@7365admin1/layer-common 4.149.2 → 4.150.0

package/components/HidUserEnrollment.vue

@@ -53,7 +53,9 @@
       @refresh="loadUsers"
       @update:page="goToPage"
     >
-      <template v-if="!props.cardManagement" #actions>
+      <!-- Enrolling is the users right (`hid-mgmt:manage-hid-users`). Hidden,
+           not disabled: the server refuses the call for a member without it. -->
+      <template v-if="!props.cardManagement && canManageHidUsers" #actions>
         <AppButton icon="mdi-account-plus" @click="openEnroll"
           >Enroll</AppButton
         >
@@ -141,14 +143,14 @@
 
       <template #[`item.action-table`]="{ item }">
         <AppButton
-          v-if="props.cardManagement"
+          v-if="props.cardManagement && canManageHidUsers"
           variant="secondary"
           icon="mdi-card-account-details-outline"
           @click="openCardManager(item)"
         >
           Manage
         </AppButton>
-        <v-menu v-else>
+        <v-menu v-else-if="!props.cardManagement">
           <template #activator="{ props: menuProps }">
             <AppButton
               v-bind="menuProps"
@@ -159,16 +161,18 @@
 
           <v-list density="compact" min-width="150">
             <v-list-item title="View" @click="openView(item)" />
-            <v-list-item title="Edit" @click="openEdit(item)" />
-            <v-list-item
-              title="Manage HID Cards"
-              @click="openCardManager(item)"
-            />
-            <v-list-item
-              title="Delete"
-              class="text-error"
-              @click="openDelete(item)"
-            />
+            <template v-if="canManageHidUsers">
+              <v-list-item title="Edit" @click="openEdit(item)" />
+              <v-list-item
+                title="Manage HID Cards"
+                @click="openCardManager(item)"
+              />
+              <v-list-item
+                title="Delete"
+                class="text-error"
+                @click="openDelete(item)"
+              />
+            </template>
           </v-list>
         </v-menu>
       </template>
@@ -274,13 +278,26 @@
                it. -->
           <div class="field-label">Enrolling <span>*</span></div>
           <AppSelect
-            v-if="!selectedUser"
+            v-if="!selectedUser && subjectCategoryOptions.length"
             v-model="form.subjectCategory"
             :items="subjectCategoryOptions"
             klass="mb-3"
             @update:model-value="onSubjectCategoryChanged"
           />
-          <p v-else class="field-hint mb-3">{{ subjectCategoryLabel }}</p>
+          <p v-else-if="selectedUser" class="field-hint mb-3">{{ subjectCategoryLabel }}</p>
+          <!-- WHY THERE IS NOTHING TO PICK. Drawn in place of the dropdown when
+               the reader serves nobody, and beneath it when only some types were
+               removed. Without it, a missing option reads as a screen that failed
+               to load rather than as a setting on the reader.
+               Nothing extra is needed to stop the save: with no type there is no
+               subject, and the save already refuses that. -->
+          <p
+            v-if="!selectedUser && subjectCategoryNote"
+            class="field-hint mb-3"
+            :class="{ 'field-hint--error': enrolmentSubjects.emptied }"
+          >
+            {{ subjectCategoryNote }}
+          </p>
 
           <!-- Block / Level / Unit / Resident. Enrolment only.
                Enrollment is resident-only and the resident must already exist
@@ -363,7 +380,7 @@
                access is bound by user id, so there is nothing to bind. The note
                below says how many were left out rather than letting a missing
                colleague read as a bug. -->
-          <template v-if="!selectedUser && !isResidentSubject">
+          <template v-if="!selectedUser && isMemberSubject">
             <div class="field-label">Member <span>*</span></div>
             <AppSelect
               v-model="form.subjectId"
@@ -389,6 +406,59 @@
             </p>
           </template>
 
+          <!-- SERVICE PROVIDER STAFF. One person from a provider company, and
+               never the company: granting a company puts every employee of the
+               firm on the door, including the ones who do not attend this site.
+               The list, the service filter and the filter's "All services"
+               default are the Members > Service Providers screen's own, from the
+               same endpoint and through the same `filterProviderMembers` rule,
+               so the two screens cannot disagree about who works here.
+               Unpaged - the endpoint returns the site's people in one response -
+               so searching and filtering cost no request. -->
+          <template v-if="!selectedUser && isProviderSubject">
+            <div class="field-label">Service</div>
+            <AppSelect
+              v-model="providerService"
+              :items="providerServiceOptions"
+              klass="mb-3"
+              @update:model-value="onProviderServiceChanged"
+            />
+
+            <div class="field-label">Person <span>*</span></div>
+            <AppSelect
+              v-model="form.subjectId"
+              :items="providerOptions"
+              searchable
+              search-placeholder="Search by name, company or role"
+              :placeholder="providerPlaceholder"
+              klass="mb-3"
+              @update:model-value="onProviderChanged"
+            />
+
+            <!-- ACCESS ONLY, and the button says so. Shown here and nowhere
+                 else: it is the one subject type that arrives a shift at a time,
+                 and the people it adds fill in their own credentials from their
+                 app afterwards. -->
+            <div class="hid-bulk-cta mb-3">
+              <AppButton
+                variant="ghost"
+                icon="mdi-account-multiple-plus-outline"
+                :disabled="loadingProviders"
+                @click="openBulkAdd"
+              >
+                Add Users in Bulk
+              </AppButton>
+              <span class="field-hint">
+                Gives access to many people at once. They add their own face, QR
+                or PIN from their app.
+              </span>
+            </div>
+
+            <p v-if="hiddenProviderNote" class="field-hint mb-3">
+              {{ hiddenProviderNote }}
+            </p>
+          </template>
+
           <!-- The duplicate check. It is reader-scoped: this resident holding a
                HID user on another gate is normal and says nothing here. -->
           <p v-if="checkingResident" class="field-hint">
@@ -412,17 +482,176 @@
                whatever the reader already holds. -->
           <!-- A mirror of the chosen member's role, on the same rule as Name:
                restated from the record, never collected. -->
-          <template v-if="!selectedUser && !isResidentSubject">
-            <div class="field-label">Role</div>
+          <template v-if="!selectedUser && isPersonSubject">
+            <div class="field-label">{{ subjectMirrorLabel }}</div>
             <AppField
               v-model="form.subjectRole"
-              aria-label="Role"
-              placeholder="Select a member above"
+              :aria-label="subjectMirrorLabel"
+              :placeholder="subjectMirrorPlaceholder"
               readonly
               klass="mb-3"
             />
           </template>
 
+          <!-- WHERE THIS PERSON WILL END UP.
+               Enrolling is no longer "pick a reader" - they land on every reader
+               at the site that serves their account type - so the dialog states
+               it rather than asking. The excluded readers are drawn too, with the
+               reason: an absent reader reads as a screen that failed to load,
+               while "does not serve residents" reads as a setting somebody chose.
+               Replaced while a save is running by the per-reader progress below,
+               which is the same list with each row's own state. -->
+          <template v-if="!selectedUser">
+            <div class="field-label">
+              {{ readerOutcomes.length ? "Enrolling on" : "Will be enrolled on" }}
+            </div>
+
+            <div v-if="readerOutcomes.length" class="hid-fanout mb-1">
+              <div
+                v-for="outcome in readerOutcomes"
+                :key="outcome.readerId"
+                class="hid-fanout__row"
+                :class="`hid-fanout__row--${outcome.step}`"
+              >
+                <v-icon
+                  :icon="
+                    outcome.step === 'done'
+                      ? 'mdi-check-circle-outline'
+                      : outcome.step === 'failed'
+                      ? 'mdi-alert-circle-outline'
+                      : outcome.step === 'working'
+                      ? 'mdi-progress-upload'
+                      : 'mdi-clock-outline'
+                  "
+                  size="17"
+                />
+                <div class="hid-fanout__body">
+                  <strong>{{ outcome.name }}</strong>
+                  <span v-if="outcome.message">{{ outcome.message }}</span>
+                </div>
+                <!-- Retry is per reader, because the failure was. Enabled only
+                     when nothing else is running, so two writes cannot race at
+                     one device. -->
+                <AppButton
+                  v-if="outcome.step === 'failed'"
+                  variant="row"
+                  icon="mdi-refresh"
+                  :disabled="fanOutRunning"
+                  @click="retryReader(outcome)"
+                />
+              </div>
+            </div>
+
+            <div v-else class="hid-fanout mb-1">
+              <div
+                v-for="target in enrolmentTargets.targets"
+                :key="target.readerId"
+                class="hid-fanout__row hid-fanout__row--target"
+              >
+                <v-icon icon="mdi-check" size="17" />
+                <div class="hid-fanout__body">
+                  <strong>{{ target.name }}</strong>
+                  <span v-if="target.location">{{ target.location }}</span>
+                  <span v-if="target.warning">{{ target.warning }}</span>
+                </div>
+              </div>
+              <div
+                v-for="skipped in enrolmentTargets.excluded"
+                :key="skipped.readerId"
+                class="hid-fanout__row hid-fanout__row--excluded"
+              >
+                <v-icon icon="mdi-minus" size="17" />
+                <div class="hid-fanout__body">
+                  <strong>{{ skipped.name }}</strong>
+                  <span>{{ skipped.reason }}</span>
+                </div>
+              </div>
+            </div>
+
+            <p v-if="fanOutProgress && fanOutRunning" class="field-hint mb-3">
+              {{ fanOutProgress }}
+            </p>
+            <p
+              v-else-if="fanOutResult"
+              class="field-hint mb-3"
+              :class="{ 'field-hint--error': fanOutResult.tone !== 'success' }"
+            >
+              {{ fanOutResult.message }}
+            </p>
+            <p v-else-if="!enrolmentTargets.targets.length" class="field-hint field-hint--error mb-3">
+              No reader at this site serves this kind of person yet.
+            </p>
+            <!-- Each reader numbers its own users, so the ID and registration
+                 below describe the reader on screen - not the others. -->
+            <p v-else-if="enrolmentTargets.targets.length > 1" class="field-hint mb-3">
+              Each reader assigns its own ID and registration number.
+            </p>
+          </template>
+
+          <!-- EDITING SOMEBODY WHO IS ON SEVERAL READERS.
+               The same list, for the same reason, except the readers are the
+               ones that already hold this person rather than the ones that would
+               take them. Said before the save because of the PIN: a changed PIN
+               that reaches two readers of three leaves this person holding two
+               PINs, so the operator needs to know the change travels. -->
+          <template v-else-if="editPlaces.length > 1 || readerOutcomes.length">
+            <div class="field-label">
+              {{ readerOutcomes.length ? "Updating on" : "Also on" }}
+            </div>
+
+            <div class="hid-fanout mb-1">
+              <div
+                v-for="outcome in editRows"
+                :key="outcome.readerId"
+                class="hid-fanout__row"
+                :class="`hid-fanout__row--${outcome.step}`"
+              >
+                <v-icon
+                  :icon="
+                    outcome.step === 'done'
+                      ? 'mdi-check-circle-outline'
+                      : outcome.step === 'failed'
+                      ? 'mdi-alert-circle-outline'
+                      : outcome.step === 'working'
+                      ? 'mdi-progress-upload'
+                      : outcome.step === 'target'
+                      ? 'mdi-check'
+                      : 'mdi-clock-outline'
+                  "
+                  size="17"
+                />
+                <div class="hid-fanout__body">
+                  <strong>{{ outcome.name }}</strong>
+                  <span v-if="outcome.message">{{ outcome.message }}</span>
+                </div>
+              </div>
+            </div>
+
+            <p v-if="fanOutProgress && fanOutRunning" class="field-hint mb-3">
+              {{ fanOutProgress }}
+            </p>
+            <p
+              v-else-if="editResult"
+              class="field-hint mb-3"
+              :class="{ 'field-hint--error': editResult.tone !== 'success' }"
+            >
+              {{ editResult.message }}
+            </p>
+            <!-- Registration is the one field that does NOT travel: each reader
+                 allocates its own, and one number written to all would collide. -->
+            <p v-else class="field-hint mb-3">
+              Name, photo, PIN and password are updated on every reader. The
+              registration number is each reader's own.
+            </p>
+          </template>
+
+          <p
+            v-else-if="editPlacesLoading"
+            class="field-hint mb-3"
+          >
+            Checking which readers hold this person...
+          </p>
+
           <div class="field-label">Name</div>
           <AppField
             v-model="form.name"
@@ -430,6 +659,8 @@
             :placeholder="
               isResidentSubject
                 ? 'Select a resident above'
+                : isProviderSubject
+                ? 'Select a person above'
                 : 'Select a member above'
             "
             readonly
@@ -567,6 +798,115 @@
       </v-card>
     </v-dialog>
 
