On overnight tours, passenger notification is a legal obligation. Identity details must be collected, submitted in the correct format and kept on record.
The module takes passengers from the same source as the booking form, prepares the notification record, and on confirmation produces an immutable manifest: the JSON snapshot is frozen and signed with a SHA-256 digest. It cannot be updated afterwards.
Because the module holds sensitive identity data it sits in its own permission scope; only authorised roles can reach it, and every view and change is written to the audit trail.