')).toBe('0 0% 0%')
+    expect(hexToHslTriplet('#2563eb')).toBe('221 83% 53%')
+  })
+
+  it('accepts uppercase hex and surrounding whitespace', () => {
+    expect(hexToHslTriplet(' #2563EB ')).toBe('221 83% 53%')
+  })
+
+  it('returns null for anything that is not a 6-digit hex color', () => {
+    expect(hexToHslTriplet('#fff')).toBeNull()
+    expect(hexToHslTriplet('#12345')).toBeNull()
+    expect(hexToHslTriplet('2563eb')).toBeNull()
+    expect(hexToHslTriplet('blue')).toBeNull()
+    expect(hexToHslTriplet('')).toBeNull()
+  })
+})
+
+describe('buildBrandVarsCss', () => {
+  it('emits the brand variables in both the light and the dark block', () => {
+    const css = buildBrandVarsCss({ brandColor: ACCESSIBLE_BLUE, chromeColor: null })
+    expect(css).not.toBeNull()
+    // Light: html[data-brand]:not(.dark) at (0,2,1) beats :root (0,1,0) and
+    // :root[data-palette] (0,2,0). Dark: html[data-brand].dark at (0,2,1)
+    // beats .dark (0,1,0) and .dark[data-palette] (0,2,0).
+    expect(css).toContain('html[data-brand]:not(.dark) {')
+    expect(css).toContain('html[data-brand].dark {')
+    const brandTriplet = hexToHslTriplet(ACCESSIBLE_BLUE)
+    const lightBlock = css!.split('html[data-brand].dark')[0]
+    const darkBlock = css!.split('html[data-brand].dark')[1]
+    for (const block of [lightBlock, darkBlock]) {
+      expect(block).toContain(`--primary: ${brandTriplet};`)
+      expect(block).toContain('--primary-foreground: 0 0% 100%;')
+      expect(block).toContain(`--ring: ${brandTriplet};`)
+    }
+  })
+
+  it('sets --frame to the derived chrome when no override is stored', () => {
+    const css = buildBrandVarsCss({ brandColor: ACCESSIBLE_BLUE, chromeColor: null })
+    const chromeTriplet = hexToHslTriplet(deriveChromeColor(ACCESSIBLE_BLUE))
+    expect(css).toContain(`--frame: ${chromeTriplet};`)
+  })
+
+  it('sets --frame to the explicit chrome override when stored', () => {
+    const css = buildBrandVarsCss({ brandColor: ACCESSIBLE_BLUE, chromeColor: '#101820' })
+    expect(css).toContain(`--frame: ${hexToHslTriplet('#101820')};`)
+    expect(css).not.toContain(`--frame: ${hexToHslTriplet(deriveChromeColor(ACCESSIBLE_BLUE))};`)
+  })
+
+  it('scopes light sidebar text tokens to the frame sidebar', () => {
+    const css = buildBrandVarsCss({ brandColor: ACCESSIBLE_BLUE, chromeColor: null })
+    expect(css).toContain('html[data-brand] .bg-frame > aside {')
+    const sidebarBlock = css!.split('.bg-frame > aside')[1]
+    expect(sidebarBlock).toContain('--foreground: 0 0% 98%;')
+    expect(sidebarBlock).toContain('--muted-foreground: 0 0% 75%;')
+    expect(sidebarBlock).toContain('--primary: 0 0% 98%;')
+    // The solid-primary chip inside the sidebar inverts onto the chrome tone.
+    const chromeTriplet = hexToHslTriplet(deriveChromeColor(ACCESSIBLE_BLUE))
+    expect(sidebarBlock).toContain(`--primary-foreground: ${chromeTriplet};`)
+    expect(sidebarBlock).toContain('--secondary: ')
+    expect(sidebarBlock).toContain('--muted: ')
+    expect(sidebarBlock).toContain('--border: ')
+  })
+
+  it('lifts --primary/--ring in the dark block for a dark brand color', () => {
+    const css = buildBrandVarsCss({ brandColor: DARK_GREEN, chromeColor: null })!
+    const [lightBlock, darkBlock] = css.split('html[data-brand].dark')
+    const source = hexToHslTriplet(DARK_GREEN)!
+    // The stored color ends in its own (low) lightness; the lifted variant is
+    // the same hue and saturation at 62% lightness.
+    const lifted = source.replace(/\d+%$/, '62%')
+    expect(lifted).not.toBe(source)
+    expect(lightBlock).toContain(`--primary: ${source};`)
+    expect(lightBlock).toContain(`--ring: ${source};`)
+    expect(darkBlock).toContain(`--primary: ${lifted};`)
+    expect(darkBlock).toContain(`--ring: ${lifted};`)
+    expect(darkBlock).not.toContain(`--ring: ${source};`)
+  })
+
+  it('flips dark-mode button text dark when white fails on the lifted tone', () => {
+    const css = buildBrandVarsCss({ brandColor: DARK_GREEN, chromeColor: null })!
+    const [lightBlock, darkBlock] = css.split('html[data-brand].dark')
+    // Light theme keeps the gate's guarantee: white on the stored color.
+    expect(lightBlock).toContain('--primary-foreground: 0 0% 100%;')
+    // Lifted light green cannot carry white button text.
+    expect(darkBlock.split('.bg-frame')[0]).toContain('--primary-foreground: 0 0% 10%;')
+  })
+
+  it('keeps a light-enough brand color unchanged in dark mode (as today)', () => {
+    const css = buildBrandVarsCss({ brandColor: ACCESSIBLE_BLUE, chromeColor: null })!
+    const darkBlock = css.split('html[data-brand].dark')[1].split('.bg-frame')[0]
+    const brandTriplet = hexToHslTriplet(ACCESSIBLE_BLUE)
+    expect(darkBlock).toContain(`--primary: ${brandTriplet};`)
+    expect(darkBlock).toContain(`--ring: ${brandTriplet};`)
+    expect(darkBlock).toContain('--primary-foreground: 0 0% 100%;')
+  })
+
+  it('scopes deep-chrome tokens to the mobile bottom nav', () => {
+    const css = buildBrandVarsCss({ brandColor: ACCESSIBLE_BLUE, chromeColor: null })!
+    expect(css).toContain('html[data-brand] nav[data-mobile-nav] {')
+    const navBlock = css.split('nav[data-mobile-nav]')[1]
+    const chromeTriplet = hexToHslTriplet(deriveChromeColor(ACCESSIBLE_BLUE))
+    // The bar renders on --card with --border hairlines: chrome tone + the
+    // same calibrated light text as the sidebar.
+    expect(navBlock).toContain(`--card: ${chromeTriplet};`)
+    expect(navBlock).toContain('--muted-foreground: 0 0% 75%;')
+    expect(navBlock).toContain('--primary: 0 0% 98%;')
+    expect(navBlock).toContain(`--primary-foreground: ${chromeTriplet};`)
+    expect(navBlock).toContain('--border: ')
+  })
+
+  it('fails open (null) when the brand color fails the accessibility gate', () => {
+    expect(
+      buildBrandVarsCss({ brandColor: INACCESSIBLE_YELLOW, chromeColor: null }),
+    ).toBeNull()
+  })
+
+  it('fails open (null) on invalid brand or chrome hex', () => {
+    expect(buildBrandVarsCss({ brandColor: 'not-a-color', chromeColor: null })).toBeNull()
+    expect(buildBrandVarsCss({ brandColor: '#12345', chromeColor: null })).toBeNull()
+    expect(
+      buildBrandVarsCss({ brandColor: ACCESSIBLE_BLUE, chromeColor: 'nonsense' }),
+    ).toBeNull()
+  })
+})
diff --git a/lib/branding/__tests__/fonts.test.ts b/lib/branding/__tests__/fonts.test.ts
new file mode 100644
index 00000000..226ba0ba
--- /dev/null
+++ b/lib/branding/__tests__/fonts.test.ts
@@ -0,0 +1,33 @@
+import { describe, it, expect } from 'vitest'
+import { getBrandFontPair, DEFAULT_FONT_KEY } from '@/lib/branding/fonts'
+
+describe('getBrandFontPair', () => {
+  it('returns null for the default key (no per-request override)', () => {
+    expect(getBrandFontPair(DEFAULT_FONT_KEY)).toBeNull()
+  })
+
+  it('falls back to the default pair for unknown keys', () => {
+    expect(getBrandFontPair('comic-sans')).toBeNull()
+    expect(getBrandFontPair('')).toBeNull()
+  })
+
+  it('resolves each curated menu entry to a serif display + sans body pair', () => {
+    expect(getBrandFontPair('lora')).toEqual({
+      display: 'var(--font-lora), Georgia, serif',
+      body: 'var(--font-source-sans), system-ui, sans-serif',
+    })
+    expect(getBrandFontPair('fraunces')).toEqual({
+      display: 'var(--font-fraunces), Georgia, serif',
+      body: 'var(--font-work-sans), system-ui, sans-serif',
+    })
+    expect(getBrandFontPair('playfair')).toEqual({
+      display: 'var(--font-playfair), Georgia, serif',
+      body: 'var(--font-public-sans), system-ui, sans-serif',
+    })
+  })
+
+  it('is not fooled by Object prototype property names', () => {
+    expect(getBrandFontPair('toString')).toBeNull()
+    expect(getBrandFontPair('hasOwnProperty')).toBeNull()
+  })
+})
diff --git a/lib/branding/__tests__/public-brand.test.ts b/lib/branding/__tests__/public-brand.test.ts
new file mode 100644
index 00000000..72a94f43
--- /dev/null
+++ b/lib/branding/__tests__/public-brand.test.ts
@@ -0,0 +1,85 @@
+import { describe, it, expect } from 'vitest'
+import { getBranding } from '@/lib/branding/service'
+import {
+  toPublicBrand,
+  mergeClientBranding,
+  type PublicBrand,
+} from '@/lib/branding/public-brand'
+import type { Brand } from '@/lib/branding/resolve'
+
+const fullBrand: Brand = {
+  id: 'brand-1',
+  teamId: 'team-1',
+  domain: 'app.siffra.se',
+  appName: 'Siffra',
+  logoUrl: 'https://cdn.example.com/storage/v1/object/public/brand-logos/siffra.png',
+  brandColor: '#2563eb',
+  chromeColor: null,
+  fontKey: 'default',
+  supportEmail: 'support@siffra.se',
+  authEmailFrom: null,
+  senderDomain: 'mail.siffra.se',
+  senderDomainStatus: 'verified',
+  resendDomainId: 'rd_123',
+}
+
+describe('toPublicBrand', () => {
+  it('keeps only the client-safe fields', () => {
+    const pub = toPublicBrand(fullBrand)
+    expect(pub).toEqual({
+      appName: 'Siffra',
+      logoUrl: fullBrand.logoUrl,
+      supportEmail: 'support@siffra.se',
+      authEmailFrom: null,
+      brandColor: '#2563eb',
+      fontKey: 'default',
+      domain: 'app.siffra.se',
+    })
+    // Ops-internal email plumbing must never cross to the client bundle.
+    expect(pub).not.toHaveProperty('senderDomain')
+    expect(pub).not.toHaveProperty('senderDomainStatus')
+    expect(pub).not.toHaveProperty('resendDomainId')
+    expect(pub).not.toHaveProperty('teamId')
+  })
+})
+
+describe('mergeClientBranding', () => {
+  const base = getBranding()
+
+  it('returns plain getBranding() values when there is no brand (the additive guarantee)', () => {
+    const merged = mergeClientBranding(base, null)
+    expect(merged.brand).toBeNull()
+    expect(merged.logoUrl).toBeNull()
+    // Every base field passes through untouched.
+    expect(merged).toMatchObject(base)
+    expect(merged.appName).toBe(base.appName)
+    expect(merged.supportEmail).toBe(base.supportEmail)
+    expect(merged.authEmailFrom).toBe(base.authEmailFrom)
+    expect(merged.themeColor).toBe(base.themeColor)
+    expect(merged.logoPath).toBe(base.logoPath)
+  })
+
+  it('layers brand values over the defaults when a brand is active', () => {
+    const pub = toPublicBrand(fullBrand)
+    const merged = mergeClientBranding(base, pub)
+    expect(merged.appName).toBe('Siffra')
+    expect(merged.supportEmail).toBe('support@siffra.se')
+    expect(merged.themeColor).toBe('#2563eb')
+    expect(merged.logoUrl).toBe(fullBrand.logoUrl)
+    expect(merged.brand).toEqual(pub)
+    // Untouched defaults survive the merge.
+    expect(merged.logoPath).toBe(base.logoPath)
+    expect(merged.appDescription).toBe(base.appDescription)
+  })
+
+  it('falls back to the default authEmailFrom when the brand has none', () => {
+    const withoutAuthFrom: PublicBrand = { ...toPublicBrand(fullBrand), authEmailFrom: null }
+    expect(mergeClientBranding(base, withoutAuthFrom).authEmailFrom).toBe(base.authEmailFrom)
+
+    const withAuthFrom: PublicBrand = {
+      ...toPublicBrand(fullBrand),
+      authEmailFrom: 'noreply@siffra.se',
+    }
+    expect(mergeClientBranding(base, withAuthFrom).authEmailFrom).toBe('noreply@siffra.se')
+  })
+})
diff --git a/lib/branding/__tests__/resolve.test.ts b/lib/branding/__tests__/resolve.test.ts
new file mode 100644
index 00000000..8f856323
--- /dev/null
+++ b/lib/branding/__tests__/resolve.test.ts
@@ -0,0 +1,235 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { createQueuedMockSupabase } from '@/tests/helpers'
+
+// Holder assigned in beforeEach; the mock factory closes over it so each test
+// gets a fresh queued client without re-mocking the module.
+const serviceClient = vi.hoisted(() => ({ current: null as unknown }))
+
+vi.mock('@/lib/auth/api-keys', () => ({
+  createServiceClientNoCookies: vi.fn(() => serviceClient.current),
+}))
+
+import {
+  resolveBrandByHost,
+  resolveBrandForCompany,
+  deriveChromeColor,
+  getEffectiveChrome,
+  isBrandColorAccessible,
+  normalizeHost,
+  clearBrandCache,
+} from '@/lib/branding/resolve'
+
+const brandRow = {
+  id: 'brand-1',
+  team_id: 'team-1',
+  domain: 'app.siffra.se',
+  app_name: 'Siffra',
+  logo_url: null,
+  favicon_url: null,
+  brand_color: '#2563eb',
+  chrome_color: null,
+  font_key: 'default',
+  support_email: 'support@siffra.se',
+  auth_email_from: null,
+  sender_domain: null,
+  sender_domain_status: 'unverified',
+  resend_domain_id: null,
+}
+
+let mock: ReturnType<typeof createQueuedMockSupabase>
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  clearBrandCache()
+  mock = createQueuedMockSupabase()
+  serviceClient.current = mock.supabase
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('normalizeHost', () => {
+  it('lowercases and strips port and trailing dot', () => {
+    expect(normalizeHost('APP.SIFFRA.SE:3000')).toBe('app.siffra.se')
+    expect(normalizeHost(' app.siffra.se. ')).toBe('app.siffra.se')
+    expect(normalizeHost('app.siffra.se')).toBe('app.siffra.se')
+  })
+})
+
+describe('resolveBrandByHost', () => {
+  it('resolves a brand row and maps it to the camelCase Brand shape', async () => {
+    mock.enqueue({ data: brandRow })
+
+    const brand = await resolveBrandByHost('app.siffra.se')
+
+    expect(brand).toEqual({
+      id: 'brand-1',
+      teamId: 'team-1',
+      domain: 'app.siffra.se',
+      appName: 'Siffra',
+      logoUrl: null,
+      faviconUrl: null,
+      brandColor: '#2563eb',
+      chromeColor: null,
+      fontKey: 'default',
+      supportEmail: 'support@siffra.se',
+      authEmailFrom: null,
+      senderDomain: null,
+      senderDomainStatus: 'unverified',
+      resendDomainId: null,
+    })
+    expect(mock.findCall('brands', 'eq')).toEqual(['domain', 'app.siffra.se'])
+  })
+
+  it('normalizes the host before lookup and shares the cache entry across variants', async () => {
+    mock.enqueue({ data: brandRow })
+
+    const first = await resolveBrandByHost('APP.SIFFRA.SE:3000')
+    expect(first?.domain).toBe('app.siffra.se')
+    expect(mock.findCall('brands', 'eq')).toEqual(['domain', 'app.siffra.se'])
+
+    const second = await resolveBrandByHost('app.siffra.se')
+    expect(second?.id).toBe('brand-1')
+    // Cache hit: only the first call reached the database.
+    expect(mock.supabase.from).toHaveBeenCalledTimes(1)
+  })
+
+  it('returns null for unknown hosts and caches the miss', async () => {
+    mock.enqueue({ data: null })
+
+    expect(await resolveBrandByHost('app.gnubok.se')).toBeNull()
+    expect(await resolveBrandByHost('app.gnubok.se')).toBeNull()
+    expect(mock.supabase.from).toHaveBeenCalledTimes(1)
+  })
+
+  it('returns null without touching the database for an empty host', async () => {
+    expect(await resolveBrandByHost('')).toBeNull()
+    expect(mock.supabase.from).not.toHaveBeenCalled()
+  })
+
+  it('expires cache entries after the TTL', async () => {
+    vi.useFakeTimers()
+    mock.enqueueMany([{ data: brandRow }, { data: brandRow }])
+
+    await resolveBrandByHost('app.siffra.se')
+    vi.advanceTimersByTime(59_000)
+    await resolveBrandByHost('app.siffra.se')
+    expect(mock.supabase.from).toHaveBeenCalledTimes(1)
+
+    vi.advanceTimersByTime(2_000)
+    await resolveBrandByHost('app.siffra.se')
+    expect(mock.supabase.from).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not cache a query error, so the next call retries', async () => {
+    mock.enqueue({ data: null, error: { message: 'boom' } })
+
+    expect(await resolveBrandByHost('app.siffra.se')).toBeNull()
+
+    mock.enqueue({ data: brandRow })
+    const brand = await resolveBrandByHost('app.siffra.se')
+    expect(brand?.id).toBe('brand-1')
+    expect(mock.supabase.from).toHaveBeenCalledTimes(2)
+  })
+})
+
+describe('resolveBrandForCompany', () => {
+  it('resolves companies.team_id -> brands.team_id', async () => {
+    mock.enqueueMany([{ data: { team_id: 'team-1' } }, { data: brandRow }])
+
+    const brand = await resolveBrandForCompany('company-1')
+
+    expect(brand?.teamId).toBe('team-1')
+    expect(mock.findCall('companies', 'eq')).toEqual(['id', 'company-1'])
+    expect(mock.findCall('brands', 'eq')).toEqual(['team_id', 'team-1'])
+  })
+
+  it('returns null and caches when the company has no team', async () => {
+    mock.enqueue({ data: { team_id: null } })
+
+    expect(await resolveBrandForCompany('company-1')).toBeNull()
+    expect(await resolveBrandForCompany('company-1')).toBeNull()
+    // One from('companies') call total; never reached brands.
+    expect(mock.supabase.from).toHaveBeenCalledTimes(1)
+    expect(mock.findCall('brands', 'eq')).toBeUndefined()
+  })
+
+  it('returns null when the company does not exist', async () => {
+    mock.enqueue({ data: null })
+
+    expect(await resolveBrandForCompany('missing')).toBeNull()
+  })
+
+  it('returns null when the team has no brand, and caches per company key', async () => {
+    mock.enqueueMany([{ data: { team_id: 'team-9' } }, { data: null }])
+
+    expect(await resolveBrandForCompany('company-9')).toBeNull()
+    expect(await resolveBrandForCompany('company-9')).toBeNull()
+    expect(mock.supabase.from).toHaveBeenCalledTimes(2)
+  })
+})
+
+describe('deriveChromeColor', () => {
+  it('derives a deterministic deep chrome tone from the brand color', () => {
+    expect(deriveChromeColor('#2563eb')).toBe('#1c263b')
+    expect(deriveChromeColor('#2563eb')).toBe('#1c263b')
+    expect(deriveChromeColor('#dc2626')).toBe('#3b1c1c')
+    expect(deriveChromeColor('#304D83')).toBe('#1c273b')
+  })
+
+  it('keeps near-achromatic brand colors neutral instead of tinting them red', () => {
+    // Pure gray input: saturating to 30% would produce a dark red (hue 0).
+    expect(deriveChromeColor('#1a1a1a')).toBe('#262626')
+  })
+
+  it('always emits a six-digit lowercase hex color', () => {
+    for (const input of ['#ffffff', '#000000', '#00ff00', '#ABCDEF']) {
+      expect(deriveChromeColor(input)).toMatch(/^#[0-9a-f]{6}$/)
+    }
+  })
+
+  it('throws on invalid input (format is CHECK-enforced upstream)', () => {
+    expect(() => deriveChromeColor('blue')).toThrow(/Invalid hex color/)
+  })
+})
+
+describe('getEffectiveChrome', () => {
+  it('prefers the explicit chrome_color override', () => {
+    expect(getEffectiveChrome({ brandColor: '#2563eb', chromeColor: '#101418' })).toBe('#101418')
+  })
+
+  it('derives from the brand color when no override is set', () => {
+    expect(getEffectiveChrome({ brandColor: '#2563eb', chromeColor: null })).toBe('#1c263b')
+  })
+})
+
+describe('isBrandColorAccessible', () => {
+  it('accepts colors where white text clears 4.5:1', () => {
+    expect(isBrandColorAccessible('#1a1a1a')).toBe(true)
+    expect(isBrandColorAccessible('#2563eb')).toBe(true)
+  })
+
+  it('rejects colors where white text fails 4.5:1', () => {
+    expect(isBrandColorAccessible('#ffff00')).toBe(false)
+    expect(isBrandColorAccessible('#ffffff')).toBe(false)
+  })
+
+  it('rejects invalid hex strings instead of throwing', () => {
+    expect(isBrandColorAccessible('blue')).toBe(false)
+    expect(isBrandColorAccessible('#12345')).toBe(false)
+    expect(isBrandColorAccessible('')).toBe(false)
+  })
+})
+
+describe('clearBrandCache', () => {
+  it('forces the next resolution back to the database', async () => {
+    mock.enqueueMany([{ data: brandRow }, { data: brandRow }])
+
+    await resolveBrandByHost('app.siffra.se')
+    clearBrandCache()
+    await resolveBrandByHost('app.siffra.se')
+
+    expect(mock.supabase.from).toHaveBeenCalledTimes(2)
+  })
+})
diff --git a/lib/branding/brand-context.tsx b/lib/branding/brand-context.tsx
new file mode 100644
index 00000000..3bcb4c41
--- /dev/null
+++ b/lib/branding/brand-context.tsx
@@ -0,0 +1,44 @@
+'use client'
+
+/**
+ * Per-request brand context (WL-12 slice A2).
+ *
+ * The root layout resolves the brand from the request host and provides its
+ * client-safe subset here. `useBranding()` is the client-side migration
+ * target for `getBranding()` call sites: it returns the brand merged over the
+ * sync defaults, and plain `getBranding()` values when the host has no brand,
+ * so an un-migrated call site and a migrated one agree on default hosts.
+ *
+ * Server components do not use this: they call `resolveBrandByHost()` (or the
+ * layout's already-resolved brand) directly.
+ */
+
+import { createContext, useContext, useMemo, type ReactNode } from 'react'
+import { getBranding } from './service'
+import {
+  mergeClientBranding,
+  type ClientBranding,
+  type PublicBrand,
+} from './public-brand'
+
+const BrandContext = createContext<PublicBrand | null>(null)
+
+export function BrandProvider({
+  brand,
+  children,
+}: {
+  brand: PublicBrand | null
+  children: ReactNode
+}) {
+  return <BrandContext.Provider value={brand}>{children}</BrandContext.Provider>
+}
+
+/**
+ * The active branding for client components: per-request brand values merged
+ * over `getBranding()` defaults, falling back to plain defaults when the
+ * request host serves no brand.
+ */
+export function useBranding(): ClientBranding {
+  const brand = useContext(BrandContext)
+  return useMemo(() => mergeClientBranding(getBranding(), brand), [brand])
+}
diff --git a/lib/branding/brand-style.ts b/lib/branding/brand-style.ts
new file mode 100644
index 00000000..b6f5a0f2
--- /dev/null
+++ b/lib/branding/brand-style.ts
@@ -0,0 +1,211 @@
+/**
+ * Brand style block builder (WL-12 slice A2).
+ *
+ * Pure functions that turn a brand's colors into the server-rendered
+ * <style id="brand-vars"> block the root layout injects on branded hosts.
+ * Kept free of rendering so the triplet conversion and the block builder
+ * are unit-testable in plain node.
+ *
+ * How the block wins over app/globals.css in both themes:
+ *
+ *   - globals.css declares the light theme on `:root` (0,1,0) and the dark
+ *     theme on `.dark` (0,1,0); the user palettes add `:root[data-palette]` /
+ *     `.dark[data-palette]` at (0,2,0).
+ *   - the layout stamps `data-brand` on <html> only when a brand renders, so
+ *     `html[data-brand]:not(.dark)` and `html[data-brand].dark` are (0,2,1):
+ *     they beat every one of the above in their own mode without relying on
+ *     stylesheet order.
+ *   - the sidebar block defines variables directly ON the sidebar element
+ *     (`.bg-frame > aside`), and element-level custom properties always beat
+ *     inherited ones, whatever the specificity of the root declarations.
+ *
+ * No brand (or a brand whose color fails the accessibility gate) means the
+ * layout renders no block and no `data-brand` attribute at all: the additive
+ * guarantee (default hosts stay byte-identical) lives in the callers, and the
+ * fail-open path lives here as a `null` return.
+ */
+
+import { getContrastRatio } from '@/lib/invoices/contrast-check'
+import { getEffectiveChrome, hslToHex, isBrandColorAccessible, type Brand } from './resolve'
+
+const HEX_COLOR_RE = /^#[0-9A-Fa-f]{6}$/
+
+interface Hsl {
+  h: number
+  s: number
+  l: number
+}
+
+function hexToHsl(hex: string): Hsl | null {
+  if (typeof hex !== 'string') return null
+  const trimmed = hex.trim()
+  if (!HEX_COLOR_RE.test(trimmed)) return null
+  const value = trimmed.slice(1)
+  const r = parseInt(value.slice(0, 2), 16) / 255
+  const g = parseInt(value.slice(2, 4), 16) / 255
+  const b = parseInt(value.slice(4, 6), 16) / 255
+
+  const max = Math.max(r, g, b)
+  const min = Math.min(r, g, b)
+  const l = (max + min) / 2
+  const d = max - min
+
+  let h = 0
+  let s = 0
+  if (d !== 0) {
+    s = d / (1 - Math.abs(2 * l - 1))
+    if (max === r) h = ((g - b) / d) % 6
+    else if (max === g) h = (b - r) / d + 2
+    else h = (r - g) / d + 4
+    h *= 60
+    if (h < 0) h += 360
+  }
+
+  return { h, s, l }
+}
+
+/** Format an HSL value in the space-separated triplet globals.css uses. */
+function formatTriplet(hsl: Hsl): string {
+  const h = Math.round(hsl.h) % 360
+  const s = Math.round(hsl.s * 100)
+  const l = Math.round(hsl.l * 100)
+  return `${h} ${s}% ${l}%`
+}
+
+/**
+ * Convert a `#rrggbb` hex color to the `H S% L%` triplet format the theme
+ * variables in app/globals.css use (e.g. `#2563eb` -> `221 83% 53%`).
+ * Returns null for anything that is not a 6-digit hex color.
+ */
+export function hexToHslTriplet(hex: string): string | null {
+  const hsl = hexToHsl(hex)
+  return hsl ? formatTriplet(hsl) : null
+}
+
+// Sidebar tokens on deep chrome (WL-02 round 2: deep-branded chrome needs
+// light sidebar text). The sidebar consumes --foreground, --muted-foreground,
+// --primary (active items), --primary-foreground, --secondary (hover/active
+// chips), --muted (count badges) and --border (trial box, hairlines); this is
+// the minimal set that keeps it readable on the deep tone. Lightness values
+// are fixed (not relative to the chrome) so any tone inside the derivation
+// bounds (L 15-17%) gets the same calibrated lift; hue and saturation follow
+// the chrome so the chips read as the same material. A light chrome override
+// would break this contract, which is why the onboarding gate (WL-02) rejects
+// it there instead of us auto-correcting at render time.
+const SIDEBAR_FOREGROUND = '0 0% 98%'
+const SIDEBAR_MUTED_FOREGROUND = '0 0% 75%'
+const SIDEBAR_SECONDARY_LIGHTNESS = 0.28
+const SIDEBAR_MUTED_LIGHTNESS = 0.26
+const SIDEBAR_BORDER_LIGHTNESS = 0.3
+const SIDEBAR_SATURATION_MAX = 0.35
+
+// Dark-mode ring/primary lift (WL-02 gap fix). Every accessible brand color
+// is fairly dark (the white-text 4.5:1 gate demands it), and a LOW-lightness
+// one (below ~45%) disappears against dark surfaces: invisible focus rings,
+// murky primary buttons. The dark theme therefore lifts such colors to a
+// lighter variant of the same hue (~62%, inside the 60-65% band the WL-02
+// prototype used for its dark-mode brand variants). Colors at or above the
+// threshold keep their stored value in dark mode, exactly as before.
+const DARK_LIFT_LIGHTNESS_THRESHOLD = 0.45
+const DARK_LIFT_TARGET_LIGHTNESS = 0.62
+
+/** The brand tone the DARK theme renders: lifted when the source is dark. */
+function darkModeBrandHsl(brandHsl: Hsl): Hsl {
+  if (brandHsl.l >= DARK_LIFT_LIGHTNESS_THRESHOLD) return brandHsl
+  return { ...brandHsl, l: DARK_LIFT_TARGET_LIGHTNESS }
+}
+
+/**
+ * Build the CSS text for the `<style id="brand-vars">` block: brand primary +
+ * ring + deep chrome frame in both the light and dark theme, plus the
+ * sidebar-scoped light-text tokens. Returns null (fail open to the default
+ * theme) when the brand color fails the WCAG gate or any color is not valid
+ * hex; the caller logs and renders without the block.
+ */
+export function buildBrandVarsCss(brand: Pick<Brand, 'brandColor' | 'chromeColor'>): string | null {
+  const brandHsl = hexToHsl(brand.brandColor)
+  if (!brandHsl) return null
+  if (!isBrandColorAccessible(brand.brandColor)) return null
+
+  const chromeHsl = hexToHsl(getEffectiveChrome(brand))
+  if (!chromeHsl) return null
+
+  const brandTriplet = formatTriplet(brandHsl)
+  const chromeTriplet = formatTriplet(chromeHsl)
+
+  const sidebarSaturation = Math.min(chromeHsl.s, SIDEBAR_SATURATION_MAX)
+  const sidebarTone = (lightness: number) =>
+    formatTriplet({ h: chromeHsl.h, s: sidebarSaturation, l: lightness })
+
+  // The gate guarantees 4.5:1 for white on the brand color, so
+  // --primary-foreground is white in the light theme.
+  const brandVars = [
+    `  --primary: ${brandTriplet};`,
+    '  --primary-foreground: 0 0% 100%;',
+    `  --ring: ${brandTriplet};`,
+    `  --frame: ${chromeTriplet};`,
+  ].join('\n')
+
+  // Dark theme: a dark brand color is lifted (darkModeBrandHsl) so rings and
+  // primary buttons stay visible on dark surfaces. The white-text guarantee
+  // only holds for the STORED color; the lifted tone may need dark button
+  // text instead, so the foreground follows the same contrast math as the
+  // onboarding gate.
+  const darkHsl = darkModeBrandHsl(brandHsl)
+  const darkTriplet = formatTriplet(darkHsl)
+  const darkPrimaryForeground =
+    getContrastRatio('#ffffff', hslToHex(darkHsl.h, darkHsl.s, darkHsl.l)) >= 4.5
+      ? '0 0% 100%'
+      : '0 0% 10%'
+  const darkBrandVars = [
+    `  --primary: ${darkTriplet};`,
+    `  --primary-foreground: ${darkPrimaryForeground};`,
+    `  --ring: ${darkTriplet};`,
+    `  --frame: ${chromeTriplet};`,
+  ].join('\n')
+
+  const sidebarVars = [
+    `  --foreground: ${SIDEBAR_FOREGROUND};`,
+    `  --muted-foreground: ${SIDEBAR_MUTED_FOREGROUND};`,
+    `  --primary: ${SIDEBAR_FOREGROUND};`,
+    `  --primary-foreground: ${chromeTriplet};`,
+    `  --secondary: ${sidebarTone(SIDEBAR_SECONDARY_LIGHTNESS)};`,
+    `  --secondary-foreground: ${SIDEBAR_FOREGROUND};`,
+    `  --muted: ${sidebarTone(SIDEBAR_MUTED_LIGHTNESS)};`,
+    `  --border: ${sidebarTone(SIDEBAR_BORDER_LIGHTNESS)};`,
+  ].join('\n')
+
+  // Mobile bottom nav (WL-02 gap fix): mobile keeps the pre-frame layout, so
+  // its chrome is the bottom bar, not the sidebar. Same deep-chrome
+  // treatment: the bar renders on --card with --border hairlines and
+  // --primary accents, so scoping those tokens to the bar re-tints it
+  // exactly like the sidebar. The hook is the data-mobile-nav attribute
+  // DashboardNav stamps on the bar (a class would couple this block to
+  // Tailwind utility names).
+  const mobileNavVars = [
+    `  --card: ${chromeTriplet};`,
+    `  --border: ${sidebarTone(SIDEBAR_BORDER_LIGHTNESS)};`,
+    `  --muted-foreground: ${SIDEBAR_MUTED_FOREGROUND};`,
+    `  --primary: ${SIDEBAR_FOREGROUND};`,
+    `  --primary-foreground: ${chromeTriplet};`,
+  ].join('\n')
+
+  // `.bg-frame > aside` is the dashboard sidebar: DashboardNav's <aside> is a
+  // direct child of the frame wrapper in every shell variant of
+  // app/(dashboard)/layout.tsx. `bg-frame` is a locked design-system class
+  // (.claude/rules/design.md), so the selector is stable.
+  return [
+    'html[data-brand]:not(.dark) {',
+    brandVars,
+    '}',
+    'html[data-brand].dark {',
+    darkBrandVars,
+    '}',
+    'html[data-brand] .bg-frame > aside {',
+    sidebarVars,
+    '}',
+    'html[data-brand] nav[data-mobile-nav] {',
+    mobileNavVars,
+    '}',
+  ].join('\n')
+}
diff --git a/lib/branding/fonts.ts b/lib/branding/fonts.ts
new file mode 100644
index 00000000..c4dd3711
--- /dev/null
+++ b/lib/branding/fonts.ts
@@ -0,0 +1,70 @@
+/**
+ * Curated brand font menu (WL-03).
+ *
+ * `next/font` is strictly build-time, so a brand can never bring an arbitrary
+ * font; it picks from this menu via `brands.font_key`. The delivery pattern
+ * (documented in WL-03's research) is zero-client-JS:
+ *
+ *   - every menu font is registered in app/layout.tsx via `next/font` and its
+ *     `.variable` class sits on <html> on every host,
+ *   - the active pair is selected per request by setting `--font-display` /
+ *     `--font-body` as inline style on <html>, which beats the `:root`
+ *     declarations in app/globals.css.
+ *
+ * The menu: `'default'` is Hedvig Letters Serif + Geist, exactly today's
+ * pair, already declared in globals.css. `null` therefore means "no
+ * per-request override", which keeps default hosts byte-identical. The three
+ * curated pairs below (all Google Fonts, OFL) are registered in
+ * app/layout.tsx with `preload: false` (WL-03: only the default pair may
+ * preload; a preloading menu font would be downloaded by every visitor on
+ * every host), so a menu font costs nothing until a brand actually selects
+ * it and the browser resolves its `var()`.
+ *
+ * Adding a menu font is one entry + one registration:
+ *   1. register it in app/layout.tsx via `next/font` with `preload: false`,
+ *   2. append its `.variable` class to the <html> className list there,
+ *   3. add one entry here mapping the new font_key to its variable pair.
+ */
+
+export interface BrandFontPair {
+  /** Value for the `--font-display` CSS variable. */
+  display: string
+  /** Value for the `--font-body` CSS variable. */
+  body: string
+}
+
+export const DEFAULT_FONT_KEY = 'default'
+
+const FONT_MENU: Record<string, BrandFontPair | null> = {
+  [DEFAULT_FONT_KEY]: null,
+  // Lora + Source Sans 3: warm bookish serif over a neutral workhorse sans;
+  // the closest in spirit to the default pair without echoing it.
+  lora: {
+    display: 'var(--font-lora), Georgia, serif',
+    body: 'var(--font-source-sans), system-ui, sans-serif',
+  },
+  // Fraunces + Work Sans: characterful old-style display with a plain
+  // geometric body; the most distinctive of the three.
+  fraunces: {
+    display: 'var(--font-fraunces), Georgia, serif',
+    body: 'var(--font-work-sans), system-ui, sans-serif',
+  },
+  // Playfair Display + Public Sans: high-contrast editorial serif over the
+  // sober USWDS sans; the most formal of the three.
+  playfair: {
+    display: 'var(--font-playfair), Georgia, serif',
+    body: 'var(--font-public-sans), system-ui, sans-serif',
+  },
+}
+
+/**
+ * Resolve a brand's font_key to the CSS variable pair to set on <html>.
+ * Returns null for the default pair and for unknown keys (fail open to the
+ * globals.css defaults; an unknown key must never break rendering).
+ */
+export function getBrandFontPair(fontKey: string): BrandFontPair | null {
+  if (Object.prototype.hasOwnProperty.call(FONT_MENU, fontKey)) {
+    return FONT_MENU[fontKey]
+  }
+  return FONT_MENU[DEFAULT_FONT_KEY]
+}
diff --git a/lib/branding/public-brand.ts b/lib/branding/public-brand.ts
new file mode 100644
index 00000000..4334a1eb
--- /dev/null
+++ b/lib/branding/public-brand.ts
@@ -0,0 +1,69 @@
+/**
+ * Client-safe brand shape + merge logic (WL-12 slice A2).
+ *
+ * The full `Brand` row carries ops-internal email plumbing (Resend domain id,
+ * sender verification state) that has no business in the client bundle. The
+ * root layout converts the resolved brand to this serializable subset before
+ * handing it to the BrandProvider.
+ *
+ * `mergeClientBranding` is the single place where per-request brand values
+ * are layered over the sync `getBranding()` defaults; it is pure so the
+ * fallback behavior is unit-testable without rendering. No brand in, defaults
+ * out untouched: that is the additive guarantee for un-branded hosts.
+ */
+
+import type { BrandingConfig } from './service'
+import type { Brand } from './resolve'
+
+/** Serializable subset of a Brand that may cross to the client. */
+export interface PublicBrand {
+  appName: string
+  logoUrl: string | null
+  supportEmail: string
+  authEmailFrom: string | null
+  brandColor: string
+  fontKey: string
+  domain: string
+}
+
+export function toPublicBrand(brand: Brand): PublicBrand {
+  return {
+    appName: brand.appName,
+    logoUrl: brand.logoUrl,
+    supportEmail: brand.supportEmail,
+    authEmailFrom: brand.authEmailFrom,
+    brandColor: brand.brandColor,
+    fontKey: brand.fontKey,
+    domain: brand.domain,
+  }
+}
+
+export interface ClientBranding extends BrandingConfig {
+  /** Brand logo URL on a branded host; null on default hosts (use logoPath). */
+  logoUrl: string | null
+  /** The per-request brand, or null on default hosts. */
+  brand: PublicBrand | null
+}
+
+/**
+ * Layer the per-request brand over the sync branding defaults. With no brand
+ * every value is exactly `getBranding()`'s (defaults < env < extension), so
+ * un-migrated surfaces and default hosts render exactly as before.
+ */
+export function mergeClientBranding(
+  base: BrandingConfig,
+  brand: PublicBrand | null,
+): ClientBranding {
+  if (!brand) {
+    return { ...base, logoUrl: null, brand: null }
+  }
+  return {
+    ...base,
+    appName: brand.appName,
+    supportEmail: brand.supportEmail,
+    authEmailFrom: brand.authEmailFrom ?? base.authEmailFrom,
+    themeColor: brand.brandColor,
+    logoUrl: brand.logoUrl,
+    brand,
+  }
+}
diff --git a/lib/branding/request-brand.ts b/lib/branding/request-brand.ts
new file mode 100644
index 00000000..ec2a08be
--- /dev/null
+++ b/lib/branding/request-brand.ts
@@ -0,0 +1,50 @@
+import 'server-only'
+
+/**
+ * Request-scoped brand helpers for SERVER components (WL-12 slice A4).
+ *
+ * Server components cannot use the client `useBranding()` hook; they resolve
+ * the brand from the request Host header instead, exactly like the root
+ * layout does. Unknown hosts (the canonical domain included) fall back to
+ * `getBranding()` defaults, which keeps default hosts byte-identical.
+ *
+ * Do NOT import this from client components or from host-less paths
+ * (cron, API-key routes): those use `resolveBrandForCompany()` directly.
+ */
+
+import { headers } from 'next/headers'
+import { getBranding } from './service'
+import { normalizeHost, resolveBrandByHost, type Brand } from './resolve'
+
+/**
+ * Local dev override (WL-17): host-based resolution can never brand
+ * localhost (no brands row exists for it), which made branding untestable in
+ * local dev. Setting BRAND_DEV_DOMAIN=<brands.domain> in .env.local makes
+ * localhost render that brand. Guarded on the literal local hosts, so the
+ * variable can never rebrand a real domain even if it leaks into a deployed
+ * environment. UI-only: the middleware home-domain rule still sees the real
+ * host, so company partitioning stays un-overridden.
+ */
+const LOCAL_DEV_HOSTS = new Set(['localhost', '127.0.0.1'])
+
+/** The brand serving the current request, or null on default/unknown hosts. */
+export async function resolveRequestBrand(): Promise<Brand | null> {
+  const requestHeaders = await headers()
+  const host = requestHeaders.get('host')
+  if (!host) return null
+  const devDomain = process.env.BRAND_DEV_DOMAIN
+  if (devDomain && LOCAL_DEV_HOSTS.has(normalizeHost(host))) {
+    return resolveBrandByHost(devDomain)
+  }
+  return resolveBrandByHost(host)
+}
+
+/**
+ * The app name the current request should display: the request host's brand
+ * name when one exists, else the `getBranding()` default. The server-side
+ * counterpart of `useBranding().appName`.
+ */
+export async function getRequestAppName(): Promise<string> {
+  const brand = await resolveRequestBrand()
+  return brand?.appName ?? getBranding().appName
+}
diff --git a/lib/branding/resolve.ts b/lib/branding/resolve.ts
new file mode 100644
index 00000000..6aaa264d
--- /dev/null
+++ b/lib/branding/resolve.ts
@@ -0,0 +1,338 @@
+/**
+ * Brand resolution for white-label domains.
+ *
+ * Two resolvers against the same small `brands` table (WL-12):
+ *
+ *   - resolveBrandByHost(host):     what the screen shows (root layout reads
+ *                                   the request host)
+ *   - resolveBrandForCompany(id):   what outbound artifacts carry (email
+ *                                   sender identity, mailed links) via
+ *                                   companies.team_id -> brands.team_id,
+ *                                   for cron/API paths that have no host
+ *
+ * Both use the cookieless service client and bypass RLS by design: anonymous
+ * visitors on a brand domain need the brand before login. Results are cached
+ * in-memory per key with a short TTL (~60s); ops-assisted onboarding
+ * tolerates that staleness, so there is no invalidation infrastructure in v1.
+ * Unknown hosts and brandless companies resolve to null, cached too, so the
+ * canonical-domain hot path costs one lookup per TTL window; callers fall
+ * back to getBranding() defaults (lib/branding/service.ts).
+ */
+
+import { createServiceClientNoCookies } from '@/lib/auth/api-keys'
+import { getContrastRatio } from '@/lib/invoices/contrast-check'
+
+/** Camelcase mirror of a public.brands row. */
+export interface Brand {
+  id: string
+  teamId: string
+  domain: string
+  appName: string
+  logoUrl: string | null
+  /** Square tab icon; the layout prefers it over logoUrl for rel="icon". */
+  faviconUrl: string | null
+  brandColor: string
+  chromeColor: string | null
+  fontKey: string
+  supportEmail: string
+  authEmailFrom: string | null
+  senderDomain: string | null
+  senderDomainStatus: 'unverified' | 'pending' | 'verified' | 'failed'
+  resendDomainId: string | null
+}
+
+interface BrandRow {
+  id: string
+  team_id: string
+  domain: string
+  app_name: string
+  logo_url: string | null
+  favicon_url: string | null
+  brand_color: string
+  chrome_color: string | null
+  font_key: string
+  support_email: string
+  auth_email_from: string | null
+  sender_domain: string | null
+  sender_domain_status: string
+  resend_domain_id: string | null
+}
+
+function mapRow(row: BrandRow): Brand {
+  return {
+    id: row.id,
+    teamId: row.team_id,
+    domain: row.domain,
+    appName: row.app_name,
+    logoUrl: row.logo_url,
+    faviconUrl: row.favicon_url ?? null,
+    brandColor: row.brand_color,
+    chromeColor: row.chrome_color,
+    fontKey: row.font_key,
+    supportEmail: row.support_email,
+    authEmailFrom: row.auth_email_from,
+    senderDomain: row.sender_domain,
+    senderDomainStatus: row.sender_domain_status as Brand['senderDomainStatus'],
+    resendDomainId: row.resend_domain_id,
+  }
+}
+
+// ============================================================
+// In-memory TTL cache (module-level; no external deps)
+// ============================================================
+
+const CACHE_TTL_MS = 60_000
+
+interface CacheEntry {
+  value: Brand | null
+  expiresAt: number
+}
+
+const cache = new Map<string, CacheEntry>()
+
+function readCache(key: string): CacheEntry | undefined {
+  const entry = cache.get(key)
+  if (!entry) return undefined
+  if (entry.expiresAt <= Date.now()) {
+    cache.delete(key)
+    return undefined
+  }
+  return entry
+}
+
+function writeCache(key: string, value: Brand | null): void {
+  cache.set(key, { value, expiresAt: Date.now() + CACHE_TTL_MS })
+}
+
+/** Test hook: drop every cached resolution. */
+export function clearBrandCache(): void {
+  cache.clear()
+}
+
+// ============================================================
+// Resolvers
+// ============================================================
+
+/**
+ * Normalize a Host header value to the shape stored in brands.domain:
+ * lowercase hostname, no port, no trailing dot.
+ */
+export function normalizeHost(host: string): string {
+  let h = host.trim().toLowerCase()
+  const colon = h.indexOf(':')
+  if (colon !== -1) h = h.slice(0, colon)
+  return h.replace(/\.+$/, '')
+}
+
+/**
+ * Look up the brand serving `host`. Null for unknown hosts (the canonical
+ * domain included): callers fall back to getBranding() defaults, which keeps
+ * the additive guarantee (unknown host = default Accounted, bit for bit).
+ */
+export async function resolveBrandByHost(host: string): Promise<Brand | null> {
+  const normalized = normalizeHost(host)
+  if (!normalized) return null
+
+  const key = `host:${normalized}`
+  const hit = readCache(key)
+  if (hit) return hit.value
+
+  const supabase = createServiceClientNoCookies()
+  const { data, error } = await supabase
+    .from('brands')
+    .select('*')
+    .eq('domain', normalized)
+    .maybeSingle()
+
+  if (error) {
+    // Transient failure: fall back to defaults without caching, so a live
+    // brand is not masked for a whole TTL window by one failed query.
+    return null
+  }
+
+  const brand = data ? mapRow(data as BrandRow) : null
+  writeCache(key, brand)
+  return brand
+}
+
+/**
+ * Look up the brand a company's outbound artifacts should carry:
+ * companies.team_id -> brands.team_id. Null when the company does not exist,
+ * has no team, or its team has no brand.
+ */
+export async function resolveBrandForCompany(companyId: string): Promise<Brand | null> {
+  if (!companyId) return null
+
+  const key = `company:${companyId}`
+  const hit = readCache(key)
+  if (hit) return hit.value
+
+  const supabase = createServiceClientNoCookies()
+  const { data: company, error: companyError } = await supabase
+    .from('companies')
+    .select('team_id')
+    .eq('id', companyId)
+    .maybeSingle()
+
+  if (companyError) return null
+
+  const teamId = (company as { team_id: string | null } | null)?.team_id ?? null
+  if (!teamId) {
+    writeCache(key, null)
+    return null
+  }
+
+  const { data, error } = await supabase
+    .from('brands')
+    .select('*')
+    .eq('team_id', teamId)
+    .maybeSingle()
+
+  if (error) return null
+
+  const brand = data ? mapRow(data as BrandRow) : null
+  writeCache(key, brand)
+  return brand
+}
+
+/**
+ * Look up the brand owned by a team directly (brands.team_id is unique).
+ * For team-scoped artifacts that concern no single company, e.g. the byrå
+ * team-invite mail. Null when the team has no brand; cached like the other
+ * resolvers.
+ */
+export async function resolveBrandForTeam(teamId: string): Promise<Brand | null> {
+  if (!teamId) return null
+
+  const key = `team:${teamId}`
+  const hit = readCache(key)
+  if (hit) return hit.value
+
+  const supabase = createServiceClientNoCookies()
+  const { data, error } = await supabase
+    .from('brands')
+    .select('*')
+    .eq('team_id', teamId)
+    .maybeSingle()
+
+  if (error) return null
+
+  const brand = data ? mapRow(data as BrandRow) : null
+  writeCache(key, brand)
+  return brand
+}
+
+// ============================================================
+// Chrome derivation (WL-02: config model A standard, C opt-in)
+// ============================================================
+
+const HEX_COLOR_RE = /^#[0-9A-Fa-f]{6}$/
+
+// Deep chrome tone bounds (WL-02 round 2): keep the brand hue, clamp
+// saturation to roughly 30-35% and lightness to roughly 15-17% so the
+// frame/sidebar reads as a deep-branded tone in both light and dark mode.
+const CHROME_SATURATION_MIN = 0.3
+const CHROME_SATURATION_MAX = 0.35
+const CHROME_LIGHTNESS_MIN = 0.15
+const CHROME_LIGHTNESS_MAX = 0.17
+
+// Below this saturation the hue carries no real information (HSL reports
+// hue 0 for pure grays); boosting saturation would tint a neutral brand
+// red-ish, so near-achromatic brand colors keep their neutrality.
+const ACHROMATIC_SATURATION_THRESHOLD = 0.05
+
+function clamp(value: number, min: number, max: number): number {
+  return Math.min(Math.max(value, min), max)
+}
+
+function hexToHsl(hex: string): { h: number; s: number; l: number } {
+  const m = HEX_COLOR_RE.exec(hex.trim())
+  if (!m) throw new Error(`Invalid hex color: ${hex}`)
+  const value = m[0].slice(1)
+  const r = parseInt(value.slice(0, 2), 16) / 255
+  const g = parseInt(value.slice(2, 4), 16) / 255
+  const b = parseInt(value.slice(4, 6), 16) / 255
+
+  const max = Math.max(r, g, b)
+  const min = Math.min(r, g, b)
+  const l = (max + min) / 2
+  const d = max - min
+
+  let h = 0
+  let s = 0
+  if (d !== 0) {
+    s = d / (1 - Math.abs(2 * l - 1))
+    if (max === r) h = ((g - b) / d) % 6
+    else if (max === g) h = (b - r) / d + 2
+    else h = (r - g) / d + 4
+    h *= 60
+    if (h < 0) h += 360
+  }
+
+  return { h, s, l }
+}
+
+/** HSL (h in degrees, s/l as 0-1 fractions) to `#rrggbb`. Exported for the
+ * brand style block's dark-mode contrast check (lib/branding/brand-style.ts). */
+export function hslToHex(h: number, s: number, l: number): string {
+  const c = (1 - Math.abs(2 * l - 1)) * s
+  const hp = h / 60
+  const x = c * (1 - Math.abs((hp % 2) - 1))
+
+  let r1 = 0
+  let g1 = 0
+  let b1 = 0
+  if (hp < 1) [r1, g1] = [c, x]
+  else if (hp < 2) [r1, g1] = [x, c]
+  else if (hp < 3) [g1, b1] = [c, x]
+  else if (hp < 4) [g1, b1] = [x, c]
+  else if (hp < 5) [r1, b1] = [x, c]
+  else [r1, b1] = [c, x]
+
+  const m = l - c / 2
+  const toHex = (v: number) =>
+    Math.round((v + m) * 255)
+      .toString(16)
+      .padStart(2, '0')
+  return `#${toHex(r1)}${toHex(g1)}${toHex(b1)}`
+}
+
+/**
+ * Derive the deep chrome tone from the brand color: same hue, saturation
+ * clamped to [30%, 35%], lightness clamped to [15%, 17%]. Deterministic.
+ * Near-achromatic inputs stay achromatic (a gray brand gets a neutral dark
+ * gray chrome, not a red tint).
+ */
+export function deriveChromeColor(brandColorHex: string): string {
+  const { h, s, l } = hexToHsl(brandColorHex)
+  const chromeS =
+    s < ACHROMATIC_SATURATION_THRESHOLD
+      ? s
+      : clamp(s, CHROME_SATURATION_MIN, CHROME_SATURATION_MAX)
+  const chromeL = clamp(l, CHROME_LIGHTNESS_MIN, CHROME_LIGHTNESS_MAX)
+  return hslToHex(h, chromeS, chromeL)
+}
+
+/**
+ * The chrome color a brand actually renders with: the explicit ops override
+ * when set, else the tone derived from the brand color.
+ */
+export function getEffectiveChrome(brand: Pick<Brand, 'brandColor' | 'chromeColor'>): string {
+  return brand.chromeColor ?? deriveChromeColor(brand.brandColor)
+}
+
+// ============================================================
+// Contrast guardrail (WL-02: reuse the invoice-branding check)
+// ============================================================
+
+/**
+ * Whether white text on the brand color clears WCAG 2.2 AA for normal text
+ * (4.5:1), i.e. the color is usable as a primary button background. Reuses
+ * the invoice-branding contrast math (lib/invoices/contrast-check.ts).
+ * Invalid hex input returns false rather than throwing: the gate rejects,
+ * it never crashes onboarding.
+ */
+export function isBrandColorAccessible(hex: string): boolean {
+  if (!HEX_COLOR_RE.test(hex.trim())) return false
+  return getContrastRatio('#ffffff', hex.trim()) >= 4.5
+}
diff --git a/lib/branding/team-brands.ts b/lib/branding/team-brands.ts
new file mode 100644
index 00000000..41a1371c
--- /dev/null
+++ b/lib/branding/team-brands.ts
@@ -0,0 +1,88 @@
+/**
+ * Batched brand lookup per team, for the home-domain rule (WL-01).
