From ca801212ab5bd2431df6179edb1792e0dcf8e851 Mon Sep 17 00:00:00 2001
From: Al <al@systemsaholic.com>
Date: Sun, 5 Jul 2026 10:16:51 -0400
Subject: [PATCH] feat(#1466 P3b): compliance-grade insurance resolution
 evidence
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Advances #837 P2 (documentation) + P3 (declinations). Captures HOW and by WHOM
a traveler's insurance resolution was recorded, closing the "rubber-stamp"
gap where declined/has_own/selected could be set with no consent or offered-
coverage record. Additive/forward-only; ships live on merge.

Migration (20260705120000): new enum insurance_resolution_source
('advisor_manual','client_esign') + 4 additive columns on trip_traveler_insurance
(resolution_source NOT NULL DEFAULT 'advisor_manual', consent_method,
form_token_id FK→form_tokens ON DELETE SET NULL, offered_coverages_snapshot jsonb).
The ~93 existing prod rows keep the default with null evidence — a documented
pre-P3b audit gap, NOT retro-enforced (flag to Al).

Backend:
- insurance.service: validateStatusRequirements now REQUIRES a valid consent_method
  when an advisor records a resolved status (400 otherwise); pending is exempt.
  create/updateTravelerInsurance FORCE resolution_source='advisor_manual'
  server-side (mirrors the activity_id-strip; spoofed values stripped) and freeze
  offered_coverages_snapshot from active packages. A client_esign record is
  preserved (no consent demanded, evidence not clobbered) when the advisor edits
  without changing the resolved status; an override flips it to advisor_manual with
  fresh consent and unlinks the token. formatTravelerInsurance surfaces all 4 fields.
- forms.service handleInsuranceWaiverSubmission: stamps resolution_source='client_esign',
  form_token_id, offered_coverages_snapshot on every write (insert+update, both
  actions) inside the existing atomic-claim tx. No new send.
- Shared insurance-offer-snapshot.mapper (extracted verbatim from
  queueProposalEmails' contextData snapshot, §7 colocated spec) so the advisor and
  waiver paths record an identical offer shape.
- insurance.queries declines report surfaces resolution_source + consent_method.

Frontend (trip-insurance.tsx):
- TravelerInsuranceDialog + AssignPackageDialog: required "Confirmed via" selector
  shown for a resolved status on a non-e-sign record; Save gated until chosen.
- Status table + dialog: "View signed waiver" link when form_token_id is present
  (reuses GET /trips/:id/forms/:formId/pdf — no new endpoint).

Shared-types: InsuranceResolutionSource, AdvisorConsentMethod (+ADVISOR_CONSENT_METHODS,
excludes client-self-service), InsuranceOfferSnapshotItem; 4 read-DTO fields +
consentMethod on Create/Update.

STRICT error mode (compliance never best-effort). Money boundary untouched
(commissionTotalCents/activityId/mirror/link paths unchanged). No TripsService touch.

Tests (all foreground): mapper spec; service evidence spec (consent required per
resolved status + exempt for pending; resolution_source always advisor_manual even
if spoofed; snapshot frozen; client_esign preserve vs override); forms spec extended
(client_esign+form_token_id+snapshot on both branches inside the tx).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../trips/[id]/_components/trip-insurance.tsx | 176 ++++++++++-
 .../src/forms/__tests__/forms.service.spec.ts |  50 ++++
 apps/api/src/forms/forms.service.ts           |  17 ++
 .../reporting/queries/insurance.queries.ts    |   5 +
 .../src/trips/insurance-automation.service.ts |  25 +-
 .../insurance-offer-snapshot.mapper.spec.ts   |  85 ++++++
 .../trips/insurance-offer-snapshot.mapper.ts  |  38 +++
 .../trips/insurance.service.evidence.spec.ts  | 282 ++++++++++++++++++
 apps/api/src/trips/insurance.service.ts       | 133 ++++++++-
 packages/database/src/index.ts                |   9 +
 ...000_1466_insurance_resolution_evidence.sql |  24 ++
 .../src/migrations/meta/_journal.json         |   7 +
 .../database/src/schema/insurance.schema.ts   |  25 ++
 .../shared-types/src/api/insurance.types.ts   |  53 ++++
 14 files changed, 905 insertions(+), 24 deletions(-)
 create mode 100644 apps/api/src/trips/insurance-offer-snapshot.mapper.spec.ts
 create mode 100644 apps/api/src/trips/insurance-offer-snapshot.mapper.ts
 create mode 100644 apps/api/src/trips/insurance.service.evidence.spec.ts
 create mode 100644 packages/database/src/migrations/20260705120000_1466_insurance_resolution_evidence.sql

diff --git a/apps/admin/src/app/trips/[id]/_components/trip-insurance.tsx b/apps/admin/src/app/trips/[id]/_components/trip-insurance.tsx
index bcb65b61d..6d4e7feb0 100644
--- a/apps/admin/src/app/trips/[id]/_components/trip-insurance.tsx
+++ b/apps/admin/src/app/trips/[id]/_components/trip-insurance.tsx
@@ -63,10 +63,30 @@ import type {
   TravelerInsuranceStatus,
   InsurancePolicyType,
   InsuranceProductDto,
+  AdvisorConsentMethod,
+  InsuranceResolutionSource,
 } from '@tailfire/shared-types/api'
+import { ADVISOR_CONSENT_METHODS } from '@tailfire/shared-types/api'
 import { formatCurrency, dollarsToCents, centsToDollars } from '@/lib/pricing/currency-helpers'
 import { InsuranceProposalDialog } from '@/components/insurance/insurance-proposal-dialog'
 import { ConfirmDialog } from '@/components/ui/confirm-dialog'
+import { fetchTripFormPdfUrl } from '@/hooks/use-trip-forms'
+
+// refs #1466 P3b — statuses that constitute a compliance "resolution".
+const RESOLVED_TRAVELER_STATUSES: TravelerInsuranceStatus[] = [
+  'declined',
+  'has_own_insurance',
+  'selected_package',
+]
+const isResolvedTravelerStatus = (s: TravelerInsuranceStatus) =>
+  RESOLVED_TRAVELER_STATUSES.includes(s)
+
+// refs #1466 P3b — human labels for how advisor consent was captured.
+const CONSENT_METHOD_LABELS: Record<AdvisorConsentMethod, string> = {
+  verbal_phone: 'Verbal (phone)',
+  email_confirmation: 'Email confirmation',
+  in_person_signature: 'In-person signature',
+}
 
 interface TripInsuranceProps {
   trip: TripResponseDto
@@ -193,6 +213,8 @@ export function TripInsurance({ trip }: TripInsuranceProps) {
     declinedReason: '',
     premiumPaidCents: null as number | null,
     notes: '',
+    // refs #1466 P3b — how the advisor captured consent for a resolved status.
+    consentMethod: null as AdvisorConsentMethod | null,
   })
 
   const handleOpenPackageDialog = (pkg?: TripInsurancePackageDto) => {
@@ -323,6 +345,8 @@ export function TripInsurance({ trip }: TripInsuranceProps) {
         declinedReason: existing.declinedReason || '',
         premiumPaidCents: existing.premiumPaidCents ?? null,
         notes: existing.notes || '',
+        // Pre-fill the prior consent method so re-saving doesn't force a re-pick.
+        consentMethod: (existing.consentMethod as AdvisorConsentMethod | null) ?? null,
       })
     } else {
       setTravelerForm({
@@ -333,6 +357,7 @@ export function TripInsurance({ trip }: TripInsuranceProps) {
         declinedReason: '',
         premiumPaidCents: null,
         notes: '',
+        consentMethod: null,
       })
     }
     setShowTravelerDialog(true)
@@ -533,6 +558,13 @@ export function TripInsurance({ trip }: TripInsuranceProps) {
                         <span className="text-red-600">{insurance.declinedReason}</span>
                       )}
                       {status === 'pending' && <span className="italic">Awaiting response</span>}
+                      {/* refs #1466 P3b — link the signed waiver when the resolution
+                          came from a client e-sign (form_token_id present). */}
+                      {insurance?.formTokenId && (
+                        <div className="mt-1.5">
+                          <ViewSignedWaiverLink tripId={trip.id} formTokenId={insurance.formTokenId} />
+                        </div>
+                      )}
                     </TableCell>
                     <TableCell>
                       <Button variant="outline" size="sm" onClick={() => handleOpenTravelerDialog(traveler.id)}>
@@ -862,6 +894,9 @@ function AssignPackageDialog({
   const { toast } = useToast()
   const [selectedIds, setSelectedIds] = useState<Set<string>>(new Set())
   const [saving, setSaving] = useState(false)
+  // refs #1466 P3b — assigning a package resolves the traveler to 'selected_package',
+  // which the server requires a consent method for. One selector covers the batch.
+  const [consentMethod, setConsentMethod] = useState<AdvisorConsentMethod | null>(null)
 
   useEffect(() => {
     if (open && pkg) {
@@ -872,6 +907,7 @@ function AssignPackageDialog({
           .map((t) => t.tripTravelerId),
       )
       setSelectedIds(pre)
+      setConsentMethod(null)
     }
   }, [open, pkg, travelerInsuranceList])
 
