Added scheduler jobs

Reviewed-on: #173

Architecture.md

@@ -22,12 +22,13 @@ The PFM platform is constructed using **Clean Architecture** and **Domain-Driven
 │                             API GATEWAY                                │
 │  PostFundManagement.Api (ASP.NET Core Minimal APIs / Carter)           │
 │  Authentication: JWT Bearer + OpenTelemetry Observability              │
+│  Quartz Client: Scheduler-Only (ZeroSizeThreadPool / Enqueues Jobs)    │
 └───────────────────────────────────┬────────────────────────────────────┘
                                     │
 ┌───────────────────────────────────▼────────────────────────────────────┐
 │                          APPLICATION LAYER                             │
 │  PostFundManagement.Application                                        │
-│  CQRS (Mediator), Business Validators, Domain Services, Quartz Jobs   │
+│  CQRS (Mediator), Business Validators, Domain Services, Event Handlers │
 └──────────────────┬─────────────────────────────────┬───────────────────┘
                    │                                 │
 ┌──────────────────▼──────────────────┐   ┌──────────▼───────────────────┐
@@ -35,8 +36,15 @@ The PFM platform is constructed using **Clean Architecture** and **Domain-Driven
 │  PostFundManagement.Domain          │   │  PostFundManagement.Infrastr.│
 │  Entities, Value Objects, Enums,    │   │  PostgreSQL (EF Core 10),    │
 │  Domain Invariants, Audit Models    │   │  Skoruba STS, S3 Garage,     │
-└─────────────────────────────────────┘   │  Redis HybridCache           │
-                                          └──────────────────────────────┘
+└─────────────────────────────────────┘   │  Redis, Quartz (pfm-scheduler)│
+                                          └──────────────┬───────────────┘
+                                                         │
+┌────────────────────────────────────────────────────────▼───────────────┐
+│                     BACKGROUND JOBS WORKER HOST                        │
+│  PostFundManagement.Jobs (.NET 10 Background Host / Quartz Runner)     │
+│  Recurring Job Registration (JobsWorker) & Mediated Execution Engine   │
+│  Quartz Runner: Full Execution (DefaultThreadPool MaxConcurrency = 5)  │
+└────────────────────────────────────────────────────────────────────────┘
 ```
 
 ---
@@ -113,8 +121,8 @@ Even if an `Executive`, `Manager`, or `Supervisor` possesses the `update` claim
 flowchart LR
     A["Maker (User A)<br/>Creates Record"] --> B["Record Persisted<br/>with createdBy = User A"]
     B --> C{"Checker Evaluation<br/>(Approver Login)"}
-    C -->|Checker == User A| D["Approval BLOCKED<br/>Maker-Checker Violation"]
-    C -->|Checker == User B<br/>with 'update' claim| E["Approval GRANTED<br/>Status -> Approved"]
+    C -->|"Checker is User A"| D["Approval BLOCKED: Maker-Checker Violation"]
+    C -->|"Checker is User B with update claim"| E["Approval GRANTED: Status Approved"]
 ```
 
 ### 4.2 Record Attribution Model
@@ -189,4 +197,122 @@ Following the introduction of fine-grained RBAC and Maker-Checker checks, startu
 * **Immediate Non-Blocking Session Render**: If valid session tokens and user profiles exist in `localStorage`, `AuthProvider` immediately unblocks UI rendering (`isLoading: false`) and runs tenant lockout checks, account synchronization, and claim revalidation asynchronously in the background.
 * **In-Memory User Sync & Lockout Caching**: `isUserSyncedInBrowser` and `verifyTenantLockout` maintain in-memory references to eliminate synchronous `JSON.parse` operations from the request pipeline.
 
+---
+
+## 6. Distributed Background Job Processing Architecture (PostFundManagement.Jobs)
+
+The PFM platform decouples synchronous API request handling from asynchronous, long-running, and scheduled workloads using a distributed **Quartz.NET (v4.6+)** clustering topology backed by PostgreSQL (`pfm-scheduler`).
+
+### 6.1 Split-Node Topology: Scheduler Client vs. Execution Host
+
+To maintain high API throughput, low memory footprint, and complete process isolation, PFM implements a split-node architecture between `PostFundManagement.Api` and `PostFundManagement.Jobs`:
+
+```
+┌──────────────────────────────────────────────┐
+│          PostFundManagement.Api              │
+│       (API Gateway / Scheduler Client)       │
+│                                              │
+│  * AddQuartzSchedulerClient()                │
+│  * ZeroSizeThreadPool (0 execution threads)  │
+│  * SchedulerStatus.Created (Standby mode)    │
+│  * Strictly schedules / enqueues events      │
+│  * Never acquires triggers or executes jobs  │
+└──────────────────────┬───────────────────────┘
+                       │ Schedules IEvent jobs via IJobOrchestrator
+                       ▼
+┌──────────────────────────────────────────────┐
+│           PostgreSQL JobStore                │
+│             (pfm-scheduler)                  │
+│                                              │
+│  * Clustered tables (QRTZ_TRIGGERS, etc.)    │
+│  * System.Text.Json serialized IEvent payload│
+│  * Distributed locking & check-in heartbeat  │
+└──────────────────────▲───────────────────────┘
+                       │
+                       │ Acquires triggers & executes (Polling loop)
+┌──────────────────────┴───────────────────────┐
+│         PostFundManagement.Jobs              │
+│        (Dedicated Worker Service)            │
+│                                              │
+│  * AddQuartzScheduler()                      │
+│  * DefaultThreadPool (MaxConcurrency = 5)    │
+│  * SchedulerStatus.Running (Started loop)    │
+│  * JobsWorker background service:            │
+│    - Registers recurring cron jobs on start  │
+│    - Enqueues one-time jobs when needed      │
+│  * Executes MediatorJob<TNotification>       │
+│  * Deserializes and publishes via IMediator  │
+└──────────────────────────────────────────────┘
+```
+
+| Characteristic | `PostFundManagement.Api` | `PostFundManagement.Jobs` |
+| :--- | :--- | :--- |
+| **Architectural Role** | API Gateway & Event Producer | Dedicated Execution Daemon & Consumer |
+| **Registration Extension** | `AddQuartzSchedulerClient(...)` | `AddQuartzScheduler(...)` |
+| **Thread Pool** | `ZeroSizeThreadPool` (0 threads) | `DefaultThreadPool` (`MaxConcurrency = 5`) |
+| **Hosted Service** | None (`AddQuartzHostedService` omitted) | `AddQuartzHostedService(WaitForJobsToComplete = true)` |
+| **Lifecycle State** | `SchedulerStatus.Created` (Standby) | `SchedulerStatus.Running` (Active execution loop) |
+| **Readiness Check** | Verifies DB connectivity without requiring `Running` | Verifies active execution engine & DB connectivity |
+| **Trigger Acquisition** | ❌ **Disabled** (Cannot acquire triggers or run jobs) | ✅ **Active** (Polls DB, acquires triggers, runs jobs) |
+
+### 6.2 Event-Driven Mediated Orchestration (`IEvent` & `MediatorJob`)
+
+Background tasks are modeled as strongly-typed domain events implementing `IEvent : INotification` (`PostFundManagement.Domain.Abstractions`).
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant API as PostFundManagement.Api
+    participant Orchestrator as IJobOrchestrator
+    participant DB as PostgreSQL pfm-scheduler
+    participant Host as PostFundManagement.Jobs
+    participant QuartzThread as Quartz Execution Engine
+    participant Mediator as IMediator MediatorJob
+    participant Handler as Domain Event Handlers
+
+    Note over API,Orchestrator: 1. Event Scheduling (API Node)
+    API->>Orchestrator: SendAsync(notification) / ScheduleAsync(notification, cron)
+    Orchestrator->>DB: Stores JobDetail and Trigger with serialized Payload JSON
+    Note over DB,Host: 2. Distributed Acquisition (Jobs Node)
+    QuartzThread->>DB: Polls and acquires due trigger with row-level locks
+    QuartzThread->>Host: Dispatches to local thread pool
+    Host->>Mediator: Instantiates MediatorJob[TNotification]
+    Mediator->>Mediator: Deserializes payload from MergedJobDataMap
+    Mediator->>Handler: Publish(notification, cancellationToken)
+    Handler-->>Host: Execution complete and updates business data in pfm DB
+    Host->>DB: Releases trigger and commits execution state
+```
+
+1. **Scheduling via `IJobOrchestrator`**:
+   - `SendAsync<TNotification>(notification)`: Schedules a durable, one-time execution in the `onetime-jobs` group with `StartNow()` and `DisallowConcurrentExecution()`.
+   - `ScheduleAsync<TNotification>(notification, cronExpression)`: Configures a durable, cron-driven recurring job in the `scheduled-jobs` group with automatic misfire handling (`CronTriggerMisfireInstruction.IgnoreMisfires`).
+   - `InterruptAsync(eventName, correlationId)`: Allows runtime cancellation of active job executions across the cluster.
+2. **Transparent Deserialization & Dispatch (`MediatorJob<TNotification>`)**:
+   `MediatorJob<TNotification>` resolves `IMediator` from DI, deserializes the JSON payload, initiates OpenTelemetry distributed tracing (`MediatorTelemetry.Source`), and publishes the event to all registered in-process handlers.
+
+### 6.3 Recurring vs. One-Time Job Patterns
+
+* **Recurring Jobs**: Scheduled by `JobsWorker` (`BackgroundService` in `PostFundManagement.Jobs`) during application startup. These jobs govern periodic health sweeps, SLA tracking, notification batching, and risk evaluations on predictable cron intervals.
+* **One-Time Jobs**: Primarily scheduled by `PostFundManagement.Api` as immediate or deferred side-effects of HTTP requests and lifecycle mutations (e.g. user invites, award registration triggers). Furthermore, a running recurring job in `PostFundManagement.Jobs` can dispatch a one-time job (`jobOrchestrator.SendAsync`) when handling fan-out tasks or invoking decoupled activities that cannot be triggered directly by the originating job.
+
+### 6.4 Core Background Processing Capabilities
+
+The background job runner powers four essential operational workloads:
+
+1. **Automated Project Monitoring & Reminders**:
+   - Sweeps active projects, contractual deliverables, and milestone deadlines.
+   - Computes planned vs. actual progress variance and escalates overdue milestones (`FR-M04-017`, `FR-M07-009`).
+   - Dispatches automated reminders to Grantees/Partners prior to milestone due dates and submission cut-offs.
+2. **Risk Monitoring & Automated Notifications**:
+   - Evaluates project risk registers, Key Risk Indicators (KRIs), and issue escalation thresholds (`FR-M09-001` - `011`).
+   - Detects risk score creep (Likelihood $\times$ Impact) and triggers automated alerts when risk tolerance thresholds are breached.
+   - Monitors overdue mitigation action plans and escalates unresolved high-severity risks to Programme Managers.
+3. **Email Notification Processing**:
+   - Continuously consumes and batches pending notification records (`Platform.Email` / `NotificationPlatform.Email`).
+   - Dispatches transactional emails via MailKit / MimeKit SMTP with exponential backoff and retry policies.
+   - Updates delivery status (`Sent`, `Failed`, retry count) and logs dispatch telemetry for audit compliance (`FR-M25-001`).
+4. **Platform Extensibility**:
+   - New background jobs and recurring routines can be introduced by creating an `IEvent` model in `PostFundManagement.Application` and scheduling it via `JobsWorker` or `IJobOrchestrator`, with zero impact on the API surface.
+
+
 

Directory.Build.props

@@ -44,6 +44,7 @@
     <Using Include="Microsoft.Extensions.Logging" />
     <Using Include="Microsoft.Extensions.Options" />
     <Using Include="Microsoft.IdentityModel.Tokens" />
+    <Using Include="Microsoft.FeatureManagement" />
 
     <!-- Domain Constants -->
     <Using Static="true" Include="PostFundManagement.Domain.Extensions.Constants" />

Directory.Packages.props

@@ -12,67 +12,68 @@
     <PackageVersion Include="Scrutor" Version="7.0.0" />
 
     <!-- Microsoft Extensions & Configuration -->
-    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.10.0" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Http.Polly" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.10.0" />
-    <PackageVersion Include="Microsoft.Extensions.Validation" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.FeatureManagement.AspNetCore" Version="4.7.0" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.11.0" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Polly" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.11.0" />
+    <PackageVersion Include="Microsoft.Extensions.Validation" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.FeatureManagement.AspNetCore" Version="4.8.0" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.14" />
 
     <!-- Security, Authentication & Identity -->
     <PackageVersion Include="AccessTokenClient.Extensions" Version="5.1.0" />
-    <PackageVersion Include="Duende.AccessTokenManagement" Version="4.2.0" />
-    <PackageVersion Include="Duende.AccessTokenManagement.OpenIdConnect" Version="4.2.0" />
+    <PackageVersion Include="Duende.AccessTokenManagement" Version="4.3.0" />
+    <PackageVersion Include="Duende.AccessTokenManagement.OpenIdConnect" Version="4.3.0" />
     <PackageVersion Include="IdentityModel" Version="6.2.0" />
     <PackageVersion Include="IdentityModel.AspNetCore" Version="4.3.0" />
     <PackageVersion Include="IdentityModel.AspNetCore.OAuth2introspection" Version="6.2.0" />
     <PackageVersion Include="IdentityServer4.AccessTokenValidation" Version="3.0.1" />
-    <PackageVersion Include="KubernetesClient" Version="19.0.2" />
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.Certificate" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.12" />
+    <PackageVersion Include="KubernetesClient" Version="21.0.8" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.Certificate" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.14" />
     
     <!-- Upgraded to latest non-vulnerable version -->
-    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.13" />
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.14" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.14" />
 
     <!-- Resilience -->
-    <PackageVersion Include="Polly" Version="8.8.0" />
-    <PackageVersion Include="Polly.Extensions" Version="8.8.0" />
+    <PackageVersion Include="Polly" Version="8.8.1" />
+    <PackageVersion Include="Polly.Extensions" Version="8.8.1" />
 
     <!-- API, Web & Documentation -->
     <PackageVersion Include="Asp.Versioning.Abstractions" Version="10.2.1" />
     <PackageVersion Include="Asp.Versioning.Http" Version="10.2.3" />
     <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="10.2.1" />
-    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.AspNetCore.OutputCaching.StackExchangeRedis" Version="10.0.12" />
-    <PackageVersion Include="Refit.HttpClientFactory" Version="15.2.0" />
-    <PackageVersion Include="Scalar.AspNetCore" Version="2.17.4" />
+    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.AspNetCore.OutputCaching.StackExchangeRedis" Version="10.0.14" />
+    <PackageVersion Include="Refit.HttpClientFactory" Version="16.4.0" />
+    <PackageVersion Include="Scalar.AspNetCore" Version="2.18.3" />
 
     <!-- Database & Entity Framework Core -->
-    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Abstractions" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Analyzers" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Abstractions" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Analyzers" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.14" />
     <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
 
     <!-- Quartz Scheduler -->
-    <PackageVersion Include="Quartz" Version="4.1.0" />
-    <PackageVersion Include="Quartz.AspNetCore" Version="4.1.0" />
-    <PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="4.1.0" />
-    <PackageVersion Include="Quartz.Plugins" Version="4.1.0" />
-    <PackageVersion Include="Quartz.Plugins.TimeZoneConverter" Version="4.1.0" />
-    <PackageVersion Include="Quartz.Serialization.SystemTextJson" Version="4.1.0" />
+    <PackageVersion Include="Quartz" Version="4.6.2" />
+    <PackageVersion Include="Quartz.AspNetCore" Version="4.6.2" />
+    <PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="4.6.2" />
+    <PackageVersion Include="Quartz.Plugins" Version="4.6.2" />
+    <PackageVersion Include="Quartz.Plugins.TimeZoneConverter" Version="4.6.2" />
+    <PackageVersion Include="Quartz.Serialization.SystemTextJson" Version="4.6.2" />
 
     <!-- Health Checks -->
     <PackageVersion Include="AspNetCore.HealthChecks.NpgSql" Version="9.0.0" />
@@ -83,17 +84,17 @@
     <PackageVersion Include="AspNetCore.HealthChecks.UI.InMemory.Storage" Version="9.0.0" />
 
     <!-- Observability & OpenTelemetry -->
-    <PackageVersion Include="OpenTelemetry" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry" Version="1.20.1" />
+    <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.20.1" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.20.1" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.20.1" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.20.1" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.20.1" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.20.1" />
 
     <!-- Email & Messaging -->
-    <PackageVersion Include="MailKit" Version="4.18.0" />
-    <PackageVersion Include="MimeKit" Version="4.18.0" />
+    <PackageVersion Include="MailKit" Version="4.18.2" />
+    <PackageVersion Include="MimeKit" Version="4.18.2" />
 
     <!-- CQRS & Mediator -->
     <PackageVersion Include="FluentResults" Version="4.0.0" />
@@ -101,17 +102,17 @@
     <PackageVersion Include="Mediator.SourceGenerator" Version="3.0.2" />
 
     <!-- Cloud Storage -->
-    <PackageVersion Include="AWSSDK.Extensions.NetCore.Setup" Version="4.0.101.4" />
-    <PackageVersion Include="AWSSDK.S3" Version="4.0.103.3" />
+    <PackageVersion Include="AWSSDK.Extensions.NetCore.Setup" Version="4.0.102.7" />
+    <PackageVersion Include="AWSSDK.S3" Version="4.0.104.7" />
 
     <!-- Analyzers -->
-    <PackageVersion Include="Meziantou.Analyzer" Version="3.0.259" />
+    <PackageVersion Include="Meziantou.Analyzer" Version="3.0.317" />
 
     <!-- Testing -->
-    <PackageVersion Include="coverlet.collector" Version="6.0.4" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageVersion Include="coverlet.collector" Version="10.1.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
     <PackageVersion Include="xunit" Version="2.9.3" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="4.0.1" />
   </ItemGroup>
 </Project>
 

GEMINI.md

@@ -71,6 +71,7 @@ PostFundManagement/
 ├── PostFundManagement.Infrastructure/  # EF Core 10, PostgreSQL (Npgsql), Migrations, Data Protection
 ├── PostFundManagement.Application/     # CQRS Handlers, Mediator, DTOs, Validations, S3, Email, Quartz
 ├── PostFundManagement.Api/             # Minimal APIs / Carter endpoints, Auth, Swagger/Scalar, Versioning
+├── PostFundManagement.Jobs/            # Dedicated Quartz.NET Background Worker Host (Recurring & One-Time Execution)
 ├── PostFundManagement.Tests/           # Unit & Integration test suite (xUnit, Coverlet)
 ├── PostFundManagement.ConsoleUI/       # Internal Staff & Admin Web Portal (React 19 + Vite 6 + Tailwind 4)
 ├── PostFundManagement.PartnerUI/       # External Grantee / Partner Portal (React 19 + Vite 8 + Tailwind 4)
@@ -85,6 +86,7 @@ PostFundManagement/
 | **`PostFundManagement.Infrastructure`** | `net10.0` | `Microsoft.EntityFrameworkCore` 10.0.12, `Npgsql.EntityFrameworkCore.PostgreSQL` 10.0.3, `Duende.AccessTokenManagement` 4.2.0, EF Core Tools & Design | Houses `PostFundManagementDbContext`, EF Core fluent configurations, entity-to-table mappings, PostgreSQL schema definitions, multitenancy filters, and migrations. |
 | **`PostFundManagement.Application`** | `net10.0` | `Mediator.SourceGenerator` / `Mediator.Abstractions` 3.0.2, `FluentResults` 4.0.0, `Microsoft.Extensions.Caching.Hybrid` 10.10.0, `Microsoft.Extensions.Caching.StackExchangeRedis` 10.0.12, `Refit` 15.2.0, `Duende.AccessTokenManagement.OpenIdConnect` 4.2.0, `Quartz` 4.1.0, `AWSSDK.S3` | Implements CQRS command/query handlers, domain validators, S3 object storage clients (Garage S3), background jobs (Quartz), notification dispatchers, and business logic. |
 | **`PostFundManagement.Api`** | `net10.0` | `Microsoft.AspNetCore.OpenApi` 10.0.12, `Scalar.AspNetCore` 2.17.4, `Asp.Versioning.Http` 10.2.3, `IdentityModel.AspNetCore` 4.3.0, `Microsoft.AspNetCore.Authentication.JwtBearer` 10.0.12, `AspNetCore.HealthChecks.NpgSql` 9.0.0, `AspNetCore.HealthChecks.UI` | Minimal API endpoint definitions divided by business slices (`Grants`, `Projects`, `Execution`, `Governance`, `Evidence`, `Communications`, `Users`). Handles routing, auth policies, error problem details, and OpenAPI metadata. |
+| **`PostFundManagement.Jobs`** | `net10.0` | `Quartz` 4.6.2, `Quartz.Extensions.DependencyInjection` 4.6.2, `Quartz.Serialization.SystemTextJson` 4.6.2, `Mediator.Abstractions` 3.0.2 | Dedicated background execution host. Executes recurring Quartz jobs (registered on startup by `JobsWorker`), processes asynchronous domain events (`IEvent`), and executes jobs concurrently (`MaxConcurrency = 5`). |
 | **`PostFundManagement.Tests`** | `net10.0` | `xunit` 2.9.3, `xunit.runner.visualstudio` 3.1.4, `Microsoft.NET.Test.Sdk` 17.14.1, `coverlet.collector` 6.0.4 | Unit and integration test coverage for domain rules, CQRS handlers, financial calculation models, and gate condition validations. |
 
 ### 2.2 Frontend Projects (React 19 / TypeScript)
@@ -120,6 +122,22 @@ PostFundManagement/
 * **Authentication / STS**: Duende IdentityServer / Skoruba Administration (`https://sts.security.khongisa.co.za`).
 * **Observability**: OpenTelemetry exporters streaming traces, metrics, and logs to Aspire Dashboard / OTLP collectors.
 
+### 2.4 Distributed Background Processing Architecture (Quartz.NET & PostFundManagement.Jobs)
+* **Dedicated Execution Daemon**: `PostFundManagement.Jobs` is a standalone background host responsible for recurring job scheduling, lifecycle sweeps, and asynchronous event execution.
+* **API Isolation (Scheduler Client)**: `PostFundManagement.Api` is strictly configured as a scheduler client via `AddQuartzSchedulerClient(...)` using `ZeroSizeThreadPool` (0 worker threads) and running in standby (`SchedulerStatus.Created`). The API enqueues jobs and triggers into the clustered PostgreSQL database (`pfm-scheduler`) but never acquires triggers or executes jobs locally.
+* **Worker Execution Engine**: `PostFundManagement.Jobs` configures full Quartz execution via `AddQuartzScheduler(...)` using `DefaultThreadPool` (`MaxConcurrency = 5`) and `AddQuartzHostedService(options => options.WaitForJobsToComplete = true)`.
+* **Event-Driven Orchestration (`IEvent` & `MediatorJob`)**:
+  - The API acts as the primary source of one-time events triggered by user actions and lifecycle transitions (implementing `IEvent : INotification`).
+  - Events are enqueued via `IJobOrchestrator.SendAsync` or `ScheduleAsync` and persisted in `pfm-scheduler` as `MediatorJob<TNotification>` with serialized JSON payloads.
+  - When acquired by `PostFundManagement.Jobs`, `MediatorJob` deserializes the event payload, propagates OpenTelemetry distributed traces, and publishes the event via `IMediator.Publish(...)`.
+* **Startup Recurring Registration**: On daemon startup, `JobsWorker : BackgroundService` initializes and registers recurring cron jobs across tenant portfolios.
+* **Cascading One-Time Execution**: If a recurring job identifies complex follow-up items that cannot be processed in the recurring execution window, it dispatches decoupled one-time jobs (`jobOrchestrator.SendAsync`) across worker threads.
+* **Core Job Workloads**:
+  1. *Automated Project Monitoring & Reminders*: Sweeps milestones, checks contractual SLA deadlines, sets overdue flags (`FR-M07-009`), and sends reminder notices to Grantees/Partners.
+  2. *Risk Monitoring & Automated Notifications*: Evaluates risk score creep ($\text{Likelihood} \times \text{Impact}$), flags tolerance breaches, and sends escalation alerts for overdue mitigation actions.
+  3. *Email Notification Processing*: Batches and dispatches pending notification entries (`Platform.Email` / `NotificationPlatform.Email`) via MailKit/MimeKit SMTP and records delivery telemetry (`FR-M25-001`).
+  4. *Future Jobs*: Seamlessly supports future scheduled workloads (e.g. drawdown reconciliations, compliance expiries, portfolio aggregations) simply by adding `IEvent` handlers.
+
 ---
 
 ## 3. Master Business Rules (BR-001 to BR-010)
@@ -848,7 +866,7 @@ The platform uses **Hashids** to obfuscate internal sequential database primary
 * **Implementation**: Managed by `HashService` (`PostFundManagement.Application/Services/Shared/HashService.cs`) using the `Hashids.net` (v1.7.0) library.
 * **Shared Configuration (`HasherSettings`)**:
   * **Salt**: Sourced from configuration (`HasherSettings:Salt` or `HASHER_SALT`), defaulting to:
-    `"TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ=="`
+    `"salt-random-string"`
   * **Min Hash Length**: `HasherSettings:MinHashLength` or `HASHER_MIN_HASH_LENGTH` (default: `11`).
 * **Core Service Methods**:
   * `HashEncodeLongId(long id)` / `HashEncodeIntId(int id)`: Encodes integers into obfuscated HashID strings (e.g. `1` $\to$ `kY5aB9m...`).

PostFundManagement.Api/Endpoints/Evidence/GetProjectEvidenceEndpoint.cs

@@ -11,7 +11,7 @@ public class GetProjectEvidenceEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapGet("api/evidence/{projectId}", async (string projectId, IEvidenceService service, 
+        builder.MapGet("api/evidence/projects/{projectId}", async (string projectId, IEvidenceService service, 
             CancellationToken cancellationToken = default) =>
                 await service.GetProjectEvidencesAsync(projectId, cancellationToken) switch
                 {

PostFundManagement.Api/Endpoints/Projects/CreateOutcomeEndpoint.cs

@@ -12,7 +12,14 @@ public sealed class CreateOutcomeEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapPost("api/projects/beneficiaries/outcomes", HandleCreateAsync)
+        builder.MapPost("api/projects/beneficiaries/outcomes", async (CreateOutcomeRequest request, HttpContext context,
+        IProjectService service, CancellationToken cancellationToken = default) =>
+            await service.CreateOutcomeAsync(request, context.GetUserId(), cancellationToken) switch
+            {
+                { IsSuccess: true } => Results.Ok(),
+                var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                var r => Results.InternalServerError(r.Errors.ToProblems())
+            })
             .WithDescription("Add a new beneficiary outcome")
             .RequireAuthorization(Constants.MainScope)
             .WithName(typeof(CreateOutcomeEndpoint).ToEndpointName())
@@ -22,25 +29,5 @@ public sealed class CreateOutcomeEndpoint : IEndpoint
             .Produces<Problems>(StatusCodes.Status500InternalServerError)
             .Produces(StatusCodes.Status401Unauthorized)
             .WithTags(EndpointTags.Projects);
-
-        builder.MapPost("api/projects/beneficiaris/outcomes", HandleCreateAsync)
-            .WithDescription("Add a new beneficiary outcome (legacy route)")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreateOutcomeEndpoint).ToEndpointName("TypoAlias"))
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Projects);
     }
-
-    private static async Task<IResult> HandleCreateAsync(CreateOutcomeRequest request, HttpContext context,
-        IProjectService service, CancellationToken cancellationToken = default) =>
-        await service.CreateOutcomeAsync(request, context.GetUserId(), cancellationToken) switch
-        {
-            { IsSuccess: true } => Results.Ok(),
-            var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
-            var r => Results.InternalServerError(r.Errors.ToProblems())
-        };
 }

PostFundManagement.Api/Endpoints/Users/SetUserLockoutEndpoint.cs

@@ -1,4 +1,4 @@
-using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
@@ -13,22 +13,29 @@ public sealed class SetUserLockoutEndpoint : IEndpoint
     {
         builder.MapPut("api/users/{userId:Guid}/session/lockout/{disable:bool}", async (Guid userId, bool disable, HttpContext context,
             IUserService service, CancellationToken cancellationToken = default) =>
-                await service.SetUserLockoutAsync(userId, context.GetUserId(), disable, cancellationToken) switch
-                {
-                    {  IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Lock user session")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(SetUserLockoutEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Users);
+        {
+            var (_, role) = context.User.GetUserRole();
+            if (role != null && role.Equals("Partner", StringComparison.OrdinalIgnoreCase))
+                return Results.Forbid();
+
+            return await service.SetUserLockoutAsync(userId, context.GetUserId(), disable, cancellationToken) switch
+            {
+                {  IsSuccess: true } => Results.Ok(),
+                var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                var r => Results.InternalServerError(r.Errors.ToProblems())
+            };
+        })
+        .WithDescription("Lock user session")
+        .RequireAuthorization(Constants.MainScope)
+        .WithName(typeof(SetUserLockoutEndpoint).ToEndpointName())
+        .MapToApiVersion(new ApiVersion(1))
+        .Produces(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .Produces(StatusCodes.Status403Forbidden)
+        .Produces<Problems>(StatusCodes.Status404NotFound)
+        .Produces<Problems>(StatusCodes.Status400BadRequest)
+        .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .WithTags(EndpointTags.Users);
     }
 }

PostFundManagement.Api/Endpoints/Users/SyncUserEndpoint.cs

@@ -11,8 +11,8 @@ public class SyncUserEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapPost("api/integration/sync", async (IJobOrchestrator jobOrchestrator,
-            HttpContext context, IUserService service, CancellationToken cancellationToken = default) =>
+        builder.MapPost("api/integration/sync", async (HttpContext context, IUserService service, 
+            CancellationToken cancellationToken = default) =>
                 await service.SyncUserAsync(context.GetUserId(), context.GetUserEmail(), context.GetUserRole(), cancellationToken) switch
                 {
                     { IsSuccess: true } => Results.Ok(),

PostFundManagement.Api/Program.cs

@@ -4,7 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Health;
 using PostFundManagement.Domain.Mediator;
 using PostFundManagement.Infrastructure.Database.Services;
-using static PostFundManagement.Domain.Extensions.Constants;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -45,7 +44,7 @@ builder.Services.AddSkorubaApiService(builder.Configuration);
 builder.Services.AddScoped(typeof(IPipelineBehavior<,>), typeof(TelemetryPipelineBehavior<,>));
 builder.Services.AddScoped(typeof(IPipelineBehavior<,>), typeof(LoggingPipelineBehavior<,>));
 
-builder.Services.AddQuartzScheduler(DefaultSchedulerName, builder.Configuration);
+builder.Services.AddQuartzSchedulerClient(DefaultSchedulerName, builder.Configuration);
 builder.Services.AddEmailServices(builder.Configuration);
 builder.Services.AddHashServices(builder.Configuration);
 builder.Services.AddGarageS3(builder.Configuration);
@@ -116,7 +115,29 @@ builder.Services.AddCors(options =>
 {
     options.AddPolicy(CorsPolicy, policy =>
     {
-        policy.WithOrigins(allowedOrigins)
+        policy.SetIsOriginAllowed(origin =>
+              {
+                  if (string.IsNullOrWhiteSpace(origin)) return false;
+
+                  var clean = origin.TrimEnd('/');
+
+                  if (allowedOrigins.Any(a => string.Equals(a.TrimEnd('/'), clean, StringComparison.OrdinalIgnoreCase)))
+                      return true;
+
+                  try
+                  {
+                      var host = new Uri(origin).Host;
+                      if (host.EndsWith("khongisa.co.za", StringComparison.OrdinalIgnoreCase) ||
+                          host.Equals("localhost", StringComparison.OrdinalIgnoreCase) ||
+                          host.Equals("127.0.0.1", StringComparison.OrdinalIgnoreCase))
+                      {
+                          return true;
+                      }
+                  }
+                  catch { /* eat all exceptions */ }
+
+                  return false;
+              })
               .AllowAnyHeader()
               .AllowAnyMethod()
               .AllowCredentials();
@@ -125,12 +146,7 @@ builder.Services.AddCors(options =>
 
 var app = builder.Build();
 
-var schedulerFactory = app.Services.GetRequiredService<ISchedulerFactory>();
-var scheduler = await schedulerFactory.GetScheduler();
-
-if (scheduler!.Status != SchedulerStatus.Running)
-    await scheduler.Start();
-
+app.UseCors(CorsPolicy);
 app.UseHsts();
 app.UseHttpsRedirection();
 app.UseRouting();
@@ -218,4 +234,4 @@ app.MapGet("/", () => Results.Redirect($"/openapi/{latestVersionGroup}"))
 if (!app.Environment.IsDevelopment())
     app.UseExceptionHandler("/Error", createScopeForErrors: true);
 
-app.Run();
+app.Run();

PostFundManagement.Api/appsettings.json

@@ -1,6 +1,7 @@
 {
   "EnableServiceCaching": true,
   "CorsOrigins": [
+    "https://partner.ifri.khongisa.co.za",
     "https://console.ifri.khongisa.co.za",
     "https://localhost:7208"
   ],
@@ -30,14 +31,7 @@
       "Microsoft.EntityFrameworkCore.Database": "Error",
       "Microsoft.EntityFrameworkCore.Update": "Error"
     }
-  },
-  "EmailProcessorCron": "0 */5 * * * ?",
-  "Email": {
-    "SmtpServer": "smtp.example.com",
-    "SmtpPort": 587,
-    "SenderEmail": "noreply@example.com",
-    "SenderName": "Example"
-  },
+  },  
   "HasherSettings": {
     "MinHashLength": 11
   },

PostFundManagement.Application/Abstractions/Services/ICommunicationsService.cs

@@ -25,7 +25,6 @@ public interface ICommunicationsService
     Task<Result> CreateNotificationAsync(CreateNotificationRequest request, Guid userId, CancellationToken cancellationToken = default);
 
     [Log]
-    [Audit]
     Task<Result> UpdateNotificationAsync(UpdateNotificationRequest request, CancellationToken cancellationToken = default);
 
     [Log]