+ *
+ * The dashboard layout needs "does team X have a brand, and on which domain"
+ * for every company the user belongs to, in one round trip: looping
+ * resolveBrandForCompany would cost 2 queries per company on a cold cache.
+ * Like lib/branding/resolve.ts this uses the cookieless service client and
+ * bypasses RLS BY DESIGN: an end client (Kalle) is not a member of the byrå
+ * team, so RLS would hide the brand row he needs for his "hanteras via
+ * app.siffra.se" signpost. Only domain + app name leave this module: no
+ * email identity or color config is exposed to that path.
+ *
+ * Results are cached in-memory per team id with the same ~60s TTL as the
+ * resolvers; ops-assisted onboarding tolerates that staleness.
+ */
+
+import { createServiceClientNoCookies } from '@/lib/auth/api-keys'
+import type { TeamBrandRef } from '@/lib/company/home-domain'
+
+const CACHE_TTL_MS = 60_000
+
+interface CacheEntry {
+  value: TeamBrandRef | null
+  expiresAt: number
+}
+
+const cache = new Map<string, CacheEntry>()
+
+/** Test hook: drop every cached team brand. */
+export function clearTeamBrandCache(): void {
+  cache.clear()
+}
+
+/**
+ * Resolve brands for a set of team ids. Returns a map containing ONLY teams
+ * that have a brand; brandless teams are absent (and negatively cached).
+ * On a transient query failure the uncached teams resolve as brandless for
+ * this call, without poisoning the cache: the canonical appearance is the
+ * safe fallback (the additive guarantee).
+ */
+export async function resolveBrandsForTeams(
+  teamIds: Array<string | null | undefined>,
+): Promise<Map<string, TeamBrandRef>> {
+  const now = Date.now()
+  const result = new Map<string, TeamBrandRef>()
+  const misses: string[] = []
+
+  const unique = [...new Set(teamIds.filter((id): id is string => !!id))]
+  for (const teamId of unique) {
+    const entry = cache.get(teamId)
+    if (entry && entry.expiresAt > now) {
+      if (entry.value) result.set(teamId, entry.value)
+      continue
+    }
+    misses.push(teamId)
+  }
+
+  if (misses.length === 0) return result
+
+  const supabase = createServiceClientNoCookies()
+  const { data, error } = await supabase
+    .from('brands')
+    .select('team_id, domain, app_name')
+    .in('team_id', misses)
+
+  if (error) {
+    // Transient failure: treat the misses as brandless for this call only.
+    return result
+  }
+
+  const found = new Map<string, TeamBrandRef>()
+  for (const row of (data ?? []) as Array<{
+    team_id: string
+    domain: string
+    app_name: string
+  }>) {
+    found.set(row.team_id, { domain: row.domain, appName: row.app_name })
+  }
+
+  const expiresAt = Date.now() + CACHE_TTL_MS
+  for (const teamId of misses) {
+    const value = found.get(teamId) ?? null
+    cache.set(teamId, { value, expiresAt })
+    if (value) result.set(teamId, value)
+  }
+
+  return result
+}
diff --git a/lib/byra/__tests__/kpi-aggregate.test.ts b/lib/byra/__tests__/kpi-aggregate.test.ts
new file mode 100644
index 00000000..23b19c1b
--- /dev/null
+++ b/lib/byra/__tests__/kpi-aggregate.test.ts
@@ -0,0 +1,185 @@
+import { describe, it, expect } from 'vitest'
+import {
+  filterBucketsToRange,
+  mergeMonthlySeries,
+  periodsInRange,
+  pickCurrentPeriod,
+  resolvePeriodPreset,
+  resultMargin,
+  sumBuckets,
+  type FiscalPeriodLite,
+  type MonthBucket,
+} from '@/lib/byra/kpi-aggregate'
+
+const bucket = (
+  year: number,
+  month0: number,
+  income = 0,
+  expenses = 0,
+): MonthBucket => ({ year, month0, income, expenses })
+
+const period = (
+  id: string,
+  start: string,
+  end: string,
+  ob: string | null = null,
+): FiscalPeriodLite => ({
+  id,
+  company_id: 'c1',
+  period_start: start,
+  period_end: end,
+  opening_balance_entry_id: ob,
+})
+
+describe('resolvePeriodPreset', () => {
+  const today = new Date(2026, 7, 4) // 2026-08-04
+
+  it('resolves month to the first of the current month', () => {
+    expect(resolvePeriodPreset('month', today).range).toEqual({
+      fromDate: '2026-08-01',
+      toDate: '2026-08-04',
+    })
+  })
+
+  it('resolves quarter to the quarter start', () => {
+    expect(resolvePeriodPreset('quarter', today).range).toEqual({
+      fromDate: '2026-07-01',
+      toDate: '2026-08-04',
+    })
+  })
+
+  it('resolves ytd to January 1', () => {
+    expect(resolvePeriodPreset('ytd', today).range).toEqual({
+      fromDate: '2026-01-01',
+      toDate: '2026-08-04',
+    })
+  })
+
+  it('resolves 12m across the year boundary', () => {
+    expect(resolvePeriodPreset('12m', today).range).toEqual({
+      fromDate: '2025-09-01',
+      toDate: '2026-08-04',
+    })
+  })
+
+  it('falls back to ytd on unknown or missing input', () => {
+    expect(resolvePeriodPreset('bogus', today).preset).toBe('ytd')
+    expect(resolvePeriodPreset(undefined, today).preset).toBe('ytd')
+  })
+
+  it('handles a January today for quarter and 12m', () => {
+    const january = new Date(2026, 0, 15)
+    expect(resolvePeriodPreset('quarter', january).range.fromDate).toBe('2026-01-01')
+    expect(resolvePeriodPreset('12m', january).range.fromDate).toBe('2025-02-01')
+  })
+})
+
+describe('pickCurrentPeriod', () => {
+  const fy25 = period('p25', '2025-01-01', '2025-12-31')
+  const fy26 = period('p26', '2026-01-01', '2026-12-31')
+  const fy27 = period('p27', '2027-01-01', '2027-12-31')
+
+  it('picks the period containing today', () => {
+    expect(pickCurrentPeriod([fy25, fy26, fy27], '2026-08-04')?.id).toBe('p26')
+  })
+
+  it('falls back to the most recent past period', () => {
+    expect(pickCurrentPeriod([fy25, fy26], '2027-06-01')?.id).toBe('p26')
+  })
+
+  it('falls back to the earliest future period when all are ahead', () => {
+    expect(pickCurrentPeriod([fy26, fy27], '2024-06-01')?.id).toBe('p26')
+  })
+
+  it('returns null for no periods', () => {
+    expect(pickCurrentPeriod([], '2026-08-04')).toBeNull()
+  })
+
+  it('prefers the latest start when periods overlap today', () => {
+    const short = period('pShort', '2026-07-01', '2026-12-31')
+    expect(pickCurrentPeriod([fy26, short], '2026-08-04')?.id).toBe('pShort')
+  })
+})
+
+describe('periodsInRange', () => {
+  it('keeps periods overlapping the range and drops the rest', () => {
+    const fy25 = period('p25', '2025-01-01', '2025-12-31')
+    const fy26 = period('p26', '2026-01-01', '2026-12-31')
+    const range = { fromDate: '2025-09-01', toDate: '2026-08-04' }
+    expect(periodsInRange([fy25, fy26], range).map((p) => p.id)).toEqual(['p25', 'p26'])
+    expect(
+      periodsInRange([fy25], { fromDate: '2026-01-01', toDate: '2026-08-04' }),
+    ).toEqual([])
+  })
+})
+
+describe('filterBucketsToRange', () => {
+  it('keeps whole months inside the range, inclusive of partial edge months', () => {
+    const buckets = [
+      bucket(2025, 7),
+      bucket(2025, 8),
+      bucket(2026, 7),
+      bucket(2026, 8),
+    ]
+    const range = { fromDate: '2025-09-01', toDate: '2026-08-04' }
+    expect(filterBucketsToRange(buckets, range)).toEqual([
+      bucket(2025, 8),
+      bucket(2026, 7),
+    ])
+  })
+})
+
+describe('sumBuckets and resultMargin', () => {
+  it('sums revenue, expenses and result with öre rounding', () => {
+    const sums = sumBuckets([
+      bucket(2026, 0, 100.005, 50.004),
+      bucket(2026, 1, 200, 25),
+    ])
+    expect(sums.revenue).toBe(300.01)
+    expect(sums.expenses).toBe(75.0)
+    expect(sums.result).toBe(225.01)
+  })
+
+  it('returns zeros for no buckets', () => {
+    expect(sumBuckets([])).toEqual({ revenue: 0, expenses: 0, result: 0 })
+  })
+
+  it('computes margin in percent and nulls out on zero revenue', () => {
+    expect(resultMargin(200, 50)).toBe(25)
+    expect(resultMargin(300, 100)).toBe(33.33)
+    expect(resultMargin(0, -500)).toBeNull()
+  })
+})
+
+describe('mergeMonthlySeries', () => {
+  it('zero-fills every month of the range and sums across companies', () => {
+    const range = { fromDate: '2026-01-01', toDate: '2026-03-31' }
+    const months = mergeMonthlySeries(
+      [bucket(2026, 0, 100, 40), bucket(2026, 0, 50, 10), bucket(2026, 2, 30, 5)],
+      range,
+    )
+    expect(months).toEqual([
+      { label: 'Jan', income: 150, expenses: 50 },
+      { label: 'Feb', income: 0, expenses: 0 },
+      { label: 'Mar', income: 30, expenses: 5 },
+    ])
+  })
+
+  it('adds a year suffix when the range spans calendar years', () => {
+    const range = { fromDate: '2025-12-01', toDate: '2026-01-31' }
+    const months = mergeMonthlySeries([bucket(2025, 11, 10, 0)], range)
+    expect(months.map((m) => m.label)).toEqual(['Dec 25', 'Jan 26'])
+  })
+
+  it('ignores buckets outside the range', () => {
+    const range = { fromDate: '2026-01-01', toDate: '2026-01-31' }
+    const months = mergeMonthlySeries([bucket(2025, 11, 999, 999)], range)
+    expect(months).toEqual([{ label: 'Jan', income: 0, expenses: 0 }])
+  })
+
+  it('returns empty for an inverted range', () => {
+    expect(
+      mergeMonthlySeries([], { fromDate: '2026-03-01', toDate: '2026-01-31' }),
+    ).toEqual([])
+  })
+})
diff --git a/lib/byra/brand-access.ts b/lib/byra/brand-access.ts
new file mode 100644
index 00000000..a5e195cd
--- /dev/null
+++ b/lib/byra/brand-access.ts
@@ -0,0 +1,41 @@
+import { NextResponse } from 'next/server'
+import { createServiceClient } from '@/lib/supabase/server'
+import { getByraMembership } from '@/lib/clients/fetch-client-overview'
+
+/**
+ * Shared authorization for byrå brand write routes (WL-17).
+ *
+ * brands has no write RLS (rows are ops-managed), so every brand write goes
+ * through the service client behind this explicit owner/admin check on the
+ * caller's byrå team: the same authorization idiom as /api/team/members.
+ */
+
+export interface ByraBrandAccess {
+  teamId: string
+  serviceClient: ReturnType<typeof createServiceClient>
+  errorResponse: NextResponse | null
+}
+
+/** Resolve the caller's byrå team and require owner/admin, or an error response. */
+export async function requireByraBrandAccess(userId: string): Promise<ByraBrandAccess> {
+  const serviceClient = createServiceClient()
+  const membership = await getByraMembership(serviceClient, userId)
+  if (!membership) {
+    return {
+      teamId: '',
+      serviceClient,
+      errorResponse: NextResponse.json({ error: 'Endast för byråteam.' }, { status: 403 }),
+    }
+  }
+  if (membership.role !== 'owner' && membership.role !== 'admin') {
+    return {
+      teamId: membership.teamId,
+      serviceClient,
+      errorResponse: NextResponse.json(
+        { error: 'Endast ägare och administratörer kan ändra varumärket.' },
+        { status: 403 },
+      ),
+    }
+  }
+  return { teamId: membership.teamId, serviceClient, errorResponse: null }
+}
diff --git a/lib/byra/kpi-aggregate.ts b/lib/byra/kpi-aggregate.ts
new file mode 100644
index 00000000..59265ae7
--- /dev/null
+++ b/lib/byra/kpi-aggregate.ts
@@ -0,0 +1,224 @@
+/**
+ * Pure aggregation helpers for the byrå cockpit Nyckeltal page (WL-16).
+ *
+ * The fetch layer (lib/byra/kpi-overview.ts) pulls per-fiscal-period KPI
+ * aggregates for every client company; everything computable without I/O
+ * lives here so it is unit-testable: period-preset resolution, fiscal-period
+ * selection, calendar-month bucket filtering, and the merged cross-client
+ * monthly series for the chart.
+ *
+ * Clients can have different fiscal years, so the cross-client axis is
+ * CALENDAR months (a deliberate v1 choice; see DECISIONS.md). Balance-side
+ * numbers (cash, VAT) are as-of the current fiscal period's activity, never
+ * range-filtered: balances do not decompose over date ranges.
+ */
+
+import { roundOre } from '@/lib/money'
+import type { MonthlyDataPoint } from '@/components/reports/IncomeExpenseChart'
+
+/** Swedish month labels, mirrors MONTH_LABELS in lib/reports/monthly-breakdown.ts
+ *  (not imported: that module pulls server-side report code, and this helper is
+ *  bundled into the client via ByraKpiView). */
+const MONTH_LABELS = [
+  'Jan', 'Feb', 'Mar', 'Apr', 'Maj', 'Jun',
+  'Jul', 'Aug', 'Sep', 'Okt', 'Nov', 'Dec',
+]
+
+export type KpiPeriodPreset = 'month' | 'quarter' | 'ytd' | '12m'
+
+export const KPI_PERIOD_PRESETS: KpiPeriodPreset[] = ['month', 'quarter', 'ytd', '12m']
+
+/** Inclusive ISO date range (yyyy-MM-dd). */
+export interface KpiRange {
+  fromDate: string
+  toDate: string
+}
+
+/** One month of P&L activity for one company (0-based month, JS convention). */
+export interface MonthBucket {
+  year: number
+  month0: number
+  income: number
+  expenses: number
+}
+
+export interface FiscalPeriodLite {
+  id: string
+  company_id: string
+  period_start: string
+  period_end: string
+  opening_balance_entry_id: string | null
+}
+
+function isoDate(year: number, month0: number, day: number): string {
+  return `${year}-${String(month0 + 1).padStart(2, '0')}-${String(day).padStart(2, '0')}`
+}
+
+/** Year and 0-based month straight from the ISO string (timezone-proof). */
+function isoYearMonth0(iso: string): { year: number; month0: number } {
+  return { year: Number(iso.slice(0, 4)), month0: Number(iso.slice(5, 7)) - 1 }
+}
+
+/** Absolute month index for range comparisons. */
+function monthIndex(year: number, month0: number): number {
+  return year * 12 + month0
+}
+
+/**
+ * Resolve the period preset from the URL into a calendar date range ending
+ * today. Unknown or missing values fall back to 'ytd'. `today` is injected
+ * so the resolution is deterministic in tests.
+ */
+export function resolvePeriodPreset(
+  raw: string | undefined,
+  today: Date,
+): { preset: KpiPeriodPreset; range: KpiRange } {
+  const preset: KpiPeriodPreset = (KPI_PERIOD_PRESETS as string[]).includes(raw ?? '')
+    ? (raw as KpiPeriodPreset)
+    : 'ytd'
+
+  const y = today.getFullYear()
+  const m = today.getMonth()
+  const toDate = isoDate(y, m, today.getDate())
+
+  let fromDate: string
+  switch (preset) {
+    case 'month':
+      fromDate = isoDate(y, m, 1)
+      break
+    case 'quarter':
+      fromDate = isoDate(y, Math.floor(m / 3) * 3, 1)
+      break
+    case '12m': {
+      const start = monthIndex(y, m) - 11
+      fromDate = isoDate(Math.floor(start / 12), start % 12, 1)
+      break
+    }
+    case 'ytd':
+      fromDate = isoDate(y, 0, 1)
+      break
+  }
+
+  return { preset, range: { fromDate, toDate } }
+}
+
+/**
+ * The fiscal period whose closing balances represent "now" for a company:
+ * the period containing today (latest start wins if periods overlap), else
+ * the most recent past period, else the earliest future one. Null only when
+ * the company has no periods at all.
+ */
+export function pickCurrentPeriod(
+  periods: FiscalPeriodLite[],
+  todayIso: string,
+): FiscalPeriodLite | null {
+  if (periods.length === 0) return null
+
+  const containing = periods
+    .filter((p) => p.period_start <= todayIso && p.period_end >= todayIso)
+    .sort((a, b) => b.period_start.localeCompare(a.period_start))
+  if (containing.length > 0) return containing[0]
+
+  const past = periods
+    .filter((p) => p.period_end < todayIso)
+    .sort((a, b) => b.period_end.localeCompare(a.period_end))
+  if (past.length > 0) return past[0]
+
+  return [...periods].sort((a, b) => a.period_start.localeCompare(b.period_start))[0]
+}
+
+/** Fiscal periods whose span overlaps the range (inclusive on both ends). */
+export function periodsInRange(
+  periods: FiscalPeriodLite[],
+  range: KpiRange,
+): FiscalPeriodLite[] {
+  return periods.filter(
+    (p) => p.period_start <= range.toDate && p.period_end >= range.fromDate,
+  )
+}
+
+/**
+ * Keep buckets whose calendar month falls inside the range. Month
+ * granularity: a range starting or ending mid-month includes that whole
+ * month's bucket (presets start on month boundaries, and the current month's
+ * bucket only ever contains entries up to today).
+ */
+export function filterBucketsToRange(buckets: MonthBucket[], range: KpiRange): MonthBucket[] {
+  const from = isoYearMonth0(range.fromDate)
+  const to = isoYearMonth0(range.toDate)
+  const fromIdx = monthIndex(from.year, from.month0)
+  const toIdx = monthIndex(to.year, to.month0)
+  return buckets.filter((b) => {
+    const idx = monthIndex(b.year, b.month0)
+    return idx >= fromIdx && idx <= toIdx
+  })
+}
+
+export interface RangeSums {
+  revenue: number
+  expenses: number
+  result: number
+}
+
+/** Sum a company's in-range buckets into revenue/expenses/result. */
+export function sumBuckets(buckets: MonthBucket[]): RangeSums {
+  let income = 0
+  let expenses = 0
+  for (const b of buckets) {
+    income += b.income
+    expenses += b.expenses
+  }
+  const revenue = roundOre(income)
+  const rounded = roundOre(expenses)
+  return { revenue, expenses: rounded, result: roundOre(revenue - rounded) }
+}
+
+/**
+ * Net result margin in percent (two decimals), null when there is no
+ * revenue to divide by. Mirrors the percent idiom in lib/reports/kpi.ts.
+ */
+export function resultMargin(revenue: number, result: number): number | null {
+  if (revenue === 0) return null
+  return Math.round((result / revenue) * 10000) / 100
+}
+
+/**
+ * Merge every selected company's in-range buckets into one chart series:
+ * all months of the range zero-initialized, bucket sums added, Swedish
+ * month labels with a two-digit year suffix when the range spans years.
+ */
+export function mergeMonthlySeries(buckets: MonthBucket[], range: KpiRange): MonthlyDataPoint[] {
+  const from = isoYearMonth0(range.fromDate)
+  const to = isoYearMonth0(range.toDate)
+  const fromIdx = monthIndex(from.year, from.month0)
+  const toIdx = monthIndex(to.year, to.month0)
+  if (toIdx < fromIdx) return []
+
+  const sums = new Map<number, { income: number; expenses: number }>()
+  for (let idx = fromIdx; idx <= toIdx; idx++) {
+    sums.set(idx, { income: 0, expenses: 0 })
+  }
+  for (const b of buckets) {
+    const target = sums.get(monthIndex(b.year, b.month0))
+    if (!target) continue
+    target.income += b.income
+    target.expenses += b.expenses
+  }
+
+  const spansYears = from.year !== to.year
+  const months: MonthlyDataPoint[] = []
+  for (let idx = fromIdx; idx <= toIdx; idx++) {
+    const year = Math.floor(idx / 12)
+    const month0 = idx % 12
+    const label = spansYears
+      ? `${MONTH_LABELS[month0]} ${String(year).slice(-2)}`
+      : MONTH_LABELS[month0]
+    const sum = sums.get(idx)!
+    months.push({
+      label,
+      income: roundOre(sum.income),
+      expenses: roundOre(sum.expenses),
+    })
+  }
+  return months
+}
diff --git a/lib/byra/kpi-overview.ts b/lib/byra/kpi-overview.ts
new file mode 100644
index 00000000..39eacba8
--- /dev/null
+++ b/lib/byra/kpi-overview.ts
@@ -0,0 +1,299 @@
+/**
+ * Byrå cockpit Nyckeltal fetch layer (WL-16): cross-client KPI numbers.
+ *
+ * Read-first like the rest of the cockpit (WL-09): every query is a
+ * cross-membership READ that RLS already allows via user_company_ids().
+ * Per client company the numbers come from the get_kpi_report_aggregates
+ * RPC (SECURITY INVOKER, one SQL pass per fiscal period; the same fast
+ * path the in-company KPI route uses), so nothing here scans journal
+ * lines through PostgREST.
+ *
+ * One RPC call per (company, fiscal period): with the byrå scale this is
+ * designed for (~10 clients, 1-2 periods per range) that is a couple of
+ * dozen parallel round trips. Past ~15 clients the right move is a new
+ * RPC taking uuid[] (see DECISIONS.md).
+ */
+
+import type { SupabaseClient } from '@supabase/supabase-js'
+import { createLogger } from '@/lib/logger'
+import { fetchAllRows } from '@/lib/supabase/fetch-all'
+import {
+  fetchClientOverview,
+  type ClientOverview,
+} from '@/lib/clients/fetch-client-overview'
+import type { ClientDeadline } from '@/lib/clients/aggregate'
+import {
+  fetchKpiAggregates,
+  buildOpeningBalances,
+  buildTrialBalanceRows,
+} from '@/lib/reports/kpi-aggregates'
+import { calculateCashPosition, calculateVatLiability } from '@/lib/reports/kpi'
+import type { MonthlyDataPoint } from '@/components/reports/IncomeExpenseChart'
+import {
+  filterBucketsToRange,
+  mergeMonthlySeries,
+  periodsInRange,
+  pickCurrentPeriod,
+  resolvePeriodPreset,
+  resultMargin,
+  sumBuckets,
+  type FiscalPeriodLite,
+  type KpiPeriodPreset,
+  type KpiRange,
+  type MonthBucket,
+} from '@/lib/byra/kpi-aggregate'
+
+const log = createLogger('byra:kpi-overview')
+
+/** Max ids per PostgREST .in() filter (mirrors lib/clients/fetch-client-overview.ts). */
+const IN_CLAUSE_CHUNK = 150
+
+function chunked<T>(items: T[], size: number): T[][] {
+  const out: T[][] = []
+  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size))
+  return out
+}
+
+export interface ByraKpiClientRow {
+  companyId: string
+  name: string
+  orgNumber: string | null
+  revenue: number
+  expenses: number
+  result: number
+  /** Net margin in percent, null when revenue is 0. */
+  margin: number | null
+  /** Closing balance of 19xx accounts for the current fiscal period. */
+  cash: number
+  /** Net 26xx position, positive = att betala (mirrors ruta 49). */
+  vatLiability: number
+  unbookedCount: number
+  inboxCount: number
+  nextDeadline: ClientDeadline | null
+  /** True when this client's numbers could not be fetched; render dashes, not zeros. */
+  failed: boolean
+}
+
+export interface ByraKpiOverview {
+  team: { id: string; name: string }
+  role: ClientOverview['role']
+  preset: KpiPeriodPreset
+  range: KpiRange
+  /** Full roster for the company filter chips (unfiltered). */
+  allClients: Array<{ companyId: string; name: string }>
+  /** Ids the current filter selects (equals the full roster when unfiltered). */
+  selectedIds: string[]
+  /** One row per selected client, revenue descending. */
+  rows: ByraKpiClientRow[]
+  /** Merged monthly income/expense series across the selected clients. */
+  months: MonthlyDataPoint[]
+}
+
+interface CompanyKpiNumbers {
+  revenue: number
+  expenses: number
+  result: number
+  margin: number | null
+  cash: number
+  vatLiability: number
+  failed: boolean
+  buckets: MonthBucket[]
+}
+
+const FAILED_NUMBERS: CompanyKpiNumbers = {
+  revenue: 0,
+  expenses: 0,
+  result: 0,
+  margin: null,
+  cash: 0,
+  vatLiability: 0,
+  failed: true,
+  buckets: [],
+}
+
+/**
+ * Fetch one company's numbers: monthly P&L buckets clipped to the range,
+ * plus cash and VAT from the current fiscal period's closing balances.
+ * Account names are irrelevant here (nothing displays them), so the trial
+ * balance rows are built with an empty account map.
+ */
+async function fetchCompanyNumbers(
+  supabase: SupabaseClient,
+  companyId: string,
+  periods: FiscalPeriodLite[],
+  range: KpiRange,
+  todayIso: string,
+): Promise<CompanyKpiNumbers> {
+  const current = pickCurrentPeriod(periods, todayIso)
+  const inRange = periodsInRange(periods, range)
+
+  const needed = new Map<string, FiscalPeriodLite>()
+  for (const p of inRange) needed.set(p.id, p)
+  if (current) needed.set(current.id, current)
+  if (needed.size === 0) {
+    return { ...FAILED_NUMBERS, failed: false }
+  }
+
+  const [aggEntries, priorResult] = await Promise.all([
+    Promise.all(
+      [...needed.values()].map(async (period) => ({
+        period,
+        agg: await fetchKpiAggregates(
+          supabase,
+          companyId,
+          period.id,
+          period.opening_balance_entry_id,
+        ),
+      })),
+    ),
+    // Opening balances without an OB entry fall back to the server-side
+    // prior-period aggregate, exactly like the in-company KPI route.
+    current && !current.opening_balance_entry_id
+      ? supabase.rpc('compute_prior_opening_balances', {
+          p_company_id: companyId,
+          p_period_start: current.period_start,
+        })
+      : Promise.resolve(null),
+  ])
+
+  if (priorResult?.error) {
+    throw new Error(priorResult.error.message)
+  }
+
+  const inRangeIds = new Set(inRange.map((p) => p.id))
+  const buckets: MonthBucket[] = []
+  for (const { period, agg } of aggEntries) {
+    if (!inRangeIds.has(period.id)) continue
+    for (const m of agg.monthly) {
+      buckets.push({ year: m.year, month0: m.month - 1, income: m.income, expenses: m.expenses })
+    }
+  }
+  const rangeBuckets = filterBucketsToRange(buckets, range)
+  const sums = sumBuckets(rangeBuckets)
+
+  let cash = 0
+  let vatLiability = 0
+  if (current) {
+    const currentAgg = aggEntries.find((e) => e.period.id === current.id)!.agg
+    const openingBalances = buildOpeningBalances(
+      currentAgg,
+      current.opening_balance_entry_id ? null : (priorResult?.data ?? []),
+    )
+    const tbRows = buildTrialBalanceRows(openingBalances, currentAgg.tb, new Map())
+    cash = calculateCashPosition(tbRows)
+    vatLiability = calculateVatLiability(tbRows)
+  }
+
+  return {
+    ...sums,
+    margin: resultMargin(sums.revenue, sums.result),
+    cash,
+    vatLiability,
+    failed: false,
+    buckets: rangeBuckets,
+  }
+}
+
+/**
+ * Aggregate the Nyckeltal overview for the caller's byrå team. Returns null
+ * when the user is not a byrå team member (the page redirects). A failing
+ * client is marked `failed` and zero-weighted rather than failing the page.
+ */
+export async function fetchByraKpiOverview(
+  supabase: SupabaseClient,
+  userId: string,
+  opts: { preset?: string; companyIds?: string[]; today?: Date } = {},
+): Promise<ByraKpiOverview | null> {
+  const overview = await fetchClientOverview(supabase, userId)
+  if (!overview) return null
+
+  const today = opts.today ?? new Date()
+  const { preset, range } = resolvePeriodPreset(opts.preset, today)
+  const todayIso = range.toDate
+
+  const roster = overview.clients
+  const requested = new Set(opts.companyIds ?? [])
+  const validRequested = roster.filter((c) => requested.has(c.companyId))
+  const selected = validRequested.length > 0 ? validRequested : roster
+
+  const base: ByraKpiOverview = {
+    team: overview.team,
+    role: overview.role,
+    preset,
+    range,
+    allClients: roster.map((c) => ({ companyId: c.companyId, name: c.name })),
+    selectedIds: selected.map((c) => c.companyId),
+    rows: [],
+    months: [],
+  }
+  if (selected.length === 0) return base
+
+  const selectedIds = base.selectedIds
+  const periodRows: FiscalPeriodLite[] = []
+  for (const chunk of chunked(selectedIds, IN_CLAUSE_CHUNK)) {
+    const rows = await fetchAllRows<FiscalPeriodLite>(({ from, to }) =>
+      supabase
+        .from('fiscal_periods')
+        .select('id, company_id, period_start, period_end, opening_balance_entry_id')
+        .in('company_id', chunk)
+        .order('id', { ascending: true })
+        .range(from, to),
+    )
+    periodRows.push(...rows)
+  }
+  const periodsByCompany = new Map<string, FiscalPeriodLite[]>()
+  for (const p of periodRows) {
+    const list = periodsByCompany.get(p.company_id)
+    if (list) list.push(p)
+    else periodsByCompany.set(p.company_id, [p])
+  }
+
+  const numbers = await Promise.all(
+    selected.map(async (client) => {
+      try {
+        return await fetchCompanyNumbers(
+          supabase,
+          client.companyId,
+          periodsByCompany.get(client.companyId) ?? [],
+          range,
+          todayIso,
+        )
+      } catch (err) {
+        log.error('byra-kpi client fetch failed', err, {
+          companyId: client.companyId,
+          operation: 'byra.kpi_overview',
+        })
+        return FAILED_NUMBERS
+      }
+    }),
+  )
+
+  const rows: ByraKpiClientRow[] = selected.map((client, i) => {
+    const n = numbers[i]
+    return {
+      companyId: client.companyId,
+      name: client.name,
+      orgNumber: client.orgNumber,
+      revenue: n.revenue,
+      expenses: n.expenses,
+      result: n.result,
+      margin: n.margin,
+      cash: n.cash,
+      vatLiability: n.vatLiability,
+      unbookedCount: client.unbookedCount,
+      inboxCount: client.inboxCount,
+      nextDeadline: client.nextDeadline,
+      failed: n.failed,
+    }
+  })
+  rows.sort((a, b) => b.revenue - a.revenue || a.name.localeCompare(b.name, 'sv'))
+
+  return {
+    ...base,
+    rows,
+    months: mergeMonthlySeries(
+      numbers.flatMap((n) => n.buckets),
+      range,
+    ),
+  }
+}
diff --git a/lib/clients/__tests__/aggregate.test.ts b/lib/clients/__tests__/aggregate.test.ts
new file mode 100644
index 00000000..da782221
--- /dev/null
+++ b/lib/clients/__tests__/aggregate.test.ts
@@ -0,0 +1,215 @@
+import { describe, it, expect } from 'vitest'
+import {
+  countByCompany,
+  deadlineUrgency,
+  pickNextDeadlines,
+  sortClientRows,
+  filterClientRows,
+  type ClientOverviewRow,
+} from '../aggregate'
+
+function isoDaysFromNow(days: number): string {
+  const d = new Date()
+  d.setHours(0, 0, 0, 0)
+  d.setDate(d.getDate() + days)
+  // Local date parts, not toISOString(): UTC conversion would shift the day
+  // in timezones ahead of UTC and skew the day math under test.
+  const y = d.getFullYear()
+  const m = String(d.getMonth() + 1).padStart(2, '0')
+  const day = String(d.getDate()).padStart(2, '0')
+  return `${y}-${m}-${day}`
+}
+
+function makeRow(overrides: Partial<ClientOverviewRow> = {}): ClientOverviewRow {
+  return {
+    companyId: 'c-1',
+    name: 'Alpha AB',
+    orgNumber: null,
+    unbookedCount: 0,
+    inboxCount: 0,
+    nextDeadline: null,
+    lastBookedDate: null,
+    ...overrides,
+  }
+}
+
+describe('countByCompany', () => {
+  it('counts rows per company id', () => {
+    const counts = countByCompany([
+      { company_id: 'a' },
+      { company_id: 'b' },
+      { company_id: 'a' },
+      { company_id: 'a' },
+    ])
+    expect(counts.get('a')).toBe(3)
+    expect(counts.get('b')).toBe(1)
+    expect(counts.get('c')).toBeUndefined()
+  })
+
+  it('returns an empty map for no rows', () => {
+    expect(countByCompany([]).size).toBe(0)
+  })
+})
+
+describe('deadlineUrgency', () => {
+  it('flags overdue on status overdue', () => {
+    expect(
+      deadlineUrgency({ due_date: isoDaysFromNow(30), status: 'overdue' }),
+    ).toBe('overdue')
+  })
+
+  it('flags overdue on a passed due date even before the cron sweeps', () => {
+    expect(
+      deadlineUrgency({ due_date: isoDaysFromNow(-1), status: 'upcoming' }),
+    ).toBe('overdue')
+  })
+
+  it('flags action_needed inside the 14-day window (status engine semantics)', () => {
+    expect(
+      deadlineUrgency({ due_date: isoDaysFromNow(14), status: 'upcoming' }),
+    ).toBe('action_needed')
+    expect(
+      deadlineUrgency({ due_date: isoDaysFromNow(1), status: 'in_progress' }),
+    ).toBe('action_needed')
+  })
+
+  it('keeps far-future deadlines as upcoming', () => {
+    expect(
+      deadlineUrgency({ due_date: isoDaysFromNow(15), status: 'upcoming' }),
+    ).toBe('upcoming')
+  })
+})
+
+describe('pickNextDeadlines', () => {
+  it('picks the earliest due date per company from unsorted input', () => {
+    const next = pickNextDeadlines([
+      {
+        company_id: 'a',
+        title: 'Later',
+        due_date: isoDaysFromNow(40),
+        tax_deadline_type: null,
+        status: 'upcoming',
+      },
+      {
+        company_id: 'a',
+        title: 'Sooner',
+        due_date: isoDaysFromNow(2),
+        tax_deadline_type: 'vat_declaration',
+        status: 'action_needed',
+      },
+      {
+        company_id: 'b',
+        title: 'Only',
+        due_date: isoDaysFromNow(60),
+        tax_deadline_type: null,
+        status: 'upcoming',
+      },
+    ])
+
+    expect(next.get('a')).toEqual({
+      title: 'Sooner',
+      dueDate: isoDaysFromNow(2),
+      taxDeadlineType: 'vat_declaration',
+      urgency: 'action_needed',
+    })
+    expect(next.get('b')?.urgency).toBe('upcoming')
+  })
+})
+
+describe('sortClientRows', () => {
+  it('puts overdue-deadline companies first, then sorts by unbooked count', () => {
+    const rows = [
+      makeRow({ companyId: 'calm', name: 'Calm AB', unbookedCount: 50 }),
+      makeRow({
+        companyId: 'late',
+        name: 'Late AB',
+        unbookedCount: 0,
+        nextDeadline: {
+          title: 'Moms',
+          dueDate: isoDaysFromNow(-5),
+          taxDeadlineType: 'vat_declaration',
+          urgency: 'overdue',
+        },
+      }),
+      makeRow({ companyId: 'busy', name: 'Busy AB', unbookedCount: 120 }),
+    ]
+
+    expect(sortClientRows(rows).map((r) => r.companyId)).toEqual([
+      'late',
+      'busy',
+      'calm',
+    ])
+  })
+
+  it('orders overdue companies by earliest due date', () => {
+    const rows = [
+      makeRow({
+        companyId: 'less-late',
+        name: 'A',
+        nextDeadline: {
+          title: 'Moms',
+          dueDate: isoDaysFromNow(-2),
+          taxDeadlineType: null,
+          urgency: 'overdue',
+        },
+      }),
+      makeRow({
+        companyId: 'most-late',
+        name: 'B',
+        nextDeadline: {
+          title: 'AGI',
+          dueDate: isoDaysFromNow(-30),
+          taxDeadlineType: null,
+          urgency: 'overdue',
+        },
+      }),
+    ]
+
+    expect(sortClientRows(rows).map((r) => r.companyId)).toEqual([
+      'most-late',
+      'less-late',
+    ])
+  })
+
+  it('tie-breaks by name so the list is stable', () => {
+    const rows = [
+      makeRow({ companyId: 'b', name: 'Beta AB', unbookedCount: 3 }),
+      makeRow({ companyId: 'a', name: 'Alfa AB', unbookedCount: 3 }),
+    ]
+    expect(sortClientRows(rows).map((r) => r.companyId)).toEqual(['a', 'b'])
+  })
+
+  it('does not mutate the input array', () => {
+    const rows = [
+      makeRow({ companyId: 'x', unbookedCount: 1 }),
+      makeRow({ companyId: 'y', unbookedCount: 9 }),
+    ]
+    const before = rows.map((r) => r.companyId)
+    sortClientRows(rows)
+    expect(rows.map((r) => r.companyId)).toEqual(before)
+  })
+})
+
+describe('filterClientRows', () => {
+  const rows = [
+    makeRow({ companyId: 'a', name: 'Alfa Bygg AB', orgNumber: '556012-5790' }),
+    makeRow({ companyId: 'b', name: 'Beta Konsult AB', orgNumber: '5591234567' }),
+  ]
+
+  it('returns everything for an empty query', () => {
+    expect(filterClientRows(rows, '  ')).toHaveLength(2)
+  })
+
+  it('matches case-insensitively on name', () => {
+    expect(filterClientRows(rows, 'alfa').map((r) => r.companyId)).toEqual(['a'])
+  })
+
+  it('matches org numbers ignoring separators', () => {
+    expect(filterClientRows(rows, '5560125790').map((r) => r.companyId)).toEqual(['a'])
+    expect(filterClientRows(rows, '559123').map((r) => r.companyId)).toEqual(['b'])
+  })
+
+  it('returns nothing on a miss', () => {
+    expect(filterClientRows(rows, 'gamma')).toHaveLength(0)
+  })
+})
diff --git a/lib/clients/aggregate.ts b/lib/clients/aggregate.ts
new file mode 100644
index 00000000..343044f1
--- /dev/null
+++ b/lib/clients/aggregate.ts
@@ -0,0 +1,131 @@
+/**
+ * Pure aggregation helpers for the byrå cockpit client list (WL-14).
+ *
+ * The fetch layer (lib/clients/fetch-client-overview.ts) runs a handful of
+ * grouped queries across all client companies; everything that can be
+ * computed without I/O lives here so it is unit-testable: per-company
+ * counting, next-deadline selection with the 14-day ACTION_NEEDED semantics
+ * from lib/deadlines/status-engine.ts, and the urgency sort (overdue
+ * deadlines first, then largest unbooked pile).
+ */
+
+import {
+  ACTION_NEEDED_THRESHOLD_DAYS,
+  daysUntilDeadline,
+} from '@/lib/deadlines/status-engine'
+
+export type DeadlineUrgency = 'overdue' | 'action_needed' | 'upcoming'
+
+export interface ClientDeadline {
+  title: string
+  dueDate: string
+  taxDeadlineType: string | null
+  urgency: DeadlineUrgency
+}
+
+export interface ClientOverviewRow {
+  companyId: string
+  name: string
+  orgNumber: string | null
+  /** Canonical "att bokföra" count (lib/worklist book_transaction predicate). */
+  unbookedCount: number
+  /** Unconsumed inbox documents (lib/worklist inbox_document predicate). */
+  inboxCount: number
+  nextDeadline: ClientDeadline | null
+  /** Latest posted verifikat date; null = nothing booked yet. */
+  lastBookedDate: string | null
+}
+
+/** Count rows per company_id from a flat grouped-query result. */
+export function countByCompany(rows: Array<{ company_id: string }>): Map<string, number> {
+  const counts = new Map<string, number>()
+  for (const row of rows) {
+    counts.set(row.company_id, (counts.get(row.company_id) ?? 0) + 1)
+  }
+  return counts
+}
+
+export interface DeadlineRowInput {
+  company_id: string
+  title: string
+  due_date: string
+  tax_deadline_type: string | null
+  status: string
+}
+
+/**
+ * Deadline urgency per the status engine: `overdue` status (or a passed due
+ * date the cron has not swept yet) flags overdue; within the 14-day
+ * ACTION_NEEDED window flags action_needed; everything else is upcoming.
+ * Computing from the due date as well as the stored status keeps the cockpit
+ * honest between cron runs.
+ */
+export function deadlineUrgency(row: Pick<DeadlineRowInput, 'due_date' | 'status'>): DeadlineUrgency {
+  const days = daysUntilDeadline(row.due_date)
+  if (row.status === 'overdue' || days < 0) return 'overdue'
+  if (row.status === 'action_needed' || days <= ACTION_NEEDED_THRESHOLD_DAYS) {
+    return 'action_needed'
+  }
+  return 'upcoming'
+}
+
+/**
+ * Pick each company's next deadline (earliest due date) from a flat list of
+ * open deadlines. Input does not need to be pre-sorted.
+ */
+export function pickNextDeadlines(rows: DeadlineRowInput[]): Map<string, ClientDeadline> {
+  const next = new Map<string, { dueDate: string; row: DeadlineRowInput }>()
+  for (const row of rows) {
+    const current = next.get(row.company_id)
+    if (!current || row.due_date < current.dueDate) {
+      next.set(row.company_id, { dueDate: row.due_date, row })
+    }
+  }
+  const result = new Map<string, ClientDeadline>()
+  for (const [companyId, { row }] of next) {
+    result.set(companyId, {
+      title: row.title,
+      dueDate: row.due_date,
+      taxDeadlineType: row.tax_deadline_type,
+      urgency: deadlineUrgency(row),
+    })
+  }
+  return result
+}
+
+/**
+ * Urgency sort per the WL-14 resolution: companies with an OVERDUE deadline
+ * first (earliest due date wins within the band), then everyone else by
+ * unbooked count descending. Name is the stable tie-break so the list does
+ * not jitter between renders.
+ */
+export function sortClientRows(rows: ClientOverviewRow[]): ClientOverviewRow[] {
+  const byName = (a: ClientOverviewRow, b: ClientOverviewRow) =>
+    a.name.localeCompare(b.name, 'sv')
+
+  return [...rows].sort((a, b) => {
+    const aOverdue = a.nextDeadline?.urgency === 'overdue'
+    const bOverdue = b.nextDeadline?.urgency === 'overdue'
+    if (aOverdue !== bOverdue) return aOverdue ? -1 : 1
+    if (aOverdue && bOverdue) {
+      const byDue = a.nextDeadline!.dueDate.localeCompare(b.nextDeadline!.dueDate)
+      if (byDue !== 0) return byDue
+    }
+    if (a.unbookedCount !== b.unbookedCount) return b.unbookedCount - a.unbookedCount
+    return byName(a, b)
+  })
+}
+
+/** Case-insensitive free-text filter on name and org number. */
+export function filterClientRows(rows: ClientOverviewRow[], query: string): ClientOverviewRow[] {
+  const q = query.trim().toLowerCase()
+  if (!q) return rows
+  const qDigits = q.replace(/[^0-9]/g, '')
+  return rows.filter((row) => {
+    if (row.name.toLowerCase().includes(q)) return true
+    const org = row.orgNumber ?? ''
+    if (org.toLowerCase().includes(q)) return true
+    // "5560-1257" should match "5560125790": compare digits to digits.
+    return qDigits.length > 0 && org.replace(/[^0-9]/g, '').includes(qDigits)
+  })
+}
diff --git a/lib/clients/fetch-client-overview.ts b/lib/clients/fetch-client-overview.ts
new file mode 100644
index 00000000..88870c0b
--- /dev/null
+++ b/lib/clients/fetch-client-overview.ts
@@ -0,0 +1,253 @@
+/**
+ * Byrå cockpit aggregation (WL-14): one overview row per client company.
+ *
+ * Read-first by design (WL-09): every query here is a cross-membership READ,
+ * which RLS already allows via user_company_ids(); nothing writes. Queries
+ * are GROUPED across all client company ids (a handful of queries total,
+ * never N-per-company):
+ *
+ *   1. byrå team membership (teams.kind = 'byra')
+ *   2. client companies (companies.team_id = byrå team)
+ *   3. display names/org numbers (company_settings)
+ *   4. unbooked transactions (canonical lib/worklist book_transaction predicate)
+ *   5. unconsumed inbox documents (lib/worklist inbox_document predicate,
+ *      including the document_attachments backstop)
+ *   6. open deadlines (status-engine semantics)
+ *   7. latest posted verifikat per company (embedded order+limit, one query)
+ *
+ * fetchAllRows guards every query that can exceed PostgREST's 1000-row cap.
+ */
+
+import type { SupabaseClient } from '@supabase/supabase-js'
+import { fetchAllRows } from '@/lib/supabase/fetch-all'
+import {
+  countByCompany,
+  pickNextDeadlines,
+  sortClientRows,
+  type ClientOverviewRow,
+  type DeadlineRowInput,
+} from '@/lib/clients/aggregate'
+
+export interface ClientOverview {
+  team: { id: string; name: string }
+  /** The caller's role in the byrå team: gates the create action (WL-15). */
+  role: 'owner' | 'admin' | 'member'
+  clients: ClientOverviewRow[]
+}
+
+/** Max ids per PostgREST .in() filter (mirrors lib/worklist IN_CLAUSE_CHUNK). */
+const IN_CLAUSE_CHUNK = 150
+
+function chunked<T>(items: T[], size: number): T[][] {
+  const out: T[][] = []
+  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size))
+  return out
+}
+
+interface ByraMembershipRow {
+  team_id: string
+  role: string
+  teams: { id: string; name: string; kind: string } | null
+}
+
+/**
+ * The caller's byrå team membership, or null for non-byrå users. When a user
+ * somehow belongs to several byrå teams the earliest-created team wins
+ * (deterministic, mirrors ensure_user_team's tie-break).
+ */
+export async function getByraMembership(
+  supabase: SupabaseClient,
+  userId: string,
+): Promise<{ teamId: string; teamName: string; role: ClientOverview['role'] } | null> {
+  const { data, error } = await supabase
+    .from('team_members')
+    .select('team_id, role, teams:team_id!inner(id, name, kind, created_at)')
+    .eq('user_id', userId)
+    .eq('teams.kind', 'byra')
+    .order('created_at', { ascending: true })
+
+  if (error || !data || data.length === 0) return null
+
+  const row = data[0] as unknown as ByraMembershipRow
+  const role = row.role === 'owner' || row.role === 'admin' ? row.role : 'member'
+  return {
+    teamId: row.team_id,
+    teamName: row.teams?.name ?? '',
+    role,
+  }
+}
+
+/**
+ * Aggregate the client overview for the caller's byrå team. Returns null when
+ * the user is not a byrå team member (the route maps that to 403, the page to
+ * a redirect).
+ */
+export async function fetchClientOverview(
+  supabase: SupabaseClient,
+  userId: string,
+): Promise<ClientOverview | null> {
+  const membership = await getByraMembership(supabase, userId)
+  if (!membership) return null
+
+  // 2. Client companies: everything hanging on the byrå team, archived
+  // excluded. RLS additionally scopes this to companies the caller can read
+  // (team sync makes every byrå member a member of every client company).
+  const companies = await fetchAllRows<{
+    id: string
+    name: string
+    org_number: string | null
+  }>(({ from, to }) =>
+    supabase
+      .from('companies')
+      .select('id, name, org_number')
+      .eq('team_id', membership.teamId)
+      .is('archived_at', null)
+      .order('id', { ascending: true })
+      .range(from, to),
+  )
+
+  if (companies.length === 0) {
+    return {
+      team: { id: membership.teamId, name: membership.teamName },
+      role: membership.role,
+      clients: [],
+    }
+  }
+
+  const companyIds = companies.map((c) => c.id)
+  const idChunks = chunked(companyIds, IN_CLAUSE_CHUNK)
+
+  // 3. Current display names + settings org numbers (companies.name can be
+  // stale; the dashboard layout uses the same source).
+  const settingsRows: Array<{
+    company_id: string
+    company_name: string | null
+    org_number: string | null
+  }> = []
+  for (const chunk of idChunks) {
+    const { data, error } = await supabase
+      .from('company_settings')
+      .select('company_id, company_name, org_number')
+      .in('company_id', chunk)
+    if (error) throw new Error(error.message)
+    settingsRows.push(...(data ?? []))
+  }
+  const settingsByCompany = new Map(settingsRows.map((s) => [s.company_id, s]))
+
+  // 4. Unbooked transactions: the canonical predicate (is_business IS NULL
+  // AND is_ignored = false; see lib/worklist/types.ts book_transaction).
+  const unbookedRows: Array<{ company_id: string }> = []
+  for (const chunk of idChunks) {
+    const rows = await fetchAllRows<{ id: string; company_id: string }>(({ from, to }) =>
+      supabase
+        .from('transactions')
+        .select('id, company_id')
+        .in('company_id', chunk)
+        .is('is_business', null)
+        .eq('is_ignored', false)
+        .order('id', { ascending: true })
+        .range(from, to),
+    )
+    unbookedRows.push(...rows)
+  }
+  const unbookedByCompany = countByCompany(unbookedRows)
+
+  // 5. Unconsumed inbox documents (lib/worklist inbox_document): items with a
+  // file that became nothing yet, whose document is still unlinked.
+  const inboxRows: Array<{ company_id: string; document_id: string | null }> = []
+  for (const chunk of idChunks) {
+    const rows = await fetchAllRows<{
+      id: string
+      company_id: string
+      document_id: string | null
+    }>(({ from, to }) =>
+      supabase
+        .from('invoice_inbox_items')
+        .select('id, company_id, document_id')
+        .in('company_id', chunk)
+        .not('document_id', 'is', null)
+        .is('created_supplier_invoice_id', null)
+        .is('created_journal_entry_id', null)
+        .is('matched_transaction_id', null)
+        .order('id', { ascending: true })
+        .range(from, to),
+    )
+    inboxRows.push(...rows)
+  }
+
+  const docIds = [
+    ...new Set(inboxRows.map((r) => r.document_id).filter((id): id is string => !!id)),
+  ]
+  const unlinkedDocRows: Array<{ company_id: string }> = []
+  for (const chunk of chunked(docIds, IN_CLAUSE_CHUNK)) {
+    const { data, error } = await supabase
+      .from('document_attachments')
+      .select('id, company_id')
+      .in('id', chunk)
+      .is('journal_entry_id', null)
+      .eq('is_current_version', true)
+    if (error) throw new Error(error.message)
+    unlinkedDocRows.push(...(data ?? []))
+  }
+  const inboxByCompany = countByCompany(unlinkedDocRows)
+
+  // 6. Open deadlines across all clients, then the earliest per company with
+  // the 14-day ACTION_NEEDED semantics (lib/deadlines/status-engine.ts).
+  const deadlineRows: DeadlineRowInput[] = []
+  for (const chunk of idChunks) {
+    const rows = await fetchAllRows<DeadlineRowInput & { id: string }>(({ from, to }) =>
+      supabase
+        .from('deadlines')
+        .select('id, company_id, title, due_date, tax_deadline_type, status')
+        .in('company_id', chunk)
+        .eq('is_completed', false)
+        .is('dismissed_at', null)
+        .in('status', ['upcoming', 'action_needed', 'in_progress', 'overdue'])
+        .order('id', { ascending: true })
+        .range(from, to),
+    )
+    deadlineRows.push(...rows)
+  }
+  const nextDeadlineByCompany = pickNextDeadlines(deadlineRows)
+
+  // 7. Latest posted verifikat date per company: ONE query using PostgREST's
+  // per-parent embedded order + limit (lateral join under the hood), instead
+  // of N latest-entry queries.
+  const lastBookedByCompany = new Map<string, string>()
+  for (const chunk of idChunks) {
+    const { data, error } = await supabase
+      .from('companies')
+      .select('id, journal_entries(entry_date)')
+      .in('id', chunk)
+      .eq('journal_entries.status', 'posted')
+      .order('entry_date', { referencedTable: 'journal_entries', ascending: false })
+      .limit(1, { referencedTable: 'journal_entries' })
+    if (error) throw new Error(error.message)
+    for (const row of (data ?? []) as Array<{
+      id: string
+      journal_entries: Array<{ entry_date: string }> | null
+    }>) {
+      const entryDate = row.journal_entries?.[0]?.entry_date
+      if (entryDate) lastBookedByCompany.set(row.id, entryDate)
+    }
+  }
+
+  const clients: ClientOverviewRow[] = companies.map((company) => {
+    const settings = settingsByCompany.get(company.id)
+    return {
+      companyId: company.id,
+      name: settings?.company_name || company.name,
+      orgNumber: company.org_number ?? settings?.org_number ?? null,
+      unbookedCount: unbookedByCompany.get(company.id) ?? 0,
+      inboxCount: inboxByCompany.get(company.id) ?? 0,
+      nextDeadline: nextDeadlineByCompany.get(company.id) ?? null,
+      lastBookedDate: lastBookedByCompany.get(company.id) ?? null,
+    }
+  })
+
+  return {
+    team: { id: membership.teamId, name: membership.teamName },
+    role: membership.role,
+    clients: sortClientRows(clients),
+  }
+}
diff --git a/lib/company/__tests__/actions.test.ts b/lib/company/__tests__/actions.test.ts
index 9a4a6110..e6cd7db5 100644
--- a/lib/company/__tests__/actions.test.ts
+++ b/lib/company/__tests__/actions.test.ts
@@ -211,6 +211,96 @@ describe('createCompanyFromOnboarding: org_number validation', () => {
   })
 })
 