+    <!-- ADD USERS IN BULK.
+         Over the enrolment form, not instead of it: the operator came here to
+         enrol, and this is the shortcut for the case where a whole shift arrives
+         at once. It grants ACCESS only - the people it adds are recognised by the
+         reader once they add a face, QR or PIN from their own app - which is why
+         it collects no photo, PIN or password.
+         The table is the same list as the picker behind it, under the same
+         service filter, with Company / Name / Service and nothing else: the
+         Members screen's other columns say nothing about whether to open a door
+         for somebody. -->
+    <v-dialog v-model="bulkDialog" max-width="640" persistent>
+      <v-card class="screen-modal">
+        <v-card-title>Add Users in Bulk</v-card-title>
+        <v-card-text class="screen-modal__body">
+          <p class="field-hint mb-3">
+            Gives these people access to
+            <strong>{{ bulkReaderLabel }}</strong>. They add their own face, QR
+            or PIN from their app - nothing is enrolled on the reader here.
+          </p>
+
+          <AppField
+            v-model="bulkSearch"
+            aria-label="Search people"
+            placeholder="Search by name, company or role"
+            klass="mb-3"
+          />
+
+          <v-progress-linear v-if="bulkLoading" indeterminate class="mb-3" />
+
+          <template v-else-if="bulkRows.length">
+            <v-table density="compact" class="hid-bulk-table mb-2">
+              <thead>
+                <tr>
+                  <th class="hid-bulk-table__check">
+                    <!-- Acts on the rows in front of you - what the service
+                         filter and the search have left - never on the whole
+                         estate. -->
+                    <v-checkbox
+                      :model-value="bulkAllSelected"
+                      :disabled="!bulkSelectableRows.length"
+                      hide-details
+                      density="compact"
+                      aria-label="Select everyone listed"
+                      @update:model-value="toggleBulkAll"
+                    />
+                  </th>
+                  <th>Company</th>
+                  <th>Name</th>
+                  <th>Service</th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr v-for="row in bulkRows" :key="row.subjectId">
+                  <td class="hid-bulk-table__check">
+                    <!-- Already on the door: ticked and locked. Unticking here
+                         would revoke access, and this dialog does not revoke. -->
+                    <v-checkbox
+                      :model-value="row.granted || isBulkSelected(row.subjectId)"
+                      :disabled="row.granted"
+                      hide-details
+                      density="compact"
+                      :aria-label="`Select ${row.name}`"
+                      @update:model-value="toggleBulkRow(row.subjectId, $event)"
+                    />
+                  </td>
+                  <td>{{ row.company || "—" }}</td>
+                  <td>
+                    {{ row.name }}
+                    <span v-if="row.granted" class="hid-bulk-granted">
+                      Already has access
+                    </span>
+                  </td>
+                  <td>{{ row.service || "—" }}</td>
+                </tr>
+              </tbody>
+            </v-table>
+            <p class="field-hint">
+              {{ bulkSelectedCount }} selected<template v-if="bulkGrantedCount">
+                · {{ bulkGrantedCount }} already have access</template
+              >
+            </p>
+          </template>
+
+          <v-alert v-else type="info" variant="tonal" density="compact">
+            {{ bulkEmptyText }}
+          </v-alert>
+        </v-card-text>
+        <v-card-actions class="screen-modal__footer">
+          <v-btn
+            class="text-none screen-btn-ghost"
+            variant="flat"
+            :disabled="bulkSaving"
+            @click="bulkDialog = false"
+          >
+            Cancel
+          </v-btn>
+          <v-btn
+            class="text-none screen-btn-primary"
+            variant="flat"
+            :loading="bulkSaving"
+            :disabled="!bulkSelectedCount"
+            @click="saveBulkAdd"
+          >
+            Give access
+          </v-btn>
+        </v-card-actions>
+      </v-card>
+    </v-dialog>
+
     <HidCameraCaptureDialog v-model="cameraDialog" @capture="onCameraCapture" />
 
     <v-dialog v-model="viewDialog" max-width="430">
@@ -759,20 +1099,76 @@
       </v-card>
     </v-dialog>
 
-    <v-dialog v-model="deleteDialog" max-width="360" persistent>
+    <v-dialog v-model="deleteDialog" max-width="420" persistent>
       <v-card class="screen-modal">
         <v-card-title>Delete</v-card-title>
         <v-card-text class="screen-modal__body text-body-2">
           Are you sure you want to permanently delete this HID user?
+
+          <div v-if="deletePlacesLoading" class="text-caption text-medium-emphasis mt-2">
+            Checking which readers hold this person...
+          </div>
+          <div v-else class="text-caption text-medium-emphasis mt-2">
+            {{ deleteReach }}
+          </div>
+
+          <!-- Only a choice when there is one to make. On one reader the radios
+               would ask the operator to confirm the only possible answer. -->
+          <v-radio-group
+            v-if="deleteScopeOptions.length > 1"
+            v-model="deleteScope"
+            class="mt-2"
+            density="compact"
+            hide-details
+            :disabled="deleting"
+          >
+            <v-radio
+              v-for="choice in deleteScopeOptions"
+              :key="choice.value"
+              :label="choice.label"
+              :value="choice.value"
+              density="compact"
+            />
+          </v-radio-group>
+
+          <!-- Per-reader, so a reader that refused is named rather than hidden
+               behind a single failure message. -->
+          <div v-if="deleteOutcomes.length > 1" class="mt-3">
+            <div
+              v-for="outcome in deleteOutcomes"
+              :key="outcome.readerId"
+              class="d-flex align-center justify-space-between text-caption"
+            >
+              <span>{{ outcome.name }}</span>
+              <span
+                :class="outcome.step === 'failed'
+                  ? 'text-error'
+                  : 'text-medium-emphasis'"
+              >
+                {{ outcome.step === "done" ? "Deleted"
+                  : outcome.step === "failed" ? (outcome.message || "Failed")
+                  : outcome.step === "working" ? "Deleting..." : "Waiting" }}
+              </span>
+            </div>
+          </div>
+
+          <div
+            v-if="deleteSummary && deleteSummary.tone !== 'success'"
+            class="text-caption text-error mt-2"
+          >
+            {{ deleteSummary.message }}
+          </div>
+
           <div class="text-caption text-medium-emphasis mt-2">
-            This action will remove the user from the HID reader and mark the
-            identity as deleted.
+            This removes the user from the reader and marks the identity as
+            deleted, which also takes away the access that let them through.
           </div>
         </v-card-text>
         <v-card-actions class="screen-modal__footer">
           <v-btn
             class="text-none screen-btn-ghost"
             variant="flat"
+            :disabled="deleting"
             @click="deleteDialog = false"
           >
             Cancel
@@ -780,10 +1176,12 @@
           <v-btn
             class="text-none screen-btn-primary"
             variant="flat"
-            :loading="deleting"
+            :loading="deleting || deletePlacesLoading"
             @click="deleteUser"
           >
-            Delete
+            {{ deleteSummary && deleteSummary.tone === "partial"
+              ? "Try again"
+              : "Delete" }}
           </v-btn>
         </v-card-actions>
       </v-card>
@@ -804,9 +1202,51 @@ import {
   hiddenSubjectNote,
   memberCandidateOf,
   memberHasAccount,
+  HID_ALL_SERVICES,
+  enrolmentSubjectOfCategory,
+  permissionCategoryOf,
+  providerAccountsKnown,
+  providerCandidateOf,
+  providerEnrollableRows,
   readMemberPage,
+  serviceFilterOf,
   subjectCategoryLabel as labelForSubjectCategory,
+  subjectLinkOf,
+  type HidEnrolmentSubject,
 } from "../utils/hid-enrolment-subject";
+import { nextRegistration } from "../utils/hid-registration";
+/* Mirrors core's audience rules — core is what enforces them; this only decides
+   what is worth offering and where an enrolment lands. */
+import {
+  availableEnrolmentSubjects,
+  deleteFanOutSummary,
+  deleteReachText,
+  deleteScopeChoices,
+  editFanOutSummary,
+  fanOutProgressText,
+  fanOutSummary,
+  partitionEnrolmentTargets,
+  type THidReaderOutcome,
+  type THidReaderStep,
+} from "../utils/hid-reader-audiences";
+/* The SAME filter the Members > Service Providers screen applies, not a second
+   copy of the rule: a picker that disagrees with the screen the operator was
+   just looking at is a picker they cannot trust. Core applies it to the Excel
+   export too (`filterSiteProviderMembers`). */
+import {
+  filterProviderMembers,
+  serviceTypeOptions,
+} from "../utils/site-provider-members";
+/* Bulk access is granted through the permissions document, and the PUT REPLACES
+   this reader's whole assignment set. These three are what keep a bulk add from
+   revoking everybody who was already on the door - see the file's own header. */
+import {
+  seedAssignments,
+  setAssignment,
+  subjectOfIdentity,
+  toAssignmentPayload,
+  type HidAssignmentState,
+} from "../utils/hid-permission-assignments";
 
 const props = defineProps({
   site: {
@@ -826,6 +1266,10 @@ const props = defineProps({
   },
 });
 