@@ -893,16 +929,19 @@ function AssignPackageDialog({
         const checked = selectedIds.has(traveler.id)
         if (checked) {
           // Assign this package to the traveler (create or update — same endpoint).
+          // consentMethod threaded so the resolved status carries P3b evidence.
           if (existing) {
             await api.patch(`/trips/${tripId}/insurance/travelers/${existing.id}`, {
               status: 'selected_package',
               selectedPackageId: pkg.id,
+              consentMethod,
             })
           } else {
             await api.post(`/trips/${tripId}/insurance/travelers`, {
               tripTravelerId: traveler.id,
               status: 'selected_package',
               selectedPackageId: pkg.id,
+              consentMethod,
             })
           }
         } else if (existing && existing.status === 'selected_package' && existing.selectedPackageId === pkg.id) {
@@ -962,11 +1001,38 @@ function AssignPackageDialog({
           )}
         </div>
 
+        {/* refs #1466 P3b — required consent capture for the batch assignment. */}
+        {selectedIds.size > 0 && (
+          <div className="grid gap-2 border-t border-ash-100 pt-3">
+            <Label htmlFor="assignConsentMethod">
+              Confirmed via <span className="text-red-500">*</span>
+            </Label>
+            <Select
+              value={consentMethod ?? ''}
+              onValueChange={(value) => setConsentMethod(value as AdvisorConsentMethod)}
+            >
+              <SelectTrigger id="assignConsentMethod">
+                <SelectValue placeholder="How was this confirmed?" />
+              </SelectTrigger>
+              <SelectContent>
+                {ADVISOR_CONSENT_METHODS.map((m) => (
+                  <SelectItem key={m} value={m}>
+                    {CONSENT_METHOD_LABELS[m]}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+        )}
+
         <DialogFooter>
           <Button variant="outline" onClick={() => onOpenChange(false)} disabled={saving}>
             Cancel
           </Button>
-          <Button onClick={handleSave} disabled={saving || travelers.length === 0}>
+          <Button
+            onClick={handleSave}
+            disabled={saving || travelers.length === 0 || (selectedIds.size > 0 && !consentMethod)}
+          >
             {saving ? (
               <>
                 <Loader2 className="mr-2 h-4 w-4 animate-spin" />
@@ -982,6 +1048,48 @@ function AssignPackageDialog({
   )
 }
 
+// refs #1466 P3b — open a traveler's signed insurance waiver in a new tab. Reuses
+// the existing GET /trips/:id/forms/:formId/pdf endpoint (short-lived signed URL);
+// no new endpoint. Mirrors the trip-forms download click-then-navigate pattern so
+// the post-fetch navigation isn't treated as a blocked popup.
+function ViewSignedWaiverLink({ tripId, formTokenId }: { tripId: string; formTokenId: string }) {
+  const { toast } = useToast()
+  const [loading, setLoading] = useState(false)
+
+  const open = async () => {
+    setLoading(true)
+    const win = window.open('about:blank', '_blank')
+    try {
+      const { url } = await fetchTripFormPdfUrl(tripId, formTokenId)
+      if (win) win.location.href = url
+      else window.open(url, '_blank', 'noopener,noreferrer')
+    } catch {
+      win?.close()
+      toast({
+        title: 'Document unavailable',
+        description: 'The signed waiver for this traveler could not be retrieved.',
+        variant: 'destructive',
+      })
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  return (
+    <Button
+      type="button"
+      variant="outline"
+      size="sm"
+      className="w-fit gap-1.5"
+      onClick={open}
+      disabled={loading}
+    >
+      {loading ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <Shield className="h-3.5 w-3.5" />}
+      View signed waiver
+    </Button>
+  )
+}
+
 // Separate component for traveler insurance dialog to use hooks properly
 interface TravelerInsuranceDialogProps {
   open: boolean
@@ -999,6 +1107,10 @@ interface TravelerInsuranceDialogProps {
     declinedReason: string | null
     premiumPaidCents: number | null
     notes: string | null
+    // refs #1466 P3b — evidence context for the consent selector + waiver link.
+    resolutionSource?: InsuranceResolutionSource
+    consentMethod?: string | null
+    formTokenId?: string | null
   }
   form: {
     status: TravelerInsuranceStatus
@@ -1008,6 +1120,7 @@ interface TravelerInsuranceDialogProps {
     declinedReason: string
     premiumPaidCents: number | null
     notes: string
+    consentMethod: AdvisorConsentMethod | null
   }
   setForm: (form: any) => void
   travelerName: string
@@ -1051,6 +1164,28 @@ function TravelerInsuranceDialog({
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [open, packagesLoaded, packages, form.selectedPackageId])
 
+  // refs #1466 P3b — a resolved status recorded via the ADVISOR path must carry a
+  // consent method. A record already resolved by the client (client_esign) keeps
+  // its signed-waiver evidence for evidence-NEUTRAL edits (notes/premium). But if
+  // the advisor MATERIALLY changes the resolution (status or a status-defining
+  // field), it becomes an advisor override that must re-capture consent — mirror
+  // the server rule so the override isn't silently 400'd.
+  const isClientEsign = existingInsurance?.resolutionSource === 'client_esign'
+  const statusIsResolved = isResolvedTravelerStatus(form.status)
+  const esignMaterialChange =
+    !!existingInsurance &&
+    isClientEsign &&
+    (form.status !== existingInsurance.status ||
+      (form.status === 'selected_package' &&
+        (form.selectedPackageId ?? null) !== (existingInsurance.selectedPackageId ?? null)) ||
+      (form.status === 'has_own_insurance' &&
+        ((form.externalPolicyNumber || null) !== (existingInsurance.externalPolicyNumber ?? null) ||
+          (form.externalProviderName || null) !== (existingInsurance.externalProviderName ?? null))) ||
+      (form.status === 'declined' &&
+        (form.declinedReason || null) !== (existingInsurance.declinedReason ?? null)))
+  const showConsent = statusIsResolved && (!isClientEsign || esignMaterialChange)
+  const needsConsent = showConsent && !form.consentMethod
+
   const handleSave = async () => {
     if (!travelerId) return
 
@@ -1064,6 +1199,9 @@ function TravelerInsuranceDialog({
       // Premium payment only applies to an agency-sold package; clear it otherwise.
       premiumPaidCents: form.status === 'selected_package' ? form.premiumPaidCents : null,
       notes: form.notes || null,
+      // Only send consent when the advisor actually captured it (resolved status,
+      // non-e-sign record). The server ignores it for pending/e-sign records.
+      ...(showConsent ? { consentMethod: form.consentMethod } : {}),
     }
 
     if (existingInsurance) {
@@ -1219,6 +1357,40 @@ function TravelerInsuranceDialog({
             </div>
           )}
 