+describe('createCompanyFromOnboarding: byrå team gating (WL-15)', () => {
+  const baseParams = {
+    settings: {
+      entity_type: 'aktiebolag' as const,
+      company_name: 'Klient AB',
+    },
+    fiscalPeriod: {
+      startDate: '2026-01-01',
+      endDate: '2026-12-31',
+      name: 'Räkenskapsår 2026',
+    },
+  }
+
+  it('refuses a plain byrå MEMBER (creation is +1 on the byrå invoice)', async () => {
+    const { supabase } = buildSupabase({
+      user: { id: 'user-1' },
+      results: {
+        teams: { maybeSingle: { data: { kind: 'byra' } } },
+        team_members: { maybeSingle: { data: { role: 'member' } } },
+      },
+      rpcResults: { create_company_with_owner: { data: 'should-not-happen' } },
+    })
+    mockCreateClient.mockResolvedValue(supabase as never)
+
+    const result = await createCompanyFromOnboarding({
+      teamId: 'byra-team',
+      ...baseParams,
+    })
+
+    expect(result.error).toBe(
+      'Endast byråns ägare och administratörer kan skapa klientbolag.',
+    )
+    const rpcCreate = supabase.rpc.mock.calls.find(
+      ([name]) => name === 'create_company_with_owner',
+    )
+    expect(rpcCreate).toBeUndefined()
+  })
+
+  it('lets a byrå ADMIN create, with the explicit byrå team binding', async () => {
+    const { supabase } = buildSupabase({
+      user: { id: 'user-1' },
+      results: {
+        teams: { maybeSingle: { data: { kind: 'byra' } } },
+        team_members: { maybeSingle: { data: { role: 'admin' } } },
+      },
+      rpcResults: {
+        create_company_with_owner: { data: 'client-company-id' },
+        seed_chart_of_accounts: { data: null },
+      },
+    })
+    mockCreateClient.mockResolvedValue(supabase as never)
+
+    const result = await createCompanyFromOnboarding({
+      teamId: 'byra-team',
+      ...baseParams,
+    })
+
+    // Response shape: the created company id, no error.
+    expect(result).toEqual({ companyId: 'client-company-id' })
+
+    // Team binding present: the RPC received the byrå team explicitly
+    // (never ensure_user_team arbitrariness, WL-08/WL-15).
+    const rpcCreate = supabase.rpc.mock.calls.find(
+      ([name]) => name === 'create_company_with_owner',
+    )
+    expect(rpcCreate?.[1]).toMatchObject({ p_team_id: 'byra-team' })
+  })
+
+  it('keeps personal-team creation untouched (no role gate)', async () => {
+    const { supabase } = buildSupabase({
+      user: { id: 'user-1' },
+      results: {
+        teams: { maybeSingle: { data: { kind: 'personal' } } },
+      },
+      rpcResults: {
+        create_company_with_owner: { data: 'personal-company-id' },
+        seed_chart_of_accounts: { data: null },
+      },
+    })
+    mockCreateClient.mockResolvedValue(supabase as never)
+
+    const result = await createCompanyFromOnboarding({
+      teamId: 'personal-team',
+      ...baseParams,
+    })
+
+    expect(result).toEqual({ companyId: 'personal-company-id' })
+  })
+})
+
 describe('createCompanyFromOnboarding: TIC snapshot persistence', () => {
   it('persists the supplied ticLookup to companies.tic_snapshot', async () => {
     const { supabase, calls } = buildSupabase({
diff --git a/lib/company/__tests__/context.test.ts b/lib/company/__tests__/context.test.ts
index 2f7fc17b..2e5e6907 100644
--- a/lib/company/__tests__/context.test.ts
+++ b/lib/company/__tests__/context.test.ts
@@ -112,7 +112,7 @@ describe('setActiveCompany', () => {
     expect(mockCookieSet).not.toHaveBeenCalled()
   })
 