PostFundManagement.Application/Events/LateProjectReminderEvent.cs

@@ -0,0 +1,176 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Services.Communications;
+using PostFundManagement.Domain;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Infrastructure.Database;
+
+namespace PostFundManagement.Application.Events;
+
+public sealed class LateProjectEvent : IEvent
+{
+    public Guid Id { get; set; } = Guid.CreateVersion7();
+
+    public string Name { get; set; } = nameof(LateProjectEvent);
+
+    public DateTimeOffset EnqueueAt { get; set; } = DateTimeOffset.UtcNow;
+
+    public string CorrelationId { get; set; } = "lateproject-reminder";
+
+    public static LateProjectEvent Create() => new();
+}
+
+public sealed class LateProjectEventHandler(IDbContextFactory<ApplicationDbContext> contextFactory,
+    ICommunicationsService service) : INotificationHandler<LateProjectEvent>
+{
+    readonly int lateDays = 3;
+
+    public async ValueTask Handle(LateProjectEvent notification, CancellationToken cancellationToken)
+    {
+        await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
+
+        var now = DateTime.UtcNow;
+        var overdueCutoff = lateDays > 0 ? now.AddDays(-lateDays) : now;
+
+        // Query overdue milestones that are not yet approved
+        // Execute ToListAsync before GroupBy so EF Core does not fail SQL translation
+        var overdueMilestones = await context.Milestones
+            .AsNoTracking()
+            .Include(i => i.Project)
+                .ThenInclude(p => p!.Programme)
+                    .ThenInclude(pr => pr!.Owner)
+            .Include(i => i.Project)
+                .ThenInclude(p => p!.Programme)
+                    .ThenInclude(pr => pr!.Portfolio)
+                        .ThenInclude(po => po!.Organisation)
+                            .ThenInclude(o => o!.User)
+            .Where(m => m.Status != ApprovalStatus.Approved && m.DueAt <= overdueCutoff)
+            .OrderBy(o => o.DueAt)
+            .ToListAsync(cancellationToken);
+
+        if (overdueMilestones.Count == 0) return;
+
+        var lateMilestonesByProject = overdueMilestones.GroupBy(g => g.ProjectId);
+
+        var partnerResourceStream = typeof(IDomain).Assembly
+            .GetManifestResourceStream("PostFundManagement.Domain.Templates.lateprojectsmilestones.html");
+
+        if (partnerResourceStream is null) return;
+
+        using var partnerHtmlTemplateReader = new StreamReader(partnerResourceStream);
+        var partnerTemplate = await partnerHtmlTemplateReader.ReadToEndAsync(cancellationToken);
+
+        var programmeResourceStream = typeof(IDomain).Assembly
+            .GetManifestResourceStream("PostFundManagement.Domain.Templates.noncompliantprojects-prog.html");
+
+        string? programmeTemplate = null;
+        if (programmeResourceStream is not null)
+        {
+            using var programmeHtmlTemplateReader = new StreamReader(programmeResourceStream);
+            programmeTemplate = await programmeHtmlTemplateReader.ReadToEndAsync(cancellationToken);
+        }
+
+        foreach (var group in lateMilestonesByProject)
+        {
+            var milestones = group.ToList();
+
+            if (milestones.Count == 0) continue;
+
+            var project = milestones[0].Project;
+
+            if (project is null) continue;
+
+            var mostLateMilestone = milestones.OrderBy(m => m.DueAt).FirstOrDefault();
+
+            var daysOverdue = mostLateMilestone != null
+                ? (int)Math.Max(0, (now - mostLateMilestone.DueAt).TotalDays)
+                : 0;
+
+            var organisation = mostLateMilestone?.Project?.Programme?.Portfolio?.Organisation;
+
+            if (organisation is null) continue;
+
+            var recipientId = organisation.UserId ?? organisation.CreatedBy;
+            var recipientEmail = organisation.User?.Email ?? organisation.Email;
+
+            if (string.IsNullOrWhiteSpace(recipientEmail) || recipientId == Guid.Empty) continue;
+
+            var tableRowsBuilder = new StringBuilder();
+            foreach (var milestone in milestones.OrderBy(m => m.DueAt))
+            {
+                var delay = (int)Math.Max(0, (now - milestone.DueAt).TotalDays);
+                var statusText = milestone.Status.ToString();
+                var milestoneName = WebUtility.HtmlEncode(milestone.Name ?? "Milestone Deliverable");
+
+                tableRowsBuilder.AppendLine($@"
+                    <tr style=""border-bottom: 1px solid #e2e8f0;"">
+                        <td style=""padding: 10px 14px; font-weight: 500; color: #1e293b;"">{milestoneName}</td>
+                        <td style=""padding: 10px 14px; color: #64748b; font-size: 13px;"">{milestone.DueAt:yyyy-MM-dd}</td>
+                        <td style=""padding: 10px 14px; color: #dc2626; font-weight: 600; font-size: 13px;"">+{delay} d</td>
+                        <td style=""padding: 10px 14px; font-size: 12px;""><span style=""background-color: #fee2e2; color: #991b1b; padding: 2px 8px; border-radius: 9999px; font-weight: 600;"">{statusText}</span></td>
+                    </tr>");
+            }
+
+            // 1. Send notice to Partner / Recipient Organisation
+            var messageBody = partnerTemplate;
+            messageBody = messageBody.Replace("[OrganisationName]", WebUtility.HtmlEncode(organisation.Name ?? "Partner"));
+            messageBody = messageBody.Replace("[RecipientName]", WebUtility.HtmlEncode(organisation.Name ?? "Partner"));
+            messageBody = messageBody.Replace("[ProjectName]", WebUtility.HtmlEncode(project.Name ?? "Project"));
+            messageBody = messageBody.Replace("[ProjectStartDate]", project.StartedAt.HasValue ? $"{project.StartedAt:yyyy-MM-dd}" : "Not Specified");
+            messageBody = messageBody.Replace("[ProjectEndDate]", project.EndedAt.HasValue ? $"{project.EndedAt:yyyy-MM-dd}" : "Not Specified");
+            messageBody = messageBody.Replace("[TotalLateMilestones]", milestones.Count.ToString());
+            messageBody = messageBody.Replace("[TotalLateMiletones]", milestones.Count.ToString());
+            messageBody = messageBody.Replace("[MostLateMilestoneName]", WebUtility.HtmlEncode(mostLateMilestone?.Name ?? "N/A"));
+            messageBody = messageBody.Replace("[MostLateMilestoneDueDate]", mostLateMilestone != null ? $"{mostLateMilestone.DueAt:yyyy-MM-dd}" : "N/A");
+            messageBody = messageBody.Replace("[MostLateMilestoneDaysOverdue]", daysOverdue.ToString());
+            messageBody = messageBody.Replace("[LateMilestonesTable]", tableRowsBuilder.ToString());
+            messageBody = messageBody.Replace("[PortalUrl]", "https://partner.ifri.khongisa.co.za");
+            messageBody = messageBody.Replace("[Year]", now.Year.ToString());
+
+            var notificationRequest = new CreateNotificationRequest(organisation.Id, recipientId, NotificationPlatform.Email,
+                $"Overdue Milestone Alert: {project.Name}", recipientEmail, messageBody, NotificationStatus.Queued);
+
+            _ = await service.CreateNotificationAsync(notificationRequest, SystemUser, cancellationToken);
+
+            // 2. Construct and send escalation notification for the Programme Manager (FR-M07-009)
+            if (!string.IsNullOrWhiteSpace(programmeTemplate))
+            {
+                var programme = project.Programme;
+                var programmeManager = programme?.Owner;
+                var programmeManagerId = programme?.OwnedBy ?? programmeManager?.Id;
+                var programmeManagerEmail = programmeManager?.Email;
+
+                if (programmeManagerId.HasValue && programmeManagerId.Value != Guid.Empty && !string.IsNullOrWhiteSpace(programmeManagerEmail))
+                {
+                    var progMessageBody = programmeTemplate;
+                    progMessageBody = progMessageBody.Replace("[ProgrammeManagerName]", WebUtility.HtmlEncode(programmeManagerEmail ?? "Programme Manager"));
+                    progMessageBody = progMessageBody.Replace("[ProgrammeName]", WebUtility.HtmlEncode(programme?.Name ?? "Programme"));
+                    progMessageBody = progMessageBody.Replace("[PortfolioName]", WebUtility.HtmlEncode(programme?.Portfolio?.Name ?? "Portfolio"));
+                    progMessageBody = progMessageBody.Replace("[OrganisationName]", WebUtility.HtmlEncode(organisation.Name ?? "Partner"));
+                    progMessageBody = progMessageBody.Replace("[ProjectName]", WebUtility.HtmlEncode(project.Name ?? "Project"));
+                    progMessageBody = progMessageBody.Replace("[ProjectStartDate]", project.StartedAt.HasValue ? $"{project.StartedAt:yyyy-MM-dd}" : "Not Specified");
+                    progMessageBody = progMessageBody.Replace("[ProjectEndDate]", project.EndedAt.HasValue ? $"{project.EndedAt:yyyy-MM-dd}" : "Not Specified");
+                    progMessageBody = progMessageBody.Replace("[TotalLateMilestones]", milestones.Count.ToString());
+                    progMessageBody = progMessageBody.Replace("[TotalLateMiletones]", milestones.Count.ToString());
+                    progMessageBody = progMessageBody.Replace("[MostLateMilestoneName]", WebUtility.HtmlEncode(mostLateMilestone?.Name ?? "N/A"));
+                    progMessageBody = progMessageBody.Replace("[MostLateMilestoneDueDate]", mostLateMilestone != null ? $"{mostLateMilestone.DueAt:yyyy-MM-dd}" : "N/A");
+                    progMessageBody = progMessageBody.Replace("[MostLateMilestoneDaysOverdue]", daysOverdue.ToString());
+                    progMessageBody = progMessageBody.Replace("[LateMilestonesTable]", tableRowsBuilder.ToString());
+                    progMessageBody = progMessageBody.Replace("[ConsoleUrl]", "https://console.ifri.khongisa.co.za");
+                    progMessageBody = progMessageBody.Replace("[PortalUrl]", "https://partner.ifri.khongisa.co.za");
+                    progMessageBody = progMessageBody.Replace("[Year]", now.Year.ToString());
+
+                    var progNotificationRequest = new CreateNotificationRequest(
+                        organisation.Id,
+                        programmeManagerId.Value,
+                        NotificationPlatform.Email,
+                        $"[Escalation] Overdue Milestones: {project.Name} ({programme?.Name})",
+                        programmeManagerEmail,
+                        progMessageBody,
+                        NotificationStatus.Queued);
+
+                    _ = await service.CreateNotificationAsync(progNotificationRequest, SystemUser, cancellationToken);
+                }
+            }
+        }
+    }
+}

PostFundManagement.Application/Events/NonCompliantProjectEvent.cs

@@ -0,0 +1,221 @@
+using System.Net;
+using System.Text;
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Services.Communications;
+using PostFundManagement.Domain;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Infrastructure.Database;
+
+namespace PostFundManagement.Application.Events;
+
+public sealed class NonCompliantProjectEvent : IEvent
+{
+    public Guid Id { get; set; } = Guid.CreateVersion7();
+
+    public string Name { get; set; } = nameof(NonCompliantProjectEvent);
+
+    public DateTimeOffset EnqueueAt { get; set; } = DateTimeOffset.UtcNow;
+
+    public string CorrelationId { get; set; } = "noncompliant-project-check";
+
+    public static NonCompliantProjectEvent Create() => new();
+}
+
+public sealed class NonCompliantProjectEventHandler(IDbContextFactory<ApplicationDbContext> contextFactory,
+    ICommunicationsService service) : INotificationHandler<NonCompliantProjectEvent>
+{
+    public async ValueTask Handle(NonCompliantProjectEvent notification, CancellationToken cancellationToken)
+    {
+        await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
+
+        var now = DateTime.UtcNow;
+
+        // Fetch active/monitored projects with programme, portfolio, and award organisations
+        var projects = await context.Projects
+            .AsNoTracking()
+            .Include(p => p.Programme)
+                .ThenInclude(pr => pr!.Owner)
+            .Include(p => p.Programme)
+                .ThenInclude(pr => pr!.Portfolio)
+                    .ThenInclude(po => po!.Organisation)
+                        .ThenInclude(o => o!.User)
+            .Include(p => p.Awards)
+                .ThenInclude(a => a.Organisation)
+                    .ThenInclude(o => o!.User)
+            .ToListAsync(cancellationToken);
+
+        if (projects.Count == 0) return;
+
+        // Fetch compliance items and milestones to evaluate compliance according to ConsoleUI rules
+        var complianceItems = await context.ComplianceItems
+            .AsNoTracking()
+            .ToListAsync(cancellationToken);
+
+        var milestones = await context.Milestones
+            .AsNoTracking()
+            .ToListAsync(cancellationToken);
+
+        var complianceByProject = complianceItems.GroupBy(c => c.ProjectId)
+            .ToDictionary(g => g.Key, g => g.ToList());
+
+        var milestonesByProject = milestones.GroupBy(m => m.ProjectId)
+            .ToDictionary(g => g.Key, g => g.ToList());
+
+        // Load noncompliantprojects.html template for partner organisations
+        var partnerResourceStream = typeof(IDomain).Assembly
+            .GetManifestResourceStream("PostFundManagement.Domain.Templates.noncompliantprojects.html");
+
+        if (partnerResourceStream is null) return;
+
+        using var partnerHtmlTemplateReader = new StreamReader(partnerResourceStream);
+        var partnerTemplate = await partnerHtmlTemplateReader.ReadToEndAsync(cancellationToken);
+
+        // Load noncompliantprojects-prog.html template for programme managers
+        var progResourceStream = typeof(IDomain).Assembly
+            .GetManifestResourceStream("PostFundManagement.Domain.Templates.noncompliantprojects-prog.html");
+
+        string? programmeTemplate = null;
+        if (progResourceStream is not null)
+        {
+            using var progHtmlTemplateReader = new StreamReader(progResourceStream);
+            programmeTemplate = await progHtmlTemplateReader.ReadToEndAsync(cancellationToken);
+        }
+
+        foreach (var project in projects)
+        {
+            complianceByProject.TryGetValue(project.Id, out var pComplianceItems);
+            pComplianceItems ??= [];
+
+            milestonesByProject.TryGetValue(project.Id, out var pMilestones);
+            pMilestones ??= [];
+
+            // ConsoleUI Invariant: A project is 100% compliant if unmetCompCount == 0 && overdueMilestones.Count == 0
+            var unmetCompItems = pComplianceItems.Where(c => c.Status == ComplianceStatus.NotMet).ToList();
+            var overdueMilestones = pMilestones
+                .Where(m => m.Status != ApprovalStatus.Approved && m.DueAt < now)
+                .OrderBy(m => m.DueAt)
+                .ToList();
+
+            var isCompliant = unmetCompItems.Count == 0 && overdueMilestones.Count == 0;
+            if (isCompliant) continue;
+
+            // Compliance rate calculation
+            var totalEvaluated = pComplianceItems.Count + pMilestones.Count;
+            var totalMet = pComplianceItems.Count(c => c.Status == ComplianceStatus.Met || c.Status == ComplianceStatus.Exceeded)
+                         + pMilestones.Count(m => m.Status == ApprovalStatus.Approved);
+            var compliancePercentage = totalEvaluated > 0
+                ? (int)Math.Round((double)totalMet / totalEvaluated * 100)
+                : 0;
+
+            // Resolve target partner organisation
+            var organisation = project.Awards.FirstOrDefault()?.Organisation
+                ?? project.Programme?.Portfolio?.Organisation;
+
+            if (organisation is null) continue;
+
+            var recipientId = organisation.UserId ?? organisation.CreatedBy;
+            var recipientEmail = organisation.User?.Email ?? organisation.Email;
+            if (string.IsNullOrWhiteSpace(recipientEmail) || recipientId == Guid.Empty) continue;
+
+            // Construct non-compliance table rows
+            var tableRowsBuilder = new StringBuilder();
+
+            foreach (var item in unmetCompItems)
+            {
+                var title = WebUtility.HtmlEncode(item.Title ?? "Statutory Compliance Obligation");
+                var requirements = WebUtility.HtmlEncode(item.Requirements ?? "Verification evidence required");
+
+                tableRowsBuilder.AppendLine($@"
+                    <tr style=""border-bottom: 1px solid #e2e8f0;"">
+                        <td style=""padding: 10px 14px; font-weight: 600; color: #475569; font-size: 12px;"">Statutory / Legal</td>
+                        <td style=""padding: 10px 14px; font-weight: 500; color: #1e293b;"">{title}</td>
+                        <td style=""padding: 10px 14px; color: #64748b; font-size: 13px;"">{requirements}</td>
+                        <td style=""padding: 10px 14px; font-size: 12px;""><span style=""background-color: #fee2e2; color: #991b1b; padding: 2px 8px; border-radius: 9999px; font-weight: 600;"">Not Met</span></td>
+                    </tr>");
+            }
+
+            foreach (var m in overdueMilestones)
+            {
+                var delay = (int)Math.Max(0, (now - m.DueAt).TotalDays);
+                var mName = WebUtility.HtmlEncode(m.Name ?? "Milestone Deliverable");
+
+                tableRowsBuilder.AppendLine($@"
+                    <tr style=""border-bottom: 1px solid #e2e8f0;"">
+                        <td style=""padding: 10px 14px; font-weight: 600; color: #d97706; font-size: 12px;"">Milestone SLA</td>
+                        <td style=""padding: 10px 14px; font-weight: 500; color: #1e293b;"">{mName}</td>
+                        <td style=""padding: 10px 14px; color: #dc2626; font-size: 13px;"">Due: {m.DueAt:yyyy-MM-dd} (+{delay} d)</td>
+                        <td style=""padding: 10px 14px; font-size: 12px;""><span style=""background-color: #fee2e2; color: #991b1b; padding: 2px 8px; border-radius: 9999px; font-weight: 600;"">Overdue</span></td>
+                    </tr>");
+            }
+
+            // 1. Dispatch partner audit notice
+            var messageBody = partnerTemplate;
+            messageBody = messageBody.Replace("[OrganisationName]", WebUtility.HtmlEncode(organisation.Name ?? "Partner"));
+            messageBody = messageBody.Replace("[ProjectName]", WebUtility.HtmlEncode(project.Name ?? "Project"));
+            messageBody = messageBody.Replace("[ProgrammeName]", WebUtility.HtmlEncode(project.Programme?.Name ?? "Programme"));
+            messageBody = messageBody.Replace("[PortfolioName]", WebUtility.HtmlEncode(project.Programme?.Portfolio?.Name ?? "Portfolio"));
+            messageBody = messageBody.Replace("[ProjectStartDate]", project.StartedAt.HasValue ? $"{project.StartedAt:yyyy-MM-dd}" : "Not Specified");
+            messageBody = messageBody.Replace("[ProjectEndDate]", project.EndedAt.HasValue ? $"{project.EndedAt:yyyy-MM-dd}" : "Not Specified");
+            messageBody = messageBody.Replace("[ComplianceScore]", $"{compliancePercentage}%");
+            messageBody = messageBody.Replace("[UnmetComplianceCount]", unmetCompItems.Count.ToString());
+            messageBody = messageBody.Replace("[UnmetMilestonesCount]", overdueMilestones.Count.ToString());
+            messageBody = messageBody.Replace("[NonComplianceTable]", tableRowsBuilder.ToString());
+            messageBody = messageBody.Replace("[PortalUrl]", "https://partner.ifri.khongisa.co.za");
+            messageBody = messageBody.Replace("[ConsoleUrl]", "https://console.ifri.khongisa.co.za");
+            messageBody = messageBody.Replace("[Year]", now.Year.ToString());
+
+            var notificationRequest = new CreateNotificationRequest(
+                organisation.Id,
+                recipientId,
+                NotificationPlatform.Email,
+                $"[Audit Notice] Project Non-Compliance: {project.Name}",
+                recipientEmail,
+                messageBody,
+                NotificationStatus.Queued);
+
+            _ = await service.CreateNotificationAsync(notificationRequest, SystemUser, cancellationToken);
+
+            // 2. Dispatch internal escalation to Programme Manager (FR-M07-009 / M10)
+            if (!string.IsNullOrWhiteSpace(programmeTemplate))
+            {
+                var programme = project.Programme;
+                var programmeManager = programme?.Owner;
+                var programmeManagerId = programme?.OwnedBy ?? programmeManager?.Id;
+                var programmeManagerEmail = programmeManager?.Email;
+
+                if (programmeManagerId.HasValue && programmeManagerId.Value != Guid.Empty && !string.IsNullOrWhiteSpace(programmeManagerEmail))
+                {
+                    var progMessageBody = programmeTemplate;
+                    progMessageBody = progMessageBody.Replace("[ProgrammeManagerName]", WebUtility.HtmlEncode(programmeManagerEmail ?? "Programme Manager"));
+                    progMessageBody = progMessageBody.Replace("[ProgrammeName]", WebUtility.HtmlEncode(programme?.Name ?? "Programme"));
+                    progMessageBody = progMessageBody.Replace("[PortfolioName]", WebUtility.HtmlEncode(programme?.Portfolio?.Name ?? "Portfolio"));
+                    progMessageBody = progMessageBody.Replace("[OrganisationName]", WebUtility.HtmlEncode(organisation.Name ?? "Partner"));
+                    progMessageBody = progMessageBody.Replace("[ProjectName]", WebUtility.HtmlEncode(project.Name ?? "Project"));
+                    progMessageBody = progMessageBody.Replace("[ProjectStartDate]", project.StartedAt.HasValue ? $"{project.StartedAt:yyyy-MM-dd}" : "Not Specified");
+                    progMessageBody = progMessageBody.Replace("[ProjectEndDate]", project.EndedAt.HasValue ? $"{project.EndedAt:yyyy-MM-dd}" : "Not Specified");
+                    progMessageBody = progMessageBody.Replace("[TotalLateMilestones]", overdueMilestones.Count.ToString());
+                    progMessageBody = progMessageBody.Replace("[TotalLateMiletones]", overdueMilestones.Count.ToString());
+                    progMessageBody = progMessageBody.Replace("[MostLateMilestoneName]", WebUtility.HtmlEncode(overdueMilestones.FirstOrDefault()?.Name ?? "N/A"));
+                    progMessageBody = progMessageBody.Replace("[MostLateMilestoneDueDate]", overdueMilestones.FirstOrDefault() != null ? $"{overdueMilestones.First().DueAt:yyyy-MM-dd}" : "N/A");
+                    progMessageBody = progMessageBody.Replace("[MostLateMilestoneDaysOverdue]", overdueMilestones.FirstOrDefault() != null ? $"{(int)Math.Max(0, (now - overdueMilestones.First().DueAt).TotalDays)}" : "0");
+                    progMessageBody = progMessageBody.Replace("[LateMilestonesTable]", tableRowsBuilder.ToString());
+                    progMessageBody = progMessageBody.Replace("[ConsoleUrl]", "https://console.ifri.khongisa.co.za");
+                    progMessageBody = progMessageBody.Replace("[PortalUrl]", "https://partner.ifri.khongisa.co.za");
+                    progMessageBody = progMessageBody.Replace("[Year]", now.Year.ToString());
+
+                    var progNotificationRequest = new CreateNotificationRequest(
+                        organisation.Id,
+                        programmeManagerId.Value,
+                        NotificationPlatform.Email,
+                        $"[Weekly Audit Escalation] Non-Compliant Project: {project.Name} ({programme?.Name})",
+                        programmeManagerEmail,
+                        progMessageBody,
+                        NotificationStatus.Queued);
+
+                    _ = await service.CreateNotificationAsync(progNotificationRequest, SystemUser, cancellationToken);
+                }
+            }
+        }
+    }
+}
+

PostFundManagement.Application/Events/ProcessEmailEvent.cs

@@ -0,0 +1,122 @@
+using PostFundManagement.Application.Services.Shared;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Infrastructure.Database;
+
+namespace PostFundManagement.Application.Events;
+
+public sealed class ProcessEmailEvent : IEvent
+{
+    public Guid Id { get; set; } = Guid.CreateVersion7();
+
+    public string Name { get; set; } = nameof(ProcessEmailEvent);
+
+    public DateTimeOffset EnqueueAt { get; set; } = DateTimeOffset.UtcNow;
+
+    public string CorrelationId { get; set; } = "email-processor";
+
+    public static ProcessEmailEvent Create() => new();
+}
+
+public sealed class ProcessEmailEventHandler(IDbContextFactory<ApplicationDbContext> contextFactory,
+    IFeatureManager featureManager, EmailService emailService, ISkorubaUserService skorubaUserService) : INotificationHandler<ProcessEmailEvent>
+{
+    const int maxBatch = 100;
+
+    public async ValueTask Handle(ProcessEmailEvent notification, CancellationToken cancellationToken)
+    {
+        if (!await featureManager.IsEnabledAsync(FeatureEmailProcessor)) return;
+
+        await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
+
+        var outgoing = await context.Notifications.AsNoTracking()
+            .Include(i => i.Organisation)
+            .Include(i => i.RecipientUser)
+            .Include(i => i.Tenant)
+            .Where(n => n.Status == Domain.NotificationStatus.Queued)
+            .OrderByDescending(o => o.CreatedAt)
+            .Take(maxBatch)
+            .ToListAsync(cancellationToken);
+
+        if (outgoing?.Count == 0) return;
+
+        if (emailService.Status is not (Domain.EmailStatuses.Connected or Domain.EmailStatuses.Success))
+            await emailService.ConnectAsync(cancellationToken);
+
+        var failedTransmissions = new List<(long notificationId, string? error)>();
+
+        foreach (var enqueuedMessage in outgoing!)
+        {
+            var userClaimResult = await skorubaUserService.GetUserClaimsAsync(enqueuedMessage.RecipientUser!.Id, cancellationToken: cancellationToken);
+
+            if (userClaimResult.IsFailed)
+            {
+                failedTransmissions.Add((enqueuedMessage.Id, "Failed to retrieve user claims"));
+
+                continue;
+            }
+
+            var name = userClaimResult.Value.FirstOrDefault(c => c.ClaimType == "given_name")?.ClaimValue ?? enqueuedMessage.Organisation!.Name;
+            var surname = userClaimResult.Value.FirstOrDefault(c => c.ClaimType == "family_name")?.ClaimValue ?? string.Empty;
+            var email = enqueuedMessage.RecipientUser?.Email ?? enqueuedMessage.Organisation?.Email ?? enqueuedMessage.Destination ?? string.Empty;
+
+            if (string.IsNullOrWhiteSpace(email))
+            {
+                failedTransmissions.Add((enqueuedMessage.Id, "Could not resolve destination email address"));
+
+                continue;
+            }
+
+            var message = new Domain.Models.Email.Message
+            {
+                Sender = new Domain.Models.Email.Party
+                {
+                    Address = "noreply@ifritechnologies.co.za",
+                    Name = "Post Fund Management"
+                },
+                Recipient = new Domain.Models.Email.Party
+                {
+                    Address = email,
+                    Name = string.IsNullOrWhiteSpace(surname)
+                        ? name : $"{name} {surname}"
+                },
+                Subject = enqueuedMessage.Subject,
+                Body = new Domain.Models.Email.Body
+                {
+                    Properties = new Domain.Models.Email.BodyProperties
+                    {
+                        HasAttachments = false,
+                        IsHtml = true
+                    },
+                    Message = enqueuedMessage.Message
+                }
+            };
+
+            var response = await emailService.SendEmailAsync(message, cancellationToken);
+
+            if (response.IsFailed || response.Value.Status is not (Domain.EmailStatuses.Connected or Domain.EmailStatuses.Success))
+            {
+                failedTransmissions.Add((enqueuedMessage.Id, $"Error: {response.Value.Error}"));
+
+                continue;
+            }
+        }
+
+        foreach (var (notificationId, error) in failedTransmissions)
+            await context.Notifications.Where(n => n.Id == notificationId)
+                    .ExecuteUpdateAsync(p => p
+                        .SetProperty(u => u.Status, Domain.NotificationStatus.Failed)
+                        .SetProperty(u => u.Error, error), cancellationToken);
+
+        var failedIds = failedTransmissions.Select(f => f.notificationId).ToList();
+
+        foreach (var successMessage in outgoing)
+        {
+            if (failedIds.Contains(successMessage.Id)) continue;
+
+            await context.Notifications.Where(n => n.Id == successMessage.Id)
+                    .ExecuteUpdateAsync(p => p
+                        .SetProperty(u => u.Status, Domain.NotificationStatus.Sent)
+                        .SetProperty(u => u.Error, string.Empty), cancellationToken);
+        }
+    }
+}

PostFundManagement.Application/Extensions/Quartz.cs

@@ -20,7 +20,7 @@ public static class Quartz
         services.AddQuartz(config =>
         {
             config.UseSimpleTypeLoader();
-            config.UseDefaultThreadPool(options => options.MaxConcurrency = 0);
+            config.UseThreadPool<global::Quartz.Impl.ZeroSizeThreadPool>();
             config.UseTimeZoneConverter();
 
             config.UsePersistentStore(storage =>

PostFundManagement.Application/Interceptors/AuditInterceptor.cs

@@ -1,9 +1,3 @@
-using System.Reflection;
-using System.Security.Claims;
-using System.Text.Json;
-using Castle.DynamicProxy;
-using FluentResults;
-using Microsoft.AspNetCore.Http;
 using PostFundManagement.Application.Services.Shared;
 using PostFundManagement.Domain.Attributes;
 

PostFundManagement.Application/Services/Communications/CommunicationsCacheService.cs

@@ -15,7 +15,7 @@ public sealed class CommunicationsCacheService(CommunicationsService service, ID
     public async Task<Result<ApplicantData[]>> GetApplicantDataAsync(Guid applicantUserId, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<ApplicantData[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetApplicantDataAsync(applicantUserId, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getapplicantdata-{applicantUserId}").Value;
@@ -37,7 +37,7 @@ public sealed class CommunicationsCacheService(CommunicationsService service, ID
     public async Task<Result<Invite>> GetApplicantInviteAsync(Guid applicantUserId, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Invite>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetApplicantInviteAsync(applicantUserId, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getapplicantinvite-{applicantUserId}").Value;
@@ -59,7 +59,7 @@ public sealed class CommunicationsCacheService(CommunicationsService service, ID
     public async Task<Result<Invite[]>> GetApplicantInvitesAsync(Guid applicantUserId, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Invite[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetApplicantInvitesAsync(applicantUserId, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getapplicantinvites-{applicantUserId}").Value;
@@ -83,7 +83,7 @@ public sealed class CommunicationsCacheService(CommunicationsService service, ID
     public async Task<Result<Invite[]>> GetInvitesAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Invite[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetInvitesAsync(pagination, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getinvites-{pagination.Page}-{pagination.PageSize}").Value;
@@ -107,7 +107,7 @@ public sealed class CommunicationsCacheService(CommunicationsService service, ID
     public async Task<Result<Notification>> GetNotificationAsync(string notificationIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Notification>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetNotificationAsync(notificationIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getnotification-{notificationIdHash}").Value;
@@ -131,7 +131,7 @@ public sealed class CommunicationsCacheService(CommunicationsService service, ID
     public async Task<Result<Notification[]>> GetNotificationsAsync(string organisationIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Notification[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetNotificationsAsync(organisationIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getnotifications-{organisationIdHash}").Value;

PostFundManagement.Application/Services/Communications/Events/SyncUserEvent.cs

@@ -1,21 +0,0 @@
-using PostFundManagement.Application.Abstractions;
-using PostFundManagement.Domain.Abstractions;
-
-namespace PostFundManagement.Application.Services.Communications.Events;
-
-public class SyncUserEvent : EventBase, IEvent
-{
-    public string Name { get; set; } = nameof(SyncUserEvent);
-
-    public static SyncUserEvent Create() => new();
-}
-
-public class SyncUserEventHandler(ILogger<SyncUserEvent> logger) : INotificationHandler<SyncUserEvent>
-{
-    public ValueTask Handle(SyncUserEvent notification, CancellationToken cancellationToken)
-    {
-        logger.LogInformation("Integration Sync executed. Correlation ID: {CorrelationId}", notification.CorrelationId);
-
-        return ValueTask.CompletedTask;
-    }
-}

PostFundManagement.Application/Services/Communications/Records.cs

@@ -20,6 +20,7 @@ public sealed record InviteRequest([Required] long OrganisationId,
     [Required] long InvitedOrganisationId,
     [Required] long AwardId,
     [Required] long ContractId,
+    [Required] long ProjectId,
     [Required] Guid Recipient,
     [Required][MaxLength(LabelLength)] string Message,
     [Required] NotificationPlatform Platform);

PostFundManagement.Application/Services/Evidence/EvidenceCacheService.cs

@@ -21,7 +21,7 @@ public sealed class EvidenceCacheService(EvidenceService service, IDistributedCa
     public async Task<Result<Domain.Models.Evidence>> GetEvidenceAsync(string evidenceId, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Domain.Models.Evidence>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetEvidenceAsync(evidenceId, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getevidence-{evidenceId}").Value;
@@ -45,7 +45,7 @@ public sealed class EvidenceCacheService(EvidenceService service, IDistributedCa
     public async Task<Result<Domain.Models.Evidence[]>> GetEvidenceFilesAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Domain.Models.Evidence[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetEvidenceFilesAsync(pagination, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getevidencefiles-{pagination.Page}-{pagination.PageSize}").Value;
@@ -69,7 +69,7 @@ public sealed class EvidenceCacheService(EvidenceService service, IDistributedCa
     public async Task<Result<string>> GetEvidenceUrlAsync(string evidenceIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<string>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetEvidenceUrlAsync(evidenceIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getevidenceurl-{evidenceIdHash}").Value;
@@ -93,7 +93,7 @@ public sealed class EvidenceCacheService(EvidenceService service, IDistributedCa
     public async Task<Result<Indicator>> GetIndicatorAsync(string indicatorId, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Indicator>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetIndicatorAsync(indicatorId, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getindicator-{indicatorId}").Value;
@@ -117,7 +117,7 @@ public sealed class EvidenceCacheService(EvidenceService service, IDistributedCa
     public async Task<Result<Indicator[]>> GetIndicatorsAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Indicator[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetIndicatorsAsync(pagination, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getindicators-{pagination.Page}-{pagination.PageSize}").Value;
@@ -141,7 +141,7 @@ public sealed class EvidenceCacheService(EvidenceService service, IDistributedCa
     public async Task<Result<Domain.Models.Evidence[]>> GetMilestoneEvidencesAsync(string milestoneIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Domain.Models.Evidence[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetMilestoneEvidencesAsync(milestoneIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getmilestoneevidences-{milestoneIdHash}").Value;
@@ -165,7 +165,7 @@ public sealed class EvidenceCacheService(EvidenceService service, IDistributedCa
     public async Task<Result<Domain.Models.Evidence[]>> GetProjectEvidencesAsync(string projectIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Domain.Models.Evidence[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetProjectEvidencesAsync(projectIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getprojectevidences-{projectIdHash}").Value;

PostFundManagement.Application/Services/Execution/ExecutionCacheService.cs

@@ -24,7 +24,7 @@ public sealed class ExecutionCacheService(ExecutionService service, IDistributed
     public async Task<Result<Disbursement>> GetDisbursementAsync(string disbursementIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Disbursement>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetDisbursementAsync(disbursementIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getdisbursement-{disbursementIdHash}").Value;
@@ -48,7 +48,7 @@ public sealed class ExecutionCacheService(ExecutionService service, IDistributed
     public async Task<Result<Disbursement[]>> GetDisbursementsAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Disbursement[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetDisbursementsAsync(pagination, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getdisbursements-{pagination.Page}-{pagination.PageSize}-{pagination.Index}").Value;
@@ -72,7 +72,7 @@ public sealed class ExecutionCacheService(ExecutionService service, IDistributed
     public async Task<Result<Risk>> GetRiskAsync(string riskIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Risk>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetRiskAsync(riskIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getrisk-{riskIdHash}").Value;
@@ -96,7 +96,7 @@ public sealed class ExecutionCacheService(ExecutionService service, IDistributed
     public async Task<Result<Risk[]>> GetRisksAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Risk[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetRisksAsync(pagination, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getrisks-{pagination.Page}-{pagination.PageSize}-{pagination.Index}").Value;
@@ -120,7 +120,7 @@ public sealed class ExecutionCacheService(ExecutionService service, IDistributed
     public async Task<Result<Rule>> GetRuleAsync(string ruleIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Rule>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetRuleAsync(ruleIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getrisk-{ruleIdHash}").Value;
@@ -144,7 +144,7 @@ public sealed class ExecutionCacheService(ExecutionService service, IDistributed
     public async Task<Result<Rule[]>> GetRulesAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Rule[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetRulesAsync(pagination, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getrules-{pagination.Page}-{pagination.PageSize}-{pagination.Index}").Value;

PostFundManagement.Application/Services/Governance/GovernanceCacheService.cs

@@ -27,7 +27,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<Dashboard>> GetDashboardAsync(CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Dashboard>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetDashboardAsync(cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getdashboard").Value;
@@ -51,7 +51,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<Instrument[]>> GetInstrumentsAsync(string programmeIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Instrument[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetInstrumentsAsync(programmeIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getinstruments").Value;
@@ -75,7 +75,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<Organisation>> GetOrganisationAsync(string organisationIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Organisation>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetOrganisationAsync(organisationIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getorganisation-{organisationIdHash}").Value;
@@ -99,7 +99,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<Organisation[]>> GetOrganisationsAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Organisation[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetOrganisationsAsync(pagination, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getorganisations-{pagination.Page}-{pagination.PageSize}").Value;
@@ -123,7 +123,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<Portfolio[]>> GetOrganisationPorfoliosAsync(string organisationIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Portfolio[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetOrganisationPorfoliosAsync(organisationIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getorganisationportfolios-{organisationIdHash}").Value;
@@ -147,7 +147,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<Portfolio>> GetPortfolioAsync(string portfolioIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Portfolio>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetPortfolioAsync(portfolioIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getportfolio-{portfolioIdHash}").Value;
@@ -171,7 +171,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<Programme[]>> GetPortfolioProgrammesAsync(string portfolioIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Programme[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetPortfolioProgrammesAsync(portfolioIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getportfolioprogrammes-{portfolioIdHash}").Value;
@@ -195,7 +195,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<Programme[]>> GetProgrammesAsync(string portfolioIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Programme[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetProgrammesAsync(portfolioIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getprogrammes-{portfolioIdHash}").Value;
@@ -219,7 +219,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<Tenant>> GetTenantAsync(string tenantIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Tenant>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetTenantAsync(tenantIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"gettenant-{tenantIdHash}").Value;
@@ -243,7 +243,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<TenantOrganisation>> GetTenantOrganisationAsync(string tenantOrganisationIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<TenantOrganisation>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetTenantOrganisationAsync(tenantOrganisationIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"gettenantorganisation-{tenantOrganisationIdHash}").Value;
@@ -267,7 +267,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<TenantOrganisation[]>> GetTenantOrganisationsAsync(string tenantIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<TenantOrganisation[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetTenantOrganisationsAsync(tenantIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"gettenantorganisations-{tenantIdHash}").Value;
@@ -294,7 +294,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<Tenant[]>> GetTenantsAsync(CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Tenant[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetTenantsAsync(cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"gettenants").Value;
@@ -336,7 +336,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<Portfolio[]>> GetPorfoliosAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Portfolio[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetPorfoliosAsync(pagination, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getportfolios-{pagination.Page}-{pagination.PageSize}").Value;
@@ -360,7 +360,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<decimal>> GetProgrammeValueAsync(string programmeIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<decimal>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetProgrammeValueAsync(programmeIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getprogrammevalue-{programmeIdHash}").Value;
@@ -386,7 +386,7 @@ public sealed class GovernanceCacheService(GovernanceService service, IDistribut
     public async Task<Result<decimal>> GetPorfolioValueAsync(string portfolioIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<decimal>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetPorfolioValueAsync(portfolioIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getportfoliovalue-{portfolioIdHash}").Value;

PostFundManagement.Application/Services/Governance/GovernanceService.cs

@@ -182,7 +182,7 @@ public sealed class GovernanceService(IDbContextFactory<ApplicationDbContext> co
             if (!await context.Users.AnyAsync(u => u.Id == request.OrganisationUser, cancellationToken))
                 return Result.Fail(ValidationError.Create("Organisation user not found"));
 
-            if (!await context.TenantUsers.AnyAsync(u => u.UserId == request.OrganisationUser && u.TenantId == tenantContext.TenantId, cancellationToken))
+            if (!tenantContext.IsAdmin && !await context.TenantUsers.AnyAsync(u => u.UserId == request.OrganisationUser && u.TenantId == tenantContext.TenantId, cancellationToken))
                 return Result.Fail(ValidationError.Create("Organisation user does not belong to the current tenant"));
 
             var changedTotal = await context.Organisations
@@ -192,6 +192,7 @@ public sealed class GovernanceService(IDbContextFactory<ApplicationDbContext> co
                     .SetProperty(u => u.RegistrationNo, request.RegistrationNo.Clean())
                     .SetProperty(u => u.Email, request.Email.ToLower(CultureInfo.InvariantCulture).Clean())
                     .SetProperty(u => u.Type, request.Type)
+                    .SetProperty(u => u.UserId, request.OrganisationUser) 
                     .SetProperty(u => u.Status, request.Status), cancellationToken);
 
             var tenantOrganisation = await context.TenantOrganisations.AsNoTracking().FirstOrDefaultAsync(f => f.OrganisationId == request.OrganisationId, cancellationToken);

PostFundManagement.Application/Services/Grants/GrantsCacheService.cs

@@ -27,7 +27,7 @@ public sealed class GrantsCacheService(GrantsService service, IDistributedCache
     public async Task<Result<Award>> GetAwardAsync(string awardIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Award>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetAwardAsync(awardIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getaward-{awardIdHash}").Value;
@@ -51,7 +51,7 @@ public sealed class GrantsCacheService(GrantsService service, IDistributedCache
     public async Task<Result<Award[]>> GetAwardsAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Award[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetAwardsAsync(pagination, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getawards-{pagination.Page}-{pagination.PageSize}-{pagination.Index}").Value;
@@ -75,7 +75,7 @@ public sealed class GrantsCacheService(GrantsService service, IDistributedCache
     public async Task<Result<Budget>> GetBudgetAsync(string budgetIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Budget>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetBudgetAsync(budgetIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getbudget-{budgetIdHash}").Value;
@@ -99,7 +99,7 @@ public sealed class GrantsCacheService(GrantsService service, IDistributedCache
     public async Task<Result<Budget[]>> GetBudgetsAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Budget[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetBudgetsAsync(pagination, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getbudgets-{pagination.Page}-{pagination.PageSize}-{pagination.Index}").Value;
@@ -123,7 +123,7 @@ public sealed class GrantsCacheService(GrantsService service, IDistributedCache
     public async Task<Result<Contract>> GetContractAsync(string contractIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Contract>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetContractAsync(contractIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getctract-{contractIdHash}").Value;
@@ -147,7 +147,7 @@ public sealed class GrantsCacheService(GrantsService service, IDistributedCache
     public async Task<Result<Contract[]>> GetContractsAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Contract[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetContractsAsync(pagination, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getcontracts-{pagination.Index}-{pagination.PageSize}-{pagination.Page}").Value;
@@ -171,7 +171,7 @@ public sealed class GrantsCacheService(GrantsService service, IDistributedCache
     public async Task<Result<string>> GetContractUrlAsync(string contractIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<string>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetContractUrlAsync(contractIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getcontracturl-{contractIdHash}").Value;