+// Enrol, edit, delete, cards and PINs are all the users right. The screen
+// itself is behind `HidEnabledGate` (the view right).
+const { canManageHidUsers } = useHidAccessPermission();
+
 const {
   getReaders,
   getIdentities,
@@ -847,8 +1291,14 @@ const {
   createIdentity,
   updateIdentity,
   deleteIdentity,
+  pushStoredFace,
+  getSitePermissions,
+  updateSitePermissions,
 } = useHidAmico();
 const { getAll: getAllMembers } = useMember();
+/* Members > Service Providers reads this same call, so the enrolment picker
+   offers exactly the people that screen lists. Site-scoped by the server. */
+const { getSiteMembers } = useServiceProvider();
 const runtimeConfig = useRuntimeConfig();
 
 type HidMetadata = Record<string, unknown> & {
@@ -928,7 +1378,36 @@ const saving = ref(false);
 const deleting = ref(false);
 const formDialog = ref(false);
 const viewDialog = ref(false);
+/** One reader that holds this person, and the ids that reader knows them by. */
+type TPersonPlace = {
+  readerId: string;
+  name: string;
+  identityId: string;
+  hidUserId: string;
+};
+
 const deleteDialog = ref(false);
+/* Where this person actually is, resolved when the dialog opens so the operator
+   chooses the scope knowing the reach rather than after the fact. */
+const deletePlaces = ref<TPersonPlace[]>([]);
+const deletePlacesLoading = ref(false);
+const deleteScope = ref<"here" | "all">("here");
+/* Kept apart from the enrolment fan-out's outcomes on purpose: that list drives
+   a Retry that RE-ENROLS, which is the wrong action for a reader a delete could
+   not reach. */
+const deleteOutcomes = ref<THidReaderOutcome[]>([]);
+const deleteReach = computed(
+  () => deleteReachText(deletePlaces.value, selectedReaderId.value),
+);
+const deleteScopeOptions = computed(() => deleteScopeChoices(
+  deletePlaces.value.length,
+  selectedReader.value?.name || "this reader",
+));
+const deleteSummary = computed(() =>
+  deleteOutcomes.value.length && !deleting.value
+    ? deleteFanOutSummary(deleteOutcomes.value)
+    : null
+);
 const cardDialog = ref(false);
 const selectedUser = ref<HidUser | null>(null);
 const cardUser = ref<HidUser | null>(null);
@@ -1034,7 +1513,11 @@ type UnitPerson = {
  * the dialog, and `useHidReaderSelection` already set the precedent for where
  * that line sits.
  */
-const REMEMBERED_SUBJECT_CATEGORY = ref<THidPermissionCategory>("resident");
+/* The dropdown's values, plus `service_provider` - which the dropdown does not
+   offer but `openEdit` resolves from records that name a COMPANY. */
+type TEnrolmentSubjectValue = HidEnrolmentSubject | "service_provider";
+
+const REMEMBERED_SUBJECT_CATEGORY = ref<HidEnrolmentSubject>("resident");
 
 const form = reactive({
   reader: "",
@@ -1048,7 +1531,7 @@ const form = reactive({
   accessPin: "",
   password: "",
   photoPreview: "",
-  subjectCategory: REMEMBERED_SUBJECT_CATEGORY.value,
+  subjectCategory: REMEMBERED_SUBJECT_CATEGORY.value as TEnrolmentSubjectValue,
   subjectId: "",
   /** A mirror of the chosen member's role. Never sent; display only. */
   subjectRole: "",
@@ -1167,9 +1650,137 @@ const unitResidentNote = computed(() => {
 
 /* ── THE SUBJECT TYPE ──────────────────────────────────────────────────── */
 
-const subjectCategoryOptions = HID_ENROLMENT_SUBJECTS;
+/**
+ * ONLY THE TYPES THE TARGETED READER WILL ACCEPT.
+ *
+ * Offering one it refuses is not merely untidy: the server rejects the grant on
+ * SAVE, after a person has been chosen and a face captured - and the capture is
+ * the expensive step at a reader.
+ *
+ * A SET of readers rather than one, so the fan-out enrolment that lands a person
+ * on every matching reader asks the same question without this being rewritten.
+ * Today the set holds whichever reader the screen has selected.
+ */
+const enrolmentSubjects = computed(() => availableEnrolmentSubjects(
+  [selectedReader.value as Record<string, unknown> | null],
+  HID_ENROLMENT_SUBJECTS,
+  (option) => permissionCategoryOf(option.value),
+));
+const subjectCategoryOptions = computed(() => enrolmentSubjects.value.options);
+
+/* ── WHICH READERS THIS ENROLMENT LANDS ON ─────────────────────────────────
+ *
+ * Enrolling is no longer "pick a reader". A person belongs on every reader at
+ * the site that serves their account type, so the dialog states where they will
+ * end up and why anything is left out, rather than asking.
+ *
+ * The excluded list is drawn too. An absent reader with no reason reads as a
+ * screen that failed to load; a reader with "does not serve residents" beside it
+ * reads as a setting somebody chose.
+ */
+const enrolmentTargets = computed(() => partitionEnrolmentTargets(
+  readers.value as Array<Record<string, unknown>>,
+  permissionCategoryOf(form.subjectCategory),
+));
+
+/**
+ * How each reader is getting on, in the order they are being written.
+ *
+ * Held for the whole save so the list can be read after it finishes: a reader
+ * that failed keeps its row and its Retry, and the person stays enrolled on the
+ * ones that worked. Cleared when the dialog opens, never when a save ends.
+ */
+const readerOutcomes = ref<THidReaderOutcome[]>([]);
+const fanOutRunning = ref(false);
+const fanOutProgress = computed(() => fanOutProgressText(readerOutcomes.value));
+const fanOutResult = computed(() =>
+  readerOutcomes.value.length && !fanOutRunning.value
+    ? fanOutSummary(readerOutcomes.value)
+    : null
+);
+const failedReaders = computed(() =>
+  readerOutcomes.value.filter((outcome) => outcome.step === "failed")
+);
+/* Where an edit will land, resolved when the form opens so the dialog can say
+   it BEFORE the operator changes a PIN - "this also changes the gym" is only
+   useful in advance. */
+const editPlaces = ref<TPersonPlace[]>([]);
+const editPlacesLoading = ref(false);
+/* Before a save, the readers that hold this person; during and after it, those
+   same readers with each one's own state. One list either way, so the rows do
+   not move when the save starts. */
+type TEditRow = {
+  readerId: string;
+  name: string;
+  /* "target" is this list's own state and not a fan-out step: a reader that
+     holds this person but has not been asked to do anything yet. */
+  step: THidReaderStep | "target";
+  message?: string;
+};
+const editRows = computed<TEditRow[]>(() => (
+  readerOutcomes.value.length
+    ? readerOutcomes.value
+    : editPlaces.value.map((place) => ({
+        readerId: place.readerId,
+        name: place.name,
+        step: "target" as const,
+      }))
+));
+/* The edit's own summary: it has to speak about the PIN, which an enrolment's
+   does not - a PIN that reached some readers and not others is worse than one
+   that reached none. */
+const editResult = computed(() =>
+  readerOutcomes.value.length && !fanOutRunning.value
+    ? editFanOutSummary(readerOutcomes.value, Boolean(form.accessPin))
+    : null
+);
+
+function setReaderStep(
+  readerId: string,
+  step: THidReaderStep,
+  extra: { message?: string; retryable?: boolean } = {},
+) {
+  readerOutcomes.value = readerOutcomes.value.map((outcome) => (
+    outcome.readerId === readerId ? { ...outcome, step, ...extra } : outcome
+  ));
+}
+
+/* Why a type is missing, and - when none is left - why there is nothing to pick.
+   An absent option with no explanation reads as a broken screen. */
+const subjectCategoryNote = computed(() => {
+  if (enrolmentSubjects.value.emptied) {
+    return "This reader has no types switched on. Switch Resident, Member or"
+      + " Service provider on in the reader's settings before enrolling anybody here.";
+  }
+  if (enrolmentSubjects.value.narrowed) {
+    return "Only the kinds of people this reader serves are listed.";
+  }
+  return "";
+});
 
 const isResidentSubject = computed(() => form.subjectCategory === "resident");
+/* Members and provider staff both pick ONE PERSON from a flat list, but from
+   different lists, so they are separate branches rather than "not a resident". */
+const isMemberSubject = computed(
+  () => form.subjectCategory === "property_management"
+);
+const isProviderSubject = computed(
+  () => form.subjectCategory === "service_provider_staff"
+);
+/** Either of the two person pickers - what the Role mirror follows. */
+const isPersonSubject = computed(
+  () => isMemberSubject.value || isProviderSubject.value
+);
+
+/* The mirror's label follows the list it mirrors. A member's subtitle is their
+   role at the site; a contractor's is the firm they work for, and calling that
+   "Role" would read as a mistake. */
+const subjectMirrorLabel = computed(() =>
+  isProviderSubject.value ? "Company" : "Role"
+);
+const subjectMirrorPlaceholder = computed(() =>
+  isProviderSubject.value ? "Select a person above" : "Select a member above"
+);
 