-  it('sets the cookie only after the write is verified', async () => {
+  it('sets the cookies only after the write is verified', async () => {
     const { supabase, calls } = buildSupabase({
       company_members: { single: { data: { company_id: 'company-2' } } },
       user_preferences: { single: { data: { active_company_id: 'company-2' } } },
@@ -122,12 +122,21 @@ describe('setActiveCompany', () => {
 
     const upsert = calls.find((c) => c.table === 'user_preferences' && c.method === 'upsert')
     expect(upsert?.args[0]).toEqual({ user_id: 'user-1', active_company_id: 'company-2' })
-    expect(mockCookieSet).toHaveBeenCalledTimes(1)
+    expect(mockCookieSet).toHaveBeenCalledTimes(2)
     expect(mockCookieSet).toHaveBeenCalledWith(
       'gnubok-company-id',
       'company-2',
       expect.objectContaining({ httpOnly: true, path: '/' }),
     )
+    // The explicit-choice marker (byrå landing): must be a SESSION cookie
+    // (no maxAge), so a new browser session starts unpicked and byrå
+    // owners/admins land in the cockpit again.
+    const picked = mockCookieSet.mock.calls.find((c) => c[0] === 'gnubok-company-picked')
+    expect(picked?.[1]).toBe('1')
+    expect(picked?.[2]).toEqual(
+      expect.objectContaining({ httpOnly: true, path: '/', sameSite: 'lax' }),
+    )
+    expect(picked?.[2]).not.toHaveProperty('maxAge')
   })
 })
 
diff --git a/lib/company/__tests__/home-domain.test.ts b/lib/company/__tests__/home-domain.test.ts
new file mode 100644
index 00000000..0f043a06
--- /dev/null
+++ b/lib/company/__tests__/home-domain.test.ts
@@ -0,0 +1,182 @@
+import { describe, it, expect } from 'vitest'
+import {
+  partitionCompaniesByHomeDomain,
+  isCompanyHomedOnHost,
+  resolveLandingPath,
+  type TeamBrandRef,
+} from '../home-domain'
+
+interface Entry {
+  id: string
+  teamId: string | null
+}
+
+const CANONICAL = {
+  canonicalDomain: 'app.gnubok.se',
+  canonicalAppName: 'Accounted',
+}
+
+const siffraBrand: TeamBrandRef = { domain: 'app.siffra.se', appName: 'Siffra' }
+
+function partition(opts: {
+  companies: Entry[]
+  brandByTeam?: Map<string, TeamBrandRef>
+  hostBrandTeamId?: string | null
+}) {
+  return partitionCompaniesByHomeDomain<Entry>({
+    companies: opts.companies,
+    getTeamId: (c) => c.teamId,
+    brandByTeam: opts.brandByTeam ?? new Map(),
+    hostBrandTeamId: opts.hostBrandTeamId ?? null,
+    ...CANONICAL,
+  })
+}
+
+describe('partitionCompaniesByHomeDomain', () => {
+  it('canonical host with no brands anywhere: everything visible (additive guarantee)', () => {
+    const result = partition({
+      companies: [
+        { id: 'own', teamId: 'personal-1' },
+        { id: 'other', teamId: null },
+      ],
+    })
+    expect(result.visible.map((c) => c.id)).toEqual(['own', 'other'])
+    expect(result.foreign).toHaveLength(0)
+  })
+
+  it('canonical host: branded companies become foreign under their brand domain', () => {
+    const result = partition({
+      companies: [
+        { id: 'own-firma', teamId: 'personal-1' },
+        { id: 'client', teamId: 'byra-1' },
+      ],
+      brandByTeam: new Map([['byra-1', siffraBrand]]),
+    })
+    expect(result.visible.map((c) => c.id)).toEqual(['own-firma'])
+    expect(result.foreign).toEqual([
+      { item: { id: 'client', teamId: 'byra-1' }, domain: 'app.siffra.se', appName: 'Siffra' },
+    ])
+  })
+
+  it("brand host: only the brand team's companies are visible", () => {
+    const result = partition({
+      companies: [
+        { id: 'own-firma', teamId: 'personal-1' },
+        { id: 'client-a', teamId: 'byra-1' },
+        { id: 'client-b', teamId: 'byra-1' },
+      ],
+      brandByTeam: new Map([['byra-1', siffraBrand]]),
+      hostBrandTeamId: 'byra-1',
+    })
+    expect(result.visible.map((c) => c.id)).toEqual(['client-a', 'client-b'])
+    // The consultant's own firma points home to the canonical domain.
+    expect(result.foreign).toEqual([
+      {
+        item: { id: 'own-firma', teamId: 'personal-1' },
+        domain: 'app.gnubok.se',
+        appName: 'Accounted',
+      },
+    ])
+  })
+
+  it('brand host: a company under ANOTHER brand points at that brand domain', () => {
+    const otherBrand: TeamBrandRef = { domain: 'app.other.se', appName: 'Other' }
+    const result = partition({
+      companies: [{ id: 'other-client', teamId: 'byra-2' }],
+      brandByTeam: new Map([
+        ['byra-1', siffraBrand],
+        ['byra-2', otherBrand],
+      ]),
+      hostBrandTeamId: 'byra-1',
+    })
+    expect(result.visible).toHaveLength(0)
+    expect(result.foreign[0]!.domain).toBe('app.other.se')
+  })
+})
+
+describe('isCompanyHomedOnHost', () => {
+  const brandByTeam = new Map([['byra-1', siffraBrand]])
+
+  it('brandless company is homed on the canonical host', () => {
+    expect(
+      isCompanyHomedOnHost({
+        companyTeamId: 'personal-1',
+        brandByTeam,
+        hostBrandTeamId: null,
+      }),
+    ).toBe(true)
+  })
+
+  it('branded company is NOT homed on the canonical host', () => {
+    expect(
+      isCompanyHomedOnHost({
+        companyTeamId: 'byra-1',
+        brandByTeam,
+        hostBrandTeamId: null,
+      }),
+    ).toBe(false)
+  })
+
+  it('branded company is homed on its own brand host', () => {
+    expect(
+      isCompanyHomedOnHost({
+        companyTeamId: 'byra-1',
+        brandByTeam,
+        hostBrandTeamId: 'byra-1',
+      }),
+    ).toBe(true)
+  })
+
+  it('brandless company is NOT homed on a brand host', () => {
+    expect(
+      isCompanyHomedOnHost({
+        companyTeamId: 'personal-1',
+        brandByTeam,
+        hostBrandTeamId: 'byra-1',
+      }),
+    ).toBe(false)
+  })
+})
+
+describe('resolveLandingPath', () => {
+  it("byrå staff on their brand host land in the cockpit", () => {
+    expect(
+      resolveLandingPath({
+        hostBrandTeamId: 'byra-1',
+        byraTeams: [{ teamId: 'byra-1', hasBrand: true }],
+      }),
+    ).toBe('/clients')
+  })
+
+  it("someone else's brand host never lands in the cockpit", () => {
+    expect(
+      resolveLandingPath({
+        hostBrandTeamId: 'byra-2',
+        byraTeams: [{ teamId: 'byra-1', hasBrand: true }],
+      }),
+    ).toBe('/')
+  })
+
+  it('brandless byrå homes its cockpit on the canonical host (WL-01)', () => {
+    expect(
+      resolveLandingPath({
+        hostBrandTeamId: null,
+        byraTeams: [{ teamId: 'byra-1', hasBrand: false }],
+      }),
+    ).toBe('/clients')
+  })
+
+  it('a BRANDED byrå does not land in the cockpit on the canonical host', () => {
+    expect(
+      resolveLandingPath({
+        hostBrandTeamId: null,
+        byraTeams: [{ teamId: 'byra-1', hasBrand: true }],
+      }),
+    ).toBe('/')
+  })
+
+  it('non-byrå users always land on / (byte-identical flow)', () => {
+    expect(resolveLandingPath({ hostBrandTeamId: null, byraTeams: [] })).toBe('/')
+    expect(resolveLandingPath({ hostBrandTeamId: 'byra-1', byraTeams: [] })).toBe('/')
+  })
+})
diff --git a/lib/company/__tests__/tab-guard.test.ts b/lib/company/__tests__/tab-guard.test.ts
new file mode 100644
index 00000000..0dcfcf57
--- /dev/null
+++ b/lib/company/__tests__/tab-guard.test.ts
@@ -0,0 +1,246 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import {
+  decodeStorageValue,
+  encodeStorageValue,
+  guardBrowserWrite,
+  guardStore,
+  isTabMismatch,
+  markCompanySwitchInFlight,
+  markSelfSwitchTarget,
+  requestHasNextActionHeader,
+  shouldBlockMutation,
+} from '../tab-guard'
+
+const ORIGIN = 'http://localhost:3000'
+
+describe('encode/decodeStorageValue', () => {
+  it('round-trips a company id', () => {
+    expect(decodeStorageValue(encodeStorageValue('company-2'))).toBe('company-2')
+  })
+
+  it('reads malformed payloads as unknown', () => {
+    expect(decodeStorageValue(null)).toBeNull()
+    expect(decodeStorageValue('not json')).toBeNull()
+    expect(decodeStorageValue(JSON.stringify({ companyId: 42 }))).toBeNull()
+  })
+})
+
+describe('isTabMismatch', () => {
+  it('mismatches only on positive evidence of a different company', () => {
+    expect(isTabMismatch('company-1', 'company-2')).toBe(true)
+    expect(isTabMismatch('company-1', 'company-1')).toBe(false)
+  })
+
+  it('never mismatches on unknown observations', () => {
+    expect(isTabMismatch('company-1', null)).toBe(false)
+    expect(isTabMismatch('company-1', undefined)).toBe(false)
+  })
+
+  it('never mismatches when the tab has no company', () => {
+    expect(isTabMismatch(null, 'company-2')).toBe(false)
+  })
+})
+
+describe('shouldBlockMutation', () => {
+  const mismatch = {
+    pageOrigin: ORIGIN,
+    tabCompanyId: 'company-1',
+    observedCompanyId: 'company-2',
+  }
+
+  it('blocks a mutating same-origin /api request from a stale tab', () => {
+    for (const method of ['POST', 'PUT', 'PATCH', 'DELETE', 'post']) {
+      expect(
+        shouldBlockMutation({ ...mismatch, method, url: '/api/invoices' }),
+      ).toBe(true)
+    }
+    expect(
+      shouldBlockMutation({
+        ...mismatch,
+        method: 'POST',
+        url: `${ORIGIN}/api/transactions/tx-1/categorize`,
+      }),
+    ).toBe(true)
+  })
+
+  it('never blocks reads', () => {
+    expect(
+      shouldBlockMutation({ ...mismatch, method: 'GET', url: '/api/invoices' }),
+    ).toBe(false)
+    expect(
+      shouldBlockMutation({ ...mismatch, method: undefined, url: '/api/invoices' }),
+    ).toBe(false)
+  })
+
+  it('never blocks while tab and active company agree', () => {
+    expect(
+      shouldBlockMutation({
+        pageOrigin: ORIGIN,
+        tabCompanyId: 'company-1',
+        observedCompanyId: 'company-1',
+        method: 'POST',
+        url: '/api/invoices',
+      }),
+    ).toBe(false)
+  })
+
+  it('never blocks on unknown active company (no positive evidence)', () => {
+    expect(
+      shouldBlockMutation({
+        pageOrigin: ORIGIN,
+        tabCompanyId: 'company-1',
+        observedCompanyId: null,
+        method: 'POST',
+        url: '/api/invoices',
+      }),
+    ).toBe(false)
+  })
+
+  it('only guards same-origin /api paths for plain fetches', () => {
+    // Cross-origin (e.g. browser-direct Supabase) is outside the seam.
+    expect(
+      shouldBlockMutation({
+        ...mismatch,
+        method: 'POST',
+        url: 'https://xyz.supabase.co/rest/v1/transactions',
+      }),
+    ).toBe(false)
+    // A plain (non-action) POST to a page route is not guarded.
+    expect(
+      shouldBlockMutation({ ...mismatch, method: 'POST', url: '/clients' }),
+    ).toBe(false)
+    // Prefix trickery: /apiary is not /api/.
+    expect(
+      shouldBlockMutation({ ...mismatch, method: 'POST', url: '/apiary/things' }),
+    ).toBe(false)
+  })
+
+  it('blocks a server-action POST to a page route from a stale tab', () => {
+    expect(
+      shouldBlockMutation({
+        ...mismatch,
+        method: 'POST',
+        url: '/transactions',
+        isServerAction: true,
+      }),
+    ).toBe(true)
+  })
+
+  it('lets the sanctioned company-switch action through while in flight', () => {
+    expect(
+      shouldBlockMutation({
+        ...mismatch,
+        method: 'POST',
+        url: '/clients',
+        isServerAction: true,
+        companySwitchInFlight: true,
+      }),
+    ).toBe(false)
+  })
+
+  it('never blocks a server action while tab and active company agree', () => {
+    expect(
+      shouldBlockMutation({
+        pageOrigin: ORIGIN,
+        tabCompanyId: 'company-1',
+        observedCompanyId: 'company-1',
+        method: 'POST',
+        url: '/clients',
+        isServerAction: true,
+      }),
+    ).toBe(false)
+  })
+
+  it('never blocks a cross-origin request even with the action marker', () => {
+    expect(
+      shouldBlockMutation({
+        ...mismatch,
+        method: 'POST',
+        url: 'https://evil.example/steal',
+        isServerAction: true,
+      }),
+    ).toBe(false)
+  })
+})
+
+describe('requestHasNextActionHeader', () => {
+  it('detects the header on init.headers as a plain record (Next 16 shape)', () => {
+    expect(
+      requestHasNextActionHeader('/clients', {
+        headers: { Accept: 'text/x-component', 'Next-Action': 'abc123' },
+      }),
+    ).toBe(true)
+    expect(
+      requestHasNextActionHeader('/clients', { headers: { 'next-action': 'abc123' } }),
+    ).toBe(true)
+  })
+
+  it('detects the header on Headers instances and entry arrays', () => {
+    expect(
+      requestHasNextActionHeader('/clients', {
+        headers: new Headers({ 'Next-Action': 'abc123' }),
+      }),
+    ).toBe(true)
+    expect(
+      requestHasNextActionHeader('/clients', { headers: [['Next-Action', 'abc123']] }),
+    ).toBe(true)
+  })
+
+  it('detects the header on a Request input when init has none', () => {
+    const req = new Request('http://localhost/clients', {
+      method: 'POST',
+      headers: { 'Next-Action': 'abc123' },
+    })
+    expect(requestHasNextActionHeader(req)).toBe(true)
+  })
+
+  it('is false for ordinary requests', () => {
+    expect(requestHasNextActionHeader('/api/invoices')).toBe(false)
+    expect(
+      requestHasNextActionHeader('/api/invoices', {
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    ).toBe(false)
+    expect(requestHasNextActionHeader(new URL('http://localhost/x'))).toBe(false)
+  })
+})
+
+describe('markSelfSwitchTarget', () => {
+  it('sets and clears the self-switch marker on the store', () => {
+    markSelfSwitchTarget('company-2')
+    expect(guardStore.selfSwitchTargetId).toBe('company-2')
+    markSelfSwitchTarget(null)
+    expect(guardStore.selfSwitchTargetId).toBeNull()
+  })
+})
+
+describe('guardBrowserWrite', () => {
+  beforeEach(() => {
+    guardStore.tabCompanyId = null
+    guardStore.observedCompanyId = null
+    guardStore.notifyBlocked = null
+    markCompanySwitchInFlight(false)
+  })
+
+  it('allows the write when tab and observation agree (or nothing observed)', () => {
+    guardStore.tabCompanyId = 'company-1'
+    expect(guardBrowserWrite()).toBe(true)
+    guardStore.observedCompanyId = 'company-1'
+    expect(guardBrowserWrite()).toBe(true)
+  })
+
+  it('refuses the write and raises the dialog on positive mismatch evidence', () => {
+    let notified = 0
+    guardStore.tabCompanyId = 'company-1'
+    guardStore.observedCompanyId = 'company-2'
+    guardStore.notifyBlocked = () => {
+      notified += 1
+    }
+    expect(guardBrowserWrite()).toBe(false)
+    expect(notified).toBe(1)
+  })
+
+  it('allows the write when no guard is mounted (no tab belief)', () => {
+    expect(guardBrowserWrite()).toBe(true)
+  })
+})
diff --git a/lib/company/actions.ts b/lib/company/actions.ts
index 20524312..424becdd 100644
--- a/lib/company/actions.ts
+++ b/lib/company/actions.ts
@@ -95,6 +95,31 @@ async function createCompanyFromOnboardingImpl(params: {
 
   const companyName = (params.settings.company_name as string | undefined) || 'Mitt företag'
 
+  // Creating a company under a BYRÅ team is admin-gated (WL-15): every
+  // created client company is +1 on the byrå's monthly invoice, so only team
+  // owner/admin may do it. Personal-team creation is untouched. The
+  // create_company_with_owner RPC enforces the same rule in the database
+  // (migration 20260826130400); this check exists to return a readable error
+  // instead of a raw 42501. A team the caller cannot read via RLS resolves
+  // to null kind here and falls through to the RPC's own membership check.
+  const { data: teamRow } = await supabase
+    .from('teams')
+    .select('kind')
+    .eq('id', params.teamId)
+    .maybeSingle()
+  if ((teamRow as { kind?: string } | null)?.kind === 'byra') {
+    const { data: teamMemberRow } = await supabase
+      .from('team_members')
+      .select('role')
+      .eq('team_id', params.teamId)
+      .eq('user_id', user.id)
+      .maybeSingle()
+    const teamRole = (teamMemberRow as { role?: string } | null)?.role
+    if (teamRole !== 'owner' && teamRole !== 'admin') {
+      return { error: 'Endast byråns ägare och administratörer kan skapa klientbolag.' }
+    }
+  }
+
   // Steps 1-5 (company + owner via RPC, org number, TIC snapshot, chart,
   // settings, fiscal period, tax deadlines, with rollback) are shared with
   // the MCP and v1 creation paths: lib/company/create-company.ts.
diff --git a/lib/company/context.ts b/lib/company/context.ts
index d3e30a77..bcd0dfb0 100644
--- a/lib/company/context.ts
+++ b/lib/company/context.ts
@@ -11,6 +11,16 @@ export { CompanyContextError, getActiveCompanyId }
 
 const COMPANY_COOKIE = 'gnubok-company-id'
 
+/**
+ * Session marker for an EXPLICIT company choice (WL byrå landing). Set only
+ * by setActiveCompany, which every deliberate switch funnels through
+ * (company switcher, cockpit client entry, onboarding). The middleware's
+ * first-membership fallback write-back upserts user_preferences directly and
+ * never sets this, so "/" can tell a picked company from an auto-resolved
+ * one. Session-scoped on purpose: a new browser session starts unpicked.
+ */
+export const COMPANY_PICKED_COOKIE = 'gnubok-company-picked'
+
 /**
  * Resolve a company's effective entity type.
  *
@@ -175,6 +185,14 @@ export async function setActiveCompany(
       sameSite: 'lax',
       maxAge: 60 * 60 * 24 * 365, // 1 year
     })
+    // Explicit-choice marker (see COMPANY_PICKED_COOKIE). No maxAge: a session
+    // cookie, gone when the browser closes.
+    cookieStore.set(COMPANY_PICKED_COOKIE, '1', {
+      path: '/',
+      httpOnly: true,
+      secure: process.env.NODE_ENV === 'production',
+      sameSite: 'lax',
+    })
   } catch {
     // Sealed cookie store (render phase): the DB write is what matters.
   }
diff --git a/lib/company/home-domain.ts b/lib/company/home-domain.ts
new file mode 100644
index 00000000..4ba89fab
--- /dev/null
+++ b/lib/company/home-domain.ts
@@ -0,0 +1,117 @@
+/**
+ * The home-domain rule (WL-01, locked): every company has exactly one home
+ * domain: its byrå team's brand domain when the team has a brand, else the
+ * canonical domain. A company is opened and worked in ONLY on its home
+ * domain; everywhere else the UI shows a signpost, never the company.
+ *
+ * Explicitly a NAVIGATION rule, not a security boundary: access is governed
+ * solely by company membership and RLS, unchanged. These helpers are pure so
+ * the rule is unit-testable; the dashboard layout feeds them the host brand
+ * (resolveBrandByHost) and the per-team brand map (resolveBrandsForTeams).
+ */
+
+export interface TeamBrandRef {
+  domain: string
+  appName: string
+}
+
+export interface ForeignCompanyRef {
+  id: string
+  name: string
+  /** The host where this company is actually worked in. */
+  domain: string
+  /** Brand app name for the signpost copy; canonical app name when brandless. */
+  appName: string
+}
+
+export interface HomeDomainPartition<T> {
+  /** Companies homed on the current host: the only ones the switcher offers. */
+  visible: T[]
+  /** Companies homed elsewhere: shown as non-clickable "Hanteras via" entries. */
+  foreign: Array<{ item: T; domain: string; appName: string }>
+}
+
+/**
+ * Partition a user's companies by home domain for the current host.
+ *
+ * - On a brand host (hostBrandTeamId set): visible = companies owned by that
+ *   brand's team; everything else is foreign (its own brand domain, or the
+ *   canonical domain for brandless companies).
+ * - On the canonical host (hostBrandTeamId null): visible = companies WITHOUT
+ *   a brand; branded companies are foreign under their brand domain.
+ *
+ * A company whose team has no entry in brandByTeam is brandless and homed on
+ * the canonical domain, so the canonical hot path (no brands anywhere) yields
+ * visible = everything and foreign = [] : byte-identical behavior.
+ */
+export function partitionCompaniesByHomeDomain<T>(opts: {
+  companies: T[]
+  getTeamId: (company: T) => string | null
+  brandByTeam: Map<string, TeamBrandRef>
+  hostBrandTeamId: string | null
+  canonicalDomain: string
+  canonicalAppName: string
+}): HomeDomainPartition<T> {
+  const { companies, getTeamId, brandByTeam, hostBrandTeamId } = opts
+  const visible: T[] = []
+  const foreign: HomeDomainPartition<T>['foreign'] = []
+
+  for (const company of companies) {
+    const teamId = getTeamId(company)
+    const brand = teamId ? brandByTeam.get(teamId) : undefined
+
+    if (hostBrandTeamId !== null) {
+      if (teamId === hostBrandTeamId) {
+        visible.push(company)
+      } else {
+        foreign.push({
+          item: company,
+          domain: brand?.domain ?? opts.canonicalDomain,
+          appName: brand?.appName ?? opts.canonicalAppName,
+        })
+      }
+    } else if (!brand) {
+      visible.push(company)
+    } else {
+      foreign.push({ item: company, domain: brand.domain, appName: brand.appName })
+    }
+  }
+
+  return { visible, foreign }
+}
+
+/**
+ * Whether the active company is homed on the current host (its brand domain
+ * equals the host's brand domain; null equals null on canonical). When false
+ * the layout renders the signpost instead of the company's dashboard.
+ */
+export function isCompanyHomedOnHost(opts: {
+  companyTeamId: string | null
+  brandByTeam: Map<string, TeamBrandRef>
+  hostBrandTeamId: string | null
+}): boolean {
+  const brand = opts.companyTeamId ? opts.brandByTeam.get(opts.companyTeamId) : undefined
+  if (opts.hostBrandTeamId === null) return !brand
+  return opts.companyTeamId === opts.hostBrandTeamId
+}
+
+/**
+ * Post-login landing (WL-14): byrå staff land in the cockpit on the byrå's
+ * home domain: the brand domain when the team has a brand, else the canonical
+ * domain (a byrå team without white label is a valid state, WL-01). Everyone
+ * else keeps today's '/' byte-identically.
+ */
+export function resolveLandingPath(opts: {
+  /** teams.id of the brand serving the current host, null on canonical. */
+  hostBrandTeamId: string | null
+  /** The user's byrå team memberships with brand presence. */
+  byraTeams: Array<{ teamId: string; hasBrand: boolean }>
+}): '/clients' | '/' {
+  if (opts.hostBrandTeamId !== null) {
+    return opts.byraTeams.some((t) => t.teamId === opts.hostBrandTeamId)
+      ? '/clients'
+      : '/'
+  }
+  // Canonical host: only a brandless byrå homes its cockpit here.
+  return opts.byraTeams.some((t) => !t.hasBrand) ? '/clients' : '/'
+}
diff --git a/lib/company/post-login-landing.ts b/lib/company/post-login-landing.ts
new file mode 100644
index 00000000..2f545d54
--- /dev/null
+++ b/lib/company/post-login-landing.ts
@@ -0,0 +1,26 @@
+'use client'
+
+/**
+ * Post-login landing (WL-14): asks the server where this session should land
+ * when the auth flow has no explicit destination. Byrå staff on their byrå's
+ * home domain get '/clients' (the cockpit); everyone else '/': and ANY
+ * failure (offline, 4xx, malformed payload) degrades to '/', so the
+ * non-byrå flow can never be worse than today's hardcoded push.
+ *
+ * The answer is whitelisted client-side: only the two known destinations are
+ * ever returned, so a compromised or confused response cannot redirect the
+ * user anywhere else.
+ */
+export async function resolvePostLoginDestination(): Promise<'/clients' | '/'> {
+  try {
+    const res = await fetch('/api/clients/landing', {
+      cache: 'no-store',
+      credentials: 'same-origin',
+    })
+    if (!res.ok) return '/'
+    const payload = (await res.json()) as { data?: { destination?: unknown } }
+    return payload?.data?.destination === '/clients' ? '/clients' : '/'
+  } catch {
+    return '/'
+  }
+}
diff --git a/lib/company/switch-client.ts b/lib/company/switch-client.ts
index deada2bf..89740535 100644
--- a/lib/company/switch-client.ts
+++ b/lib/company/switch-client.ts
@@ -1,30 +1,67 @@
 'use client'
 
 import { switchCompany } from '@/lib/company/actions'
+import {
+  TAB_SYNC_CHANNEL,
+  TAB_SYNC_STORAGE_KEY,
+  encodeStorageValue,
+  markCompanySwitchInFlight,
+  markSelfSwitchTarget,
+} from '@/lib/company/tab-guard'
 