PostFundManagement.Application/Services/Grants/GrantsService.cs

@@ -159,12 +159,7 @@ public sealed class GrantsService(IDbContextFactory<ApplicationDbContext> contex
             await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
 
             if (!await context.Projects.AnyAsync(p => p.Id == request.ProjectId, cancellationToken))
-                return Result.Fail(NotFoundError.New);
-
-            var hasApprovedAward = await context.Awards
-                .AnyAsync(a => a.ProjectId == request.ProjectId && a.Status == ApprovalStatus.Approved, cancellationToken);
-            if (!hasApprovedAward)
-                return Result.Fail(ValidationError.Create("Cannot create budget: The project's linked award is not approved or does not exist."));
+                return Result.Fail(NotFoundError.New);            
 
             var budget = new Domain.Entities.Budget
             {

PostFundManagement.Application/Services/Projects/ProjectCacheService.cs

@@ -42,7 +42,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Domain.Models.Activity[]>> GetActivitiesAsync(string projectIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Domain.Models.Activity[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetActivitiesAsync(projectIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getactivities-{projectIdHash}").Value;
@@ -66,7 +66,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Domain.Models.Activity>> GetActivityAsync(string activityIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Domain.Models.Activity>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetActivityAsync(activityIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getactivity-{activityIdHash}").Value;
@@ -90,7 +90,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Beneficiary[]>> GetBeneficiariesAsync(string projectIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Beneficiary[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetBeneficiariesAsync(projectIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getbeneficiaries-{projectIdHash}").Value;
@@ -114,7 +114,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Beneficiary>> GetBeneficiaryAsync(string beneficiaryIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Beneficiary>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetBeneficiaryAsync(beneficiaryIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getbeneficiary-{beneficiaryIdHash}").Value;
@@ -138,7 +138,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<ChangeRequest>> GetChangeRequestAsync(string changeRequestIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<ChangeRequest>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetChangeRequestAsync(changeRequestIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getchangerequest-{changeRequestIdHash}").Value;
@@ -162,7 +162,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<ChangeRequest[]>> GetChangeRequestsAsync(string projectIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<ChangeRequest[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetChangeRequestsAsync(projectIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getchangerequests-{projectIdHash}").Value;
@@ -186,7 +186,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<ComplianceItem>> GetComplianceItemAsync(string complianceItemIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<ComplianceItem>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetComplianceItemAsync(complianceItemIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getcomplianceitem-{complianceItemIdHash}").Value;
@@ -210,7 +210,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<ComplianceItem[]>> GetComplianceItemsAsync(string projectIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<ComplianceItem[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetComplianceItemsAsync(projectIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getcomplianceitems-{projectIdHash}").Value;
@@ -234,7 +234,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Issue>> GetIssueAsync(string issueIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Issue>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetIssueAsync(issueIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getissue-{issueIdHash}").Value;
@@ -258,7 +258,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Issue[]>> GetIssuesAsync(string projectIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Issue[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetIssuesAsync(projectIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getissues-{projectIdHash}").Value;
@@ -282,7 +282,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Milestone>> GetMilestoneAsync(string milestoneIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Milestone>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetMilestoneAsync(milestoneIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getmilestone-{milestoneIdHash}").Value;
@@ -306,7 +306,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Milestone[]>> GetMilestonesAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Milestone[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetMilestonesAsync(pagination, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getmilestones-{pagination.Index}-{pagination.PageSize}-{pagination.Page}").Value;
@@ -330,7 +330,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Outcome>> GetOutcomeAsync(string outcomeIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Outcome>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetOutcomeAsync(outcomeIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getoutcome-{outcomeIdHash}").Value;
@@ -354,7 +354,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Outcome[]>> GetOutcomesAsync(string beneficiaryIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Outcome[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetOutcomesAsync(beneficiaryIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getoutcomes-{beneficiaryIdHash}").Value;
@@ -378,7 +378,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Outcome[]>> GetProjectOutcomesAsync(string projectIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Outcome[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetProjectOutcomesAsync(projectIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getprojectoutcomes-{projectIdHash}").Value;
@@ -402,7 +402,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Programme>> GetProgrammeAsync(string programmeIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Programme>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetProgrammeAsync(programmeIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getprogramme-{programmeIdHash}").Value;
@@ -426,7 +426,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Project[]>> GetProgrammeProjectsAsync(string programmeIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Project[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetProgrammeProjectsAsync(programmeIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getprogrammeprojects-{programmeIdHash}").Value;
@@ -450,7 +450,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Programme[]>> GetProgrammesAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Programme[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetProgrammesAsync(pagination, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getprogrammes-{pagination.Index}-{pagination.PageSize}-{pagination.Page}").Value;
@@ -474,7 +474,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Project>> GetProjectAsync(string projectIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Project>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetProjectAsync(projectIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getproject-{projectIdHash}").Value;
@@ -498,7 +498,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Indicator[]>> GetProjectIndicatorsAsync(string projectIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Indicator[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetProjectIndicatorsAsync(projectIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getprojectindicators-{projectIdHash}").Value;
@@ -522,7 +522,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Milestone[]>> GetProjectMilestonesAsync(string projectIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Milestone[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetProjectMilestonesAsync(projectIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getprojectmilestones-{projectIdHash}").Value;
@@ -546,7 +546,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Risk[]>> GetProjectRisksAsync(string projectIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Risk[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetProjectRisksAsync(projectIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getprojectrisks-{projectIdHash}").Value;
@@ -570,7 +570,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<Project[]>> GetProjectsAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Project[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetProjectsAsync(pagination, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getprojects-{pagination.Index}-{pagination.Page}-{pagination.PageSize}").Value;
@@ -594,7 +594,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<SiteVisit>> GetSiteVisitAsync(string siteVisitIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<SiteVisit>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetSiteVisitAsync(siteVisitIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getsitevisit-{siteVisitIdHash}").Value;
@@ -618,7 +618,7 @@ public sealed class ProjectCacheService(ProjectService service, IDistributedCach
     public async Task<Result<SiteVisit[]>> GetSiteVisitsAsync(string projectIdHash, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<SiteVisit[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetSiteVisitsAsync(projectIdHash, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getsitevisits-{projectIdHash}").Value;

PostFundManagement.Application/Services/Projects/ProjectService.cs

@@ -20,27 +20,6 @@ public sealed class ProjectService(IDbContextFactory<ApplicationDbContext> conte
             if (!await context.Users.AnyAsync(u => u.Id == userId, cancellationToken))
                 return Result.Fail(NotFoundError.New);
 
-            if (request.Status == ApprovalStatus.Approved)
-            {
-                var hasUnmetCompliance = await context.ComplianceItems
-                    .AnyAsync(c => c.ProjectId == request.ProjectId && c.Status == ComplianceStatus.NotMet, cancellationToken);
-                if (hasUnmetCompliance)
-                    return Result.Fail(ValidationError.Create("Project cannot be approved because some compliance items are not met."));
-
-                var projectBeneficiaryIds = await context.Beneficiaries
-                    .Where(b => b.ProjectId == request.ProjectId)
-                    .Select(b => b.Id)
-                    .ToListAsync(cancellationToken);
-
-                if (projectBeneficiaryIds.Count > 0)
-                {
-                    var hasUnmetOutcomes = await context.Outcomes
-                        .AnyAsync(o => projectBeneficiaryIds.Contains(o.BeneficiaryId) && o.Status == ComplianceStatus.NotMet, cancellationToken);
-                    if (hasUnmetOutcomes)
-                        return Result.Fail(ValidationError.Create("Project cannot be approved because some beneficiary outcomes are not met."));
-                }
-            }
-
             var changedTotal = await context.Projects
                 .Where(f => f.Id == request.ProjectId)
                 .ExecuteUpdateAsync(f => f

PostFundManagement.Application/Services/Shared/HashService.cs

@@ -51,8 +51,10 @@ public sealed partial class HashService(IHashids hasher) : IService
 
         int[] decoded = hasher.Decode(hash);
 
-        return Result.FailIf(decoded.Length <= 0, ValidationError.Create("Invalid or modified Int hash token."))
-            .ToResult(decoded[0]);
+        if (decoded.Length <= 0)
+            return Result.Fail<int>(ValidationError.Create("Invalid or modified Int hash token."));
+
+        return Result.Ok(decoded[0]);
     }
 
     public Result<long> DecodeLongIdHash(string hash)
@@ -62,8 +64,10 @@ public sealed partial class HashService(IHashids hasher) : IService
 
         long[] decoded = hasher.DecodeLong(hash);
 
-        return Result.FailIf(decoded.Length <= 0, ValidationError.Create("Invalid or modified Long hash token."))
-            .ToResult(decoded[0]);
+        if (decoded.Length <= 0)
+            return Result.Fail<long>(ValidationError.Create("Invalid or modified Long hash token."));
+
+        return Result.Ok(decoded[0]);
     }
 
     public async Task<Result<string>> DecodeHexHash(string hex) =>

PostFundManagement.Application/Services/Users/UserCacheService.cs

@@ -29,7 +29,7 @@ public sealed class UserCacheService(UserService service, IDistributedCache cach
     public async Task<Result<Claim[]>> GetRoleClaimsAsync(Guid roleId, Guid userId, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Claim[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetRoleClaimsAsync(roleId, userId, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getsystemroles-{userId}").Value;
@@ -54,7 +54,7 @@ public sealed class UserCacheService(UserService service, IDistributedCache cach
     public async Task<Result<Role[]>> GetSystemRolesAsync(Guid userId, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Role[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetSystemRolesAsync(userId, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getsystemroles-{userId}").Value;
@@ -79,7 +79,7 @@ public sealed class UserCacheService(UserService service, IDistributedCache cach
     public async Task<Result<User>> GetUserAsync(Guid userId, CancellationToken cancellationToken) =>
         await Result.Try((Func<Task<Result<User>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetUserAsync(userId, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getuser-{userId}").Value;
@@ -103,7 +103,7 @@ public sealed class UserCacheService(UserService service, IDistributedCache cach
     public async Task<Result<Claim[]>> GetUserClaimsAsync(Guid targetUserId, Guid userId, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Claim[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetUserClaimsAsync(targetUserId, userId, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getuserclaims-{userId}").Value;
@@ -128,7 +128,7 @@ public sealed class UserCacheService(UserService service, IDistributedCache cach
     public async Task<Result<Role[]>> GetUserRolesAsync(Guid targetUserId, Guid userId, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Role[]>>>)(async () =>
         {
-            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+            if (!await featureManager.IsEnabledAsync(FeatureServiceCaching))
                 return await service.GetUserRolesAsync(targetUserId, userId, cancellationToken);
 
             var cacheKey = HashService.ToMd5Hash($"getuserroles-{userId}").Value;

PostFundManagement.ConsoleUI/.env.example

@@ -12,7 +12,6 @@ APP_URL="MY_APP_URL"
 VITE_OIDC_AUTHORITY="https://sts.security.khongisa.co.za"
 VITE_OIDC_AUDIENCE="pfm-api-dev"
 VITE_OIDC_CLIENT_ID="pfm-scalar-dev"
-VITE_OIDC_CLIENT_SECRET="secret_71f88570a46eb22eb5270b47f69e3332c84d8db85d008f0276cb7431c8872d27"
 
 # PFM Backend API Base URL
 VITE_API_BASE_URL="https://api.ifri.khongisa.co.za/"

PostFundManagement.ConsoleUI/docker-entrypoint.sh

@@ -26,15 +26,12 @@ OIDC_AUDIENCE="${VITE_OIDC_AUDIENCE:-${OIDC_AUDIENCE:-${SecuritySettings__Audien
 # 4. OIDC Client ID
 OIDC_CLIENT_ID="${VITE_OIDC_CLIENT_ID:-${OIDC_CLIENT_ID:-${SecuritySettings__ClientId:-${SecuritySettings_ClientId:-${CLIENT_ID:-}}}}}"
 
-# 5. OIDC Client Secret
-OIDC_CLIENT_SECRET="${VITE_OIDC_CLIENT_SECRET:-${OIDC_CLIENT_SECRET:-${SecuritySettings__ClientSecret:-${SecuritySettings_ClientSecret:-${CLIENT_SECRET:-}}}}}"
-
-# 6. OIDC Scope
+# 5. OIDC Scope
 OIDC_SCOPE="${VITE_OIDC_SCOPE:-${OIDC_SCOPE:-${SecuritySettings__Scope:-${SecuritySettings_Scope:-${SCOPE:-}}}}}"
 
-# 7. Hasher Settings
-HASHER_SALT="${VITE_HASHER_SALT:-${HASHER_SALT:-${HasherSettings__Salt:-${HasherSettings_Salt:-}}}}}"
-HASHER_MIN_LENGTH="${VITE_HASHER_MIN_LENGTH:-${HASHER_MIN_LENGTH:-${HasherSettings__MinLength:-${HasherSettings_MinLength:-}}}}}"
+# 6. Hasher Settings
+HASHER_MIN_LENGTH="${VITE_HASHER_MIN_LENGTH:-${HASHER_MIN_LENGTH:-${HasherSettings__MinLength:-${HasherSettings_MinLength:-11}}}}"
+HASHER_SALT="${VITE_HASHER_SALT:-${HASHER_SALT:-${HasherSettings__Salt:-${HasherSettings_Salt:-TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==}}}}"
 
 if [ -d "$TARGET_DIR" ]; then
   echo "[docker-entrypoint] Generating runtime configuration files in $TARGET_DIR..."
@@ -51,14 +48,12 @@ window.__RUNTIME_CONFIG__ = {
   VITE_OIDC_AUDIENCE: "${OIDC_AUDIENCE}",
   OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}",
   VITE_OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}",
-  OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}",
-  VITE_OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}",
   OIDC_SCOPE: "${OIDC_SCOPE}",
   VITE_OIDC_SCOPE: "${OIDC_SCOPE}",
-  HASHER_SALT: "${HASHER_SALT}",
-  VITE_HASHER_SALT: "${HASHER_SALT}",
   HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}",
   VITE_HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}",
+  HASHER_SALT: "${HASHER_SALT}",
+  VITE_HASHER_SALT: "${HASHER_SALT}",
   ApiSettings: {
     BaseUrl: "${API_BASE_URL}"
   },
@@ -66,7 +61,6 @@ window.__RUNTIME_CONFIG__ = {
     Authority: "${OIDC_AUTHORITY}",
     Audience: "${OIDC_AUDIENCE}",
     ClientId: "${OIDC_CLIENT_ID}",
-    ClientSecret: "${OIDC_CLIENT_SECRET}",
     Scope: "${OIDC_SCOPE}"
   },
   HasherSettings: {
@@ -86,7 +80,6 @@ EOF
     "Authority": "${OIDC_AUTHORITY}",
     "Audience": "${OIDC_AUDIENCE}",
     "ClientId": "${OIDC_CLIENT_ID}",
-    "ClientSecret": "${OIDC_CLIENT_SECRET}",
     "Scope": "${OIDC_SCOPE}"
   },
   "HasherSettings": {

PostFundManagement.ConsoleUI/public/config.json

@@ -6,11 +6,10 @@
     "Authority": "",
     "Audience": "",
     "ClientId": "",
-    "ClientSecret": "",
     "Scope": ""
   },
   "HasherSettings": {
-    "Salt": "",
-    "MinHashLength": ""
+    "Salt": "TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==",
+    "MinHashLength": "11"
   }
 }

PostFundManagement.ConsoleUI/public/env-config.js

@@ -1,4 +1,13 @@
 // Development and fallback runtime configuration.
 // In Docker / Kubernetes / Cloud Run deployments, this file is dynamically
 // populated at container startup by /docker-entrypoint.sh with deployment environment variables.
-window.__RUNTIME_CONFIG__ = window.__RUNTIME_CONFIG__ || {};
+window.__RUNTIME_CONFIG__ = window.__RUNTIME_CONFIG__ || {
+  HASHER_SALT: "TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==",
+  VITE_HASHER_SALT: "TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==",
+  HASHER_MIN_LENGTH: "11",
+  VITE_HASHER_MIN_LENGTH: "11",
+  HasherSettings: {
+    Salt: "TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==",
+    MinHashLength: "11"
+  }
+};

PostFundManagement.ConsoleUI/src/auth/AuthProvider.tsx

@@ -10,13 +10,14 @@ import {
   isActivationPending,
   getActivationPendingReason,
   clearUserSyncInBrowser,
+  setActivationPending,
   UserSyncResult,
 } from '../services/userSyncService';
 import { AccountActivationModal } from '../components/auth/AccountActivationModal';
 import { PartnerAccessDeniedModal } from '../components/auth/PartnerAccessDeniedModal';
 import { SessionExpiredModal } from '../components/auth/SessionExpiredModal';
-import { encodeHashIdSync } from '../services/toolsService';
-import { verifyTenantLockout } from '../services/tenantLockoutService';
+import { encodeHashIdSync } from '../utils/hashids';
+import { verifyTenantLockout, clearTenantLockoutCache } from '../services/tenantLockoutService';
 import {
   onSessionExpired,
   triggerSessionExpired,
@@ -307,11 +308,6 @@ export function resetUserManager(): void {
   userManagerInstance = null;
 }
 
-// Automatically reset UserManager when runtime configuration is updated
-onConfigChanged(() => {
-  resetUserManager();
-});
-
 export function getUserManager(): UserManager {
   if (!userManagerInstance && typeof window !== 'undefined') {
     const sec = getSecuritySettings();
@@ -320,7 +316,7 @@ export function getUserManager(): UserManager {
     userManagerInstance = new UserManager({
       authority: sec.Authority,
       client_id: sec.ClientId,
-      client_secret: sec.ClientSecret,
+      ...(sec.ClientSecret ? { client_secret: sec.ClientSecret } : {}),
       redirect_uri: `${origin}/dashboard`,
       post_logout_redirect_uri: `${origin}/`,
       response_type: 'code',
@@ -437,8 +433,8 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
             localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(mergedClaims));
 
             const tenantClaimValues = extractTenantClaimValues(mergedClaims, token);
-            const tenantClaim = (mergedClaims.tenant as string) || (oidcUser.profile?.tenant as string) || tenantClaimValues.tenant || undefined;
-            const parsedTenantId = extractTenantId(mergedClaims, token);
+            let tenantClaim = (mergedClaims.tenant as string) || (oidcUser.profile?.tenant as string) || tenantClaimValues.tenant || undefined;
+            let parsedTenantId = extractTenantId(mergedClaims, token);
             setTenantId(parsedTenantId);
 
             const profile: AuthUserProfile = {
@@ -458,29 +454,7 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
             // Clean up code and state from URL
             window.history.replaceState({}, document.title, window.location.pathname);
 
-            // Verify tenant lockout at the instance tenant and tenant_id claims are retrieved
-            const tenantLockoutResult = await verifyTenantLockout(
-              parsedTenantId ?? tenantClaimValues.tenantId,
-              tenantClaim
-            );
-
-            if (!tenantLockoutResult.isActive) {
-              setIsPendingActivation(true);
-              setIsSynced(false);
-              setActivationError(tenantLockoutResult.errorMessage || 'Tenant is inactive or not found');
-              setIsLoading(false);
-              return;
-            }
-
-            if (tenantLockoutResult.tenant?.name) {
-              profile.tenant = tenantLockoutResult.tenant.name;
-              setTenantName(tenantLockoutResult.tenant.name);
-              localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(profile));
-            } else if (tenantClaim) {
-              setTenantName(tenantClaim);
-            }
-
-            // Synchronize authenticated user profile with backend directory
+            // Step 1: Synchronize authenticated user profile with backend directory FIRST (/v1/api/integration/sync)
             try {
               const syncResult = await syncUserAccount(userSub, token, profile, true);
               if (syncResult.isUnauthorized) {
@@ -488,6 +462,51 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                 window.location.replace('/');
                 return;
               }
+
+              // Step 2: Retrieve user roles, role claims, and user claims (Requirement 2 & 3 & 7)
+              try {
+                const resolved = await resolveUserRolesAndClaims(userSub, mergedClaims, profile);
+                if (resolved.primaryRole) {
+                  profile.role = resolved.primaryRole;
+                }
+                if (resolved.tenant) {
+                  profile.tenant = resolved.tenant;
+                  tenantClaim = resolved.tenant;
+                  setTenantName(resolved.tenant);
+                }
+                if (resolved.tenant_id !== undefined) {
+                  profile.tenant_id = resolved.tenant_id;
+                  parsedTenantId = resolved.tenant_id;
+                  setTenantId(resolved.tenant_id);
+                }
+                setUser({ ...profile });
+                setClaims({ ...resolved.claims });
+                localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(profile));
+                localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
+              } catch {}
+
+              // Step 3: Verify tenant lockout now that user is synced and authenticated
+              const tenantLockoutResult = await verifyTenantLockout(
+                parsedTenantId ?? tenantClaimValues.tenantId,
+                tenantClaim
+              );
+
+              if (!tenantLockoutResult.isActive) {
+                setIsPendingActivation(true);
+                setIsSynced(false);
+                setActivationError(tenantLockoutResult.errorMessage || 'Tenant is inactive or not found');
+                setIsLoading(false);
+                return;
+              }
+
+              if (tenantLockoutResult.tenant?.name) {
+                profile.tenant = tenantLockoutResult.tenant.name;
+                setTenantName(tenantLockoutResult.tenant.name);
+                localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(profile));
+              } else if (tenantClaim) {
+                setTenantName(tenantClaim);
+              }
+
               if (syncResult.isActivationPending) {
                 setIsPendingActivation(true);
                 setIsSynced(false);
@@ -496,26 +515,6 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                 setIsPendingActivation(false);
                 setIsSynced(true);
                 setActivationError(null);
-
-                // Retrieve user roles, role claims, and user claims (Requirement 2 & 3 & 7)
-                try {
-                  const resolved = await resolveUserRolesAndClaims(userSub, mergedClaims, profile);
-                  if (resolved.primaryRole) {
-                    profile.role = resolved.primaryRole;
-                  }
-                  if (resolved.tenant) {
-                    profile.tenant = resolved.tenant;
-                    setTenantName(resolved.tenant);
-                  }
-                  if (resolved.tenant_id !== undefined) {
-                    profile.tenant_id = resolved.tenant_id;
-                    setTenantId(resolved.tenant_id);
-                  }
-                  setUser({ ...profile });
-                  setClaims({ ...resolved.claims });
-                  localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(profile));
-                  localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
-                } catch {}
               }
             } catch (syncErr: any) {
               if (syncErr?.response?.status === 401) {
@@ -525,7 +524,9 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
               }
               setIsPendingActivation(true);
               setIsSynced(false);
-              setActivationError(syncErr?.message || 'Account activation pending');
+              const rawMsg = syncErr?.message || 'Account activation pending';
+              const cleanMsg = /network\s*error/i.test(rawMsg) ? rawMsg.replace(/network\s*error/gi, 'Permission Check') : rawMsg;
+              setActivationError(cleanMsg);
             }
 
             setIsLoading(false);
@@ -561,10 +562,10 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
             setSub(storedSub);
           }
 
-          const storedTenantId = extractTenantId(parsedClaims, storedToken);
+          let storedTenantId = extractTenantId(parsedClaims, storedToken);
           setTenantId(storedTenantId);
           const tenantClaimValues = extractTenantClaimValues(parsedClaims, storedToken);
-          const storedTenantClaim = (parsedClaims.tenant as string) || tenantClaimValues.tenant || undefined;
+          let storedTenantClaim = (parsedClaims.tenant as string) || tenantClaimValues.tenant || undefined;
 
           let resolvedUser: AuthUserProfile | null = null;
           if (storedUser) {
@@ -588,9 +589,53 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
           // Initial fast unblock: valid persisted session found, unblock UI immediately
           setIsLoading(false);
 
-          // Asynchronous background revalidation (Tenant Lockout, User Sync, Role Claims)
+          // Asynchronous background revalidation (User Sync, Role Claims, Tenant Lockout)
           (async () => {
             try {
+              const wasPending = isActivationPending();
+              setIsPendingActivation(wasPending);
+              setActivationError(getActivationPendingReason());
+
+              // Step 1: Sync user account FIRST
+              const syncResult = await syncUserAccount(
+                storedSub || '',
+                storedToken,
+                resolvedUser || undefined,
+                false
+              );
+
+              if (syncResult.isUnauthorized) {
+                await logout();
+                return;
+              }
+
+              // Step 2: Retrieve user roles, role claims, and user claims
+              try {
+                const resolved = await resolveUserRolesAndClaims(
+                  storedSub || '',
+                  parsedClaims,
+                  resolvedUser || {}
+                );
+                if (resolvedUser) {
+                  if (resolved.primaryRole) resolvedUser.role = resolved.primaryRole;
+                  if (resolved.tenant) {
+                    resolvedUser.tenant = resolved.tenant;
+                    storedTenantClaim = resolved.tenant;
+                    setTenantName(resolved.tenant);
+                  }
+                  if (resolved.tenant_id !== undefined) {
+                    resolvedUser.tenant_id = resolved.tenant_id;
+                    storedTenantId = resolved.tenant_id;
+                    setTenantId(resolved.tenant_id);
+                  }
+                  setUser({ ...resolvedUser });
+                  localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(resolvedUser));
+                }
+                setClaims({ ...resolved.claims });
+                localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
+              } catch {}
+
+              // Step 3: Verify tenant lockout now that user is verified active
               const tenantLockoutResult = await verifyTenantLockout(
                 storedTenantId ?? tenantClaimValues.tenantId,
                 storedTenantClaim
@@ -612,22 +657,6 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                 setTenantName(tenantLockoutResult.tenant.name);
               }
 
-              const wasPending = isActivationPending();
-              setIsPendingActivation(wasPending);
-              setActivationError(getActivationPendingReason());
-
-              const syncResult = await syncUserAccount(
-                storedSub || '',
-                storedToken,
-                resolvedUser || undefined,
-                false
-              );
-
-              if (syncResult.isUnauthorized) {
-                await logout();
-                return;
-              }
-
               if (syncResult.isActivationPending) {
                 setIsPendingActivation(true);
                 setIsSynced(false);
@@ -639,27 +668,6 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                 setIsPendingActivation(false);
                 setIsSynced(true);
                 setActivationError(null);
-
-                const resolved = await resolveUserRolesAndClaims(
-                  storedSub || '',
-                  parsedClaims,
-                  resolvedUser || {}
-                );
-                if (resolvedUser) {
-                  if (resolved.primaryRole) resolvedUser.role = resolved.primaryRole;
-                  if (resolved.tenant) {
-                    resolvedUser.tenant = resolved.tenant;
-                    setTenantName(resolved.tenant);
-                  }
-                  if (resolved.tenant_id !== undefined) {
-                    resolvedUser.tenant_id = resolved.tenant_id;
-                    setTenantId(resolved.tenant_id);
-                  }
-                  setUser({ ...resolvedUser });
-                  localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(resolvedUser));
-                }
-                setClaims({ ...resolved.claims });
-                localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
               }
             } catch (syncErr: any) {
               if (syncErr?.response?.status === 401) {
@@ -668,7 +676,9 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
               }
               setIsPendingActivation(true);
               setIsSynced(false);
-              setActivationError(syncErr?.message || 'Account activation pending');
+              const rawMsg = syncErr?.message || 'Account activation pending';
+              const cleanMsg = /network\s*error/i.test(rawMsg) ? rawMsg.replace(/network\s*error/gi, 'Permission Check') : rawMsg;
+              setActivationError(cleanMsg);
             }
           })();
 
@@ -687,12 +697,65 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
 
   const syncUserSession = async (force = true): Promise<UserSyncResult> => {
     try {
-      // Re-verify tenant status via GetTenant as part of the lockout resolution
-      const tenantClaimValues = extractTenantClaimValues(claims, accessToken);
-      const currentTenantId = tenantId ?? tenantClaimValues.tenantId;
-      const currentTenantClaim = (claims.tenant as string) || user?.tenant || tenantClaimValues.tenant || undefined;
+      await loadRuntimeConfig();
+      clearTenantLockoutCache();
 
-      const tenantLockoutResult = await verifyTenantLockout(currentTenantId, currentTenantClaim);
+      // Step 1: Proceed with user sync FIRST (/v1/api/integration/sync)
+      const result = await syncUserAccount(sub, accessToken, user || undefined, force);
+      if (result.isUnauthorized) {
+        await logout();
+        return result;
+      }
+      if (result.isActivationPending) {
+        setIsPendingActivation(true);
+        setIsSynced(false);
+        setActivationError(result.errorMessage || null);
+        return result;
+      }
+
+      // Step 2: Refresh user roles and claims from backend
+      let currentTenantId: number | string | null = tenantId;
+      let currentTenantClaim: string | undefined =
+        (claims.tenant as string) || user?.tenant || undefined;
+
+      try {
+        const resolved = await resolveUserRolesAndClaims(sub, claims, user || {});
+        const updatedProfile = user ? { ...user } : null;
+        if (updatedProfile && resolved.primaryRole) {
+          updatedProfile.role = resolved.primaryRole;
+        }
+        if (resolved.tenant) {
+          currentTenantClaim = resolved.tenant;
+          setTenantName(resolved.tenant);
+          if (updatedProfile) updatedProfile.tenant = resolved.tenant;
+        }
+        if (resolved.tenant_id !== undefined) {
+          currentTenantId = resolved.tenant_id;
+          setTenantId(resolved.tenant_id);
+          if (updatedProfile) updatedProfile.tenant_id = resolved.tenant_id;
+        }
+        if (updatedProfile) {
+          setUser(updatedProfile);
+          localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(updatedProfile));
+        }
+        setClaims({ ...resolved.claims });
+        localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
+      } catch {}
+
+      // Step 3: Re-verify tenant status via GetTenant now that user is synced
+      const tenantClaimValues = extractTenantClaimValues(claims, accessToken);
+      const effectiveTenantId =
+        currentTenantId ??
+        result.data?.tenantId ??
+        result.data?.organisationId ??
+        tenantClaimValues.tenantId;
+      const effectiveTenantClaim = currentTenantClaim || tenantClaimValues.tenant || undefined;
+
+      const tenantLockoutResult = await verifyTenantLockout(
+        effectiveTenantId,
+        effectiveTenantClaim,
+        true
+      );
       if (!tenantLockoutResult.isActive) {
         const msg = tenantLockoutResult.errorMessage || 'Tenant is not Active. Lockout active.';
         setIsPendingActivation(true);
@@ -705,28 +768,22 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
         };
       }
 
-      // Tenant is verified Active: proceed with user sync
-      const result = await syncUserAccount(sub, accessToken, user || undefined, force);
-      if (result.isUnauthorized) {
-        await logout();
-        return result;
-      }
-      if (result.success) {
-        setIsPendingActivation(false);
-        setIsSynced(true);
-        setActivationError(null);
-      } else if (result.isActivationPending) {
-        setIsPendingActivation(true);
-        setIsSynced(false);
-        setActivationError(result.errorMessage || null);
+      if (tenantLockoutResult.tenant?.name) {
+        setTenantName(tenantLockoutResult.tenant.name);
       }
+
+      setActivationPending(false);
+      setIsPendingActivation(false);
+      setIsSynced(true);
+      setActivationError(null);
       return result;
     } catch (err: any) {
       if (err?.response?.status === 401) {
         await logout();
         return { success: false, isUnauthorized: true };
       }
-      const msg = err?.message || 'Sync failed';
+      const rawMsg = err?.message || 'Sync failed';
+      const msg = /network\s*error/i.test(rawMsg) ? rawMsg.replace(/network\s*error/gi, 'Permission Check') : rawMsg;
       setIsPendingActivation(true);
       setIsSynced(false);
       setActivationError(msg);

PostFundManagement.ConsoleUI/src/components/auth/AccountActivationModal.tsx

@@ -115,141 +115,94 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
     navigate('/');
   };
 
+  const isTenantIssue = !!errorMessage?.toLowerCase().includes('tenant');
+
   const modalContent = (
     <div
       role="dialog"
       aria-modal="true"
       aria-labelledby="activation-modal-title"
-      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 sm:p-6 bg-[#060a12]/90 backdrop-blur-md animate-in fade-in duration-200 select-none overflow-y-auto"
+      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 bg-[#060a12]/85 backdrop-blur-md animate-in fade-in duration-200 select-none overflow-y-auto"
     >
-      {/* Non-dismissable Card Container: No X button, no escape dismiss, no backdrop click */}
       <div
-        className="relative w-full max-w-xl bg-[#0d1322] border border-amber-500/30 rounded-2xl shadow-2xl shadow-black/80 overflow-hidden flex flex-col text-slate-100 my-auto"
+        className="relative w-full max-w-lg bg-[#0d1322] border border-slate-800 rounded-2xl shadow-2xl shadow-black/80 overflow-hidden flex flex-col text-slate-100 my-auto"
         onClick={(e) => e.stopPropagation()}
       >
-        {/* Amber accent top bar */}
-        <div className="h-1.5 w-full bg-gradient-to-r from-amber-500 via-amber-400 to-yellow-500" />
+        {/* Subtle accent top border */}
+        <div className={`h-1 w-full ${isTenantIssue ? 'bg-amber-500' : 'bg-blue-600'}`} />
 
-        {/* Modal Header */}
-        <div className="p-6 pb-4 border-b border-slate-800/80 bg-[#0f172a]/60">
+        {/* Header */}
+        <div className="p-5 pb-4 border-b border-slate-800/80 bg-[#0f172a]/60">
           <div className="flex items-start justify-between gap-4">
-            <div className="flex items-center gap-3.5">
-              <div className="relative p-2.5 rounded-xl bg-amber-500/10 border border-amber-500/20 text-amber-400">
-                <ShieldAlert className="w-6 h-6" />
-                <span className="absolute -top-1 -right-1 flex h-2.5 w-2.5">
-                  <span className="animate-ping absolute inline-flex h-full w-full rounded-full bg-amber-400 opacity-75"></span>
-                  <span className="relative inline-flex rounded-full h-2.5 w-2.5 bg-amber-500"></span>
-                </span>
+            <div className="flex items-center gap-3">
+              <div className={`p-2.5 rounded-xl border ${isTenantIssue ? 'bg-amber-500/10 border-amber-500/20 text-amber-400' : 'bg-blue-500/10 border-blue-500/20 text-blue-400'}`}>
+                <ShieldAlert className="w-5 h-5" />
               </div>
               <div>
-                <span className="inline-flex items-center gap-1.5 text-[11px] font-semibold tracking-wider uppercase text-amber-400 bg-amber-500/10 border border-amber-500/20 px-2 py-0.5 rounded-full mb-1">
-                  Access Restricted • Lockout Active
-                </span>
-                <h2 id="activation-modal-title" className="text-lg sm:text-xl font-bold text-white tracking-tight">
-                  {errorMessage?.toLowerCase().includes('tenant')
-                    ? 'Tenant Lockout • Account Inactive'
-                    : 'Account Pending Administrator Activation'}
+                <h2 id="activation-modal-title" className="text-base font-bold text-white tracking-tight">
+                  {isTenantIssue ? 'Tenant Access Restricted' : 'Account Pending Activation'}
                 </h2>
+                <p className="text-xs text-slate-400 mt-0.5">
+                  {isTenantIssue
+                    ? 'The assigned tenant partition is currently inactive or restricted.'
+                    : 'Your account is authenticated and awaiting administrator enablement.'}
+                </p>
               </div>
             </div>
 
-            <BrandLogo size={36} showGlow={false} animateOnHover={false} />
+            <BrandLogo size={32} showGlow={false} animateOnHover={false} />
           </div>
         </div>
 
-        {/* Modal Body */}
-        <div className="p-6 space-y-5 overflow-y-auto max-h-[70vh]">
-          {/* Status notification block */}
-          <div className="bg-slate-900/80 border border-slate-800 rounded-xl p-4 space-y-2.5">
-            <div className="flex items-center gap-2 text-emerald-400 text-xs font-semibold">
-              <CheckCircle2 className="w-4 h-4 shrink-0" />
-              <span>Identity Verified & Signed In Successfully</span>
+        {/* Body */}
+        <div className="p-5 space-y-4">
+          {/* User Profile Summary */}
+          <div className="rounded-xl border border-slate-800/80 bg-slate-900/60 p-3.5 space-y-2 text-xs">
+            <div className="grid grid-cols-2 gap-2.5">
+              <div>
+                <span className="text-[10px] uppercase font-semibold text-slate-500 block">User</span>
+                <span className="font-semibold text-white truncate block">{displayName}</span>
+              </div>
+              <div>
+                <span className="text-[10px] uppercase font-semibold text-slate-500 block">Email</span>
+                <span className="text-slate-300 truncate block">{displayEmail || '—'}</span>
+              </div>
             </div>
-            <p className="text-xs text-slate-300 leading-relaxed">
-              You are a registered user and have successfully authenticated via Enterprise Single Sign-On.
-              However, your account has not yet been enabled in the system directory by a system administrator.
-            </p>
-            <p className="text-xs text-slate-400 leading-relaxed border-t border-slate-800/80 pt-2 font-medium">
-              If your administrator informs you that your account has been activated, please click the{' '}
-              <strong className="text-white">Sync Account</strong> button below to refresh your status and unlock the system.
-            </p>
-          </div>
-
-          {/* User Profile Card */}
-          <div className="rounded-xl border border-slate-800 bg-[#090e1a]/60 p-4 space-y-3">
-            <div className="text-[11px] font-semibold text-slate-400 uppercase tracking-wider flex items-center justify-between">
-              <span>Authenticated User Profile</span>
-              <span className="text-amber-400/90 text-[10px] font-mono bg-amber-500/10 px-2 py-0.5 rounded border border-amber-500/20">
-                Lockout Active
-              </span>
-            </div>
-
-            <div className="grid grid-cols-1 sm:grid-cols-2 gap-3 text-xs">
-              <div className="flex items-center gap-2.5 bg-slate-900/60 p-2.5 rounded-lg border border-slate-800/60">
-                <UserCheck className="w-4 h-4 text-blue-400 shrink-0" />
-                <div className="min-w-0">
-                  <span className="text-[10px] text-slate-500 block">Name</span>
-                  <span className="font-semibold text-white truncate block">{displayName}</span>
-                </div>
+            <div className="grid grid-cols-2 gap-2.5 border-t border-slate-800/60 pt-2">
+              <div>
+                <span className="text-[10px] uppercase font-semibold text-slate-500 block">Tenant</span>
+                <span className="text-slate-300 truncate block">{tenant}</span>
               </div>
-
-              <div className="flex items-center gap-2.5 bg-slate-900/60 p-2.5 rounded-lg border border-slate-800/60">
-                <Mail className="w-4 h-4 text-blue-400 shrink-0" />
-                <div className="min-w-0">
-                  <span className="text-[10px] text-slate-500 block">Email</span>
-                  <span className="font-semibold text-slate-200 truncate block">{displayEmail || 'Not specified'}</span>
-                </div>
-              </div>
-
-              <div className="flex items-center gap-2.5 bg-slate-900/60 p-2.5 rounded-lg border border-slate-800/60">
-                <Building2 className="w-4 h-4 text-indigo-400 shrink-0" />
-                <div className="min-w-0">
-                  <span className="text-[10px] text-slate-500 block">Tenant / Role</span>
-                  <span className="font-semibold text-slate-200 truncate block">
-                    {tenant} ({role})
-                  </span>
-                </div>
-              </div>
-
-              <div className="flex items-center gap-2.5 bg-slate-900/60 p-2.5 rounded-lg border border-slate-800/60">
-                <Fingerprint className="w-4 h-4 text-slate-400 shrink-0" />
-                <div className="min-w-0">
-                  <span className="text-[10px] text-slate-500 block">Subject ID</span>
-                  <span className="font-mono text-[11px] text-slate-400 truncate block">{sub || 'SSO-Principal'}</span>
-                </div>
+              <div>
+                <span className="text-[10px] uppercase font-semibold text-slate-500 block">Role</span>
+                <span className="text-blue-400 font-medium truncate block">{role}</span>
               </div>
             </div>
           </div>
 