 /* What an EDIT shows in place of the control, since the type cannot change.
    Looked up in the util, not in the switch's own options: records carry
@@ -1363,6 +1974,387 @@ function loadMoreMembers() {
   return fetchMemberPage(memberPage.value + 1, true);
 }
 
+/* ── SERVICE PROVIDER STAFF ───────────────────────────────────────────────
+ *
+ * ONE PERSON from a provider company, never the company.
+ *
+ * Read from `GET /api/service-providers/site-members` - the same call behind
+ * Members > Service Providers, with the same `filterProviderMembers` rule - so
+ * the picker lists exactly the people that screen lists. The server scopes it to
+ * the site; these are the contractors who attend THIS site, not every employee
+ * of every firm engaged with the organisation.
+ *
+ * Unpaged, deliberately, unlike the staff picker above: this endpoint returns
+ * the site's people in one response (capped at 1000 by the repository) and has
+ * no per-page cache entry to disagree with. The service filter and the search
+ * box both run over the loaded list, so neither costs a request.
+ */
+const providerPeople = ref<Record<string, unknown>[]>([]);
+const providerCompanyCount = ref(0);
+const loadingProviders = ref(false);
+const providersLoaded = ref(false);
+/**
+ * All services is the default, the same as the Members screen - but it carries a
+ * REAL value here, not "". `AppSelect`'s `hasSingleValue` is false for an empty
+ * string, so an empty-valued option draws the placeholder in placeholder grey and
+ * is never marked as chosen: the filter worked and the field looked blank. See
+ * `serviceFilterOf`.
+ */
+const providerService = ref<string>(HID_ALL_SERVICES);
+
+/** What the filter actually receives: "" for All services. */
+const providerServiceFilter = computed(() => serviceFilterOf(providerService.value));
+let providerRequestSeq = 0;
+
+/** Everyone who can actually be given a door: an app account, and active. */
+const providerEnrollable = computed(() =>
+  providerEnrollableRows(providerPeople.value)
+);
+
+/* Whether the endpoint told us who holds an app account. It only began
+   returning `user` in core 3.130, and this layer can be deployed ahead of it. */
+const providerAccountsVisible = computed(() =>
+  providerAccountsKnown(providerPeople.value)
+);
+
+/** People the operator can see on the Members screen but cannot enrol here. */
+const hiddenProviderCount = computed(
+  () => providerPeople.value.length - providerEnrollable.value.length
+);
+
+const providerServiceOptions = computed(() => [
+  { title: "All services", value: HID_ALL_SERVICES },
+  // From the ENROLLABLE set, so choosing a service never lands on an empty list.
+  ...serviceTypeOptions(providerEnrollable.value as Array<{ type?: string; typeLabel?: string }>),
+]);
+
+/** The filtered list - what both the picker and the bulk table draw. */
+const providerRows = computed(() =>
+  filterProviderMembers(providerEnrollable.value as Array<Record<string, any>>, {
+    type: providerServiceFilter.value,
+  })
+);
+
+const providerOptions = computed(() =>
+  providerRows.value.map((row) => {
+    const candidate = providerCandidateOf(row);
+    return {
+      // The firm in the title as well as the mirror: two contractors sharing a
+      // first name is the normal case, and the popover is where they have to be
+      // told apart.
+      title: candidate.subtitle
+        ? `${candidate.name} — ${candidate.subtitle}`
+        : candidate.name,
+      value: candidate.subjectId,
+    };
+  })
+);
+
+const providerPlaceholder = computed(() => {
+  if (loadingProviders.value) return "Loading people...";
+  if (!providersLoaded.value) return "Select a person";
+  if (providerOptions.value.length) return "Select a person";
+  if (providerServiceFilter.value) return "Nobody in this service can be enrolled yet";
+  if (hiddenProviderCount.value) return "Nobody here can be enrolled yet";
+  return providerCompanyCount.value
+    ? "No service provider people at this site"
+    : "No service providers work at this site yet";
+});
+
+/* Say why somebody on the Members screen is not in this list, rather than
+   letting a missing colleague read as a broken dialog. */
+const hiddenProviderNote = computed(() => {
+  if (loadingProviders.value || !hiddenProviderCount.value) return "";
+  const count = hiddenProviderCount.value;
+  const subject = count === 1 ? "1 person" : `${count} people`;
+  const verb = count === 1 ? "is" : "are";
+  const holder = count === 1 ? "that person is" : "they are";
+  const needs = providerAccountsVisible.value
+    ? "an active membership with an app account"
+    : "an active membership at this site";
+  return `${subject} from this site's service providers ${verb} not listed:`
+    + ` HID enrollment needs ${needs}, and ${holder} without one.`;
+});
+
+/** Back to "nothing loaded", so the next open starts clean. */
+function resetProviderCandidates() {
+  providerRequestSeq += 1;
+  providerPeople.value = [];
+  providerCompanyCount.value = 0;
+  providerService.value = HID_ALL_SERVICES;
+  providersLoaded.value = false;
+}
+
+/**
+ * This site's service provider people.
+ *
+ * NEVER THROWS, on the same rule as the staff loader: choosing Service provider
+ * must not break the dialog. The placeholder carries the failure.
+ */
+async function loadProviderCandidates() {
+  if (!props.site) {
+    resetProviderCandidates();
+    providersLoaded.value = true;
+    return;
+  }
+  const seq = (providerRequestSeq += 1);
+  loadingProviders.value = true;
+  try {
+    const data = await getSiteMembers(props.site);
+    // A response that arrived after the dialog was reopened belongs to a list
+    // that no longer exists - the same guard the staff pager uses.
+    if (seq !== providerRequestSeq) return;
+    providerPeople.value = Array.isArray(data?.items)
+      ? (data.items as unknown as Record<string, unknown>[])
+      : [];
+    providerCompanyCount.value = Array.isArray(data?.companies)
+      ? data.companies.length
+      : 0;
+    providersLoaded.value = true;
+  } catch (error: unknown) {
+    if (seq !== providerRequestSeq) return;
+    console.error("Unable to load service provider people for HID enrollment:", error);
+    providerPeople.value = [];
+    providerCompanyCount.value = 0;
+    providersLoaded.value = true;
+  } finally {
+    loadingProviders.value = false;
+  }
+}
+
+/** The chosen person, restated into Name and the Company mirror. */
+function onProviderChanged() {
+  // Compared on the TRIMMED id, because that is what the option's value carries
+  // (`providerCandidateOf` trims) - matching the raw field would silently find
+  // nobody and blank the name the operator just picked.
+  const row = providerRows.value.find(
+    (item) => String(item._id ?? "").trim() === form.subjectId
+  );
+  const candidate = row ? providerCandidateOf(row) : null;
+  form.name = candidate?.name ?? "";
+  form.subjectRole = candidate?.subtitle ?? "";
+  void checkSubjectEnrollment();
+}
+
+/* Changing the service can take the chosen person out of the list. Leaving a
+   selection that is no longer on screen is how a save ends up naming somebody
+   the operator cannot see. */
+function onProviderServiceChanged() {
+  if (!form.subjectId) return;
+  const stillThere = providerRows.value.some(
+    (item) => String(item._id ?? "").trim() === form.subjectId
+  );
+  if (stillThere) return;
+  form.subjectId = "";
+  form.name = "";
+  form.subjectRole = "";
+  residentConflict.value = null;
+}
+
+/* ── ADD USERS IN BULK ────────────────────────────────────────────────────
+ *
+ * ACCESS, NOT CREDENTIALS. This grants a reader group to many people at once and
+ * stops there - no face, no card, no PIN. Each person then adds their own
+ * credential from their app, which attaches to the HID user this grant created
+ * (`getProfileEnrollmentContext` reuses the existing profile identity), so
+ * nobody has to be enrolled twice.
+ *
+ * It writes through `PUT /sites/:siteId/permissions`, the one call that writes
+ * group membership, and the device users are created by the reconcile that call
+ * triggers: `provisionPermissionUser` writes `{ name, registration }` and
+ * nothing else. That is exactly "user record and group, credentials empty".
+ *
+ * THE TRAP, and the reason the saved set is fetched first: that PUT REPLACES
+ * this reader's whole assignment set. Sending only the ticked contractors would
+ * revoke every resident and every member on the door. The payload is always
+ * built from the reader's existing assignments PLUS the selection.
+ */
+const bulkDialog = ref(false);
+const bulkLoading = ref(false);
+const bulkSaving = ref(false);
+const bulkSearch = ref("");
+/** The reader's CURRENT assignments, across every category. The merge base. */
+const bulkSaved = ref<HidAssignmentState>(new Map());
+/** Who is being added now. Already-granted people are never in here. */
+const bulkSelected = ref<Set<string>>(new Set());
+
+/* NAME THE DOOR. A bulk grant is reader-scoped and the reader was chosen on the
+   screen behind two dialogs, so the confirmation says which one rather than
+   leaving the operator to remember. */
+const bulkReaderLabel = computed(() => {
+  const reader = selectedReader.value;
+  const name = String(reader?.name ?? "").trim() || "this HID reader";
+  const location = String(reader?.location ?? "").trim();
+  return location ? `${name} · ${location}` : name;
+});
+
+/** The same people the picker offers, narrowed by this dialog's own search. */
+const bulkRows = computed(() => {
+  const rows = filterProviderMembers(
+    providerRows.value as Array<Record<string, any>>,
+    { search: bulkSearch.value }
+  );
+  return rows.map((row) => {
+    const candidate = providerCandidateOf(row);
+    const id = candidate.subjectId;
+    return {
+      subjectId: id,
+      name: candidate.name,
+      company: String(row.company ?? "").trim(),
+      service: String(row.typeLabel ?? row.type ?? "").trim(),
+      // Already on the door. Ticked and locked rather than hidden: hiding them
+      // would make "select all" look like it had missed people, and unticking
+      // one here would revoke access this dialog is not for revoking.
+      granted: bulkSaved.value.has(id),
+    };
+  });
+});
+
+const bulkSelectableRows = computed(() =>
+  bulkRows.value.filter((row) => !row.granted)
+);
+const bulkSelectedCount = computed(() => bulkSelected.value.size);
+const bulkAllSelected = computed(
+  () =>
+    bulkSelectableRows.value.length > 0 &&
+    bulkSelectableRows.value.every((row) => bulkSelected.value.has(row.subjectId))
+);
+const bulkGrantedCount = computed(
+  () => bulkRows.value.filter((row) => row.granted).length
+);
+
+const bulkEmptyText = computed(() => {
+  if (bulkLoading.value) return "Loading...";
+  if (bulkSearch.value.trim()) return "No one matches this search.";
+  if (providerServiceFilter.value) return "No one in this service can be enrolled yet.";
+  return "No service provider people can be enrolled at this site yet.";
+});
+
+function isBulkSelected(subjectId: string) {
+  return bulkSelected.value.has(subjectId);
+}
+
+function toggleBulkRow(subjectId: string, selected: boolean) {
+  const next = new Set(bulkSelected.value);
+  if (selected) next.add(subjectId);
+  else next.delete(subjectId);
+  bulkSelected.value = next;
+}
+
+/* Select-all acts on the ROWS IN FRONT OF THE OPERATOR - what the service filter
+   and the search have left - never on the whole estate. A tick box cannot
+   quietly grant a door to people who are not on screen. */
+function toggleBulkAll(selected: boolean) {
+  const next = new Set(bulkSelected.value);
+  for (const row of bulkSelectableRows.value) {
+    if (selected) next.add(row.subjectId);
+    else next.delete(row.subjectId);
+  }
+  bulkSelected.value = next;
+}
+
+/**
+ * Open the bulk dialog, after reading what the reader already holds.
+ *
+ * The saved set is fetched EVERY time rather than cached: it is the merge base
+ * for a write that replaces the reader's assignments, and a stale one would
+ * revoke whoever was granted in between.
+ */
+async function openBulkAdd() {
+  const readerId =
+    selectedReaderId.value || form.reader || readers.value[0]?._id;
+  if (!readerId) {
+    showToast("Select a HID reader before adding people in bulk.", "error");
+    return;
+  }
+  /* The permissions endpoints REQUIRE an org - `schemaHidPermissionScopeQuery`
+     has it as `required()`, unlike `createIdentity`, which falls back to the
+     site's own. Both pages that mount this component pass one, so this is a
+     guard against a 400 that would read as a server fault. */
+  if (!props.org) {
+    showToast(
+      "This screen cannot grant access in bulk without an organization.",
+      "error"
+    );
+    return;
+  }
+  bulkSearch.value = "";
+  bulkSelected.value = new Set();
+  bulkSaved.value = new Map();
+  bulkDialog.value = true;
+  bulkLoading.value = true;
+  try {
+    if (!providersLoaded.value) await loadProviderCandidates();
+    const response = await getSitePermissions(props.site, props.org, readerId);
+    bulkSaved.value = seedAssignments(response?.data?.assignments ?? []);
+  } catch (error: unknown) {
+    // Closed rather than left open on an empty merge base: saving from here
+    // would send only the ticked people and revoke everybody else.
+    bulkDialog.value = false;
+    showToast(
+      apiReason(error) || "Unable to read this reader's current access.",
+      "error"
+    );
+  } finally {
+    bulkLoading.value = false;
+  }
+}
+
+/** Grant the ticked people, keeping everyone the reader already admits. */
+async function saveBulkAdd() {
+  if (bulkSaving.value || !bulkSelected.value.size) return;
+  const readerId =
+    selectedReaderId.value || form.reader || readers.value[0]?._id;
+  if (!readerId) {
+    showToast("Select a HID reader before adding people in bulk.", "error");
+    return;
+  }
+
+  bulkSaving.value = true;
+  try {
+    // Seeded from what the server holds, so every category the reader already
+    // admits survives this write.
+    let draft: HidAssignmentState = new Map(bulkSaved.value);
+    for (const subjectId of bulkSelected.value) {
+      draft = setAssignment(
+        draft,
+        bulkSaved.value,
+        subjectId,
+        // A provider employee's grant is stored under the STAFF category: core's
+        // `permissionSubjectOfIdentity` reads the `member` link and cannot see
+        // this dropdown, and that category's subject list already includes these
+        // people. See `permissionCategoryOf`.
+        permissionCategoryOf("service_provider_staff") as THidPermissionCategory,
+        true
+      );
+    }
+    const added = bulkSelected.value.size;
+    await updateSitePermissions(
+      props.site,
+      props.org,
+      readerId,
+      toAssignmentPayload(draft)
+    );
+    // Both dialogs close and the list is re-read: the reconcile has just created
+    // a HID user for each person, so the roster behind this dialog is stale.
+    bulkDialog.value = false;
+    formDialog.value = false;
+    await loadUsers();
+    showToast(
+      `${added} ${added === 1 ? "person" : "people"} can now use this reader. `
+        + "They add their own face, QR or PIN from their app.",
+      "success"
+    );
+  } catch (error: unknown) {
+    showToast(
+      apiReason(error) || "Unable to give these people access to this reader.",
+      "error"
+    );
+  } finally {
+    bulkSaving.value = false;
+  }
+}
+
 /**
  * Switching type clears the chosen subject, and nothing else.
  *
@@ -1372,15 +2364,20 @@ function loadMoreMembers() {
  * choice, so they clear with it.
  */
 async function onSubjectCategoryChanged() {
-  REMEMBERED_SUBJECT_CATEGORY.value = form.subjectCategory;
+  REMEMBERED_SUBJECT_CATEGORY.value = form.subjectCategory as HidEnrolmentSubject;
   form.subjectId = "";
   form.subjectRole = "";
   form.name = "";
   residentConflict.value = null;
 