+          {/* refs #1466 P3b — required consent capture for an advisor-recorded
+              resolution. Hidden for a client e-sign record (evidence on file). */}
+          {showConsent && (
+            <div className="grid gap-2">
+              <Label htmlFor="consentMethod">
+                Confirmed via <span className="text-red-500">*</span>
+              </Label>
+              <Select
+                value={form.consentMethod ?? ''}
+                onValueChange={(value) =>
+                  setForm({ ...form, consentMethod: value as AdvisorConsentMethod })
+                }
+              >
+                <SelectTrigger id="consentMethod">
+                  <SelectValue placeholder="How was this confirmed?" />
+                </SelectTrigger>
+                <SelectContent>
+                  {ADVISOR_CONSENT_METHODS.map((m) => (
+                    <SelectItem key={m} value={m}>
+                      {CONSENT_METHOD_LABELS[m]}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+              <p className="text-xs text-ash-500">
+                Records how the traveler&apos;s insurance decision was confirmed (compliance).
+              </p>
+            </div>
+          )}
+
+          {isClientEsign && existingInsurance?.formTokenId && (
+            <ViewSignedWaiverLink tripId={tripId} formTokenId={existingInsurance.formTokenId} />
+          )}
+
           <div className="grid gap-2">
             <Label htmlFor="notes">Notes</Label>
             <Textarea
@@ -1235,7 +1407,7 @@ function TravelerInsuranceDialog({
           <Button variant="outline" onClick={() => onOpenChange(false)}>
             Cancel
           </Button>
-          <Button onClick={handleSave} disabled={isPending || needsPackage}>
+          <Button onClick={handleSave} disabled={isPending || needsPackage || needsConsent}>
             {isPending ? 'Saving...' : 'Save'}
           </Button>
         </DialogFooter>
diff --git a/apps/api/src/forms/__tests__/forms.service.spec.ts b/apps/api/src/forms/__tests__/forms.service.spec.ts
index 11a0f50f0..0bba96bd7 100644
--- a/apps/api/src/forms/__tests__/forms.service.spec.ts
+++ b/apps/api/src/forms/__tests__/forms.service.spec.ts
@@ -377,4 +377,54 @@ describe('FormsService — submission requires a signature on both paths', () =>
     expect(mockStorage.uploadDocument).not.toHaveBeenCalled()
     expect(dbChain.transaction).not.toHaveBeenCalled()
   })
+
+  // refs #1466 P3b — the client waiver path stamps compliance evidence
+  // (resolution_source='client_esign', form_token_id, offered snapshot) on EVERY
+  // write inside the atomic-claim tx: both actions (purchase/decline) × both
+  // branches (insert new / update existing).
+  const offered = [{ id: 'pkg-1', packageName: 'Gold', premiumCents: 12000 }]
+
+  it('stamps client_esign evidence on the INSERT branch (new record, purchase)', async () => {
+    insertedValues.length = 0 // this describe doesn't reset it between tests
+    dbChain.limit.mockResolvedValue([]) // no existing insurance → insert branch
+    const form = {
+      ...baseForm,
+      contextData: { ...baseForm.contextData, packages: offered },
+    }
+    await service.handleInsuranceWaiverSubmission(
+      form,
+      { decisions: [{ travelerId: 't1', action: 'purchase', packageId: 'pkg-1' }] },
+      { ...validSig, decision: 'purchase' },
+    )
+    const evidenceInsert = insertedValues.find((v) => v.resolutionSource === 'client_esign')
+    expect(evidenceInsert).toBeDefined()
+    expect(evidenceInsert!.status).toBe('selected_package')
+    expect(evidenceInsert!.formTokenId).toBe('form-1')
+    expect(evidenceInsert!.offeredCoveragesSnapshot).toEqual(offered)
+  })
+
+  it('stamps client_esign evidence on the UPDATE branch (existing record, decline)', async () => {
+    dbChain.limit.mockResolvedValue([{ id: 'existing-ins-1' }]) // existing → update branch
+    const form = {
+      ...baseForm,
+      contextData: { ...baseForm.contextData, packages: offered },
+    }
+    await service.handleInsuranceWaiverSubmission(
+      form,
+      { decisions: [{ travelerId: 't1', action: 'decline', reason: 'has coverage' }] },
+      validSig,
+    )
+    const evidenceSet = (dbChain.set.mock.calls as any[])
+      .map((c) => c[0])
+      .find((v) => v?.resolutionSource === 'client_esign')
+    expect(evidenceSet).toBeDefined()
+    expect(evidenceSet.status).toBe('declined')
+    expect(evidenceSet.formTokenId).toBe('form-1')
+    expect(evidenceSet.offeredCoveragesSnapshot).toEqual(offered)
+    // Codex P3b block #2: a prior advisor consent_method must be cleared when the
+    // row is (re)resolved by the client's signed waiver.
+    expect(evidenceSet.consentMethod).toBeNull()
+    // reset so later suites see the default no-existing behavior
+    dbChain.limit.mockResolvedValue([])
+  })
 })
diff --git a/apps/api/src/forms/forms.service.ts b/apps/api/src/forms/forms.service.ts
index 72225b642..8c02ecfa0 100644
--- a/apps/api/src/forms/forms.service.ts
+++ b/apps/api/src/forms/forms.service.ts
@@ -568,6 +568,19 @@ export class FormsService {
             )
             .limit(1)
 
+          // refs #1466 P3b — this is a CLIENT E-SIGN resolution: stamp the
+          // compliance evidence on every write (insert AND update, both actions).
+          // form.id links the signed waiver PDF; offeredPackages freezes what the
+          // traveler was shown. Inside the existing atomic-claim tx, no new send.
+          const esignEvidence = {
+            resolutionSource: 'client_esign' as const,
+            formTokenId: form.id,
+            offeredCoveragesSnapshot: offeredPackages,
+            // Clear any stale advisor consent — this row is now resolved by the
+            // client's signed waiver, not an out-of-band advisor confirmation.
+            consentMethod: null,
+          }
+
           if (decision.action === 'purchase') {
             if (existing) {
               await tx
@@ -576,6 +589,7 @@ export class FormsService {
                   status: 'selected_package',
                   selectedPackageId: decision.packageId,
                   updatedAt: now,
+                  ...esignEvidence,
                 })
                 .where(eq(tripTravelerInsurance.id, existing.id))
             } else {
@@ -584,6 +598,7 @@ export class FormsService {
                 tripTravelerId: decision.travelerId,
                 status: 'selected_package',
                 selectedPackageId: decision.packageId,
+                ...esignEvidence,
               })
             }
           } else {
@@ -596,6 +611,7 @@ export class FormsService {
                   acknowledgedAt: now,
                   declinedReason: decision.reason ?? null,
                   updatedAt: now,
+                  ...esignEvidence,
                 })
                 .where(eq(tripTravelerInsurance.id, existing.id))
             } else {
@@ -606,6 +622,7 @@ export class FormsService {
                 declinedAt: now,
                 acknowledgedAt: now,
                 declinedReason: decision.reason ?? null,
+                ...esignEvidence,
               })
             }
           }
diff --git a/apps/api/src/reporting/queries/insurance.queries.ts b/apps/api/src/reporting/queries/insurance.queries.ts
index ca4954b70..9043e69b6 100644
--- a/apps/api/src/reporting/queries/insurance.queries.ts
+++ b/apps/api/src/reporting/queries/insurance.queries.ts
@@ -214,6 +214,9 @@ export async function queryInsuranceDeclines(
       tti.declined_reason,
       tti.declined_at,
       tti.acknowledged_at,
+      -- refs #1466 P3b — surface resolution evidence on the declines report
+      tti.resolution_source,
+      tti.consent_method,
       CASE WHEN tti.acknowledged_at IS NULL THEN true ELSE false END AS not_acknowledged
     FROM trip_traveler_insurance tti
     JOIN trips t ON t.id = tti.trip_id
@@ -241,6 +244,8 @@ export async function queryInsuranceDeclines(
     declinedAt: row.declined_at ? String(row.declined_at) : null,
     acknowledgedAt: row.acknowledged_at ? String(row.acknowledged_at) : null,
     isAcknowledged: row.acknowledged_at != null,
+    resolutionSource: row.resolution_source ?? null,
+    consentMethod: row.consent_method ?? null,
   }))
 