-          {/* Sync Attempt Feedback / Error Notice */}
+          {/* Feedback notice if sync failed */}
           {errorMessage && (
-            <div className="rounded-xl border border-rose-500/30 bg-rose-500/10 p-3.5 flex items-start gap-3 animate-in fade-in duration-150">
-              <AlertTriangle className="w-4 h-4 text-rose-400 shrink-0 mt-0.5" />
-              <div className="space-y-1">
-                <p className="text-xs font-semibold text-rose-300">
-                  {errorMessage?.toLowerCase().includes('tenant')
-                    ? 'Tenant Lockout In Effect'
-                    : 'Account Not Activated Yet'}
-                </p>
-                <p className="text-xs text-rose-200/90 leading-relaxed">{errorMessage}</p>
-                {syncAttemptCount > 0 && (
-                  <p className="text-[11px] text-rose-400/80 pt-1">
-                    Attempt #{syncAttemptCount} checked at {new Date().toLocaleTimeString()}
-                  </p>
-                )}
+            <div className="rounded-xl border border-amber-500/25 bg-amber-500/10 p-3 flex items-start gap-2.5 text-xs text-amber-200">
+              <AlertTriangle className="w-4 h-4 text-amber-400 shrink-0 mt-0.5" />
+              <div className="min-w-0">
+                <span className="font-semibold text-amber-300 block">Notice:</span>
+                <p className="text-[11px] text-amber-200/90 leading-relaxed mt-0.5">{errorMessage}</p>
               </div>
             </div>
           )}
+
+          <p className="text-[11px] text-slate-400 text-center">
+            Once your administrator enables your account, click <strong className="text-white">Sync Account</strong> to enter the console.
+          </p>
         </div>
 
-        {/* Modal Actions */}
-        <div className="p-5 border-t border-slate-800/80 bg-[#0a0f1d] flex flex-col sm:flex-row items-center justify-between gap-3">
+        {/* Footer Actions */}
+        <div className="p-4 border-t border-slate-800 bg-[#0a0f1d] flex flex-col sm:flex-row items-center justify-between gap-2.5">
           <div className="flex items-center gap-2 w-full sm:w-auto">
             <button
               onClick={handleNavigateLanding}
               type="button"
-              className="flex-1 sm:flex-none inline-flex items-center justify-center gap-1.5 px-3.5 py-2 text-xs font-medium text-slate-400 hover:text-slate-200 bg-slate-900 hover:bg-slate-800 border border-slate-800 rounded-xl transition cursor-pointer"
-              title="View public landing page. Entering the console again will display this modal until enabled."
+              className="flex-1 sm:flex-none inline-flex items-center justify-center gap-1.5 px-3 py-2 text-xs font-medium text-slate-400 hover:text-white bg-slate-900 hover:bg-slate-800 border border-slate-800 rounded-xl transition cursor-pointer"
             >
               <ArrowLeft className="w-3.5 h-3.5" />
               <span>Landing Page</span>
@@ -258,8 +211,7 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
             <button
               onClick={handleSignOut}
               type="button"
-              className="flex-1 sm:flex-none inline-flex items-center justify-center gap-1.5 px-3.5 py-2 text-xs font-medium text-slate-400 hover:text-rose-400 bg-slate-900 hover:bg-rose-500/10 border border-slate-800 hover:border-rose-500/30 rounded-xl transition cursor-pointer"
-              title="Sign out of current SSO session"
+              className="flex-1 sm:flex-none inline-flex items-center justify-center gap-1.5 px-3 py-2 text-xs font-medium text-slate-400 hover:text-rose-400 bg-slate-900 hover:bg-rose-500/10 border border-slate-800 hover:border-rose-500/20 rounded-xl transition cursor-pointer"
             >
               <LogOut className="w-3.5 h-3.5" />
               <span>Sign Out</span>
@@ -271,10 +223,10 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
             disabled={isSyncing}
             type="button"
             id="activation-sync-btn"
-            className="w-full sm:w-auto inline-flex items-center justify-center gap-2 px-5 py-2.5 text-xs font-semibold text-white bg-blue-600 hover:bg-blue-500 active:bg-blue-700 disabled:opacity-50 disabled:pointer-events-none rounded-xl shadow-lg shadow-blue-600/30 transition cursor-pointer"
+            className="w-full sm:w-auto inline-flex items-center justify-center gap-2 px-4 py-2 text-xs font-semibold text-white bg-blue-600 hover:bg-blue-500 active:bg-blue-700 disabled:opacity-50 rounded-xl shadow-md transition cursor-pointer"
           >
-            <RefreshCw className={`w-4 h-4 ${isSyncing ? 'animate-spin' : ''}`} />
-            <span>{isSyncing ? 'Verifying Activation...' : 'Sync Account'}</span>
+            <RefreshCw className={`w-3.5 h-3.5 ${isSyncing ? 'animate-spin' : ''}`} />
+            <span>{isSyncing ? 'Checking...' : 'Sync Account'}</span>
           </button>
         </div>
       </div>

PostFundManagement.ConsoleUI/src/components/auth/PartnerAccessDeniedModal.tsx

@@ -61,114 +61,57 @@ export const PartnerAccessDeniedModal: React.FC<PartnerAccessDeniedModalProps> =
       aria-modal="true"
       aria-labelledby="partner-denied-title"
       aria-describedby="partner-denied-description"
-      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 bg-black/85 backdrop-blur-md animate-in fade-in duration-200 overflow-y-auto"
+      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 bg-black/80 backdrop-blur-md animate-in fade-in duration-150 overflow-y-auto"
     >
-      <div className="relative w-full max-w-lg overflow-hidden rounded-2xl bg-[#0e1424] border border-rose-900/60 shadow-2xl shadow-rose-950/50 my-auto">
-        {/* Glow Header Accent */}
-        <div className="h-2 w-full bg-linear-to-r from-rose-600 via-red-500 to-amber-500" />
+      <div className="relative w-full max-w-md overflow-hidden rounded-2xl bg-[#0d1322] border border-slate-800 shadow-2xl my-auto text-slate-100">
+        <div className="h-1 w-full bg-rose-600" />
 
-        <div className="p-6 sm:p-8 space-y-6">
-          {/* Header */}
-          <div className="flex items-start gap-4">
-            <div className="flex h-12 w-12 shrink-0 items-center justify-center rounded-2xl bg-rose-500/15 border border-rose-500/30 text-rose-400">
-              <Ban className="h-6 w-6 text-rose-400" />
+        <div className="p-5 space-y-4">
+          <div className="flex items-start gap-3">
+            <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-xl bg-rose-500/10 border border-rose-500/20 text-rose-400">
+              <Ban className="h-5 w-5" />
             </div>
-            <div className="space-y-1">
-              <div className="flex items-center gap-2">
-                <span className="inline-flex items-center gap-1 text-[11px] font-semibold text-rose-400 bg-rose-950/60 px-2 py-0.5 rounded-md border border-rose-800/60">
-                  <Lock className="w-3 h-3" />
-                  Restricted Role
-                </span>
-                <span className="text-xs text-slate-500">Security Policy</span>
-              </div>
-              <h2 id="partner-denied-title" className="text-lg font-bold text-white tracking-tight">
-                Access Denied: Partner Role
+            <div>
+              <h2 id="partner-denied-title" className="text-base font-bold text-white tracking-tight">
+                Partner Portal Required
               </h2>
-              <p id="partner-denied-description" className="text-xs text-slate-400 leading-relaxed">
-                Users assigned the <strong className="text-rose-300">Partner</strong> role by security are not permitted to access the PFM Backoffice Console.
+              <p id="partner-denied-description" className="text-xs text-slate-400 mt-0.5">
+                Accounts with the Partner role must access the Partner Portal.
               </p>
             </div>
           </div>
 
-          {/* User & Identity Summary Card */}
-          <div className="rounded-xl bg-slate-900/80 border border-slate-800 p-4 space-y-3 text-xs">
-            <div className="flex items-center justify-between pb-2 border-b border-slate-800/80">
-              <span className="text-slate-400 font-medium">Account Name</span>
-              <span className="text-white font-semibold">{displayName}</span>
+          <div className="rounded-xl bg-slate-900/60 border border-slate-800 p-3.5 space-y-2 text-xs">
+            <div className="flex items-center justify-between">
+              <span className="text-slate-500 text-[11px] uppercase font-semibold">User</span>
+              <span className="text-white font-medium">{displayName}</span>
             </div>
-
             {displayEmail && (
-              <div className="flex items-center justify-between pb-2 border-b border-slate-800/80">
-                <span className="text-slate-400 font-medium flex items-center gap-1.5">
-                  <Mail className="w-3.5 h-3.5 text-slate-500" />
-                  Email
-                </span>
-                <span className="text-slate-200 font-mono">{displayEmail}</span>
+              <div className="flex items-center justify-between border-t border-slate-800/60 pt-2">
+                <span className="text-slate-500 text-[11px] uppercase font-semibold">Email</span>
+                <span className="text-slate-300 font-mono text-[11px]">{displayEmail}</span>
               </div>
             )}
-
-            <div className="flex items-center justify-between pb-2 border-b border-slate-800/80">
-              <span className="text-slate-400 font-medium flex items-center gap-1.5">
-                <Building2 className="w-3.5 h-3.5 text-slate-500" />
-                Assigned Role
-              </span>
-              <span className="text-rose-400 font-semibold bg-rose-950/60 px-2 py-0.5 rounded border border-rose-800/50">
-                {role}
-              </span>
+            <div className="flex items-center justify-between border-t border-slate-800/60 pt-2">
+              <span className="text-slate-500 text-[11px] uppercase font-semibold">Role</span>
+              <span className="text-rose-400 font-medium">{role}</span>
             </div>
-
-            {tenant && (
-              <div className="flex items-center justify-between pb-2 border-b border-slate-800/80">
-                <span className="text-slate-400 font-medium flex items-center gap-1.5">
-                  <Building2 className="w-3.5 h-3.5 text-slate-500" />
-                  Tenant Context
-                </span>
-                <span className="text-slate-200 font-medium truncate max-w-[220px]">{tenant}</span>
-              </div>
-            )}
-
-            {sub && (
-              <div className="flex items-center justify-between text-[11px] text-slate-500">
-                <span className="flex items-center gap-1">
-                  <Fingerprint className="w-3 h-3" />
-                  Subject Key
-                </span>
-                <span className="font-mono text-slate-400 truncate max-w-[200px]">{sub}</span>
-              </div>
-            )}
           </div>
 
-          {/* Security Policy Information */}
-          <div className="p-4 rounded-xl bg-rose-950/20 border border-rose-900/40 text-xs text-rose-200 leading-relaxed space-y-1.5">
-            <p className="font-semibold text-rose-300 flex items-center gap-1.5">
-              <ShieldAlert className="w-4 h-4 text-rose-400" />
-              Administrative Boundary Notice
-            </p>
-            <p className="text-[11px] text-rose-300/90">
-              The PFM Console is reserved for statutory administrators, sponsors, programme managers, and governance officers. Partner credentials cannot access this environment. If you require backoffice administrative access, please request an updated role assignment from your system administrator.
-            </p>
-          </div>
+          <p className="text-[11px] text-slate-400 text-center leading-relaxed">
+            The Console is reserved for statutory administrators and programme managers.
+          </p>
 
-          {/* Actions */}
-          <div className="pt-2">
+          <div className="pt-1">
             <button
               onClick={handleLogoutClick}
-              className="w-full flex items-center justify-center gap-2 py-2.5 px-4 rounded-xl bg-slate-800 hover:bg-slate-700 text-slate-200 hover:text-white text-xs font-semibold border border-slate-700 transition cursor-pointer shadow-sm"
+              className="w-full flex items-center justify-center gap-2 py-2.5 px-4 rounded-xl bg-blue-600 hover:bg-blue-500 text-white text-xs font-semibold shadow-md transition cursor-pointer"
             >
-              <LogOut className="w-4 h-4 text-rose-400" />
-              <span>Sign Out & Return to Home</span>
+              <LogOut className="w-4 h-4" />
+              <span>Sign Out & Return Home</span>
             </button>
           </div>
         </div>
-
-        {/* Footer Brand watermark */}
-        <div className="px-6 py-3 bg-[#0a0f1d] border-t border-slate-800/80 flex items-center justify-between text-[11px] text-slate-500">
-          <div className="flex items-center gap-2">
-            <BrandLogo size={16} showGlow={false} animateOnHover={false} />
-            <span>Post Fund Management (PFM)</span>
-          </div>
-          <span>National Security Gateway</span>
-        </div>
       </div>
     </div>
   );

PostFundManagement.ConsoleUI/src/components/auth/SessionExpiredModal.tsx

@@ -87,7 +87,7 @@ export const SessionExpiredModal: React.FC<SessionExpiredModalProps> = ({
   const modalContent = (
     <div
       id="session-expired-modal-backdrop"
-      className="fixed inset-0 z-[9999] flex items-center justify-center bg-black/85 backdrop-blur-md p-4 animate-in fade-in duration-200 overflow-y-auto"
+      className="fixed inset-0 z-[9999] flex items-center justify-center bg-black/80 backdrop-blur-md p-4 animate-in fade-in duration-150 overflow-y-auto"
       onMouseEnter={() => setIsPaused(true)}
       onMouseLeave={() => setIsPaused(false)}
       role="dialog"
@@ -96,27 +96,20 @@ export const SessionExpiredModal: React.FC<SessionExpiredModalProps> = ({
     >
       <div
         id="session-expired-modal-content"
-        className="relative w-full max-w-md bg-[#0c121e] border border-amber-500/40 rounded-2xl shadow-2xl shadow-black/90 p-6 overflow-hidden text-slate-200 space-y-5 my-auto"
+        className="relative w-full max-w-md bg-[#0d1322] border border-slate-800 rounded-2xl shadow-2xl p-5 overflow-hidden text-slate-200 space-y-4 my-auto"
       >
-        {/* Subtle decorative top accent bar */}
-        <div className="absolute top-0 left-0 right-0 h-1 bg-gradient-to-r from-amber-500 via-orange-500 to-rose-500" />
+        <div className="absolute top-0 left-0 right-0 h-1 bg-amber-500" />
 
-        {/* Top bar with close button */}
         <div className="flex items-start justify-between pt-1">
           <div className="flex items-center gap-3">
-            <div className="w-12 h-12 rounded-2xl bg-amber-500/10 border border-amber-500/30 flex items-center justify-center text-amber-400 shrink-0 shadow-lg shadow-amber-500/10">
-              <ShieldAlert className="w-6 h-6" />
+            <div className="w-10 h-10 rounded-xl bg-amber-500/10 border border-amber-500/20 flex items-center justify-center text-amber-400 shrink-0">
+              <ShieldAlert className="w-5 h-5" />
             </div>
             <div>
-              <div className="flex items-center gap-2">
-                <h3 id="session-expired-title" className="text-base font-bold text-white tracking-tight">
-                  Session Expired
-                </h3>
-                <span className="text-[10px] font-mono font-semibold px-2 py-0.5 rounded bg-rose-950/60 text-rose-300 border border-rose-800/60">
-                  HTTP 401
-                </span>
-              </div>
-              <p className="text-xs text-slate-400 mt-0.5">Authorization token invalidated</p>
+              <h3 id="session-expired-title" className="text-base font-bold text-white tracking-tight">
+                Session Expired
+              </h3>
+              <p className="text-xs text-slate-400">Authorization credentials expired</p>
             </div>
           </div>
 
@@ -125,60 +118,46 @@ export const SessionExpiredModal: React.FC<SessionExpiredModalProps> = ({
             type="button"
             onClick={handleAction}
             aria-label="Dismiss and return to landing page"
-            className="p-1.5 text-slate-400 hover:text-white rounded-lg hover:bg-slate-800/80 transition-colors"
+            className="p-1.5 text-slate-400 hover:text-white rounded-lg hover:bg-slate-800 transition-colors cursor-pointer"
           >
             <X className="w-4 h-4" />
           </button>
         </div>
 
-        {/* Informative Explanation (non-technical and clear) */}
-        <div className="space-y-2.5 text-xs text-slate-300 leading-relaxed bg-slate-900/60 p-4 rounded-xl border border-slate-800/80">
+        <div className="text-xs text-slate-300 leading-relaxed bg-slate-900/60 p-3.5 rounded-xl border border-slate-800/80 space-y-1.5">
           <p>
-            Your active working session has ended or your security credentials have expired. To protect your data and prevent unauthorized changes, your session has been closed.
+            Your active session has ended to protect account security. Please sign in again to continue working.
           </p>
           {reason && (
-            <div className="flex items-start gap-2 pt-1 text-[11px] text-amber-300/90 font-mono">
+            <div className="flex items-start gap-1.5 pt-1 text-[11px] text-amber-300/90 font-mono">
               <AlertTriangle className="w-3.5 h-3.5 shrink-0 mt-0.5 text-amber-400" />
               <span className="break-words">{reason}</span>
             </div>
           )}
         </div>
 
-        {/* Progress Bar Countdown */}
-        <div className="space-y-2">
-          <div className="flex items-center justify-between text-xs">
-            <span className="text-slate-400 flex items-center gap-1.5">
-              <Clock className="w-3.5 h-3.5 text-amber-400" />
-              Returning to landing page in{' '}
-              <strong className="text-white font-mono">{secondsRemaining}s</strong>
+        <div className="flex items-center justify-between text-xs text-slate-400">
+          <span className="flex items-center gap-1.5">
+            <Clock className="w-3.5 h-3.5 text-amber-400" />
+            Redirecting in <strong className="text-white font-mono">{secondsRemaining}s</strong>
+          </span>
+          {isPaused && (
+            <span className="text-[10px] text-amber-400/80 px-1.5 py-0.5 rounded bg-amber-500/10 border border-amber-500/20">
+              Paused
             </span>
-            {isPaused && (
-              <span className="text-[10px] text-amber-400/80 font-medium px-1.5 py-0.2 rounded bg-amber-950/40 border border-amber-900/60">
-                Paused on hover
-              </span>
-            )}
-          </div>
-
-          {/* Progress bar line */}
-          <div className="w-full h-2 bg-slate-800/90 rounded-full overflow-hidden border border-slate-700/60 p-0.5">
-            <div
-              className="h-full rounded-full bg-gradient-to-r from-amber-500 via-orange-500 to-rose-500 transition-all duration-75 ease-linear"
-              style={{ width: `${progressPercent}%` }}
-            />
-          </div>
+          )}
         </div>
 
-        {/* Actions */}
-        <div className="pt-2 flex flex-col sm:flex-row items-center gap-2.5">
+        <div className="pt-1">
           <button
             id="session-expired-return-btn"
             type="button"
             onClick={handleAction}
-            className="w-full py-2.5 px-4 text-xs font-semibold text-white bg-gradient-to-r from-blue-600 to-indigo-600 hover:from-blue-500 hover:to-indigo-500 rounded-xl shadow-lg shadow-blue-500/20 transition-all flex items-center justify-center gap-2"
+            className="w-full py-2.5 px-4 text-xs font-semibold text-white bg-blue-600 hover:bg-blue-500 rounded-xl shadow-md transition-all flex items-center justify-center gap-2 cursor-pointer"
           >
             <LogOut className="w-4 h-4" />
-            <span>Return to Landing Page Now</span>
-            <ArrowRight className="w-3.5 h-3.5 ml-0.5" />
+            <span>Return to Landing Page</span>
+            <ArrowRight className="w-3.5 h-3.5" />
           </button>
         </div>
       </div>

PostFundManagement.ConsoleUI/src/components/layout/AppLayout.tsx

@@ -1,5 +1,5 @@
 import React, { useState } from 'react';
-import { NavLink, Outlet, useNavigate, Link } from 'react-router-dom';
+import { NavLink, Outlet, useNavigate, Link, useLocation } from 'react-router-dom';
 import { NotificationBell } from './NotificationBell';
 import {
   Inbox,
@@ -144,6 +144,27 @@ export const AppLayout: React.FC = () => {
   const [sidebarOpen, setSidebarOpen] = useState(true);
   const [userMenuOpen, setUserMenuOpen] = useState(false);
   const navigate = useNavigate();
+  const location = useLocation();
+  const [collapsedSections, setCollapsedSections] = useState<Record<string, boolean>>({});
+
+  const isSectionCollapsed = (path: string, subItems?: SubNavItem[]): boolean => {
+    if (collapsedSections[path] !== undefined) {
+      return collapsedSections[path];
+    }
+    if (subItems?.some((s) => location.pathname.startsWith(s.path))) {
+      return false;
+    }
+    return false;
+  };
+
+  const toggleSection = (path: string, e: React.MouseEvent) => {
+    e.preventDefault();
+    e.stopPropagation();
+    setCollapsedSections((prev) => ({
+      ...prev,
+      [path]: !isSectionCollapsed(path),
+    }));
+  };
 
   const handleLogout = async () => {
     await logout();
@@ -186,7 +207,6 @@ export const AppLayout: React.FC = () => {
   useQuery({
     queryKey: ['users-directory'],
     queryFn: () => getUsers(1, 200),
-    staleTime: 5 * 60 * 1000,
   });
 
   // Query tenant endpoint to resolve tenant name if not provided in claims or profile
@@ -194,7 +214,6 @@ export const AppLayout: React.FC = () => {
     queryKey: ['active-tenant-header', tenantId],
     queryFn: () => getTenant(tenantId!),
     enabled: !!tenantId && !claims?.tenant && !user?.tenant && !authTenantName,
-    staleTime: 5 * 60 * 1000,
   });
 
   // Ensure current logged-in user is registered in the email cache
@@ -346,26 +365,45 @@ export const AppLayout: React.FC = () => {
               );
             }
 
+            const isCollapsed = isSectionCollapsed(item.path, item.subItems);
+
             return (
               <div key={item.path} className="space-y-1">
-                <NavLink
-                  to={item.path}
-                  end={hasSub}
-                  className={({ isActive }) =>
-                    `flex items-center gap-3 px-3.5 py-2.5 rounded-xl text-xs font-medium transition-all min-w-0 ${
-                      isActive
-                        ? 'bg-gradient-to-r from-blue-600 to-indigo-600 text-white shadow-md shadow-blue-600/25 font-semibold'
-                        : 'text-slate-400 hover:text-slate-100 hover:bg-slate-800/60'
-                    }`
-                  }
-                  title={item.name}
-                >
-                  <Icon className="w-4.5 h-4.5 shrink-0" />
-                  <span className="truncate flex-1">{item.name}</span>
-                </NavLink>
+                <div className="flex items-center gap-1">
+                  <NavLink
+                    to={item.path}
+                    end={hasSub}
+                    className={({ isActive }) =>
+                      `flex-1 flex items-center gap-3 px-3.5 py-2.5 rounded-xl text-xs font-medium transition-all min-w-0 ${
+                        isActive
+                          ? 'bg-gradient-to-r from-blue-600 to-indigo-600 text-white shadow-md shadow-blue-600/25 font-semibold'
+                          : 'text-slate-400 hover:text-slate-100 hover:bg-slate-800/60'
+                      }`
+                    }
+                    title={item.name}
+                  >
+                    <Icon className="w-4.5 h-4.5 shrink-0" />
+                    <span className="truncate flex-1">{item.name}</span>
+                  </NavLink>
+                  {hasSub && (
+                    <button
+                      type="button"
+                      onClick={(e) => toggleSection(item.path, e)}
+                      className="p-2 text-slate-400 hover:text-white hover:bg-slate-800/80 rounded-lg transition-colors cursor-pointer"
+                      title={isCollapsed ? `Expand ${item.name}` : `Collapse ${item.name}`}
+                      aria-label={isCollapsed ? `Expand ${item.name}` : `Collapse ${item.name}`}
+                    >
+                      <ChevronDown
+                        className={`w-3.5 h-3.5 transition-transform duration-200 ${
+                          isCollapsed ? '-rotate-90 text-slate-500' : 'rotate-0 text-slate-300'
+                        }`}
+                      />
+                    </button>
+                  )}
+                </div>
 
                 {/* Sub-items under parent item */}
-                {hasSub && (
+                {hasSub && !isCollapsed && (
                   <div className="pl-6 pr-1 py-1 space-y-1 border-l border-slate-800/80 ml-5">
                     {item.subItems?.map((subItem) => {
                       const SubIcon = subItem.icon;

PostFundManagement.ConsoleUI/src/components/monitoring/ContractsManagement.tsx

@@ -36,7 +36,7 @@ import {
   getAllProgrammes,
   getProjects,
 } from '../../services/api';
-import { toolsService } from '../../services/toolsService';
+import { toolsService } from '../../utils/hashids';
 import { Modal } from '../ui/Modal';
 import { useToast } from '../ui/Toast';
 import { ProblemDetailsAlert } from '../ui/ProblemDetailsAlert';
@@ -1247,7 +1247,7 @@ export const ContractsManagement: React.FC<ContractsManagementProps> = ({
             {Number(contractToUpdate?.status) === ContractStatus.Active ? (
               <div className="w-full bg-[#151b2c] border border-emerald-500/30 rounded-xl px-3 py-2 text-xs text-emerald-300 font-semibold flex items-center gap-1.5 cursor-default">
                 <Lock className="w-3.5 h-3.5 text-emerald-400" />
-                <span>Active / Executed (Immutable - Cannot Be Changed)</span>
+                <span>Active / Executed</span>
               </div>
             ) : (
               (() => {

PostFundManagement.ConsoleUI/src/components/monitoring/EvidenceReviewQueue.tsx

@@ -807,7 +807,7 @@ export const EvidenceReviewQueue: React.FC<EvidenceReviewQueueProps> = ({
                           title="Approved evidence is immutable. Status cannot be modified."
                         >
                           <Lock className="w-3.5 h-3.5 text-emerald-400" />
-                          <span>Approved (Immutable)</span>
+                          <span>Approved</span>
                         </span>
                       ) : (
                         <>

PostFundManagement.ConsoleUI/src/components/notifications/UserSearchPicker.tsx

@@ -58,7 +58,6 @@ export const UserSearchPicker: React.FC<UserSearchPickerProps> = ({
   const { data: users = [], isLoading } = useQuery<User[]>({
     queryKey: ['users-directory'],
     queryFn: () => getUsers(1, 200),
-    staleTime: 5 * 60 * 1000,
   });
 
   // Filter active users and exclude the current logged-in user so they can never message themselves

PostFundManagement.ConsoleUI/src/components/projects/ProjectActivitiesModal.tsx

@@ -37,7 +37,7 @@ const activitySchema = z.object({
   title: z.string().min(3, 'Activity title required'),
   description: z.string().min(5, 'Description required'),
   category: z.string().min(2, 'Category required'),
-  amount: z.coerce.number().min(1, 'Amount must be positive'),
+  amount: z.coerce.number().min(0, 'Amount must be non-negative'),
   milestoneId: z.string().optional().nullable(),
   performedAt: z.string().optional().nullable(),
 });

PostFundManagement.ConsoleUI/src/components/projects/ProjectExpandedRow.tsx

@@ -20,6 +20,7 @@ import {
   getProjectIndicators,
   getProjectRisks,
   getBudgets,
+  getDisbursements,
 } from '../../services/api';
 import { Project, ApprovalStatus, Budget } from '../../types';
 import {
@@ -86,9 +87,21 @@ export const ProjectExpandedRow: React.FC<ProjectExpandedRowProps> = ({
   );
   const approvedBudgetTotal = approvedBudgets.reduce((sum, b) => sum + (Number(b.amount) || 0), 0);
 
+  const { data: disbursements = [] } = useQuery({
+    queryKey: ['disbursements', projectId],
+    queryFn: () => getDisbursements(1, 100),
+  });
+
+  const projectDisbursements = disbursements.filter(
+    (d) => String(d.projectId) === String(projectId) && (Number(d.status) === ApprovalStatus.Approved || Number(d.status) === 3)
+  );
+  const totalDisbursed = projectDisbursements.reduce((sum, d) => sum + (Number(d.amount) || 0), 0);
+
   const verifiedMilestonesCount = milestones.filter((m) => m.status === ApprovalStatus.Approved).length;
   const milestoneProgress = milestones.length > 0 ? Math.round((verifiedMilestonesCount / milestones.length) * 100) : 0;
   const totalActivityBudget = activities.reduce((sum, a) => sum + (Number(a.amount) || 0), 0);
+  const projectValue = totalActivityBudget - totalDisbursed;
+  const projectVariance = approvedBudgetTotal - projectValue;
 
   return (
     <div className="p-4 sm:p-5 lg:p-6 bg-[#090d16]/95 border-t border-b border-blue-500/20 space-y-6 animate-in fade-in duration-200 w-full min-w-0">
@@ -108,6 +121,19 @@ export const ProjectExpandedRow: React.FC<ProjectExpandedRowProps> = ({
                 <span className="text-xs text-emerald-400 font-mono font-semibold shrink-0">
                   Approved Budget: {formatZAR(approvedBudgetTotal)}
                 </span>
+                <span className="text-slate-600">&bull;</span>
+                <span className="text-xs text-blue-400 font-mono font-semibold shrink-0" title={`Activities: ${formatZAR(totalActivityBudget)} - Disbursements: ${formatZAR(totalDisbursed)}`}>
+                  Project Value: {formatZAR(projectValue)}
+                </span>
+                <span className="text-slate-600">&bull;</span>
+                <span
+                  className={`text-xs font-mono font-semibold shrink-0 ${
+                    projectVariance >= 0 ? 'text-emerald-400' : 'text-rose-400'
+                  }`}
+                  title="Approved Budget minus Net Project Value"
+                >
+                  Variance: {projectVariance >= 0 ? '+' : ''}{formatZAR(projectVariance)}
+                </span>
               </>
             )}
           </div>

PostFundManagement.ConsoleUI/src/components/projects/ProjectViewModal.tsx

@@ -33,6 +33,7 @@ import {
   getProjectIndicators,
   getProjectRisks,
   getBudgets,
+  getDisbursements,
   updateProjectStatus,
 } from '../../services/api';
 import { Project, ApprovalStatus, Programme } from '../../types';
@@ -150,11 +151,23 @@ export const ProjectViewModal: React.FC<ProjectViewModalProps> = ({
   );
   const approvedBudgetTotal = approvedBudgets.reduce((sum, b) => sum + (Number(b.amount) || 0), 0);
 
-  // Milestone Progress
+  // Milestone Progress & Disbursements
   const verifiedMilestonesCount = milestones.filter((m) => m.status === ApprovalStatus.Approved).length;
   const milestoneProgress = milestones.length > 0 ? Math.round((verifiedMilestonesCount / milestones.length) * 100) : 0;
   const totalActivityBudget = activities.reduce((sum, a) => sum + (Number(a.amount) || 0), 0);
 
+  const { data: disbursements = [] } = useQuery({
+    queryKey: ['disbursements', project?.id],
+    queryFn: () => getDisbursements(1, 100),
+    enabled: !!project?.id,
+  });
+  const projectDisbursements = disbursements.filter(
+    (d) => String(d.projectId) === String(project?.id) && (Number(d.status) === ApprovalStatus.Approved || Number(d.status) === 3)
+  );
+  const totalDisbursed = projectDisbursements.reduce((sum, d) => sum + (Number(d.amount) || 0), 0);
+  const projectValue = totalActivityBudget - totalDisbursed;
+  const projectVariance = approvedBudgetTotal - projectValue;
+
   // Schedule Risk
   const scheduleRisk = useMemo(() => {
     if (!project) return null;
@@ -244,20 +257,20 @@ export const ProjectViewModal: React.FC<ProjectViewModalProps> = ({
                   Budget: {formatZAR(approvedBudgetTotal)}
                 </span>
                 <span className="text-slate-600">&bull;</span>
-                <span className="text-blue-400 font-mono font-bold">
-                  Project Value: {formatZAR(totalActivityBudget)}
+                <span className="text-blue-400 font-mono font-bold" title={`Activities Total: ${formatZAR(totalActivityBudget)} minus Disbursements: ${formatZAR(totalDisbursed)}`}>
+                  Project Value: {formatZAR(projectValue)}
                 </span>
                 <span className="text-slate-600">&bull;</span>
                 <span
                   className={`font-mono font-bold px-2 py-0.5 rounded text-[11px] border ${
-                    approvedBudgetTotal - totalActivityBudget >= 0
+                    projectVariance >= 0
                       ? 'text-emerald-400 bg-emerald-500/10 border-emerald-500/30'
                       : 'text-rose-400 bg-rose-500/10 border-rose-500/30'
                   }`}
-                  title="Approved Budget minus Total Project Value"
+                  title={`Approved Budget: ${formatZAR(approvedBudgetTotal)} | Net Project Value: ${formatZAR(projectValue)} (Activities: ${formatZAR(totalActivityBudget)} - Disbursements: ${formatZAR(totalDisbursed)}) | Variance: ${projectVariance >= 0 ? '+' : ''}${formatZAR(projectVariance)}`}
                 >
-                  Variance: {approvedBudgetTotal - totalActivityBudget >= 0 ? '+' : ''}
-                  {formatZAR(approvedBudgetTotal - totalActivityBudget)}
+                  Variance: {projectVariance >= 0 ? '+' : ''}
+                  {formatZAR(projectVariance)}
                 </span>
               </div>
             </div>

PostFundManagement.ConsoleUI/src/components/users/UserSecurityModal.tsx

@@ -32,6 +32,7 @@ import { clearCachedUserRbac, fetchAndCacheRoleClaims } from '../../services/rol
 import { HelpTooltip } from '../ui/HelpTooltip';
 import { ObfuscatedIdNumber } from '../ui/ObfuscatedIdNumber';
 import { decodeIdNumberHex } from '../../utils/hashids';
+import { useAuth } from '../../auth/AuthProvider';
 import { User, Role, Claim, ActivityStatus } from '../../types';
 import { formatDate, getActivityStatusBadge, getUserRoleBadge } from '../../lib/formatters';
 import { useRbac, ROLE_CLAIM_DEFINITIONS } from '../../auth/rbac';
@@ -49,9 +50,15 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
 }) => {
   const queryClient = useQueryClient();
   const { success, error: toastError } = useToast();
+  const { user: currentAuthUser } = useAuth();
   const { canApprove, canAdd, canView, canAccess, isUnrestricted } = useRbac();
   const hasTenantSelfHelpAccess = canAccess('tenant_self_service') || canView('tenant_self_service');
 
+  const userId = user?.id || '';
+  const isSelf =
+    Boolean(currentAuthUser?.id && userId && String(currentAuthUser.id).toLowerCase() === String(userId).toLowerCase()) ||
+    Boolean(currentAuthUser?.email && user?.email && currentAuthUser.email.toLowerCase() === user.email.toLowerCase());
+
   const canManageRolesAndClaims =
     canApprove('settings_users') ||
     canApprove('tenant_management') ||
@@ -63,18 +70,17 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
     hasTenantSelfHelpAccess ||
     isUnrestricted;
   const canChangeStatus =
-    canAdd('settings_users') ||
-    canAdd('tenant_management') ||
-    canAdd('tenant_self_service') ||
-    canApprove('settings_users') ||
-    isUnrestricted;
+    !isSelf &&
+    (canAdd('settings_users') ||
+      canAdd('tenant_management') ||
+      canAdd('tenant_self_service') ||
+      canApprove('settings_users') ||
+      isUnrestricted);
 
   const [activeTab, setActiveTab] = useState<'overview' | 'roles' | 'claims' | 'sessions'>('overview');
 
   const [selectedRoleToAdd, setSelectedRoleToAdd] = useState('');
 
-  const userId = user?.id || '';
-
   // 1. Fetch fresh user details
   const { data: freshUser, isLoading: loadingUser, refetch: refetchUser } = useQuery<User | null>({
     queryKey: ['user-detail', userId],
@@ -237,20 +243,35 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
     onError: (err: unknown) => toastError('Logout Failed', err),
   });
 