-  if (!isResidentSubject.value && !membersLoaded.value) {
+  // Each list is fetched on first use and then kept, so flipping between the
+  // three options costs one request each rather than one per flip.
+  if (isMemberSubject.value && !membersLoaded.value) {
     await loadMemberCandidates();
   }
+  if (isProviderSubject.value && !providersLoaded.value) {
+    await loadProviderCandidates();
+  }
 }
 
 /* The staff equivalent of `onResidentChanged`. */
@@ -1576,7 +2573,14 @@ async function init() {
   await loadUsers();
 }
 
-async function loadReaders() {
+/**
+ * `resolveSelection` is off when the enrolment dialog refreshes this.
+ *
+ * The tail of this function re-resolves the SHARED reader selection, which is
+ * right on first load and wrong from a dialog: opening Enroll should not be able
+ * to move the reader the operator picked on the screen behind it.
+ */
+async function loadReaders(options: { resolveSelection?: boolean } = {}) {
   if (!props.site) return;
   const response = await getReaders({ site: props.site, page: 1, limit: 100 });
   const responseRecord = toRecord(response);
@@ -1590,7 +2594,9 @@ async function loadReaders() {
      resolver refuses a remembered reader that is not this site's, so a site
      switch or a deleted reader falls back to the first rather than querying
      an id the site does not own. */
-  selectedReaderId.value = resolveForSite(props.site, readers.value);
+  if (options.resolveSelection !== false) {
+    selectedReaderId.value = resolveForSite(props.site, readers.value);
+  }
 }
 
 /**
@@ -1726,9 +2732,19 @@ function resetForm() {
   selectedPhotoFile.value = null;
   removePhotoRequested.value = false;
   facialEnrolled.value = false;
-  // The type the operator last enrolled, not a hard "resident": somebody adding
-  // a shift of guards should not re-pick Member for each one.
-  form.subjectCategory = REMEMBERED_SUBJECT_CATEGORY.value;
+  /*
+   * The type the operator last enrolled, not a hard "resident": somebody adding
+   * a shift of guards should not re-pick Member for each one.
+   *
+   * UNLESS this reader does not serve it. `AppSelect` draws blank when its value
+   * is not among its items - the same way "All services" drew blank when its
+   * value was "" - so the remembered type falls back to the first one on offer.
+   */
+  const offered = subjectCategoryOptions.value;
+  const remembered = REMEMBERED_SUBJECT_CATEGORY.value;
+  form.subjectCategory = offered.some((option) => option.value === remembered)
+    ? remembered
+    : (offered[0]?.value ?? remembered);
   form.subjectId = "";
   form.subjectRole = "";
   residentConflict.value = null;
@@ -1925,11 +2941,25 @@ async function checkSubjectEnrollment() {
 
 async function openEnroll() {
   selectedUser.value = null;
-  resetForm();
+  /*
+   * READERS FIRST, and before `resetForm`.
+   *
+   * The audiences decide which types are offered and which one the form opens
+   * on, and they are edited on a different screen - so the copy loaded when this
+   * screen mounted can be stale by the time somebody clicks Enroll. Without this
+   * the dropdown offers a type the reader no longer serves until the page is
+   * reloaded.
+   *
+   * Folded into the same wait as the id allocations so it costs no extra delay,
+   * and with the shared selection left alone: opening Enroll must not move the
+   * reader chosen on the screen behind it.
+   */
   const [hidUserId, registration] = await Promise.all([
-    getNextUid(),
-    getNextRegistration(),
+    getNextUid(selectedReaderId.value),
+    getNextRegistration(selectedReaderId.value),
+    loadReaders({ resolveSelection: false }),
   ]);
+  resetForm();
   form.hidUserId = hidUserId;
   form.registration = registration;
   formDialog.value = true;
@@ -1938,8 +2968,11 @@ async function openEnroll() {
   // onto Member with an empty list. Loaded after the dialog is up, not before:
   // the request must not delay it, and the picker carries its own loading
   // placeholder. Fresh each opening, because staff change between them.
+  readerOutcomes.value = [];
   resetMemberCandidates();
-  if (!isResidentSubject.value) await loadMemberCandidates();
+  resetProviderCandidates();
+  if (isMemberSubject.value) await loadMemberCandidates();
+  if (isProviderSubject.value) await loadProviderCandidates();
 }
 
 async function openEdit(user: HidUser) {
@@ -1961,14 +2994,21 @@ async function openEdit(user: HidUser) {
   removePinRequested.value = false;
   form.photoPreview = "";
   facialEnrolled.value = hasFacialEnrollment(user);
-  form.subjectCategory = user.person
-    ? "resident"
-    : user.serviceProvider
-    ? "service_provider"
-    : "property_management";
-  form.subjectId = String(
-    user.person || user.member || user.serviceProvider || ""
-  );
+  /*
+   * ONE reading of the links, shared with the Access Permissions screen.
+   * `subjectOfIdentity` knows that a `member` link is how BOTH a
+   * property-management member and a service provider's own employee are stored,
+   * and uses the identity's `type` to tell them apart - without which a
+   * contractor's edit would be headed "Member".
+   *
+   * This was the same ternary written out inline. The other copy of it went
+   * stale, so neither is written out any more.
+   */
+  const editedSubject = subjectOfIdentity(user as Record<string, unknown>);
+  form.subjectCategory = enrolmentSubjectOfCategory(
+    editedSubject?.category
+  ) as TEnrolmentSubjectValue;
+  form.subjectId = editedSubject?.subjectId ?? "";
   // The resident this user already holds is not a conflict with itself. A real
   // one only appears if the operator reassigns the row to somebody else.
   residentConflict.value = null;
@@ -1984,8 +3024,22 @@ async function openEdit(user: HidUser) {
   if (form.unit) await loadUnitPeople();
   selectedPhotoFile.value = null;
   removePhotoRequested.value = false;
+  readerOutcomes.value = [];
+  editPlaces.value = [];
   formDialog.value = true;
 