 /**
  * Client-side company switch: persists the new active company via the
  * server action, notifies sibling tabs, then hard-reloads onto the new
- * company. Shared by CompanySwitcher (mobile sheet) and the sidebar
- * user-menu flyout so both use the exact same mechanism.
+ * company. Shared by CompanySwitcher (mobile sheet), the sidebar user-menu
+ * flyout and the byrå cockpit so all use the exact same mechanism.
+ *
+ * `destination` (default '/') is where THIS tab lands after the switch: the
+ * cockpit's soft switch (WL-09) enters a client directly on the target page
+ * instead of bouncing via the start page. It is always a full-page load: the
+ * hard navigation is what tears down React state, router cache, in-flight
+ * fetches and blob URLs so nothing from the previous company survives.
  *
  * Returns an error code instead of navigating when the switch fails.
  */
 export async function performCompanySwitch(
   companyId: string,
+  options: { destination?: string } = {},
 ): Promise<{ error: string } | void> {
-  const result = await switchCompany(companyId)
+  // The tab guard blocks server-action POSTs from a mismatched tab, but the
+  // switch action is the sanctioned exception: it is both dialog exits and
+  // the deliberate re-switch from a stale tab. Flag it around the call so the
+  // patched fetch lets exactly this action through.
+  markCompanySwitchInFlight(true)
+  let result: { error?: string }
+  try {
+    result = await switchCompany(companyId)
+  } finally {
+    markCompanySwitchInFlight(false)
+  }
   if (result.error) {
     return { error: result.error }
   }
-  // Notify every other open tab of the same user so they hard-reload
-  // onto the new company. BroadcastChannel is best-effort: if the
-  // browser doesn't support it (very old) we still hard-reload
-  // ourselves, and other tabs will self-correct via the visibilitychange
-  // / pageshow listeners in CompanyTabSync on their next focus event.
+  // This tab's own switch: the broadcast below loops back into this tab's
+  // CompanyTabSync (BroadcastChannel delivers to every same-name channel in
+  // the same context except the posting object), and without this marker the
+  // guard would raise its blocking dialog over the hard navigation already
+  // in flight. The marker suppresses only the dialog; stray mutations from
+  // this tab are still blocked until the reload lands.
+  markSelfSwitchTarget(companyId)
+  // Notify every other open tab of the same user so their tab guard can
+  // react (blocking dialog, WL-09). BroadcastChannel is the live signal;
+  // the localStorage write is the fallback (storage events fire in every
+  // other same-origin tab even where BroadcastChannel is unavailable) and
+  // the synchronous last-known value the mutation guard reads.
+  try {
+    window.localStorage.setItem(TAB_SYNC_STORAGE_KEY, encodeStorageValue(companyId))
+  } catch {
+    // Storage may be unavailable (private mode); BroadcastChannel and the
+    // focus-time server checks in CompanyTabSync still cover the other tabs.
+  }
   if (typeof BroadcastChannel !== 'undefined') {
     try {
-      const channel = new BroadcastChannel('gnubok-company-switch')
+      const channel = new BroadcastChannel(TAB_SYNC_CHANNEL)
       channel.postMessage({ companyId })
       channel.close()
     } catch {
@@ -34,5 +71,5 @@ export async function performCompanySwitch(
   // Hard navigation: tears down React state, router cache, in-flight
   // fetches, blob URLs, etc. This is the whole point: nothing from the
   // previous company can survive the switch.
-  window.location.assign('/')
+  window.location.assign(options.destination ?? '/')
 }
diff --git a/lib/company/tab-guard.ts b/lib/company/tab-guard.ts
new file mode 100644
index 00000000..4bbde152
--- /dev/null
+++ b/lib/company/tab-guard.ts
@@ -0,0 +1,219 @@
+/**
+ * Cross-tab active-company guard logic (WL-09, tab guard).
+ *
+ * The active company is ONE user_preferences row per user, shared by every
+ * tab and session. Two tabs on two clients therefore silently write both
+ * tabs' actions into the LAST switched company's books. The guard gives each
+ * tab a memory of the company it is rendering (server-rendered at mount) and
+ * blocks the tab as soon as another tab switches: a blocking dialog whose
+ * only exits are "switch back" or "reload as the new company". Deliberately
+ * NO continue-anyway: continuing would post into the wrong company's books
+ * (this is not the soft-guard pattern).
+ *
+ * Pure logic lives here so it is unit-testable; the DOM wiring (channel,
+ * storage events, fetch wrapping, the dialog) lives in
+ * components/dashboard/CompanyTabSync.tsx.
+ */
+
+/** Broadcast channel name: pre-existing wire identifier, do not rename. */
+export const TAB_SYNC_CHANNEL = 'gnubok-company-switch'
+
+/**
+ * localStorage key doubling as the BroadcastChannel fallback: writing it
+ * fires `storage` events in every OTHER tab of the same origin. The value is
+ * JSON: { companyId, at } (the timestamp makes re-switching to the same
+ * company still produce a new value, so the event always fires).
+ */
+export const TAB_SYNC_STORAGE_KEY = 'gnubok-active-company'
+
+/** Methods that mutate state and must not run from a stale tab. */
+const MUTATING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE'])
+
+/**
+ * The header Next.js puts on every client-invoked server action POST
+ * (verified against next@16.2.12: fetchServerAction in
+ * dist/client/components/router-reducer/reducers/server-action-reducer.js
+ * calls the bare global `fetch` with `{ 'next-action': actionId }`, so these
+ * requests DO pass through the patched window.fetch).
+ */
+export const NEXT_ACTION_HEADER = 'next-action'
+
+export interface TabSyncMessage {
+  companyId: string | null
+}
+
+/**
+ * Shared guard state: one writer (CompanyTabSync, the single dashboard-shell
+ * mount) and two readers (the patched fetch and guardBrowserWrite below).
+ * Module-level so browser-direct write sites can consult the tab's belief
+ * without threading React context through every mutation helper.
+ */
+export const guardStore: {
+  /** The company this tab is rendering (server-rendered at mount). */
+  tabCompanyId: string | null
+  /** Last observed active company from another tab's switch broadcast. */
+  observedCompanyId: string | null
+  /** Raises the blocking dialog when a mutation is refused. */
+  notifyBlocked: (() => void) | null
+  /**
+   * True while performCompanySwitch awaits the sanctioned switchCompany
+   * server action: the ONE server action that must pass from a mismatched
+   * tab, because it IS both dialog exits ("switch back") and the deliberate
+   * user-driven re-switch. Action ids are opaque per-build hashes, so the
+   * sanctioned call is identified by this flag rather than by id.
+   */
+  companySwitchInFlight: boolean
+  /**
+   * Set when THIS tab initiated a switch to the given company and is
+   * hard-navigating there. The switch broadcast loops back into the
+   * initiating tab (BroadcastChannel delivers to every same-name channel in
+   * the same context except the posting object), which would raise the
+   * "switched in another tab" dialog over the tab's own navigation. While
+   * set, CompanyTabSync suppresses the dialog; mutation blocking stays
+   * active. Cleared on bfcache restore (pageshow persisted): a restored page
+   * renders the OLD company and must get the full guard back.
+   */
+  selfSwitchTargetId: string | null
+} = {
+  tabCompanyId: null,
+  observedCompanyId: null,
+  notifyBlocked: null,
+  companySwitchInFlight: false,
+  selfSwitchTargetId: null,
+}
+
+/** Flagged by performCompanySwitch around the sanctioned switch action. */
+export function markCompanySwitchInFlight(inFlight: boolean): void {
+  guardStore.companySwitchInFlight = inFlight
+}
+
+/**
+ * Flagged by performCompanySwitch after the switch persisted, right before
+ * it broadcasts and hard-navigates: this tab's own switch, not a foreign one.
+ */
+export function markSelfSwitchTarget(companyId: string | null): void {
+  guardStore.selfSwitchTargetId = companyId
+}
+
+/**
+ * Whether a fetch call carries the server-action marker header. Pure over the
+ * (input, init) pair so it is unit-testable; Headers, record and entries
+ * shapes all occur (Next uses a plain record, but the seam is generic).
+ */
+export function requestHasNextActionHeader(
+  input: { headers?: unknown } | string | URL,
+  init?: { headers?: unknown },
+): boolean {
+  const hasHeader = (headers: unknown): boolean => {
+    if (!headers) return false
+    if (typeof Headers !== 'undefined' && headers instanceof Headers) {
+      return headers.has(NEXT_ACTION_HEADER)
+    }
+    if (Array.isArray(headers)) {
+      return headers.some(
+        (entry) =>
+          Array.isArray(entry) &&
+          typeof entry[0] === 'string' &&
+          entry[0].toLowerCase() === NEXT_ACTION_HEADER,
+      )
+    }
+    if (typeof headers === 'object') {
+      return Object.keys(headers as Record<string, unknown>).some(
+        (key) => key.toLowerCase() === NEXT_ACTION_HEADER,
+      )
+    }
+    return false
+  }
+  if (init && hasHeader(init.headers)) return true
+  if (typeof input === 'object' && input !== null && !(input instanceof URL)) {
+    return hasHeader((input as { headers?: unknown }).headers)
+  }
+  return false
+}
+
+/** Serialize the storage payload written on every switch. */
+export function encodeStorageValue(companyId: string | null): string {
+  return JSON.stringify({ companyId, at: Date.now() })
+}
+
+/** Parse a storage payload; malformed input reads as "unknown" (null). */
+export function decodeStorageValue(raw: string | null): string | null {
+  if (!raw) return null
+  try {
+    const parsed = JSON.parse(raw) as { companyId?: unknown }
+    return typeof parsed.companyId === 'string' ? parsed.companyId : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Whether an observed active-company id conflicts with the company this tab
+ * is rendering. Unknown observations (null) are never a mismatch: the guard
+ * only blocks on positive evidence of a switch.
+ */
+export function isTabMismatch(
+  tabCompanyId: string | null,
+  observedCompanyId: string | null | undefined,
+): boolean {
+  if (!tabCompanyId) return false
+  if (observedCompanyId === null || observedCompanyId === undefined) return false
+  return observedCompanyId !== tabCompanyId
+}
+
+/**
+ * Whether a fetch about to leave this tab must be blocked. Guards mutating
+ * same-origin requests on two shapes:
+ *
+ *   - /api paths: the fetch-based mutation surface.
+ *   - server-action POSTs (isServerAction: the request carries the
+ *     `next-action` header; they POST to page routes through the same
+ *     patched window.fetch). The one sanctioned exception is the company
+ *     switch itself (companySwitchInFlight): it is both dialog exits and the
+ *     deliberate re-switch from a stale tab, so blocking it would deadlock
+ *     the guard's own resolution.
+ *
+ * Browser-direct Supabase calls go to another origin and are outside this
+ * seam; their write sites call guardBrowserWrite() instead.
+ */
+export function shouldBlockMutation(opts: {
+  method: string | undefined
+  url: string
+  pageOrigin: string
+  tabCompanyId: string | null
+  observedCompanyId: string | null | undefined
+  /** The request carries the next-action header (a server action POST). */
+  isServerAction?: boolean
+  /** The sanctioned company-switch action is in flight; let it through. */
+  companySwitchInFlight?: boolean
+}): boolean {
+  const method = (opts.method ?? 'GET').toUpperCase()
+  if (!MUTATING_METHODS.has(method)) return false
+  if (!isTabMismatch(opts.tabCompanyId, opts.observedCompanyId)) return false
+
+  let parsed: URL
+  try {
+    parsed = new URL(opts.url, opts.pageOrigin)
+  } catch {
+    return false
+  }
+  if (parsed.origin !== opts.pageOrigin) return false
+  if (opts.isServerAction) return !opts.companySwitchInFlight
+  return parsed.pathname === '/api' || parsed.pathname.startsWith('/api/')
+}
+
+/**
+ * Guard for browser-direct Supabase mutations (they go straight to the
+ * Supabase origin, so the patched window.fetch's /api check never sees them).
+ * Call before executing the write: returns true when the write may proceed.
+ * On positive evidence of a cross-tab switch it raises the blocking dialog
+ * (the same only-exits-are-switch-or-reload dialog, WL-09) and returns false;
+ * the caller simply returns without writing.
+ */
+export function guardBrowserWrite(): boolean {
+  if (!isTabMismatch(guardStore.tabCompanyId, guardStore.observedCompanyId)) {
+    return true
+  }
+  guardStore.notifyBlocked?.()
+  return false
+}
diff --git a/lib/email/__tests__/__snapshots__/auth-templates.test.ts.snap b/lib/email/__tests__/__snapshots__/auth-templates.test.ts.snap
new file mode 100644
index 00000000..e4a19491
--- /dev/null
+++ b/lib/email/__tests__/__snapshots__/auth-templates.test.ts.snap
@@ -0,0 +1,97 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`buildAuthEmail > renders the branded recovery mail (snapshot) 1`] = `
+"
+<!DOCTYPE html>
+<html lang="sv">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Återställ ditt lösenord</title>
+</head>
+<body style="margin: 0; padding: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; line-height: 1.6; color: #333; background-color: #f5f5f5;">
+  <div style="max-width: 520px; margin: 0 auto; padding: 40px 20px;">
+    <div style="background: #ffffff; border-radius: 12px; padding: 40px 32px; border: 1px solid #e5e5e5;">
+      <!-- Header -->
+      <div style="margin-bottom: 28px;">
+        <p style="margin: 0 0 4px 0; font-size: 13px; color: #888; letter-spacing: 0.05em;">SIFFRA</p>
+        <h1 style="margin: 0 0 8px 0; font-size: 22px; font-weight: 600; color: #111;">
+          Återställ ditt lösenord
+        </h1>
+        <p style="margin: 0; color: #666; font-size: 15px;">
+          Vi har tagit emot en begäran om att återställa lösenordet för ditt konto hos Siffra. Klicka på knappen nedan för att välja ett nytt lösenord.
+        </p>
+      </div>
+
+      <div style="margin: 28px 0;">
+        <a href="https://app.siffra.se/auth/callback?token_hash=abc&amp;type=recovery" style="display: inline-block; background: #111; color: #fff; text-decoration: none; padding: 12px 28px; border-radius: 8px; font-size: 14px; font-weight: 500;">
+          Återställ lösenord
+        </a>
+      </div>
+      <!-- Info -->
+      <p style="margin: 0; color: #999; font-size: 13px;">
+        Om du inte begärde detta kan du bortse från det här meddelandet.
+      </p>
+    </div>
+  </div>
+</body>
+</html>"
+`;
+
+exports[`buildAuthEmail > renders the branded recovery mail (snapshot) 2`] = `
+"Återställ ditt lösenord
+
+Vi har tagit emot en begäran om att återställa lösenordet för ditt konto hos Siffra. Klicka på knappen nedan för att välja ett nytt lösenord.
+
+Återställ lösenord: https://app.siffra.se/auth/callback?token_hash=abc&type=recovery
+
+Om du inte begärde detta kan du bortse från det här meddelandet."
+`;
+
+exports[`buildAuthEmail > renders the platform default without a brand 1`] = `
+"
+<!DOCTYPE html>
+<html lang="sv">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Återställ ditt lösenord</title>
+</head>
+<body style="margin: 0; padding: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; line-height: 1.6; color: #333; background-color: #f5f5f5;">
+  <div style="max-width: 520px; margin: 0 auto; padding: 40px 20px;">
+    <div style="background: #ffffff; border-radius: 12px; padding: 40px 32px; border: 1px solid #e5e5e5;">
+      <!-- Header -->
+      <div style="margin-bottom: 28px;">
+        <p style="margin: 0 0 4px 0; font-size: 13px; color: #888; letter-spacing: 0.05em;">ACCOUNTED</p>
+        <h1 style="margin: 0 0 8px 0; font-size: 22px; font-weight: 600; color: #111;">
+          Återställ ditt lösenord
+        </h1>
+        <p style="margin: 0; color: #666; font-size: 15px;">
+          Vi har tagit emot en begäran om att återställa lösenordet för ditt konto hos Accounted. Klicka på knappen nedan för att välja ett nytt lösenord.
+        </p>
+      </div>
+
+      <div style="margin: 28px 0;">
+        <a href="https://app.gnubok.se/auth/callback?token_hash=abc&amp;type=recovery" style="display: inline-block; background: #111; color: #fff; text-decoration: none; padding: 12px 28px; border-radius: 8px; font-size: 14px; font-weight: 500;">
+          Återställ lösenord
+        </a>
+      </div>
+      <!-- Info -->
+      <p style="margin: 0; color: #999; font-size: 13px;">
+        Om du inte begärde detta kan du bortse från det här meddelandet.
+      </p>
+    </div>
+  </div>
+</body>
+</html>"
+`;
+
+exports[`buildAuthEmail > renders the platform default without a brand 2`] = `
+"Återställ ditt lösenord
+
+Vi har tagit emot en begäran om att återställa lösenordet för ditt konto hos Accounted. Klicka på knappen nedan för att välja ett nytt lösenord.
+
+Återställ lösenord: https://app.gnubok.se/auth/callback?token_hash=abc&type=recovery
+
+Om du inte begärde detta kan du bortse från det här meddelandet."
+`;
diff --git a/lib/email/__tests__/__snapshots__/brand-mail-snapshots.test.ts.snap b/lib/email/__tests__/__snapshots__/brand-mail-snapshots.test.ts.snap
new file mode 100644
index 00000000..515a5a5d
--- /dev/null
+++ b/lib/email/__tests__/__snapshots__/brand-mail-snapshots.test.ts.snap
@@ -0,0 +1,336 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`invite mail (template class: invite) > branded: brand sender, brand-domain link, no Accounted leakage 1`] = `
+"
+<!DOCTYPE html>
+<html lang="sv">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Inbjudan till Kund AB</title>
+</head>
+<body style="margin: 0; padding: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; line-height: 1.6; color: #333; background-color: #f5f5f5;">
+  <div style="max-width: 520px; margin: 0 auto; padding: 40px 20px;">
+    <div style="background: #ffffff; border-radius: 12px; padding: 40px 32px; border: 1px solid #e5e5e5;">
+      <!-- Header -->
+      <div style="margin-bottom: 28px;">
+        <p style="margin: 0 0 4px 0; font-size: 13px; color: #888; letter-spacing: 0.05em;">SIFFRA</p>
+        <h1 style="margin: 0 0 8px 0; font-size: 22px; font-weight: 600; color: #111;">
+          Du har blivit inbjuden
+        </h1>
+        <p style="margin: 0; color: #666; font-size: 15px;">
+          <strong>sara@siffra.se</strong> har bjudit in dig till <strong>Kund AB</strong> på siffra.
+        </p>
+      </div>
+
+      <!-- CTA -->
+      <div style="margin: 28px 0;">
+        <a href="https://app.siffra.se/invite/tok-1" style="display: inline-block; background: #111; color: #fff; text-decoration: none; padding: 12px 28px; border-radius: 8px; font-size: 14px; font-weight: 500;">
+          Acceptera inbjudan
+        </a>
+      </div>
+
+      <!-- Info -->
+      <p style="margin: 0; color: #999; font-size: 13px;">
+        Länken är giltig i 7 dagar. Om du inte förväntade dig denna inbjudan kan du ignorera detta meddelande.
+      </p>
+    </div>
+  </div>
+</body>
+</html>"
+`;
+
+exports[`invite mail (template class: invite) > unbranded: byte-identical to the un-overridden template on the canonical URL 1`] = `
+"
+<!DOCTYPE html>
+<html lang="sv">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Inbjudan till Kund AB</title>
+</head>
+<body style="margin: 0; padding: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; line-height: 1.6; color: #333; background-color: #f5f5f5;">
+  <div style="max-width: 520px; margin: 0 auto; padding: 40px 20px;">
+    <div style="background: #ffffff; border-radius: 12px; padding: 40px 32px; border: 1px solid #e5e5e5;">
+      <!-- Header -->
+      <div style="margin-bottom: 28px;">
+        <p style="margin: 0 0 4px 0; font-size: 13px; color: #888; letter-spacing: 0.05em;">ACCOUNTED</p>
+        <h1 style="margin: 0 0 8px 0; font-size: 22px; font-weight: 600; color: #111;">
+          Du har blivit inbjuden
+        </h1>
+        <p style="margin: 0; color: #666; font-size: 15px;">
+          <strong>sara@siffra.se</strong> har bjudit in dig till <strong>Kund AB</strong> på accounted.
+        </p>
+      </div>
+
+      <!-- CTA -->
+      <div style="margin: 28px 0;">
+        <a href="https://app.gnubok.se/invite/tok-1" style="display: inline-block; background: #111; color: #fff; text-decoration: none; padding: 12px 28px; border-radius: 8px; font-size: 14px; font-weight: 500;">
+          Acceptera inbjudan
+        </a>
+      </div>
+
+      <!-- Info -->
+      <p style="margin: 0; color: #999; font-size: 13px;">
+        Länken är giltig i 7 dagar. Om du inte förväntade dig denna inbjudan kan du ignorera detta meddelande.
+      </p>
+    </div>
+  </div>
+</body>
+</html>"
+`;
+
+exports[`invoice mail (template class: invoice) > unbranded: template output unchanged and platform-free 1`] = `
+"
+<!DOCTYPE html>
+<html lang="sv">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Faktura F-1001</title>
+</head>
+<body style="margin: 0; padding: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; line-height: 1.6; color: #333;">
+  <div style="max-width: 600px; margin: 0 auto; padding: 40px 20px;">
+    <!-- Header -->
+    <div style="margin-bottom: 30px; border-bottom: 2px solid #1a1a1a; padding-bottom: 16px;">
+      <h1 style="margin: 0 0 10px 0; font-size: 24px; font-weight: 600; color: #1a1a1a;">
+        Faktura från Kund AB
+      </h1>
+      <p style="margin: 0; color: #666; font-size: 14px;">
+        Fakturanummer: F-1001
+      </p>
+    </div>
+
+    <!-- Greeting -->
+    <div style="margin-bottom: 30px;">
+      <p style="margin: 0 0 15px 0;">
+        Hej Erik,
+      </p>
+      <p style="margin: 0;">
+        Tack för ditt förtroende! Bifogat hittar du din faktura.
+      </p>
+    </div>
+
+    <!-- Summary Box -->
+    <div style="background: #f8f9fa; border-radius: 8px; padding: 25px; margin-bottom: 30px;">
+      <table style="width: 100%; border-collapse: collapse;">
+        <tr>
+          <td style="padding: 8px 0; color: #666; font-size: 14px;">Fakturanummer:</td>
+          <td style="padding: 8px 0; text-align: right; font-weight: 500;">F-1001</td>
+        </tr>
+        <tr>
+          <td style="padding: 8px 0; color: #666; font-size: 14px;">Fakturadatum:</td>
+          <td style="padding: 8px 0; text-align: right;">2026-07-01</td>
+        </tr>
+        <tr>
+          <td style="padding: 8px 0; color: #666; font-size: 14px;">Förfallodatum:</td>
+          <td style="padding: 8px 0; text-align: right; font-weight: 500; color: #e11d48;">
+            2026-07-31
+          </td>
+        </tr>
+        <tr>
+          <td colspan="2" style="padding: 15px 0 8px 0; border-top: 1px solid #e5e7eb;"></td>
+        </tr>
+        <tr>
+          <td style="padding: 8px 0; font-size: 18px; font-weight: 600;">Att betala:</td>
+          <td style="padding: 8px 0; text-align: right; font-size: 18px; font-weight: 600; color: #1a1a1a;">
+            1 250,00 SEK
+          </td>
+        </tr>
+      </table>
+    </div>
+
+    <!-- Pay-online button: only when the user pasted a payment link on this
+         invoice. The URL is schema-validated (https-only) but still escaped
+         for the attribute context: a URL may legally contain quotes. -->
+    
+
+    <!-- Payment Details -->
+    
+    <div style="margin-bottom: 30px;">
+      <h2 style="margin: 0 0 15px 0; font-size: 16px; font-weight: 600; color: #1a1a1a;">
+        Betalningsinformation
+      </h2>
+      <table style="width: 100%; border-collapse: collapse;">
+        
+        
+        
+        
+        <tr>
+          <td style="padding: 6px 0; color: #666; font-size: 14px;">Meddelande:</td>
+          <td style="padding: 6px 0; font-weight: 500;">F-1001</td>
+        </tr>
+      </table>
+    </div>
+    
+
+    <!-- Footer -->
+    <div style="margin-top: 30px; padding-top: 20px; border-top: 1px solid #e5e7eb;">
+      <p style="margin: 0 0 10px 0; color: #666; font-size: 14px;">
+        Har du frågor om fakturan? Svara direkt på detta mejl så hjälper vi dig.
+      </p>
+      <p style="margin: 0; color: #666; font-size: 14px;">
+        Med vänliga hälsningar,<br>
+        <strong style="color: #1a1a1a;">Kund AB</strong>
+      </p>
+      
+      <p style="margin: 10px 0 0 0; color: #999; font-size: 12px;">
+        Org.nr: 556000-0000
+        
+         | Innehar F-skattsedel
+      </p>
+      
+    </div>
+  </div>
+</body>
+</html>
+"
+`;
+
+exports[`payslip mail (template class: payslip) > branded: brand sender and brand-domain link 1`] = `
+"<p>Hej Anna,</p>
+<p>Din lönespecifikation för juni 2026 finns att hämta via länken nedan.</p>
+<p><a href="https://app.siffra.se/payslip/tok-1">Visa lönespecifikation</a></p>
+<p>Utbetalningsdag: 2026-06-25<br>
+Länken är personlig och giltig i 90 dagar.</p>
+<p>Med vänliga hälsningar,<br>Kund AB</p>"
+`;
+
+exports[`payslip mail (template class: payslip) > unbranded: canonical link, platform sender, unchanged body 1`] = `
+"<p>Hej Anna,</p>
+<p>Din lönespecifikation för juni 2026 finns att hämta via länken nedan.</p>
+<p><a href="https://app.gnubok.se/payslip/tok-1">Visa lönespecifikation</a></p>
+<p>Utbetalningsdag: 2026-06-25<br>
+Länken är personlig och giltig i 90 dagar.</p>
+<p>Med vänliga hälsningar,<br>Kund AB</p>"
+`;
+
+exports[`reminder mail (template class: reminder) > unbranded: canonical action link and unchanged output 1`] = `
+"
+<!DOCTYPE html>
+<html lang="sv">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Vänlig påminnelse - Faktura F-1001</title>
+</head>
+<body style="margin: 0; padding: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; line-height: 1.6; color: #333; background-color: #f9fafb;">
+  <div style="max-width: 600px; margin: 0 auto; padding: 40px 20px;">
+    <div style="background: white; border-radius: 12px; padding: 40px; box-shadow: 0 1px 3px rgba(0,0,0,0.1);">
+      <!-- Header -->
+      <div style="text-align: center; margin-bottom: 30px;">
+        <div style="display: inline-block; background: #2563eb15; color: #2563eb; padding: 8px 16px; border-radius: 20px; font-size: 12px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.5px;">
+          Vänlig påminnelse
+        </div>
+      </div>
+
+      <!-- Title -->
+      <h1 style="margin: 0 0 20px 0; font-size: 22px; font-weight: 600; color: #111; text-align: center;">
+        Faktura F-1001 förföll för 20 dagar sedan
+      </h1>
+
+      <!-- Greeting and Message -->
+      <div style="margin-bottom: 30px;">
+        <p style="margin: 0 0 15px 0;">
+          Hej Erik,
+        </p>
+
+        
+        <p style="margin: 0 0 15px 0;">
+          Vi vill påminna dig om att faktura F-1001 förföll till betalning den 2026-06-01.
+          Om du redan har betalat kan du bortse från denna påminnelse.
+        </p>
+        
+      </div>
+
+      <!-- Invoice Summary Box -->
+      <div style="background: #f8f9fa; border-radius: 8px; padding: 25px; margin-bottom: 30px; border-left: 4px solid #2563eb;">
+        <table style="width: 100%; border-collapse: collapse;">
+          <tr>
+            <td style="padding: 8px 0; color: #666; font-size: 14px;">Fakturanummer:</td>
+            <td style="padding: 8px 0; text-align: right; font-weight: 500;">F-1001</td>
+          </tr>
+          <tr>
+            <td style="padding: 8px 0; color: #666; font-size: 14px;">Fakturadatum:</td>
+            <td style="padding: 8px 0; text-align: right;">2026-05-01</td>
+          </tr>
+          <tr>
+            <td style="padding: 8px 0; color: #666; font-size: 14px;">Förfallodatum:</td>
+            <td style="padding: 8px 0; text-align: right; color: #dc2626; font-weight: 500;">
+              2026-06-01
+            </td>
+          </tr>
+          <tr>
+            <td colspan="2" style="padding: 15px 0 8px 0; border-top: 1px solid #e5e7eb;"></td>
+          </tr>
+          <tr>
+            <td style="padding: 8px 0; color: #666; font-size: 14px;">Ursprungligt belopp:</td>
+            <td style="padding: 8px 0; text-align: right; font-weight: 500;">1 250 kr</td>
+          </tr>
+          
+          
+          
+          <tr>
+            <td style="padding: 8px 0; font-size: 18px; font-weight: 600;">Att betala:</td>
+            <td style="padding: 8px 0; text-align: right; font-size: 18px; font-weight: 600; color: #2563eb;">
+              1 250 kr
+            </td>
+          </tr>
+          
+        </table>
+      </div>
+
+      <!-- Payment Details -->
+      <div style="margin-bottom: 30px;">
+        <h2 style="margin: 0 0 15px 0; font-size: 16px; font-weight: 600; color: #111;">
+          Betalningsinformation
+        </h2>
+        <table style="width: 100%; border-collapse: collapse;">
+          
+          
+          
+          
+          <tr>
+            <td style="padding: 6px 0; color: #666; font-size: 14px;">Meddelande:</td>
+            <td style="padding: 6px 0; font-weight: 500;">F-1001</td>
+          </tr>
+        </table>
+      </div>
+
+      <!-- Action Buttons -->
+      <div style="text-align: center; margin-bottom: 30px;">
+        <p style="margin: 0 0 20px 0; color: #666; font-size: 14px;">
+          Har du redan betalat eller har frågor om fakturan?
+        </p>
+        <a href="https://app.gnubok.se/invoice-action/tok-1" style="display: inline-block; background: #2563eb; color: white; padding: 14px 28px; border-radius: 8px; text-decoration: none; font-weight: 500; font-size: 14px;">
+          Hantera faktura
+        </a>
+      </div>
+
+      <!-- Footer -->
+      <div style="padding-top: 20px; border-top: 1px solid #e5e7eb;">
+        <p style="margin: 0 0 10px 0; color: #666; font-size: 14px;">
+          Har du frågor? Svara direkt på detta mejl så hjälper vi dig.
+        </p>
+        <p style="margin: 0; color: #666; font-size: 14px;">
+          Med vänliga hälsningar,<br>
+          <strong>Kund AB</strong>
+        </p>
+        
+        <p style="margin: 10px 0 0 0; color: #999; font-size: 12px;">
+          Org.nr: 199001011234
+          
+        </p>
+        
+      </div>
+    </div>
+
+    <!-- Unsubscribe note -->
+    <p style="text-align: center; margin-top: 20px; color: #999; font-size: 12px;">
+      Detta är ett automatiskt meddelande angående en obetald faktura.
+    </p>
+  </div>
+</body>
+</html>
+"
+`;
diff --git a/lib/email/__tests__/auth-templates.test.ts b/lib/email/__tests__/auth-templates.test.ts
new file mode 100644
index 00000000..54f09e2d
--- /dev/null
+++ b/lib/email/__tests__/auth-templates.test.ts
@@ -0,0 +1,82 @@
+import { describe, it, expect } from 'vitest'
+import { buildAuthEmail } from '../auth-templates'
+
+const URL_EXAMPLE = 'https://app.siffra.se/auth/callback?token_hash=abc&type=recovery'
+// In HTML the URL lands in an attribute and is entity-escaped.
+const URL_EXAMPLE_HTML = URL_EXAMPLE.replace(/&/g, '&amp;')
+
+describe('buildAuthEmail', () => {
+  it.each([
+    ['signup', 'Bekräfta din e-postadress'],
+    ['recovery', 'Återställ ditt lösenord'],
+    ['magiclink', 'Din inloggningslänk'],
+    ['invite', 'Du har blivit inbjuden'],
+    ['email_change', 'Bekräfta din nya e-postadress'],
+    ['email_change_current', 'Godkänn ändrad e-postadress'],
+  ] as const)('renders %s with the brand app name and action link', (actionType, subject) => {
+    const mail = buildAuthEmail({
+      actionType,
+      appName: 'Siffra',
+      actionUrl: URL_EXAMPLE,
+    })
+    expect(mail.subject).toBe(subject)
+    expect(mail.html).toContain('Siffra')
+    expect(mail.html).toContain(URL_EXAMPLE_HTML)
+    expect(mail.html).not.toMatch(/accounted/i)
+    expect(mail.text).toContain(URL_EXAMPLE)
+    expect(mail.text).not.toMatch(/accounted/i)
+  })
+
+  it('renders the platform default without a brand', () => {
+    const mail = buildAuthEmail({
+      actionType: 'recovery',
+      appName: 'Accounted',
+      actionUrl: 'https://app.gnubok.se/auth/callback?token_hash=abc&type=recovery',
+    })
+    expect(mail.html).toContain('ACCOUNTED')
+    expect(mail.html).toContain('https://app.gnubok.se/auth/callback')
+    expect(mail.html).toMatchSnapshot()
+    expect(mail.text).toMatchSnapshot()
+  })
+
+  it('renders the branded recovery mail (snapshot)', () => {
+    const mail = buildAuthEmail({
+      actionType: 'recovery',
+      appName: 'Siffra',
+      actionUrl: URL_EXAMPLE,
+    })
+    expect(mail.html).toMatchSnapshot()
+    expect(mail.text).toMatchSnapshot()
+  })
+
+  it('renders the reauthentication code without a link', () => {
+    const mail = buildAuthEmail({
+      actionType: 'reauthentication',
+      appName: 'Siffra',
+      otpCode: '123456',
+    })
+    expect(mail.subject).toBe('Din verifieringskod')
+    expect(mail.html).toContain('123456')
+    expect(mail.html).not.toContain('<a href')
+    expect(mail.text).toContain('Kod: 123456')
+  })
+
+  it('falls back to a generic mail for unknown action types', () => {
+    const mail = buildAuthEmail({
+      actionType: 'some_future_type',
+      appName: 'Siffra',
+      actionUrl: URL_EXAMPLE,
+    })
+    expect(mail.subject).toBe('Bekräfta din åtgärd')
+    expect(mail.html).toContain(URL_EXAMPLE_HTML)
+  })
+
+  it('escapes HTML in the app name', () => {
+    const mail = buildAuthEmail({
+      actionType: 'recovery',
+      appName: '<script>x</script>',
+      actionUrl: URL_EXAMPLE,
+    })
+    expect(mail.html).not.toContain('<script>')
+  })
+})
diff --git a/lib/email/__tests__/brand-mail-snapshots.test.ts b/lib/email/__tests__/brand-mail-snapshots.test.ts
new file mode 100644
index 00000000..536b30ce
--- /dev/null
+++ b/lib/email/__tests__/brand-mail-snapshots.test.ts
@@ -0,0 +1,264 @@
+/**
+ * WL-13 brand-mail snapshot suite: for every template class (invite, payslip,
+ * invoice, reminder) assert the three sender states:
+ *
+ *   - branded company  -> brand sender + brand-domain links + no platform
+ *                         ("Accounted") leakage in the mail body
+ *   - unbranded company-> today's output, unchanged
+ *   - unverified sender domain -> platform-address fallback (fromName set,
+ *                         no fromAddress; the Resend service renders the brand
+ *                         name alone over the platform address)
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import type { Brand } from '@/lib/branding/resolve'
+import { makeCustomer, makeInvoice, makeCompanySettings } from '@/tests/helpers'
+
+const resolveBrandForCompanyMock = vi.hoisted(() => vi.fn())
+vi.mock('@/lib/branding/resolve', () => ({
+  resolveBrandForCompany: resolveBrandForCompanyMock,
+}))
+
+vi.mock('@/lib/branding/service', () => ({
+  getBranding: () => ({ appName: 'Accounted', appUrl: 'https://app.gnubok.se' }),
+}))
+
+import { getSenderForCompany, getBaseUrlForBrand } from '../brand-sender'
+import {
+  generateInviteEmailSubject,
+  generateInviteEmailHtml,
+  generateInviteEmailText,
+} from '../invite-templates'
+import {
+  generateReminderEmailHtml,
+  generateReminderEmailText,
+  type ReminderEmailData,
+} from '../reminder-templates'
+import { generateInvoiceEmailHtml } from '../invoice-templates'
+import { buildPayslipLinkEmail } from '@/lib/salary/payslips/email-template'
+
+function makeBrand(overrides: Partial<Brand> = {}): Brand {
+  return {
+    id: 'brand-1',
+    teamId: 'team-1',
+    domain: 'app.siffra.se',
+    appName: 'Siffra',
+    logoUrl: null,
+    brandColor: '#123456',
+    chromeColor: null,
+    fontKey: 'default',
+    supportEmail: 'support@siffra.se',
+    authEmailFrom: 'noreply@post.siffra.se',
+    senderDomain: 'post.siffra.se',
+    senderDomainStatus: 'verified',
+    resendDomainId: 'rd-1',
+    ...overrides,
+  }
+}
+
+const VERIFIED = makeBrand()
+const UNVERIFIED = makeBrand({ senderDomainStatus: 'pending' })
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  resolveBrandForCompanyMock.mockResolvedValue(null)
+})
+
+describe('invite mail (template class: invite)', () => {
+  async function composeInvite() {
+    const sender = await getSenderForCompany('company-1')
+    const baseUrl = getBaseUrlForBrand(sender.brand)
+    const data = {
+      companyName: 'Kund AB',
+      inviterEmail: 'sara@siffra.se',
+      inviteUrl: `${baseUrl}/invite/tok-1`,
+      appName: sender.brand?.appName,
+    }
+    return {
+      sender,
+      subject: generateInviteEmailSubject(data),
+      html: generateInviteEmailHtml(data),
+      text: generateInviteEmailText(data),
+    }
+  }
+
+  it('branded: brand sender, brand-domain link, no Accounted leakage', async () => {
+    resolveBrandForCompanyMock.mockResolvedValue(VERIFIED)
+    const mail = await composeInvite()
+    expect(mail.sender).toMatchObject({
+      fromName: 'Siffra',
+      fromAddress: 'noreply@post.siffra.se',
+      replyTo: 'support@siffra.se',
+    })
+    expect(mail.html).toContain('https://app.siffra.se/invite/tok-1')
+    expect(mail.subject).toContain('siffra')
+    expect(mail.html).not.toMatch(/accounted/i)
+    expect(mail.text).not.toMatch(/accounted/i)
+    expect(mail.html).toMatchSnapshot()
+  })
+
+  it('unbranded: byte-identical to the un-overridden template on the canonical URL', async () => {
+    const mail = await composeInvite()
+    expect(mail.sender).toEqual({ fromName: null, fromAddress: null, replyTo: null, brand: null })
+    expect(mail.html).toContain('https://app.gnubok.se/invite/tok-1')
+    const todays = generateInviteEmailHtml({
+      companyName: 'Kund AB',
+      inviterEmail: 'sara@siffra.se',
+      inviteUrl: 'https://app.gnubok.se/invite/tok-1',
+    })
+    expect(mail.html).toBe(todays)
+    expect(mail.html).toMatchSnapshot()
+  })
+
+  it('unverified sender domain: via-Accounted fallback (fromName without fromAddress)', async () => {
+    resolveBrandForCompanyMock.mockResolvedValue(UNVERIFIED)
+    const mail = await composeInvite()
+    expect(mail.sender.fromName).toBe('Siffra')
+    expect(mail.sender.fromAddress).toBeNull()
+    // Links and body still carry the brand even in the fallback.
+    expect(mail.html).toContain('https://app.siffra.se/invite/tok-1')
+    expect(mail.html).not.toMatch(/accounted/i)
+  })
+})
+
+describe('payslip mail (template class: payslip)', () => {
+  async function composePayslip() {
+    const sender = await getSenderForCompany('company-1')
+    const baseUrl = getBaseUrlForBrand(sender.brand)
+    return {
+      sender,
+      ...buildPayslipLinkEmail({
+        employeeFirstName: 'Anna',
+        companyName: 'Kund AB',
+        periodYear: 2026,
+        periodMonth: 6,
+        paymentDate: '2026-06-25',
+        url: `${baseUrl}/payslip/tok-1`,
+      }),
+    }
+  }
+
+  it('branded: brand sender and brand-domain link', async () => {
+    resolveBrandForCompanyMock.mockResolvedValue(VERIFIED)
+    const mail = await composePayslip()
+    expect(mail.sender).toMatchObject({
+      fromName: 'Siffra',
+      fromAddress: 'noreply@post.siffra.se',
+    })
+    expect(mail.html).toContain('https://app.siffra.se/payslip/tok-1')
+    expect(mail.html).not.toMatch(/accounted/i)
+    expect(mail.html).toMatchSnapshot()
+  })
+
+  it('unbranded: canonical link, platform sender, unchanged body', async () => {
+    const mail = await composePayslip()
+    expect(mail.sender.fromName).toBeNull()
+    expect(mail.sender.fromAddress).toBeNull()
+    expect(mail.html).toContain('https://app.gnubok.se/payslip/tok-1')
+    expect(mail.html).toMatchSnapshot()
+  })
+
+  it('unverified sender domain: via-Accounted fallback', async () => {
+    resolveBrandForCompanyMock.mockResolvedValue(UNVERIFIED)
+    const mail = await composePayslip()
+    expect(mail.sender.fromName).toBe('Siffra')
+    expect(mail.sender.fromAddress).toBeNull()
+  })
+})
+
+describe('invoice mail (template class: invoice)', () => {
+  const company = makeCompanySettings({
+    company_name: 'Kund AB',
+    org_number: '556000-0000',
+  })
+  const customer = makeCustomer({ name: 'Erik Andersson', email: 'erik@example.se', language: 'sv' })
+  const invoice = makeInvoice({
+    invoice_number: 'F-1001',
+    invoice_date: '2026-07-01',
+    due_date: '2026-07-31',
+    total: 1250,
+    currency: 'SEK',
+  })
+
+  it('branded: mail rides the brand sender domain, COMPANY stays the display sender', async () => {
+    resolveBrandForCompanyMock.mockResolvedValue(VERIFIED)
+    const sender = await getSenderForCompany('company-1')
+    // The call site (sendTrackedInvoiceEmail) keeps fromName = company name
+    // and only picks up fromAddress from the brand.
+    expect(sender.fromAddress).toBe('noreply@post.siffra.se')
+    const html = generateInvoiceEmailHtml({ invoice, customer, company })
+    // Template content is company-branded and platform-free by design;
+    // the brand must not inject itself into the customer-facing body.
+    expect(html).not.toMatch(/accounted/i)
+    expect(html).not.toContain('Siffra')
+    expect(html).toContain('Kund AB')
+  })
+
+  it('unbranded: template output unchanged and platform-free', async () => {
+    const sender = await getSenderForCompany('company-1')
+    expect(sender.fromAddress).toBeNull()
+    const html = generateInvoiceEmailHtml({ invoice, customer, company })
+    expect(html).not.toMatch(/accounted/i)
+    expect(html).toMatchSnapshot()
+  })
+
+  it('unverified sender domain: no fromAddress, so the From header stays byte-identical', async () => {
+    resolveBrandForCompanyMock.mockResolvedValue(UNVERIFIED)
+    const sender = await getSenderForCompany('company-1')
+    expect(sender.fromAddress).toBeNull()
+  })
+})
+
+describe('reminder mail (template class: reminder)', () => {
+  function makeReminderData(actionUrl: string): ReminderEmailData {
+    return {
+      invoice: makeInvoice({
+        invoice_number: 'F-1001',
+        invoice_date: '2026-05-01',
+        due_date: '2026-06-01',
+        total: 1250,
+        currency: 'SEK',
+      }),
+      customer: makeCustomer({ name: 'Erik Andersson', email: 'erik@example.se' }),
+      company: makeCompanySettings({ company_name: 'Kund AB' }),
+      reminderLevel: 1,
+      daysOverdue: 20,
+      actionUrl,
+      interestAmount: 0,
+      interestRate: 0,
+      interestFromDate: '2026-06-02',
+      interestDays: 0,
+      reminderFee: 0,
+    }
+  }
+
+  it('branded: action link on the brand home domain, no Accounted leakage', async () => {
+    resolveBrandForCompanyMock.mockResolvedValue(VERIFIED)
+    const sender = await getSenderForCompany('company-1')
+    const baseUrl = getBaseUrlForBrand(sender.brand)
+    const data = makeReminderData(`${baseUrl}/invoice-action/tok-1`)
+    const html = generateReminderEmailHtml(data)
+    const text = generateReminderEmailText(data)
+    expect(sender.fromAddress).toBe('noreply@post.siffra.se')
+    expect(html).toContain('https://app.siffra.se/invoice-action/tok-1')
+    expect(html).not.toMatch(/accounted/i)
+    expect(text).toContain('https://app.siffra.se/invoice-action/tok-1')
+  })
+
+  it('unbranded: canonical action link and unchanged output', async () => {
+    const sender = await getSenderForCompany('company-1')
+    const baseUrl = getBaseUrlForBrand(sender.brand)
+    const data = makeReminderData(`${baseUrl}/invoice-action/tok-1`)
+    const html = generateReminderEmailHtml(data)
+    expect(sender.fromAddress).toBeNull()
+    expect(html).toContain('https://app.gnubok.se/invoice-action/tok-1')
+    expect(html).not.toMatch(/accounted/i)
+    expect(html).toMatchSnapshot()
+  })
+
+  it('unverified sender domain: brand link but platform From address', async () => {
+    resolveBrandForCompanyMock.mockResolvedValue(UNVERIFIED)
+    const sender = await getSenderForCompany('company-1')
+    expect(sender.fromAddress).toBeNull()
+    expect(getBaseUrlForBrand(sender.brand)).toBe('https://app.siffra.se')
+  })
+})
diff --git a/lib/email/__tests__/brand-sender.test.ts b/lib/email/__tests__/brand-sender.test.ts
new file mode 100644
index 00000000..feaf110a
--- /dev/null
+++ b/lib/email/__tests__/brand-sender.test.ts
@@ -0,0 +1,112 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import type { Brand } from '@/lib/branding/resolve'
+
+const resolveBrandForCompanyMock = vi.hoisted(() => vi.fn())
+vi.mock('@/lib/branding/resolve', () => ({
+  resolveBrandForCompany: resolveBrandForCompanyMock,
+}))
+
+vi.mock('@/lib/branding/service', () => ({
+  getBranding: () => ({ appName: 'Accounted', appUrl: 'https://app.gnubok.se' }),
+}))
+
+import {
+  getSenderForBrand,
+  getSenderForCompany,
+  getBaseUrlForBrand,
+  getBaseUrlForCompany,
+} from '../brand-sender'
+
+function makeBrand(overrides: Partial<Brand> = {}): Brand {
+  return {
+    id: 'brand-1',
+    teamId: 'team-1',
+    domain: 'app.siffra.se',
+    appName: 'Siffra',
+    logoUrl: null,
+    brandColor: '#123456',
+    chromeColor: null,
+    fontKey: 'default',
+    supportEmail: 'support@siffra.se',
+    authEmailFrom: 'noreply@post.siffra.se',
+    senderDomain: 'post.siffra.se',
+    senderDomainStatus: 'verified',
+    resendDomainId: 'rd-1',
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('getSenderForBrand', () => {
+  it('returns platform defaults (all null) for no brand', () => {
+    expect(getSenderForBrand(null)).toEqual({
+      fromName: null,
+      fromAddress: null,
+      replyTo: null,
+      brand: null,
+    })
+  })
+
+  it('sends from the brand address when the sender domain is verified', () => {
+    const brand = makeBrand()
+    expect(getSenderForBrand(brand)).toEqual({
+      fromName: 'Siffra',
+      fromAddress: 'noreply@post.siffra.se',
+      replyTo: 'support@siffra.se',
+      brand,
+    })
+  })
+
+  it('falls back to the via-platform pattern when the domain is unverified', () => {
+    const brand = makeBrand({ senderDomainStatus: 'pending' })
+    expect(getSenderForBrand(brand)).toEqual({
+      fromName: 'Siffra',
+      fromAddress: null,
+      replyTo: 'support@siffra.se',
+      brand,
+    })
+  })
+
+  it('falls back when the domain is verified but authEmailFrom is missing', () => {
+    const brand = makeBrand({ authEmailFrom: null })
+    const sender = getSenderForBrand(brand)
+    expect(sender.fromAddress).toBeNull()
+    expect(sender.fromName).toBe('Siffra')
+  })
+})
+
+describe('getSenderForCompany', () => {
+  it('resolves through resolveBrandForCompany', async () => {
+    const brand = makeBrand()
+    resolveBrandForCompanyMock.mockResolvedValue(brand)
+    const sender = await getSenderForCompany('company-1')
+    expect(resolveBrandForCompanyMock).toHaveBeenCalledWith('company-1')
+    expect(sender.fromAddress).toBe('noreply@post.siffra.se')
+  })
+
+  it('returns platform defaults for a brandless company', async () => {
+    resolveBrandForCompanyMock.mockResolvedValue(null)
+    const sender = await getSenderForCompany('company-1')
+    expect(sender).toEqual({ fromName: null, fromAddress: null, replyTo: null, brand: null })
+  })
+})
+
+describe('base URLs', () => {
+  it('uses the brand home domain when a brand exists', () => {
+    expect(getBaseUrlForBrand(makeBrand())).toBe('https://app.siffra.se')
+  })
+
+  it('uses the canonical app URL without a brand', () => {
+    expect(getBaseUrlForBrand(null)).toBe('https://app.gnubok.se')
+  })
+
+  it('getBaseUrlForCompany resolves the brand by company', async () => {
+    resolveBrandForCompanyMock.mockResolvedValue(makeBrand())
+    await expect(getBaseUrlForCompany('company-1')).resolves.toBe('https://app.siffra.se')
+    resolveBrandForCompanyMock.mockResolvedValue(null)
+    await expect(getBaseUrlForCompany('company-2')).resolves.toBe('https://app.gnubok.se')
+  })
+})
diff --git a/lib/email/__tests__/standard-webhook.test.ts b/lib/email/__tests__/standard-webhook.test.ts
new file mode 100644
index 00000000..7cb460e0
--- /dev/null
+++ b/lib/email/__tests__/standard-webhook.test.ts
@@ -0,0 +1,128 @@
+import { describe, it, expect } from 'vitest'
+import { createHmac, randomBytes } from 'node:crypto'
+import { verifyStandardWebhookSignature } from '../standard-webhook'
+
+const KEY = randomBytes(24)
+const SECRET = `v1,whsec_${KEY.toString('base64')}`
+
+function sign(id: string, timestamp: string, payload: string, key: Buffer = KEY): string {
+  const sig = createHmac('sha256', key)
+    .update(`${id}.${timestamp}.${payload}`)
+    .digest('base64')
+  return `v1,${sig}`
+}
+
+const NOW_MS = 1_754_000_000_000
+const NOW_SECONDS = String(Math.floor(NOW_MS / 1000))
+
+describe('verifyStandardWebhookSignature', () => {
+  const payload = JSON.stringify({ hello: 'world' })
+
+  it('accepts a valid v1 signature', () => {
+    expect(
+      verifyStandardWebhookSignature({
+        secret: SECRET,
+        payload,
+        id: 'msg_1',
+        timestamp: NOW_SECONDS,
+        signature: sign('msg_1', NOW_SECONDS, payload),
+        nowMs: NOW_MS,
+      }),
+    ).toBe(true)
+  })
+
+  it('accepts the whsec_-only secret format', () => {
+    expect(
+      verifyStandardWebhookSignature({
+        secret: `whsec_${KEY.toString('base64')}`,
+        payload,
+        id: 'msg_1',
+        timestamp: NOW_SECONDS,
+        signature: sign('msg_1', NOW_SECONDS, payload),
+        nowMs: NOW_MS,
+      }),
+    ).toBe(true)
+  })
+
+  it('accepts a space-separated signature list with one matching entry', () => {
+    const other = sign('msg_1', NOW_SECONDS, payload, randomBytes(24))
+    const good = sign('msg_1', NOW_SECONDS, payload)
+    expect(
+      verifyStandardWebhookSignature({
+        secret: SECRET,
+        payload,
+        id: 'msg_1',
+        timestamp: NOW_SECONDS,
+        signature: `${other} ${good}`,
+        nowMs: NOW_MS,
+      }),
+    ).toBe(true)
+  })
+
+  it('rejects a signature computed with a different key', () => {
+    expect(
+      verifyStandardWebhookSignature({
+        secret: SECRET,
+        payload,
+        id: 'msg_1',
+        timestamp: NOW_SECONDS,
+        signature: sign('msg_1', NOW_SECONDS, payload, randomBytes(24)),
+        nowMs: NOW_MS,
+      }),
+    ).toBe(false)
+  })
+
+  it('rejects a tampered payload', () => {
+    expect(
+      verifyStandardWebhookSignature({
+        secret: SECRET,
+        payload: payload + 'x',
+        id: 'msg_1',
+        timestamp: NOW_SECONDS,
+        signature: sign('msg_1', NOW_SECONDS, payload),
+        nowMs: NOW_MS,
+      }),
+    ).toBe(false)
+  })
+
+  it('rejects missing headers', () => {
+    expect(
+      verifyStandardWebhookSignature({
+        secret: SECRET,
+        payload,
+        id: null,
+        timestamp: NOW_SECONDS,
+        signature: sign('msg_1', NOW_SECONDS, payload),
+        nowMs: NOW_MS,
+      }),
+    ).toBe(false)
+  })
+
+  it('rejects a timestamp outside the replay tolerance', () => {
+    const stale = String(Math.floor(NOW_MS / 1000) - 3600)
+    expect(
+      verifyStandardWebhookSignature({
+        secret: SECRET,
+        payload,
+        id: 'msg_1',
+        timestamp: stale,
+        signature: sign('msg_1', stale, payload),
+        nowMs: NOW_MS,
+      }),
+    ).toBe(false)
+  })
+
+  it('ignores non-v1 signature versions', () => {
+    const sig = sign('msg_1', NOW_SECONDS, payload).slice(3)
+    expect(
+      verifyStandardWebhookSignature({
+        secret: SECRET,
+        payload,
+        id: 'msg_1',
+        timestamp: NOW_SECONDS,
+        signature: `v1a,${sig}`,
+        nowMs: NOW_MS,
+      }),
+    ).toBe(false)
+  })
+})
diff --git a/lib/email/auth-templates.ts b/lib/email/auth-templates.ts
new file mode 100644
index 00000000..434d2029
--- /dev/null
+++ b/lib/email/auth-templates.ts
@@ -0,0 +1,176 @@
+/**
+ * Auth mail templates for the Supabase Send Email hook (WL-05, WL-13).
+ *
+ * Swedish-only, like the other user-facing mail templates in lib/email/
+ * (see .claude/rules/i18n.md): these are transactional mails, not UI chrome,
+ * so they deliberately do not go through next-intl.
+ *
+ * The appName parameter carries the brand of the requesting host (resolved
+ * via resolveBrandByHost from the redirect_to origin); the default is the
+ * platform name, so unbranded hosts render canonical mail.
+ */
+
+import { escapeHtml, sanitizeSubjectLine } from './user-text'
+
+export type AuthEmailActionType =
+  | 'signup'
+  | 'recovery'
+  | 'magiclink'
+  | 'invite'
+  | 'email_change'
+  | 'email_change_current'
+  | 'reauthentication'
+
+interface AuthEmailContent {
+  subject: string
+  heading: string
+  body: (appName: string) => string
+  cta: string
+}
+
+const CONTENT: Record<AuthEmailActionType, AuthEmailContent> = {
+  signup: {
+    subject: 'Bekräfta din e-postadress',
+    heading: 'Bekräfta din e-postadress',
+    body: (appName) =>
+      `Klicka på knappen nedan för att bekräfta din e-postadress och slutföra din registrering hos ${appName}.`,
+    cta: 'Bekräfta e-postadress',
+  },
+  recovery: {
+    subject: 'Återställ ditt lösenord',
+    heading: 'Återställ ditt lösenord',
+    body: (appName) =>
+      `Vi har tagit emot en begäran om att återställa lösenordet för ditt konto hos ${appName}. Klicka på knappen nedan för att välja ett nytt lösenord.`,
+    cta: 'Återställ lösenord',
+  },
+  magiclink: {
+    subject: 'Din inloggningslänk',
+    heading: 'Logga in',
+    body: (appName) => `Klicka på knappen nedan för att logga in hos ${appName}.`,
+    cta: 'Logga in',
+  },
+  invite: {
+    subject: 'Du har blivit inbjuden',
+    heading: 'Du har blivit inbjuden',
+    body: (appName) =>
+      `Du har blivit inbjuden till ${appName}. Klicka på knappen nedan för att skapa ditt konto.`,
+    cta: 'Acceptera inbjudan',
+  },
+  email_change: {
+    subject: 'Bekräfta din nya e-postadress',
+    heading: 'Bekräfta din nya e-postadress',
+    body: (appName) =>
+      `Klicka på knappen nedan för att bekräfta din nya e-postadress hos ${appName}.`,
+    cta: 'Bekräfta ny e-postadress',
+  },
+  email_change_current: {
+    subject: 'Godkänn ändrad e-postadress',
+    heading: 'Godkänn ändrad e-postadress',
+    body: (appName) =>
+      `En ändring av e-postadressen för ditt konto hos ${appName} har begärts. Klicka på knappen nedan för att godkänna ändringen från din nuvarande adress.`,
+    cta: 'Godkänn ändringen',
+  },
+  reauthentication: {
+    subject: 'Din verifieringskod',
+    heading: 'Din verifieringskod',
+    body: (appName) => `Ange koden nedan för att bekräfta din identitet hos ${appName}.`,
+    cta: '',
+  },
+}
+
+// Availability first: an action type this module does not know (Supabase can
+// add new mail classes) still produces a usable mail with the verify link
+// rather than dropping the send.
+const FALLBACK_CONTENT: AuthEmailContent = {
+  subject: 'Bekräfta din åtgärd',
+  heading: 'Bekräfta din åtgärd',
+  body: (appName) => `Klicka på knappen nedan för att fortsätta hos ${appName}.`,
+  cta: 'Fortsätt',
+}
+
+const IGNORE_NOTE = 'Om du inte begärde detta kan du bortse från det här meddelandet.'
+
+export interface AuthEmailInput {
+  actionType: string
+  appName: string
+  /** Verify URL on the originating host (token_hash flow). */
+  actionUrl?: string
+  /** One-time code, for reauthentication mail (no link). */
+  otpCode?: string
+}
+
+export interface AuthEmail {
+  subject: string
+  html: string
+  text: string
+}
+
+function contentFor(actionType: string): AuthEmailContent {
+  return (CONTENT as Record<string, AuthEmailContent>)[actionType] ?? FALLBACK_CONTENT
+}
+
+export function buildAuthEmail(input: AuthEmailInput): AuthEmail {
+  const content = contentFor(input.actionType)
+  const appName = input.appName
+  const safeAppName = escapeHtml(appName)
+  const body = content.body(appName)
+
+  const action = input.otpCode
+    ? `
+      <div style="margin: 28px 0;">
+        <span style="display: inline-block; background: #f5f5f5; border: 1px solid #e5e5e5; border-radius: 8px; padding: 12px 28px; font-size: 22px; font-weight: 600; letter-spacing: 0.3em; color: #111;">${escapeHtml(input.otpCode)}</span>
+      </div>`
+    : input.actionUrl
+      ? `
+      <div style="margin: 28px 0;">
+        <a href="${escapeHtml(input.actionUrl)}" style="display: inline-block; background: #111; color: #fff; text-decoration: none; padding: 12px 28px; border-radius: 8px; font-size: 14px; font-weight: 500;">
+          ${escapeHtml(content.cta)}
+        </a>
+      </div>`
+      : ''
+
+  const html = `
+<!DOCTYPE html>
+<html lang="sv">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>${escapeHtml(content.subject)}</title>
+</head>
+<body style="margin: 0; padding: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; line-height: 1.6; color: #333; background-color: #f5f5f5;">
+  <div style="max-width: 520px; margin: 0 auto; padding: 40px 20px;">
+    <div style="background: #ffffff; border-radius: 12px; padding: 40px 32px; border: 1px solid #e5e5e5;">
+      <!-- Header -->
+      <div style="margin-bottom: 28px;">
+        <p style="margin: 0 0 4px 0; font-size: 13px; color: #888; letter-spacing: 0.05em;">${safeAppName.toUpperCase()}</p>
+        <h1 style="margin: 0 0 8px 0; font-size: 22px; font-weight: 600; color: #111;">
+          ${escapeHtml(content.heading)}
+        </h1>
+        <p style="margin: 0; color: #666; font-size: 15px;">
+          ${escapeHtml(body)}
+        </p>
+      </div>
+${action}
+      <!-- Info -->
+      <p style="margin: 0; color: #999; font-size: 13px;">
+        ${IGNORE_NOTE}
+      </p>
+    </div>
+  </div>
+</body>
+</html>`
+
+  let text = `${content.heading}\n\n${body}\n\n`
+  if (input.otpCode) {
+    text += `Kod: ${input.otpCode}\n\n`
+  } else if (input.actionUrl) {
+    text += `${content.cta}: ${input.actionUrl}\n\n`
+  }
+  text += IGNORE_NOTE
+
+  return {
+    subject: sanitizeSubjectLine(content.subject),
+    html,
+    text,
+  }
+}
diff --git a/lib/email/brand-sender.ts b/lib/email/brand-sender.ts
new file mode 100644
index 00000000..b36283c3
--- /dev/null
+++ b/lib/email/brand-sender.ts
@@ -0,0 +1,79 @@
+/**
+ * Brand-aware outbound mail identity (WL-13).
+ *
+ * THE RULE: every outbound mail is sent in the brand of the COMPANY it
+ * concerns, resolved via resolveBrandForCompany (WL-12). These helpers are
+ * the ONLY entry points call sites use for sender identity and link base
+ * URLs; a company without a brand gets exactly today's values, byte for byte.
+ *
+ * Sender chain (WL-04):
+ *   1. Brand with a VERIFIED Resend sender domain and an authEmailFrom
+ *      address: send from the brand address with the brand app name.
+ *   2. Brand without a verified sender domain: ride the platform default
+ *      address with the brand name alone as the display name (fromName set,
+ *      no fromAddress; no "via <platform>", founder call 2026-08-05).
+ *      DMARC-clean: the From domain stays ours.
+ *   3. No brand: platform defaults (fromName/fromAddress/replyTo all null,
+ *      the email service renders "<Platform> <RESEND_FROM_EMAIL>").
+ */
+
+import { getBranding } from '@/lib/branding/service'
+import { resolveBrandForCompany, type Brand } from '@/lib/branding/resolve'
+
+export interface BrandSender {
+  /** Display name for the From header; null = platform default. */
+  fromName: string | null
+  /**
+   * Explicit From address; only set when the brand's sender domain is
+   * verified in Resend. Null = platform default address.
+   */
+  fromAddress: string | null
+  /** Reply-To; the brand's support address when a brand exists, else null. */
+  replyTo: string | null
+  /** The resolved brand, for callers that also need appName/domain/logo. */
+  brand: Brand | null
+}
+
+/** Pure mapping from a resolved brand to sender identity. */
+export function getSenderForBrand(brand: Brand | null): BrandSender {
+  if (!brand) {
+    return { fromName: null, fromAddress: null, replyTo: null, brand: null }
+  }
+  if (brand.senderDomainStatus === 'verified' && brand.authEmailFrom) {
+    return {
+      fromName: brand.appName,
+      fromAddress: brand.authEmailFrom,
+      replyTo: brand.supportEmail || null,
+      brand,
+    }
+  }
+  // Unverified/pending/failed sender domain: "via Accounted" fallback.
+  return {
+    fromName: brand.appName,
+    fromAddress: null,
+    replyTo: brand.supportEmail || null,
+    brand,
+  }
+}
+
+/**
+ * Sender identity for mail concerning `companyId`. Host-independent and
+ * cron-safe: resolution goes company -> team -> brand.
+ */
+export async function getSenderForCompany(companyId: string): Promise<BrandSender> {
+  return getSenderForBrand(await resolveBrandForCompany(companyId))
+}
+
+/** Base URL mailed links should point at, given an already-resolved brand. */
+export function getBaseUrlForBrand(brand: Brand | null): string {
+  return brand ? `https://${brand.domain}` : getBranding().appUrl
+}
+
+/**
+ * Base URL for links in mail concerning `companyId`: the brand's home domain
+ * when the company's team has a brand, else the canonical app URL
+ * (NEXT_PUBLIC_APP_URL via getBranding().appUrl).
+ */
+export async function getBaseUrlForCompany(companyId: string): Promise<string> {
+  return getBaseUrlForBrand(await resolveBrandForCompany(companyId))
+}
diff --git a/lib/email/invite-templates.ts b/lib/email/invite-templates.ts
index e8e8380a..5593b6d1 100644
--- a/lib/email/invite-templates.ts
+++ b/lib/email/invite-templates.ts
@@ -4,16 +4,22 @@ export interface InviteEmailData {
   companyName: string
   inviterEmail: string
   inviteUrl: string
+  /**
+   * Brand override (WL-13): the app name of the brand of the company the
+   * invite concerns. Absent = platform default from getBranding(), which
+   * keeps unbranded companies byte-identical to before.
+   */
+  appName?: string
 }
 