-  const lockoutMutation = useMutation({
-    mutationFn: (disableLock: boolean) => setUserLockout(userId, disableLock),
-    onSuccess: (_, disableLock) => {
-      success(
-        disableLock ? 'Account Unlocked' : 'Account Locked',
-        `User account lockout status successfully modified.`
-      );
+  const lockUserMutation = useMutation({
+    mutationFn: () => setUserLockout(userId, true),
+    onSuccess: () => {
+      success('Account Locked', 'User account lockout enabled (disable = true).');
       refetchUser();
+      queryClient.invalidateQueries({ queryKey: ['users'] });
+      queryClient.invalidateQueries({ queryKey: ['user-detail', userId] });
     },
-    onError: (err: unknown) => toastError('Lockout Update Failed', err),
+    onError: (err: unknown) => toastError('Lock User Failed', err),
+  });
+
+  const unlockUserMutation = useMutation({
+    mutationFn: () => setUserLockout(userId, false),
+    onSuccess: () => {
+      success('Account Unlocked', 'User account lockout disabled (disable = false).');
+      refetchUser();
+      queryClient.invalidateQueries({ queryKey: ['users'] });
+      queryClient.invalidateQueries({ queryKey: ['user-detail', userId] });
+    },
+    onError: (err: unknown) => toastError('Unlock User Failed', err),
   });
 
   const statusMutation = useMutation({
-    mutationFn: (newStatus: ActivityStatus) => updateUserStatus(userId, newStatus),
+    mutationFn: (newStatus: ActivityStatus) => {
+      if (isSelf) {
+        throw new Error('Maker-Checker Violation: You cannot alter your own account activity status.');
+      }
+      return updateUserStatus(userId, newStatus);
+    },
     onSuccess: () => {
       success('Status Updated', 'User activity status changed.');
       refetchUser();
@@ -280,18 +301,18 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
     <Modal
       isOpen={isOpen}
       onClose={onClose}
-      title={`User Administration: ${effectiveUser.email || effectiveUser.id}`}
-      subtitle="Direct tenant-level user, role, claims, and session administration without database intervention."
+      title={`User Security: ${effectiveUser.email || effectiveUser.id}`}
+      subtitle="Manage account status, role assignment, permissions, and active sessions."
     >
       <div className="space-y-4 text-xs">
         {/* Navigation Tabs */}
-        <div className="flex gap-2 border-b border-slate-800 pb-2">
+        <div className="flex gap-1.5 border-b border-slate-800 pb-2">
           <button
             type="button"
             onClick={() => setActiveTab('overview')}
-            className={`px-3 py-1.5 rounded-lg font-semibold transition cursor-pointer ${
+            className={`px-3 py-1.5 rounded-lg font-medium transition cursor-pointer ${
               activeTab === 'overview'
-                ? 'bg-blue-600 text-white'
+                ? 'bg-blue-600 text-white font-semibold'
                 : 'text-slate-400 hover:text-white hover:bg-slate-800'
             }`}
           >
@@ -300,21 +321,21 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
           <button
             type="button"
             onClick={() => setActiveTab('roles')}
-            className={`px-3 py-1.5 rounded-lg font-semibold transition cursor-pointer flex items-center gap-1.5 ${
+            className={`px-3 py-1.5 rounded-lg font-medium transition cursor-pointer flex items-center gap-1.5 ${
               activeTab === 'roles'
-                ? 'bg-blue-600 text-white'
+                ? 'bg-blue-600 text-white font-semibold'
                 : 'text-slate-400 hover:text-white hover:bg-slate-800'
             }`}
           >
             <Shield className="w-3.5 h-3.5" />
-            <span>Roles ({(Array.isArray(userRoles) ? userRoles : []).length})</span>
+            <span>Role ({(Array.isArray(userRoles) ? userRoles : []).length})</span>
           </button>
           <button
             type="button"
             onClick={() => setActiveTab('claims')}
-            className={`px-3 py-1.5 rounded-lg font-semibold transition cursor-pointer flex items-center gap-1.5 ${
+            className={`px-3 py-1.5 rounded-lg font-medium transition cursor-pointer flex items-center gap-1.5 ${
               activeTab === 'claims'
-                ? 'bg-blue-600 text-white'
+                ? 'bg-blue-600 text-white font-semibold'
                 : 'text-slate-400 hover:text-white hover:bg-slate-800'
             }`}
           >
@@ -324,9 +345,9 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
           <button
             type="button"
             onClick={() => setActiveTab('sessions')}
-            className={`px-3 py-1.5 rounded-lg font-semibold transition cursor-pointer flex items-center gap-1.5 ${
+            className={`px-3 py-1.5 rounded-lg font-medium transition cursor-pointer flex items-center gap-1.5 ${
               activeTab === 'sessions'
-                ? 'bg-blue-600 text-white'
+                ? 'bg-blue-600 text-white font-semibold'
                 : 'text-slate-400 hover:text-white hover:bg-slate-800'
             }`}
           >
@@ -386,7 +407,14 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
                   </span>
                 </div>
                 <div className="flex items-center gap-2">
-                  {effectiveUser?.status === ActivityStatus.Active ? (
+                  {isSelf ? (
+                    <span
+                      className="px-2.5 py-1 text-[11px] font-semibold text-slate-400 bg-slate-900 border border-slate-800 rounded-lg"
+                      title="Maker-Checker policy: Administrators cannot change their own account activity status"
+                    >
+                      Self-Account (Protected)
+                    </span>
+                  ) : effectiveUser?.status === ActivityStatus.Active ? (
                     <button
                       type="button"
                       onClick={() => statusMutation.mutate(ActivityStatus.Inactive)}
@@ -592,70 +620,66 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
           </div>
         )}
 
-        {/* TAB 4: Sessions & Direct Account Interventions */}
+        {/* TAB 4: Sessions & Security Interventions */}
         {activeTab === 'sessions' && (
           <div className="space-y-3">
             <div className="p-4 bg-slate-900/60 rounded-xl border border-slate-800 space-y-4">
               {/* Force Logout Action */}
-              <div className="flex items-center justify-between border-b border-slate-800/80 pb-3">
+              <div className="flex items-center justify-between border-b border-slate-800/80 pb-3 gap-3">
                 <div>
                   <h4 className="text-white font-semibold flex items-center gap-1.5">
                     <LogOut className="w-4 h-4 text-amber-400" />
                     <span>Revoke Active User Session</span>
-                    <HelpTooltip
-                      title="User Session Invalidation"
-                      content="Enables a tenant self-service user to immediately logout a user if they are currently logged in, terminating their active token and session."
-                      size="sm"
-                      placement="top"
-                    />
                   </h4>
                   <p className="text-[11px] text-slate-400 mt-0.5">
-                    Terminates all active JWT tokens and sessions immediately without direct database intervention.
+                    Immediately invalidates active JWT tokens and logs the user out.
                   </p>
                 </div>
                 <button
                   type="button"
                   onClick={() => logoutMutation.mutate()}
                   disabled={logoutMutation.isPending || !canManageSessions}
-                  className="px-3 py-1.5 bg-amber-500/10 hover:bg-amber-500/20 text-amber-400 border border-amber-500/20 rounded-xl font-semibold transition cursor-pointer disabled:opacity-50"
+                  className="px-3 py-1.5 bg-amber-500/10 hover:bg-amber-500/20 text-amber-400 border border-amber-500/20 rounded-xl font-semibold transition cursor-pointer disabled:opacity-50 shrink-0"
                 >
                   {logoutMutation.isPending ? 'Revoking...' : 'Force Logout'}
                 </button>
               </div>
 
               {/* Lock / Unlock Account */}
-              <div className="flex items-center justify-between">
+              <div className="flex items-center justify-between gap-3">
                 <div>
                   <h4 className="text-white font-semibold flex items-center gap-1.5">
                     <Lock className="w-4 h-4 text-rose-400" />
-                    <span>Account Lockout Control</span>
-                    <HelpTooltip
-                      title="Account Lockout Control"
-                      content="Enables a tenant self-service user to change a user's lockout status. The system defaults to a lockout period of 100 years when locking a user account."
-                      size="sm"
-                      placement="top"
-                    />
+                    <span>Account Lockout</span>
                   </h4>
                   <p className="text-[11px] text-slate-400 mt-0.5">
-                    Temporarily lock out or re-enable the user from logging into this tenant. The system defaults to a lockout period of 100 years.
+                    Control tenant login authorization for this account.
                   </p>
                 </div>
-                <div className="flex items-center gap-2">
+                <div className="flex items-center gap-2 shrink-0">
                   <button
                     type="button"
-                    onClick={() => lockoutMutation.mutate(false)}
-                    disabled={lockoutMutation.isPending || !canManageSessions}
+                    onClick={(e) => {
+                      e.preventDefault();
+                      e.stopPropagation();
+                      lockUserMutation.mutate();
+                    }}
+                    disabled={lockUserMutation.isPending || unlockUserMutation.isPending || !canManageSessions}
                     className="px-3 py-1.5 bg-rose-500/10 hover:bg-rose-500/20 text-rose-400 border border-rose-500/20 rounded-xl font-semibold transition cursor-pointer disabled:opacity-50"
                   >
-                    Lock User
+                    {lockUserMutation.isPending ? 'Locking...' : 'Lock User'}
                   </button>
                   <button
                     type="button"
-                    onClick={() => lockoutMutation.mutate(true)}
-                    disabled={lockoutMutation.isPending || !canManageSessions}
+                    onClick={(e) => {
+                      e.preventDefault();
+                      e.stopPropagation();
+                      unlockUserMutation.mutate();
+                    }}
+                    disabled={unlockUserMutation.isPending || lockUserMutation.isPending || !canManageSessions}
                     className="px-3 py-1.5 bg-emerald-500/10 hover:bg-emerald-500/20 text-emerald-400 border border-emerald-500/20 rounded-xl font-semibold transition cursor-pointer disabled:opacity-50"
                   >
-                    Unlock User
+                    {unlockUserMutation.isPending ? 'Unlocking...' : 'Unlock User'}
                   </button>
                 </div>
               </div>

PostFundManagement.ConsoleUI/src/config.ts

@@ -1,10 +1,10 @@
-import { updateHasherSettings } from './services/toolsService';
+import { updateHasherSettings } from './utils/hashids';
 
 export interface SecuritySettings {
   Authority: string;
   Audience: string;
   ClientId: string;
-  ClientSecret: string;
+  ClientSecret?: string;
   Scope?: string;
 }
 
@@ -13,7 +13,7 @@ export interface ApiSettings {
 }
 
 export interface HasherSettings {
-  Salt: string;
+  Salt?: string;
   MinHashLength: number;
 }
 
@@ -36,7 +36,6 @@ export const defaultSecuritySettings: SecuritySettings = {
   Authority: 'https://sts.security.khongisa.co.za',
   Audience: 'pfm-api-dev',
   ClientId: 'pfm-console-dev',
-  ClientSecret: 'secret_dcaeaa28097d9ba5b06ec324d9eac9d9c81de96e0a203cf2c6154c6dd7c89e94',
   Scope: 'openid profile roles email address pfm-api-dev',
 };
 
@@ -49,6 +48,10 @@ export const defaultHasherSettings: HasherSettings = {
   MinHashLength: 11,
 };
 
+function syncAllHasherSettings(salt: string | undefined, minHashLength: number): void {
+  updateHasherSettings(salt, minHashLength);
+}
+
 /**
  * Extracts first non-empty, trimmed string from candidate values.
  */
@@ -255,9 +258,8 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
   const clientSecret = pickFirstNonEmpty(
     windowConfig.clientSecret,
     fetchedConfig.clientSecret,
-    buildEnvConfig.clientSecret,
-    defaultSecuritySettings.ClientSecret
-  )!;
+    buildEnvConfig.clientSecret
+  );
 
   const scope = pickFirstNonEmpty(
     windowConfig.scope,
@@ -278,7 +280,7 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
     fetchedConfig.hasherSalt,
     buildEnvConfig.hasherSalt,
     defaultHasherSettings.Salt
-  )!;
+  );
 
   const minHashLength =
     windowConfig.hasherMinLength ||
@@ -291,14 +293,14 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
       Authority: normalizeAuthorityUrl(authority),
       Audience: audience,
       ClientId: clientId,
-      ClientSecret: clientSecret,
+      ...(clientSecret ? { ClientSecret: clientSecret } : {}),
       Scope: scope,
     },
     ApiSettings: {
       BaseUrl: normalizeBaseUrl(baseUrl),
     },
     HasherSettings: {
-      Salt: salt,
+      Salt: salt || defaultHasherSettings.Salt,
       MinHashLength: minHashLength,
     },
     ConfigSource: source,
@@ -310,7 +312,7 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
 let runtimeConfig: AppConfig = resolveConfig();
 
 // Immediately apply deterministic hasher settings
-updateHasherSettings(runtimeConfig.HasherSettings.Salt, runtimeConfig.HasherSettings.MinHashLength);
+syncAllHasherSettings(runtimeConfig.HasherSettings.Salt, runtimeConfig.HasherSettings.MinHashLength);
 
 const configListeners: Array<(config: AppConfig) => void> = [];
 
@@ -360,7 +362,7 @@ export async function loadRuntimeConfig(): Promise<AppConfig> {
     runtimeConfig = resolveConfig(fetchedJson);
 
     // Synchronize deterministic hasher settings
-    updateHasherSettings(runtimeConfig.HasherSettings.Salt, runtimeConfig.HasherSettings.MinHashLength);
+    syncAllHasherSettings(runtimeConfig.HasherSettings.Salt, runtimeConfig.HasherSettings.MinHashLength);
 
     console.info(
       `[Config] Active runtime configuration: source=${runtimeConfig.ConfigSource}, API=${runtimeConfig.ApiSettings.BaseUrl}, STS=${runtimeConfig.SecuritySettings.Authority}`

PostFundManagement.ConsoleUI/src/hooks/useInAppNotifications.ts

@@ -6,6 +6,7 @@ import {
   getNotifications,
   createNotification,
   markNotificationAsRead,
+  archiveNotification,
   updateNotification,
   getCurrentUserTenantId,
 } from '../services/api';
@@ -124,7 +125,6 @@ export function useInAppNotifications() {
     },
     // Live polling every 30 seconds
     refetchInterval: 30000,
-    staleTime: 10000,
   });
 
   // InApp notifications (strictly platform === InApp 5) for Bell & Counters
@@ -137,7 +137,10 @@ export function useInAppNotifications() {
   // Active in-app notifications in inbox (excluding trashed and drafts)
   const inboxNotifications = useMemo(() => {
     return inAppNotifications.filter(
-      n => !trashedIds.includes(String(n.id)) && Number(n.status) !== NotificationStatus.Draft
+      n =>
+        !trashedIds.includes(String(n.id)) &&
+        Number(n.status) !== NotificationStatus.Archived &&
+        Number(n.status) !== NotificationStatus.Draft
     );
   }, [inAppNotifications, trashedIds]);
 
@@ -168,7 +171,9 @@ export function useInAppNotifications() {
 
   // Trashed notifications (In-App only)
   const trashedNotifications = useMemo(() => {
-    return inAppNotifications.filter(n => trashedIds.includes(String(n.id)));
+    return inAppNotifications.filter(
+      n => trashedIds.includes(String(n.id)) || Number(n.status) === NotificationStatus.Archived
+    );
   }, [inAppNotifications, trashedIds]);
 
   // Mutation to mark notification as read
@@ -211,8 +216,8 @@ export function useInAppNotifications() {
     });
   }, [starredStorageKey]);
 
-  // Delete message (move to trash)
-  const deleteMessage = useCallback((id: string | number) => {
+  // Delete message (NotificationStatus == Archived & move to trash)
+  const deleteMessage = useCallback(async (id: string | number) => {
     const strId = String(id);
     setTrashedIds(prev => {
       const next = prev.includes(strId) ? prev : [...prev, strId];
@@ -222,10 +227,22 @@ export function useInAppNotifications() {
       } catch {}
       return next;
     });
-  }, [trashStorageKey]);
 
-  // Restore from trash
-  const restoreMessage = useCallback((id: string | number) => {
+    queryClient.setQueryData<Notification[]>(['inapp-notifications', userId], (old = []) =>
+      old.map(n => (String(n.id) === strId ? { ...n, status: NotificationStatus.Archived } : n))
+    );
+
+    try {
+      await archiveNotification(id);
+    } catch (err) {
+      console.warn('[deleteMessage] Error archiving notification on server:', err);
+    } finally {
+      queryClient.invalidateQueries({ queryKey: ['inapp-notifications'] });
+    }
+  }, [trashStorageKey, userId, queryClient]);
+
+  // Restore from trash / unarchive
+  const restoreMessage = useCallback(async (id: string | number) => {
     const strId = String(id);
     setTrashedIds(prev => {
       const next = prev.filter(x => x !== strId);
@@ -235,7 +252,19 @@ export function useInAppNotifications() {
       } catch {}
       return next;
     });
-  }, [trashStorageKey]);
+
+    queryClient.setQueryData<Notification[]>(['inapp-notifications', userId], (old = []) =>
+      old.map(n => (String(n.id) === strId ? { ...n, status: NotificationStatus.Read } : n))
+    );
+
+    try {
+      await markNotificationAsRead(id);
+    } catch (err) {
+      console.warn('[restoreMessage] Error restoring notification on server:', err);
+    } finally {
+      queryClient.invalidateQueries({ queryKey: ['inapp-notifications'] });
+    }
+  }, [trashStorageKey, userId, queryClient]);
 
   // Permanent delete
   const permanentDelete = useCallback((id: string | number) => {

PostFundManagement.ConsoleUI/src/lib/formatters.ts

@@ -80,6 +80,7 @@ export const NOTIFICATION_STATUS_OPTIONS = [
   { value: NotificationStatus.Cancelled, label: 'Cancelled' },
   { value: NotificationStatus.Bounced, label: 'Bounced' },
   { value: NotificationStatus.Draft, label: 'Draft' },
+  { value: NotificationStatus.Archived, label: 'Archived' },
 ];
 
 export const NOTIFICATION_PLATFORM_OPTIONS = [
@@ -510,6 +511,8 @@ export const getEmailStatusBadge = (status?: EmailStatuses | number | null) => {
 export const getNotificationStatusBadge = (status?: NotificationStatus | number | null) => {
   const s = Number(status);
   switch (s) {
+    case NotificationStatus.Archived:
+      return { label: 'Archived', className: 'bg-slate-800 text-slate-300 border-slate-700 font-semibold' };
     case NotificationStatus.Draft:
       return { label: 'Draft', className: 'bg-purple-50 text-purple-800 border-purple-300 font-semibold' };
     case NotificationStatus.Delivered:

PostFundManagement.ConsoleUI/src/lib/queryClient.ts

@@ -4,15 +4,38 @@ import { bumpMutationEpoch } from '../services/httpClient';
 export const queryClient = new QueryClient({
   defaultOptions: {
     queries: {
-      staleTime: 1000 * 60 * 2, // 2 minutes fresh in memory
-      gcTime: 1000 * 60 * 10,   // 10 minutes cache retention
-      refetchOnWindowFocus: false,
-      refetchOnReconnect: true,
+      // Remove caching from all pages: zero stale time and zero cache retention
+      // Whenever a component needs data, it must call its corresponding endpoint(s)
+      staleTime: 0,
+      gcTime: 0,
+      refetchOnMount: 'always',
+      refetchOnWindowFocus: 'always',
+      refetchOnReconnect: 'always',
       retry: 1,
     },
   },
 });
 
+// Retain caching ONLY for sync status, auth token, roles and grants
+const RETAINED_CACHE_OPTIONS = {
+  staleTime: 5 * 60 * 1000,
+  gcTime: 10 * 60 * 1000,
+  refetchOnMount: false,
+  refetchOnWindowFocus: false,
+};
+
+queryClient.setQueryDefaults(['roles'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['system-roles'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['role-claims'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['user-roles'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['user-claims'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['grants'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['user-grants'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['user-sync'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['sync-status'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['auth'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['auth-token'], RETAINED_CACHE_OPTIONS);
+
 /**
  * Invalidates queries while simultaneously bumping the mutation epoch.
  * This guarantees that the background refetch generates a fresh query parameter (_v)

PostFundManagement.ConsoleUI/src/pages/BeneficiariesPage.tsx

@@ -353,6 +353,12 @@ export const BeneficiariesPage: React.FC = () => {
   const updateCompMutation = useMutation({
     mutationFn: (vals: ComplianceFormValues) => {
       if (!editingComp) throw new Error('No item selected');
+      if (
+        (vals.status === ComplianceStatus.Met || vals.status === ComplianceStatus.Exceeded) &&
+        isMaker(editingComp.createdBy)
+      ) {
+        throw new Error('Maker-Checker Violation: You created this compliance item and cannot approve it.');
+      }
       return updateComplianceItem({
         complianceItemId: editingComp.id,
         title: vals.title,
@@ -399,6 +405,12 @@ export const BeneficiariesPage: React.FC = () => {
   const updateOutcomeMutation = useMutation({
     mutationFn: (vals: OutcomeFormValues) => {
       if (!editingOutcome) throw new Error('No outcome selected for update');
+      if (
+        (vals.status === ComplianceStatus.Met || vals.status === ComplianceStatus.Exceeded) &&
+        isMaker(editingOutcome.createdBy)
+      ) {
+        throw new Error('Maker-Checker Violation: You created this outcome record and cannot approve or certify fulfillment.');
+      }
       return updateOutcome({
         outcomeId: editingOutcome.id,
         name: vals.name,
@@ -1467,11 +1479,15 @@ export const BeneficiariesPage: React.FC = () => {
               {...compForm.register('status')}
               className="w-full bg-slate-900 border border-slate-800 rounded-xl px-3 py-2 text-xs text-white focus:outline-none focus:border-blue-500 cursor-pointer"
             >
-              {COMPLIANCE_STATUS_OPTIONS.map((opt) => (
-                <option key={opt.value} value={opt.value}>
-                  {opt.label}
-                </option>
-              ))}
+              {COMPLIANCE_STATUS_OPTIONS.map((opt) => {
+                const isApprovedOpt = opt.value === ComplianceStatus.Met || opt.value === ComplianceStatus.Exceeded;
+                const makerRestricted = editingComp && isApprovedOpt && isMaker(editingComp.createdBy);
+                return (
+                  <option key={opt.value} value={opt.value} disabled={makerRestricted}>
+                    {opt.label} {makerRestricted ? '(Maker-Checker: Restricted)' : ''}
+                  </option>
+                );
+              })}
             </select>
           </div>
 
@@ -1680,11 +1696,15 @@ export const BeneficiariesPage: React.FC = () => {
               {...outcomeForm.register('status')}
               className="w-full bg-slate-900 border border-slate-800 rounded-xl px-3 py-2 text-xs text-white focus:outline-none focus:border-blue-500 cursor-pointer"
             >
-              {COMPLIANCE_STATUS_OPTIONS.map((opt) => (
-                <option key={opt.value} value={opt.value}>
-                  {opt.label}
-                </option>
-              ))}
+              {COMPLIANCE_STATUS_OPTIONS.map((opt) => {
+                const isMetOpt = opt.value === ComplianceStatus.Met || opt.value === ComplianceStatus.Exceeded;
+                const makerRestricted = editingOutcome && isMetOpt && isMaker(editingOutcome.createdBy);
+                return (
+                  <option key={opt.value} value={opt.value} disabled={makerRestricted}>
+                    {opt.label} {makerRestricted ? '(Maker-Checker: Restricted)' : ''}
+                  </option>
+                );
+              })}
             </select>
           </div>
 

PostFundManagement.ConsoleUI/src/pages/ChangeManagementPage.tsx

@@ -1020,7 +1020,7 @@ export const ChangeManagementPage: React.FC = () => {
                             {Number(cr.status) === ApprovalStatus.Approved ? (
                               <span className="inline-flex items-center gap-1 text-xs font-semibold text-emerald-400 bg-emerald-500/10 px-2.5 py-1 rounded-lg border border-emerald-500/20 cursor-default" title="Approved and enacted change requests are immutable.">
                                 <Lock className="w-3 h-3 text-emerald-400" />
-                                <span>Resolved &amp; Enacted (Immutable)</span>
+                                <span>Resolved &amp; Enacted</span>
                               </span>
                             ) : (
                               <>
@@ -1528,7 +1528,7 @@ export const ChangeManagementPage: React.FC = () => {
                   title="Approved and enacted change requests are immutable."
                 >
                   <Lock className="w-3.5 h-3.5 text-emerald-400" />
-                  <span>Approved &amp; Enacted (Immutable - Cannot Be Changed)</span>
+                  <span>Approved &amp; Enacted</span>
                 </div>
               ) : (
                 <select

PostFundManagement.ConsoleUI/src/pages/GovernancePage.tsx

@@ -11,6 +11,7 @@ import {
   Edit2,
   Mail,
   Shield,
+  ShieldCheck,
   Layers,
   ChevronRight,
   Search,
@@ -24,9 +25,11 @@ import {
   UserPlus,
   ChevronDown,
   ChevronUp,
+  CheckCircle,
   CheckCircle2,
   Loader2,
   Lock,
+  AlertTriangle,
 } from 'lucide-react';
 import {
   getOrganisations,
@@ -69,6 +72,7 @@ import { ExportButton } from '../components/ui/ExportButton';
 import { ExportColumn } from '../utils/exportUtils';
 import { useAuth } from '../auth/AuthProvider';
 import { useRbac } from '../auth/rbac';
+import { bumpMutationEpoch } from '../services/httpClient';
 import { useTableSort, SortableTh } from '../utils/tableSort';
 import { FundingInstrumentsSection, InstructionsSection } from '../components/governance/InstructionsSection';
 import { RulesSection } from '../components/governance/RulesSection';
@@ -110,6 +114,7 @@ const organisationSchema = z.object({
   registrationNo: z.string().min(4, 'Registration number is mandatory'),
   email: z.string().email('Enter a valid email address'),
   organisationUser: z.string().min(1, 'Please select a linked executive or manager user'),
+  idNumber: z.string().optional(),
   type: z.coerce.number().min(1).max(27),
   status: z.coerce.number().optional(),
 });
@@ -134,8 +139,8 @@ type ProgrammeFormValues = z.infer<typeof programmeSchema>;
 
 export const GovernancePage: React.FC = () => {
   const queryClient = useQueryClient();
-  const { sub, user, claims } = useAuth();
-  const { canAdd, canApprove, canExport, canApproveRecord, isMaker } = useRbac();
+  const { sub, user, claims, roles, tenantId } = useAuth();
+  const { canAdd, canApprove, canExport, canApproveRecord, isMaker, isUnrestricted } = useRbac();
   const currentUserId = sub || user?.id || '';
   const { success, error: toastError } = useToast();
 
@@ -241,7 +246,6 @@ export const GovernancePage: React.FC = () => {
   const { data: usersDirectory = [] } = useQuery({
     queryKey: ['users-directory'],
     queryFn: () => getUsers(1, 200),
-    staleTime: 5 * 60 * 1000,
   });
 
   const { data: systemRoles = [] } = useQuery<Role[]>({
@@ -263,6 +267,37 @@ export const GovernancePage: React.FC = () => {
     });
   }, [usersDirectory]);
 
+  const modalExecutiveUsers = React.useMemo(() => {
+    const list: User[] = [...executiveAndManagerUsers];
+    const linkedUserId =
+      editingOrg?.userId ||
+      editingOrg?.UserId ||
+      '';
+
+    if (linkedUserId) {
+      const linkedStr = String(linkedUserId).toLowerCase();
+      const alreadyIncluded = list.some((u) => u.id && String(u.id).toLowerCase() === linkedStr);
+      if (!alreadyIncluded) {
+        const inDirectory = usersDirectory.find((u) => u.id && String(u.id).toLowerCase() === linkedStr);
+        if (inDirectory) {
+          list.unshift(inDirectory);
+        } else {
+          const email = getUserEmail(linkedUserId);
+          const hasRealEmail = email && email !== '—' && email.includes('@') && email !== String(linkedUserId);
+          list.unshift({
+            id: String(linkedUserId),
+            email: hasRealEmail ? email : String(linkedUserId),
+            role: 'Executive',
+            status: ActivityStatus.Active,
+            lastLoginAt: null,
+          });
+        }
+      }
+    }
+
+    return list;
+  }, [executiveAndManagerUsers, usersDirectory, editingOrg?.id, editingOrg?.userId]);
+
   // Quick Add Executive User Subform state
   const [isQuickAddUserOpen, setIsQuickAddUserOpen] = useState(false);
   const [quickUserEmail, setQuickUserEmail] = useState('');
@@ -560,11 +595,23 @@ export const GovernancePage: React.FC = () => {
       registrationNo: '',
       email: '',
       organisationUser: '',
+      idNumber: '',
       type: OrganisationType.Enterprise,
-      status: ActivityStatus.Active,
+      status: ActivityStatus.Inactive,
     },
   });
 
+  const watchedOrgUser = orgForm.watch('organisationUser');
+  const selectedExecutiveUser = React.useMemo(() => {
+    if (!watchedOrgUser) return null;
+    const str = String(watchedOrgUser).toLowerCase();
+    return (
+      usersDirectory.find((u) => u.id && String(u.id).toLowerCase() === str) ||
+      modalExecutiveUsers.find((u) => u.id && String(u.id).toLowerCase() === str) ||
+      null
+    );
+  }, [watchedOrgUser, usersDirectory, modalExecutiveUsers]);
+
   const portfolioForm = useForm<PortfolioFormValues>({
     resolver: zodResolver(portfolioSchema),
     defaultValues: {
@@ -580,7 +627,7 @@ export const GovernancePage: React.FC = () => {
     defaultValues: {
       name: '',
       portfolioId: portfolios[0]?.id ? Number(portfolios[0].id) : 201,
-      status: ApprovalStatus.Approved,
+      status: ApprovalStatus.Pending,
       ownerEmail: effectiveUserEmail,
     },
   });
@@ -589,11 +636,20 @@ export const GovernancePage: React.FC = () => {
   const orgMutation = useMutation({
     mutationFn: (data: OrganisationFormValues) => {
       if (editingOrg) {
+        if (!data.idNumber || !data.idNumber.trim()) {
+          orgForm.setError('idNumber', {
+            type: 'manual',
+            message: 'Government ID number is required to assign this executive user.',
+          });
+          throw new Error('Executive user ID number is required when updating an organisation.');
+        }
+
         return updateOrganisation({
           organisationId: editingOrg.id,
           name: data.name,
           registrationNo: data.registrationNo,
           email: data.email,
+          idNumber: data.idNumber.trim(),
           organisationUser: data.organisationUser,
           type: Number(data.type),
           status: data.status !== undefined ? Number(data.status) : ActivityStatus.Active,
@@ -603,11 +659,13 @@ export const GovernancePage: React.FC = () => {
         name: data.name,
         registrationNo: data.registrationNo,
         email: data.email,
+        idNumber: data.idNumber?.trim() || null,
         organisationUser: data.organisationUser,
         type: Number(data.type),
       });
     },
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['organisations'] });
       success(editingOrg ? 'Organisation updated' : 'Organisation registered successfully');
       setIsOrgModalOpen(false);
@@ -639,6 +697,7 @@ export const GovernancePage: React.FC = () => {
       });
     },
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['portfolios'] });
       success(editingPortfolio ? 'Portfolio updated successfully' : 'Portfolio created successfully');
       setIsPortfolioModalOpen(false);
@@ -650,15 +709,43 @@ export const GovernancePage: React.FC = () => {
     },
   });
 
+  const approveProgrammeMutation = useMutation({
+    mutationFn: async (pr: Programme) => {
+      if (isMaker(pr.createdBy)) {
+        throw new Error('Maker-Checker policy: Record creator cannot approve their own programme.');
+      }
+      return updateProgramme({
+        programmeId: pr.id,
+        name: pr.name || '',
+        portfolioId: Number(pr.portfolioId),
+        status: ApprovalStatus.Approved,
+        ownerId: pr.ownedBy,
+      });
+    },
+    onSuccess: () => {
+      bumpMutationEpoch();
+      queryClient.invalidateQueries({ queryKey: ['programmes'] });
+      queryClient.invalidateQueries({ queryKey: ['programme'] });
+      success('Programme Approved', 'Programme governance status successfully updated to Approved.');
+    },
+    onError: (err: unknown) => {
+      toastError('Programme Approval Failed', err);
+    },
+  });
+
   const programmeMutation = useMutation({
     mutationFn: (data: ProgrammeFormValues) => {
       const resolvedOwnerId = resolveOwnerId(data.ownerEmail, editingProgramme?.ownedBy);
       if (editingProgramme) {
+        const targetStatus = (data.status !== undefined ? Number(data.status) : 1) as ApprovalStatus;
+        if (targetStatus === ApprovalStatus.Approved && isMaker(editingProgramme.createdBy)) {
+          throw new Error('Maker-Checker policy violation: Record creators cannot approve their own programmes.');
+        }
         return updateProgramme({
           programmeId: editingProgramme.id,
           name: data.name,
           portfolioId: Number(data.portfolioId),
-          status: (data.status !== undefined ? Number(data.status) : 1) as ApprovalStatus,
+          status: targetStatus,
           ownerId: resolvedOwnerId,
         });
       }
@@ -669,7 +756,9 @@ export const GovernancePage: React.FC = () => {
       });
     },
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['programmes'] });
+      queryClient.invalidateQueries({ queryKey: ['programme'] });
       success(editingProgramme ? 'Programme updated successfully' : 'Programme created successfully');
       setIsProgrammeModalOpen(false);
       setEditingProgramme(null);
@@ -688,8 +777,9 @@ export const GovernancePage: React.FC = () => {
       registrationNo: '',
       email: '',
       organisationUser: defaultUser?.id || '',
+      idNumber: defaultUser?.idNumber || '',
       type: OrganisationType.Enterprise,
-      status: ActivityStatus.Active,
+      status: ActivityStatus.Inactive,
     });
     setIsQuickAddUserOpen(false);
     setQuickUserError(null);
@@ -702,26 +792,51 @@ export const GovernancePage: React.FC = () => {
     const targetUserId =
       org.userId ||
       org.UserId ||
-      org.organisationUser ||
-      org.OrganisationUser ||
-      org.createdBy ||
       '';
 
-    const matchedUser = targetUserId
-      ? usersDirectory.find((u) => u.id && String(u.id).toLowerCase() === String(targetUserId).toLowerCase())
-      : null;
+    let selectedUserId = '';
+    let matchedUser: User | undefined;
+    if (targetUserId) {
+      const targetStr = String(targetUserId).toLowerCase();
+      matchedUser = usersDirectory.find(
+        (u) =>
+          (u.id && String(u.id).toLowerCase() === targetStr) ||
+          (u.email && u.email.toLowerCase() === targetStr)
+      );
 
-    const selectedUserId = matchedUser?.id || targetUserId || '';
+      if (matchedUser) {
+        selectedUserId = matchedUser.id;
+        if (matchedUser.email) {
+          registerUserEmail(matchedUser.id, matchedUser.email);
+        }
+      } else {
+        selectedUserId = String(targetUserId);
+        const email = getUserEmail(targetUserId);
+        if (email && email !== '—' && email.includes('@')) {
+          registerUserEmail(selectedUserId, email);
+        }
+      }
+    }
+
+    const resolvedIdNumber = matchedUser?.idNumber || org.idNumber || '';
 
     orgForm.reset({
       name: org.name || '',
       registrationNo: org.registrationNo || '',
       email: org.email || '',
       organisationUser: selectedUserId,
+      idNumber: resolvedIdNumber,
       type: org.type || OrganisationType.Enterprise,
       status: org.status ?? ActivityStatus.Active,
     });
 
+    if (selectedUserId && !resolvedIdNumber) {
+      orgForm.setError('idNumber', {
+        type: 'manual',
+        message: 'This executive user has no ID number on file. An ID number is required to update the organisation.',
+      });
+    }
+
     setIsQuickAddUserOpen(false);
     setQuickUserError(null);
     setIsOrgModalOpen(true);
@@ -755,7 +870,7 @@ export const GovernancePage: React.FC = () => {
     programmeForm.reset({
       name: '',
       portfolioId: portfolios[0]?.id ? Number(portfolios[0].id) : 201,
-      status: ApprovalStatus.Approved,
+      status: ApprovalStatus.Pending,
       ownerEmail: effectiveUserEmail,
     });
     setIsProgrammeModalOpen(true);
@@ -833,6 +948,7 @@ export const GovernancePage: React.FC = () => {
     status: (p) => getApprovalStatusBadge(p.status).label,
     createdAt: (p) => p.createdAt,
     ownedBy: (p) => getUserEmail(p.ownedBy),
+    createdBy: (p) => getUserEmail(p.createdBy),
   });
 