   // Summary
diff --git a/apps/api/src/trips/insurance-automation.service.ts b/apps/api/src/trips/insurance-automation.service.ts
index 7cca369b9..b984a5404 100644
--- a/apps/api/src/trips/insurance-automation.service.ts
+++ b/apps/api/src/trips/insurance-automation.service.ts
@@ -12,6 +12,7 @@ import { DatabaseService } from '../db/database.service'
 import { FormsService } from '../forms/forms.service'
 import { AutomationService } from '../automation/automation.service'
 import { QUEUES } from '../automation/automation.types'
+import { mapPackagesToOfferSnapshot } from './insurance-offer-snapshot.mapper'
 
 export interface TravelerPreview {
   // Alias of tripTravelerId — the admin UI keys selections on `id`.
@@ -316,25 +317,11 @@ export class InsuranceAutomationService {
           tripStartDate: trip.startDate ?? null,
           tripEndDate: trip.endDate ?? null,
           dependentNames: dependents.map((d) => `${d.firstName || ''} ${d.lastName || ''}`.trim()),
-          // Snapshot of active packages at time of token creation — used by the public form page
-          packages: activePackages.map((p) => ({
-            id: p.id,
-            tripId: p.tripId,
-            providerName: p.providerName,
-            packageName: p.packageName,
-            policyType: p.policyType,
-            coverageAmountCents: p.coverageAmountCents,
-            premiumCents: p.premiumCents,
-            deductibleCents: p.deductibleCents,
-            currency: p.currency,
-            coverageStartDate: p.coverageStartDate,
-            coverageEndDate: p.coverageEndDate,
-            termsUrl: p.termsUrl,
-            isFromCatalog: p.isFromCatalog,
-            displayOrder: p.displayOrder,
-            activityId: p.activityId,
-            isActive: p.isActive,
-          })),
+          // Snapshot of active packages at time of token creation — used by the
+          // public form page AND (via P3b) persisted as the traveler's
+          // offered_coverages_snapshot on a client_esign resolution. Shared mapper
+          // keeps the advisor path and the waiver path byte-identical.
+          packages: mapPackagesToOfferSnapshot(activePackages),
         },
         expiresInDays: 30,
       })
diff --git a/apps/api/src/trips/insurance-offer-snapshot.mapper.spec.ts b/apps/api/src/trips/insurance-offer-snapshot.mapper.spec.ts
new file mode 100644
index 000000000..56de80a93
--- /dev/null
+++ b/apps/api/src/trips/insurance-offer-snapshot.mapper.spec.ts
@@ -0,0 +1,85 @@
+/**
+ * refs #1466 P3b — insurance-offer-snapshot mapper (§7 colocated spec).
+ * Freezes the packages a traveler was shown; shared by the advisor path and the
+ * client waiver token so both persist the identical offer shape.
+ */
+import type { TripInsurancePackage } from '@tailfire/database'
+import { mapPackagesToOfferSnapshot } from './insurance-offer-snapshot.mapper'
+
+function pkg(overrides: Partial<TripInsurancePackage> = {}): TripInsurancePackage {
+  return {
+    id: 'pkg-1',
+    tripId: 'trip-1',
+    providerName: 'Manulife',
+    packageName: 'Premium Protection',
+    policyType: 'comprehensive',
+    coverageAmountCents: 500000,
+    premiumCents: 12000,
+    deductibleCents: null,
+    currency: 'CAD',
+    coverageStartDate: '2026-08-01',
+    coverageEndDate: '2026-08-15',
+    coverageDetails: null,
+    termsUrl: 'https://insurer/terms.pdf',
+    termsAndConditions: null,
+    cancellationPolicy: null,
+    activityId: null,
+    commissionTotalCents: null,
+    commissionTaxCents: null,
+    commissionTaxType: null,
+    supplierId: null,
+    insuranceProductId: null,
+    isFromCatalog: true,
+    displayOrder: 2,
+    isActive: true,
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    ...overrides,
+  } as TripInsurancePackage
+}
+
+describe('mapPackagesToOfferSnapshot', () => {
+  it('maps the offer-relevant fields verbatim', () => {
+    const [item] = mapPackagesToOfferSnapshot([pkg()])
+    expect(item).toEqual({
+      id: 'pkg-1',
+      tripId: 'trip-1',
+      providerName: 'Manulife',
+      packageName: 'Premium Protection',
+      policyType: 'comprehensive',
+      coverageAmountCents: 500000,
+      premiumCents: 12000,
+      deductibleCents: null,
+      currency: 'CAD',
+      coverageStartDate: '2026-08-01',
+      coverageEndDate: '2026-08-15',
+      termsUrl: 'https://insurer/terms.pdf',
+      isFromCatalog: true,
+      displayOrder: 2,
+      activityId: null,
+      isActive: true,
+    })
+  })
+
+  it('coalesces nullable DB defaults (isFromCatalog/displayOrder/isActive)', () => {
+    const [item] = mapPackagesToOfferSnapshot([
+      pkg({ isFromCatalog: null, displayOrder: null, isActive: null }),
+    ])
+    expect(item!.isFromCatalog).toBe(false)
+    expect(item!.displayOrder).toBe(0)
+    expect(item!.isActive).toBe(true)
+  })
+
+  it('preserves order and maps every package', () => {
+    const out = mapPackagesToOfferSnapshot([
+      pkg({ id: 'a' }),
+      pkg({ id: 'b' }),
+      pkg({ id: 'c' }),
+    ])
+    expect(out.map((p) => p.id)).toEqual(['a', 'b', 'c'])
+  })
+
+  it('returns [] for no packages', () => {
+    expect(mapPackagesToOfferSnapshot([])).toEqual([])
+  })
+})
diff --git a/apps/api/src/trips/insurance-offer-snapshot.mapper.ts b/apps/api/src/trips/insurance-offer-snapshot.mapper.ts
new file mode 100644
index 000000000..a0d500181
--- /dev/null
+++ b/apps/api/src/trips/insurance-offer-snapshot.mapper.ts
@@ -0,0 +1,38 @@
+import type { TripInsurancePackage } from '@tailfire/database'
+import type { InsuranceOfferSnapshotItem } from '@tailfire/shared-types'
+
+/**
+ * refs #1466 P3b — freeze the packages a traveler was shown at the moment a
+ * resolution is recorded.
+ *
+ * Extracted VERBATIM from the form-token `contextData.packages` snapshot that
+ * InsuranceAutomationService.queueProposalEmails builds, so BOTH the client
+ * waiver token and the advisor resolution path persist the IDENTICAL offer
+ * shape into trip_traveler_insurance.offered_coverages_snapshot.
+ *
+ * Nullable DB defaults (isFromCatalog/displayOrder/isActive) are coalesced to
+ * their column defaults — same convention as formatPackage's read DTO — so the
+ * snapshot item is a clean, non-null record.
+ */
+export function mapPackagesToOfferSnapshot(
+  packages: TripInsurancePackage[],
+): InsuranceOfferSnapshotItem[] {
+  return packages.map((p) => ({
+    id: p.id,
+    tripId: p.tripId,
+    providerName: p.providerName,
+    packageName: p.packageName,
+    policyType: p.policyType,
+    coverageAmountCents: p.coverageAmountCents,
+    premiumCents: p.premiumCents,
+    deductibleCents: p.deductibleCents,
+    currency: p.currency,
+    coverageStartDate: p.coverageStartDate,
+    coverageEndDate: p.coverageEndDate,
+    termsUrl: p.termsUrl,
+    isFromCatalog: p.isFromCatalog ?? false,
+    displayOrder: p.displayOrder ?? 0,
+    activityId: p.activityId,
+    isActive: p.isActive ?? true,
+  }))
+}
diff --git a/apps/api/src/trips/insurance.service.evidence.spec.ts b/apps/api/src/trips/insurance.service.evidence.spec.ts
new file mode 100644
index 000000000..9a6cbedca
--- /dev/null
+++ b/apps/api/src/trips/insurance.service.evidence.spec.ts
@@ -0,0 +1,282 @@
+/**
+ * refs #1466 P3b — compliance-grade resolution evidence on the ADVISOR path.
+ *
+ * - consent_method REQUIRED when recording a resolved status; NOT for pending.
+ * - resolution_source is SERVICE-MANAGED — always 'advisor_manual', even if the
+ *   DTO tries to spoof it.
+ * - offered_coverages_snapshot is frozen from active packages on a resolution.
+ * - a client_esign record is preserved (no consent demand, evidence not clobbered)
+ *   when the advisor edits it without changing the resolved status.
+ */
+import { BadRequestException } from '@nestjs/common'
+import { InsuranceService } from './insurance.service'
+
+const TRIP_ID = 'trip-1'
+const TRAVELER_ID = 'traveler-1'
+
+// Sentinel schema tables (identity-compared by the mocked .from()). Columns are
+// plain strings — real drizzle eq()/and() just store the operands.
+const schema = {
+  trips: { id: 't.id', agencyId: 't.agency' },
+  tripTravelers: { id: 'tt.id', tripId: 'tt.trip' },
+  tripInsurancePackages: {
+    id: 'p.id',
+    tripId: 'p.trip',
+    premiumCents: 'p.premium',
+    isActive: 'p.active',
+    displayOrder: 'p.order',
+  },
+  tripTravelerInsurance: { id: 'i.id', tripId: 'i.trip', tripTravelerId: 'i.traveler' },
+}
+
+const activePackages = [
+  {
+    id: 'pkg-1',
+    tripId: TRIP_ID,
+    providerName: 'Manulife',
+    packageName: 'Premium',
+    policyType: 'comprehensive',
+    coverageAmountCents: 500000,
+    premiumCents: 12000,
+    deductibleCents: null,
+    currency: 'CAD',
+    coverageStartDate: null,
+    coverageEndDate: null,
+    termsUrl: null,
+    isFromCatalog: true,
+    displayOrder: 0,
+    activityId: null,
+    isActive: true,
+  },
+]
+
+/**
+ * Build an InsuranceService with a chainable db mock. `existing` is the row
+ * returned for a tripTravelerInsurance lookup (update path). Captures the last
+ * insert values / update set for assertions.
+ */
+function makeService(existing?: Record<string, unknown>) {
+  const captured: { insert?: any; set?: any } = {}
+  let table: unknown = null
+  let op: 'select' | 'insert' | 'update' = 'select'
+
+  const selectResult = (t: unknown, terminal: 'limit' | 'orderBy'): unknown[] => {
+    if (t === schema.trips) return [{ id: TRIP_ID, agencyId: 'agency-1' }]
+    if (t === schema.tripTravelers) return [{ id: TRAVELER_ID }]