+  // After the dialog is up, like the candidate lists: it is several requests and
+  // the form must not wait on them. A failure leaves the list empty and `saveUser`
+  // resolves it again rather than skipping readers.
+  editPlacesLoading.value = true;
+  try {
+    editPlaces.value = await findPersonReaders(user);
+  } catch (error: unknown) {
+    console.error("Unable to work out which readers hold this person:", error);
+  } finally {
+    editPlacesLoading.value = false;
+  }
+
   try {
     const hidUserId = toHidNumericId(user.hidUserId);
     const [pinStatus, passwordStatus] = await Promise.all([
@@ -2004,9 +3058,26 @@ function openView(user: HidUser) {
   viewDialog.value = true;
 }
 
-function openDelete(user: HidUser) {
+async function openDelete(user: HidUser) {
   selectedUser.value = user;
+  // Always reopened narrow. A scope carried over from the last delete would
+  // widen a delete the operator did not widen.
+  deleteScope.value = "here";
+  deleteOutcomes.value = [];
+  deletePlaces.value = [];
   deleteDialog.value = true;
+
+  deletePlacesLoading.value = true;
+  try {
+    deletePlaces.value = await findPersonReaders(user);
+  } catch (error: unknown) {
+    // The reach is what the scope choice is FOR, so without it the dialog
+    // offers only this reader rather than guessing at "all".
+    console.error("Unable to work out which readers hold this person:", error);
+    deletePlaces.value = [];
+  } finally {
+    deletePlacesLoading.value = false;
+  }
 }
 
 function triggerPhotoInput() {
@@ -2081,6 +3152,8 @@ async function saveUser() {
     : !selectedUser.value && !form.subjectId
     ? isResidentSubject.value
       ? "a resident"
+      : isProviderSubject.value
+      ? "a person"
       : "a member"
     : !form.name
     ? "a name"
@@ -2122,7 +3195,6 @@ async function saveUser() {
   }
 
   saving.value = true;
-  let newlyCreatedHidUserId: number | undefined;
   try {
     const hidUser = toHidUserObject({
       hidUserId: form.hidUserId,
@@ -2139,27 +3211,7 @@ async function saveUser() {
     // an empty string as a link being removed and then refuses the write for
     // having no subject at all. Omitting the keys is what makes it keep the
     // subject the record already has.
-    const subjectLink = form.subjectId
-      ? {
-          person: form.subjectCategory === "resident" ? form.subjectId : "",
-          member:
-            form.subjectCategory === "property_management"
-              ? form.subjectId
-              : "",
-          serviceProvider:
-            form.subjectCategory === "service_provider" ? form.subjectId : "",
-          type: (form.subjectCategory === "resident"
-            ? "resident"
-            : form.subjectCategory === "service_provider"
-            ? "contractor"
-            : "staff") as
-            | "resident"
-            | "staff"
-            | "contractor"
-            | "visitor"
-            | "unknown",
-        }
-      : {};
+    const subjectLink = subjectLinkOf(form.subjectCategory, form.subjectId);
 
     const payload = {
       hidUserId: String(hidUser.id),
@@ -2187,61 +3239,359 @@ async function saveUser() {
     };
 
     if (selectedUser.value) {
-      await updateHidUserOnReader(readerId, hidUser);
-      const facialResult = await syncFacialImage(readerId, hidUser.id);
-      applyFacialResult(payload.metadata, facialResult);
-      payload.metadata.pinEnrolled = await syncAccessPin(readerId, hidUser.id);
-      payload.metadata.passwordSet = await syncPassword(readerId, hidUser.id);
-      if (selectedUser.value._id) {
-        await updateIdentity(selectedUser.value._id, payload);
-      } else if (form.subjectId) {
-        await saveIdentityOnReader(readerId, payload);
+      /*
+       * AN EDIT REACHES EVERY READER THIS PERSON IS ON.
+       *
+       * After a fan-out they are on several, and a change applied to one leaves
+       * the others wrong in a way nothing on screen would show: a PIN changed at
+       * the lobby and not at the gym means the person has two PINs and no way to
+       * know which door wants which.
+       *
+       * Each reader knows them by its OWN HID user id, so the id comes from that
+       * reader's identity rather than from the row on screen.
+       *
+       * REGISTRATION IS NOT FANNED OUT. Each reader allocates its own from its
+       * own numbering, and one number written to all of them would collide with
+       * whatever else holds it there.
+       */
+      const places = editPlaces.value.length
+        ? editPlaces.value
+        : await findPersonReaders(selectedUser.value);
+      readerOutcomes.value = places.map((place) => ({
+        readerId: place.readerId,
+        name: place.name,
+        step: "waiting" as const,
+      }));
+      fanOutRunning.value = true;
+      for (const place of places) {
+        setReaderStep(place.readerId, "working");
+        try {
+          const readerUser = toHidUserObject({
+            hidUserId: place.hidUserId,
+            name: form.name,
+            // This reader's own, left exactly as it is.
+            registration: "",
+          });
+          if (!readerUser.id) throw new Error("This reader has no usable HID user ID for this person.");
+          await updateHidUserOnReader(place.readerId, {
+            ...readerUser,
+            registration: "",
+          });
+          const perReader = { ...payload, metadata: { ...payload.metadata } };
+          applyFacialResult(
+            perReader.metadata,
+            await syncFacialImage(place.readerId, readerUser.id),
+          );
+          perReader.metadata.pinEnrolled = await syncAccessPin(place.readerId, readerUser.id);
+          perReader.metadata.passwordSet = await syncPassword(place.readerId, readerUser.id);
+          if (place.identityId) {
+            await updateIdentity(place.identityId, {
+              ...perReader,
+              hidUserId: place.hidUserId,
+              // Untouched: see above.
+              registration: undefined as unknown as string,
+            });
+          }
+          setReaderStep(place.readerId, "done");
+        } catch (error: unknown) {
+          setReaderStep(place.readerId, "failed", {
+            message: getHidErrorMessage(error),
+            retryable: false,
+          });
+          console.error(`Unable to update this person on reader ${place.readerId}:`, error);
+        }
       }
-      // else: a user the reader holds and we have never linked. The photo, PIN
-      // and password above are already on the device; creating an identity for
-      // it would need a subject we deliberately no longer ask for here.
+      fanOutRunning.value = false;
+
+      const summary = editFanOutSummary(readerOutcomes.value, Boolean(form.accessPin));
+      await loadUsers();
+      if (summary.tone === "success") formDialog.value = false;
+      showToast(summary.message, summary.tone === "success" ? "success" : "error");
+      return;
     } else {
-      const created = await createHidUserOnReader(readerId, hidUser);
-      if (created) newlyCreatedHidUserId = hidUser.id;
-      const facialResult = await syncFacialImage(readerId, hidUser.id);
-      applyFacialResult(payload.metadata, facialResult);
-      payload.metadata.pinEnrolled = await syncAccessPin(readerId, hidUser.id);
-      payload.metadata.passwordSet = await syncPassword(readerId, hidUser.id);
-      await saveIdentityOnReader(readerId, payload);
-      selectedReaderId.value = readerId;
+      /*
+       * EVERY READER THAT SERVES THIS PERSON, one at a time.
+       *
+       * Sequential rather than parallel on purpose: each reader is an embedded
+       * server, several of them are reached over the same VPN, and the operator
+       * is watching a list that only means anything if the rows settle in order.
+       * It is also what keeps a failure attributable to one reader.
+       *
+       * The loop does not stop at the first failure. A reader being asleep is the
+       * ordinary case, and abandoning the rest would deny somebody three doors
+       * because of a fourth.
+       */
+      const targets = enrolmentTargets.value.targets;
+      if (!targets.length) {
+        showToast(
+          "No reader at this site serves this kind of person. Switch an account type"
+            + " on for a reader before enrolling anybody.",
+          "error",
+        );
+        return;
+      }
+
+      readerOutcomes.value = targets.map((target) => ({
+        readerId: target.readerId,
+        name: target.name,
+        step: "waiting" as const,
+      }));
+      fanOutRunning.value = true;
+      for (const target of targets) {
+        setReaderStep(target.readerId, "working");
+        try {
+          await enrolOnReader(target.readerId);
+          setReaderStep(target.readerId, "done");
+        } catch (error: unknown) {
+          setReaderStep(target.readerId, "failed", {
+            message: getHidErrorMessage(error),
+            // Retry needs no photo in hand once one is on file - that is what
+            // the stored image bought. Without it, a retry can only work while
+            // the capture is still in this dialog.
+            retryable: true,
+          });
+          console.error(`Unable to enroll on reader ${target.readerId}:`, error);
+        }
+      }
+      fanOutRunning.value = false;
+
+      const summary = fanOutSummary(readerOutcomes.value);
+      await loadUsers();
+      /*
+       * THE DIALOG STAYS OPEN WHEN ANYTHING FAILED, because the Retry lives in
+       * it. Closing would leave the operator with a toast naming readers they
+       * can no longer act on.
+       */
+      if (summary.tone === "success") formDialog.value = false;
+      showToast(
+        summary.message,
+        summary.tone === "success" ? "success" : "error",
+      );
+      return;
     }
 