   // Export Columns Definitions
@@ -863,6 +979,7 @@ export const GovernancePage: React.FC = () => {
       format: (id) => programmes.filter((pr) => String(pr.portfolioId) === String(id)).length,
     },
     { header: 'Owner Email', key: 'ownedBy', format: (val) => getUserEmail(val) },
+    { header: 'Created By (Maker)', key: 'createdBy', format: (val) => getUserEmail(val) },
     { header: 'Creation Date', key: 'createdAt', format: (val) => formatDate(val) },
     { header: 'Description', key: 'description', format: (val) => val || '—' },
   ];
@@ -881,6 +998,7 @@ export const GovernancePage: React.FC = () => {
     { header: 'Governance Status', key: 'status', format: (val) => getApprovalStatusBadge(val).label },
     { header: 'Creation Date', key: 'createdAt', format: (val) => formatDate(val) },
     { header: 'Owner Email', key: 'ownedBy', format: (val) => getUserEmail(val) },
+    { header: 'Created By (Maker)', key: 'createdBy', format: (val) => getUserEmail(val) },
   ];
 
   return (
@@ -1150,6 +1268,11 @@ export const GovernancePage: React.FC = () => {
                             <Mail className="w-3.5 h-3.5 text-slate-500" />
                             {org.email}
                           </span>
+                          {org.userId && (
+                            <span className="text-[10px] text-blue-400/90 font-mono block mt-0.5" title={`Executive User: ${org.userId}`}>
+                              Exec: {getUserEmail(org.userId)}
+                            </span>
+                          )}
                         </td>
                         <td className="py-3.5 px-4">
                           <span className={`inline-flex items-center px-2.5 py-0.5 rounded-full text-[10px] font-semibold border ${statusBadge.className}`}>
@@ -1382,19 +1505,22 @@ export const GovernancePage: React.FC = () => {
                   <SortableTh column="ownedBy" currentColumn={progSortCol} direction={progSortDir} onSort={handleProgSort} className="py-3.5 px-4">
                     Owner Email
                   </SortableTh>
+                  <SortableTh column="createdBy" currentColumn={progSortCol} direction={progSortDir} onSort={handleProgSort} className="py-3.5 px-4">
+                    Created By
+                  </SortableTh>
                   <th className="py-3.5 px-5 text-right font-medium">Actions</th>
                 </tr>
               </thead>
               <tbody className="divide-y divide-slate-800/60">
                 {loadingProgrammes ? (
                   <tr>
-                    <td colSpan={6} className="py-8 text-center text-slate-500">
+                    <td colSpan={7} className="py-8 text-center text-slate-500">
                       Loading programmes...
                     </td>
                   </tr>
                 ) : sortedProgrammes.length === 0 ? (
                   <tr>
-                    <td colSpan={6} className="py-8 text-center text-slate-500">
+                    <td colSpan={7} className="py-8 text-center text-slate-500">
                       No programmes found matching query.
                     </td>
                   </tr>
@@ -1402,6 +1528,7 @@ export const GovernancePage: React.FC = () => {
                   sortedProgrammes.map((pr) => {
                     const port = portfolios.find((p) => String(p.id) === String(pr.portfolioId));
                     const statusBadge = getApprovalStatusBadge(pr.status);
+                    const isApproved = Number(pr.status) === ApprovalStatus.Approved;
                     return (
                       <tr key={pr.id} className="hover:bg-slate-800/40 transition-colors">
                         <td className="py-3.5 px-5">
@@ -1420,8 +1547,49 @@ export const GovernancePage: React.FC = () => {
                         <td className="py-3.5 px-4 font-mono text-slate-300 font-medium text-[11px]">
                           {getUserEmail(pr.ownedBy)}
                         </td>
+                        <td className="py-3.5 px-4 font-mono text-slate-400 text-[11px]">
+                          {getUserEmail(pr.createdBy)}
+                        </td>
                         <td className="py-3.5 px-5 text-right">
-                          <div className="flex items-center justify-end gap-1.5">
+                          <div className="flex items-center justify-end gap-1.5 flex-wrap sm:flex-nowrap">
+                            {isApproved ? (
+                              <span
+                                className="inline-flex items-center gap-1 text-xs font-semibold text-emerald-400 bg-emerald-500/10 px-2.5 py-1 rounded-lg border border-emerald-500/20 cursor-default"
+                                title="Approved programmes cannot be modified."
+                              >
+                                <Lock className="w-3 h-3 text-emerald-400" />
+                                <span>Approved</span>
+                              </span>
+                            ) : (
+                              <>
+                                <button
+                                  type="button"
+                                  onClick={() => openEditProgramme(pr)}
+                                  className="inline-flex items-center gap-1 text-xs font-semibold text-slate-200 hover:text-white bg-slate-900/80 hover:bg-slate-800 border border-slate-700/80 px-2.5 py-1 rounded-lg transition shadow-xs cursor-pointer"
+                                  title="Edit Programme"
+                                >
+                                  <Edit2 className="w-3 h-3" />
+                                  Edit
+                                </button>
+                                {canApproveRecord('governance', pr.createdBy) && (
+                                  <button
+                                    type="button"
+                                    disabled={approveProgrammeMutation.isPending}
+                                    onClick={() => approveProgrammeMutation.mutate(pr)}
+                                    className="inline-flex items-center gap-1 text-xs font-semibold text-emerald-300 hover:text-white bg-emerald-500/10 hover:bg-emerald-500/20 border border-emerald-500/30 px-2.5 py-1 rounded-lg transition shadow-xs cursor-pointer"
+                                    title="Approve Programme"
+                                  >
+                                    <CheckCircle className="w-3 h-3" />
+                                    <span>Approve</span>
+                                  </button>
+                                )}
+                                {canApprove('governance') && isMaker(pr.createdBy) && (
+                                  <span className="text-[10px] text-amber-400 font-mono italic px-1.5 py-0.5 bg-amber-500/10 border border-amber-500/20 rounded">
+                                    Maker-Checker: Record creator cannot approve
+                                  </span>
+                                )}
+                              </>
+                            )}
                             <button
                               type="button"
                               onClick={() => {
@@ -1458,14 +1626,6 @@ export const GovernancePage: React.FC = () => {
                               <Scale className="w-3 h-3" />
                               Rules
                             </button>
-                            <button
-                              type="button"
-                              onClick={() => openEditProgramme(pr)}
-                              className="inline-flex items-center gap-1 text-xs font-semibold text-slate-200 hover:text-white bg-slate-900/80 hover:bg-slate-800 border border-slate-700/80 px-2.5 py-1 rounded-lg transition shadow-xs cursor-pointer"
-                            >
-                              <Edit2 className="w-3 h-3" />
-                              Edit
-                            </button>
                           </div>
                         </td>
                       </tr>
@@ -1611,11 +1771,11 @@ export const GovernancePage: React.FC = () => {
               <div className="flex items-center justify-between mb-1">
                 <div className="flex items-center gap-1">
                   <label className="block text-xs font-semibold text-slate-300">
-                    Linked Executive / Manager User *
+                    Responsible Executive User *
                   </label>
                   <HelpTooltip
-                    title="Designated Organisation User"
-                    content="Only users with an Executive or Manager role can be assigned to an organisation."
+                    title="Executive / Organisation User"
+                    content="The Executive user responsible for this organisation. Stored as userId in the organisation record and submitted as organisationUser to the API."
                     size="sm"
                     placement="top"
                   />
@@ -1636,11 +1796,36 @@ export const GovernancePage: React.FC = () => {
                 )}
               </div>
               <select
-                {...orgForm.register('organisationUser')}
+                {...orgForm.register('organisationUser', {
+                  onChange: (e) => {
+                    const selectedId = e.target.value;
+                    if (!selectedId) {
+                      orgForm.setValue('idNumber', '');
+                      return;
+                    }
+                    const str = String(selectedId).toLowerCase();
+                    const matched =
+                      usersDirectory.find((u) => u.id && String(u.id).toLowerCase() === str) ||
+                      modalExecutiveUsers.find((u) => u.id && String(u.id).toLowerCase() === str);
+
+                    if (matched?.idNumber && matched.idNumber.trim()) {
+                      orgForm.setValue('idNumber', matched.idNumber.trim(), { shouldValidate: true });
+                      orgForm.clearErrors('idNumber');
+                    } else {
+                      orgForm.setValue('idNumber', '', { shouldValidate: true });
+                      if (editingOrg) {
+                        orgForm.setError('idNumber', {
+                          type: 'manual',
+                          message: 'Selected user has no ID number on file. Please enter their ID number to enable executive assignment.',
+                        });
+                      }
+                    }
+                  },
+                })}
                 className="w-full px-3 py-2 text-xs border border-slate-700/80 rounded-xl focus:outline-none focus:ring-1 focus:ring-blue-500 bg-[#090d16] text-white font-medium"
               >
                 <option value="">-- Select linked executive or manager account --</option>
-                {executiveAndManagerUsers.map((u) => (
+                {modalExecutiveUsers.map((u) => (
                   <option key={u.id} value={u.id}>
                     {u.email || u.id} ({u.role || 'Executive'})
                   </option>
@@ -1654,9 +1839,61 @@ export const GovernancePage: React.FC = () => {
                   No Executive or Manager user found. Create one below to continue.
                 </p>
               )}
+              {watchedOrgUser && selectedExecutiveUser && selectedExecutiveUser.idNumber && selectedExecutiveUser.idNumber.trim() && (
+                <div className="flex items-center gap-1.5 text-[11px] text-emerald-400 mt-1">
+                  <CheckCircle className="w-3.5 h-3.5 text-emerald-400 shrink-0" />
+                  <span>ID on file: <strong className="font-mono text-emerald-300">{selectedExecutiveUser.idNumber}</strong></span>
+                </div>
+              )}
             </div>
           </div>
 
+          {/* Missing ID Number Alert */}
+          {watchedOrgUser && selectedExecutiveUser && (!selectedExecutiveUser.idNumber || !selectedExecutiveUser.idNumber.trim()) && (
+            <div className="p-3 rounded-xl border border-amber-500/30 bg-amber-500/10 text-amber-300 text-xs flex items-start gap-2.5">
+              <AlertTriangle className="w-4 h-4 text-amber-400 shrink-0 mt-0.5" />
+              <div className="space-y-1">
+                <p className="font-semibold text-amber-200">
+                  Missing Executive ID Number
+                </p>
+                <p className="text-[11px] text-amber-300/90 leading-relaxed">
+                  The selected executive (<strong className="font-mono text-white">{selectedExecutiveUser.email || watchedOrgUser}</strong>) does not have a Government ID Number on file. An ID number is required to assign this executive user; otherwise the update will be ignored. Please enter their ID number below.
+                </p>
+              </div>
+            </div>
+          )}
+
+          {/* Executive User ID Number Input */}
+          <div>
+            <div className="flex items-center justify-between mb-1">
+              <div className="flex items-center gap-1">
+                <label className="block text-xs font-semibold text-slate-300">
+                  Executive ID Number {editingOrg ? '*' : '(Optional)'}
+                </label>
+                <HelpTooltip
+                  title="Executive ID Requirement"
+                  content="Government Issued ID or Passport of the executive. Required when updating to persist the executive user link; otherwise the update will be ignored."
+                  size="sm"
+                  placement="top"
+                />
+              </div>
+              {selectedExecutiveUser?.idNumber && (
+                <span className="text-[10px] text-emerald-400 font-mono">Sourced from profile</span>
+              )}
+            </div>
+            <input
+              type="text"
+              {...orgForm.register('idNumber')}
+              className={`w-full px-3 py-2 text-xs border rounded-xl focus:outline-none focus:ring-1 focus:ring-blue-500 text-white bg-[#090d16] font-mono ${
+                orgForm.formState.errors.idNumber ? 'border-rose-500 ring-1 ring-rose-500' : 'border-slate-700/80'
+              }`}
+              placeholder="Enter 13-digit ID or Passport Number"
+            />
+            {orgForm.formState.errors.idNumber && (
+              <p className="text-[10px] text-rose-500 mt-1">{orgForm.formState.errors.idNumber.message}</p>
+            )}
+          </div>
+
           {/* Inline Collapsible Subform to Create Executive User */}
           {isQuickAddUserOpen && !editingOrg && (
             <div className="p-3.5 rounded-xl border border-blue-500/30 bg-blue-950/20 space-y-3">
@@ -2004,18 +2241,18 @@ export const GovernancePage: React.FC = () => {
                   placement="top"
                 />
               </div>
-              {selectedProgrammeForDetail && Number(selectedProgrammeForDetail.status) === ApprovalStatus.Approved ? (
+              {editingProgramme && Number(editingProgramme.status) === ApprovalStatus.Approved ? (
                 <div
                   className="w-full px-3 py-2 text-xs border border-emerald-500/30 bg-emerald-500/10 rounded-xl text-emerald-300 font-semibold flex items-center gap-1.5 cursor-default"
-                  title="Approved programmes are immutable."
+                  title="Approved programmes cannot be modified."
                 >
                   <Lock className="w-3.5 h-3.5 text-emerald-400" />
-                  <span>Approved (Immutable - Cannot Be Changed)</span>
+                  <span>Approved</span>
                 </div>
               ) : (
                 (() => {
-                  const canApproveProgramme = canApproveRecord('governance', selectedProgrammeForDetail?.createdBy);
-                  const isSelf = isMaker(selectedProgrammeForDetail?.createdBy);
+                  const canApproveProgramme = canApproveRecord('governance', editingProgramme?.createdBy);
+                  const isSelf = isMaker(editingProgramme?.createdBy);
 
                   return (
                     <select
@@ -2460,11 +2697,17 @@ export const GovernancePage: React.FC = () => {
                     <span className="text-slate-300">{getOrganisationTypeLabel(orgFreshDetail?.type ?? selectedOrgForDetail?.type ?? OrganisationType.Enterprise)}</span>
                   </div>
                   <div className="flex items-center gap-2 min-w-0">
-                    <span className="text-slate-400 font-semibold text-[11px] uppercase tracking-wider shrink-0">Linked User:</span>
+                    <span className="text-slate-400 font-semibold text-[11px] uppercase tracking-wider shrink-0">Executive User:</span>
                     <span className="text-blue-400 font-mono text-[11px] truncate">
                       {getUserEmail(orgFreshDetail?.userId || selectedOrgForDetail?.userId) || orgFreshDetail?.userId || selectedOrgForDetail?.userId || '—'}
                     </span>
                   </div>
+                  <div className="flex items-center gap-2 min-w-0">
+                    <span className="text-slate-400 font-semibold text-[11px] uppercase tracking-wider shrink-0">Created By:</span>
+                    <span className="text-slate-300 font-mono text-[11px] truncate">
+                      {getUserEmail(orgFreshDetail?.createdBy || selectedOrgForDetail?.createdBy) || orgFreshDetail?.createdBy || selectedOrgForDetail?.createdBy || '—'}
+                    </span>
+                  </div>
                 </div>
               </div>
 
@@ -2717,13 +2960,38 @@ export const GovernancePage: React.FC = () => {
                     <span className="text-slate-400 font-semibold block text-[11px] uppercase tracking-wider mb-1">Programme Title</span>
                     <span className="text-white font-semibold text-sm block">{programmeFreshDetail?.name || selectedProgrammeForDetail?.name}</span>
                   </div>
-                  <span className={`inline-flex items-center px-2.5 py-0.5 rounded-full text-[10px] font-semibold border whitespace-nowrap ${getApprovalStatusBadge(programmeFreshDetail?.status ?? selectedProgrammeForDetail?.status ?? ApprovalStatus.Approved).className}`}>
-                    {getApprovalStatusBadge(programmeFreshDetail?.status ?? selectedProgrammeForDetail?.status ?? ApprovalStatus.Approved).label}
-                  </span>
+                  <div className="flex items-center gap-2">
+                    <span className={`inline-flex items-center px-2.5 py-0.5 rounded-full text-[10px] font-semibold border whitespace-nowrap ${getApprovalStatusBadge(programmeFreshDetail?.status ?? selectedProgrammeForDetail?.status ?? ApprovalStatus.Approved).className}`}>
+                      {getApprovalStatusBadge(programmeFreshDetail?.status ?? selectedProgrammeForDetail?.status ?? ApprovalStatus.Approved).label}
+                    </span>
+                    {selectedProgrammeForDetail && Number(programmeFreshDetail?.status ?? selectedProgrammeForDetail.status) !== ApprovalStatus.Approved && (
+                      canApproveRecord('governance', selectedProgrammeForDetail.createdBy) ? (
+                        <button
+                          type="button"
+                          disabled={approveProgrammeMutation.isPending}
+                          onClick={async () => {
+                            await approveProgrammeMutation.mutateAsync(selectedProgrammeForDetail);
+                            setIsProgrammeDetailModalOpen(false);
+                            setSelectedProgrammeForDetail(null);
+                          }}
+                          className="inline-flex items-center gap-1 text-xs font-semibold text-emerald-300 hover:text-white bg-emerald-500/10 hover:bg-emerald-500/20 border border-emerald-500/30 px-2.5 py-1 rounded-lg transition shadow-xs cursor-pointer"
+                        >
+                          <CheckCircle className="w-3.5 h-3.5" />
+                          <span>Approve Programme</span>
+                        </button>
+                      ) : (
+                        isMaker(selectedProgrammeForDetail.createdBy) && canApprove('governance') && (
+                          <span className="text-[10px] text-amber-400 font-mono italic px-1.5 py-0.5 bg-amber-500/10 border border-amber-500/20 rounded">
+                            Maker-Checker: Record creator cannot approve
+                          </span>
+                        )
+                      )
+                    )}
+                  </div>
                 </div>
 
-                {/* Core Details Grid: Owner & Creation Date */}
-                <div className="grid grid-cols-1 sm:grid-cols-2 gap-3 text-xs">
+                {/* Core Details Grid: Owner, Maker, Creation Date */}
+                <div className="grid grid-cols-1 sm:grid-cols-3 gap-3 text-xs">
                   {/* Creation Date */}
                   <div className="p-3 bg-[#080d1a] rounded-lg border border-slate-800 flex items-center gap-2.5">
                     <Calendar className="w-4 h-4 text-slate-400 shrink-0" />
@@ -2745,6 +3013,17 @@ export const GovernancePage: React.FC = () => {
                       </span>
                     </div>
                   </div>
+
+                  {/* Maker */}
+                  <div className="p-3 bg-[#080d1a] rounded-lg border border-slate-800 flex items-center gap-2.5">
+                    <ShieldCheck className="w-4 h-4 text-slate-400 shrink-0" />
+                    <div className="min-w-0 flex-1">
+                      <span className="text-slate-500 font-medium block text-[10px] uppercase tracking-wider">Created By (Maker)</span>
+                      <span className="font-mono text-slate-200 text-xs truncate block" title={getUserEmail(programmeFreshDetail?.createdBy || selectedProgrammeForDetail?.createdBy)}>
+                        {getUserEmail(programmeFreshDetail?.createdBy || selectedProgrammeForDetail?.createdBy)}
+                      </span>
+                    </div>
+                  </div>
                 </div>
 
                 {/* Metrics: Total Rules and Total Instructions */}

PostFundManagement.ConsoleUI/src/pages/GrantsPage.tsx

@@ -47,6 +47,7 @@ import { ExportButton } from '../components/ui/ExportButton';
 import { ExportColumn } from '../utils/exportUtils';
 import { useTableSort, SortableTh } from '../utils/tableSort';
 import { useRbac } from '../auth/rbac';
+import { bumpMutationEpoch } from '../services/httpClient';
 import {
   Award,
   Budget,
@@ -123,7 +124,7 @@ export const GrantsPage: React.FC = () => {
   const [isBudgetModalOpen, setIsBudgetModalOpen] = useState(false);
   const [editingBudget, setEditingBudget] = useState<Budget | null>(null);
   const [isEditBudgetModalOpen, setIsEditBudgetModalOpen] = useState(false);
-  const [selectedBudgetStatus, setSelectedBudgetStatus] = useState<ApprovalStatus>(ApprovalStatus.Approved);
+  const [selectedBudgetStatus, setSelectedBudgetStatus] = useState<ApprovalStatus>(ApprovalStatus.Pending);
   const [isDisbursementModalOpen, setIsDisbursementModalOpen] = useState(false);
   const [editingDisbursement, setEditingDisbursement] = useState<Disbursement | null>(null);
 
@@ -233,6 +234,7 @@ export const GrantsPage: React.FC = () => {
   const updateAwardMutation = useMutation({
     mutationFn: (data: UpdateAwardRequest) => updateAward(data),
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['awards'] });
       queryClient.invalidateQueries({ queryKey: ['dashboard'] });
       success('Award Updated', 'Award details saved successfully.');
@@ -248,6 +250,7 @@ export const GrantsPage: React.FC = () => {
   const budgetMutation = useMutation({
     mutationFn: (data: CreateBudgetRequest) => createBudget(data),
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['budgets'] });
       success('Budget line established', 'Budget line created against project');
       setIsBudgetModalOpen(false);
@@ -261,6 +264,7 @@ export const GrantsPage: React.FC = () => {
   const updateBudgetMutation = useMutation({
     mutationFn: (data: UpdateBudgetRequest) => updateBudget(data),
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['budgets'] });
       success('Budget Updated', 'Budget compliance and approval status updated.');
       setIsEditBudgetModalOpen(false);
@@ -287,6 +291,7 @@ export const GrantsPage: React.FC = () => {
       });
     },
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['disbursements'] });
       success(
         editingDisbursement ? 'Disbursement Updated' : 'Disbursement Scheduled',
@@ -497,6 +502,7 @@ export const GrantsPage: React.FC = () => {
   const approveMutation = useMutation({
     mutationFn: (id: string | number) => approveDisbursement(id),
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['disbursements'] });
       queryClient.invalidateQueries({ queryKey: ['dashboard'] });
       success(
@@ -637,8 +643,14 @@ export const GrantsPage: React.FC = () => {
     handleSort: handleAwardSort,
   } = useTableSort(filteredAwards, null, null, {
     referenceNo: (a) => a.referenceNo,
-    organisationId: (a) => a.organisationName || `Org #${a.organisationId}`,
-    programmeId: (a) => a.programmeName || `Programme #${a.programmeId}`,
+    organisationId: (a) => {
+      const org = organisations.find((o) => String(o.id) === String(a.organisationId));
+      return (org?.name || a.organisationName || `Organisation #${a.organisationId}`).toLowerCase();
+    },
+    programmeId: (a) => {
+      const prog = programmes.find((p) => String(p.id) === String(a.programmeId));
+      return (prog?.name || a.programmeName || `Programme #${a.programmeId}`).toLowerCase();
+    },
     amount: (a) => a.amount,
     status: (a) => getApprovalStatusBadge(a.status).label,
     createdAt: (a) => a.createdAt,
@@ -651,7 +663,10 @@ export const GrantsPage: React.FC = () => {
     handleSort: handleBudgetSort,
   } = useTableSort(filteredBudgets, null, null, {
     name: (b) => b.name,
-    projectId: (b) => b.projectId,
+    projectId: (b) => {
+      const proj = projects.find((p) => String(p.id) === String(b.projectId));
+      return (proj?.name || `Project #${b.projectId}`).toLowerCase();
+    },
     amount: (b) => b.amount,
     createdAt: (b) => b.createdAt,
     status: (b) => getApprovalStatusBadge(b.status ?? ApprovalStatus.Approved).label,
@@ -665,8 +680,15 @@ export const GrantsPage: React.FC = () => {
     handleSort: handleDisbSort,
   } = useTableSort(filteredDisbursements, null, null, {
     id: (d) => d.id,
-    projectId: (d) => d.projectId,
-    milestoneId: (d) => d.milestoneId || 0,
+    projectId: (d) => {
+      const proj = projects.find((p) => String(p.id) === String(d.projectId));
+      return (proj?.name || `Project #${d.projectId}`).toLowerCase();
+    },
+    milestoneId: (d) => {
+      if (!d.milestoneId) return 'Advance Tranche';
+      const ms = milestones.find((m) => String(m.id) === String(d.milestoneId));
+      return (ms?.name || `Milestone #${d.milestoneId}`).toLowerCase();
+    },
     amount: (d) => d.amount,
     paymentReference: (d) => d.paymentReference || '',
     status: (d) => getApprovalStatusBadge(d.status).label,
@@ -826,8 +848,10 @@ export const GrantsPage: React.FC = () => {
             <div className="flex items-center gap-2 self-end sm:self-center">
               <button
                 type="button"
-                onClick={() => {
-                  refetchAwards();
+                onClick={async () => {
+                  bumpMutationEpoch();
+                  await queryClient.invalidateQueries({ queryKey: ['awards'] });
+                  await refetchAwards();
                   success('Refreshed', 'Awards intake list refreshed from API.');
                 }}
                 disabled={isFetchingAwards}
@@ -899,10 +923,28 @@ export const GrantsPage: React.FC = () => {
                             <span className="text-[10px] text-slate-500 font-mono">System ID: #{awd.id}</span>
                           </td>
                           <td className="py-3.5 px-4 text-slate-200 font-medium">
-                            {awd.organisationName || `Org #${awd.organisationId}`}
+                            {(() => {
+                              const org = organisations.find((o) => String(o.id) === String(awd.organisationId));
+                              const orgName = org?.name || awd.organisationName || (awd.organisationId ? `Organisation #${awd.organisationId}` : '—');
+                              return (
+                                <div>
+                                  <span className="text-white block font-medium">{orgName}</span>
+                                  {awd.organisationId && <span className="text-[10px] text-slate-500 font-mono">ID: #{awd.organisationId}</span>}
+                                </div>
+                              );
+                            })()}
                           </td>
                           <td className="py-3.5 px-4 text-slate-400">
-                            {awd.programmeName || `Programme #${awd.programmeId}`}
+                            {(() => {
+                              const prog = programmes.find((p) => String(p.id) === String(awd.programmeId));
+                              const progName = prog?.name || awd.programmeName || (awd.programmeId ? `Programme #${awd.programmeId}` : '—');
+                              return (
+                                <div>
+                                  <span className="text-slate-200 block">{progName}</span>
+                                  {awd.programmeId && <span className="text-[10px] text-slate-500 font-mono">Programme #{awd.programmeId}</span>}
+                                </div>
+                              );
+                            })()}
                           </td>
                           <td className="py-3.5 px-4 text-right font-mono font-bold text-white text-xs">
                             {formatZAR(awd.amount)}
@@ -919,10 +961,10 @@ export const GrantsPage: React.FC = () => {
                             {Number(awd.status) === ApprovalStatus.Approved ? (
                               <span
                                 className="inline-flex items-center gap-1 text-xs font-semibold text-emerald-400 bg-emerald-500/10 px-2.5 py-1.5 rounded-lg border border-emerald-500/20 cursor-default"
-                                title="Approved award is immutable. Details cannot be modified."
+                                title="Approved award details cannot be modified."
                               >
                                 <Lock className="w-3 h-3 text-emerald-400" />
-                                <span>Approved (Immutable)</span>
+                                <span>Approved</span>
                               </span>
                             ) : (
                               <button
@@ -973,8 +1015,10 @@ export const GrantsPage: React.FC = () => {
             <div className="flex items-center gap-2 self-end sm:self-center">
               <button
                 type="button"
-                onClick={() => {
-                  refetchBudgets();
+                onClick={async () => {
+                  bumpMutationEpoch();
+                  await queryClient.invalidateQueries({ queryKey: ['budgets'] });
+                  await refetchBudgets();
                   success('Refreshed', 'Budget line categories refreshed from API.');
                 }}
                 disabled={isFetchingBudgets}
@@ -1004,7 +1048,7 @@ export const GrantsPage: React.FC = () => {
                       Budget Line Category
                     </SortableTh>
                     <SortableTh column="projectId" currentColumn={budgetSortCol} direction={budgetSortDir} onSort={handleBudgetSort} className="py-3.5 px-4">
-                      Project ID
+                      Project
                     </SortableTh>
                     <SortableTh column="amount" currentColumn={budgetSortCol} direction={budgetSortDir} onSort={handleBudgetSort} align="right" className="py-3.5 px-4 text-right">
                       Approved Amount (ZAR)
@@ -1043,7 +1087,18 @@ export const GrantsPage: React.FC = () => {
                             <span className="font-semibold text-white block">{b.name}</span>
                             <span className="text-[10px] text-slate-500 font-mono">ID: #{b.id}</span>
                           </td>
-                          <td className="py-3.5 px-4 text-slate-400 font-mono">Project #{b.projectId}</td>
+                          <td className="py-3.5 px-4 text-slate-200">
+                            {(() => {
+                              const proj = projects.find((p) => String(p.id) === String(b.projectId));
+                              const projName = proj?.name || `Project #${b.projectId}`;
+                              return (
+                                <div>
+                                  <span className="font-medium text-white block">{projName}</span>
+                                  <span className="text-[10px] text-slate-500 font-mono">ID: #{b.projectId}</span>
+                                </div>
+                              );
+                            })()}
+                          </td>
                           <td className="py-3.5 px-4 text-right font-mono font-bold text-white">
                             {formatZAR(b.amount)}
                           </td>
@@ -1059,10 +1114,10 @@ export const GrantsPage: React.FC = () => {
                               {Number(b.status) === ApprovalStatus.Approved ? (
                                 <span
                                   className="inline-flex items-center gap-1 text-xs font-semibold text-emerald-400 bg-emerald-500/10 px-2.5 py-1.5 rounded-lg border border-emerald-500/20 cursor-default"
-                                  title="Approved budget is immutable. Status cannot be modified."
+                                  title="Approved budget status cannot be modified."
                                 >
                                   <Lock className="w-3 h-3 text-emerald-400" />
-                                  <span>Approved (Immutable)</span>
+                                  <span>Approved</span>
                                 </span>
                               ) : (
                                 <>
@@ -1133,8 +1188,10 @@ export const GrantsPage: React.FC = () => {
             <div className="flex items-center gap-2 self-end sm:self-center">
               <button
                 type="button"
-                onClick={() => {
-                  refetchDisbursements();
+                onClick={async () => {
+                  bumpMutationEpoch();
+                  await queryClient.invalidateQueries({ queryKey: ['disbursements'] });
+                  await refetchDisbursements();
                   success('Refreshed', 'Disbursement tranches refreshed from API.');
                 }}
                 disabled={isFetchingDisbursements}
@@ -1172,7 +1229,7 @@ export const GrantsPage: React.FC = () => {
                       Disbursement ID
                     </SortableTh>
                     <SortableTh column="projectId" currentColumn={disbSortCol} direction={disbSortDir} onSort={handleDisbSort} className="py-3.5 px-4">
-                      Project ID
+                      Project
                     </SortableTh>
                     <SortableTh column="milestoneId" currentColumn={disbSortCol} direction={disbSortDir} onSort={handleDisbSort} className="py-3.5 px-4">
                       Milestone Association
@@ -1211,9 +1268,32 @@ export const GrantsPage: React.FC = () => {
                           <td className="py-3.5 px-5 font-mono font-bold text-white">
                             DSB-{d.id}
                           </td>
-                          <td className="py-3.5 px-4 text-slate-300 font-mono">Project #{d.projectId}</td>
+                          <td className="py-3.5 px-4 text-slate-200">
+                            {(() => {
+                              const proj = projects.find((p) => String(p.id) === String(d.projectId));
+                              const projName = proj?.name || `Project #${d.projectId}`;
+                              return (
+                                <div>
+                                  <span className="font-medium text-white block">{projName}</span>
+                                  <span className="text-[10px] text-slate-500 font-mono">Project ID: #{d.projectId}</span>
+                                </div>
+                              );
+                            })()}
+                          </td>
                           <td className="py-3.5 px-4 text-slate-400 font-medium">
-                            {d.milestoneId ? `Milestone #${d.milestoneId}` : 'Initial Advance Tranche'}
+                            {(() => {
+                              if (!d.milestoneId) {
+                                return <span className="text-slate-400 italic">Initial Advance Tranche</span>;
+                              }
+                              const ms = milestones.find((m) => String(m.id) === String(d.milestoneId));
+                              const msName = ms?.name || `Milestone #${d.milestoneId}`;
+                              return (
+                                <div>
+                                  <span className="font-medium block">{msName}</span>
+                                  <span className="text-[10px] text-slate-500 font-mono">Milestone ID: #{d.milestoneId}</span>
+                                </div>
+                              );
+                            })()}
                           </td>
                           <td className="py-3.5 px-4 text-right font-mono font-bold text-white text-xs">
                             {formatZAR(d.amount)}
@@ -1549,7 +1629,14 @@ export const GrantsPage: React.FC = () => {
           onSubmit={editAwardForm.handleSubmit((values) => {
             if (!editingAward) return;
             if (Number(editingAward.status) === ApprovalStatus.Approved) {
-              toastError('Record Immutable', 'Approved awards cannot be modified.');
+              toastError('Record Approved', 'Approved awards cannot be modified.');
+              return;
+            }
+            if (
+              selectedAwardStatus === ApprovalStatus.Approved &&
+              !canApproveRecord('grant_financials', editingAward.createdBy)
+            ) {
+              toastError('Maker-Checker Violation', 'Record creators cannot approve their own award records.');
               return;
             }
             updateAwardMutation.mutate({
@@ -1630,7 +1717,7 @@ export const GrantsPage: React.FC = () => {
             {Number(editingAward?.status) === ApprovalStatus.Approved ? (
               <div className="w-full px-3 py-2 text-xs border border-emerald-500/30 bg-emerald-500/10 rounded-xl text-emerald-300 font-semibold flex items-center gap-1.5 cursor-default">
                 <Lock className="w-3.5 h-3.5 text-emerald-400" />
-                <span>Approved (Immutable - Cannot Be Changed)</span>
+                <span>Approved</span>
               </div>
             ) : (
               <select
@@ -1640,7 +1727,21 @@ export const GrantsPage: React.FC = () => {
               >
                 <option value={ApprovalStatus.Pending}>Pending Approval</option>
                 <option value={ApprovalStatus.Review}>Under Review</option>
-                <option value={ApprovalStatus.Approved}>Approved &amp; Activated</option>
+                {(() => {
+                  const canApproveAwd = canApproveRecord('grant_financials', editingAward?.createdBy);
+                  const isSelf = isMaker(editingAward?.createdBy);
+                  let reason = '';
+                  if (!canApprove('grant_financials')) {
+                    reason = ' (Requires Update Permission)';
+                  } else if (isSelf) {
+                    reason = ' (Maker-Checker: Cannot approve own record)';
+                  }
+                  return (
+                    <option value={ApprovalStatus.Approved} disabled={!canApproveAwd}>
+                      Approved &amp; Activated {reason}
+                    </option>
+                  );
+                })()}
                 <option value={ApprovalStatus.Rejected}>Rejected</option>
               </select>
             )}
@@ -1783,7 +1884,7 @@ export const GrantsPage: React.FC = () => {
             {Number(editingBudget?.status) === ApprovalStatus.Approved ? (
               <div className="w-full px-3 py-2 text-xs border border-emerald-500/30 bg-emerald-500/10 rounded-xl text-emerald-300 font-semibold flex items-center gap-1.5 cursor-default">
                 <Lock className="w-3.5 h-3.5 text-emerald-400" />
-                <span>Approved (Immutable - Status Cannot Be Changed)</span>
+                <span>Approved</span>
               </div>
             ) : (
               <select

PostFundManagement.ConsoleUI/src/pages/InboxPage.tsx

@@ -42,7 +42,6 @@ export const InboxPage: React.FC = () => {
   const { data: directoryUsers = [] } = useQuery<User[]>({
     queryKey: ['users-directory'],
     queryFn: () => getUsers(1, 200),
-    staleTime: 5 * 60 * 1000,
   });
 
   const {
@@ -149,7 +148,11 @@ export const InboxPage: React.FC = () => {
         }
       }
     } else if (!selectedMessage && folderMessages.length > 0 && activeFolder !== 'drafts') {
-      setSelectedMessage(folderMessages[0]);
+      const first = folderMessages[0];
+      setSelectedMessage(first);
+      if (activeFolder === 'inbox' && Number(first.status) !== NotificationStatus.Read) {
+        markAsRead(first.id);
+      }
     }
   }, [targetIdParam, folderMessages, activeFolder]);
 
@@ -666,6 +669,22 @@ export const InboxPage: React.FC = () => {
                         >
                           <Star className={`w-3.5 h-3.5 ${isStarred ? 'fill-amber-400' : ''}`} />
                         </button>
+
+                        <button
+                          type="button"
+                          onClick={e => {
+                            e.stopPropagation();
+                            deleteMessage(item.id);
+                            if (selectedMessage?.id === item.id) {
+                              setSelectedMessage(null);
+                            }
+                          }}
+                          className="p-0.5 rounded text-slate-400 hover:text-rose-400 transition cursor-pointer"
+                          title="Delete message (Archive)"
+                        >
+                          <Trash2 className="w-3.5 h-3.5" />
+                        </button>
+
                         <span className="text-[10px] text-slate-400 font-mono">
                           {formatDate(item.createdAt)}
                         </span>

PostFundManagement.ConsoleUI/src/pages/ProjectsPage.tsx

@@ -42,6 +42,7 @@ import {
   recordIndicatorActual,
   getBudgets,
   getActivities,
+  getDisbursements,
 } from '../services/api';
 import { Modal } from '../components/ui/Modal';
 import { HelpTooltip } from '../components/ui/HelpTooltip';
@@ -242,6 +243,11 @@ export const ProjectsPage: React.FC = () => {
     queryFn: () => getBudgets(1, 100),
   });
 
+  const { data: allDisbursements = [] } = useQuery({
+    queryKey: ['disbursements'],
+    queryFn: () => getDisbursements(1, 200),
+  });
+
   const { data: allProjectActivities = new Map<string | number, any[]>() } = useQuery({
     queryKey: ['allProjectActivities', projects.map((p) => p.id)],
     queryFn: async () => {
@@ -311,6 +317,18 @@ export const ProjectsPage: React.FC = () => {
     return map;
   }, [allBudgets]);
 
+  // Disbursed capital per project
+  const disbursedByProject = useMemo(() => {
+    const map = new Map<string | number, number>();
+    allDisbursements.forEach((d) => {
+      if (Number(d.status) === ApprovalStatus.Approved || Number(d.status) === 3) {
+        const current = map.get(d.projectId) || 0;
+        map.set(d.projectId, current + (Number(d.amount) || 0));
+      }
+    });
+    return map;
+  }, [allDisbursements]);
+
   // Filtered Projects
   const filteredProjects = useMemo(() => {
     return projects.filter((p) => {
@@ -380,9 +398,22 @@ export const ProjectsPage: React.FC = () => {
         return amt > 0 ? formatZAR(amt) : 'R 0';
       },
     },
+    {
+      header: 'Project Variance (ZAR)',
+      key: 'id',
+      format: (_, p) => {
+        const approvedBudget = approvedBudgetsByProject.get(p.id) || 0;
+        const pActs = allProjectActivities.get(p.id) || [];
+        const pActsTotal = pActs.reduce((sum, a) => sum + (Number(a.amount) || 0), 0);
+        const pDisbursedTotal = disbursedByProject.get(p.id) || 0;
+        const projectValue = pActsTotal - pDisbursedTotal;
+        const pVariance = approvedBudget - projectValue;
+        return `${pVariance >= 0 ? '+' : ''}${formatZAR(pVariance)}`;
+      },
+    },
     { header: 'Approval Status', key: 'status', format: (val) => getApprovalStatusBadge(val).label },
     { header: 'Created By', key: 'createdBy', format: (val) => getUserEmail(val) },
-  ], [programmeMap, milestonesByProject, approvedBudgetsByProject]);
+  ], [programmeMap, milestonesByProject, approvedBudgetsByProject, allProjectActivities, disbursedByProject]);
 