+    if (t === schema.tripInsurancePackages) {
+      // limit → verifyPackageBelongsToTrip; orderBy → buildOfferSnapshot
+      return terminal === 'orderBy'
+        ? activePackages
+        : [{ id: 'pkg-1', tripId: TRIP_ID, premiumCents: 12000 }]
+    }
+    if (t === schema.tripTravelerInsurance) return existing ? [echoRow({})] : []
+    return []
+  }
+
+  const echoRow = (values: Record<string, unknown>) => ({
+    id: existing?.id ?? 'new-id',
+    tripId: TRIP_ID,
+    tripTravelerId: TRAVELER_ID,
+    status: 'pending',
+    selectedPackageId: null,
+    externalPolicyNumber: null,
+    externalProviderName: null,
+    externalCoverageDetails: null,
+    declinedReason: null,
+    declinedAt: null,
+    acknowledgedAt: null,
+    premiumPaidCents: null,
+    policyNumber: null,
+    notes: null,
+    resolutionSource: 'advisor_manual',
+    consentMethod: null,
+    formTokenId: null,
+    offeredCoveragesSnapshot: null,
+    ...existing,
+    ...values,
+    createdAt: new Date(),
+    updatedAt: new Date(),
+  })
+
+  const chain: any = {
+    select: () => ((op = 'select'), chain),
+    insert: (t: unknown) => ((op = 'insert'), (table = t), chain),
+    update: (t: unknown) => ((op = 'update'), (table = t), chain),
+    from: (t: unknown) => ((table = t), chain),
+    values: (v: any) => ((captured.insert = v), chain),
+    set: (v: any) => ((captured.set = v), chain),
+    where: () => chain,
+    limit: async () => selectResult(table, 'limit'),
+    orderBy: async () => selectResult(table, 'orderBy'),
+    returning: async () =>
+      op === 'insert' ? [echoRow(captured.insert)] : [echoRow(captured.set)],
+  }
+
+  const db: any = { client: chain, schema }
+  const service = new InsuranceService(db, {} as any, {} as any, {} as any)
+  return { service, captured }
+}
+
+describe('InsuranceService — P3b resolution evidence (create)', () => {
+  it('rejects a resolved status with no consentMethod', async () => {
+    const { service } = makeService()
+    await expect(
+      service.createTravelerInsurance(TRIP_ID, {
+        tripTravelerId: TRAVELER_ID,
+        status: 'declined',
+      } as any),
+    ).rejects.toBeInstanceOf(BadRequestException)
+  })
+
+  it('rejects an invalid consentMethod value', async () => {
+    const { service } = makeService()
+    await expect(
+      service.createTravelerInsurance(TRIP_ID, {
+        tripTravelerId: TRAVELER_ID,
+        status: 'declined',
+        consentMethod: 'carrier_pigeon',
+      } as any),
+    ).rejects.toBeInstanceOf(BadRequestException)
+  })
+
+  it('accepts pending WITHOUT a consentMethod (not a resolution)', async () => {
+    const { service, captured } = makeService()
+    await service.createTravelerInsurance(TRIP_ID, {
+      tripTravelerId: TRAVELER_ID,
+      status: 'pending',
+    } as any)
+    expect(captured.insert.resolutionSource).toBe('advisor_manual')
+    expect(captured.insert.consentMethod).toBeNull()
+    expect(captured.insert.offeredCoveragesSnapshot).toBeNull()
+  })
+
+  it('records a resolved decline with consent + frozen offer snapshot; forces advisor_manual even if spoofed', async () => {
+    const { service, captured } = makeService()
+    await service.createTravelerInsurance(TRIP_ID, {
+      tripTravelerId: TRAVELER_ID,
+      status: 'declined',
+      consentMethod: 'verbal_phone',
+      // spoof attempt — must be ignored
+      resolutionSource: 'client_esign',
+    } as any)
+    expect(captured.insert.resolutionSource).toBe('advisor_manual')
+    expect(captured.insert.consentMethod).toBe('verbal_phone')
+    expect(captured.insert.offeredCoveragesSnapshot).toHaveLength(1)
+    expect(captured.insert.offeredCoveragesSnapshot[0].id).toBe('pkg-1')
+  })
+})
+
+describe('InsuranceService — P3b resolution evidence (update)', () => {
+  it('preserves a client_esign record on a non-status edit (no consent required, evidence intact)', async () => {
+    const { service, captured } = makeService({
+      id: 'ins-1',
+      status: 'declined',
+      resolutionSource: 'client_esign',
+      formTokenId: 'form-99',
+      consentMethod: null,
+    })
+    // Editing only notes — no status change, no consentMethod supplied.
+    await service.updateTravelerInsurance(TRIP_ID, 'ins-1', { notes: 'called client' } as any)
+    // Service-managed evidence is never written from an advisor edit here.
+    expect(captured.set.resolutionSource).toBeUndefined()
+    expect(captured.set.formTokenId).toBeUndefined()
+    expect(captured.set.consentMethod).toBeUndefined()
+  })
+
+  it('requires consent when advisor OVERRIDES a client_esign record to a new status → flips to advisor_manual', async () => {
+    const { service } = makeService({
+      id: 'ins-1',
+      status: 'declined',
+      resolutionSource: 'client_esign',
+      formTokenId: 'form-99',
+    })
+    await expect(
+      service.updateTravelerInsurance(TRIP_ID, 'ins-1', { status: 'has_own_insurance', externalProviderName: 'BlueCross' } as any),
+    ).rejects.toBeInstanceOf(BadRequestException)
+  })
+
+  it('flips a client_esign override to advisor_manual with fresh consent + unlinks the token', async () => {
+    const { service, captured } = makeService({
+      id: 'ins-1',
+      status: 'declined',
+      resolutionSource: 'client_esign',
+      formTokenId: 'form-99',
+    })
+    await service.updateTravelerInsurance(TRIP_ID, 'ins-1', {
+      status: 'has_own_insurance',
+      externalProviderName: 'BlueCross',
+      consentMethod: 'email_confirmation',
+    } as any)
+    expect(captured.set.resolutionSource).toBe('advisor_manual')
+    expect(captured.set.consentMethod).toBe('email_confirmation')
+    expect(captured.set.formTokenId).toBeNull()
+  })
+
+  // Codex P3b block #1 regression: reassigning a signed selected_package record to
+  // a DIFFERENT package is a material change even though the status is unchanged.
+  it('treats a client_esign package reassignment (A→B, status unchanged) as a material override requiring consent', async () => {
+    const { service } = makeService({
+      id: 'ins-1',
+      status: 'selected_package',
+      selectedPackageId: 'pkg-A',
+      resolutionSource: 'client_esign',
+      formTokenId: 'form-99',
+    })
+    await expect(
+      service.updateTravelerInsurance(TRIP_ID, 'ins-1', {
+        status: 'selected_package',
+        selectedPackageId: 'pkg-B',
+      } as any),
+    ).rejects.toBeInstanceOf(BadRequestException)
+  })
+
+  it('flips a client_esign package reassignment to advisor_manual with consent + unlinks the token', async () => {
+    const { service, captured } = makeService({
+      id: 'ins-1',
+      status: 'selected_package',
+      selectedPackageId: 'pkg-A',
+      resolutionSource: 'client_esign',
+      formTokenId: 'form-99',
+    })
+    await service.updateTravelerInsurance(TRIP_ID, 'ins-1', {
+      status: 'selected_package',
+      selectedPackageId: 'pkg-B',
+      consentMethod: 'in_person_signature',
+    } as any)
+    expect(captured.set.resolutionSource).toBe('advisor_manual')
+    expect(captured.set.consentMethod).toBe('in_person_signature')
+    expect(captured.set.formTokenId).toBeNull()
+  })
+
+  // Codex P3b block #3 regression: consent_method is service-managed — a neutral
+  // PATCH must never inject an arbitrary value onto the compliance column.
+  it('ignores a body-supplied consentMethod on a neutral PATCH (no status/material change)', async () => {
+    const { service, captured } = makeService({
+      id: 'ins-1',
+      status: 'selected_package',
+      selectedPackageId: 'pkg-A',
+      resolutionSource: 'advisor_manual',
+      consentMethod: 'verbal_phone',
+    })
+    await service.updateTravelerInsurance(TRIP_ID, 'ins-1', {
+      notes: 'just a note',
+      consentMethod: 'bogus',
+    } as any)
+    // stripped — not written to the evidence column
+    expect(captured.set.consentMethod).toBeUndefined()
+  })
+
+  it('preserves client_esign on an evidence-neutral edit (premium only, no consent needed)', async () => {
+    const { service, captured } = makeService({
+      id: 'ins-1',
+      status: 'selected_package',
+      selectedPackageId: 'pkg-A',
+      resolutionSource: 'client_esign',
+      formTokenId: 'form-99',
+    })
+    await service.updateTravelerInsurance(TRIP_ID, 'ins-1', { premiumPaidCents: 5000 } as any)
+    expect(captured.set.resolutionSource).toBeUndefined()
+    expect(captured.set.formTokenId).toBeUndefined()
+    expect(captured.set.consentMethod).toBeUndefined()
+  })
+})
diff --git a/apps/api/src/trips/insurance.service.ts b/apps/api/src/trips/insurance.service.ts
index 2f076e6f3..c540478de 100644
--- a/apps/api/src/trips/insurance.service.ts
+++ b/apps/api/src/trips/insurance.service.ts
@@ -20,6 +20,12 @@ import { PaymentSchedulesService } from './payment-schedules.service'
 import { shouldRetireFloatingInsuranceActivity } from './insurance-retire.policy'
 import { evaluateCurrencyChange } from './currency-change.helpers'
 import { CURRENCY_CHANGE_BLOCKED_CODE } from './activity-currency.service'
+import { mapPackagesToOfferSnapshot } from './insurance-offer-snapshot.mapper'
+import {
+  ADVISOR_CONSENT_METHODS,
+  type AdvisorConsentMethod,
+  type InsuranceOfferSnapshotItem,
+} from '@tailfire/shared-types'
 import type {
   TripInsurancePackageDto,
   CreateTripInsurancePackageDto,
@@ -29,8 +35,18 @@ import type {
   CreateTripTravelerInsuranceDto,
   UpdateTripTravelerInsuranceDto,
   TripTravelersInsuranceListDto,
+  TravelerInsuranceStatus,
 } from '@tailfire/shared-types'
 