 export function generateInviteEmailSubject(data: InviteEmailData): string {
-  const { appName } = getBranding()
+  const appName = data.appName ?? getBranding().appName
   return `Du har bjudits in till ${data.companyName} på ${appName.toLowerCase()}`
 }
 
 export function generateInviteEmailHtml(data: InviteEmailData): string {
   const { companyName, inviterEmail, inviteUrl } = data
-  const { appName } = getBranding()
+  const appName = data.appName ?? getBranding().appName
 
   return `
 <!DOCTYPE html>
@@ -55,7 +61,7 @@ export function generateInviteEmailHtml(data: InviteEmailData): string {
 }
 
 export function generateInviteEmailText(data: InviteEmailData): string {
-  const { appName } = getBranding()
+  const appName = data.appName ?? getBranding().appName
   return `Du har bjudits in till ${data.companyName} på ${appName.toLowerCase()} av ${data.inviterEmail}.
 
 Acceptera inbjudan: ${data.inviteUrl}
@@ -70,16 +76,35 @@ Länken är giltig i 7 dagar.`
 export interface TeamInviteEmailData {
   inviterEmail: string
   inviteUrl: string
+  /**
+   * Brand override (WL-13): the app name of the byrå team's brand. Absent =
+   * platform default from getBranding(), which keeps brandless teams
+   * byte-identical to before.
+   */
+  appName?: string
 }
 
-export function generateTeamInviteEmailSubject(): string {
-  const { appName } = getBranding()
-  return `Du har bjudits in till ett team på ${appName.toLowerCase()}`
+export function generateTeamInviteEmailSubject(data?: Pick<TeamInviteEmailData, 'appName'>): string {
+  // Branded byrå: the invite is to THE BYRÅ, by name and in its own casing
+  // ("Du har blivit inbjuden till Willem"), no platform wording. Brandless
+  // teams keep the platform phrasing byte-identical.
+  if (data?.appName) {
+    return `Du har blivit inbjuden till ${data.appName}`
+  }
+  return `Du har bjudits in till ett team på ${getBranding().appName.toLowerCase()}`
 }
 
 export function generateTeamInviteEmailHtml(data: TeamInviteEmailData): string {
   const { inviterEmail, inviteUrl } = data
-  const { appName } = getBranding()
+  const appName = data.appName ?? getBranding().appName
+  // Branded byrå: headline and body name the byrå itself; brandless teams
+  // keep the generic team wording.
+  const headline = data.appName
+    ? `Du har blivit inbjuden till ${data.appName}`
+    : 'Du har blivit inbjuden till ett team'
+  const bodyLine = data.appName
+    ? `<strong>${inviterEmail}</strong> har bjudit in dig till <strong>${data.appName}</strong>. Du får tillgång till alla företag i teamet.`
+    : `<strong>${inviterEmail}</strong> har bjudit in dig som konsult. Du får tillgång till alla företag i teamet.`
 
   return `
 <!DOCTYPE html>
@@ -96,10 +121,10 @@ export function generateTeamInviteEmailHtml(data: TeamInviteEmailData): string {
       <div style="margin-bottom: 28px;">
         <p style="margin: 0 0 4px 0; font-size: 13px; color: #888; letter-spacing: 0.05em;">${appName.toUpperCase()}</p>
         <h1 style="margin: 0 0 8px 0; font-size: 22px; font-weight: 600; color: #111;">
-          Du har blivit inbjuden till ett team
+          ${headline}
         </h1>
         <p style="margin: 0; color: #666; font-size: 15px;">
-          <strong>${inviterEmail}</strong> har bjudit in dig som konsult. Du får tillgång till alla företag i teamet.
+          ${bodyLine}
         </p>
       </div>
 
@@ -121,8 +146,14 @@ export function generateTeamInviteEmailHtml(data: TeamInviteEmailData): string {
 }
 
 export function generateTeamInviteEmailText(data: TeamInviteEmailData): string {
-  const { appName } = getBranding()
-  return `Du har bjudits in som konsult till ett team på ${appName.toLowerCase()} av ${data.inviterEmail}. Du får tillgång till alla företag i teamet.
+  if (data.appName) {
+    return `Du har blivit inbjuden till ${data.appName} av ${data.inviterEmail}. Du får tillgång till alla företag i teamet.
+
+Acceptera inbjudan: ${data.inviteUrl}
+
+Länken är giltig i 7 dagar.`
+  }
+  return `Du har bjudits in som konsult till ett team på ${getBranding().appName.toLowerCase()} av ${data.inviterEmail}. Du får tillgång till alla företag i teamet.
 
 Acceptera inbjudan: ${data.inviteUrl}
 
diff --git a/lib/email/send-team-invite.ts b/lib/email/send-team-invite.ts
new file mode 100644
index 00000000..80cfa442
--- /dev/null
+++ b/lib/email/send-team-invite.ts
@@ -0,0 +1,73 @@
+import { getEmailService } from '@/lib/email/service'
+import { getSenderForBrand, getBaseUrlForBrand } from '@/lib/email/brand-sender'
+import { resolveBrandForTeam } from '@/lib/branding/resolve'
+import {
+  generateTeamInviteEmailSubject,
+  generateTeamInviteEmailHtml,
+  generateTeamInviteEmailText,
+} from '@/lib/email/invite-templates'
+import { createLogger } from '@/lib/logger'
+
+const log = createLogger('team-invite-mail')
+
+export interface TeamInviteMailResult {
+  /** The accept link, always produced so the inviter can share it directly. */
+  inviteUrl: string
+  /** False when the service is unconfigured or the provider send failed. */
+  emailSent: boolean
+}
+
+/**
+ * Send a byrå-team invitation mail in the team's brand (WL-13): sender
+ * identity via getSenderForBrand(resolveBrandForTeam(teamId)) and the accept
+ * link on the brand's home domain, canonical for brandless teams.
+ *
+ * Shared by invite creation and re-send so the two paths cannot drift. A send
+ * failure never throws: the invitation stays valid and the caller surfaces
+ * emailSent: false together with the link.
+ */
+export async function sendTeamInviteMail(params: {
+  teamId: string
+  email: string
+  inviterEmail: string
+  token: string
+}): Promise<TeamInviteMailResult> {
+  const { teamId, email, inviterEmail, token } = params
+
+  const brand = await resolveBrandForTeam(teamId)
+  const sender = getSenderForBrand(brand)
+  const appUrl = getBaseUrlForBrand(brand)
+  const inviteUrl = `${appUrl}/invite/${token}`
+
+  let emailSent = false
+  const emailService = getEmailService()
+  if (emailService.isConfigured()) {
+    const emailData = {
+      inviterEmail,
+      inviteUrl,
+      appName: sender.brand?.appName,
+    }
+    const result = await emailService.sendEmail({
+      to: email,
+      subject: generateTeamInviteEmailSubject(emailData),
+      html: generateTeamInviteEmailHtml(emailData),
+      text: generateTeamInviteEmailText(emailData),
+      fromName: sender.fromName ?? undefined,
+      fromAddress: sender.fromAddress ?? undefined,
+      replyTo: sender.replyTo ?? undefined,
+    })
+    if (result.success) {
+      emailSent = true
+      log.info('team invite email sent', { to: email, teamId, messageId: result.messageId })
+    } else {
+      log.error('team invite email send failed', new Error(result.error ?? 'unknown'), {
+        to: email,
+        teamId,
+      })
+    }
+  } else {
+    log.warn('email service not configured: team invite email skipped', { to: email, teamId })
+  }
+
+  return { inviteUrl, emailSent }
+}
diff --git a/lib/email/service.ts b/lib/email/service.ts
index a7c18ba0..9561a0ad 100644
--- a/lib/email/service.ts
+++ b/lib/email/service.ts
@@ -15,6 +15,13 @@ export interface SendEmailOptions {
   text?: string
   replyTo?: string
   fromName?: string
+  /**
+   * Explicit From address. Only ever set by lib/email/brand-sender.ts for
+   * brands whose Resend sender domain is VERIFIED. When absent, the provider
+   * sends from its default address (RESEND_FROM_EMAIL) with fromName as the
+   * display name.
+   */
+  fromAddress?: string
   /**
    * Explicit From identity (company's own verified sending domain). When
    * set, the provider sends as "<name> <address>" instead of the platform
diff --git a/lib/email/standard-webhook.ts b/lib/email/standard-webhook.ts
new file mode 100644
index 00000000..0878beab
--- /dev/null
+++ b/lib/email/standard-webhook.ts
@@ -0,0 +1,78 @@
+/**
+ * Standard Webhooks signature verification (https://www.standardwebhooks.com/),
+ * implemented with node:crypto only: the Supabase Send Email hook signs its
+ * requests in this format and the endpoint must stay dependency-free.
+ *
+ * Scheme: the secret is base64 material, presented as "v1,whsec_<base64>"
+ * (Supabase dashboard) or "whsec_<base64>". The signed content is
+ * "<msg-id>.<timestamp>.<raw-body>", HMAC-SHA256 over the decoded secret,
+ * base64-encoded. The webhook-signature header carries a space-separated
+ * list of "<version>,<signature>" entries; only symmetric v1 entries are
+ * considered.
+ */
+
+import { createHmac, timingSafeEqual } from 'node:crypto'
+
+const DEFAULT_TOLERANCE_SECONDS = 300
+
+export interface StandardWebhookVerificationInput {
+  /** Raw secret ("v1,whsec_...", "whsec_..." or bare base64). */
+  secret: string
+  /** Raw request body, byte-identical to what was signed. */
+  payload: string
+  /** webhook-id header. */
+  id: string | null
+  /** webhook-timestamp header (unix seconds). */
+  timestamp: string | null
+  /** webhook-signature header. */
+  signature: string | null
+  /** Replay window in seconds; default 300. */
+  toleranceSeconds?: number
+  /** Test hook: current time in ms. */
+  nowMs?: number
+}
+
+function decodeSecret(secret: string): Buffer {
+  let s = secret.trim()
+  if (s.startsWith('v1,')) s = s.slice(3)
+  if (s.startsWith('whsec_')) s = s.slice(6)
+  return Buffer.from(s, 'base64')
+}
+
+/**
+ * True only when the signature verifies and the timestamp is within the
+ * replay tolerance. Never throws: any malformed input is a failed
+ * verification.
+ */
+export function verifyStandardWebhookSignature(
+  input: StandardWebhookVerificationInput,
+): boolean {
+  const { secret, payload, id, timestamp, signature } = input
+  if (!secret || !id || !timestamp || !signature) return false
+
+  const ts = Number(timestamp)
+  if (!Number.isFinite(ts)) return false
+  const nowSeconds = (input.nowMs ?? Date.now()) / 1000
+  const tolerance = input.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS
+  if (Math.abs(nowSeconds - ts) > tolerance) return false
+
+  const key = decodeSecret(secret)
+  if (key.length === 0) return false
+
+  const expected = createHmac('sha256', key)
+    .update(`${id}.${timestamp}.${payload}`)
+    .digest()
+
+  for (const part of signature.split(/\s+/)) {
+    const commaIndex = part.indexOf(',')
+    if (commaIndex === -1) continue
+    const version = part.slice(0, commaIndex)
+    const candidateBase64 = part.slice(commaIndex + 1)
+    if (version !== 'v1' || !candidateBase64) continue
+    const candidate = Buffer.from(candidateBase64, 'base64')
+    if (candidate.length === expected.length && timingSafeEqual(candidate, expected)) {
+      return true
+    }
+  }
+  return false
+}
diff --git a/lib/entitlements/team-agreement.ts b/lib/entitlements/team-agreement.ts
new file mode 100644
index 00000000..74560d9c
--- /dev/null
+++ b/lib/entitlements/team-agreement.ts
@@ -0,0 +1,64 @@
+import type { SupabaseClient } from '@supabase/supabase-js'
+
+/**
+ * WL-10 billing honesty: a company attached to a byrå team whose team holds
+ * an active manual (partner-agreement) grant is covered by the byrå's
+ * agreement. The billing surface shows an "Ingår i <byråns namn>s avtal"
+ * state instead of the upgrade pitch for these companies.
+ */
+export interface TeamAgreement {
+  teamName: string
+}
+
+/**
+ * Resolve whether `companyId` is covered by a byrå-team agreement.
+ *
+ * The v1 partner deal is manual team-scoped grant rows: source='manual',
+ * team_id set, expires_at = contract end or NULL (WL-10 resolution). Any such
+ * unexpired row on the company's team counts; grace handling is simply ops
+ * setting expires_at, after which this returns null and the company falls
+ * back to the standard non-paying behavior.
+ *
+ * MUST be called with the SERVICE client: end clients are never members of
+ * the byrå team (WL-08), so RLS hides both the team row and the team-scoped
+ * grant rows from their session. The caller is responsible for having
+ * authorized companyId (requireCompanyId) before passing it here.
+ */
+export async function getTeamAgreement(
+  serviceClient: SupabaseClient,
+  companyId: string,
+): Promise<TeamAgreement | null> {
+  const { data: company } = await serviceClient
+    .from('companies')
+    .select('team_id')
+    .eq('id', companyId)
+    .maybeSingle()
+
+  const teamId = (company as { team_id: string | null } | null)?.team_id ?? null
+  if (!teamId) return null
+
+  const { data: team } = await serviceClient
+    .from('teams')
+    .select('name, kind')
+    .eq('id', teamId)
+    .maybeSingle()
+
+  const teamRow = team as { name: string; kind: string } | null
+  if (!teamRow || teamRow.kind !== 'byra') return null
+
+  const { data: grants, error: grantsError } = await serviceClient
+    .from('capability_grants')
+    .select('expires_at')
+    .eq('team_id', teamId)
+    .eq('source', 'manual')
+
+  // Fail-closed on a read error: no fabricated agreement state.
+  if (grantsError) return null
+
+  const now = Date.now()
+  const active = ((grants ?? []) as { expires_at: string | null }[]).some(
+    (g) => g.expires_at === null || new Date(g.expires_at).getTime() > now,
+  )
+
+  return active ? { teamName: teamRow.name } : null
+}
diff --git a/lib/invoices/__tests__/invoice-deliveries.test.ts b/lib/invoices/__tests__/invoice-deliveries.test.ts
index ebe441ee..5c170edd 100644
--- a/lib/invoices/__tests__/invoice-deliveries.test.ts
+++ b/lib/invoices/__tests__/invoice-deliveries.test.ts
@@ -5,6 +5,7 @@ import type { EmailService } from '@/lib/email/service'
 const mockUploadDocument = vi.fn()
 const mockDeleteDocument = vi.fn()
 const mockCreateServiceClient = vi.fn()
+const mockGetSenderForCompany = vi.fn()
 vi.mock('@/lib/core/documents/document-service', () => ({
   uploadDocument: (...args: unknown[]) => mockUploadDocument(...args),
   deleteDocument: (...args: unknown[]) => mockDeleteDocument(...args),
@@ -12,6 +13,9 @@ vi.mock('@/lib/core/documents/document-service', () => ({
 vi.mock('@/lib/supabase/server', () => ({
   createServiceClient: () => mockCreateServiceClient(),
 }))
+vi.mock('@/lib/email/brand-sender', () => ({
+  getSenderForCompany: (...args: unknown[]) => mockGetSenderForCompany(...args),
+}))
 
 import {
   InvoiceDeliverySnapshotError,
@@ -97,6 +101,13 @@ describe('invoice delivery tracking', () => {
       sha256_hash: 'sha256-exact-pdf',
     })
     mockDeleteDocument.mockResolvedValue({ ok: true })
+    // Default: unbranded company (today's sender, byte for byte).
+    mockGetSenderForCompany.mockResolvedValue({
+      fromName: null,
+      fromAddress: null,
+      replyTo: null,
+      brand: null,
+    })
   })
 
   it('persists the exact payload before sending and records provider success', async () => {
@@ -152,6 +163,56 @@ describe('invoice delivery tracking', () => {
     })
   })
 
+  it('keeps the From header unbranded for a company without a brand', async () => {
+    const { supabase } = makeSupabase()
+    const sendEmail = vi.fn().mockResolvedValue({ success: true, provider: 'resend' })
+
+    await sendTrackedInvoiceEmail(makeInput(supabase, makeEmailService(sendEmail)))
+
+    expect(mockGetSenderForCompany).toHaveBeenCalledWith('company-1')
+    const options = sendEmail.mock.calls[0][0]
+    expect(options.fromName).toBe('Example AB')
+    expect(options.fromAddress).toBeUndefined()
+    expect(options.replyTo).toBe('sender@example.com')
+  })
+
+  it('rides the verified brand sender domain while keeping the company display name', async () => {
+    mockGetSenderForCompany.mockResolvedValue({
+      fromName: 'Siffra',
+      fromAddress: 'noreply@post.siffra.se',
+      replyTo: 'support@siffra.se',
+      brand: { appName: 'Siffra' },
+    })
+    const { supabase } = makeSupabase()
+    const sendEmail = vi.fn().mockResolvedValue({ success: true, provider: 'resend' })
+
+    await sendTrackedInvoiceEmail(makeInput(supabase, makeEmailService(sendEmail)))
+
+    const options = sendEmail.mock.calls[0][0]
+    // The COMPANY stays the displayed sender; only the address is the brand's.
+    expect(options.fromName).toBe('Example AB')
+    expect(options.fromAddress).toBe('noreply@post.siffra.se')
+    // Reply-to stays the company's own address, not the brand support box.
+    expect(options.replyTo).toBe('sender@example.com')
+  })
+
+  it('does not attach a From address for an unverified brand sender domain', async () => {
+    mockGetSenderForCompany.mockResolvedValue({
+      fromName: 'Siffra',
+      fromAddress: null,
+      replyTo: 'support@siffra.se',
+      brand: { appName: 'Siffra' },
+    })
+    const { supabase } = makeSupabase()
+    const sendEmail = vi.fn().mockResolvedValue({ success: true, provider: 'resend' })
+
+    await sendTrackedInvoiceEmail(makeInput(supabase, makeEmailService(sendEmail)))
+
+    const options = sendEmail.mock.calls[0][0]
+    expect(options.fromName).toBe('Example AB')
+    expect(options.fromAddress).toBeUndefined()
+  })
+
   it('does not call the provider when the immutable snapshot cannot be saved', async () => {
     const { supabase } = makeSupabase({
       snapshotData: null,
diff --git a/lib/invoices/__tests__/reminder-processor-payment-gate.test.ts b/lib/invoices/__tests__/reminder-processor-payment-gate.test.ts
index 853cb00c..9bd376cd 100644
--- a/lib/invoices/__tests__/reminder-processor-payment-gate.test.ts
+++ b/lib/invoices/__tests__/reminder-processor-payment-gate.test.ts
@@ -70,6 +70,10 @@ vi.mock('@/lib/email/service', () => ({
 vi.mock('@/lib/bookkeeping/reminder-fee-entries', () => ({
   createReminderFeeEntry: mockCreateReminderFeeEntry,
 }))
+vi.mock('@/lib/email/brand-sender', () => ({
+  getSenderForCompany: vi.fn().mockResolvedValue({ brand: null }),
+  getBaseUrlForBrand: vi.fn().mockReturnValue('https://app.accounted.test'),
+}))
 
 import { processOverdueReminders } from '../reminder-processor'
 
diff --git a/lib/invoices/__tests__/reminder-processor.test.ts b/lib/invoices/__tests__/reminder-processor.test.ts
index a55e6153..a6a4b472 100644
--- a/lib/invoices/__tests__/reminder-processor.test.ts
+++ b/lib/invoices/__tests__/reminder-processor.test.ts
@@ -28,16 +28,24 @@ vi.mock('@supabase/ssr', () => {
   }
 })
 
+const sendEmailSpy = vi.hoisted(() => vi.fn())
+
 vi.mock('@/lib/email/invoice-sender', () => ({
   resolveInvoiceSender: vi.fn().mockResolvedValue(undefined),
 }))
 
 vi.mock('@/lib/email/service', () => ({
   getEmailService: () => ({
-    sendEmail: vi.fn().mockResolvedValue({ success: true }),
+    sendEmail: sendEmailSpy,
   }),
 }))
 
+const brandSenderMock = vi.hoisted(() => ({
+  getSenderForCompany: vi.fn(),
+  getBaseUrlForBrand: vi.fn(),
+}))
+vi.mock('@/lib/email/brand-sender', () => brandSenderMock)
+
 import {
   processOverdueReminders,
   determineReminderLevel,
@@ -47,6 +55,15 @@ import {
 import { makeCompanySettings, makeCustomer, makeInvoice } from '@/tests/helpers'
 import { getReminderDaysConfig } from '@/lib/email/reminder-templates'
 
+sendEmailSpy.mockResolvedValue({ success: true })
+brandSenderMock.getSenderForCompany.mockResolvedValue({
+  fromName: null,
+  fromAddress: null,
+  replyTo: null,
+  brand: null,
+})
+brandSenderMock.getBaseUrlForBrand.mockReturnValue('https://app.gnubok.se')
+
 describe('determineReminderLevel', () => {
   it('returns null below the level-1 threshold', () => {
     expect(determineReminderLevel(10, [])).toBeNull()
@@ -176,6 +193,94 @@ describe('processOverdueReminders: credit-note filter', () => {
   })
 })
 
+describe('sendReminder: brand mail (WL-13)', () => {
+  const invoice = Object.assign(
+    makeInvoice({
+      company_id: 'company-1',
+      invoice_number: 'F-1001',
+      due_date: '2026-06-01',
+      total: 1250,
+      currency: 'SEK',
+    }),
+    { customer: makeCustomer({ name: 'Erik Andersson', email: 'erik@example.se' }) },
+  )
+  // bankgiro satisfies the payment-account gate; without a usable SEK
+  // account sendReminder refuses before ever reaching the mail path.
+  const company = makeCompanySettings({
+    company_name: 'Kund AB',
+    email: 'faktura@kund.se',
+    bankgiro: '123-4567',
+  })
+  const surcharges = {
+    interestAmount: 0,
+    interestRate: 0,
+    interestFromDate: '2026-06-02',
+    interestDays: 0,
+    reminderFee: 0,
+  }
+
+  beforeEach(() => {
+    sendEmailSpy.mockClear()
+    sendEmailSpy.mockResolvedValue({ success: true })
+    brandSenderMock.getSenderForCompany.mockResolvedValue({
+      fromName: null,
+      fromAddress: null,
+      replyTo: null,
+      brand: null,
+    })
+    brandSenderMock.getBaseUrlForBrand.mockReturnValue('https://app.gnubok.se')
+  })
+
+  it('unbranded: canonical action link and today\'s From fields', async () => {
+    await sendReminder(invoice, company, 1, 'tok-1', surcharges)
+
+    const options = sendEmailSpy.mock.calls[0][0]
+    expect(options.text).toContain('https://app.gnubok.se/invoice-action/tok-1')
+    expect(options.fromName).toBe('Kund AB')
+    expect(options.replyTo).toBe('faktura@kund.se')
+    expect(options.fromAddress).toBeUndefined()
+  })
+
+  it('branded: action link on the brand domain, mail rides the verified brand sender', async () => {
+    const brand = { appName: 'Siffra', domain: 'app.siffra.se' }
+    brandSenderMock.getSenderForCompany.mockResolvedValue({
+      fromName: 'Siffra',
+      fromAddress: 'noreply@post.siffra.se',
+      replyTo: 'support@siffra.se',
+      brand,
+    })
+    brandSenderMock.getBaseUrlForBrand.mockReturnValue('https://app.siffra.se')
+
+    await sendReminder(invoice, company, 1, 'tok-1', surcharges)
+
+    expect(brandSenderMock.getSenderForCompany).toHaveBeenCalledWith('company-1')
+    expect(brandSenderMock.getBaseUrlForBrand).toHaveBeenCalledWith(brand)
+    const options = sendEmailSpy.mock.calls[0][0]
+    expect(options.text).toContain('https://app.siffra.se/invoice-action/tok-1')
+    // The COMPANY stays the displayed sender; only the address is the brand's.
+    expect(options.fromName).toBe('Kund AB')
+    expect(options.fromAddress).toBe('noreply@post.siffra.se')
+    expect(options.replyTo).toBe('faktura@kund.se')
+    expect(options.html).not.toMatch(/accounted/i)
+  })
+
+  it('unverified brand sender domain: brand link but no From address override', async () => {
+    brandSenderMock.getSenderForCompany.mockResolvedValue({
+      fromName: 'Siffra',
+      fromAddress: null,
+      replyTo: 'support@siffra.se',
+      brand: { appName: 'Siffra', domain: 'app.siffra.se' },
+    })
+    brandSenderMock.getBaseUrlForBrand.mockReturnValue('https://app.siffra.se')
+
+    await sendReminder(invoice, company, 1, 'tok-1', surcharges)
+
+    const options = sendEmailSpy.mock.calls[0][0]
+    expect(options.text).toContain('https://app.siffra.se/invoice-action/tok-1')
+    expect(options.fromAddress).toBeUndefined()
+  })
+})
+
 describe('sendReminder payment-account gate', () => {
   const customer = makeCustomer({ email: 'kund@example.se' })
   const surcharges = { interestAmount: 0, interestRate: 0.1, interestDays: 0, reminderFee: 60 }
diff --git a/lib/invoices/invoice-deliveries.ts b/lib/invoices/invoice-deliveries.ts
index 5a107682..c5f9f327 100644
--- a/lib/invoices/invoice-deliveries.ts
+++ b/lib/invoices/invoice-deliveries.ts
@@ -1,5 +1,6 @@
 import type { SupabaseClient } from '@supabase/supabase-js'
 import type { EmailService, SendEmailOptions, SendEmailResult } from '@/lib/email/service'
+import { getSenderForCompany } from '@/lib/email/brand-sender'
 import { deleteDocument, uploadDocument } from '@/lib/core/documents/document-service'
 import { createServiceClient } from '@/lib/supabase/server'
 import type { InvoiceDelivery } from '@/types'
@@ -145,6 +146,12 @@ export async function sendTrackedInvoiceEmail(
     )
   }
 
+  // Brand mail (WL-13): the invoice mail keeps the COMPANY as the displayed
+  // sender exactly as today, but rides the brand's verified sender domain
+  // when the company's team has one. No brand, or an unverified sender
+  // domain, leaves the From header byte-identical to before.
+  const brandSender = await getSenderForCompany(companyId)
+
   const emailOptions: SendEmailOptions = {
     to,
     cc,
@@ -154,6 +161,9 @@ export async function sendTrackedInvoiceEmail(
     text,
     replyTo,
     fromName,
+    ...(brandSender.fromAddress ? { fromAddress: brandSender.fromAddress } : {}),
+    // The company's own verified sender wins over the brand address
+    // (buildFromHeader gives `from` precedence).
     from,
     attachments: [
       {
diff --git a/lib/invoices/reminder-processor.ts b/lib/invoices/reminder-processor.ts
index 53aa5154..31e3c67e 100644
--- a/lib/invoices/reminder-processor.ts
+++ b/lib/invoices/reminder-processor.ts
@@ -1,5 +1,6 @@
 import { createServerClient } from '@supabase/ssr'
 import { getEmailService } from '@/lib/email/service'
+import { getSenderForCompany, getBaseUrlForBrand } from '@/lib/email/brand-sender'
 import { resolveInvoiceSender, type InvoiceSenderIdentity } from '@/lib/email/invoice-sender'
 import {
   generateReminderEmailHtml,
@@ -139,8 +140,12 @@ export async function sendReminder(
 
   const daysOverdue = calculateDaysOverdue(invoice.due_date)
 
-  // Build action URL (public page for customer response)
-  const baseUrl = process.env.NEXT_PUBLIC_APP_URL || 'https://app.erp-base.se'
+  // Brand mail (WL-13): the action link points at the company's home domain
+  // and the mail rides the brand's verified sender domain, while the COMPANY
+  // stays the displayed sender exactly as today. No brand = canonical URL
+  // and today's From header.
+  const brandSender = await getSenderForCompany(invoice.company_id)
+  const baseUrl = getBaseUrlForBrand(brandSender.brand)
   const actionUrl = `${baseUrl}/invoice-action/${actionToken}`
 
   const emailData = {
@@ -160,6 +165,9 @@ export async function sendReminder(
     text: generateReminderEmailText(emailData),
     replyTo: company.email || undefined,
     fromName: company.company_name || undefined,
+    ...(brandSender.fromAddress ? { fromAddress: brandSender.fromAddress } : {}),
+    // The company's own verified sender wins over the brand address
+    // (buildFromHeader gives `from` precedence).
     from: sender,
   })
 
diff --git a/lib/supabase/__tests__/middleware.test.ts b/lib/supabase/__tests__/middleware.test.ts
index c9418388..71bbaa87 100644
--- a/lib/supabase/__tests__/middleware.test.ts
+++ b/lib/supabase/__tests__/middleware.test.ts
@@ -27,6 +27,20 @@ const state = vi.hoisted(() => ({
     }>
     error: unknown
   },
+  // Rows the team_members query resolves to (the byrå exception in the
+  // no-company branch and the home-domain guard both await eq-terminated
+  // chains, so the from() mock makes exactly that table thenable).
+  byraMemberships: [] as Array<{
+    role?: string
+    teams: { kind: string; brands?: { domain: string } | Array<{ domain: string }> | null }
+  }>,
+  // Rows any awaited company_members filter chain resolves to: the Rule 2
+  // home-domain client lookup AND the Rule 1 canonical personal-company
+  // exemption both land here (each scenario exercises only one of them).
+  clientMemberships: [] as Array<Record<string, unknown>>,
+  clientMembershipsError: null as unknown,
+  // What the mocked resolveBrandByHost returns for the request host.
+  hostBrand: null as null | { teamId: string },
   signOut: vi.fn(async () => ({ error: null })),
   // Row returned for user_preferences reads (the auto_logout mint lookup).
   userPreferences: null as null | { auto_logout: boolean },
@@ -54,7 +68,23 @@ vi.mock('@supabase/ssr', () => ({
       const chain: Record<string, unknown> = {}
       const self = new Proxy(chain, {
         get: (_t, prop) => {
-          if (prop === 'then') return undefined
+          if (prop === 'then') {
+            // The byrå-membership lookup and the home-domain client lookup
+            // await their filter chains directly (no .maybeSingle terminal),
+            // so those tables must be thenable.
+            if (table === 'team_members') {
+              return (resolve: (v: unknown) => void) =>
+                resolve({ data: state.byraMemberships, error: null })
+            }
+            if (table === 'company_members') {
+              return (resolve: (v: unknown) => void) =>
+                resolve({
+                  data: state.clientMembershipsError ? null : state.clientMemberships,
+                  error: state.clientMembershipsError,
+                })
+            }
+            return undefined
+          }
           if (prop === 'maybeSingle' || prop === 'single') {
             return async () => ({
               data:
@@ -86,6 +116,13 @@ vi.mock('@/lib/logger', () => {
   return { createLogger: () => logger }
 })
 
+vi.mock('@/lib/branding/resolve', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@/lib/branding/resolve')>()),
+  resolveBrandByHost: vi.fn(async () =>
+    state.hostBrand ? { teamId: state.hostBrand.teamId } : null,
+  ),
+}))
+
 import { updateSession } from '../middleware'
 import {
   createSessionTimeoutState,
@@ -105,6 +142,10 @@ function run(path: string, init?: RequestInit) {
   return updateSession(new NextRequest(`${ORIGIN}${path}`, init))
 }
 
+function runAt(origin: string, path: string, headers?: Record<string, string>) {
+  return updateSession(new NextRequest(`${origin}${path}`, { headers }))
+}
+
 describe('updateSession redirect destinations', () => {
   const envBackup = {
     require: process.env.NEXT_PUBLIC_REQUIRE_MFA,
@@ -128,6 +169,10 @@ describe('updateSession redirect destinations', () => {
       data: [{ company_id: 'company-1', locale: 'sv', used_fallback: false }],
       error: null,
     }
+    state.byraMemberships = []
+    state.clientMemberships = []
+    state.clientMembershipsError = null
+    state.hostBrand = null
     state.userPreferences = null
     state.userPreferencesError = null
     delete process.env.NEXT_PUBLIC_REQUIRE_MFA
@@ -577,6 +622,235 @@ describe('updateSession redirect destinations', () => {
     })
   })
 