     formDialog.value = false;
     await loadUsers();
-    showToast(
-      selectedUser.value?._id
-        ? "HID user updated on reader."
-        : "HID user enrolled on reader."
-    );
+    showToast("HID user updated on reader.");
+  } catch (error: unknown) {
+    // No rollback here any more: `enrolOnReader` undoes ITS OWN reader, which is
+    // the only place a HID user is created. A second copy of that logic here
+    // could only ever fire for a reader this function no longer touches.
+    console.error("Unable to save HID user:", error);
+    showToast(getHidErrorMessage(error), "error");
+  } finally {
+    saving.value = false;
+    fanOutRunning.value = false;
+    // Discard the captured image on every path. On a part-way failure this is what stops
+    // the photo lingering in the open form after a retry or a cancel.
+    form.photoPreview = "";
+    selectedPhotoFile.value = null;
+    removePhotoRequested.value = false;
+  }
+}
+
+/**
+ * ENROL THIS PERSON ON ONE READER.
+ *
+ * Lifted out of `saveUser` so the fan-out loop and the per-reader Retry run the
+ * SAME sequence. Two paths that each "enrol on a reader" would drift, and the
+ * one that drifts is the retry - the path nobody exercises until something has
+ * already gone wrong.
+ *
+ * Every reader allocates its own UID and registration number, from the device
+ * that will hold them. Reading one reader's numbering and writing it to another
+ * is how two people end up sharing a UID.
+ *
+ * Rolls back ITS OWN reader only. A reader that failed should not undo the three
+ * that worked - the person genuinely has access on those, and the whole point of
+ * a per-reader result is that a partial enrolment is a real, recoverable state.
+ */
+async function enrolOnReader(readerId: string) {
+  const uid = await getNextUid(readerId);
+  const registration = await getNextRegistration(readerId);
+  const hidUser = toHidUserObject({
+    hidUserId: uid,
+    name: form.name,
+    registration,
+  });
+  if (!hidUser.id) {
+    throw new Error("This reader did not return a usable HID user ID.");
+  }
+
+  let created = false;
+  try {
+    created = Boolean(await createHidUserOnReader(readerId, hidUser));
+    const payload = {
+      hidUserId: String(hidUser.id),
+      registration,
+      ...subjectLinkOf(form.subjectCategory, form.subjectId),
+      status: "active" as const,
+      metadata: {
+        name: form.name,
+        block: form.block,
+        level: form.level,
+        unit: form.unit,
+        unitLabel: buildUnitLabel(),
+        facialEnrolled: false,
+        facialEnrolledAt: "",
+        facialData: "",
+        imageTimestamp: "",
+        facialScores: {},
+        pinEnrolled: false,
+        passwordSet: false,
+        hidPhysicalCards: [],
+      },
+    };
+    applyFacialResult(payload.metadata, await syncFacialImage(readerId, hidUser.id));
+    payload.metadata.pinEnrolled = await syncAccessPin(readerId, hidUser.id);
+    payload.metadata.passwordSet = await syncPassword(readerId, hidUser.id);
+    await saveIdentityOnReader(readerId, payload);
   } catch (error: unknown) {
-    if (newlyCreatedHidUserId) {
+    if (created) {
       try {
         await runObjectOperation(readerId, {
           operation: "destroy",
           object: "users",
-          where: { users: { id: newlyCreatedHidUserId } },
+          where: { users: { id: hidUser.id } },
         });
       } catch (rollbackError) {
         console.error(
-          "Unable to roll back the partially enrolled HID user:",
-          rollbackError
+          `Unable to roll back the partially enrolled HID user on reader ${readerId}:`,
+          rollbackError,
         );
       }
     }
-    console.error("Unable to save HID user:", error);
+    throw error;
+  }
+}
+
+/**
+ * TRY ONE READER AGAIN.
+ *
+ * Runs the same `enrolOnReader` the fan-out ran, so the retry cannot drift from
+ * the thing it is retrying - and the drift would be invisible until somebody
+ * needed it.
+ *
+ * When the capture is no longer in the dialog - reopened, or a photo discarded
+ * after the first attempt - the face comes from the copy on file instead, which
+ * is the whole reason the image is stored. Without that, retrying a reader that
+ * was asleep meant bringing the person back.
+ */
+/**
+ * This person's iService account id, read off a reader that already has them.
+ *
+ * The form holds a SUBJECT - a resident record, a membership - and the account
+ * behind it is resolved server-side, so the only way to learn it on this side is
+ * to read back an identity that has been written. Returns "" when no reader has
+ * one yet, which is also the case where there is no stored photo to push.
+ */
+async function enrolledAccountId() {
+  const done = readerOutcomes.value.find((outcome) => outcome.step === "done");
+  if (!done || !form.subjectId) return "";
+  try {
+    const identity = await findResidentIdentity(done.readerId, form.subjectId);
+    return String(identity?.user ?? "");
+  } catch (error: unknown) {
+    console.error("Unable to resolve the account behind this enrolment:", error);
+    return "";
+  }
+}
+
+/**
+ * EVERY READER THAT HOLDS THIS PERSON.
+ *
+ * Needed by both editing and deleting, because after a fan-out a person is on
+ * several readers and each one knows them by a DIFFERENT HID user id. Acting on
+ * the id from the reader on screen would write to the wrong user on every other
+ * reader - or to nobody, which is worse because it looks like it worked.
+ *
+ * Matched on the ACCOUNT, not the subject record. `listIdentities` checks
+ * `person`, `member`, `serviceProvider` and `user`, and the account is the one
+ * field every row carries however it was written - an enrolment, a bulk grant or
+ * a reconcile. A row written by the reconcile may hold no subject at all.
+ *
+ * Falls back to the reader on screen when there is no account to match: a device
+ * user we have never linked exists on that reader and nowhere else we can prove.
+ */
+async function findPersonReaders(user: HidUser): Promise<TPersonPlace[]> {
+  const here = {
+    readerId: selectedReaderId.value,
+    name: selectedReader.value?.name || "this reader",
+    identityId: await findIdentityIdForUser(selectedReaderId.value, user),
+    hidUserId: String(user.hidUserId ?? ""),
+  };
+
+  const current = await findExistingIdentityOnReader(selectedReaderId.value, {
+    hidUserId: String(user.hidUserId ?? ""),
+    registration: String(user.registration ?? ""),
+    cardNo: String(user.cardNo ?? ""),
+    metadata: {},
+  }).catch(() => null);
+  const accountId = String(current?.user ?? "").trim();
+  if (!accountId) return [here];
+
+  const found: TPersonPlace[] = [];
+  for (const reader of readers.value) {
+    const readerId = String(reader._id ?? "");
+    if (!readerId) continue;
+    try {
+      const response = await getIdentities(readerId, {
+        page: 1,
+        // A person should hold one per reader; a few are asked for so a stray
+        // duplicate is seen rather than hidden behind the first row.
+        limit: 5,
+        subject: accountId,
+      });
+      const items = readCandidatePage(response).items.map(toHidUser);
+      for (const identity of items) {
+        if (!identity._id) continue;
+        found.push({
+          readerId,
+          name: String(reader.name ?? "") || "HID Reader",
+          identityId: identity._id,
+          hidUserId: String(identity.hidUserId ?? ""),
+        });
+      }
+    } catch (error: unknown) {
+      // One unreachable reader must not hide the others. It is reported as a
+      // failure when acted on, not silently dropped from the count.
+      console.error(`Unable to check reader ${readerId} for this person:`, error);
+    }
+  }
+  return found.length ? found : [here];
+}
+
+async function retryReader(outcome: THidReaderOutcome) {
+  if (fanOutRunning.value) return;
+  fanOutRunning.value = true;
+  setReaderStep(outcome.readerId, "working", { message: "" });
+  try {
+    await enrolOnReader(outcome.readerId);
+    /*
+     * NO PHOTO IN HAND, so use the one on file.
+     *
+     * `enrolOnReader` sends the capture when the dialog still holds it. Reopened
+     * after a failure, it does not - and that is exactly when the stored image
+     * earns its keep. The account id is read off a reader that already worked,
+     * because it is the server that resolves a subject to an account and the
+     * form only ever knew the subject.
+     */
+    if (!selectedPhotoFile.value) {
+      const accountId = await enrolledAccountId();
+      if (accountId) await pushStoredFace(outcome.readerId, accountId);
+    }
+    setReaderStep(outcome.readerId, "done", { message: "" });
+    await loadUsers();
+    showToast(`Enrolled on ${outcome.name}.`);
+  } catch (error: unknown) {
+    setReaderStep(outcome.readerId, "failed", {
+      message: getHidErrorMessage(error),
+      retryable: true,
+    });
+    console.error(`Retry failed on reader ${outcome.readerId}:`, error);
     showToast(getHidErrorMessage(error), "error");
   } finally {
-    saving.value = false;
-    // Discard the captured image on every path. On a part-way failure this is what stops
-    // the photo lingering in the open form after a retry or a cancel.
-    form.photoPreview = "";
-    selectedPhotoFile.value = null;
-    removePhotoRequested.value = false;
+    fanOutRunning.value = false;
   }
 }
 
@@ -2373,41 +3723,84 @@ async function findIdentityIdForUser(readerId: string, user: HidUser) {
   }
 }
 
+/**
+ * Remove this person from ONE reader: the admin role, the PIN, the device user,
+ * then our own row.
+ *
+ * Order matters. The identity id is resolved by the caller before anything is
+ * destroyed, because it is read from our own records and a failure there costs
+ * nothing - whereas a device user destroyed with no row left to clear is the
+ * orphan that `findIdentityIdForUser` exists to prevent.
+ */
+async function deleteOnReader(place: TPersonPlace) {
+  const hidUserId = toHidNumericId(place.hidUserId);
+  await syncHidUserRole(place.readerId, hidUserId, false);
+  await deleteUserPin(place.readerId, hidUserId);
+  await deleteHidUserFromReader(place.readerId, place.hidUserId);
+  if (place.identityId) {
+    // Soft-deletes the row AND removes the access grant that let this person
+    // through, which is what stops the next reconcile rebuilding them.
+    await deleteIdentity(place.identityId);
+  }
+}
+
 async function deleteUser() {
   if (!selectedUser.value) return;
 