   // Table Sorting
   const customExtractors = {
@@ -404,6 +435,14 @@ export const ProjectsPage: React.FC = () => {
       if (risk.isAtRisk) return 2;
       return 3;
     },
+    variance: (p: Project) => {
+      const approvedBudget = approvedBudgetsByProject.get(p.id) || 0;
+      const pActs = allProjectActivities.get(p.id) || [];
+      const pActsTotal = pActs.reduce((sum, a) => sum + (Number(a.amount) || 0), 0);
+      const pDisbursedTotal = disbursedByProject.get(p.id) || 0;
+      const projectValue = pActsTotal - pDisbursedTotal;
+      return approvedBudget - projectValue;
+    },
   };
 
   const { sortedData: sortedProjects, sortColumn, sortDirection, handleSort } = useTableSort(
@@ -1007,17 +1046,17 @@ export const ProjectsPage: React.FC = () => {
                     />
                   </div>
                 </SortableTh>
-                <th className="py-3.5 px-4 text-right font-semibold whitespace-nowrap w-36">
+                <SortableTh column="variance" currentColumn={sortColumn} direction={sortDirection} onSort={handleSort} align="right" className="py-3.5 px-4 text-right whitespace-nowrap w-36">
                   <div className="flex items-center justify-end gap-1">
                     <span>Project Variance</span>
                     <HelpTooltip
                       title="Project Variance"
-                      content="Approved allocated budget minus scheduled milestone activity values. Positive (green) indicates within budget constraints; negative (red) indicates cost overrun."
+                      content="Approved allocated budget minus net project value (milestone activity commitments minus disbursements). Positive (green) indicates remaining budget headroom; negative (red) indicates cost overrun."
                       size="sm"
                       placement="bottom"
                     />
                   </div>
-                </th>
+                </SortableTh>
                 <th className="py-3.5 px-4 text-right font-semibold whitespace-nowrap w-56">Actions</th>
               </tr>
             </thead>
@@ -1212,7 +1251,9 @@ export const ProjectsPage: React.FC = () => {
                           const approvedBudget = approvedBudgetsByProject.get(p.id) || 0;
                           const pActs = allProjectActivities.get(p.id) || [];
                           const pActsTotal = pActs.reduce((sum, a) => sum + (Number(a.amount) || 0), 0);
-                          const pVariance = approvedBudget - pActsTotal;
+                          const pDisbursedTotal = disbursedByProject.get(p.id) || 0;
+                          const projectValue = pActsTotal - pDisbursedTotal;
+                          const pVariance = approvedBudget - projectValue;
                           const isPos = pVariance >= 0;
                           return (
                             <td className="py-3.5 px-4 text-right whitespace-nowrap w-36 font-mono font-bold" onClick={(e) => e.stopPropagation()}>
@@ -1222,7 +1263,7 @@ export const ProjectsPage: React.FC = () => {
                                     ? 'text-emerald-400 bg-emerald-500/10 border-emerald-500/30'
                                     : 'text-rose-400 bg-rose-500/10 border-rose-500/30'
                                 }`}
-                                title={`Approved Budget: ${formatZAR(approvedBudget)} | Milestone Activities: ${formatZAR(pActsTotal)} | Variance: ${isPos ? '+' : ''}${formatZAR(pVariance)}`}
+                                title={`Approved Budget: ${formatZAR(approvedBudget)} | Milestone Activities: ${formatZAR(pActsTotal)} | Disbursements: ${formatZAR(pDisbursedTotal)} | Project Value: ${formatZAR(projectValue)} | Variance: ${isPos ? '+' : ''}${formatZAR(pVariance)}`}
                               >
                                 {isPos ? `+${formatZAR(pVariance)}` : `-${formatZAR(Math.abs(pVariance))}`}
                               </span>

PostFundManagement.ConsoleUI/src/pages/SettingsPage.tsx

@@ -57,6 +57,7 @@ import {
   getOrganisations,
   getAwards,
   getContracts,
+  getProjects,
   getAuditLogs,
   getNotifications,
   notifyInviteApproved,
@@ -79,6 +80,8 @@ import {
   NotificationStatus,
   NotificationPlatform,
   ActivityStatus,
+  ApprovalStatus,
+  ContractStatus,
   User,
   Invite,
   InviteRequest,
@@ -110,7 +113,7 @@ export const SettingsPage: React.FC = () => {
 
   const [activeTab, setActiveTab] = useState<'users' | 'invites' | 'notifications' | 'audit'>('users');
 
-  const { canView, canAdd, canExport } = useRbac();
+  const { canView, canAdd, canExport, canApproveRecord, isMaker } = useRbac();
   const canViewUsers = canView('settings_users') || canView('tenant_self_service');
   const canViewInvites = canView('settings_invites');
   const canViewNotifications = canView('settings_notifications');
@@ -152,7 +155,6 @@ export const SettingsPage: React.FC = () => {
   const { data: usersDirectory = [] } = useQuery({
     queryKey: ['users-directory'],
     queryFn: () => getUsers(1, 200),
-    staleTime: 5 * 60 * 1000,
   });
 
   const {
@@ -241,6 +243,7 @@ export const SettingsPage: React.FC = () => {
   const [invitedOrgId, setInvitedOrgId] = useState<string | number>('');
   const [inviteAwardId, setInviteAwardId] = useState<string | number>('');
   const [inviteContractId, setInviteContractId] = useState<string | number>('');
+  const [inviteProjectId, setInviteProjectId] = useState<string | number>('');
   const [inviteRecipientUuid, setInviteRecipientUuid] = useState('');
   const [inviteMessage, setInviteMessage] = useState('');
   const [invitePlatform, setInvitePlatform] = useState<NotificationPlatform>(NotificationPlatform.Email);
@@ -253,6 +256,10 @@ export const SettingsPage: React.FC = () => {
   );
 
   const handleApproveInvite = async (inv: Invite, idx: number) => {
+    if (isMaker(inv.createdBy)) {
+      toastError('Maker-Checker Violation', 'You cannot approve an invitation that you created.');
+      return;
+    }
     const inviteKey = inv.id ? String(inv.id) : `inv_${idx}`;
     markInviteAsApprovedInStorage(inviteKey, currentTenantId);
     setApprovedInviteIds((prev) => (prev.includes(inviteKey) ? prev : [...prev, inviteKey]));
@@ -270,32 +277,6 @@ export const SettingsPage: React.FC = () => {
     );
   };
 
-  // Invites filtering & search
-  const [inviteSearchTerm, setInviteSearchTerm] = useState('');
-  const [invitePlatformFilter, setInvitePlatformFilter] = useState<'all' | number>('all');
-
-  const {
-    data: invitesList = [],
-    isLoading: loadingInvites,
-    isFetching: isFetchingInvites,
-    refetch: refetchInvites,
-  } = useQuery({
-    queryKey: ['invites'],
-    queryFn: () => getInvites(1, 100),
-  });
-
-  const filteredInvites = useMemo(() => {
-    return invitesList.filter((inv) => {
-      const matchSearch =
-        !inviteSearchTerm.trim() ||
-        (inv.recipient && inv.recipient.toLowerCase().includes(inviteSearchTerm.toLowerCase())) ||
-        (inv.message && inv.message.toLowerCase().includes(inviteSearchTerm.toLowerCase()));
-      const matchPlatform =
-        invitePlatformFilter === 'all' || Number(inv.platform) === Number(invitePlatformFilter);
-      return matchSearch && matchPlatform;
-    });
-  }, [invitesList, inviteSearchTerm, invitePlatformFilter]);
-
   const { data: organisations = [] } = useQuery({
     queryKey: ['organisations'],
     queryFn: () => getOrganisations(1, 50),
@@ -311,6 +292,104 @@ export const SettingsPage: React.FC = () => {
     queryFn: () => getContracts(1, 50),
   });
 
+  const { data: projects = [] } = useQuery({
+    queryKey: ['projects'],
+    queryFn: () => getProjects(1, 100),
+  });
+
+  // Only awards that are Approved AND have an Approved/Active contract are eligible for invitations
+  const eligibleAwards = useMemo(() => {
+    return awards.filter((aw) => {
+      const isApprovedAward = Number(aw.status) === ApprovalStatus.Approved;
+      if (!isApprovedAward) return false;
+      const hasApprovedContract = contracts.some(
+        (c) =>
+          String(c.awardId) === String(aw.id) &&
+          (Number(c.status) === ContractStatus.Active || Number(c.status) === ContractStatus.Executed)
+      );
+      return hasApprovedContract;
+    });
+  }, [awards, contracts]);
+
+  const handleSelectAward = (awardId: string | number) => {
+    setInviteAwardId(awardId);
+    const selected = eligibleAwards.find((a) => String(a.id) === String(awardId));
+    if (selected) {
+      setInvitedOrgId(selected.organisationId);
+      const matchingContract = contracts.find(
+        (c) =>
+          String(c.awardId) === String(selected.id) &&
+          (Number(c.status) === ContractStatus.Active || Number(c.status) === ContractStatus.Executed)
+      );
+      if (matchingContract) {
+        setInviteContractId(matchingContract.id);
+      }
+      setInviteProjectId(selected.projectId || '');
+    }
+  };
+
+  React.useEffect(() => {
+    if (isSendInviteModalOpen) {
+      if (eligibleAwards.length > 0) {
+        const currentAward =
+          eligibleAwards.find((a) => String(a.id) === String(inviteAwardId)) || eligibleAwards[0];
+        setInviteAwardId(currentAward.id);
+        setInvitedOrgId(currentAward.organisationId);
+        const matchingContract = contracts.find(
+          (c) =>
+            String(c.awardId) === String(currentAward.id) &&
+            (Number(c.status) === ContractStatus.Active || Number(c.status) === ContractStatus.Executed)
+        );
+        if (matchingContract) {
+          setInviteContractId(matchingContract.id);
+        }
+        setInviteProjectId(currentAward.projectId || '');
+      } else {
+        setInviteAwardId('');
+        setInvitedOrgId('');
+        setInviteContractId('');
+        setInviteProjectId('');
+      }
+    }
+  }, [isSendInviteModalOpen, eligibleAwards, contracts]);
+
+  // Invites filtering & search
+  const [inviteSearchTerm, setInviteSearchTerm] = useState('');
+  const [invitePlatformFilter, setInvitePlatformFilter] = useState<'all' | number>('all');
+
+  const {
+    data: invitesList = [],
+    isLoading: loadingInvites,
+    isFetching: isFetchingInvites,
+    refetch: refetchInvites,
+  } = useQuery({
+    queryKey: ['invites'],
+    queryFn: () => getInvites(1, 100),
+  });
+
+  const getStoredInvitePlatform = (inviteId?: string | number): NotificationPlatform | undefined => {
+    if (!inviteId) return undefined;
+    try {
+      const raw = localStorage.getItem(`pfm_invite_platform_${inviteId}`);
+      return raw !== null ? (Number(raw) as NotificationPlatform) : undefined;
+    } catch {
+      return undefined;
+    }
+  };
+
+  const storeInvitePlatform = (inviteId: string | number, platform: NotificationPlatform) => {
+    try {
+      localStorage.setItem(`pfm_invite_platform_${inviteId}`, String(platform));
+    } catch {}
+  };
+
+  const resolveUserEmail = (userIdOrUuid?: string | null): string => {
+    if (!userIdOrUuid) return '—';
+    const u = usersDirectory.find((usr) => String(usr.id).toLowerCase() === String(userIdOrUuid).toLowerCase());
+    const email = u?.email || getUserEmail(userIdOrUuid);
+    return email && email !== '—' ? email : String(userIdOrUuid);
+  };
+
   const sendInviteMutation = useMutation({
     mutationFn: (payload: InviteRequest) => sendInvite(payload),
     onSuccess: (data, variables) => {
@@ -320,8 +399,10 @@ export const SettingsPage: React.FC = () => {
       setInviteRecipientUuid('');
       setInviteMessage('');
 
+      const invId = (data as any)?.id ? String((data as any).id) : `inv_${Date.now()}`;
+      storeInvitePlatform(invId, variables.platform);
+
       if (inviteAutoApprove) {
-        const invId = (data as any)?.id ? String((data as any).id) : `inv_${Date.now()}`;
         markInviteAsApprovedInStorage(invId, currentTenantId);
         setApprovedInviteIds((prev) => (prev.includes(invId) ? prev : [...prev, invId]));
 
@@ -333,6 +414,7 @@ export const SettingsPage: React.FC = () => {
             organisationId: variables.organisationId,
             awardId: variables.awardId,
             contractId: variables.contractId,
+            projectId: variables.projectId,
             message: variables.message,
           },
         }).then(() => {
@@ -418,6 +500,38 @@ export const SettingsPage: React.FC = () => {
     handleSort: handleNotifSort,
   } = useTableSort(filteredNotifications, 'createdAt', 'desc');
 
+  const resolveInvitePlatform = (inv: Invite): NotificationPlatform => {
+    if (inv.platform !== undefined && inv.platform !== null) {
+      return Number(inv.platform) as NotificationPlatform;
+    }
+    const stored = getStoredInvitePlatform(inv.id);
+    if (stored !== undefined) return stored;
+
+    const linkedNotif = fetchedNotifications.find(
+      (n) =>
+        (inv.recipient && n.recipient?.toLowerCase() === inv.recipient?.toLowerCase()) ||
+        (inv.invitedOrganisationId && String(n.organisationId) === String(inv.invitedOrganisationId))
+    );
+    if (linkedNotif?.platform !== undefined && linkedNotif.platform !== null) {
+      return Number(linkedNotif.platform) as NotificationPlatform;
+    }
+    return NotificationPlatform.Email;
+  };
+
+  const filteredInvites = useMemo(() => {
+    return invitesList.filter((inv) => {
+      const recipientEmail = resolveUserEmail(inv.recipient).toLowerCase();
+      const matchSearch =
+        !inviteSearchTerm.trim() ||
+        (inv.recipient && inv.recipient.toLowerCase().includes(inviteSearchTerm.toLowerCase())) ||
+        recipientEmail.includes(inviteSearchTerm.toLowerCase());
+      const resolvedPlatform = resolveInvitePlatform(inv);
+      const matchPlatform =
+        invitePlatformFilter === 'all' || Number(resolvedPlatform) === Number(invitePlatformFilter);
+      return matchSearch && matchPlatform;
+    });
+  }, [invitesList, inviteSearchTerm, invitePlatformFilter, fetchedNotifications, usersDirectory]);
+
   // ==========================================
   // 4. Audit Log Ledger State
   // ==========================================
@@ -486,9 +600,22 @@ export const SettingsPage: React.FC = () => {
     {
       header: 'Changes / Arguments',
       key: 'changes',
-      format: (val) => (Array.isArray(val) ? val.join('; ') : val || '—'),
+      format: (val) => {
+        if (!val) return '—';
+        let str = Array.isArray(val) ? val.join('; ') : typeof val === 'object' ? JSON.stringify(val) : String(val);
+        str = str.replace(/\r\n|\r|\n/g, ' ').replace(/\s{2,}/g, ' ').trim();
+        return str.length > 250 ? `${str.slice(0, 247)}...` : str;
+      },
+    },
+    {
+      header: 'Error Details',
+      key: 'error',
+      format: (val) => {
+        if (!val) return '—';
+        let str = String(val).replace(/\r\n|\r|\n/g, ' ').replace(/\s{2,}/g, ' ').trim();
+        return str.length > 250 ? `${str.slice(0, 247)}...` : str;
+      },
     },
-    { header: 'Error Details', key: 'error', format: (val) => val || '—' },
   ];
 
   const uniqueAuditEntities = Array.from(
@@ -558,13 +685,25 @@ export const SettingsPage: React.FC = () => {
   ];
 
   const inviteExportColumns: ExportColumn<Invite>[] = [
-    { header: 'Recipient (UUID)', key: 'recipient' },
-    { header: 'Channel / Platform', key: 'platform', format: (val) => getNotificationPlatformLabel(val) },
-    { header: 'Invitation Message', key: 'message' },
+    {
+      header: 'Recipient Email',
+      key: 'recipient',
+      format: (val) => resolveUserEmail(val),
+    },
+    {
+      header: 'Channel / Platform',
+      key: 'platform',
+      format: (_val, inv) => getNotificationPlatformLabel(resolveInvitePlatform(inv)),
+    },
     {
       header: 'Target Organisation / Grant',
       key: 'invitedOrganisationId',
-      format: (val, inv) => `Org #${val || inv.organisationId || '—'} (Award #${inv.awardId || '—'})`,
+      format: (val, inv) => {
+        const orgId = val || inv.organisationId;
+        const org = organisations.find((o) => String(o.id) === String(orgId));
+        const orgName = org?.name || `Organisation #${orgId || '—'}`;
+        return `${orgName} • Award #${inv.awardId || '—'}`;
+      },
     },
     { header: 'Date Dispatched', key: 'createdAt', format: (val) => (val ? formatDate(val) : '—') },
   ];
@@ -590,7 +729,15 @@ export const SettingsPage: React.FC = () => {
     sortColumn: inviteSortCol,
     sortDirection: inviteSortDir,
     handleSort: handleInviteSort,
-  } = useTableSort(filteredInvites, 'createdAt', 'desc');
+  } = useTableSort(filteredInvites, 'createdAt', 'desc', {
+    recipient: (inv: Invite) => resolveUserEmail(inv.recipient),
+    platform: (inv: Invite) => getNotificationPlatformLabel(resolveInvitePlatform(inv)),
+    invitedOrganisationId: (inv: Invite) => {
+      const orgId = inv.invitedOrganisationId || inv.organisationId;
+      const org = organisations.find((o) => String(o.id) === String(orgId));
+      return org?.name || `Organisation #${orgId || ''}`;
+    },
+  });
 
   const getActionBadge = (action?: string | null) => {
     const act = (action || 'GENERAL_EVENT').toUpperCase();
@@ -1181,14 +1328,11 @@ export const SettingsPage: React.FC = () => {
                 <thead>
                   <tr className="bg-slate-900/60 border-b border-slate-800/80 text-slate-400 uppercase tracking-wider font-semibold">
                     <SortableTh column="recipient" currentColumn={inviteSortCol} direction={inviteSortDir} onSort={handleInviteSort} className="py-3.5 px-5">
-                      Recipient (UUID)
+                      Recipient Email
                     </SortableTh>
                     <SortableTh column="platform" currentColumn={inviteSortCol} direction={inviteSortDir} onSort={handleInviteSort} className="py-3.5 px-4">
                       Channel
                     </SortableTh>
-                    <SortableTh column="message" currentColumn={inviteSortCol} direction={inviteSortDir} onSort={handleInviteSort} className="py-3.5 px-4">
-                      Message
-                    </SortableTh>
                     <SortableTh column="invitedOrganisationId" currentColumn={inviteSortCol} direction={inviteSortDir} onSort={handleInviteSort} className="py-3.5 px-4">
                       Target Org / Grant
                     </SortableTh>
@@ -1206,13 +1350,13 @@ export const SettingsPage: React.FC = () => {
                 <tbody className="divide-y divide-slate-800/50">
                   {loadingInvites ? (
                     <tr>
-                      <td colSpan={7} className="py-8 text-center text-slate-500">
+                      <td colSpan={6} className="py-8 text-center text-slate-500">
                         Loading invitations ledger...
                       </td>
                     </tr>
                   ) : sortedInvites.length === 0 ? (
                     <tr>
-                      <td colSpan={7} className="py-8 text-center text-slate-500">
+                      <td colSpan={6} className="py-8 text-center text-slate-500">
                         No invitations recorded yet. Use &ldquo;Dispatch Invitation&rdquo; to send one.
                       </td>
                     </tr>
@@ -1222,22 +1366,34 @@ export const SettingsPage: React.FC = () => {
                         approvedInviteIds.includes(String(inv.id)) ||
                         approvedInviteIds.includes(`inv_${idx}`) ||
                         approvedInviteIds.includes(String(idx));
+                      const resolvedPlatform = resolveInvitePlatform(inv);
+                      const userEmail = resolveUserEmail(inv.recipient);
+                      const orgId = inv.invitedOrganisationId || inv.organisationId;
+                      const org = organisations.find((o) => String(o.id) === String(orgId));
+                      const orgName = org?.name || `Organisation #${orgId || '—'}`;
+                      const isCreator = isMaker(inv.createdBy);
 
                       return (
                         <tr key={idx} className="hover:bg-slate-800/40 transition-colors">
-                          <td className="py-3.5 px-5 font-mono text-slate-300 text-[11px]">
-                            {inv.recipient}
+                          <td className="py-3.5 px-5 text-slate-200 text-xs">
+                            <div className="font-medium text-white flex items-center gap-1.5">
+                              <Mail className="w-3.5 h-3.5 text-blue-400 shrink-0" />
+                              <span className="truncate">{userEmail}</span>
+                            </div>
+                            <div className="font-mono text-slate-500 text-[10px] truncate max-w-xs mt-0.5">
+                              {inv.recipient}
+                            </div>
                           </td>
                           <td className="py-3.5 px-4">
                             <span className="inline-flex items-center px-2 py-0.5 rounded text-[10px] font-semibold bg-blue-500/10 text-blue-400 border border-blue-500/20">
-                              {getNotificationPlatformLabel(inv.platform)}
+                              {getNotificationPlatformLabel(resolvedPlatform)}
                             </span>
                           </td>
-                          <td className="py-3.5 px-4 text-white font-medium max-w-xs truncate">
-                            {inv.message}
-                          </td>
-                          <td className="py-3.5 px-4 text-slate-400 text-[11px]">
-                            Org #{inv.invitedOrganisationId || inv.organisationId} &bull; Award #{inv.awardId}
+                          <td className="py-3.5 px-4 text-slate-300 text-xs">
+                            <div className="font-medium text-white">{orgName}</div>
+                            <div className="text-slate-400 text-[11px] mt-0.5">
+                              Award #{inv.awardId || '—'}
+                            </div>
                           </td>
                           <td className="py-3.5 px-4">
                             {isApproved ? (
@@ -1261,7 +1417,7 @@ export const SettingsPage: React.FC = () => {
                                 <Check className="w-3 h-3" />
                                 Partner Notified
                               </span>
-                            ) : (
+                            ) : canApproveRecord('settings_invites', inv.createdBy) ? (
                               <button
                                 type="button"
                                 onClick={() => handleApproveInvite(inv, idx)}
@@ -1271,6 +1427,17 @@ export const SettingsPage: React.FC = () => {
                                 <Check className="w-3 h-3" />
                                 <span>Approve</span>
                               </button>
+                            ) : isCreator ? (
+                              <span
+                                className="inline-flex items-center gap-1 px-2 py-0.5 rounded text-[10px] font-semibold bg-amber-500/10 text-amber-400 border border-amber-500/20"
+                                title="Maker-Checker: You created this invite and cannot approve it"
+                              >
+                                Maker (Creator)
+                              </span>
+                            ) : (
+                              <span className="text-[11px] text-slate-500">
+                                Pending Review
+                              </span>
                             )}
                           </td>
                         </tr>
@@ -2491,15 +2658,20 @@ export const SettingsPage: React.FC = () => {
         <form
           onSubmit={(e) => {
             e.preventDefault();
+            if (!inviteAwardId) {
+              toastError('Policy Violation', 'An approved award with an approved contract must be selected.');
+              return;
+            }
             if (!inviteRecipientUuid || !inviteMessage) {
-              toastError('Validation Error', 'Recipient UUID and message content are mandatory.');
+              toastError('Validation Error', 'Recipient identifier and message content are mandatory.');
               return;
             }
             sendInviteMutation.mutate({
               organisationId: inviteOrgId || (organisations[0]?.id ? Number(organisations[0].id) : 101),
               invitedOrganisationId: invitedOrgId || (organisations[1]?.id ? Number(organisations[1].id) : 102),
-              awardId: inviteAwardId || (awards[0]?.id ? Number(awards[0].id) : 301),
-              contractId: inviteContractId || (contracts[0]?.id ? Number(contracts[0].id) : 401),
+              awardId: inviteAwardId,
+              contractId: inviteContractId,
+              projectId: inviteProjectId || 0,
               recipient: inviteRecipientUuid,
               message: inviteMessage,
               platform: invitePlatform,
@@ -2507,18 +2679,51 @@ export const SettingsPage: React.FC = () => {
           }}
           className="space-y-4"
         >
-          <div>
-            <div className="flex items-center gap-1 mb-1.5">
-              <label className="block text-xs font-semibold text-slate-300">
-                Recipient User UUID *
-              </label>
-              <HelpTooltip
-                title="Recipient UUID"
-                content="Unique directory user identifier or email for targeted delivery."
-                size="sm"
-                placement="right"
-              />
+          {eligibleAwards.length === 0 ? (
+            <div className="p-3.5 rounded-xl bg-amber-500/10 border border-amber-500/30 text-amber-300 text-xs flex items-start gap-2.5">
+              <RotateCcw className="w-4 h-4 shrink-0 text-amber-400 mt-0.5" />
+              <div>
+                <span className="font-semibold block text-white">No Approved Awards Eligible for Invitation</span>
+                <span className="text-[11px] text-amber-300/90 leading-relaxed block mt-0.5">
+                  System governance policy strictly requires that invitations may only be dispatched for awards that have been formally <strong>Approved</strong> and whose associated contract is <strong>Approved &amp; Active</strong>.
+                </span>
+              </div>
             </div>
+          ) : null}
+
+          <div className="space-y-1.5">
+            <div className="flex items-center justify-between">
+              <div className="flex items-center gap-1">
+                <label className="block text-xs font-semibold text-slate-300">
+                  Recipient User *
+                </label>
+                <HelpTooltip
+                  title="Recipient Directory Identifier"
+                  content="Select a registered recipient user from directory or enter their unique user UUID."
+                  size="sm"
+                  placement="right"
+                />
+              </div>
+              {usersDirectory.length > 0 && (
+                <span className="text-[10px] text-slate-400">Quick-select from registered users</span>
+              )}
+            </div>
+            {usersDirectory.length > 0 && (
+              <select
+                value={usersDirectory.some((u) => String(u.id).toLowerCase() === inviteRecipientUuid.toLowerCase()) ? inviteRecipientUuid : ''}
+                onChange={(e) => {
+                  if (e.target.value) setInviteRecipientUuid(e.target.value);
+                }}
+                className="w-full px-3 py-2 text-xs bg-slate-900/80 border border-slate-700/80 rounded-xl text-white focus:outline-none focus:ring-2 focus:ring-blue-500/50 [&>option]:bg-slate-900 [&>option]:text-white mb-1"
+              >
+                <option value="">-- Choose from Registered Users --</option>
+                {usersDirectory.map((u) => (
+                  <option key={u.id} value={u.id}>
+                    {u.name ? `${u.name} — ` : ''}{u.email} ({u.id})
+                  </option>
+                ))}
+              </select>
+            )}
             <input
               type="text"
               value={inviteRecipientUuid}
@@ -2529,6 +2734,98 @@ export const SettingsPage: React.FC = () => {
             />
           </div>
 
+          <div className="grid grid-cols-2 gap-3">
+            <div>
+              <div className="flex items-center gap-1 mb-1.5">
+                <label className="block text-xs font-semibold text-slate-300">
+                  Approved Award *
+                </label>
+                <HelpTooltip
+                  title="Approved Award Required"
+                  content="Only awards with status Approved and an Active/Approved contract are eligible for invitations."
+                  size="sm"
+                  placement="top"
+                />
+              </div>
+              <select
+                value={inviteAwardId}
+                onChange={(e) => handleSelectAward(e.target.value)}
+                disabled={eligibleAwards.length === 0}
+                className="w-full px-3 py-2 text-xs bg-slate-900/80 border border-slate-700/80 rounded-xl text-white focus:outline-none focus:ring-2 focus:ring-blue-500/50 [&>option]:bg-slate-900 [&>option]:text-white disabled:opacity-50"
+                required
+              >
+                {eligibleAwards.length === 0 ? (
+                  <option value="">No approved awards available</option>
+                ) : (
+                  eligibleAwards.map((aw) => {
+                    const recipientOrg = organisations.find((o) => String(o.id) === String(aw.organisationId));
+                    return (
+                      <option key={aw.id} value={aw.id}>
+                        Award #{aw.id} — {recipientOrg?.name || `Org #${aw.organisationId}`}
+                      </option>
+                    );
+                  })
+                )}
+              </select>
+            </div>
+
+            <div>
+              <div className="flex items-center gap-1 mb-1.5">
+                <label className="block text-xs font-semibold text-slate-300">
+                  Approved Contract *
+                </label>
+                <HelpTooltip
+                  title="Associated Approved Contract"
+                  content="The active/approved contract linked to the selected award."
+                  size="sm"
+                  placement="top"
+                />
+              </div>
+              <input
+                type="text"
+                value={inviteContractId ? `Contract #${inviteContractId} (Approved & Active)` : 'No active contract'}
+                readOnly
+                className="w-full px-3 py-2 text-xs bg-slate-900/50 border border-slate-800 rounded-xl text-slate-300 font-mono focus:outline-none cursor-not-allowed"
+              />
+            </div>
+          </div>
+
+          <div className="grid grid-cols-2 gap-3">
+            <div>
+              <div className="flex items-center gap-1 mb-1.5">
+                <label className="block text-xs font-semibold text-slate-300">
+                  Target Organisation (Recipient Org)
+                </label>
+              </div>
+              <input
+                type="text"
+                value={(() => {
+                  const o = organisations.find((org) => String(org.id) === String(invitedOrgId));
+                  return o ? `${o.name} (#${o.id})` : invitedOrgId ? `Org #${invitedOrgId}` : '—';
+                })()}
+                readOnly
+                className="w-full px-3 py-2 text-xs bg-slate-900/50 border border-slate-800 rounded-xl text-slate-300 focus:outline-none cursor-not-allowed"
+              />
+            </div>
+
+            <div>
+              <div className="flex items-center gap-1 mb-1.5">
+                <label className="block text-xs font-semibold text-slate-300">
+                  Associated Project
+                </label>
+              </div>
+              <input
+                type="text"
+                value={(() => {
+                  const prj = projects.find((p) => String(p.id) === String(inviteProjectId));
+                  return prj ? `${prj.name || 'Project'} (#${prj.id})` : inviteProjectId ? `Project #${inviteProjectId}` : 'Initial Award Project';
+                })()}
+                readOnly
+                className="w-full px-3 py-2 text-xs bg-slate-900/50 border border-slate-800 rounded-xl text-slate-300 focus:outline-none cursor-not-allowed"
+              />
+            </div>
+          </div>
+
           <div className="grid grid-cols-2 gap-3">
             <div>
               <div className="flex items-center gap-1 mb-1.5">
@@ -2558,7 +2855,7 @@ export const SettingsPage: React.FC = () => {
             <div>
               <div className="flex items-center gap-1 mb-1.5">
                 <label className="block text-xs font-semibold text-slate-300">
-                  Originating Organisation
+                  Originating Authority
                 </label>
                 <HelpTooltip
                   title="Inviting Authority"
@@ -2581,58 +2878,6 @@ export const SettingsPage: React.FC = () => {
             </div>
           </div>
 
-          <div className="grid grid-cols-2 gap-3">
-            <div>
-              <div className="flex items-center gap-1 mb-1.5">
-                <label className="block text-xs font-semibold text-slate-300">
-                  Associated Award
-                </label>
-                <HelpTooltip
-                  title="Linked Grant Award"
-                  content="Optional award attachment to link recipient permissions directly to grant administration."
-                  size="sm"
-                  placement="top"
-                />
-              </div>
-              <select
-                value={inviteAwardId}
-                onChange={(e) => setInviteAwardId(e.target.value)}
-                className="w-full px-3 py-2 text-xs bg-slate-900/80 border border-slate-700/80 rounded-xl text-white focus:outline-none focus:ring-2 focus:ring-blue-500/50 [&>option]:bg-slate-900 [&>option]:text-white"
-              >
-                {awards.map((aw) => (
-                  <option key={aw.id} value={aw.id}>
-                    Award #{aw.id}
-                  </option>
-                ))}
-              </select>
-            </div>
-
-            <div>
-              <div className="flex items-center gap-1 mb-1.5">
-                <label className="block text-xs font-semibold text-slate-300">
-                  Associated Contract
-                </label>
-                <HelpTooltip
-                  title="Linked Contract"
-                  content="Optional bilateral agreement linking the recipient to contract execution."
-                  size="sm"
-                  placement="top"
-                />
-              </div>
-              <select
-                value={inviteContractId}
-                onChange={(e) => setInviteContractId(e.target.value)}
-                className="w-full px-3 py-2 text-xs bg-slate-900/80 border border-slate-700/80 rounded-xl text-white focus:outline-none focus:ring-2 focus:ring-blue-500/50 [&>option]:bg-slate-900 [&>option]:text-white"
-              >
-                {contracts.map((ctr) => (
-                  <option key={ctr.id} value={ctr.id}>
-                    Contract #{ctr.id}
-                  </option>
-                ))}
-              </select>
-            </div>
-          </div>
-
           <div>
             <div className="flex items-center gap-1 mb-1.5">
               <label className="block text-xs font-semibold text-slate-300">
@@ -2681,7 +2926,7 @@ export const SettingsPage: React.FC = () => {
             </button>
             <button
               type="submit"
-              disabled={sendInviteMutation.isPending}
+              disabled={sendInviteMutation.isPending || eligibleAwards.length === 0}
               className="px-4 py-2 text-xs font-semibold text-white bg-gradient-to-r from-blue-600 to-indigo-600 hover:from-blue-500 hover:to-indigo-500 rounded-xl shadow-lg shadow-blue-500/20 transition disabled:opacity-50"
             >
               {sendInviteMutation.isPending ? 'Sending...' : 'Send Invitation'}

PostFundManagement.ConsoleUI/src/pages/SiteVisitsPage.tsx

@@ -528,7 +528,7 @@ export const SiteVisitsPage: React.FC = () => {
                   title="Approved site visits are immutable."
                 >
                   <Lock className="w-3.5 h-3.5 text-emerald-400" />
-                  <span>Approved &amp; Verified (Immutable - Cannot Be Changed)</span>
+                  <span>Approved &amp; Verified</span>
                 </div>
               ) : (
                 <select

PostFundManagement.ConsoleUI/src/pages/TenantManagementPage.tsx

@@ -68,14 +68,12 @@ const TenantOrganisationsSubList: React.FC<{ tenantId: number | string; tenantNa
   } = useQuery<TenantOrganisation[]>({
     queryKey: ['tenant-organisations', tenantId],
     queryFn: () => getTenantOrganisations(tenantId),
-    staleTime: 30000,
   });
 
   // Fetch tenant users directory to resolve linked user email per organisation
   const { data: tenantUsers = [] } = useQuery<TenantUser[]>({
     queryKey: ['tenant-users', tenantId],
     queryFn: () => getTenantUsers(tenantId),
-    staleTime: 5 * 60 * 1000,
   });
 
   React.useEffect(() => {
@@ -261,7 +259,6 @@ const TenantUsersSubList: React.FC<{
   const { data: tenantUsers = [], isLoading, refetch } = useQuery<TenantUser[]>({
     queryKey: ['tenant-users', tenantId],
     queryFn: () => getTenantUsers(tenantId),
-    staleTime: 30000,
   });
 
   const { canAdd } = useRbac();
@@ -460,7 +457,6 @@ export const TenantManagementPage: React.FC = () => {
   } = useQuery<Tenant[]>({
     queryKey: ['tenants-list'],
     queryFn: () => getTenants(),
-    staleTime: 30000,
   });
 
   // Forms
@@ -962,6 +958,7 @@ export const TenantManagementPage: React.FC = () => {
         isOpen={isCreateModalOpen}
         onClose={() => setIsCreateModalOpen(false)}
         title="Provision New Tenant Partition"
+        subtitle="Define an isolated multi-tenant partition for grants, portfolios, and users."
         size="md"
       >
         <form
@@ -970,17 +967,6 @@ export const TenantManagementPage: React.FC = () => {
           )}
           className="space-y-4"
         >
-          <div className="p-3.5 rounded-xl bg-blue-950/20 border border-blue-800/30 text-xs text-blue-200 flex items-start gap-2.5">
-            <Info className="w-4 h-4 text-blue-400 shrink-0 mt-0.5" />
-            <div className="space-y-1 leading-relaxed">
-              <p className="font-semibold text-white">Multi-Tenant Partition Boundary</p>
-              <p>
-                Creating a new tenant defines an isolated partition boundary for grants, portfolios, projects, and users.
-                New tenants are automatically initialized in the Active state.
-              </p>
-            </div>
-          </div>
-
           <div>
             <label className="block text-xs font-semibold text-slate-300 mb-1.5">
               Tenant Organization Name <span className="text-rose-400">*</span>
@@ -1007,7 +993,7 @@ export const TenantManagementPage: React.FC = () => {
             <button
               type="submit"
               disabled={createMutation.isPending}
-              className="flex items-center gap-1.5 px-4 py-2 bg-gradient-to-r from-blue-600 to-indigo-600 hover:from-blue-500 hover:to-indigo-500 text-white text-xs font-semibold rounded-xl shadow-md transition disabled:opacity-50 cursor-pointer"
+              className="flex items-center gap-1.5 px-4 py-2 bg-blue-600 hover:bg-blue-500 text-white text-xs font-semibold rounded-xl shadow-md transition disabled:opacity-50 cursor-pointer"
             >
               {createMutation.isPending && <RefreshCw className="w-3.5 h-3.5 animate-spin" />}
               <span>{createMutation.isPending ? 'Provisioning...' : 'Create Tenant'}</span>
@@ -1021,6 +1007,7 @@ export const TenantManagementPage: React.FC = () => {
         isOpen={isUpdateModalOpen}
         onClose={() => setIsUpdateModalOpen(false)}
         title={`Update Tenant: ${selectedTenant?.name || ''}`}
+        subtitle="Modify tenant partition name and operational access status."
         size="md"
       >
         {selectedTenant && (
@@ -1064,13 +1051,12 @@ export const TenantManagementPage: React.FC = () => {
 
             {/* Warning when selecting Inactive or Disabled */}
             {Number(updateForm.watch('status')) !== ActivityStatus.Active && (
-              <div className="p-3 rounded-xl bg-amber-950/30 border border-amber-800/40 text-xs text-amber-200 flex items-start gap-2.5">
+              <div className="p-3 rounded-xl bg-amber-500/10 border border-amber-500/20 text-xs text-amber-200 flex items-start gap-2.5">
                 <AlertTriangle className="w-4 h-4 text-amber-400 shrink-0 mt-0.5" />
-                <div className="space-y-1">
-                  <p className="font-semibold text-white">Multitenancy Lockout Warning</p>
-                  <p className="text-[11px] leading-relaxed text-amber-300/90">
-                    Changing this tenant's status to Inactive or Disabled immediately locks out all users assigned to this partition.
-                    The backend API will deny requests until the tenant is restored to Active status.
+                <div className="space-y-0.5">
+                  <p className="font-semibold text-amber-300">Lockout Notice</p>
+                  <p className="text-[11px] text-amber-200/90 leading-relaxed">
+                    Setting this tenant to Inactive or Disabled immediately locks out assigned users from accessing the API.
                   </p>
                 </div>
               </div>
@@ -1087,7 +1073,7 @@ export const TenantManagementPage: React.FC = () => {
               <button
                 type="submit"
                 disabled={updateMutation.isPending}
-                className="flex items-center gap-1.5 px-4 py-2 bg-gradient-to-r from-blue-600 to-indigo-600 hover:from-blue-500 hover:to-indigo-500 text-white text-xs font-semibold rounded-xl shadow-md transition disabled:opacity-50 cursor-pointer"
+                className="flex items-center gap-1.5 px-4 py-2 bg-blue-600 hover:bg-blue-500 text-white text-xs font-semibold rounded-xl shadow-md transition disabled:opacity-50 cursor-pointer"
               >
                 {updateMutation.isPending && <RefreshCw className="w-3.5 h-3.5 animate-spin" />}
                 <span>{updateMutation.isPending ? 'Saving...' : 'Update Tenant'}</span>
@@ -1102,66 +1088,47 @@ export const TenantManagementPage: React.FC = () => {
         isOpen={isDetailModalOpen}
         onClose={() => setIsDetailModalOpen(false)}
         title={`Tenant Details: ${selectedTenant?.name || ''}`}
+        subtitle="Partition boundary information, creation audit, and operational status."
         size="lg"
       >
         {selectedTenant && (
-          <div className="space-y-5">
-            <div className="grid grid-cols-1 sm:grid-cols-2 gap-4 bg-slate-950/60 p-4 rounded-xl border border-slate-800">
+          <div className="space-y-4">
+            <div className="grid grid-cols-2 sm:grid-cols-3 gap-3 bg-slate-950/60 p-3.5 rounded-xl border border-slate-800 text-xs">
               <div>
-                <p className="text-[11px] text-slate-500 uppercase tracking-wider">Tenant Numeric ID</p>
+                <p className="text-[10px] text-slate-500 uppercase tracking-wider font-semibold">Tenant ID</p>
                 <p className="text-sm font-bold text-white mt-0.5">#{selectedTenant.id}</p>
               </div>
 