+  // ── No-company branch: the byrå cockpit exception ─────────────────────
+
+  describe('byrå team members with zero companies', () => {
+    beforeEach(() => {
+      state.user = SIGNED_IN
+      // No resolvable company at all (fresh byrå, no client memberships).
+      state.company = {
+        data: [{ company_id: null, locale: 'sv', used_fallback: true }],
+        error: null,
+      }
+    })
+
+    it('steers a byrå owner from the dashboard root to the empty cockpit, not onboarding', async () => {
+      state.byraMemberships = [{ role: 'owner', teams: { kind: 'byra' } }]
+
+      const response = await run('/')
+
+      expect(new URL(locationOf(response)!).pathname).toBe('/byra')
+    })
+
+    it('lets a byrå admin through to cockpit routes', async () => {
+      state.byraMemberships = [{ role: 'admin', teams: { kind: 'byra' } }]
+
+      for (const path of ['/byra', '/clients', '/companies/new-client', '/settings/brand']) {
+        const response = await run(path)
+        expect(response.status).toBe(200)
+      }
+    })
+
+    it('steers a plain byrå member to the cockpit too (any role counts)', async () => {
+      state.byraMemberships = [{ role: 'member', teams: { kind: 'byra' } }]
+
+      const response = await run('/')
+
+      expect(new URL(locationOf(response)!).pathname).toBe('/byra')
+    })
+
+    it('keeps the onboarding redirect for non-byrå users', async () => {
+      state.byraMemberships = []
+
+      const response = await run('/')
+
+      expect(new URL(locationOf(response)!).pathname).toBe('/onboarding')
+    })
+  })
+
+  // ── Home-domain affinity (WL): the domain corrects itself ─────────────
+
+  describe('home-domain affinity', () => {
+    const ARBORE = 'https://arbore.accounted.se'
+    const ACOUNT = 'https://acount.accounted.se'
+
+    beforeEach(() => {
+      state.user = SIGNED_IN
+    })
+
+    it('redirects a byrå member on a foreign byrå domain to their own domain', async () => {
+      state.byraMemberships = [
+        { teams: { kind: 'byra', brands: { domain: 'acount.accounted.se' } } },
+      ]
+
+      const response = await runAt(ARBORE, '/')
+
+      expect(locationOf(response)).toBe(`${ACOUNT}/`)
+    })
+
+    it('redirects a byrå member on the platform domain to their byrå domain', async () => {
+      state.byraMemberships = [
+        { teams: { kind: 'byra', brands: { domain: 'arbore.accounted.se' } } },
+      ]
+
+      const response = await runAt('https://app.gnubok.se', '/')
+
+      expect(locationOf(response)).toBe(`${ARBORE}/`)
+    })
+
+    it('preserves path and query across the affinity redirect', async () => {
+      state.byraMemberships = [
+        { teams: { kind: 'byra', brands: { domain: 'arbore.accounted.se' } } },
+      ]
+
+      const response = await runAt('https://app.gnubok.se', '/invoices/abc?tab=payments')
+
+      expect(locationOf(response)).toBe(`${ARBORE}/invoices/abc?tab=payments`)
+    })
+
+    it('lets a byrå member through on their own domain and caches the verdict', async () => {
+      state.byraMemberships = [
+        { teams: { kind: 'byra', brands: { domain: 'arbore.accounted.se' } } },
+      ]
+
+      const response = await runAt(ARBORE, '/byra')
+
+      expect(response.status).toBe(200)
+      expect(response.headers.get('set-cookie')).toContain(
+        'gnubok-home-ok=arbore.accounted.se',
+      )
+    })
+
+    it('keeps a byrå member with a brandless personal company on the canonical host', async () => {
+      state.byraMemberships = [
+        { teams: { kind: 'byra', brands: { domain: 'arbore.accounted.se' } } },
+      ]
+      // A personal company with no team at all: homed on canonical.
+      state.clientMemberships = [{ companies: { team_id: null, teams: null } }]
+
+      const response = await runAt('https://app.gnubok.se', '/')
+
+      expect(response.status).toBe(200)
+      expect(locationOf(response)).toBeNull()
+      expect(response.headers.get('set-cookie')).toContain(
+        'gnubok-home-ok=app.gnubok.se',
+      )
+    })
+
+    it('counts a company whose team has no brand as canonical-homed too', async () => {
+      state.byraMemberships = [
+        { teams: { kind: 'byra', brands: { domain: 'arbore.accounted.se' } } },
+      ]
+      state.clientMemberships = [
+        { companies: { team_id: 'team-personal', teams: { brands: null } } },
+      ]
+
+      const response = await runAt('https://app.gnubok.se', '/')
+
+      expect(response.status).toBe(200)
+      expect(response.headers.get('set-cookie')).toContain(
+        'gnubok-home-ok=app.gnubok.se',
+      )
+    })
+
+    it('still redirects a byrå member whose companies are all brand-homed', async () => {
+      state.byraMemberships = [
+        { teams: { kind: 'byra', brands: { domain: 'arbore.accounted.se' } } },
+      ]
+      state.clientMemberships = [
+        { companies: { team_id: 'team-arbore', teams: { brands: { id: 'brand-1' } } } },
+      ]
+
+      const response = await runAt('https://app.gnubok.se', '/')
+
+      expect(locationOf(response)).toBe(`${ARBORE}/`)
+    })
+
+    it('still redirects off a FOREIGN byrå domain even with a canonical personal company', async () => {
+      state.byraMemberships = [
+        { teams: { kind: 'byra', brands: { domain: 'acount.accounted.se' } } },
+      ]
+      state.clientMemberships = [{ companies: { team_id: null, teams: null } }]
+
+      const response = await runAt(ARBORE, '/')
+
+      expect(locationOf(response)).toBe(`${ACOUNT}/`)
+    })
+
+    it('stays put without caching when the canonical-company lookup fails', async () => {
+      const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+      state.byraMemberships = [
+        { teams: { kind: 'byra', brands: { domain: 'arbore.accounted.se' } } },
+      ]
+      state.clientMembershipsError = { message: 'connection reset' }
+
+      const response = await runAt('https://app.gnubok.se', '/')
+
+      // Fail open: no redirect, and no home-ok cookie so the next request
+      // re-runs the check instead of freezing the error verdict for the TTL.
+      expect(response.status).toBe(200)
+      expect(response.headers.get('set-cookie') ?? '').not.toContain('gnubok-home-ok')
+      expect(errorSpy).toHaveBeenCalled()
+      errorSpy.mockRestore()
+    })
+
+    it('tolerates the array shape for the embedded brand', async () => {
+      state.byraMemberships = [
+        { teams: { kind: 'byra', brands: [{ domain: 'acount.accounted.se' }] } },
+      ]
+
+      const response = await runAt(ARBORE, '/')
+
+      expect(locationOf(response)).toBe(`${ACOUNT}/`)
+    })
+
+    it('redirects a user with no byrå ties off a brand domain to the platform', async () => {
+      state.hostBrand = { teamId: 'team-arbore' }
+
+      const response = await runAt(ARBORE, '/')
+
+      expect(locationOf(response)).toBe('https://app.gnubok.se/')
+    })
+
+    it('keeps a byrå client user on the byrå domain their company lives under', async () => {
+      state.hostBrand = { teamId: 'team-arbore' }
+      state.clientMemberships = [{ company_id: 'company-1' }]
+
+      const response = await runAt(ARBORE, '/')
+
+      expect(response.status).toBe(200)
+    })
+
+    it('does nothing on the platform domain for regular users', async () => {
+      const response = await runAt('https://app.gnubok.se', '/')
+
+      expect(response.status).toBe(200)
+    })
+
+    it('does nothing on localhost and direct Vercel hosts', async () => {
+      state.byraMemberships = [
+        { teams: { kind: 'byra', brands: { domain: 'arbore.accounted.se' } } },
+      ]
+
+      for (const origin of [ORIGIN, 'https://erp-base-abc123.vercel.app']) {
+        const response = await runAt(origin, '/byra')
+        expect(response.status).toBe(200)
+      }
+    })
+
+    it('skips the check while the host-scoped OK cookie is fresh', async () => {
+      state.byraMemberships = [
+        { teams: { kind: 'byra', brands: { domain: 'acount.accounted.se' } } },
+      ]
+
+      const response = await runAt(ARBORE, '/', {
+        cookie: 'gnubok-home-ok=arbore.accounted.se',
+      })
+
+      expect(response.status).toBe(200)
+    })
+  })
+
   // ── MFA semantics that must not change ────────────────────────────────
 
   describe('per-request timing header and log line', () => {
diff --git a/lib/supabase/middleware.ts b/lib/supabase/middleware.ts
index 88ff9943..c4ce5442 100644
--- a/lib/supabase/middleware.ts
+++ b/lib/supabase/middleware.ts
@@ -15,6 +15,7 @@ import { apiPathSkipsMfaGate } from '@/lib/auth/api-mfa-gate'
 import { DEFAULT_LOCALE, LOCALE_COOKIE, isLocale } from '@/i18n/config'
 import { userHasPassword } from '@/lib/auth/has-password'
 import { safeReturnTo } from '@/lib/auth/safe-return-to'
+import { normalizeHost, resolveBrandByHost } from '@/lib/branding/resolve'
 import {
   apiRequestSkipsSessionTimeout,
   createSessionTimeoutState,
@@ -39,6 +40,14 @@ import {
 
 const log = createLogger('proxy')
 
+/**
+ * Host-scoped marker that the signed-in user is on their home domain, so the
+ * affinity check below costs zero queries on the hot path. Expiry re-runs the
+ * check, which bounds staleness after team-membership changes.
+ */
+const HOME_DOMAIN_OK_COOKIE = 'gnubok-home-ok'
+const HOME_DOMAIN_OK_MAX_AGE = 15 * 60
+
 /**
  * Auth proxy entry point. Wraps the real work so every response carries a
  * per-phase timing header and emits one structured log line, mirroring what
@@ -320,6 +329,35 @@ async function updateSessionInner(
     return bounceToAuth(request, '/login')
   }
 
+  // ── Home-domain affinity (WL, founder call 2026-08-05) ──────────────────
+  // Every signed-in user has a home domain: byrå team members home on their
+  // brand's domain, everyone else on the platform app URL, except a byrå's
+  // client users, whose home is the byrå domain their companies live under.
+  // On a mismatch the request is redirected to the home domain's root:
+  // sessions are per domain, so the user lands on the RIGHT branded login
+  // and signs in there ("the domain corrects itself"). This complements the
+  // WL-01 signpost, which handles per-company homing INSIDE a domain and
+  // stays the answer for multi-domain company rosters. Exemption: byrå
+  // staff who also have canonical-homed companies stay put on the canonical
+  // host; the signpost handles per-company homing.
+  const homeOutcome = await resolveHomeDomainOutcome(supabase, user.id, request)
+  if (homeOutcome.redirectTo) {
+    return NextResponse.redirect(homeOutcome.redirectTo)
+  }
+  if (homeOutcome.cacheOk) {
+    supabaseResponse.cookies.set(
+      HOME_DOMAIN_OK_COOKIE,
+      normalizeHost(request.nextUrl.hostname),
+      {
+        path: '/',
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+        maxAge: HOME_DOMAIN_OK_MAX_AGE,
+      },
+    )
+  }
+
   // /mfa/enroll: gate behind has-password. BankID-only users who reach this
   // page can lock themselves out: Supabase requires AAL2 to change password
   // or unenroll MFA, and AAL2 needs a prior password sign-in. Force them to
@@ -461,6 +499,34 @@ async function updateSessionInner(
       return supabaseResponse
     }
 
+    // Byrå team members (any role: widened from owner/admin, founder call
+    // 2026-08-05) with zero client companies (a fresh byrå) home to the
+    // EMPTY cockpit, never to the company onboarding wizard: clients are
+    // created from the cockpit, and forcing the wizard here would make a
+    // byrå user create a personal company just to get in. Cockpit-shaped
+    // paths pass through (the dashboard layout renders its no-company shell);
+    // everything else is steered to /byra. API requests pass through so the
+    // routes' own guards answer with JSON instead of an HTML redirect.
+    // The query runs only in the rare no-company state: zero hot-path cost.
+    const { data: byraRows } = await supabase
+      .from('team_members')
+      .select('role, teams:team_id!inner(kind)')
+      .eq('user_id', user.id)
+      .eq('teams.kind', 'byra')
+    const isByraMember = (byraRows ?? []).length > 0
+    if (isByraMember) {
+      const isByraNoCompanyAllowed =
+        pathname.startsWith('/byra') ||
+        pathname.startsWith('/clients') ||
+        pathname.startsWith('/companies/new') ||
+        pathname.startsWith('/settings') ||
+        pathname.startsWith('/api/')
+      if (isByraNoCompanyAllowed) {
+        return supabaseResponse
+      }
+      return NextResponse.redirect(new URL('/byra', request.url))
+    }
+
     // Enrichment lives in the user-keyed `bankid_enrichment` table (migration
     // 20260506160000), it cannot live in extension_data, which is
     // company-scoped, and the user has no company yet on this path.
@@ -650,6 +716,167 @@ function bounceToAuth(
   return NextResponse.redirect(url)
 }
 
+/**
+ * Hosts that carry no brand affinity: local dev and direct Vercel
+ * deployment URLs must never bounce a signed-in user to a product domain.
+ */
+function isAffinityExemptHost(host: string): boolean {
+  return (
+    !host ||
+    host === 'localhost' ||
+    host.endsWith('.localhost') ||
+    host.endsWith('.vercel.app') ||
+    /^\d{1,3}(\.\d{1,3}){3}$/.test(host)
+  )
+}
+
+/**
+ * Decide whether this signed-in request sits on the user's home domain.
+ *
+ * Rules (founder call 2026-08-05):
+ *   1. A byrå team member's home is their brand's domain: any other product
+ *      host (a foreign byrå domain OR the platform domain) redirects there,
+ *      EXCEPT on the canonical platform host when the member also has a
+ *      company homed there (a company whose team has no brand): they stay,
+ *      and the WL-01 signpost handles per-company homing.
+ *   2. A non-member on a brand domain redirects to the platform app URL,
+ *      UNLESS one of their companies is homed under that brand's team (the
+ *      byrå's own client users log in on the byrå domain).
+ *   3. Everyone else stays put.
+ *
+ * `cacheOk` marks a positive "this is home" verdict, cached in a host-scoped
+ * cookie by the caller. Query failures fail open with no caching, so a
+ * transient error neither locks anyone out nor sticks for a TTL window.
+ */
+async function resolveHomeDomainOutcome(
+  supabase: ReturnType<typeof createServerClient>,
+  userId: string,
+  request: NextRequest,
+): Promise<{ redirectTo: URL | null; cacheOk: boolean }> {
+  const stay = { redirectTo: null, cacheOk: false }
+  const host = normalizeHost(request.nextUrl.hostname)
+  if (isAffinityExemptHost(host)) return stay
+  if (request.cookies.get(HOME_DOMAIN_OK_COOKIE)?.value === host) return stay
+
+  // Rule 1: the user's own byrå brand domains (RLS: members read their brand).
+  const { data: byraRows, error: byraError } = await supabase
+    .from('team_members')
+    .select('teams:team_id!inner(kind, brands(domain))')
+    .eq('user_id', userId)
+    .eq('teams.kind', 'byra')
+  if (byraError) {
+    console.error('[middleware] home-domain byrå lookup failed', byraError)
+    return stay
+  }
+
+  const byraDomains: string[] = []
+  for (const row of byraRows ?? []) {
+    const teams = (row as { teams?: { brands?: unknown } | null }).teams
+    const brands = teams?.brands
+    // One brand per team (brands.team_id unique): PostgREST returns an
+    // object, but tolerate the array shape too.
+    const list = Array.isArray(brands) ? brands : brands ? [brands] : []
+    for (const entry of list) {
+      const domain = (entry as { domain?: unknown }).domain
+      if (typeof domain === 'string' && domain) byraDomains.push(normalizeHost(domain))
+    }
+  }
+  if (byraDomains.length > 0) {
+    if (byraDomains.includes(host)) return { redirectTo: null, cacheOk: true }
+
+    // Exemption: a byrå member who ALSO belongs to a company homed on the
+    // canonical domain (its team has no brand, or no team at all) must be
+    // able to reach that company somewhere, and the canonical host is its
+    // only home. Redirecting them off canonical made their own company
+    // deterministically unreachable: on the brand host it renders as a
+    // non-clickable signpost pointing right back at canonical. So on the
+    // canonical host, stay when such a company exists (host-stable verdict,
+    // so it is cacheable); a foreign brand host still redirects, since
+    // nothing of the user's is homed there. Cost: one extra query, only for
+    // byrå members on the canonical host without a fresh home-ok cookie.
+    const canonicalHost = normalizeHost(
+      new URL(process.env.NEXT_PUBLIC_APP_URL || 'https://app.gnubok.se').hostname,
+    )
+    if (host === canonicalHost) {
+      const { data: companyRows, error: companyError } = await supabase
+        .from('company_members')
+        .select('companies!inner(team_id, teams(brands(id)))')
+        .eq('user_id', userId)
+      if (companyError) {
+        console.error(
+          '[middleware] home-domain canonical-company lookup failed',
+          companyError,
+        )
+        return stay
+      }
+      if ((companyRows ?? []).some(rowHasCanonicalHomedCompany)) {
+        return { redirectTo: null, cacheOk: true }
+      }
+    }
+    // Carry the original path and query across the hop so deep links (invite
+    // accepts, direct object URLs) survive the domain correction.
+    return {
+      redirectTo: new URL(
+        `${request.nextUrl.pathname}${request.nextUrl.search}`,
+        `https://${byraDomains[0]}`,
+      ),
+      cacheOk: false,
+    }
+  }
+
+  // Rule 2: not a byrå member, so only a brand host can be foreign.
+  const hostBrand = await resolveBrandByHost(host)
+  if (!hostBrand) return { redirectTo: null, cacheOk: true }
+
+  const { data: clientRows, error: clientError } = await supabase
+    .from('company_members')
+    .select('company_id, companies!inner(team_id)')
+    .eq('user_id', userId)
+    .eq('companies.team_id', hostBrand.teamId)
+    .limit(1)
+  if (clientError) {
+    console.error('[middleware] home-domain client lookup failed', clientError)
+    return stay
+  }
+  if ((clientRows ?? []).length > 0) return { redirectTo: null, cacheOk: true }
+
+  const platformUrl = new URL(process.env.NEXT_PUBLIC_APP_URL || 'https://app.gnubok.se')
+  if (normalizeHost(platformUrl.hostname) === host) return { redirectTo: null, cacheOk: true }
+  // Preserve path + query for the same deep-link reason as the byrå hop.
+  return {
+    redirectTo: new URL(
+      `${request.nextUrl.pathname}${request.nextUrl.search}`,
+      platformUrl.origin,
+    ),
+    cacheOk: false,
+  }
+}
+
+/**
+ * Whether a company_members row (carrying the companies → teams → brands
+ * embed) points at a company homed on the canonical domain: no team at all,
+ * or a team without a brands row. The brand null-check happens HERE in JS on
+ * purpose: a PostgREST `.is()` filter on an embedded resource does not
+ * filter the parent rows, so filtering server-side would silently match
+ * every membership. Embeds arrive as object or array depending on the
+ * relationship shape, so both are tolerated (same as the byraRows parsing).
+ */
+function rowHasCanonicalHomedCompany(row: unknown): boolean {
+  const companies = (row as { companies?: unknown }).companies
+  const companyList = Array.isArray(companies) ? companies : companies ? [companies] : []
+  for (const company of companyList) {
+    const teams = (company as { teams?: unknown }).teams
+    if (!teams) return true
+    const teamList = Array.isArray(teams) ? teams : [teams]
+    for (const team of teamList) {
+      const brands = (team as { brands?: unknown }).brands
+      const brandList = Array.isArray(brands) ? brands : brands ? [brands] : []
+      if (brandList.length === 0) return true
+    }
+  }
+  return false
+}
+
 /**
  * Resolve the active company for the authenticated user.
  *
diff --git a/messages/en.json b/messages/en.json
index e209ec52..1f3700f1 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -70,7 +70,8 @@
     },
     "more_options": "More options",
     "popup_blocked_title": "The browser blocked the tab",
-    "popup_blocked_description": "Allow pop-ups for Accounted in your browser and try again."
+    "popup_blocked_description": "Allow pop-ups for {appName} in your browser and try again.",
+    "source_code": "Source code"
   },
   "nav": {
     "dashboard": "Overview",
@@ -78,6 +79,9 @@
     "assistant": "Assistant",
     "agent_knowledge": "What your agent knows",
     "bureau": "Bureau",
+    "clients": "Clients",
+    "automations": "Automations",
+    "back_to_clients": "Back to clients",
     "kpi": "KPIs",
     "invoice_inbox": "Documents",
     "invoices": "Customer invoices",
@@ -384,7 +388,7 @@
     "salary": "Defaults for payroll runs. Tax table and vacation are set per employee.",
     "invoicing": "Numbers, terms and the look of your invoices.",
     "templates": "Reusable postings and patterns learned from your bookkeeping.",
-    "banking": "Transactions are fetched automatically. Accounted can only read, never move money.",
+    "banking": "Transactions are fetched automatically. {appName} can only read, never move money.",
     "assistant": "What the assistant knows, remembers and can do.",
     "api": "Keys for MCP clients like Claude and Cursor, and for your own integrations.",
     "whatsapp": "Link your mobile number and send receipts as photos or PDFs straight from WhatsApp."
@@ -396,7 +400,8 @@
     "invoicing": "Invoicing",
     "bookkeeping": "Bookkeeping",
     "tax": "Tax",
-    "team": "Team",
+    "team": "Members and roles",
+    "brand": "Brand",
     "banking": "Bank (PSD2)",
     "skatteverket": "Skatteverket",
     "salary": "Payroll",
@@ -592,11 +597,11 @@
     "language_saved": "Language updated",
     "language_save_failed": "Could not save language preference",
     "install_app_title": "Install as an app",
-    "install_app_description": "Use Accounted in its own window with its own icon in the Dock or taskbar.",
+    "install_app_description": "Use {appName} in its own window with its own icon in the Dock or taskbar.",
     "install_app_button": "Install",
-    "install_app_hint_ios": "Open the share menu in Safari and choose \"Add to Home Screen\" to install Accounted as an app.",
-    "install_app_hint_safari": "In Safari, choose File and then \"Add to Dock\" to install Accounted as an app.",
-    "install_app_hint_generic": "Install Accounted as an app via the install icon in your browser's address bar (Chrome and Edge).",
+    "install_app_hint_ios": "Open the share menu in Safari and choose \"Add to Home Screen\" to install {appName} as an app.",
+    "install_app_hint_safari": "In Safari, choose File and then \"Add to Dock\" to install {appName} as an app.",
+    "install_app_hint_generic": "Install {appName} as an app via the install icon in your browser's address bar (Chrome and Edge).",
     "legal_title": "Privacy & agreements",
     "legal_privacy": "Privacy policy",
     "legal_dpa": "Data Processing Agreement (DPA)"
@@ -1668,7 +1673,7 @@
     "journey_note_fskatt": "Reminder created: apply for F-skatt at verksamt.se.",
     "journey_note_vat_watch": "We watch the SEK 120,000 threshold and let you know in good time.",
     "journey_note_ceased": "The company is marked as deregistered at Bolagsverket.",
-    "journey_open_app": "Open Accounted",
+    "journey_open_app": "Open {appName}",
     "journey_done_continue": "Continue",
     "journey_done_source_title": "Where were the books before?",
     "journey_done_source_sub": "Your history comes along, down to the last öre.",
@@ -1682,12 +1687,12 @@
     "journey_ans_quarterly": "Quarterly",
     "journey_ans_monthly": "Monthly",
     "journey_ans_yearly": "Yearly",
-    "journey_dup_note": "You already have {name} in Accounted.",
-    "journey_dup_elsewhere_note": "This company already exists in Accounted. Do you have another account from before? Sign in there instead, or ask for an invitation.",
+    "journey_dup_note": "You already have {name} in {appName}.",
+    "journey_dup_elsewhere_note": "This company already exists in {appName}. Do you have another account from before? Sign in there instead, or ask for an invitation.",
     "journey_pending_invite_note": "You have a pending invitation to a company. Open the link in the invitation email to join instead.",
     "journey_fact_vat": "VAT registered",
     "journey_fact_ceased": "Deregistered",
-    "journey_cancel_add": "Back to Accounted"
+    "journey_cancel_add": "Back to {appName}"
   },
   "select_company": {
     "greeting_night": "Good night",
@@ -2168,6 +2173,8 @@
   "settings_billing": {
     "load_failed": "The subscription details could not be loaded, so your status cannot be shown right now.",
     "load_retry": "Try again",
+    "team_agreement_status": "Included in {teamName}'s agreement",
+    "team_agreement_note": "Your subscription is managed by your accounting firm. All features are unlocked and there is nothing to pay here.",
     "group_yours": "Your subscription",
     "group_included": "In the subscription",
     "group_terms": "Price and terms",
@@ -2207,7 +2214,7 @@
     "trial_ends_in": "Your trial ends in {days, plural, =1 {1 day} other {# days}} ({date}).",
     "trial_ended": "Your trial has ended: the external connections are paused.",
     "status_demo": "Demo",
-    "status_demo_note": "You are trying Accounted in a demo. Create a real account to activate a subscription, the assistant, bank connection and Skatteverket filing.",
+    "status_demo_note": "You are trying {appName} in a demo. Create a real account to activate a subscription, the assistant, bank connection and Skatteverket filing.",
     "status_active": "Active",
     "status_active_note": "You can cancel at any time.",
     "manage_note": "Change card, switch plan or cancel in Stripe.",
@@ -2487,7 +2494,36 @@
     "team_fallback": "Team",
     "you_suffix": "(you)",
     "load_failed": "The team members could not be loaded right now.",
-    "load_retry": "Try again"
+    "load_retry": "Try again",
+    "role_change_aria": "Change role for {email}",
+    "role_changed_toast": "The role was updated.",
+    "role_change_failed": "The role could not be changed.",
+    "remove_aria": "Remove {email}",
+    "remove_confirm_title": "Remove member",
+    "remove_confirm_body": "{email} is removed from {team} and loses access to the team's client companies.",
+    "remove_confirm_button": "Remove",
+    "removed_toast": "The member was removed.",
+    "remove_failed": "The member could not be removed.",
+    "invite_email_label": "Email address",
+    "invite_email_placeholder": "name@example.com",
+    "invite_role_label": "Role for the invitation",
+    "invite_button": "Invite",
+    "invite_sent_toast": "The invitation was sent.",
+    "invite_mail_not_sent": "The email could not be sent. The invitation is still valid; share the link from the team's administrator.",
+    "invite_failed": "The invitation could not be sent.",
+    "invite_expired": "Expired",
+    "invite_expires": "Expires {date}",
+    "revoke_aria": "Revoke the invitation to {email}",
+    "revoked_toast": "The invitation was revoked.",
+    "revoke_failed": "The invitation could not be revoked.",
+    "resend_aria": "Resend the invitation to {email}",
+    "resend_toast": "The invitation was resent.",
+    "resend_failed": "The invitation could not be resent.",
+    "invite_link_sent": "The invitation was emailed to {email}. You can also share the link directly.",
+    "invite_link_not_sent": "The email to {email} could not be sent. The invitation is still valid; share the link directly.",
+    "invite_link_copy_action": "Copy invitation link",
+    "invite_link_copied_toast": "The invitation link was copied.",
+    "invite_link_copy_failed": "The link could not be copied."
   },
   "settings_booking_templates": {
     "title": "Bookkeeping templates",
@@ -2810,7 +2846,7 @@
   "settings_skatteverket_connect": {
     "title": "Skatteverket",
     "system_title": "Automatic connection (ombud)",
-    "system_intro": "Grant Accounted an ombud authorization at Skatteverket and the automatic syncing (tax account, receipts) keeps working without you signing in with BankID again. The authorization is granted once in Skatteverket's Ombud och behörigheter e-service and can be withdrawn there at any time.",
+    "system_intro": "Grant {appName} an ombud authorization at Skatteverket and the automatic syncing (tax account, receipts) keeps working without you signing in with BankID again. The authorization is granted once in Skatteverket's Ombud och behörigheter e-service and can be withdrawn there at any time.",
     "system_org_label": "Grant the authorization to organisation number",
     "system_open_ombud": "Open Ombud och behörigheter",
     "system_verify": "Verify the connection",
@@ -2821,7 +2857,7 @@
     "system_status_unknown": "Not verified",
     "system_behorighet_lasombud": "Juridiskt läsombud",
     "system_behorighet_moms": "Momsdeklaration, ombud",
-    "system_cert_expires_soon": "Accounted's certificate with Skatteverket expires in {days} days.",
+    "system_cert_expires_soon": "{appName}'s certificate with Skatteverket expires in {days} days.",
     "system_verify_failed": "Verification failed",
     "system_verify_rate_limited": "Wait a minute between verifications.",
     "needs_reconsent_message": "The Skatteverket connection needs to be renewed. Automatic syncing is paused until you reconnect with BankID.",
@@ -3464,7 +3500,7 @@
     "title": "Custom inbox domain",
     "description": "Receive supplier invoices directly at your company's own address, such as invoices@yourcompany.com, without forwarding.",
     "warning_title": "Important if your domain already receives email",
-    "warning_before_subdomain": "The domain's MX records will point to Accounted. If the domain already uses email, such as Google Workspace or Microsoft 365, your regular email will stop working. Use a subdomain instead, such as",
+    "warning_before_subdomain": "The domain's MX records will point to {appName}. If the domain already uses email, such as Google Workspace or Microsoft 365, your regular email will stop working. Use a subdomain instead, such as",
     "warning_after_subdomain": "or keep forwarding to your regular inbox address.",
     "status_pending": "Waiting for DNS",
     "status_verified": "Verified",
@@ -3496,7 +3532,7 @@
     "verify_pending_title": "Not verified yet",
     "verify_pending_description": "DNS changes can take up to an hour to take effect.",
     "verify_error_title": "Verification failed",
-    "remove_confirm": "Remove {domain}? Email sent to the domain will stop reaching Accounted.",
+    "remove_confirm": "Remove {domain}? Email sent to the domain will stop reaching {appName}.",
     "remove_success_title": "Domain removed",
     "remove_error_title": "Removal failed",
     "copied": "Copied",
@@ -4006,7 +4042,7 @@
     "delivery_status_sent": "Sent",
     "delivery_status_failed": "Failed",
     "delivery_status_marked_sent": "Manual",
-    "delivery_manual_unknown_details": "The invoice was delivered outside Accounted, so its recipients, message, and delivered file are unknown.",
+    "delivery_manual_unknown_details": "The invoice was delivered outside {appName}, so its recipients, message, and delivered file are unknown.",
     "delivery_to_label": "To",
     "delivery_cc_label": "Cc",
     "delivery_bcc_label": "Bcc",
@@ -4199,13 +4235,13 @@
     "pdf_rerender_downloaded_title": "Freshly generated PDF downloaded",
     "pdf_rerender_preview_title": "Showing a freshly generated PDF",
     "pdf_preview_blocked_title": "Could not open the preview",
-    "pdf_preview_blocked_description": "Allow pop-up windows for Accounted in your browser and try again.",
-    "pdf_rerender_reason_sent_outside": "The latest send happened outside Accounted, so there is no archived copy of that particular send. The file was generated just now, from today's data, template and logo.",
+    "pdf_preview_blocked_description": "Allow pop-up windows for {appName} in your browser and try again.",
+    "pdf_rerender_reason_sent_outside": "The latest send happened outside {appName}, so there is no archived copy of that particular send. The file was generated just now, from today's data, template and logo.",
     "pdf_rerender_reason_no_archive": "No archived copy exists for this invoice; it was sent before delivery history was recorded. The file was generated just now, from today's data, template and logo.",
     "pdf_rerender_reason_archive_unreachable": "The archived copy could not be retrieved. The file was generated just now, from today's data, template and logo, and is not necessarily identical to the one the customer received.",
     "pdf_rerender_reason_payment_confirmation": "The payment confirmation is a new document, produced now with a PAID stamp from today's data. It is not the invoice that was sent to the customer; that file stays untouched in the delivery history.",
     "pdf_archive_issue_title": "The archived copy could not be retrieved",
-    "pdf_archive_issue_history_desc": "The delivery history could not be loaded, so Accounted does not know which PDF the customer actually received. Nothing was fetched. A freshly generated PDF is not the same document: it is built from today's data, template and logo.",
+    "pdf_archive_issue_history_desc": "The delivery history could not be loaded, so {appName} does not know which PDF the customer actually received. Nothing was fetched. A freshly generated PDF is not the same document: it is built from today's data, template and logo.",
     "pdf_archive_issue_document_desc": "The archived PDF that was sent to the customer could not be retrieved right now. Nothing was fetched. A freshly generated PDF is not the same document: it is built from today's data, template and logo.",
     "pdf_archive_issue_cancel": "Cancel",
     "pdf_archive_issue_retry": "Try again",
@@ -5649,7 +5685,7 @@
     "ext_mcp_server_long_description": "Exposes accounted's bookkeeping engine as MCP tools (Model Context Protocol). Connect your MCP client with an API key and do bookkeeping through conversation: list uncategorized transactions, book them, create invoices.",
     "ext_cloud_backup_name": "Cloud sync",
     "ext_cloud_backup_description": "Sync backups to your own cloud storage",
-    "ext_cloud_backup_long_description": "Connect your Google Drive or Dropbox account and upload a full backup with one click. Accounted creates a ZIP with SIE files, receipts and processing history and uploads it to a dedicated folder in your cloud storage.",
+    "ext_cloud_backup_long_description": "Connect your Google Drive or Dropbox account and upload a full backup with one click. {appName} creates a ZIP with SIE files, receipts and processing history and uploads it to a dedicated folder in your cloud storage.",
     "ext_cloud_backup_reauth_title": "{provider} needs to be reconnected",
     "ext_cloud_backup_reauth_description": "Access to your {provider} account has expired or been revoked. Automatic sync is paused until you reconnect the account.",
     "ext_cloud_backup_reauth_action": "Reconnect {provider}",
@@ -5660,7 +5696,7 @@
     "ext_cloud_backup_no_documents_note": "without documents",
     "ext_cloud_backup_last_sync_no_documents": "Latest copy was made without document files",
     "ext_cloud_backup_card_tagline": "Backup to your own {provider}.",
-    "ext_cloud_backup_legal_note": "The {provider} copy is an extra backup. The legal archive (7 years under the Swedish Bookkeeping Act) remains in Accounted.",
+    "ext_cloud_backup_legal_note": "The {provider} copy is an extra backup. The legal archive (7 years under the Swedish Bookkeeping Act) remains in {appName}.",
     "ext_cloud_backup_loading": "Loading…",
     "ext_cloud_backup_not_configured": "{provider} is not configured in this environment.",
     "ext_cloud_backup_account_label": "Account",
@@ -5672,8 +5708,8 @@
     "ext_cloud_backup_disconnecting": "Disconnecting…",
     "ext_cloud_backup_redirecting": "Redirecting…",
     "ext_cloud_backup_connect": "Connect {provider}",
-    "ext_cloud_backup_connect_description_google": "Connect your Google account to upload the backup to your own Drive. Accounted only gets access to files the app itself creates (scope drive.file).",
-    "ext_cloud_backup_connect_description_dropbox": "Connect your Dropbox account to upload the backup to your own Dropbox. Accounted gets its own app folder and cannot reach anything else in your Dropbox.",
+    "ext_cloud_backup_connect_description_google": "Connect your Google account to upload the backup to your own Drive. {appName} only gets access to files the app itself creates (scope drive.file).",
+    "ext_cloud_backup_connect_description_dropbox": "Connect your Dropbox account to upload the backup to your own Dropbox. {appName} gets its own app folder and cannot reach anything else in your Dropbox.",
     "ext_cloud_backup_connected_title": "{provider} connected",
     "ext_cloud_backup_connected_description": "A backup is being created in the background.",
     "ext_cloud_backup_connected_first_description": "Daily backup is enabled. The first copy is being created in the background.",
@@ -5803,11 +5839,110 @@
   "company_switcher": {
     "company_label": "Company",
     "default_company_name": "My business",
+    "choose_company": "Select company",
     "add_company": "Add company",
     "error_no_access": "You don't have access to this company.",
     "error_switch_failed": "The company switch could not be saved. Please try again.",
     "search_placeholder": "Search companies...",
-    "no_results": "No matching companies"
+    "no_results": "No matching companies",
+    "managed_elsewhere": "Managed on another domain",
+    "managed_via": "Managed via {domain}"
+  },
+  "company_tab_guard": {
+    "title": "The active company was switched in another tab",
+    "body": "This tab shows {company}, but another tab switched the active company. Actions here would land in the wrong company's books. Choose how to continue.",
+    "switch_back": "Switch back to {company}",
+    "reload_as_new": "Reload with the new company"
+  },
+  "signpost": {
+    "title": "This company is managed on another domain",
+    "body": "{company} belongs on another domain and cannot be opened here.",
+    "managed_via": "{company} is managed via {domain}",
+    "login_hint": "You will need to sign in again on that domain.",
+    "homed_here": "Companies on this domain",
+    "open_company": "Open",
+    "switch_failed": "Could not switch company"
+  },
+  "clients": {
+    "title": "Clients",
+    "new_client_company": "New client company",
+    "added_to_agreement": "The company is added to your agreement.",
+    "cancel": "Cancel",
+    "continue": "Continue",
+    "filter_placeholder": "Filter by name or organization number",
+    "col_company": "Company",
+    "col_unbooked": "Unbooked",
+    "col_inbox": "Inbox",
+    "col_next_deadline": "Next deadline",
+    "col_last_booked": "Last booked",
+    "deadline_overdue": "Overdue",
+    "deadline_action_needed": "Action needed",
+    "never_booked": "Never",
+    "empty": "No client companies yet. Create the first one via New client company.",
+    "no_matches": "No clients match the filter.",
+    "enter_failed": "Could not open the client"
+  },
+  "byra": {
+    "home_title": "Home",
+    "stats_clients": "Client companies",
+    "stats_attention": "Needs action",
+    "stats_deadlines": "Urgent deadlines",
+    "deadlines_title": "Upcoming deadlines",
+    "deadlines_empty": "No open deadlines.",
+    "automations_title": "Automations",
+    "automations_intro": "This is where you'll set up automated workflows for your client companies.",
+    "automations_card_digest_title": "Monday briefing",
+    "automations_card_digest_desc": "Every Monday: one email with the state of all client companies, unbooked items, inbox and the week's deadlines.",
+    "automations_card_deadlines_title": "Deadline watch",
+    "automations_card_deadlines_desc": "Automatic reminders when VAT, employer declarations or F-tax come due for a client company.",
+    "automations_card_rules_title": "Rule-driven bookkeeping",
+    "automations_card_rules_desc": "A nightly run of the firm's bookkeeping rules: confident matches are staged and approved in one sweep.",
+    "automations_card_connections_title": "Connection watch",
+    "automations_card_connections_desc": "Alerts before a client's bank or Skatteverket connection expires, so syncing never dies silently.",
+    "automations_card_checklist_title": "Monthly checklist",
+    "automations_card_checklist_desc": "A reconciliation list per client and month: bank reconciled, VAT checked, period locked.",
+    "automations_card_reports_title": "Report delivery",
+    "automations_card_reports_desc": "A monthly report to the end client under your own brand, fully automatic.",
+    "automations_footer": "Want to influence what gets built first? Let us know.",
+    "kpi_title": "Key figures",
+    "kpi_empty_title": "No client companies yet",
+    "kpi_empty_description": "Key figures appear here once the firm has client companies.",
+    "kpi_period_month": "This month",
+    "kpi_period_quarter": "This quarter",
+    "kpi_period_ytd": "Year to date",
+    "kpi_period_12m": "Last 12 months",
+    "kpi_period_picker": "Choose period",
+    "kpi_filter_all": "All companies",
+    "kpi_revenue": "Revenue",
+    "kpi_result": "Result",
+    "kpi_margin": "Margin",
+    "kpi_cash": "Cash",
+    "kpi_vat": "VAT payable",
+    "kpi_row_failed": "Could not load figures",
+    "kpi_failed_notice": "{count, plural, one {One client company} other {# client companies}} could not be loaded and is excluded from the totals."
+  },
+  "settings_brand": {
+    "logo_label": "Logo",
+    "logo_help": "Shown top left in the sidebar and on the login page. Changes can take up to a minute to propagate.",
+    "logo_alt": "Brand logo",
+    "logo_pick_or_drop": "Choose a file or drop it here",
+    "logo_uploading": "Uploading...",
+    "logo_change": "Change",
+    "logo_remove": "Remove",
+    "logo_none": "No logo uploaded",
+    "logo_too_large": "The file is too large (max 10 MB).",
+    "logo_disallowed_type": "File type not allowed. Allowed: PNG, JPG, SVG, WebP.",
+    "logo_upload_failed": "Upload failed",
+    "logo_delete_failed": "Could not remove the logo",
+    "domain_label": "Domain",
+    "domain_help": "The domain is managed by us. Contact support to change it.",
+    "app_name_label": "App name",
+    "app_name_help": "Shown beside the logo in the sidebar and in the app's headings. Changes can take up to a minute to propagate.",
+    "app_name_save": "Save",
+    "app_name_save_failed": "Could not save the app name",
+    "empty_title": "No brand profile yet",
+    "empty_description": "Contact support and we will activate your brand profile with its own domain.",
+    "load_failed": "Could not load the brand. Try reloading the page."
   },
   "transactions": {
     "counterparty_suggestion_gone_title": "That counterparty is no longer available",
@@ -6656,7 +6791,7 @@
     "bank_expiring_one": "The bank consent for {bank} expires in {days, plural, =1 {1 day} other {# days}}.",
     "bank_expiring_many": "{count} bank consents expire soon.",
     "bank_expiring_action": "Renew the consent",
-    "other_account_hint": "This account is empty, but bookkeeping for the same organisation number exists in another Accounted account. Did you sign in with the wrong login?",
+    "other_account_hint": "This account is empty, but bookkeeping for the same organisation number exists in another {appName} account. Did you sign in with the wrong login?",
     "other_account_hint_action": "Switch account",
     "skv_unexplained": "The tax account does not agree with the ledger: {amount} is unexplained after the latest fetch.",
     "skv_unexplained_action": "Reconcile",
@@ -7390,10 +7525,10 @@
     "kommun_table_number": "Table {number}",
     "kommun_load_failed": "Could not fetch the municipality list — type the municipality name and enter the tax table (skattetabell) manually.",
     "opening_balances_title": "Opening balances (payroll system switch)",
-    "opening_balances_description": "Fill in when switching to Accounted mid-year: year-to-date figures and vacation balances from the previous payroll system.",
+    "opening_balances_description": "Fill in when switching to {appName} mid-year: year-to-date figures and vacation balances from the previous payroll system.",
     "opening_balances_locked_notice": "Locked: the employee has a booked salary run. Balances unlock if that run is corrected.",
     "opening_balances_cutover_date": "Cutover date",
-    "opening_balances_cutover_hint": "First day of the first month run in Accounted (always the 1st).",
+    "opening_balances_cutover_hint": "First day of the first month run in {appName} (always the 1st).",
     "opening_balances_karens": "Karens deductions last 12 months",
     "opening_balances_karens_hint": "Sick-pay waiting periods not present as imported absence (for the high-risk protection cap, max 10).",
     "opening_balances_ytd_heading": "Year to date",
@@ -7801,7 +7936,7 @@
     "step_signatures": "Underskrifter",
     "step_filing": "Inlämning",
     "scope_title": "Omfattning och regelverk",
-    "scope_description": "Svar som påverkar om K2 får användas och om Accounted kan skapa ett digitalt inlämningspaket.",
+    "scope_description": "Svar som påverkar om K2 får användas och om {appName} kan skapa ett digitalt inlämningspaket.",
     "public_company": "Är bolaget ett publikt aktiebolag?",
     "in_liquidation": "Är bolaget i likvidation?",
     "listed_securities": "Har bolaget värdepapper på en reglerad marknad?",
diff --git a/messages/sv.json b/messages/sv.json
index c271c44a..599ad803 100644
--- a/messages/sv.json
+++ b/messages/sv.json
@@ -70,7 +70,8 @@
     },
     "more_options": "Fler alternativ",
     "popup_blocked_title": "Webbläsaren blockerade fliken",
-    "popup_blocked_description": "Tillåt popupfönster för Accounted i webbläsaren och försök igen."
+    "popup_blocked_description": "Tillåt popupfönster för {appName} i webbläsaren och försök igen.",
+    "source_code": "Källkod"
   },
   "nav": {
     "dashboard": "Översikt",
@@ -78,6 +79,9 @@
     "assistant": "Assistent",
     "agent_knowledge": "Vad din agent vet",
     "bureau": "Byrå",
+    "clients": "Klienter",
+    "automations": "Automationer",
+    "back_to_clients": "Tillbaka till klienter",
     "kpi": "Nyckeltal",
     "invoice_inbox": "Underlag",
     "invoices": "Kundfakturor",
@@ -384,7 +388,7 @@
     "salary": "Standarder för lönekörningen. Skattetabell och semester ställs in per anställd.",
     "invoicing": "Nummer, villkor och utseende på dina fakturor.",
     "templates": "Återanvändbara konteringar och mönster som lärts in från din bokföring.",
-    "banking": "Transaktioner hämtas automatiskt. Accounted kan bara läsa, aldrig flytta pengar.",
+    "banking": "Transaktioner hämtas automatiskt. {appName} kan bara läsa, aldrig flytta pengar.",
     "assistant": "Vad assistenten vet, minns och kan.",
     "api": "Nycklar för MCP-klienter som Claude och Cursor, och för egna integrationer.",
     "whatsapp": "Koppla ditt mobilnummer och skicka kvitton som foto eller PDF direkt i WhatsApp."
@@ -396,7 +400,8 @@
     "invoicing": "Fakturering",
     "bookkeeping": "Bokföring",
     "tax": "Skatt",
-    "team": "Lag",
+    "team": "Medlemmar och roller",
+    "brand": "Varumärke",
     "banking": "Bank (PSD2)",
     "skatteverket": "Skatteverket",
     "salary": "Löner",
@@ -592,11 +597,11 @@
     "language_saved": "Språket har uppdaterats",
     "language_save_failed": "Kunde inte spara språkinställningen",
     "install_app_title": "Installera som app",
-    "install_app_description": "Använd Accounted i ett eget fönster med egen ikon i Dock eller aktivitetsfältet.",
+    "install_app_description": "Använd {appName} i ett eget fönster med egen ikon i Dock eller aktivitetsfältet.",
     "install_app_button": "Installera",
-    "install_app_hint_ios": "Öppna delningsmenyn i Safari och välj \"Lägg till på hemskärmen\" för att installera Accounted som app.",
-    "install_app_hint_safari": "Välj Arkiv och sedan \"Lägg till i Dock\" i Safari för att installera Accounted som app.",
-    "install_app_hint_generic": "Installera Accounted som app via installationsikonen i webbläsarens adressfält (Chrome och Edge).",
+    "install_app_hint_ios": "Öppna delningsmenyn i Safari och välj \"Lägg till på hemskärmen\" för att installera {appName} som app.",
+    "install_app_hint_safari": "Välj Arkiv och sedan \"Lägg till i Dock\" i Safari för att installera {appName} som app.",
+    "install_app_hint_generic": "Installera {appName} som app via installationsikonen i webbläsarens adressfält (Chrome och Edge).",
     "legal_title": "Sekretess och avtal",
     "legal_privacy": "Integritetspolicy",
     "legal_dpa": "Personuppgiftsbiträdesavtal (DPA)"
@@ -1668,7 +1673,7 @@
     "journey_note_fskatt": "Påminnelse skapad: ansök om F-skatt på verksamt.se.",
     "journey_note_vat_watch": "Vi bevakar 120 000-gränsen och säger till i god tid.",
     "journey_note_ceased": "Företaget är markerat som avregistrerat hos Bolagsverket.",
-    "journey_open_app": "Öppna Accounted",
+    "journey_open_app": "Öppna {appName}",
     "journey_done_continue": "Fortsätt",
     "journey_done_source_title": "Var fanns bokföringen innan?",
     "journey_done_source_sub": "Historiken följer med hit, ner till sista öret.",
@@ -1682,12 +1687,12 @@
     "journey_ans_quarterly": "Kvartalsvis",
     "journey_ans_monthly": "Månadsvis",
     "journey_ans_yearly": "Årsvis",
-    "journey_dup_note": "Du har redan {name} i Accounted.",
-    "journey_dup_elsewhere_note": "Det här bolaget finns redan i Accounted. Har du ett annat konto sedan tidigare? Logga in där istället, eller be om en inbjudan.",
+    "journey_dup_note": "Du har redan {name} i {appName}.",
+    "journey_dup_elsewhere_note": "Det här bolaget finns redan i {appName}. Har du ett annat konto sedan tidigare? Logga in där istället, eller be om en inbjudan.",
     "journey_pending_invite_note": "Du har en väntande inbjudan till ett företag. Öppna länken i inbjudningsmejlet för att gå med istället.",
     "journey_fact_vat": "Momsregistrerat",
     "journey_fact_ceased": "Avregistrerat",
-    "journey_cancel_add": "Tillbaka till Accounted"
+    "journey_cancel_add": "Tillbaka till {appName}"
   },
   "select_company": {
     "greeting_night": "God natt",
@@ -2168,6 +2173,8 @@
   "settings_billing": {
     "load_failed": "Abonnemangsuppgifterna kunde inte läsas in, så din status kan inte visas just nu.",
     "load_retry": "Försök igen",
+    "team_agreement_status": "Ingår i {teamName}s avtal",
+    "team_agreement_note": "Ditt abonnemang hanteras av din byrå. Alla funktioner är upplåsta och det finns inget att betala här.",
     "group_yours": "Ditt abonnemang",
     "group_included": "I abonnemanget",
     "group_terms": "Pris och villkor",
@@ -2207,7 +2214,7 @@
     "trial_ends_in": "Provperioden löper ut om {days, plural, =1 {1 dag} other {# dagar}} ({date}).",
     "trial_ended": "Provperioden har löpt ut: de externa kopplingarna är pausade.",
     "status_demo": "Demo",
-    "status_demo_note": "Du provkör Accounted i en demo. Skapa ett riktigt konto för att aktivera abonnemang, assistent, bankkoppling och inlämning till Skatteverket.",
+    "status_demo_note": "Du provkör {appName} i en demo. Skapa ett riktigt konto för att aktivera abonnemang, assistent, bankkoppling och inlämning till Skatteverket.",
     "status_active": "Aktivt",
     "status_active_note": "Du kan avsluta när som helst.",
     "manage_note": "Byt kort, ändra plan eller säg upp i Stripe.",
@@ -2487,7 +2494,36 @@
     "team_fallback": "Team",
     "you_suffix": "(du)",
     "load_failed": "Teamets medlemmar kunde inte läsas in just nu.",
-    "load_retry": "Försök igen"
+    "load_retry": "Försök igen",
+    "role_change_aria": "Ändra roll för {email}",
+    "role_changed_toast": "Rollen uppdaterades.",
+    "role_change_failed": "Rollen kunde inte ändras.",
+    "remove_aria": "Ta bort {email}",
+    "remove_confirm_title": "Ta bort medlem",
+    "remove_confirm_body": "{email} tas bort från {team} och förlorar åtkomsten till teamets klientbolag.",
+    "remove_confirm_button": "Ta bort",
+    "removed_toast": "Medlemmen togs bort.",
+    "remove_failed": "Medlemmen kunde inte tas bort.",
+    "invite_email_label": "E-postadress",
+    "invite_email_placeholder": "namn@exempel.se",
+    "invite_role_label": "Roll för inbjudan",
+    "invite_button": "Bjud in",
+    "invite_sent_toast": "Inbjudan skickades.",
+    "invite_mail_not_sent": "Mejlet kunde inte skickas. Inbjudan gäller ändå, dela länken från teamets administratör.",
+    "invite_failed": "Inbjudan kunde inte skickas.",
+    "invite_expired": "Utgången",
+    "invite_expires": "Går ut {date}",
+    "revoke_aria": "Återkalla inbjudan till {email}",
+    "revoked_toast": "Inbjudan återkallades.",
+    "revoke_failed": "Inbjudan kunde inte återkallas.",
+    "resend_aria": "Skicka inbjudan till {email} igen",
+    "resend_toast": "Inbjudan skickades igen.",
+    "resend_failed": "Inbjudan kunde inte skickas igen.",
+    "invite_link_sent": "Inbjudan mejlades till {email}. Länken kan även delas direkt.",
+    "invite_link_not_sent": "Mejlet till {email} kunde inte skickas. Inbjudan gäller ändå, dela länken direkt.",
+    "invite_link_copy_action": "Kopiera inbjudningslänk",
+    "invite_link_copied_toast": "Inbjudningslänken kopierades.",
+    "invite_link_copy_failed": "Länken kunde inte kopieras."
   },
   "settings_booking_templates": {
     "title": "Bokföringsmallar",
@@ -2810,7 +2846,7 @@
   "settings_skatteverket_connect": {
     "title": "Skatteverket",
     "system_title": "Automatisk anslutning (ombud)",
-    "system_intro": "Ge Accounted behörighet som ombud hos Skatteverket så fungerar den automatiska synkroniseringen (skattekonto, kvittenser) utan att du behöver logga in med BankID på nytt. Behörigheten ges en gång i Skatteverkets e-tjänst Ombud och behörigheter och kan när som helst återkallas där.",
+    "system_intro": "Ge {appName} behörighet som ombud hos Skatteverket så fungerar den automatiska synkroniseringen (skattekonto, kvittenser) utan att du behöver logga in med BankID på nytt. Behörigheten ges en gång i Skatteverkets e-tjänst Ombud och behörigheter och kan när som helst återkallas där.",
     "system_org_label": "Ge behörigheten till organisationsnummer",
     "system_open_ombud": "Öppna Ombud och behörigheter",
     "system_verify": "Verifiera anslutningen",
@@ -2821,7 +2857,7 @@
     "system_status_unknown": "Inte verifierad",
     "system_behorighet_lasombud": "Juridiskt läsombud",
     "system_behorighet_moms": "Momsdeklaration, ombud",
-    "system_cert_expires_soon": "Accounteds certifikat mot Skatteverket går ut om {days} dagar.",
+    "system_cert_expires_soon": "{appName}s certifikat mot Skatteverket går ut om {days} dagar.",
     "system_verify_failed": "Verifieringen misslyckades",
     "system_verify_rate_limited": "Vänta en minut mellan verifieringar.",
     "needs_reconsent_message": "Anslutningen till Skatteverket behöver förnyas. Den automatiska synkroniseringen är pausad tills du ansluter igen med BankID.",
@@ -3464,7 +3500,7 @@
     "title": "Egen domän för inkorgen",
     "description": "Ta emot leverantörsfakturor direkt på bolagets egen adress, till exempel faktura@dittbolag.se, utan vidarebefordran.",
     "warning_title": "Viktigt om din domän redan tar emot e-post",
-    "warning_before_subdomain": "Domänens MX-poster pekas om till Accounted. Om domänen redan används för e-post, till exempel Google Workspace eller Microsoft 365, slutar din vanliga e-post att fungera. Använd då en underdomän, till exempel",
+    "warning_before_subdomain": "Domänens MX-poster pekas om till {appName}. Om domänen redan används för e-post, till exempel Google Workspace eller Microsoft 365, slutar din vanliga e-post att fungera. Använd då en underdomän, till exempel",
     "warning_after_subdomain": "eller fortsätt vidarebefordra till din vanliga inkorgsadress.",
     "status_pending": "Väntar på DNS",
     "status_verified": "Verifierad",
@@ -3496,7 +3532,7 @@
     "verify_pending_title": "Inte verifierad än",
     "verify_pending_description": "DNS-ändringar kan ta upp till någon timme att slå igenom.",
     "verify_error_title": "Kontrollen misslyckades",
-    "remove_confirm": "Ta bort {domain}? E-post till domänen slutar landa i Accounted.",
+    "remove_confirm": "Ta bort {domain}? E-post till domänen slutar landa i {appName}.",
     "remove_success_title": "Domänen borttagen",
     "remove_error_title": "Borttagningen misslyckades",
     "copied": "Kopierat",
@@ -4006,7 +4042,7 @@
     "delivery_status_sent": "Skickad",
     "delivery_status_failed": "Misslyckad",
     "delivery_status_marked_sent": "Manuell",
-    "delivery_manual_unknown_details": "Utskicket gjordes utanför Accounted. Mottagare, meddelande och den levererade filen är därför inte kända.",
+    "delivery_manual_unknown_details": "Utskicket gjordes utanför {appName}. Mottagare, meddelande och den levererade filen är därför inte kända.",
     "delivery_to_label": "Till",
     "delivery_cc_label": "Kopia",
     "delivery_bcc_label": "Dold kopia",
@@ -4199,13 +4235,13 @@
     "pdf_rerender_downloaded_title": "Nyskapad PDF nedladdad",
     "pdf_rerender_preview_title": "Nyskapad PDF visas",
     "pdf_preview_blocked_title": "Kunde inte öppna förhandsgranskningen",
-    "pdf_preview_blocked_description": "Tillåt popupfönster för Accounted i webbläsaren och försök igen.",
-    "pdf_rerender_reason_sent_outside": "Det senaste utskicket gjordes utanför Accounted, så det finns ingen arkiverad kopia av just det utskicket. Filen skapades nyss, utifrån dagens uppgifter, mall och logotyp.",
+    "pdf_preview_blocked_description": "Tillåt popupfönster för {appName} i webbläsaren och försök igen.",
+    "pdf_rerender_reason_sent_outside": "Det senaste utskicket gjordes utanför {appName}, så det finns ingen arkiverad kopia av just det utskicket. Filen skapades nyss, utifrån dagens uppgifter, mall och logotyp.",
     "pdf_rerender_reason_no_archive": "Ingen arkiverad kopia finns för den här fakturan; den skickades innan utskickshistoriken började sparas. Filen skapades nyss, utifrån dagens uppgifter, mall och logotyp.",
     "pdf_rerender_reason_archive_unreachable": "Den arkiverade kopian kunde inte hämtas. Filen skapades nyss, utifrån dagens uppgifter, mall och logotyp, och är inte nödvändigtvis identisk med den kunden fick.",
     "pdf_rerender_reason_payment_confirmation": "Betalningsbekräftelsen är ett nytt dokument, skapat nu med BETALD-stämpel utifrån dagens uppgifter. Det är inte fakturan som skickades till kunden; den ligger kvar orörd i utskickshistoriken.",
     "pdf_archive_issue_title": "Den arkiverade kopian kunde inte hämtas",
-    "pdf_archive_issue_history_desc": "Utskickshistoriken kunde inte läsas in, så Accounted vet inte vilken PDF kunden faktiskt fick. Ingenting har hämtats. En nyskapad PDF är inte samma dokument: den bygger på dagens uppgifter, mall och logotyp.",
+    "pdf_archive_issue_history_desc": "Utskickshistoriken kunde inte läsas in, så {appName} vet inte vilken PDF kunden faktiskt fick. Ingenting har hämtats. En nyskapad PDF är inte samma dokument: den bygger på dagens uppgifter, mall och logotyp.",
     "pdf_archive_issue_document_desc": "Den arkiverade PDF:en som skickades till kunden kunde inte hämtas just nu. Ingenting har hämtats. En nyskapad PDF är inte samma dokument: den bygger på dagens uppgifter, mall och logotyp.",
     "pdf_archive_issue_cancel": "Avbryt",
     "pdf_archive_issue_retry": "Försök igen",
@@ -5649,7 +5685,7 @@
     "ext_mcp_server_long_description": "Exponerar accounteds bokföringsmotor som MCP-verktyg (Model Context Protocol). Koppla din MCP-klient med en API-nyckel och gör bokföring genom konversation: visa okategoriserade transaktioner, bokför dem, skapa fakturor.",
     "ext_cloud_backup_name": "Molnsynkronisering",
     "ext_cloud_backup_description": "Synka säkerhetsbackup till din egen molnlagring",
-    "ext_cloud_backup_long_description": "Koppla ditt Google Drive- eller Dropbox-konto och ladda upp en fullständig säkerhetsbackup med ett klick. Accounted skapar en ZIP med SIE-filer, kvitton och behandlingshistorik och laddar upp till en egen mapp i din molnlagring.",
+    "ext_cloud_backup_long_description": "Koppla ditt Google Drive- eller Dropbox-konto och ladda upp en fullständig säkerhetsbackup med ett klick. {appName} skapar en ZIP med SIE-filer, kvitton och behandlingshistorik och laddar upp till en egen mapp i din molnlagring.",
     "ext_cloud_backup_reauth_title": "{provider} behöver kopplas om",
     "ext_cloud_backup_reauth_description": "Åtkomsten till ditt {provider}-konto har gått ut eller återkallats. Automatisk synkronisering är pausad tills du kopplar om kontot.",
     "ext_cloud_backup_reauth_action": "Koppla om {provider}",
@@ -5660,7 +5696,7 @@
     "ext_cloud_backup_no_documents_note": "utan underlag",
     "ext_cloud_backup_last_sync_no_documents": "Senaste kopian togs utan underlagsfiler",
     "ext_cloud_backup_card_tagline": "Säkerhetskopia till din egen {provider}.",
-    "ext_cloud_backup_legal_note": "Kopian i {provider} är en extra säkerhetskopia. Det lagliga arkivet (7 år enligt bokföringslagen) finns kvar i Accounted.",
+    "ext_cloud_backup_legal_note": "Kopian i {provider} är en extra säkerhetskopia. Det lagliga arkivet (7 år enligt bokföringslagen) finns kvar i {appName}.",
     "ext_cloud_backup_loading": "Laddar…",
     "ext_cloud_backup_not_configured": "{provider} är inte konfigurerat i den här miljön.",
     "ext_cloud_backup_account_label": "Konto",
@@ -5672,8 +5708,8 @@
     "ext_cloud_backup_disconnecting": "Kopplar bort…",
     "ext_cloud_backup_redirecting": "Omdirigerar…",
     "ext_cloud_backup_connect": "Koppla {provider}",
-    "ext_cloud_backup_connect_description_google": "Koppla ditt Google-konto för att ladda upp säkerhetsbackupen till din egen Drive. Accounted får bara tillgång till filer som appen själv skapar (scope drive.file).",
-    "ext_cloud_backup_connect_description_dropbox": "Koppla ditt Dropbox-konto för att ladda upp säkerhetsbackupen till din egen Dropbox. Accounted får en egen appmapp och kommer inte åt något annat i din Dropbox.",
+    "ext_cloud_backup_connect_description_google": "Koppla ditt Google-konto för att ladda upp säkerhetsbackupen till din egen Drive. {appName} får bara tillgång till filer som appen själv skapar (scope drive.file).",
+    "ext_cloud_backup_connect_description_dropbox": "Koppla ditt Dropbox-konto för att ladda upp säkerhetsbackupen till din egen Dropbox. {appName} får en egen appmapp och kommer inte åt något annat i din Dropbox.",
     "ext_cloud_backup_connected_title": "{provider} kopplat",
     "ext_cloud_backup_connected_description": "En säkerhetskopia skapas nu i bakgrunden.",
     "ext_cloud_backup_connected_first_description": "Daglig säkerhetskopiering är aktiverad. Den första kopian skapas nu i bakgrunden.",
@@ -5803,11 +5839,110 @@
   "company_switcher": {
     "company_label": "Företag",
     "default_company_name": "Min verksamhet",
+    "choose_company": "Välj bolag",
     "add_company": "Lägg till företag",
     "error_no_access": "Du har inte tillgång till detta företag.",
     "error_switch_failed": "Företagsbytet kunde inte sparas. Försök igen.",
     "search_placeholder": "Sök företag...",
-    "no_results": "Inga företag matchar"
+    "no_results": "Inga företag matchar",
+    "managed_elsewhere": "Hanteras via annan domän",
+    "managed_via": "Hanteras via {domain}"
+  },
+  "company_tab_guard": {
+    "title": "Aktivt företag har bytts i en annan flik",
+    "body": "Den här fliken visar {company}, men en annan flik har bytt aktivt företag. Åtgärder här skulle hamna i fel bolags bokföring. Välj hur du vill fortsätta.",
+    "switch_back": "Byt tillbaka till {company}",
+    "reload_as_new": "Ladda om med det nya företaget"
+  },
+  "signpost": {
+    "title": "Företaget hanteras på en annan domän",
+    "body": "{company} hör hemma på en annan domän och kan inte öppnas här.",
+    "managed_via": "{company} hanteras via {domain}",
+    "login_hint": "Du behöver logga in på nytt på den domänen.",
+    "homed_here": "Företag på den här domänen",
+    "open_company": "Öppna",
+    "switch_failed": "Det gick inte att byta företag"
+  },
+  "clients": {
+    "title": "Klienter",
+    "new_client_company": "Nytt klientbolag",
+    "added_to_agreement": "Bolaget läggs till i ert avtal.",
+    "cancel": "Avbryt",
+    "continue": "Fortsätt",
+    "filter_placeholder": "Filtrera på namn eller organisationsnummer",
+    "col_company": "Bolag",
+    "col_unbooked": "Obokfört",
+    "col_inbox": "Inkorg",
+    "col_next_deadline": "Nästa deadline",
+    "col_last_booked": "Senast bokfört",
+    "deadline_overdue": "Försenad",
+    "deadline_action_needed": "Åtgärd krävs",
+    "never_booked": "Aldrig",
+    "empty": "Inga klientbolag ännu. Skapa det första via Nytt klientbolag.",
+    "no_matches": "Inga klienter matchar filtret.",
+    "enter_failed": "Det gick inte att öppna klienten"
+  },
+  "byra": {
+    "home_title": "Hem",
+    "stats_clients": "Klientbolag",
+    "stats_attention": "Behöver åtgärd",
+    "stats_deadlines": "Brådskande deadlines",
+    "deadlines_title": "Närmaste deadlines",
+    "deadlines_empty": "Inga öppna deadlines.",
+    "automations_title": "Automationer",
+    "automations_intro": "Här kommer du kunna sätta upp automatiska flöden för dina klientbolag.",
+    "automations_card_digest_title": "Måndagsöversikt",
+    "automations_card_digest_desc": "Varje måndag: ett mejl med läget för alla klientbolag, obokfört, inkorg och veckans deadlines.",
+    "automations_card_deadlines_title": "Deadline-bevakning",
+    "automations_card_deadlines_desc": "Automatiska påminnelser när moms, arbetsgivardeklaration eller F-skatt närmar sig för ett klientbolag.",
+    "automations_card_rules_title": "Regelstyrd bokföring",
+    "automations_card_rules_desc": "Nattlig körning av byråns bokföringsregler: säkra träffar förbereds och godkänns i ett svep.",
+    "automations_card_connections_title": "Anslutningsvakt",
+    "automations_card_connections_desc": "Larm innan en klients bankkoppling eller Skatteverket-anslutning går ut, så att synken aldrig dör i tysthet.",
+    "automations_card_checklist_title": "Månadschecklista",
+    "automations_card_checklist_desc": "En avstämningslista per klient och månad: bank avstämd, moms kontrollerad, period låst.",
+    "automations_card_reports_title": "Rapportutskick",
+    "automations_card_reports_desc": "Månadsrapport till slutkunden under ert eget varumärke, helt automatiskt.",
+    "automations_footer": "Vill du påverka vad som byggs först? Hör av dig till oss.",
+    "kpi_title": "Nyckeltal",
+    "kpi_empty_title": "Inga klientbolag ännu",
+    "kpi_empty_description": "Nyckeltal visas här när byrån har klientbolag.",
+    "kpi_period_month": "Denna månad",
+    "kpi_period_quarter": "Detta kvartal",
+    "kpi_period_ytd": "Hittills i år",
+    "kpi_period_12m": "Senaste 12 månaderna",
+    "kpi_period_picker": "Välj period",
+    "kpi_filter_all": "Alla bolag",
+    "kpi_revenue": "Intäkter",
+    "kpi_result": "Resultat",
+    "kpi_margin": "Marginal",
+    "kpi_cash": "Likvida medel",
+    "kpi_vat": "Moms att betala",
+    "kpi_row_failed": "Kunde inte hämta siffror",
+    "kpi_failed_notice": "{count, plural, one {Ett klientbolag} other {# klientbolag}} kunde inte hämtas och ingår inte i summorna."
+  },
+  "settings_brand": {
+    "logo_label": "Logotyp",
+    "logo_help": "Visas uppe till vänster i sidomenyn och på inloggningssidan. Ändringar kan ta upp till en minut att slå igenom.",
+    "logo_alt": "Varumärkeslogotyp",
+    "logo_pick_or_drop": "Välj fil eller släpp här",
+    "logo_uploading": "Laddar upp...",
+    "logo_change": "Byt",
+    "logo_remove": "Ta bort",
+    "logo_none": "Ingen logotyp uppladdad",
+    "logo_too_large": "Filen är för stor (max 10 MB).",
+    "logo_disallowed_type": "Otillåten filtyp. Tillåtna: PNG, JPG, SVG, WebP.",
+    "logo_upload_failed": "Uppladdningen misslyckades",
+    "logo_delete_failed": "Kunde inte ta bort logotypen",
+    "domain_label": "Domän",
+    "domain_help": "Domänen hanteras av oss. Kontakta supporten för att ändra.",
+    "app_name_label": "Appnamn",
+    "app_name_help": "Visas bredvid logotypen i sidomenyn och i appens rubriker. Ändringar kan ta upp till en minut att slå igenom.",
+    "app_name_save": "Spara",
+    "app_name_save_failed": "Kunde inte spara appnamnet",
+    "empty_title": "Ingen varumärkesprofil ännu",
+    "empty_description": "Kontakta supporten så aktiverar vi er varumärkesprofil med egen domän.",
+    "load_failed": "Kunde inte hämta varumärket. Prova att ladda om sidan."
   },
   "transactions": {
     "counterparty_suggestion_gone_title": "Motparten är inte längre tillgänglig",
@@ -6656,7 +6791,7 @@
     "bank_expiring_one": "Banksamtycket för {bank} löper ut om {days, plural, =1 {1 dag} other {# dagar}}.",
     "bank_expiring_many": "{count} banksamtycken löper ut inom kort.",
     "bank_expiring_action": "Förnya samtycket",
-    "other_account_hint": "Det här kontot är tomt, men bokföring för samma organisationsnummer finns i ett annat Accounted-konto. Loggade du in med fel inloggning?",
+    "other_account_hint": "Det här kontot är tomt, men bokföring för samma organisationsnummer finns i ett annat {appName}-konto. Loggade du in med fel inloggning?",
     "other_account_hint_action": "Byt konto",
     "skv_unexplained": "Skattekontot stämmer inte med bokföringen: {amount} är oförklarat efter senaste hämtningen.",
     "skv_unexplained_action": "Stäm av",
@@ -7390,10 +7525,10 @@
     "kommun_table_number": "Tabell {number}",
     "kommun_load_failed": "Kunde inte hämta kommunlistan — skriv kommunnamnet och ange skattetabellen manuellt.",
     "opening_balances_title": "Ingående saldon (byte av lönesystem)",
-    "opening_balances_description": "Fylls i vid byte till Accounted mitt under året: ackumulerade värden och semestersaldon från det tidigare lönesystemet.",
+    "opening_balances_description": "Fylls i vid byte till {appName} mitt under året: ackumulerade värden och semestersaldon från det tidigare lönesystemet.",
     "opening_balances_locked_notice": "Låst: den anställda har en bokförd lönekörning. Saldon låses upp om körningen korrigeras.",
     "opening_balances_cutover_date": "Bytesdatum",
-    "opening_balances_cutover_hint": "Första dagen i den första månad som körs i Accounted (alltid den 1:a).",
+    "opening_balances_cutover_hint": "Första dagen i den första månad som körs i {appName} (alltid den 1:a).",
     "opening_balances_karens": "Karensavdrag senaste 12 mån",
     "opening_balances_karens_hint": "Antal karensperioder som inte finns som importerad frånvaro (för högriskskyddet, max 10).",
     "opening_balances_ytd_heading": "Ackumulerat i år",
@@ -7801,7 +7936,7 @@
     "step_signatures": "Underskrifter",
     "step_filing": "Inlämning",
     "scope_title": "Omfattning och regelverk",
-    "scope_description": "Svar som påverkar om K2 får användas och om Accounted kan skapa ett digitalt inlämningspaket.",
+    "scope_description": "Svar som påverkar om K2 får användas och om {appName} kan skapa ett digitalt inlämningspaket.",
     "public_company": "Är bolaget ett publikt aktiebolag?",
     "in_liquidation": "Är bolaget i likvidation?",
     "listed_securities": "Har bolaget värdepapper på en reglerad marknad?",
diff --git a/next.config.ts b/next.config.ts
index 26599431..5c1d12ea 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -34,6 +34,19 @@ const supabaseWsUrl =
   process.env.NEXT_PUBLIC_SUPABASE_WS_URL ??
   supabaseUrl.replace(/^http(s?):/, "ws$1:");
 