-  deleting.value = true;
-  try {
-    // Resolved BEFORE the device user is destroyed: this reads our own records,
-    // and doing it first means a failure here costs nothing.
-    const identityId = await findIdentityIdForUser(
+  const here: TPersonPlace = {
+    readerId: selectedReaderId.value,
+    name: selectedReader.value?.name || "this reader",
+    identityId: await findIdentityIdForUser(
       selectedReaderId.value,
       selectedUser.value
-    );
-    await syncHidUserRole(
-      selectedReaderId.value,
-      toHidNumericId(selectedUser.value.hidUserId),
-      false
-    );
-    await deleteUserPin(
-      selectedReaderId.value,
-      toHidNumericId(selectedUser.value.hidUserId)
-    );
-    await deleteHidUserFromReader(selectedReaderId.value, selectedUser.value);
-    if (identityId) {
-      // Soft-deletes the row AND removes the access grant that let this person
-      // through, which is what stops the next reconcile rebuilding them.
-      await deleteIdentity(identityId);
+    ),
+    hidUserId: String(selectedUser.value.hidUserId ?? ""),
+  };
+  const places = deleteScope.value === "all" && deletePlaces.value.length
+    ? deletePlaces.value
+    : [deletePlaces.value.find((p) => p.readerId === here.readerId) ?? here];
+
+  deleting.value = true;
+  deleteOutcomes.value = places.map((place) => ({
+    readerId: place.readerId,
+    name: place.name,
+    step: "waiting" as const,
+  }));
+  try {
+    for (const place of places) {
+      setDeleteStep(place.readerId, "working");
+      try {
+        await deleteOnReader(place);
+        setDeleteStep(place.readerId, "done");
+      } catch (error: unknown) {
+        // One reader refusing must not leave the others untouched - the point of
+        // "all readers" is that the person loses the doors that CAN be reached.
+        setDeleteStep(place.readerId, "failed", {
+          message: getHidErrorMessage(error),
+        });
+        console.error(`Unable to delete this person from reader ${place.readerId}:`, error);
+      }
     }
-    deleteDialog.value = false;
-    await loadUsers();
-    showToast("HID user deleted from reader.");
-  } catch (error: unknown) {
-    console.error("Unable to delete HID user:", error);
-    showToast(getHidErrorMessage(error), "error");
   } finally {
     deleting.value = false;
   }
+
+  const summary = deleteFanOutSummary(deleteOutcomes.value);
+  await loadUsers();
+  // A reader still holding this person keeps the dialog open, with its name on
+  // screen, so the operator can see which door is still live and try again.
+  if (summary.tone === "success") deleteDialog.value = false;
+  showToast(summary.message, summary.tone === "success" ? "success" : "error");
+}
+
+function setDeleteStep(
+  readerId: string,
+  step: THidReaderStep,
+  extra: { message?: string } = {},
+) {
+  deleteOutcomes.value = deleteOutcomes.value.map((outcome) => (
+    outcome.readerId === readerId ? { ...outcome, step, ...extra } : outcome
+  ));
 }
 
 async function saveIdentityOnReader(
@@ -2523,8 +3916,8 @@ async function updateHidUserOnReader(
   });
 }
 
-async function deleteHidUserFromReader(readerId: string, user: HidUser) {
-  const id = toHidNumericId(user.hidUserId);
+async function deleteHidUserFromReader(readerId: string, hidUserId: unknown) {
+  const id = toHidNumericId(hidUserId);
   if (!readerId || !id) return;
 
   await runObjectOperation(readerId, {
@@ -2965,9 +4358,16 @@ function getFacialData(user: HidUser) {
   );
 }
 
-async function getNextUid() {
-  const readerIds = await getExistingHidReaderIds();
-  const maxNumber = users.value.reduce((max, user) => {
+async function getNextUid(readerId: string) {
+  const readerIds = await getExistingHidReaderIds(readerId);
+  /*
+   * `users.value` is the ROSTER ON SCREEN, which belongs to the selected reader.
+   * It is still consulted for the one reader the operator is looking at - it
+   * catches a number the device has but has not reported - and it is simply a
+   * second opinion for the others, never the only one: `readerIds` above comes
+   * from the reader being allocated for.
+   */
+  const maxNumber = (readerId === selectedReaderId.value ? users.value : []).reduce((max, user) => {
     const match = String(user.hidUserId ?? "").match(/^UID(\d+)$/i);
     return Math.max(
       max,
@@ -2978,39 +4378,48 @@ async function getNextUid() {
   return `UID${String(nextNumber).padStart(6, "0")}`;
 }
 
-async function getNextRegistration() {
-  const existingUsers = await getExistingHidReaderUsers();
-  const registrations = existingUsers
-    .map((user) => String(user.registration || "").trim())
-    .filter(Boolean);
-  const numericRegistrations = registrations
-    .map((registration) => {
-      const match = registration.match(/^(\d+)$/);
-      return match
-        ? { value: Number(match[1]), width: match[1].length }
-        : undefined;
-    })
-    .filter((item): item is { value: number; width: number } => Boolean(item));
-  const maxRegistration = numericRegistrations.reduce(
-    (max, item) => Math.max(max, item.value),
-    0
-  );
-  const width = Math.max(6, ...numericRegistrations.map((item) => item.width));
-
-  return String(maxRegistration + 1).padStart(width, "0");
+/**
+ * The next registration number ON THIS READER.
+ *
+ * Every reader numbers its own users (see `enrolOnReader`), so the list has to
+ * come from the reader being allocated for. This used to read it with no
+ * reader at all, which `getExistingHidReaderUsers` answers with an empty list,
+ * so every enrolment proposed 000001 and the second person on a reader was
+ * refused with "HID Amico identity already exists for this reader"
+ * (2026-10-20, Landscape Management on HID 1 after Pest Management took
+ * 000001). The roster on screen is the second opinion for the selected reader,
+ * exactly as `getNextUid` consults it: it catches a number the device holds
+ * but has not reported.
+ */
+async function getNextRegistration(readerId: string) {
+  const existingUsers = await getExistingHidReaderUsers(readerId, ["id", "registration"]);
+  const onScreen = readerId === selectedReaderId.value ? users.value : [];
+  return nextRegistration([
+    ...existingUsers.map((user) => user.registration),
+    ...onScreen.map((user) => user.registration),
+  ]);
 }
 
-async function getExistingHidReaderIds() {
-  const users = await getExistingHidReaderUsers(["id"]);
+async function getExistingHidReaderIds(readerId: string) {
+  const users = await getExistingHidReaderUsers(readerId, ["id"]);
   return users
     .map((user) => toHidNumericId(user.hidUserId) || 0)
     .filter((value) => Number.isInteger(value) && value > 0);
 }
 
-async function getExistingHidReaderUsers(fields?: string[]) {
-  if (!selectedReaderId.value) return [];
+/**
+ * A reader's own `users` rows.
+ *
+ * `readerId` is a parameter rather than the screen's selection, because every
+ * reader numbers its own users: enrolling one person across three readers means
+ * three different UIDs and three different registration numbers, each allocated
+ * from the device that will hold it. Reading one reader's numbering and writing
+ * it to another is how two people end up sharing a UID.
+ */
+async function getExistingHidReaderUsers(readerId: string, fields?: string[]) {
+  if (!readerId) return [];
   try {
-    const response = await runObjectOperation(selectedReaderId.value, {
+    const response = await runObjectOperation(readerId, {
       operation: "load",
       object: "users",
       ...(fields ? { fields } : {}),
@@ -3283,6 +4692,97 @@ watch(selectedReaderId, (value) => {
   color: var(--err);
 }
 
+/* The bulk button and the sentence that says what it does. Stacked rather than
+   side by side: the sentence is the part that stops somebody expecting this to
+   enrol faces, so it must not be squeezed into a margin at narrow widths. */
+/* The reader list, and the same list as a progress strip once a save starts.
+   Rows rather than chips: each one carries a reason or a failure, and those are
+   sentences. */
+.hid-fanout {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.hid-fanout__row {
+  display: flex;
+  align-items: flex-start;
+  gap: 8px;
+  padding: 6px 8px;
+  border-radius: 6px;
+  background: var(--surface2, rgba(127, 127, 127, 0.06));
+}
+
+.hid-fanout__body {
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+}
+
+.hid-fanout__body strong {
+  font-size: 13px;
+  font-weight: 700;
+}
+
+/* Reasons and failures wrap rather than clip: a truncated explanation is worse
+   than none, because it reads as a bug rather than as a setting. */
+.hid-fanout__body span {
+  color: var(--muted);
+  font-size: 12px;
+  line-height: 1.4;
+  white-space: normal;
+}
+
+.hid-fanout__row--excluded {
+  opacity: 0.72;
+}
+
+.hid-fanout__row--failed {
+  color: var(--err);
+}
+
+.hid-fanout__row--done {
+  color: var(--ok, var(--accent-text));
+}
+
+.hid-bulk-cta {
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: 4px;
+}
+
+.hid-bulk-cta .field-hint {
+  margin: 0;
+}
+
+/* Checkbox column only as wide as the control, so the three columns that carry
+   meaning keep the width. */
+.hid-bulk-table__check {
+  width: 44px;
+  padding-right: 0 !important;
+}
+
+.hid-bulk-table :deep(th) {
+  font-size: 12px;
+  font-weight: 700;
+  color: var(--muted);
+  white-space: nowrap;
+}
+
+.hid-bulk-table :deep(td) {
+  font-size: 13px;
+}
+
+/* Why this row cannot be unticked, on the row itself. A disabled checkbox with
+   no reason beside it reads as a broken control. */
+.hid-bulk-granted {
+  display: block;
+  color: var(--muted);
+  font-size: 11px;
+  font-weight: 600;
+}
+
 .photo-wrap {
   display: grid;
   place-items: center;