+// refs #1466 P3b — statuses that constitute a compliance "resolution" (the
+// traveler's insurance question is answered). Recording one via the advisor path
+// requires a consent_method; the client waiver path records client_esign instead.
+const RESOLVED_INSURANCE_STATUSES: ReadonlySet<string> = new Set<TravelerInsuranceStatus>([
+  'declined',
+  'has_own_insurance',
+  'selected_package',
+])
+
 @Injectable()
 export class InsuranceService {
   private readonly logger = new Logger(InsuranceService.name)
@@ -883,6 +899,11 @@ export class InsuranceService {
     // Validate status-specific requirements
     const resolvedStatus = dto.status || 'pending'
     this.validateStatusRequirements(resolvedStatus, dto)
+    // refs #1466 P3b — a create is always a fresh advisor resolution; a resolved
+    // status must carry consent.
+    if (RESOLVED_INSURANCE_STATUSES.has(resolvedStatus)) {
+      this.assertConsentMethod(dto)
+    }
 
     // Premium paid only applies to an agency-sold package; clear it otherwise.
     let premiumPaidToWrite: number | null = null
@@ -891,6 +912,12 @@ export class InsuranceService {
       premiumPaidToWrite = dto.premiumPaidCents ?? null
     }
 
+    // refs #1466 P3b — an advisor create is always an advisor_manual resolution;
+    // resolution_source is SERVICE-MANAGED (never taken from the DTO, mirroring the
+    // activity_id-strip pattern). A resolved status freezes the offered coverages.
+    const isResolved = RESOLVED_INSURANCE_STATUSES.has(resolvedStatus)
+    const offeredSnapshot = isResolved ? await this.buildOfferSnapshot(tripId) : null
+
     const [record] = await this.db.client
       .insert(this.db.schema.tripTravelerInsurance)
       .values({
@@ -906,6 +933,10 @@ export class InsuranceService {
         acknowledgedAt: dto.status === 'declined' ? new Date() : null,
         premiumPaidCents: premiumPaidToWrite,
         notes: dto.notes ?? null,
+        // Compliance evidence (advisor path).
+        resolutionSource: 'advisor_manual',
+        consentMethod: isResolved ? (dto.consentMethod ?? null) : null,
+        offeredCoveragesSnapshot: offeredSnapshot,
       })
       .returning()
 
@@ -927,16 +958,66 @@ export class InsuranceService {
       await this.verifyPackageBelongsToTrip(dto.selectedPackageId, tripId)
     }
 