+// Brand logos (WL-12 slice A3) are served from Supabase Storage public
+// objects and rendered via next/image, which requires the host to be
+// allowlisted. The pattern stays narrow: public storage objects only.
+// try/catch because Docker builds may bake a sentinel value that is not a
+// parseable URL; no hostname simply means no remote images are allowed,
+// exactly as before.
+let supabaseImageHostname = "";
+try {
+  supabaseImageHostname = supabaseUrl ? new URL(supabaseUrl).hostname : "";
+} catch {
+  supabaseImageHostname = "";
+}
+
 const cspDirectives = [
   "default-src 'self'",
   // No analytics hosts here on purpose. PostHog replaced Recapt and is
@@ -68,6 +81,19 @@ const nextConfig: NextConfig = {
   // system env var on every Vercel build; self-hosted and local builds keep
   // the standalone directory.
   output: process.env.VERCEL ? undefined : 'standalone',
+  ...(supabaseImageHostname
+    ? {
+        images: {
+          remotePatterns: [
+            {
+              protocol: "https" as const,
+              hostname: supabaseImageHostname,
+              pathname: "/storage/v1/object/public/**",
+            },
+          ],
+        },
+      }
+    : {}),
   // Build id inlined into the client bundle so a running tab can tell when a
   // newer deploy is live (see components/system/DeployReloadPrompt). On Vercel
   // this is the commit SHA; empty elsewhere (dev / self-hosted), which disables
diff --git a/supabase/migrations/20260826130000_sie_rpc_pre_request_timeout.sql b/supabase/migrations/20260826130000_sie_rpc_pre_request_timeout.sql
new file mode 100644
index 00000000..be2ac828
--- /dev/null
+++ b/supabase/migrations/20260826130000_sie_rpc_pre_request_timeout.sql
@@ -0,0 +1,43 @@
+-- Fix the SIE import statement timeout for real this time.
+--
+-- 20260629160100 (replace_sie_import / undo_sie_import) and 20260721144311
+-- (import_sie_journal_entries) raised statement_timeout to 290s via
+-- ALTER FUNCTION ... SET. That is a no-op for the enclosing call: Postgres
+-- arms the statement_timeout timer when the top-level statement STARTS,
+-- using the role-level value in effect at that moment (authenticated = 8s),
+-- and a function-scoped SET applied mid-statement never re-arms the timer.
+-- Proven empirically 2026-08-04: a probe function declaring
+-- SET statement_timeout = '10s' around a 3s sleep was still cancelled by a
+-- 1s session timeout. Large SIE imports therefore still fail at 8s with
+-- "canceling statement due to statement timeout".
+--
+-- Working mechanism: a PostgREST pre-request hook. PostgREST invokes
+-- pgrst.db_pre_request as its OWN statement inside the request transaction,
+-- before the main query, so a transaction-local set_config here changes the
+-- value the main statement's timer is armed with. Scoped by request path to
+-- the three SIE RPCs; every other request keeps the role default (8s).
+-- 290s stays just under the calling routes' maxDuration = 300 ceiling
+-- (/api/import/sie/execute, /api/import/sie/[id]/replace and undo,
+-- /api/extensions/ext/[...path], /api/v1/.../imports/sie).
+--
+-- The function runs on EVERY PostgREST request: it must be cheap and must
+-- never throw (an error here fails all API requests). current_setting with
+-- missing_ok handles direct connections where request.path is absent.
+
+create or replace function public.pre_request_statement_timeout()
+returns void
+language plpgsql
+as $$
+begin
+  if coalesce(current_setting('request.path', true), '')
+       ~ '/rpc/(import_sie_journal_entries|replace_sie_import|undo_sie_import)$'
+  then
+    perform set_config('statement_timeout', '290s', true);
+  end if;
+end;
+$$;
+
+alter role authenticator set pgrst.db_pre_request = 'public.pre_request_statement_timeout';
+
+notify pgrst, 'reload config';
+notify pgrst, 'reload schema';
diff --git a/supabase/migrations/20260826130100_teams_kind_and_deterministic_attachment.sql b/supabase/migrations/20260826130100_teams_kind_and_deterministic_attachment.sql
new file mode 100644
index 00000000..ca2161a8
--- /dev/null
+++ b/supabase/migrations/20260826130100_teams_kind_and_deterministic_attachment.sql
@@ -0,0 +1,225 @@
+-- Migration: teams.kind + deterministic personal-team attachment
+--
+-- White-label foundation slice (WL-08 resolution, dev_docs/white-label/):
+-- teams get a kind ('personal' | 'byra') so byrå teams (named, multi-member,
+-- brand-carrying) are distinguishable from the silent one-per-user "Personal"
+-- shells. Byrå teams are created ops-assisted; every existing row becomes
+-- 'personal' via the column default, and ops flips real byrå teams via the
+-- service role.
+--
+-- Four changes:
+--   1. teams.kind column with CHECK ('personal' | 'byra'), default 'personal'
+--   2. ensure_user_team() now selects the user's PERSONAL team
+--      deterministically (the old bare LIMIT 1 with no ORDER BY could hand a
+--      consultant's new private company to the byrå team)
+--   3. AFTER UPDATE OF role trigger on team_members re-syncs team-sourced
+--      company_members roles (previously a demoted consultant kept admin in
+--      every client book until they left the team)
+--   4. Team rename path: explicit owner/admin UPDATE policy on teams, plus a
+--      BEFORE UPDATE guard that makes kind changes ops-only
+
+-- =============================================================================
+-- 1. teams.kind
+-- =============================================================================
+
+ALTER TABLE public.teams
+  ADD COLUMN kind text NOT NULL DEFAULT 'personal';
+
+ALTER TABLE public.teams
+  ADD CONSTRAINT teams_kind_check CHECK (kind IN ('personal', 'byra'));
+
+COMMENT ON COLUMN public.teams.kind IS
+  'personal = the silent one-per-user shell every user gets; byra = a named, '
+  'multi-member accounting-firm team (invitable, brand-carrying, cockpit). '
+  'Ops-managed: only the service role may change it after creation.';
+
+-- =============================================================================
+-- 2. Deterministic ensure_user_team()
+-- =============================================================================
+-- Replaces the definition from 20260415000000_schema_sync.sql. The old body
+-- picked the user's first team_members row with a bare LIMIT 1 and no ORDER
+-- BY, so under multi-team membership (own personal team + byrå team) a new
+-- personal-flow company could arbitrarily attach to the byrå team, granting
+-- the whole byrå admin access to the user's private books. Companies created
+-- through the normal flow must always attach to the PERSONAL team; cockpit
+-- flows pass the byrå team id explicitly (WL-08).
+-- SECURITY DEFINER + search_path kept exactly as the original.
+
+CREATE OR REPLACE FUNCTION public.ensure_user_team()
+ RETURNS uuid
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'public'
+AS $function$
+DECLARE
+  v_user_id uuid;
+  v_team_id uuid;
+BEGIN
+  v_user_id := auth.uid();
+  IF v_user_id IS NULL THEN
+    RAISE EXCEPTION 'Not authenticated';
+  END IF;
+
+  -- Deterministic: only ever the user's personal team. ORDER BY is a
+  -- tie-break for the (unexpected) case of multiple personal teams.
+  SELECT tm.team_id INTO v_team_id
+  FROM public.team_members tm
+  JOIN public.teams t ON t.id = tm.team_id
+  WHERE tm.user_id = v_user_id
+    AND t.kind = 'personal'
+  ORDER BY t.created_at, t.id
+  LIMIT 1;
+
+  IF v_team_id IS NOT NULL THEN
+    RETURN v_team_id;
+  END IF;
+
+  INSERT INTO public.teams (name, created_by, kind)
+  VALUES ('Personal', v_user_id, 'personal')
+  RETURNING id INTO v_team_id;
+
+  INSERT INTO public.team_members (team_id, user_id, role)
+  VALUES (v_team_id, v_user_id, 'owner');
+
+  RETURN v_team_id;
+END;
+$function$;
+
+-- =============================================================================
+-- 3. Role re-sync on team_members role UPDATE
+-- =============================================================================
+-- The INSERT sync (20260331010000, sync_team_member_to_companies) maps team
+-- owner/admin to company admin and everything else to member, but nothing
+-- re-synced on a role UPDATE: promoting a member did not grant admin, and
+-- (worse) demoting an admin left them admin in every client company. This
+-- trigger applies the same mapping to existing team-sourced rows. Rows with
+-- source = 'direct' are never touched.
+
+CREATE OR REPLACE FUNCTION public.resync_team_member_role_to_companies()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_company_role text;
+BEGIN
+  -- Same mapping as sync_team_member_to_companies: team owner/admin becomes
+  -- company admin, else member. Company 'owner' stays reserved for whoever
+  -- created that specific company, so this can never mint a company owner.
+  v_company_role := CASE
+    WHEN NEW.role IN ('owner', 'admin') THEN 'admin'
+    ELSE 'member'
+  END;
+
+  UPDATE public.company_members cm
+  SET role = v_company_role
+  WHERE cm.user_id = NEW.user_id
+    AND cm.source = 'team'
+    AND cm.role IS DISTINCT FROM v_company_role
+    AND cm.company_id IN (
+      SELECT c.id
+      FROM public.companies c
+      WHERE c.team_id = NEW.team_id
+    );
+
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS team_member_sync_role_update ON public.team_members;
+
+CREATE TRIGGER team_member_sync_role_update
+  AFTER UPDATE OF role ON public.team_members
+  FOR EACH ROW
+  WHEN (OLD.role IS DISTINCT FROM NEW.role)
+  EXECUTE FUNCTION public.resync_team_member_role_to_companies();
+
+-- The company_members BEFORE UPDATE guard (20260422120000) blocks role
+-- changes unless the caller is a company owner. The re-sync cascade above is
+-- driven by an authorized team_members write (team admins, per team_members
+-- RLS), typically by a caller who is only company *admin* in the client
+-- companies, so the guard must let trigger-cascaded writes through.
+-- pg_trigger_depth() > 1 identifies exactly those: a direct UPDATE of
+-- company_members runs this guard at depth 1; a write issued from inside
+-- another trigger (the re-sync) runs it at depth 2. Users cannot create
+-- triggers, and the team-to-company mapping never produces 'owner', so the
+-- passthrough cannot be used to mint or demote company owners.
+
+CREATE OR REPLACE FUNCTION public.enforce_company_member_role_transitions()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+DECLARE
+  caller_role text;
+BEGIN
+  -- Service role, SECURITY DEFINER cascades, and direct SQL have no auth context.
+  IF auth.uid() IS NULL THEN
+    RETURN NEW;
+  END IF;
+
+  -- Trigger-cascaded writes come from our own sync triggers
+  -- (team_member_sync_role_update), not from a direct user statement.
+  IF pg_trigger_depth() > 1 THEN
+    RETURN NEW;
+  END IF;
+
+  -- Nothing to enforce if the role field isn't changing.
+  IF NEW.role IS NOT DISTINCT FROM OLD.role THEN
+    RETURN NEW;
+  END IF;
+
+  caller_role := public.user_role_in_company(OLD.company_id);
+
+  IF caller_role IS DISTINCT FROM 'owner' THEN
+    RAISE EXCEPTION
+      'Only owners can change member roles (your role: %)',
+      COALESCE(caller_role, 'none');
+  END IF;
+
+  RETURN NEW;
+END;
+$$;
+
+-- =============================================================================
+-- 4. Team rename path
+-- =============================================================================
+-- Recreate the UPDATE policy so the rename grant (team owner/admin) is
+-- explicit next to the kind guard. Behavior is identical to 20260422120000:
+-- user_is_team_admin() already includes the created_by fallback internally.
+
+DROP POLICY IF EXISTS "teams_update" ON public.teams;
+
+CREATE POLICY "teams_update" ON public.teams
+  FOR UPDATE
+  USING (public.user_is_team_admin(id))
+  WITH CHECK (public.user_is_team_admin(id));
+
+-- Rename is allowed; kind changes are ops-only. Follows the codebase guard
+-- convention (enforce_company_member_role_transitions): auth.uid() IS NULL
+-- means service role, SECURITY DEFINER cascade, or direct SQL, all trusted
+-- ops paths; any user session is rejected.
+
+CREATE OR REPLACE FUNCTION public.enforce_team_kind_ops_only()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NEW.kind IS DISTINCT FROM OLD.kind AND auth.uid() IS NOT NULL THEN
+    RAISE EXCEPTION
+      'teams.kind is ops-managed; rename is allowed but kind changes require the service role'
+      USING ERRCODE = '42501';
+  END IF;
+
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS enforce_team_kind_ops_only ON public.teams;
+
+CREATE TRIGGER enforce_team_kind_ops_only
+  BEFORE UPDATE ON public.teams
+  FOR EACH ROW
+  EXECUTE FUNCTION public.enforce_team_kind_ops_only();
+
+NOTIFY pgrst, 'reload schema';
diff --git a/supabase/migrations/20260826130200_brands.sql b/supabase/migrations/20260826130200_brands.sql
new file mode 100644
index 00000000..053acb2f
--- /dev/null
+++ b/supabase/migrations/20260826130200_brands.sql
@@ -0,0 +1,83 @@
+-- Migration: brands table
+--
+-- White-label foundation slice (WL-01/WL-02/WL-12 resolutions,
+-- dev_docs/white-label/): a brand is a byrå team's white-label identity.
+-- One brand per team (unique team_id), one mutable domain per brand (unique
+-- domain), row presence = live. Brand rows are ops-managed via the service
+-- role in v1: no INSERT/UPDATE/DELETE policies on purpose. Host resolution
+-- (lib/branding/resolve.ts) uses the cookieless service client and bypasses
+-- RLS by design, because anonymous visitors on a brand domain need the brand
+-- before login. The single SELECT policy lets members of the owning team read
+-- their own brand (e.g. a future cockpit surface).
+--
+-- Color CHECKs mirror the invoice branding pattern
+-- (20260526120200_invoice_branding.sql): a regex gate so invalid values never
+-- reach the renderer. chrome_color is an explicit ops override; NULL means
+-- the chrome tone is derived from brand_color at runtime (WL-02 model A).
+
+CREATE TABLE public.brands (
+  id                   uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  team_id              uuid NOT NULL UNIQUE REFERENCES public.teams(id) ON DELETE CASCADE,
+
+  -- Lowercase hostname only: no scheme, no slash, no port, no uppercase.
+  domain               text NOT NULL UNIQUE,
+
+  app_name             text NOT NULL,
+  logo_url             text,
+  brand_color          text NOT NULL,
+  chrome_color         text,
+  font_key             text NOT NULL DEFAULT 'default',
+
+  -- Email identity (WL-01: the brand carries email sender identity; no
+  -- verified sender domain means the "Partner via Accounted" fallback,
+  -- email never blocks go-live).
+  support_email        text NOT NULL,
+  auth_email_from      text,
+  sender_domain        text,
+  resend_domain_id     text,
+  sender_domain_status text NOT NULL DEFAULT 'unverified',
+
+  created_at           timestamptz NOT NULL DEFAULT now(),
+  updated_at           timestamptz NOT NULL DEFAULT now(),
+
+  CONSTRAINT brands_domain_format
+    CHECK (domain ~ '^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$'),
+  CONSTRAINT brands_brand_color_format
+    CHECK (brand_color ~ '^#[0-9A-Fa-f]{6}$'),
+  CONSTRAINT brands_chrome_color_format
+    CHECK (chrome_color IS NULL OR chrome_color ~ '^#[0-9A-Fa-f]{6}$'),
+  CONSTRAINT brands_sender_domain_status_check
+    CHECK (sender_domain_status IN ('unverified', 'pending', 'verified', 'failed'))
+);
+
+COMMENT ON TABLE public.brands IS
+  'A brand is a byrå team''s white-label identity: the domain the app is '
+  'served on, the app name, logo, brand color (chrome tone derived unless '
+  'chrome_color overrides it), font pair from the curated menu, and the email '
+  'sender identity. Exactly one brand per team (unique team_id) and one '
+  'mutable domain per brand (unique domain). Row presence means live: there '
+  'is no active flag; preview happens by pointing domain at a controlled '
+  'subdomain, go-live is one UPDATE, and deleting the row reverts the team''s '
+  'companies to the canonical Accounted appearance. Rows are ops-managed via '
+  'the service role in v1; team members have read-only visibility.';
+
+-- =============================================================================
+-- RLS
+-- =============================================================================
+
+ALTER TABLE public.brands ENABLE ROW LEVEL SECURITY;
+
+-- Members of the owning team may read their brand. No write policies: brand
+-- rows are created/updated/deleted by ops through the service role in v1.
+CREATE POLICY "brands_select" ON public.brands
+  FOR SELECT USING (team_id IN (SELECT public.user_team_ids()));
+
+-- =============================================================================
+-- Triggers
+-- =============================================================================
+
+CREATE TRIGGER brands_updated_at
+  BEFORE UPDATE ON public.brands
+  FOR EACH ROW EXECUTE FUNCTION public.update_updated_at_column();
+
+NOTIFY pgrst, 'reload schema';
diff --git a/supabase/migrations/20260826130300_suppress_trial_for_byra_companies.sql b/supabase/migrations/20260826130300_suppress_trial_for_byra_companies.sql
new file mode 100644
index 00000000..de3102dd
--- /dev/null
+++ b/supabase/migrations/20260826130300_suppress_trial_for_byra_companies.sql
@@ -0,0 +1,51 @@
+-- Migration: no 30-day trial for byrå-team companies
+--
+-- White-label billing slice (WL-10 resolution, dev_docs/white-label/):
+-- companies created under a byrå team (teams.kind = 'byra') are already
+-- entitled via the team-scoped partner grant, so the company-scoped 30-day
+-- trial is pure noise there: trial-expiry emails would hit byrå clients with
+-- the wrong message. Personal-team and teamless companies keep the trial
+-- exactly as shipped in 20260818170000 (the full seven-key PAID set).
+--
+-- Replaces ONLY the trigger function body (seed_trial_capability_grants);
+-- the trigger itself (trg_seed_trial_capability_grants, AFTER INSERT ON
+-- companies) is untouched. team_id is populated in the same INSERT on every
+-- creation path (create_company_with_owner p_team_id / direct insert), so
+-- reading NEW.team_id here is race-free.
+
+CREATE OR REPLACE FUNCTION public.seed_trial_capability_grants()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  -- Byrå-team companies are covered by the team's agreement (WL-10):
+  -- no company-scoped trial, so no trial-expiry noise toward byrå clients.
+  IF NEW.team_id IS NOT NULL AND EXISTS (
+    SELECT 1 FROM public.teams t
+    WHERE t.id = NEW.team_id
+      AND t.kind = 'byra'
+  ) THEN
+    RETURN NEW;
+  END IF;
+
+  -- Full PAID set as of 20260818170000; keep this VALUES list in step with
+  -- lib/entitlements/keys.ts PAID_CAPABILITIES whenever a key is added.
+  INSERT INTO public.capability_grants (company_id, capability_key, source, expires_at)
+  SELECT NEW.id, k.key, 'trial', NEW.created_at + interval '30 days'
+  FROM (VALUES
+    ('ai'),
+    ('bank_sync'),
+    ('skatteverket'),
+    ('email_send'),
+    ('stripe_payments'),
+    ('woocommerce_sync'),
+    ('shopify_sync')
+  ) AS k(key)
+  ON CONFLICT (company_id, team_id, capability_key, source) DO NOTHING;
+  RETURN NEW;
+END;
+$$;
+
+NOTIFY pgrst, 'reload schema';
diff --git a/supabase/migrations/20260826130400_byra_client_company_creation_admin_gate.sql b/supabase/migrations/20260826130400_byra_client_company_creation_admin_gate.sql
new file mode 100644
index 00000000..02357644
--- /dev/null
+++ b/supabase/migrations/20260826130400_byra_client_company_creation_admin_gate.sql
@@ -0,0 +1,105 @@
+-- Migration: byrå client company creation is admin-gated (WL-15)
+--
+-- Cockpit slice D3 (dev_docs/white-label/tickets/WL-15): creating a client
+-- company under a byrå team is a commercial act (+1 on the byrå's monthly
+-- invoice), so only team OWNERS and ADMINS may do it. Plain members keep
+-- read/work access to client companies via the sync triggers but cannot
+-- create new ones.
+--
+-- The gate must live in the database: create_company_with_owner is a
+-- SECURITY DEFINER RPC granted to `authenticated`, so any byrå member could
+-- otherwise call it directly through PostgREST with the byrå p_team_id and
+-- bypass every application-level check.
+--
+-- Behavior for personal teams is byte-identical to
+-- 20260519180000_enforce_team_membership_in_create_company.sql: any member
+-- of a personal team may attach a company to it (in practice the sole owner;
+-- ensure_user_team creates one personal team per user). Only teams with
+-- kind = 'byra' (20260826130100) get the stricter role check.
+
+CREATE OR REPLACE FUNCTION public.create_company_with_owner(
+  p_name text,
+  p_entity_type text,
+  p_set_active boolean DEFAULT true,
+  p_team_id uuid DEFAULT NULL
+)
+RETURNS uuid
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_user_id uuid;
+  v_company_id uuid;
+  v_team_kind text;
+  v_team_role text;
+BEGIN
+  v_user_id := auth.uid();
+  IF v_user_id IS NULL THEN
+    RAISE EXCEPTION 'Not authenticated';
+  END IF;
+
+  IF p_entity_type NOT IN ('enskild_firma', 'aktiebolag') THEN
+    RAISE EXCEPTION 'Invalid entity_type: %', p_entity_type;
+  END IF;
+
+  -- Authorize p_team_id before any write. SECURITY DEFINER bypasses RLS, so
+  -- we must verify membership ourselves; without this any authenticated user
+  -- could attach a company to an arbitrary team (20260519180000). On byrå
+  -- teams the bar is higher: WL-15 locks client company creation to team
+  -- owner/admin because every created company is +1 on the byrå's invoice.
+  IF p_team_id IS NOT NULL THEN
+    SELECT tm.role, t.kind
+    INTO v_team_role, v_team_kind
+    FROM public.team_members tm
+    JOIN public.teams t ON t.id = tm.team_id
+    WHERE tm.team_id = p_team_id
+      AND tm.user_id = v_user_id;
+
+    IF v_team_role IS NULL THEN
+      RAISE EXCEPTION 'Not a member of team %', p_team_id
+        USING ERRCODE = '42501'; -- insufficient_privilege
+    END IF;
+
+    IF v_team_kind = 'byra' AND v_team_role NOT IN ('owner', 'admin') THEN
+      RAISE EXCEPTION 'Only byrå team owners and admins can create client companies'
+        USING ERRCODE = '42501'; -- insufficient_privilege
+    END IF;
+  END IF;
+
+  INSERT INTO public.companies (name, entity_type, created_by, team_id)
+  VALUES (p_name, p_entity_type, v_user_id, p_team_id)
+  RETURNING id INTO v_company_id;
+
+  INSERT INTO public.company_members (company_id, user_id, role)
+  VALUES (v_company_id, v_user_id, 'owner');
+
+  -- Seed default 1930 SEK cash account so reconciliation routes work before
+  -- any PSD2 connection is established. is_primary so the __PRIMARY_SEK__
+  -- sentinel in skattekonto-booking resolves on day one.
+  INSERT INTO public.cash_accounts (
+    company_id, ledger_account, currency, name, enabled, is_primary, source
+  )
+  VALUES (
+    v_company_id, '1930', 'SEK', 'Företagskonto (SEK)', true, true, 'manual'
+  )
+  ON CONFLICT (company_id, ledger_account) DO NOTHING;
+
+  IF p_set_active THEN
+    INSERT INTO public.user_preferences (user_id, active_company_id)
+    VALUES (v_user_id, v_company_id)
+    ON CONFLICT (user_id)
+    DO UPDATE SET active_company_id = EXCLUDED.active_company_id;
+  END IF;
+
+  IF p_team_id IS NOT NULL THEN
+    PERFORM public.sync_team_to_company(v_company_id, p_team_id);
+  END IF;
+
+  RETURN v_company_id;
+END;
+$$;
+
+GRANT EXECUTE ON FUNCTION public.create_company_with_owner(text, text, boolean, uuid) TO authenticated;
+
+NOTIFY pgrst, 'reload schema';
diff --git a/supabase/migrations/20260826130500_brands_favicon_url.sql b/supabase/migrations/20260826130500_brands_favicon_url.sql
new file mode 100644
index 00000000..9873f96b
--- /dev/null
+++ b/supabase/migrations/20260826130500_brands_favicon_url.sql
@@ -0,0 +1,15 @@
+-- Brands: optional dedicated tab icon (WL follow-up, founder ask 2026-08-05).
+--
+-- The root layout uses brands.logo_url as rel="icon" on branded hosts, but
+-- byra logos are wide lockups that squash badly at 16px. favicon_url holds a
+-- square mark; the layout prefers it over logo_url for the tab icon and
+-- falls back to logo_url when unset. Ops-managed like the rest of brands
+-- (no write RLS; byra self-service edits only the logo via its API route).
+
+alter table public.brands
+  add column if not exists favicon_url text;
+
+comment on column public.brands.favicon_url is
+  'Square tab icon URL; preferred over logo_url for rel="icon" on branded hosts.';
+
+notify pgrst, 'reload schema';
diff --git a/supabase/migrations/20260826130600_byra_gate_create_company_for_user.sql b/supabase/migrations/20260826130600_byra_gate_create_company_for_user.sql
new file mode 100644
index 00000000..589be43c
--- /dev/null
+++ b/supabase/migrations/20260826130600_byra_gate_create_company_for_user.sql
@@ -0,0 +1,111 @@
+-- Migration: byrå admin gate for create_company_for_user (WL-15)
+--
+-- 20260826130400 added the byrå owner/admin gate to create_company_with_owner,
+-- but main's newer service-role variant create_company_for_user (20260825120000,
+-- used by POST /api/v1/companies and the MCP gnubok_create_company tool) still
+-- authorizes p_team_id with a membership-only EXISTS. Any plain byrå team
+-- member could therefore bind a company to the byrå team through the API/MCP
+-- path, which is a commercial act: every created client company is +1 on the
+-- byrå's monthly invoice, and the byrå trial-suppression trigger then kills
+-- the company's trial grants.
+--
+-- This replaces the function with the exact gate from 20260826130400: when the
+-- target team has kind = 'byra', the owner (p_user_id, the API key's user)
+-- must hold team_members.role owner/admin. Personal-team behavior is
+-- unchanged: any member may attach. Everything else (validation, inserts,
+-- cash-account seed, preference upsert, team sync, grants) is byte-identical
+-- to 20260825120000.
+
+CREATE OR REPLACE FUNCTION public.create_company_for_user(
+  p_user_id uuid,
+  p_name text,
+  p_entity_type text,
+  p_team_id uuid DEFAULT NULL
+)
+RETURNS uuid
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_company_id uuid;
+  v_team_kind text;
+  v_team_role text;
+BEGIN
+  IF p_user_id IS NULL THEN
+    RAISE EXCEPTION 'p_user_id is required';
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM auth.users WHERE id = p_user_id) THEN
+    RAISE EXCEPTION 'Unknown user %', p_user_id
+      USING ERRCODE = '23503'; -- foreign_key_violation
+  END IF;
+
+  IF p_entity_type NOT IN ('enskild_firma', 'aktiebolag') THEN
+    RAISE EXCEPTION 'Invalid entity_type: %', p_entity_type;
+  END IF;
+
+  IF p_name IS NULL OR length(btrim(p_name)) = 0 THEN
+    RAISE EXCEPTION 'p_name is required';
+  END IF;
+
+  -- Same authorization as create_company_with_owner (20260826130400), against
+  -- the explicit owner: SECURITY DEFINER bypasses RLS, so team membership is
+  -- checked here. On byrå teams the bar is higher: WL-15 locks client company
+  -- creation to team owner/admin because every created company is +1 on the
+  -- byrå's invoice.
+  IF p_team_id IS NOT NULL THEN
+    SELECT tm.role, t.kind
+    INTO v_team_role, v_team_kind
+    FROM public.team_members tm
+    JOIN public.teams t ON t.id = tm.team_id
+    WHERE tm.team_id = p_team_id
+      AND tm.user_id = p_user_id;
+
+    IF v_team_role IS NULL THEN
+      RAISE EXCEPTION 'Not a member of team %', p_team_id
+        USING ERRCODE = '42501'; -- insufficient_privilege
+    END IF;
+
+    IF v_team_kind = 'byra' AND v_team_role NOT IN ('owner', 'admin') THEN
+      RAISE EXCEPTION 'Only byrå team owners and admins can create client companies'
+        USING ERRCODE = '42501'; -- insufficient_privilege
+    END IF;
+  END IF;
+
+  INSERT INTO public.companies (name, entity_type, created_by, team_id)
+  VALUES (btrim(p_name), p_entity_type, p_user_id, p_team_id)
+  RETURNING id INTO v_company_id;
+
+  INSERT INTO public.company_members (company_id, user_id, role)
+  VALUES (v_company_id, p_user_id, 'owner');
+
+  INSERT INTO public.cash_accounts (
+    company_id, ledger_account, currency, name, enabled, is_primary, source
+  )
+  VALUES (
+    v_company_id, '1930', 'SEK', 'Företagskonto (SEK)', true, true, 'manual'
+  )
+  ON CONFLICT (company_id, ledger_account) DO NOTHING;
+
+  INSERT INTO public.user_preferences (user_id, active_company_id)
+  VALUES (p_user_id, v_company_id)
+  ON CONFLICT (user_id)
+  DO UPDATE SET active_company_id = EXCLUDED.active_company_id;
+
+  IF p_team_id IS NOT NULL THEN
+    PERFORM public.sync_team_to_company(v_company_id, p_team_id);
+  END IF;
+
+  RETURN v_company_id;
+END;
+$$;
+
+-- Service role only. PostgREST exposes functions to every role by default
+-- (PUBLIC grant), so revoke first, then grant the one role that may call it.
+REVOKE ALL ON FUNCTION public.create_company_for_user(uuid, text, text, uuid) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.create_company_for_user(uuid, text, text, uuid) FROM anon;
+REVOKE ALL ON FUNCTION public.create_company_for_user(uuid, text, text, uuid) FROM authenticated;
+GRANT EXECUTE ON FUNCTION public.create_company_for_user(uuid, text, text, uuid) TO service_role;
+
+NOTIFY pgrst, 'reload schema';
diff --git a/tests/pg/brands.pg.test.ts b/tests/pg/brands.pg.test.ts
new file mode 100644
index 00000000..e3f396ae
--- /dev/null
+++ b/tests/pg/brands.pg.test.ts
@@ -0,0 +1,237 @@
+import { randomUUID } from 'node:crypto'
+import { describe, expect, it } from 'vitest'
+import { getPool, withUserContext } from '@/tests/pg/setup'
+import { insertAuthUser } from '@/tests/pg/fixtures'
+
+// Tests for 20260826130200_brands.sql (white-label foundation, WL-01/WL-02):
+// one brand per team, one unique domain per brand, hex/hostname/status CHECK
+// gates, read-only visibility for the owning team's members, and no write
+// policies for user sessions (brand rows are ops-managed via service role).
+
+async function insertTeam(params: {
+  createdBy: string
+  kind?: 'personal' | 'byra'
+  name?: string
+}): Promise<string> {
+  const id = randomUUID()
+  await getPool().query(
+    `INSERT INTO public.teams (id, name, created_by, kind)
+     VALUES ($1, $2, $3, $4)`,
+    [id, params.name ?? 'Byra Team', params.createdBy, params.kind ?? 'byra'],
+  )
+  await getPool().query(
+    `INSERT INTO public.team_members (team_id, user_id, role)
+     VALUES ($1, $2, 'owner')`,
+    [id, params.createdBy],
+  )
+  return id
+}
+
+async function insertBrand(params: {
+  teamId: string
+  domain?: string
+  appName?: string
+  brandColor?: string
+  chromeColor?: string | null
+  senderDomainStatus?: string
+}): Promise<string> {
+  const id = randomUUID()
+  await getPool().query(
+    `INSERT INTO public.brands
+       (id, team_id, domain, app_name, brand_color, chrome_color, support_email, sender_domain_status)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, COALESCE($8, 'unverified'))`,
+    [
+      id,
+      params.teamId,
+      params.domain ?? `${randomUUID().slice(0, 8)}.accounted.se`,
+      params.appName ?? 'Siffra',
+      params.brandColor ?? '#2563eb',
+      params.chromeColor ?? null,
+      'support@siffra.se',
+      params.senderDomainStatus ?? null,
+    ],
+  )
+  return id
+}
+
+async function expectSqlstate(fn: () => Promise<unknown>, expected: string): Promise<void> {
+  let sqlstate: string | undefined
+  try {
+    await fn()
+  } catch (err) {
+    sqlstate = (err as { code?: string }).code
+  }
+  expect(sqlstate).toBe(expected)
+}
+
+describe('brands: shape and defaults', () => {
+  it('inserts a valid brand and reads defaults back', async () => {
+    const owner = await insertAuthUser()
+    const teamId = await insertTeam({ createdBy: owner })
+    const brandId = await insertBrand({ teamId, domain: 'app.siffra.se' })
+
+    const { rows } = await getPool().query<{
+      domain: string
+      font_key: string
+      sender_domain_status: string
+      chrome_color: string | null
+    }>(`SELECT domain, font_key, sender_domain_status, chrome_color FROM public.brands WHERE id = $1`, [
+      brandId,
+    ])
+    expect(rows[0]).toEqual({
+      domain: 'app.siffra.se',
+      font_key: 'default',
+      sender_domain_status: 'unverified',
+      chrome_color: null,
+    })
+  })
+
+  it('deleting the team cascades the brand', async () => {
+    const owner = await insertAuthUser()
+    const teamId = await insertTeam({ createdBy: owner })
+    const brandId = await insertBrand({ teamId })
+
+    await getPool().query(`DELETE FROM public.teams WHERE id = $1`, [teamId])
+
+    const { rows } = await getPool().query(`SELECT 1 FROM public.brands WHERE id = $1`, [brandId])
+    expect(rows).toHaveLength(0)
+  })
+})
+
+describe('brands: uniqueness', () => {
+  it('enforces one brand per team (unique team_id, 23505)', async () => {
+    const owner = await insertAuthUser()
+    const teamId = await insertTeam({ createdBy: owner })
+    await insertBrand({ teamId })
+
+    await expectSqlstate(() => insertBrand({ teamId }), '23505')
+  })
+
+  it('enforces globally unique domains (23505)', async () => {
+    const ownerA = await insertAuthUser()
+    const ownerB = await insertAuthUser()
+    const teamA = await insertTeam({ createdBy: ownerA })
+    const teamB = await insertTeam({ createdBy: ownerB })
+    const domain = `${randomUUID().slice(0, 8)}.accounted.se`
+    await insertBrand({ teamId: teamA, domain })
+
+    await expectSqlstate(() => insertBrand({ teamId: teamB, domain }), '23505')
+  })
+})
+
+describe('brands: CHECK constraints', () => {
+  async function freshTeam(): Promise<string> {
+    return insertTeam({ createdBy: await insertAuthUser() })
+  }
+
+  it('rejects non-hex brand_color values (23514)', async () => {
+    for (const bad of ['blue', '#12345', '#12345g', '1a2b3c']) {
+      await expectSqlstate(
+        () => insertBrand({ teamId: '00000000-0000-0000-0000-000000000000', brandColor: bad }),
+        '23514',
+      )
+    }
+  })
+
+  it('accepts upper- and lowercase hex colors, rejects bad chrome_color (23514)', async () => {
+    const teamId = await freshTeam()
+    await insertBrand({ teamId, brandColor: '#AABBCC', chromeColor: '#0f1722' })
+
+    await expectSqlstate(
+      () =>
+        insertBrand({
+          teamId: '00000000-0000-0000-0000-000000000000',
+          chromeColor: 'dark',
+        }),
+      '23514',
+    )
+  })
+
+  it('rejects domains with scheme, slash, uppercase, or leading dot (23514)', async () => {
+    for (const bad of [
+      'https://app.siffra.se',
+      'app.siffra.se/login',
+      'App.Siffra.se',
+      '.siffra.se',
+      'app siffra.se',
+      '',
+    ]) {
+      await expectSqlstate(
+        () => insertBrand({ teamId: '00000000-0000-0000-0000-000000000000', domain: bad }),
+        '23514',
+      )
+    }
+  })
+
+  it('accepts bare hostnames including umbrella subdomains', async () => {
+    const teamA = await freshTeam()
+    const teamB = await freshTeam()
+    await insertBrand({ teamId: teamA, domain: `siffra-${randomUUID().slice(0, 6)}.accounted.se` })
+    await insertBrand({ teamId: teamB, domain: `app.rodvik-${randomUUID().slice(0, 6)}.se` })
+  })
+
+  it('rejects unknown sender_domain_status (23514)', async () => {
+    await expectSqlstate(
+      () =>
+        insertBrand({
+          teamId: '00000000-0000-0000-0000-000000000000',
+          senderDomainStatus: 'maybe',
+        }),
+      '23514',
+    )
+  })
+})
+
+describe('brands: RLS', () => {
+  it('members of the owning team can read their brand; outsiders cannot', async () => {
+    const owner = await insertAuthUser()
+    const stranger = await insertAuthUser()
+    const teamId = await insertTeam({ createdBy: owner })
+    const brandId = await insertBrand({ teamId })
+
+    await withUserContext(owner, async (client) => {
+      const { rows } = await client.query(`SELECT id FROM public.brands WHERE id = $1`, [brandId])
+      expect(rows).toHaveLength(1)
+    })
+
+    await withUserContext(stranger, async (client) => {
+      const { rows } = await client.query(`SELECT id FROM public.brands WHERE id = $1`, [brandId])
+      expect(rows).toHaveLength(0)
+    })
+  })
+
+  it('has no write policies: user sessions cannot insert, update, or delete', async () => {
+    const owner = await insertAuthUser()
+    const teamId = await insertTeam({ createdBy: owner })
+    const brandId = await insertBrand({ teamId })
+
+    await withUserContext(owner, async (client) => {
+      // UPDATE and DELETE are silently filtered to zero rows (no policy).
+      const updated = await client.query(
+        `UPDATE public.brands SET app_name = 'Hijacked' WHERE id = $1`,
+        [brandId],
+      )
+      expect(updated.rowCount).toBe(0)
+
+      const deleted = await client.query(`DELETE FROM public.brands WHERE id = $1`, [brandId])
+      expect(deleted.rowCount).toBe(0)
+    })
+
+    // INSERT is rejected outright (42501: violates row-level security).
+    const otherOwner = await insertAuthUser()
+    const otherTeam = await insertTeam({ createdBy: otherOwner })
+    let sqlstate: string | undefined
+    try {
+      await withUserContext(otherOwner, async (client) => {
+        await client.query(
+          `INSERT INTO public.brands (team_id, domain, app_name, brand_color, support_email)
+           VALUES ($1, $2, 'Rogue', '#2563eb', 'support@rogue.se')`,
+          [otherTeam, `rogue-${randomUUID().slice(0, 6)}.accounted.se`],
+        )
+      })
+    } catch (err) {
+      sqlstate = (err as { code?: string }).code
+    }
+    expect(sqlstate).toBe('42501')
+  })
+})
diff --git a/tests/pg/byra-client-company-creation.pg.test.ts b/tests/pg/byra-client-company-creation.pg.test.ts
new file mode 100644
index 00000000..91087463
--- /dev/null
+++ b/tests/pg/byra-client-company-creation.pg.test.ts
@@ -0,0 +1,255 @@
+import { randomUUID } from 'node:crypto'
+import { describe, expect, it } from 'vitest'
+import { getPool, withUserContext } from '@/tests/pg/setup'
+import { insertAuthUser } from '@/tests/pg/fixtures'
+
+// Tests for 20260826130400_byra_client_company_creation_admin_gate.sql
+// (cockpit slice D3, WL-15 resolution):
+//
+//   - creating a company under a BYRÅ team requires team role owner/admin
+//     (a plain member gets 42501): enforced in the RPC itself because it is
+//     SECURITY DEFINER and EXECUTE-granted to `authenticated`, so PostgREST
+//     callers bypass every application-level check
+//   - byrå owner/admin creation binds companies.team_id to the byrå team
+//   - personal-team creation keeps the pre-existing behavior (any member)
+//   - the non-member rejection from 20260519180000 is preserved
+
+async function insertTeam(params: {
+  createdBy: string
+  kind?: 'personal' | 'byra'
+  name?: string
+}): Promise<string> {
+  const id = randomUUID()
+  await getPool().query(
+    `INSERT INTO public.teams (id, name, created_by, kind)
+     VALUES ($1, $2, $3, $4)`,
+    [id, params.name ?? 'Test Team', params.createdBy, params.kind ?? 'personal'],
+  )
+  await getPool().query(
+    `INSERT INTO public.team_members (team_id, user_id, role)
+     VALUES ($1, $2, 'owner')`,
+    [id, params.createdBy],
+  )
+  return id
+}
+
+async function insertTeamMember(params: {
+  teamId: string
+  userId: string
+  role: 'owner' | 'admin' | 'member'
+}): Promise<void> {
+  await getPool().query(
+    `INSERT INTO public.team_members (team_id, user_id, role)
+     VALUES ($1, $2, $3)`,
+    [params.teamId, params.userId, params.role],
+  )
+}
+
+// withUserContext ROLLS BACK its transaction, so nothing the RPC creates is
+// visible to the plain pool afterwards. All persisted-state assertions must
+// therefore be gathered INSIDE the callback, after RESET ROLE (back to the
+// superuser session role, so RLS cannot hide rows), before the rollback.
+async function createCompanyAs(
+  userId: string,
+  teamId: string,
+): Promise<{
+  companyId?: string
+  companyTeamId?: string
+  memberRoles?: Record<string, { role: string; source: string }>
+  sqlstate?: string
+  message?: string
+}> {
+  try {
+    return await withUserContext(userId, async (client) => {
+      const { rows } = await client.query<{ id: string }>(
+        `SELECT public.create_company_with_owner(
+           'Klient AB', 'aktiebolag', false, $1
+         ) AS id`,
+        [teamId],
+      )
+      const companyId = rows[0]!.id
+      await client.query('RESET ROLE')
+      const company = await client.query<{ team_id: string }>(
+        `SELECT team_id FROM public.companies WHERE id = $1`,
+        [companyId],
+      )
+      const members = await client.query<{
+        user_id: string
+        role: string
+        source: string
+      }>(
+        `SELECT user_id, role, source FROM public.company_members
+         WHERE company_id = $1`,
+        [companyId],
+      )
+      const memberRoles: Record<string, { role: string; source: string }> = {}
+      for (const m of members.rows) {
+        memberRoles[m.user_id] = { role: m.role, source: m.source }
+      }
+      return {
+        companyId,
+        companyTeamId: company.rows[0]?.team_id,
+        memberRoles,
+      }
+    })
+  } catch (err) {
+    return {
+      sqlstate: (err as { code?: string }).code,
+      message: (err as { message?: string }).message,
+    }
+  }
+}
+
+describe('create_company_with_owner byrå admin gate (WL-15)', () => {
+  it('rejects a plain byrå MEMBER with 42501', async () => {
+    const byraOwner = await insertAuthUser()
+    const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra' })
+    const consultant = await insertAuthUser()
+    await insertTeamMember({ teamId: byraTeam, userId: consultant, role: 'member' })
+
+    const result = await createCompanyAs(consultant, byraTeam)
+
+    expect(result.sqlstate).toBe('42501')
+    expect(result.message).toMatch(/owners and admins/)
+  })
+
+  it('lets a byrå ADMIN create a client company bound to the byrå team', async () => {
+    const byraOwner = await insertAuthUser()
+    const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra' })
+    const admin = await insertAuthUser()
+    await insertTeamMember({ teamId: byraTeam, userId: admin, role: 'admin' })
+
+    const result = await createCompanyAs(admin, byraTeam)
+    expect(result.companyId).toBeDefined()
+    expect(result.companyTeamId).toBe(byraTeam)
+
+    // The creating consultant holds the reserved company owner role.
+    expect(result.memberRoles?.[admin]?.role).toBe('owner')
+
+    // Team sync granted the byrå owner access too (source='team').
+    expect(result.memberRoles?.[byraOwner]).toEqual({ role: 'admin', source: 'team' })
+  })
+
+  it('lets the byrå OWNER create a client company', async () => {
+    const byraOwner = await insertAuthUser()
+    const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra' })
+
+    const result = await createCompanyAs(byraOwner, byraTeam)
+    expect(result.companyId).toBeDefined()
+  })
+
+  it('keeps personal-team creation working for its member (unchanged behavior)', async () => {
+    const user = await insertAuthUser()
+    const personalTeam = await insertTeam({ createdBy: user, kind: 'personal' })
+
+    const result = await createCompanyAs(user, personalTeam)
+    expect(result.companyId).toBeDefined()
+    expect(result.companyTeamId).toBe(personalTeam)
+  })
+
+  it('still rejects a complete non-member with 42501 (20260519180000 preserved)', async () => {
+    const byraOwner = await insertAuthUser()
+    const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra' })
+    const outsider = await insertAuthUser()
+
+    const result = await createCompanyAs(outsider, byraTeam)
+
+    expect(result.sqlstate).toBe('42501')
+    expect(result.message).toMatch(/Not a member of team/)
+  })
+})
+
+// Same gate on the service-role variant (20260826130600): the RPC behind
+// POST /api/v1/companies and the MCP gnubok_create_company tool takes the
+// owner explicitly (auth.uid() is NULL on service-role paths), so it is
+// called straight through the pool without a user context.
+async function createCompanyForUser(
+  userId: string,
+  teamId: string | null,
+): Promise<{ companyId?: string; sqlstate?: string; message?: string }> {
+  try {
+    const { rows } = await getPool().query<{ id: string }>(
+      `SELECT public.create_company_for_user(
+         $1, 'Klient AB', 'aktiebolag', $2
+       ) AS id`,
+      [userId, teamId],
+    )
+    return { companyId: rows[0]!.id }
+  } catch (err) {
+    return {
+      sqlstate: (err as { code?: string }).code,
+      message: (err as { message?: string }).message,
+    }
+  }
+}
+
+describe('create_company_for_user byrå admin gate (WL-15, 20260826130600)', () => {
+  it('rejects a plain byrå MEMBER with 42501', async () => {
+    const byraOwner = await insertAuthUser()
+    const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra' })
+    const consultant = await insertAuthUser()
+    await insertTeamMember({ teamId: byraTeam, userId: consultant, role: 'member' })
+
+    const result = await createCompanyForUser(consultant, byraTeam)
+
+    expect(result.sqlstate).toBe('42501')
+    expect(result.message).toMatch(/owners and admins/)
+  })
+
+  it('lets a byrå ADMIN create a client company bound to the byrå team', async () => {
+    const byraOwner = await insertAuthUser()
+    const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra' })
+    const admin = await insertAuthUser()
+    await insertTeamMember({ teamId: byraTeam, userId: admin, role: 'admin' })
+
+    const result = await createCompanyForUser(admin, byraTeam)
+    expect(result.companyId).toBeDefined()
+
+    const { rows } = await getPool().query<{ team_id: string }>(
+      `SELECT team_id FROM public.companies WHERE id = $1`,
+      [result.companyId],
+    )
+    expect(rows[0]!.team_id).toBe(byraTeam)
+
+    // The creating consultant holds the reserved company owner role.
+    const membership = await getPool().query<{ role: string }>(
+      `SELECT role FROM public.company_members
+       WHERE company_id = $1 AND user_id = $2`,
+      [result.companyId, admin],
+    )
+    expect(membership.rows[0]!.role).toBe('owner')
+  })
+
+  it('lets the byrå OWNER create a client company', async () => {
+    const byraOwner = await insertAuthUser()
+    const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra' })
+
+    const result = await createCompanyForUser(byraOwner, byraTeam)
+    expect(result.companyId).toBeDefined()
+  })
+
+  it('keeps personal-team creation working for its member (unchanged behavior)', async () => {
+    const user = await insertAuthUser()
+    const personalTeam = await insertTeam({ createdBy: user, kind: 'personal' })
+
+    const result = await createCompanyForUser(user, personalTeam)
+    expect(result.companyId).toBeDefined()
+
+    const { rows } = await getPool().query<{ team_id: string }>(
+      `SELECT team_id FROM public.companies WHERE id = $1`,
+      [result.companyId],
+    )
+    expect(rows[0]!.team_id).toBe(personalTeam)
+  })
+
+  it('still rejects a complete non-member with 42501 (20260825120000 preserved)', async () => {
+    const byraOwner = await insertAuthUser()
+    const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra' })
+    const outsider = await insertAuthUser()
+
+    const result = await createCompanyForUser(outsider, byraTeam)
+
+    expect(result.sqlstate).toBe('42501')
+    expect(result.message).toMatch(/Not a member of team/)
+  })
+})
diff --git a/tests/pg/teams-kind-deterministic-attachment.pg.test.ts b/tests/pg/teams-kind-deterministic-attachment.pg.test.ts
new file mode 100644
index 00000000..fc42792c
--- /dev/null
+++ b/tests/pg/teams-kind-deterministic-attachment.pg.test.ts
@@ -0,0 +1,345 @@
+import { randomUUID } from 'node:crypto'
+import { describe, expect, it } from 'vitest'
+import { getPool, withUserContext } from '@/tests/pg/setup'
+import { insertAuthUser } from '@/tests/pg/fixtures'
+
+// Tests for 20260826130100_teams_kind_and_deterministic_attachment.sql
+// (white-label foundation, WL-08 resolution):
+//
+//   1. teams.kind: default 'personal', CHECK ('personal' | 'byra')
+//   2. ensure_user_team() picks the user's PERSONAL team deterministically
+//      (the old bare LIMIT 1 could hand a consultant's new private company
+//      to the byrå team)
+//   3. AFTER UPDATE OF role on team_members re-syncs team-sourced
+//      company_members roles; source='direct' rows are never touched; the
+//      company_members owner-only guard lets the trigger cascade through
+//      (pg_trigger_depth() > 1)
+//   4. teams.kind is ops-only on UPDATE; rename stays allowed for team
+//      owner/admin
+
+async function insertTeam(params: {
+  createdBy: string
+  kind?: 'personal' | 'byra'
+  name?: string
+}): Promise<string> {
+  const id = randomUUID()
+  await getPool().query(
+    `INSERT INTO public.teams (id, name, created_by, kind)
+     VALUES ($1, $2, $3, $4)`,
+    [id, params.name ?? 'Test Team', params.createdBy, params.kind ?? 'personal'],
+  )
+  await getPool().query(
+    `INSERT INTO public.team_members (team_id, user_id, role)
+     VALUES ($1, $2, 'owner')`,
+    [id, params.createdBy],
+  )
+  return id
+}
+
+async function insertTeamMember(params: {
+  teamId: string
+  userId: string
+  role?: 'owner' | 'admin' | 'member'
+}): Promise<void> {
+  await getPool().query(
+    `INSERT INTO public.team_members (team_id, user_id, role)
+     VALUES ($1, $2, $3)`,
+    [params.teamId, params.userId, params.role ?? 'member'],
+  )
+}
+
+async function insertTeamCompany(params: {
+  createdBy: string
+  teamId: string
+  name?: string
+}): Promise<string> {
+  const id = randomUUID()
+  await getPool().query(
+    `INSERT INTO public.companies (id, name, entity_type, created_by, team_id)
+     VALUES ($1, $2, 'aktiebolag', $3, $4)`,
+    [id, params.name ?? 'Client AB', params.createdBy, params.teamId],
+  )
+  await getPool().query(
+    `INSERT INTO public.company_members (company_id, user_id, role)
+     VALUES ($1, $2, 'owner')`,
+    [id, params.createdBy],
+  )
+  return id
+}
+
+async function companyRole(
+  companyId: string,
+  userId: string,
+): Promise<{ role: string; source: string } | undefined> {
+  const { rows } = await getPool().query<{ role: string; source: string }>(
+    `SELECT role, source FROM public.company_members
+     WHERE company_id = $1 AND user_id = $2`,
+    [companyId, userId],
+  )
+  return rows[0]
+}
+
+describe('teams.kind column', () => {
+  it("defaults to 'personal' when not provided", async () => {
+    const userId = await insertAuthUser()
+    const teamId = randomUUID()
+    await getPool().query(
+      `INSERT INTO public.teams (id, name, created_by) VALUES ($1, 'Defaulted', $2)`,
+      [teamId, userId],
+    )
+
+    const { rows } = await getPool().query<{ kind: string }>(
+      `SELECT kind FROM public.teams WHERE id = $1`,
+      [teamId],
+    )
+    expect(rows[0]!.kind).toBe('personal')
+  })
+
+  it("accepts 'byra'", async () => {
+    const userId = await insertAuthUser()
+    const teamId = await insertTeam({ createdBy: userId, kind: 'byra' })
+
+    const { rows } = await getPool().query<{ kind: string }>(
+      `SELECT kind FROM public.teams WHERE id = $1`,
+      [teamId],
+    )
+    expect(rows[0]!.kind).toBe('byra')
+  })
+
+  it('rejects unknown kinds via CHECK (23514)', async () => {
+    const userId = await insertAuthUser()
+
+    let sqlstate: string | undefined
+    try {
+      await getPool().query(
+        `INSERT INTO public.teams (id, name, created_by, kind)
+         VALUES ($1, 'Bad Kind', $2, 'corporate')`,
+        [randomUUID(), userId],
+      )
+    } catch (err) {
+      sqlstate = (err as { code?: string }).code
+    }
+    expect(sqlstate).toBe('23514')
+  })
+})
+
+describe('ensure_user_team determinism', () => {
+  it('returns the personal team even when a byrå membership was created first', async () => {
+    const byraOwner = await insertAuthUser()
+    const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra', name: 'Siffra' })
+
+    const consultant = await insertAuthUser()
+    // Byrå membership row is inserted BEFORE the personal team exists, so a
+    // bare LIMIT 1 with no ORDER BY would typically surface it first.
+    await insertTeamMember({ teamId: byraTeam, userId: consultant, role: 'member' })
+    const personalTeam = await insertTeam({ createdBy: consultant, kind: 'personal' })
+
+    const resolved = await withUserContext(consultant, async (client) => {
+      const { rows } = await client.query<{ team_id: string }>(
+        `SELECT public.ensure_user_team() AS team_id`,
+      )
+      return rows[0]!.team_id
+    })
+
+    expect(resolved).toBe(personalTeam)
+    expect(resolved).not.toBe(byraTeam)
+  })
+
+  it('a byrå-only member gets a fresh personal team, never the byrå team', async () => {
+    const byraOwner = await insertAuthUser()
+    const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra' })
+    const consultant = await insertAuthUser()
+    await insertTeamMember({ teamId: byraTeam, userId: consultant, role: 'member' })
+
+    await withUserContext(consultant, async (client) => {
+      const { rows } = await client.query<{ team_id: string }>(
+        `SELECT public.ensure_user_team() AS team_id`,
+      )
+      const teamId = rows[0]!.team_id
+      expect(teamId).not.toBe(byraTeam)
+
+      const team = await client.query<{ name: string; kind: string }>(
+        `SELECT name, kind FROM public.teams WHERE id = $1`,
+        [teamId],
+      )
+      expect(team.rows[0]).toEqual({ name: 'Personal', kind: 'personal' })
+    })
+  })
+
+  it("creates a 'Personal' team with an owner membership for a teamless user", async () => {
+    const userId = await insertAuthUser()
+
+    await withUserContext(userId, async (client) => {
+      const { rows } = await client.query<{ team_id: string }>(
+        `SELECT public.ensure_user_team() AS team_id`,
+      )
+      const teamId = rows[0]!.team_id
+
+      const membership = await client.query<{ role: string }>(
+        `SELECT role FROM public.team_members WHERE team_id = $1 AND user_id = $2`,
+        [teamId, userId],
+      )
+      expect(membership.rows[0]!.role).toBe('owner')
+
+      // Idempotent: a second call returns the same team.
+      const again = await client.query<{ team_id: string }>(
+        `SELECT public.ensure_user_team() AS team_id`,
+      )
+      expect(again.rows[0]!.team_id).toBe(teamId)
+    })
+  })
+})
+
+describe('team role UPDATE re-sync', () => {
+  async function seedByraWithClientCompany() {
+    const byraOwner = await insertAuthUser()
+    const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra' })
+    const client = await insertAuthUser()
+    const companyId = await insertTeamCompany({ createdBy: client, teamId: byraTeam })
+    return { byraOwner, byraTeam, client, companyId }
+  }
+
+  it('promoting member -> admin re-syncs team-sourced company roles', async () => {
+    const { byraTeam, companyId } = await seedByraWithClientCompany()
+    const consultant = await insertAuthUser()
+    await insertTeamMember({ teamId: byraTeam, userId: consultant, role: 'member' })
+    expect(await companyRole(companyId, consultant)).toEqual({ role: 'member', source: 'team' })
+
+    await getPool().query(
+      `UPDATE public.team_members SET role = 'admin' WHERE team_id = $1 AND user_id = $2`,
+      [byraTeam, consultant],
+    )
+
+    expect(await companyRole(companyId, consultant)).toEqual({ role: 'admin', source: 'team' })
+  })
+
+  it('demoting admin -> member re-syncs down (the security hole this closes)', async () => {
+    const { byraTeam, companyId } = await seedByraWithClientCompany()
+    const consultant = await insertAuthUser()
+    await insertTeamMember({ teamId: byraTeam, userId: consultant, role: 'admin' })
+    expect(await companyRole(companyId, consultant)).toEqual({ role: 'admin', source: 'team' })
+
+    await getPool().query(
+      `UPDATE public.team_members SET role = 'member' WHERE team_id = $1 AND user_id = $2`,
+      [byraTeam, consultant],
+    )
+
+    expect(await companyRole(companyId, consultant)).toEqual({ role: 'member', source: 'team' })
+  })
+
+  it("never touches source='direct' rows", async () => {
+    const { byraTeam, client } = await seedByraWithClientCompany()
+    const consultant = await insertAuthUser()
+    // Direct membership on a second team company, created BEFORE the
+    // consultant joins the team: the INSERT sync's ON CONFLICT DO NOTHING
+    // keeps the direct row.
+    const directCompany = await insertTeamCompany({
+      createdBy: client,
+      teamId: byraTeam,
+      name: 'Direct Client AB',
+    })
+    await getPool().query(
+      `INSERT INTO public.company_members (company_id, user_id, role, source)
+       VALUES ($1, $2, 'member', 'direct')`,
+      [directCompany, consultant],
+    )
+    await insertTeamMember({ teamId: byraTeam, userId: consultant, role: 'member' })
+
+    await getPool().query(
+      `UPDATE public.team_members SET role = 'admin' WHERE team_id = $1 AND user_id = $2`,
+      [byraTeam, consultant],
+    )
+
+    expect(await companyRole(directCompany, consultant)).toEqual({
+      role: 'member',
+      source: 'direct',
+    })
+  })
+
+  it('an authenticated team admin can drive the cascade (owner-only guard passthrough)', async () => {
+    const { byraTeam, companyId } = await seedByraWithClientCompany()
+    // teamAdmin joins after the company exists, so the INSERT sync makes them
+    // company 'admin' (source='team'): NOT company owner, which is exactly the
+    // caller the pre-existing owner-only role guard would have rejected
+    // without the pg_trigger_depth() passthrough.
+    const teamAdmin = await insertAuthUser()
+    await insertTeamMember({ teamId: byraTeam, userId: teamAdmin, role: 'admin' })
+    const consultant = await insertAuthUser()
+    await insertTeamMember({ teamId: byraTeam, userId: consultant, role: 'member' })
+
+    await withUserContext(teamAdmin, async (client) => {
+      const updated = await client.query(
+        `UPDATE public.team_members SET role = 'admin'
+         WHERE team_id = $1 AND user_id = $2`,
+        [byraTeam, consultant],
+      )
+      expect(updated.rowCount).toBe(1)
+
+      const { rows } = await client.query<{ role: string }>(
+        `SELECT role FROM public.company_members
+         WHERE company_id = $1 AND user_id = $2`,
+        [companyId, consultant],
+      )
+      expect(rows[0]!.role).toBe('admin')
+    })
+  })
+})
+
+describe('teams.kind ops-only guard and rename path', () => {
+  it('team owner can rename the team', async () => {
+    const owner = await insertAuthUser()
+    const teamId = await insertTeam({ createdBy: owner, kind: 'byra', name: 'Old Name' })
+
+    await withUserContext(owner, async (client) => {
+      const { rows } = await client.query<{ name: string }>(
+        `UPDATE public.teams SET name = 'New Name' WHERE id = $1 RETURNING name`,
+        [teamId],
+      )
+      expect(rows[0]!.name).toBe('New Name')
+    })
+  })
+
+  it('a plain team member cannot rename (RLS: zero rows updated)', async () => {
+    const owner = await insertAuthUser()
+    const member = await insertAuthUser()
+    const teamId = await insertTeam({ createdBy: owner, kind: 'byra' })
+    await insertTeamMember({ teamId, userId: member, role: 'member' })
+
+    await withUserContext(member, async (client) => {
+      const updated = await client.query(
+        `UPDATE public.teams SET name = 'Hijacked' WHERE id = $1`,
+        [teamId],
+      )
+      expect(updated.rowCount).toBe(0)
+    })
+  })
+
+  it('rejects kind changes from an authenticated session with 42501', async () => {
+    const owner = await insertAuthUser()
+    const teamId = await insertTeam({ createdBy: owner, kind: 'personal' })
+
+    let sqlstate: string | undefined
+    let message: string | undefined
+    try {
+      await withUserContext(owner, async (client) => {
+        await client.query(`UPDATE public.teams SET kind = 'byra' WHERE id = $1`, [teamId])
+      })
+    } catch (err) {
+      sqlstate = (err as { code?: string }).code
+      message = (err as { message?: string }).message
+    }
+    expect(sqlstate).toBe('42501')
+    expect(message).toMatch(/ops-managed/)
+  })
+
+  it('allows kind changes on the ops path (no auth context)', async () => {
+    const owner = await insertAuthUser()
+    const teamId = await insertTeam({ createdBy: owner, kind: 'personal' })
+
+    const { rows } = await getPool().query<{ kind: string }>(
+      `UPDATE public.teams SET kind = 'byra' WHERE id = $1 RETURNING kind`,
+      [teamId],
+    )
+    expect(rows[0]!.kind).toBe('byra')
+  })
+})
diff --git a/tests/pg/trial-suppression-byra.pg.test.ts b/tests/pg/trial-suppression-byra.pg.test.ts
new file mode 100644
index 00000000..a53ec35c
--- /dev/null
+++ b/tests/pg/trial-suppression-byra.pg.test.ts
@@ -0,0 +1,140 @@
+import { randomUUID } from 'node:crypto'
+import { describe, expect, it } from 'vitest'
+import { getPool } from '@/tests/pg/setup'
+import { insertAuthUser } from '@/tests/pg/fixtures'
+import { PAID_CAPABILITIES } from '@/lib/entitlements/keys'
+
+// Tests for 20260826130300_suppress_trial_for_byra_companies.sql (WL-10):
+// the company-creation trial trigger (trg_seed_trial_capability_grants /
+// seed_trial_capability_grants) must skip companies attached to a byrå team
+// (already entitled via the team-scoped partner grant) while personal-team
+// and teamless companies keep the 30-day trial exactly as before.
+//
+// The trigger is AFTER INSERT ON companies and reads NEW.team_id, so plain
+// inserts through the pool exercise it on every creation path.
+
+// Full PAID set (20260818170000); must stay in step with
+// lib/entitlements/keys.ts PAID_CAPABILITIES. Sorted: trialGrantKeys()
+// orders by capability_key.
+const TRIAL_KEYS = [...PAID_CAPABILITIES].sort()
+
+async function insertTeam(params: {
+  createdBy: string
+  kind: 'personal' | 'byra'
+  name?: string
+}): Promise<string> {
+  const id = randomUUID()
+  await getPool().query(
+    `INSERT INTO public.teams (id, name, created_by, kind)
+     VALUES ($1, $2, $3, $4)`,
+    [id, params.name ?? 'Trial Test Team', params.createdBy, params.kind],
+  )
+  await getPool().query(
+    `INSERT INTO public.team_members (team_id, user_id, role)
+     VALUES ($1, $2, 'owner')`,
+    [id, params.createdBy],
+  )
+  return id
+}
+
+async function insertCompanyOnTeam(params: {
+  createdBy: string
+  teamId: string | null
+}): Promise<string> {
+  const id = randomUUID()
+  await getPool().query(
+    `INSERT INTO public.companies (id, name, entity_type, created_by, team_id)
+     VALUES ($1, 'Trial Test AB', 'aktiebolag', $2, $3)`,
+    [id, params.createdBy, params.teamId],
+  )
+  return id
+}
+
+async function trialGrantKeys(companyId: string): Promise<string[]> {
+  const { rows } = await getPool().query<{ capability_key: string }>(
+    `SELECT capability_key FROM public.capability_grants
+     WHERE company_id = $1 AND source = 'trial'
+     ORDER BY capability_key`,
+    [companyId],
+  )
+  return rows.map((r) => r.capability_key)
+}
+
+describe('trial suppression for byrå-team companies', () => {
+  it('the trial seed covers the full seven-key PAID set', () => {
+    // Guard against the seed list drifting from lib/entitlements/keys.ts:
+    // if PAID_CAPABILITIES grows, the migration VALUES list (and this test)
+    // must grow with it.
+    expect(TRIAL_KEYS).toEqual(
+      [
+        'ai',
+        'bank_sync',
+        'email_send',
+        'shopify_sync',
+        'skatteverket',
+        'stripe_payments',
+        'woocommerce_sync',
+      ],
+    )
+  })
+
+  it('a company created under a byrå team gets NO trial grants', async () => {
+    const byraOwner = await insertAuthUser()
+    const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra' })
+
+    const companyId = await insertCompanyOnTeam({ createdBy: byraOwner, teamId: byraTeam })
+
+    expect(await trialGrantKeys(companyId)).toEqual([])
+  })
+
+  it('a company created under a personal team still gets the full trial', async () => {
+    const user = await insertAuthUser()
+    const personalTeam = await insertTeam({ createdBy: user, kind: 'personal' })
+
+    const companyId = await insertCompanyOnTeam({ createdBy: user, teamId: personalTeam })
+
+    expect(await trialGrantKeys(companyId)).toEqual(TRIAL_KEYS)
+  })
+
+  it('a teamless company still gets the full trial', async () => {
+    const user = await insertAuthUser()
+
+    const companyId = await insertCompanyOnTeam({ createdBy: user, teamId: null })
+
+    expect(await trialGrantKeys(companyId)).toEqual(TRIAL_KEYS)
+  })
+
+  it('personal-team trial expiry stays created_at + 30 days', async () => {
+    const user = await insertAuthUser()
+    const personalTeam = await insertTeam({ createdBy: user, kind: 'personal' })
+    const companyId = await insertCompanyOnTeam({ createdBy: user, teamId: personalTeam })
+
+    const { rows } = await getPool().query<{ ok: boolean }>(
+      `SELECT bool_and(g.expires_at = c.created_at + interval '30 days') AS ok
+       FROM public.capability_grants g
+       JOIN public.companies c ON c.id = g.company_id
+       WHERE g.company_id = $1 AND g.source = 'trial'`,
+      [companyId],
+    )
+    expect(rows[0]!.ok).toBe(true)
+  })
+
+  it('byrå suppression does not block non-trial grants on the same company', async () => {
+    const byraOwner = await insertAuthUser()
+    const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra' })
+    const companyId = await insertCompanyOnTeam({ createdBy: byraOwner, teamId: byraTeam })
+
+    // The team-scoped partner grant (WL-10 v1 mechanics) is unaffected.
+    await getPool().query(
+      `INSERT INTO public.capability_grants (team_id, capability_key, source, expires_at)
+       VALUES ($1, 'ai', 'manual', NULL)`,
+      [byraTeam],
+    )
+
+    const { rows } = await getPool().query<{ ok: boolean }>(
+      `SELECT public.company_has_capability($1, 'ai') AS ok`,
+      [companyId],
+    )
+    expect(rows[0]!.ok).toBe(true)
+  })
+})
diff --git a/tests/schema/no-phantom-columns.test.ts b/tests/schema/no-phantom-columns.test.ts
index ac251023..7a0c148d 100644
--- a/tests/schema/no-phantom-columns.test.ts
+++ b/tests/schema/no-phantom-columns.test.ts
@@ -80,6 +80,10 @@ const KNOWN_STALE_ON_CONFLICT: Record<string, string> = {}
  * Baseline 2026-07-26: 346 (145 dynamic-payload, 116 dynamic-select,
  * 48 dynamic-logical, 32 spread-payload, 4 dynamic-column, 1 computed key).
  *
+ * 2026-08-01: 361 after the white-label build (WL-17: brands, teams.kind,
+ * cockpit, brand mail). The growth is spread across ordinary feature queries;
+ * ceiling raised 360 -> 370 to restore headroom.
+ *
  * Raised 2026-08-06 for the sandbox seed's payroll + ledger-history builders.
  * app/api/sandbox/seed/ follows the pure-row-builder pattern the existing
  * customers.ts / pending-operations.ts modules established: the builder returns
@@ -113,8 +117,15 @@ const KNOWN_STALE_ON_CONFLICT: Record<string, string> = {}
  * of an inbound Peppol document through one helper (five literal shapes:
  * routed / unrouted / converted / failed, all partial); the column set is
  * pinned by peppol-inbound.test.ts and the pg-real immutability test.
+ *
+ * 2026-08-26 merge of add/white-label-infra with main: both sides' growth
+ * lands at once (WL queries + everything above). Count on the merged tree:
+ * 383 (162 dynamic-payload, 125 dynamic-select, 50 dynamic-logical,
+ * 39 spread-payload, 5 dynamic-column, 2 computed key); ceiling re-baselined
+ * with the usual headroom. The later catch-up merge of #1954 (byte-exact SIE
+ * upload) brought the merged count to 386.
  */
-const UNRESOLVED_CEILING = 382
+const UNRESOLVED_CEILING = 388
 
 /**
  * Floor on statically resolved column references. Guards the guard: if a change
diff --git a/types/index.ts b/types/index.ts
index 31e0858d..50ac108c 100644
--- a/types/index.ts
+++ b/types/index.ts
@@ -14,10 +14,13 @@ export type CompanyRole = 'owner' | 'admin' | 'member' | 'viewer'
 export type TeamRole = 'owner' | 'admin' | 'member'
 export type MemberSource = 'direct' | 'team'
 
-// Team (consulting firm grouping)
+// Team (consulting firm grouping). 'personal' teams are the implicit
+// one-per-user grouping; 'byra' teams are ops-created accounting-firm
+// tenants (WL-08) with invites, a brand, and cockpit access.
 export interface Team {
   id: string
   name: string
+  kind: 'personal' | 'byra'
   created_by: string
   created_at: string
   updated_at: string