-    // Validate status-specific requirements
-    if (dto.status) {
+    // refs #1466 P3b — a resolution captured by the client waiver path
+    // (client_esign) already carries its own evidence (signature/IP/signed PDF).
+    // It is preserved ONLY for evidence-NEUTRAL edits (notes, premium, policy
+    // number). ANY change to the resolution itself — the status OR a status-defining
+    // field (package, external policy/provider/coverage, decline reason) — is a
+    // material advisor override: re-capture consent, flip to advisor_manual, unlink
+    // the signed waiver, and refresh the offer snapshot.
+    const differs = (a: unknown, b: unknown) => a !== undefined && a !== b
+    const materialResolutionChange =
+      differs(dto.status, existing.status) ||
+      differs(dto.selectedPackageId, existing.selectedPackageId) ||
+      differs(dto.externalPolicyNumber, existing.externalPolicyNumber) ||
+      differs(dto.externalProviderName, existing.externalProviderName) ||
+      differs(dto.externalCoverageDetails, existing.externalCoverageDetails) ||
+      differs(dto.declinedReason, existing.declinedReason)
+    const preserveClientEsign =
+      existing.resolutionSource === 'client_esign' && !materialResolutionChange
+    const effectiveStatus = dto.status ?? existing.status
+    const effectiveResolved = RESOLVED_INSURANCE_STATUSES.has(effectiveStatus)
+    // This write establishes an advisor-recorded resolution when we're not
+    // preserving an e-sign record and either the status is (re)set or a resolution
+    // field materially changed.
+    const advisorResolutionWrite =
+      !preserveClientEsign && (dto.status !== undefined || materialResolutionChange)
+
+    // Validate status-specific field requirements (only when status is provided,
+    // to preserve the existing partial-update contract).
+    if (dto.status !== undefined) {
       this.validateStatusRequirements(dto.status, dto)
     }
+    // Consent is required whenever this write records an advisor resolution.
+    if (advisorResolutionWrite && effectiveResolved) {
+      this.assertConsentMethod(dto)
+    }
 
     const updateData: any = {
       ...dto,
       updatedAt: new Date(),
     }
 
+    // refs #1466 P3b — ALL evidence columns are SERVICE-MANAGED; strip them from the
+    // incoming body unconditionally (mirror the activity_id-strip pattern) so a
+    // spoofed { resolutionSource: 'client_esign' } can't forge provenance AND a
+    // neutral PATCH { consentMethod: 'bogus' } can't inject an unvalidated consent
+    // value. Consent is re-set ONLY inside the validated advisor-resolution block.
+    delete updateData.resolutionSource
+    delete updateData.formTokenId
+    delete updateData.offeredCoveragesSnapshot
+    delete updateData.consentMethod
+
+    if (advisorResolutionWrite) {
+      // Advisor is (re)recording the resolution → advisor_manual with fresh
+      // evidence; unlink any prior signed-waiver token (this is now the advisor's
+      // decision of record). dto.consentMethod was already validated above.
+      updateData.resolutionSource = 'advisor_manual'
+      updateData.consentMethod = effectiveResolved ? (dto.consentMethod ?? null) : null
+      updateData.offeredCoveragesSnapshot = effectiveResolved ? await this.buildOfferSnapshot(tripId) : null
+      updateData.formTokenId = null
+    }
+
     // Resolve the effective status/package after this update, then bound the
     // premium-paid amount. premiumPaidCents feeds the trip financial summary,
     // so it must be validated server-side and cleared when no package is owed.
@@ -1020,7 +1101,7 @@ export class InsuranceService {
 
   private validateStatusRequirements(
     status: string,
-    dto: CreateTripTravelerInsuranceDto | UpdateTripTravelerInsuranceDto
+    dto: CreateTripTravelerInsuranceDto | UpdateTripTravelerInsuranceDto,
   ): void {
     if (status === 'selected_package' && !dto.selectedPackageId) {
       throw new BadRequestException(
@@ -1039,6 +1120,46 @@ export class InsuranceService {
     }
   }
 
+  /**
+   * refs #1466 P3b — compliance evidence: an advisor-recorded resolution must
+   * carry HOW consent was captured. Strict (§8) — never best-effort. Called only
+   * when this write actually establishes an advisor_manual resolution (a resolved
+   * status via the advisor path), NOT when preserving an existing client e-sign.
+   */
+  private assertConsentMethod(
+    dto: CreateTripTravelerInsuranceDto | UpdateTripTravelerInsuranceDto,
+  ): void {
+    if (!dto.consentMethod) {
+      throw new BadRequestException(
+        'consentMethod is required when recording a resolved insurance status',
+      )
+    }
+    if (!ADVISOR_CONSENT_METHODS.includes(dto.consentMethod as AdvisorConsentMethod)) {
+      throw new BadRequestException(
+        `consentMethod must be one of: ${ADVISOR_CONSENT_METHODS.join(', ')}`,
+      )
+    }
+  }
+
+  /**
+   * refs #1466 P3b — snapshot the packages currently on offer for a trip, frozen
+   * onto the traveler's resolution as evidence of what they were shown. Shares the
+   * offer mapper with the client waiver token so both paths record the same shape.
+   */
+  private async buildOfferSnapshot(tripId: string): Promise<InsuranceOfferSnapshotItem[]> {
+    const packages = await this.db.client
+      .select()
+      .from(this.db.schema.tripInsurancePackages)
+      .where(
+        and(
+          eq(this.db.schema.tripInsurancePackages.tripId, tripId),
+          eq(this.db.schema.tripInsurancePackages.isActive, true),
+        ),
+      )
+      .orderBy(this.db.schema.tripInsurancePackages.displayOrder)
+    return mapPackagesToOfferSnapshot(packages)
+  }
+
   /**
    * Verify package belongs to the specified trip. Returns its premium (cents)
    * so callers can validate premium-paid amounts against it.
@@ -1205,6 +1326,12 @@ export class InsuranceService {
       notes: record.notes,
       createdAt: record.createdAt.toISOString(),
       updatedAt: record.updatedAt.toISOString(),
+      // refs #1466 P3b — compliance-grade resolution evidence.
+      resolutionSource: record.resolutionSource ?? 'advisor_manual',
+      consentMethod: record.consentMethod ?? null,
+      formTokenId: record.formTokenId ?? null,
+      offeredCoveragesSnapshot:
+        (record.offeredCoveragesSnapshot as InsuranceOfferSnapshotItem[] | null) ?? null,
     }
   }
 }
diff --git a/packages/database/src/index.ts b/packages/database/src/index.ts
index 85190fbe2..41d1971c5 100644
--- a/packages/database/src/index.ts
+++ b/packages/database/src/index.ts
@@ -35,6 +35,15 @@ export {
   type SyncHistoryMetrics,
 } from './schema/cruise-sync-history.schema'
 
+// Insurance schema type exports (root convenience — #1466 P3b mapper)
+export {
+  type TripInsurancePackage,
+  type NewTripInsurancePackage,
+  type TripTravelerInsurance,
+  type NewTripTravelerInsurance,
+  type InsuranceResolutionSource,
+} from './schema/insurance.schema'
+
 // Tour catalog schema exports
 export { tourOperators, type TourOperator, type NewTourOperator } from './schema/tour-operators.schema'
 export { tours, type Tour, type NewTour } from './schema/tours.schema'
diff --git a/packages/database/src/migrations/20260705120000_1466_insurance_resolution_evidence.sql b/packages/database/src/migrations/20260705120000_1466_insurance_resolution_evidence.sql
new file mode 100644
index 000000000..7870b4aa5
--- /dev/null
+++ b/packages/database/src/migrations/20260705120000_1466_insurance_resolution_evidence.sql
@@ -0,0 +1,24 @@
+-- refs #1466 P3b — compliance-grade insurance resolution evidence
+--
+-- Today a "declined"/"has_own_insurance"/"selected_package" resolution can be
+-- rubber-stamped by the advisor path with no record of HOW consent was obtained
+-- or WHAT coverage was offered at the time. This adds first-class evidence:
+--   * resolution_source — who resolved it (advisor manual entry vs client e-sign)
+--   * consent_method     — how advisor consent was captured (verbal/email/in-person)
+--   * form_token_id      — links a client e-sign resolution to its signed waiver
+--   * offered_coverages_snapshot — the packages that were on offer at resolution
+--
+-- Additive / forward-only. The ~93 existing prod rows keep the DEFAULT
+-- 'advisor_manual' with NULL evidence — a documented pre-P3b audit gap, NOT
+-- retro-enforced (flagged to Al). New resolutions are captured going forward.
+
+DO $$ BEGIN
+  CREATE TYPE insurance_resolution_source AS ENUM ('advisor_manual', 'client_esign');
+EXCEPTION WHEN duplicate_object THEN null;
+END $$;
+
+ALTER TABLE trip_traveler_insurance
+  ADD COLUMN IF NOT EXISTS resolution_source insurance_resolution_source NOT NULL DEFAULT 'advisor_manual',
+  ADD COLUMN IF NOT EXISTS consent_method varchar(50),
+  ADD COLUMN IF NOT EXISTS form_token_id uuid REFERENCES form_tokens(id) ON DELETE SET NULL,
+  ADD COLUMN IF NOT EXISTS offered_coverages_snapshot jsonb;
diff --git a/packages/database/src/migrations/meta/_journal.json b/packages/database/src/migrations/meta/_journal.json
index aa5848e24..1a7b85ce5 100644
--- a/packages/database/src/migrations/meta/_journal.json
+++ b/packages/database/src/migrations/meta/_journal.json
@@ -2402,6 +2402,13 @@
       "when": 1781676000039,
       "tag": "20260704150000_1466_automation_proposed",
       "breakpoints": true
+    },
+    {
+      "idx": 343,
+      "version": "7",
+      "when": 1781679600039,
+      "tag": "20260705120000_1466_insurance_resolution_evidence",
+      "breakpoints": true
     }
   ]
 }
\ No newline at end of file
diff --git a/packages/database/src/schema/insurance.schema.ts b/packages/database/src/schema/insurance.schema.ts
index df9f7ca0f..a141d0bb4 100644
--- a/packages/database/src/schema/insurance.schema.ts
+++ b/packages/database/src/schema/insurance.schema.ts
@@ -10,6 +10,7 @@ import { relations, sql } from 'drizzle-orm'
 import { trips, tripTravelers } from './trips.schema'
 import { itineraryActivities } from './activities.schema'
 import { suppliers } from './suppliers.schema'
+import { formTokens } from './form-tokens.schema'
 
 // ============================================================================
 // ENUMS
@@ -31,6 +32,16 @@ export const travelerInsuranceStatusEnum = pgEnum('traveler_insurance_status', [
   'selected_package',
 ])
 
+// refs #1466 P3b — how a traveler's insurance resolution was captured:
+//  advisor_manual = an advisor recorded it in the Insurance tab (consent captured
+//    out-of-band, recorded via consent_method);
+//  client_esign   = the client resolved it via a signed waiver/election form
+//    (form_token_id links the signed PDF + signature/IP/sha256 evidence).
+export const insuranceResolutionSourceEnum = pgEnum('insurance_resolution_source', [
+  'advisor_manual',
+  'client_esign',
+])
+
 // ---- #837 Phase 0: catalog enums --------------------------------------------
 
 // How a catalog product is shaped: a 'bundle' is an all-in-one comprehensive
@@ -167,6 +178,19 @@ export const tripTravelerInsurance = pgTable('trip_traveler_insurance', {
   declinedAt: timestamp('declined_at', { withTimezone: true }),
   acknowledgedAt: timestamp('acknowledged_at', { withTimezone: true }),
 
+  // refs #1466 P3b — compliance-grade resolution evidence. resolution_source is
+  // SERVICE-MANAGED (advisor path forces 'advisor_manual'; the client waiver path
+  // sets 'client_esign') — never client-settable. consent_method records HOW the
+  // advisor captured consent (verbal_phone|email_confirmation|in_person_signature),
+  // required by the service when a resolved status is set via the advisor path.
+  // form_token_id links a client_esign resolution to its signed waiver (SET NULL if
+  // the token is purged). offered_coverages_snapshot freezes the packages on offer
+  // at resolution time (what the traveler was shown).
+  resolutionSource: insuranceResolutionSourceEnum('resolution_source').notNull().default('advisor_manual'),
+  consentMethod: varchar('consent_method', { length: 50 }),
+  formTokenId: uuid('form_token_id').references(() => formTokens.id, { onDelete: 'set null' }),
+  offeredCoveragesSnapshot: jsonb('offered_coverages_snapshot'),
+
   // Payment tracking (when status = 'selected_package')
   premiumPaidCents: integer('premium_paid_cents'),
   policyNumber: varchar('policy_number', { length: 100 }),
@@ -367,6 +391,7 @@ export type NewTripTravelerInsurance = typeof tripTravelerInsurance.$inferInsert
 
 export type InsurancePolicyType = typeof insurancePolicyTypeEnum.enumValues[number]
 export type TravelerInsuranceStatus = typeof travelerInsuranceStatusEnum.enumValues[number]
+export type InsuranceResolutionSource = typeof insuranceResolutionSourceEnum.enumValues[number]
 
 // #837 Phase 0 catalog
 export type InsuranceProduct = typeof insuranceProducts.$inferSelect
diff --git a/packages/shared-types/src/api/insurance.types.ts b/packages/shared-types/src/api/insurance.types.ts
index 5c8ef1bc3..27bf437cc 100644
--- a/packages/shared-types/src/api/insurance.types.ts
+++ b/packages/shared-types/src/api/insurance.types.ts
@@ -23,6 +23,47 @@ export type TravelerInsuranceStatus =
   | 'declined'
   | 'selected_package'
 
+// refs #1466 P3b — how a resolution was captured (service-managed, never client-set).
+export type InsuranceResolutionSource = 'advisor_manual' | 'client_esign'
+
+/**
+ * refs #1466 P3b — how an ADVISOR captured the traveler's consent out-of-band
+ * when recording a resolved status in the Insurance tab. Required by the service
+ * for a resolved status via the advisor path. Deliberately EXCLUDES a
+ * client-self-service value — that path produces a signed waiver (client_esign)
+ * with its own evidence, never a manual consent_method.
+ */
+export const ADVISOR_CONSENT_METHODS = [
+  'verbal_phone',
+  'email_confirmation',
+  'in_person_signature',
+] as const
+export type AdvisorConsentMethod = (typeof ADVISOR_CONSENT_METHODS)[number]
+
+/**
+ * refs #1466 P3b — a frozen snapshot of one package that was on offer at the
+ * moment a resolution was recorded (what the traveler was shown). Persisted as
+ * jsonb; shared by the advisor path and the client waiver path.
+ */
+export type InsuranceOfferSnapshotItem = {
+  id: string
+  tripId: string
+  providerName: string
+  packageName: string
+  policyType: InsurancePolicyType
+  coverageAmountCents: number | null
+  premiumCents: number
+  deductibleCents: number | null
+  currency: string
+  coverageStartDate: string | null
+  coverageEndDate: string | null
+  termsUrl: string | null
+  isFromCatalog: boolean
+  displayOrder: number
+  activityId: string | null
+  isActive: boolean
+}
+
 // =============================================================================
 // Insurance Package DTOs
 // =============================================================================
@@ -154,6 +195,12 @@ export type TripTravelerInsuranceDto = {
   createdAt: string
   updatedAt: string
 
+  // refs #1466 P3b — compliance-grade resolution evidence.
+  resolutionSource: InsuranceResolutionSource
+  consentMethod: string | null
+  formTokenId: string | null
+  offeredCoveragesSnapshot: InsuranceOfferSnapshotItem[] | null
+
   // Populated traveler info (optional)
   traveler?: {
     id: string
@@ -177,6 +224,9 @@ export type CreateTripTravelerInsuranceDto = {
   declinedReason?: string | null
   premiumPaidCents?: number | null
   notes?: string | null
+  // refs #1466 P3b — required by the service when status is resolved
+  // (declined|has_own_insurance|selected_package) on the advisor path.
+  consentMethod?: AdvisorConsentMethod | null
 }
 
 /**
@@ -197,6 +247,9 @@ export type UpdateTripTravelerInsuranceDto = {
   premiumPaidCents?: number | null
   policyNumber?: string | null
   notes?: string | null
+  // refs #1466 P3b — required by the service when status is resolved
+  // (declined|has_own_insurance|selected_package) on the advisor path.
+  consentMethod?: AdvisorConsentMethod | null
 }
 
 // =============================================================================