               <div>
-                <p className="text-[11px] text-slate-500 uppercase tracking-wider">Tenant Name</p>
-                <p className="text-sm font-semibold text-slate-200 mt-0.5">{selectedTenant.name || '—'}</p>
+                <p className="text-[10px] text-slate-500 uppercase tracking-wider font-semibold">Tenant Name</p>
+                <p className="text-xs font-semibold text-slate-200 mt-0.5 truncate">{selectedTenant.name || '—'}</p>
               </div>
 
               <div>
-                <p className="text-[11px] text-slate-500 uppercase tracking-wider">Operational Status</p>
+                <p className="text-[10px] text-slate-500 uppercase tracking-wider font-semibold">Operational Status</p>
                 <div className="mt-1">
                   <ActivityStatusBadge status={selectedTenant.status} />
                 </div>
               </div>
 
               <div>
-                <p className="text-[11px] text-slate-500 uppercase tracking-wider">Created Date</p>
+                <p className="text-[10px] text-slate-500 uppercase tracking-wider font-semibold">Created Date</p>
                 <p className="text-xs text-slate-300 mt-0.5">{formatDate(selectedTenant.createdAt)}</p>
               </div>
 
               <div>
-                <p className="text-[11px] text-slate-500 uppercase tracking-wider">Created By</p>
-                <p className="text-xs font-mono text-slate-300 mt-0.5">
+                <p className="text-[10px] text-slate-500 uppercase tracking-wider font-semibold">Created By</p>
+                <p className="text-xs font-mono text-slate-300 mt-0.5 truncate">
                   {getUserEmail(selectedTenant.createdBy) || selectedTenant.createdBy || 'System Admin'}
                 </p>
               </div>
 
               {selectedTenant.updatedAt && (
                 <div>
-                  <p className="text-[11px] text-slate-500 uppercase tracking-wider">Last Updated</p>
+                  <p className="text-[10px] text-slate-500 uppercase tracking-wider font-semibold">Last Updated</p>
                   <p className="text-xs text-slate-300 mt-0.5">{formatDate(selectedTenant.updatedAt)}</p>
                 </div>
               )}
-
-              {selectedTenant.updatedBy && (
-                <div>
-                  <p className="text-[11px] text-slate-500 uppercase tracking-wider">Updated By</p>
-                  <p className="text-xs font-mono text-slate-300 mt-0.5">
-                    {getUserEmail(selectedTenant.updatedBy) || selectedTenant.updatedBy}
-                  </p>
-                </div>
-              )}
-            </div>
-
-            <div className="p-3.5 rounded-xl bg-slate-900/80 border border-slate-800 text-xs text-slate-300 space-y-2">
-              <p className="font-semibold text-white flex items-center gap-1.5">
-                <ShieldCheck className="w-4 h-4 text-blue-400" />
-                Partition Scope &amp; Authentication
-              </p>
-              <p className="text-[11px] text-slate-400 leading-relaxed">
-                When users authenticate, their security token contains claims identifying their tenant partition.
-                The system automatically scopes data queries to this tenant and enforces operational lockout if the status is not Active.
-              </p>
             </div>
 
             <div className="flex items-center justify-end gap-2.5 pt-3 border-t border-slate-800">
@@ -1171,7 +1138,7 @@ export const TenantManagementPage: React.FC = () => {
                   setIsDetailModalOpen(false);
                   handleOpenUpdate(selectedTenant);
                 }}
-                className="flex items-center gap-1.5 px-4 py-2 bg-gradient-to-r from-blue-600 to-indigo-600 hover:from-blue-500 hover:to-indigo-500 text-white text-xs font-semibold rounded-xl transition cursor-pointer"
+                className="flex items-center gap-1.5 px-4 py-2 bg-blue-600 hover:bg-blue-500 text-white text-xs font-semibold rounded-xl transition cursor-pointer"
               >
                 <Edit2 className="w-3.5 h-3.5" />
                 <span>Edit Tenant Status</span>

PostFundManagement.ConsoleUI/src/services/api.ts

@@ -1,6 +1,6 @@
 import axios, { AxiosError } from 'axios';
 import { apiClient } from './httpClient';
-import { toolsService } from './toolsService';
+import { toolsService } from '../utils/hashids';
 import {
   notifyTenantManagersAndExecutivesOnRecordStatusChange,
   notifyInviteApproved,
@@ -259,7 +259,7 @@ export const updateOrganisation = async (payload: UpdateOrganisationRequest): Pr
     name: payload.name,
     registrationNo: payload.registrationNo,
     email: payload.email,
-    idNumber: payload.idNumber,
+    idNumber: payload.idNumber || null,
     organisationUser: payload.organisationUser,
     type: Number(payload.type),
     status: orgStatus,
@@ -442,84 +442,21 @@ export const getProgrammeValue = async (programmeId: string | number): Promise<n
   }
 };
 
-const LOCAL_INSTRUCTIONS_KEY = 'pfm_local_instructions';
+export const purgeStoredInstructionDuplicates = (_apiItems?: Instrument[]): void => {};
 
-export const purgeStoredInstructionDuplicates = (apiItems: Instrument[]): void => {
-  if (typeof window === 'undefined' || !Array.isArray(apiItems) || apiItems.length === 0) return;
-  try {
-    const raw = localStorage.getItem(LOCAL_INSTRUCTIONS_KEY);
-    if (!raw) return;
-    const local: Instrument[] = JSON.parse(raw);
-    if (!Array.isArray(local) || local.length === 0) return;
+export const getStoredInstructions = (): Instrument[] => [];
 
-    const apiIds = new Set(apiItems.map((i) => String(i.id)));
-    const apiKeys = new Set(apiItems.map((i) => `${i.programmeId}::${(i.name || '').toLowerCase().trim()}`));
-
-    const remaining = local.filter(
-      (l) => !apiIds.has(String(l.id)) && !apiKeys.has(`${l.programmeId}::${(l.name || '').toLowerCase().trim()}`)
-    );
-
-    if (remaining.length !== local.length) {
-      localStorage.setItem(LOCAL_INSTRUCTIONS_KEY, JSON.stringify(remaining));
-    }
-  } catch (e) {
-    console.warn('Failed to purge stored instruction duplicates', e);
-  }
-};
-
-export const getStoredInstructions = (): Instrument[] => {
-  if (typeof window === 'undefined') return [];
-  try {
-    const raw = localStorage.getItem(LOCAL_INSTRUCTIONS_KEY);
-    return raw ? JSON.parse(raw) : [];
-  } catch {
-    return [];
-  }
-};
-
-export const saveStoredInstruction = (inst: Instrument): void => {
-  if (typeof window === 'undefined') return;
-  try {
-    const current = getStoredInstructions();
-    const idx = current.findIndex(
-      (i) => String(i.id) === String(inst.id) ||
-        (String(i.programmeId) === String(inst.programmeId) && (i.name || '').trim().toLowerCase() === (inst.name || '').trim().toLowerCase())
-    );
-    if (idx >= 0) {
-      current[idx] = { ...current[idx], ...inst, updatedAt: new Date().toISOString() };
-    } else {
-      current.unshift(inst);
-    }
-    localStorage.setItem(LOCAL_INSTRUCTIONS_KEY, JSON.stringify(current));
-  } catch (e) {
-    console.warn('Failed to save stored instruction', e);
-  }
-};
+export const saveStoredInstruction = (_inst?: Instrument): void => {};
 
 export const getInstruments = async (programmeId: string | number): Promise<Instrument[]> => {
-  let apiItems: Instrument[] = [];
-  let apiSucceeded = false;
   try {
     const hashedProgId = await toolsService.resolveProgrammeId(programmeId);
     const res = await apiClient.get<Instrument[]>(`/v1/api/governance/instruments/${hashedProgId}`);
-    if (Array.isArray(res.data)) {
-      apiItems = res.data;
-      apiSucceeded = true;
-    }
+    return Array.isArray(res.data) ? res.data : [];
   } catch (err) {
     console.warn(`[getInstruments] Could not fetch instruments from API for prog ${programmeId}:`, err);
+    return [];
   }
-
-  if (apiSucceeded) {
-    purgeStoredInstructionDuplicates(apiItems);
-    return apiItems;
-  }
-
-  // Fallback to local items only when API failed
-  const localItems = getStoredInstructions().filter(
-    (item) => String(item.programmeId) === String(programmeId)
-  );
-  return localItems;
 };
 
 export const getInstructions = getInstruments;
@@ -535,27 +472,17 @@ export const getAllInstruments = async (programmesList?: Programme[]): Promise<I
   }
 
   const map = new Map<string, Instrument>();
-  let hasApiData = false;
-
   if (progList && progList.length > 0) {
     const results = await Promise.allSettled(
       progList.map((pr) => getInstruments(pr.id))
     );
     results.forEach((res) => {
-      if (res.status === 'fulfilled' && Array.isArray(res.value) && res.value.length > 0) {
-        hasApiData = true;
+      if (res.status === 'fulfilled' && Array.isArray(res.value)) {
         res.value.forEach((inst) => map.set(String(inst.id), inst));
       }
     });
   }
-
-  if (hasApiData || map.size > 0) {
-    const allApiInstruments = Array.from(map.values());
-    purgeStoredInstructionDuplicates(allApiInstruments);
-    return allApiInstruments;
-  }
-
-  return getStoredInstructions();
+  return Array.from(map.values());
 };
 
 export const getAllInstructions = getAllInstruments;
@@ -569,40 +496,8 @@ export const createInstrument = async (payload: CreateInstrumentRequest): Promis
     description: payload.description,
   };
 
-  try {
-    const res = await apiClient.post<Instrument>('/v1/api/governance/instruments', body);
-    if (res.data && res.data.id) {
-      purgeStoredInstructionDuplicates([res.data]);
-      return res.data;
-    }
-  } catch (err: any) {
-    console.warn('[createInstrument] API create failed, falling back to local storage:', err);
-    const newId = Date.now();
-    const fallbackInstruction: Instrument = {
-      id: newId,
-      programmeId: toIntegerId(payload.programmeId),
-      code: code,
-      name: payload.name,
-      description: payload.description,
-      status: payload.status !== undefined ? Number(payload.status) : ActivityStatus.Active,
-      createdBy: payload.userId || 'system',
-      createdAt: new Date().toISOString(),
-    };
-    saveStoredInstruction(fallbackInstruction);
-    return fallbackInstruction;
-  }
-
-  // If API returned 200 without full body, return formatted item without saving duplicate to localStorage
-  return {
-    id: Date.now(),
-    programmeId: toIntegerId(payload.programmeId),
-    code: code,
-    name: payload.name,
-    description: payload.description,
-    status: payload.status !== undefined ? Number(payload.status) : ActivityStatus.Active,
-    createdBy: payload.userId || 'system',
-    createdAt: new Date().toISOString(),
-  };
+  const res = await apiClient.post<Instrument>('/v1/api/governance/instruments', body);
+  return res.data;
 };
 
 export const createInstruction = createInstrument;
@@ -619,32 +514,7 @@ export const updateInstrument = async (payload: UpdateInstrumentRequest): Promis
     status: Number(payload.status),
   };
 
-  try {
-    const res = await apiClient.put<Instrument>('/v1/api/governance/instruments', body);
-    if (res.data && res.data.id) {
-      return res.data;
-    }
-  } catch (err) {
-    console.warn('[updateInstrument] API update failed:', err);
-  }
-
-  const existing = getStoredInstructions().find((i) => String(i.id) === String(targetId));
-  const updatedInstrument: Instrument = {
-    id: targetId!,
-    programmeId: payload.programmeId ? toIntegerId(payload.programmeId) : (existing?.programmeId || 0),
-    code: payload.code || existing?.code || null,
-    name: payload.name,
-    description: payload.description,
-    status: Number(payload.status),
-    createdBy: existing?.createdBy || 'system',
-    createdAt: existing?.createdAt || new Date().toISOString(),
-    updatedBy: payload.userId || 'system',
-    updatedAt: new Date().toISOString(),
-  };
-
-  if (existing) {
-    saveStoredInstruction(updatedInstrument);
-  }
+  const res = await apiClient.put<Instrument>('/v1/api/governance/instruments', body);
   if (isApprovedOrActiveStatus(payload.status)) {
     notifyTenantManagersAndExecutivesOnRecordStatusChange({
       recordType: 'Funding Instrument',
@@ -653,7 +523,7 @@ export const updateInstrument = async (payload: UpdateInstrumentRequest): Promis
       title: payload.name,
     }).catch(console.warn);
   }
-  return updatedInstrument;
+  return res.data;
 };
 
 export const updateInstruction = updateInstrument;
@@ -1359,13 +1229,13 @@ export const getMilestoneEvidence = async (milestoneId: string | number): Promis
 export const getProjectEvidence = async (projectId: string | number): Promise<Evidence[]> => {
   try {
     const hashedProjectId = await toolsService.resolveProjectId(projectId);
-    const res = await apiClient.get<Evidence[]>(`/v1/api/evidence/${hashedProjectId}`);
+    const res = await apiClient.get<Evidence[]>(`/v1/api/evidence/projects/${hashedProjectId}`);
     return res.data || [];
   } catch (err: any) {
     // If hashed path parameter returns 404 or 400 and projectId differs, attempt with raw ID
     if ((err?.response?.status === 404 || err?.response?.status === 400) && String(projectId) !== '') {
       try {
-        const rawRes = await apiClient.get<Evidence[]>(`/v1/api/evidence/${projectId}`);
+        const rawRes = await apiClient.get<Evidence[]>(`/v1/api/evidence/projects/${projectId}`);
         return rawRes.data || [];
       } catch (fallbackErr: any) {
         if (fallbackErr?.response?.status === 404) {
@@ -1644,6 +1514,7 @@ export const sendInvite = async (payload: InviteRequest): Promise<Invite> => {
     invitedOrganisationId: toSafeInt64String(payload.invitedOrganisationId),
     awardId: toSafeInt64String(payload.awardId),
     contractId: toSafeInt64String(payload.contractId),
+    projectId: toSafeInt64String(payload.projectId || 0),
     recipient: payload.recipient,
     message: payload.message,
     platform: payload.platform !== undefined ? Number(payload.platform) : 1,
@@ -1731,7 +1602,9 @@ export const createNotification = async (payload: CreateNotificationRequest): Pr
     subject: payload.subject || null,
     destination: payload.destination || 'In-App User Inbox',
     message: payload.message,
-    status: payload.status !== undefined ? payload.status : undefined,
+    status: payload.status !== undefined
+      ? payload.status
+      : (Number(payload.platform) === NotificationPlatform.InApp ? NotificationStatus.Delivered : undefined),
   });
 };
 
@@ -1753,6 +1626,13 @@ export const markNotificationAsRead = async (notificationId: number | string): P
 };
 
 // ==========================================
+export const archiveNotification = async (notificationId: number | string): Promise<void> => {
+  await updateNotification({
+    notificationId: toIntegerId(notificationId),
+    status: NotificationStatus.Archived,
+  });
+};
+
 // 9. Governance: Tenants APIs
 // ==========================================
 export const getTenants = async (): Promise<Tenant[]> => {
@@ -2246,75 +2126,20 @@ export const updateSiteVisit = async (payload: UpdateSiteVisitRequest): Promise<
   }
 };
 
-const LOCAL_RULES_KEY = 'pfm_local_rules';
+export const purgeStoredRuleDuplicates = (_apiRules?: Rule[]): void => {};
 
-export const purgeStoredRuleDuplicates = (apiRules: Rule[]): void => {
-  if (typeof window === 'undefined' || !Array.isArray(apiRules) || apiRules.length === 0) return;
-  try {
-    const raw = localStorage.getItem(LOCAL_RULES_KEY);
-    if (!raw) return;
-    const local: Rule[] = JSON.parse(raw);
-    if (!Array.isArray(local) || local.length === 0) return;
+export const getStoredRules = (): Rule[] => [];
 
-    const apiIds = new Set(apiRules.map((r) => String(r.id)));
-    const apiKeys = new Set(apiRules.map((r) => `${r.programmeId}::${(r.name || '').toLowerCase().trim()}`));
-
-    const remaining = local.filter(
-      (l) => !apiIds.has(String(l.id)) && !apiKeys.has(`${l.programmeId}::${(l.name || '').toLowerCase().trim()}`)
-    );
-
-    if (remaining.length !== local.length) {
-      localStorage.setItem(LOCAL_RULES_KEY, JSON.stringify(remaining));
-    }
-  } catch (e) {
-    console.warn('Failed to purge stored rule duplicates', e);
-  }
-};
-
-export const getStoredRules = (): Rule[] => {
-  if (typeof window === 'undefined') return [];
-  try {
-    const raw = localStorage.getItem(LOCAL_RULES_KEY);
-    return raw ? JSON.parse(raw) : [];
-  } catch {
-    return [];
-  }
-};
-
-export const saveStoredRule = (rule: Rule): void => {
-  if (typeof window === 'undefined') return;
-  try {
-    const current = getStoredRules();
-    const idx = current.findIndex(
-      (r) => String(r.id) === String(rule.id) ||
-        (String(r.programmeId) === String(rule.programmeId) && (r.name || '').trim().toLowerCase() === (rule.name || '').trim().toLowerCase())
-    );
-    if (idx >= 0) {
-      current[idx] = { ...current[idx], ...rule, updatedAt: new Date().toISOString() };
-    } else {
-      current.unshift(rule);
-    }
-    localStorage.setItem(LOCAL_RULES_KEY, JSON.stringify(current));
-  } catch (e) {
-    console.warn('Failed to save stored rule', e);
-  }
-};
+export const saveStoredRule = (_rule?: Rule): void => {};
 
 // ==========================================
 // 15. Execution: Programme Rules APIs
 // ==========================================
 export const getRule = async (ruleId: string | number): Promise<Rule> => {
-  try {
-    const hashedRuleId = await toolsService.encodeId(ruleId);
-    const res = await apiClient.get<Rule>(`/v1/api/execution/rules/${hashedRuleId}`);
-    if (res.data) {
-      purgeStoredRuleDuplicates([res.data]);
-      return res.data;
-    }
-  } catch {
-    const localRule = getStoredRules().find((r) => String(r.id) === String(ruleId));
-    if (localRule) return localRule;
-    throw new Error('Rule not found');
+  const hashedRuleId = await toolsService.encodeId(ruleId);
+  const res = await apiClient.get<Rule>(`/v1/api/execution/rules/${hashedRuleId}`);
+  if (res.data) {
+    return res.data;
   }
   throw new Error('Rule not found');
 };
@@ -2332,38 +2157,16 @@ export const getRules = async (
   pagination: Pagination = { page: 1, pageSize: 100 },
   programmeId?: string | number
 ): Promise<Rule[]> => {
-  let apiRules: Rule[] = [];
-  let apiSucceeded = false;
-  try {
-    const res = await apiClient.post<Rule[]>('/v1/api/execution/programmes/rules', {
-      index: pagination.index ? toIntegerId(pagination.index) : 0,
-      page: pagination.page || 1,
-      pageSize: pagination.pageSize || 100,
-    });
-    if (Array.isArray(res.data)) {
-      apiRules = res.data;
-      apiSucceeded = true;
-    }
-  } catch (err) {
-    console.warn('[getRules] Error fetching from backend API:', err);
-  }
-
-  if (apiSucceeded) {
-    purgeStoredRuleDuplicates(apiRules);
-    let result = apiRules;
-    if (programmeId != null && programmeId !== '' && programmeId !== 'all') {
-      result = result.filter((r) => String(r.programmeId) === String(programmeId));
-    }
-    return result;
-  }
-
-  // Fallback to local storage only if API call failed
-  const localRules = getStoredRules();
-  let combined = localRules;
+  const res = await apiClient.post<Rule[]>('/v1/api/execution/programmes/rules', {
+    index: pagination.index ? toIntegerId(pagination.index) : 0,
+    page: pagination.page || 1,
+    pageSize: pagination.pageSize || 100,
+  });
+  let result = Array.isArray(res.data) ? res.data : [];
   if (programmeId != null && programmeId !== '' && programmeId !== 'all') {
-    combined = combined.filter((r) => String(r.programmeId) === String(programmeId));
+    result = result.filter((r) => String(r.programmeId) === String(programmeId));
   }
-  return combined;
+  return result;
 };
 
 export const createRule = async (payload: CreateRuleRequest): Promise<Rule> => {
@@ -2375,70 +2178,21 @@ export const createRule = async (payload: CreateRuleRequest): Promise<Rule> => {
     description: payload.description,
   };
 
-  try {
-    const res = await apiClient.post<Rule>('/v1/api/execution/rules', body);
-    if (res.data && res.data.id) {
-      purgeStoredRuleDuplicates([res.data]);
-      return res.data;
-    }
-  } catch (err) {
-    console.warn('[createRule] API create failed, falling back to local storage:', err);
-    const newId = Date.now();
-    const fallbackRule: Rule = {
-      id: newId,
-      programmeId: toIntegerId(payload.programmeId),
-      name: payload.name,
-      description: payload.description,
-      status: ActivityStatus.Active,
-      version: 1,
-      createdBy: validUserId,
-      createdAt: new Date().toISOString(),
-    };
-    saveStoredRule(fallbackRule);
-    return fallbackRule;
-  }
-
-  return {
-    id: Date.now(),
-    programmeId: toIntegerId(payload.programmeId),
-    name: payload.name,
-    description: payload.description,
-    status: ActivityStatus.Active,
-    version: 1,
-    createdBy: validUserId,
-    createdAt: new Date().toISOString(),
-  };
+  const res = await apiClient.post<Rule>('/v1/api/execution/rules', body);
+  return res.data;
 };
 
 export const updateRule = async (payload: UpdateRuleRequest): Promise<void> => {
   const validUserId = toValidUuid(payload.userId);
-  try {
-    await apiClient.put('/v1/api/execution/rules', {
-      ruleId: toIntegerId(payload.ruleId),
-      userId: validUserId,
-      name: payload.name,
-      description: payload.description,
-      status: Number(payload.status),
-      version: Number(payload.version || 1),
-      ...(payload.programmeId ? { programmeId: toIntegerId(payload.programmeId) } : {}),
-    });
-  } catch (err) {
-    console.warn('[updateRule] API update failed:', err);
-    const existing = getStoredRules().find((r) => String(r.id) === String(payload.ruleId));
-    const updatedRule: Rule = {
-      id: payload.ruleId,
-      programmeId: payload.programmeId ? toIntegerId(payload.programmeId) : (existing?.programmeId || 0),
-      name: payload.name,
-      description: payload.description,
-      status: Number(payload.status),
-      version: Number(payload.version || 1),
-      createdBy: existing?.createdBy || validUserId,
-      createdAt: existing?.createdAt || new Date().toISOString(),
-      updatedBy: validUserId,
-      updatedAt: new Date().toISOString(),
-    };
-    saveStoredRule(updatedRule);
-  }
+  await apiClient.put('/v1/api/execution/rules', {
+    ruleId: toIntegerId(payload.ruleId),
+    userId: validUserId,
+    name: payload.name,
+    description: payload.description,
+    status: Number(payload.status),
+    version: Number(payload.version || 1),
+    ...(payload.programmeId ? { programmeId: toIntegerId(payload.programmeId) } : {}),
+  });
 };
 
 // ==========================================

PostFundManagement.ConsoleUI/src/services/httpClient.ts

@@ -60,6 +60,8 @@ export const apiClient = axios.create({
   headers: {
     'Content-Type': 'application/json; version=1',
     Accept: 'application/json; version=1',
+    'Cache-Control': 'no-cache, no-store, must-revalidate',
+    Pragma: 'no-cache',
   },
   timeout: 15000,
 });
@@ -81,34 +83,16 @@ apiClient.interceptors.request.use(
       config.url?.includes('amazonaws.com') ||
       config.url?.includes('garage');
 
-    // Attach mutation epoch or explicit timestamp to GET requests for OutputCache management
+    // Always attach freshness timestamp and mutation epoch to internal GET requests
+    // to guarantee zero stale data, bypass browser HTTP caches, and prevent stale OutputCache hits
     if (config.method?.toUpperCase() === 'GET' && !isExternal) {
-      const headers = config.headers || {};
-      const hasNoCacheHeader =
-        headers['Cache-Control'] === 'no-cache' ||
-        headers['cache-control'] === 'no-cache' ||
-        headers['Pragma'] === 'no-cache';
-
-      if (hasNoCacheHeader) {
-        // Explicit freshness requested: attach fresh timestamp
-        if (config.params instanceof URLSearchParams) {
-          config.params.set('_t', String(Date.now()));
-        } else {
-          config.params = config.params || {};
-          config.params._t = Date.now();
-        }
+      if (config.params instanceof URLSearchParams) {
+        config.params.set('_t', String(Date.now()));
+        config.params.set('_v', String(getMutationEpoch()));
       } else {
-        // Standard GET: attach current mutation epoch
-        if (config.params instanceof URLSearchParams) {
-          if (!config.params.has('_v') && !config.params.has('_t')) {
-            config.params.set('_v', String(getMutationEpoch()));
-          }
-        } else {
-          config.params = config.params || {};
-          if (!config.params._v && !config.params._t) {
-            config.params._v = getMutationEpoch();
-          }
-        }
+        config.params = config.params || {};
+        config.params._t = Date.now();
+        config.params._v = getMutationEpoch();
       }
     }
 

PostFundManagement.ConsoleUI/src/services/tenantLockoutService.ts

@@ -1,6 +1,7 @@
-import { getTenant } from './api';
+import { getTenant, getTenants } from './api';
 import { ActivityStatus, Tenant } from '../types';
 import { setActivationPending } from './userSyncService';
+import { encodeHashIdSync, isAlreadyHashId } from '../utils/hashids';
 
 export interface TenantLockoutResult {
   isActive: boolean;
@@ -9,21 +10,10 @@ export interface TenantLockoutResult {
   statusCode?: number;
 }
 
-// In-memory cache for fast tenant status checks (avoids repeated API round trips during navigations)
-let cachedTenantLockout: {
-  key: string;
-  result: TenantLockoutResult;
-  timestamp: number;
-} | null = null;
-const LOCKOUT_CACHE_TTL_MS = 60 * 1000; // 60 seconds
-
 export function clearTenantLockoutCache(): void {
-  cachedTenantLockout = null;
+  // Caching removed to guarantee fresh tenant state on every verification
 }
 
-/**
- * Checks whether a given status value corresponds to ActivityStatus.Active (1)
- */
 export function isStatusActive(status: any): boolean {
   if (status === undefined || status === null || status === '') {
     return false;
@@ -40,9 +30,6 @@ export function isStatusActive(status: any): boolean {
   return false;
 }
 
-/**
- * Formats a human-readable status label from numeric or string status
- */
 export function getStatusLabel(status: any): string {
   if (status === ActivityStatus.Active || status === 1 || String(status).toLowerCase() === 'active') {
     return 'Active';
@@ -65,76 +52,110 @@ export function getStatusLabel(status: any): string {
   return 'Not Specified';
 }
 
-/**
- * Calls the GetTenant endpoint for the provided tenant identifier.
- *
- * Rules:
- * - If nothing is returned (empty response, 404, or failure) OR
- * - There is a response object and its Status is not Active
- * Then lockout is triggered and the existing lockout modal is shown.
- */
+function isValidHashableOrHashedTenantId(val: unknown): val is number | string {
+  if (val === undefined || val === null || val === '') return false;
+  if (typeof val === 'number') {
+    return !isNaN(val) && isFinite(val) && val > 0;
+  }
+  if (typeof val === 'string') {
+    const trimmed = val.trim();
+    if (!trimmed) return false;
+    if (/^\d+$/.test(trimmed)) {
+      return parseInt(trimmed, 10) > 0;
+    }
+    return isAlreadyHashId(trimmed);
+  }
+  return false;
+}
+
 export async function verifyTenantLockout(
   tenantId?: number | string | null,
   tenantClaim?: string | null,
   forceRefresh = false
 ): Promise<TenantLockoutResult> {
-  const primaryId =
-    tenantId !== undefined && tenantId !== null && tenantId !== ''
-      ? tenantId
-      : tenantClaim !== undefined && tenantClaim !== null && tenantClaim !== ''
-      ? tenantClaim
-      : null;
-
-  if (primaryId === null || primaryId === undefined || primaryId === '') {
-    const errorMsg =
-      'Tenant identification claims (tenant / tenant_id) not found in credentials. Access is restricted.';
-    setActivationPending(true, errorMsg);
-    return {
-      isActive: false,
-      tenant: null,
-      errorMessage: errorMsg,
-    };
+  // Resolve a valid numeric ID or HashId to avoid passing plain-text tenant names to /v1/api/governance/tenants/{id}
+  let candidateId: number | string | null = null;
+  if (isValidHashableOrHashedTenantId(tenantId)) {
+    candidateId = tenantId;
+  } else if (isValidHashableOrHashedTenantId(tenantClaim)) {
+    candidateId = tenantClaim;
   }
 
-  const cacheKey = String(primaryId).trim().toLowerCase();
-  if (!forceRefresh && cachedTenantLockout && cachedTenantLockout.key === cacheKey) {
-    if (
-      cachedTenantLockout.result.isActive &&
-      Date.now() - cachedTenantLockout.timestamp < LOCKOUT_CACHE_TTL_MS
-    ) {
-      return cachedTenantLockout.result;
-    }
-  }
+  // Fresh check: query endpoint directly without cache
 
   let tenantRes: Tenant | null = null;
   let lastError: any = null;
 
-  try {
-    tenantRes = await getTenant(primaryId);
-  } catch (err: any) {
-    lastError = err;
-    tenantRes = null;
-  }
-
-  // If primary identifier returned nothing, and tenantClaim provides a different candidate, attempt fallback
-  if (!tenantRes && tenantClaim && String(tenantClaim) !== String(primaryId)) {
+  // 1. If we have a valid numeric tenantId or HashId, encode it via HashIds and call GET /v1/api/governance/tenants/{hashedId}
+  if (candidateId !== null) {
     try {
-      tenantRes = await getTenant(tenantClaim);
-      lastError = null;
+      const hashedId = encodeHashIdSync(candidateId);
+      tenantRes = await getTenant(hashedId || candidateId);
     } catch (err: any) {
       lastError = err;
       tenantRes = null;
     }
   }
 
-  // Condition 1: If nothing is returned
+  // 2. If tenant lookup by ID wasn't possible or didn't resolve, resolve via getTenants() (matching tenantClaim name if provided)
+  if (!tenantRes) {
+    try {
+      const allTenants = await getTenants();
+      if (Array.isArray(allTenants) && allTenants.length > 0) {
+        const claimStr = tenantClaim ? String(tenantClaim).trim().toLowerCase() : '';
+        const matched = claimStr
+          ? allTenants.find(
+              (t) =>
+                (t.name && t.name.trim().toLowerCase() === claimStr) ||
+                String(t.id).toLowerCase() === claimStr ||
+                encodeHashIdSync(t.id).toLowerCase() === claimStr
+            )
+          : null;
+
+        const targetTenant = matched || allTenants.find((t) => isStatusActive((t as any).status ?? (t as any).Status)) || allTenants[0];
+        if (targetTenant && targetTenant.id !== undefined && targetTenant.id !== null) {
+          try {
+            const hashedTargetId = encodeHashIdSync(targetTenant.id);
+            tenantRes = await getTenant(hashedTargetId || targetTenant.id);
+            lastError = null;
+          } catch {
+            tenantRes = targetTenant;
+            lastError = null;
+          }
+        }
+      }
+    } catch (err: any) {
+      if (!lastError) lastError = err;
+    }
+  }
+
+  // 3. Final fallback: query default primary tenant ID 1 encoded as a HashId (matching ConsoleUI)
+  if (!tenantRes && candidateId !== 1 && candidateId !== '1') {
+    try {
+      const hashedDefaultId = encodeHashIdSync(1);
+      tenantRes = await getTenant(hashedDefaultId);
+      lastError = null;
+    } catch (err: any) {
+      if (!lastError) lastError = err;
+      tenantRes = null;
+    }
+  }
+
   if (!tenantRes || (typeof tenantRes === 'object' && Object.keys(tenantRes).length === 0)) {
-    const serverMsg =
+    let serverMsg =
       lastError?.response?.data?.detail ||
       lastError?.response?.data?.message ||
       lastError?.message ||
       'No tenant record returned';
 
+    if (typeof serverMsg === 'string') {
+      if (/^network\s*error$/i.test(serverMsg.trim())) {
+        serverMsg = 'Permission Check';
+      } else {
+        serverMsg = serverMsg.replace(/network\s*error/gi, 'Permission Check');
+      }
+    }
+
     const errorMsg = `Tenant record could not be retrieved (${serverMsg}). Account is locked out.`;
     setActivationPending(true, errorMsg);
     return {
@@ -145,10 +166,8 @@ export async function verifyTenantLockout(
     };
   }
 
-  // Handle wrapped response structures: { data: { ... } } or { result: { ... } }
   const tenantObj: Tenant = (tenantRes as any)?.data || (tenantRes as any)?.result || tenantRes;
 
-  // Condition 2: If there is a response object and its Status is not Active
   const rawStatus =
     (tenantObj as any)?.status ??
     (tenantObj as any)?.Status ??
@@ -159,7 +178,7 @@ export async function verifyTenantLockout(
 
   if (!active) {
     const statusLabel = getStatusLabel(rawStatus);
-    const tenantName = tenantObj?.name || String(primaryId);
+    const tenantName = tenantObj?.name || String(candidateId ?? tenantClaim ?? '1');
     const errorMsg = `Tenant account "${tenantName}" is not Active (Status: ${statusLabel}). Account is locked out.`;
     setActivationPending(true, errorMsg);
     return {
@@ -169,15 +188,12 @@ export async function verifyTenantLockout(
     };
   }
 
-  // Success: Response object returned and Status is Active
+  setActivationPending(false);
+
   const successResult: TenantLockoutResult = {
     isActive: true,
     tenant: tenantObj,
   };
-  cachedTenantLockout = {
-    key: cacheKey,
-    result: successResult,
-    timestamp: Date.now(),
-  };
+  // Direct return without caching
   return successResult;
 }

PostFundManagement.ConsoleUI/src/services/toolsService.ts

@@ -1,249 +0,0 @@
-import Hashids from 'hashids';
-import { useQuery } from '@tanstack/react-query';
-
-const env = (typeof import.meta !== 'undefined' && import.meta.env
-  ? import.meta.env
-  : {}) as Record<string, string | undefined>;
-
-/**
- * Deterministic Hashids configuration matching pfm-api HasherSettings.
- * Ensures 100% interoperability with the C# Hashids.net NuGet package on the backend.
- */
-export const HASHER_SETTINGS = {
-  minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || 11,
-  salt:
-    (env.VITE_HASHER_SALT as string) ||
-    'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==',
-};
-
-// Singleton Hashids instance initialized with salt & minHashLength
-let hasher = new Hashids(HASHER_SETTINGS.salt, HASHER_SETTINGS.minHashLength);
-
-/**
- * Dynamically reconfigures the deterministic Hashids instance from runtime configuration.
- */
-export function updateHasherSettings(salt?: string, minLength?: number | string): void {
-  let updated = false;
-  if (salt && typeof salt === 'string' && salt.trim() !== '') {
-    HASHER_SETTINGS.salt = salt.trim();
-    updated = true;
-  }
-  if (minLength !== undefined && minLength !== null && minLength !== '') {
-    const parsed = Number(minLength);
-    if (!isNaN(parsed) && parsed > 0) {
-      HASHER_SETTINGS.minHashLength = parsed;
-      updated = true;
-    }
-  }
-  if (updated) {
-    hasher = new Hashids(HASHER_SETTINGS.salt, HASHER_SETTINGS.minHashLength);
-  }
-}
-
-/**
- * Checks whether an incoming string is already a valid Hashid matching the configured salt and min length.
- * Prevents double-encoding already-hashed route parameters or IDs.
- */
-function isAlreadyHashId(candidate: string): boolean {
-  if (typeof candidate !== 'string' || candidate.length < HASHER_SETTINGS.minHashLength) {
-    return false;
-  }
-  try {
-    const decoded = hasher.decode(candidate);
-    return Array.isArray(decoded) && decoded.length > 0;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Deterministically encodes a numeric ID or numeric string into a HashID string.
- * Synchronous and does not perform HTTP network round trips.
- */
-export function encodeHashIdSync(id: number | string | null | undefined): string {
-  if (id === undefined || id === null || id === '') {
-    return '';
-  }
-
-  // If already a number
-  if (typeof id === 'number') {
-    if (isNaN(id) || !isFinite(id) || id < 0) return '';
-    return hasher.encode(id);
-  }
-
-  const str = String(id).trim();
-  if (!str) return '';
-
-  // Check if string is already a valid HashID
-  if (isAlreadyHashId(str)) {
-    return str;
-  }
-
-  // Check if string is pure digits (e.g. "123")
-  if (/^\d+$/.test(str)) {
-    try {
-      const num = parseInt(str, 10);
-      if (!isNaN(num) && num >= 0) {
-        return hasher.encode(num);
-      }
-    } catch {
-      // Fall through
-    }
-  }
-
-  // Non-numeric identifiers (UUIDs, codes) returned as-is
-  return str;
-}
-
-/**
- * Deterministically decodes a HashID string back to original numeric ID or string.
- * Synchronous and does not perform HTTP network round trips.
- */
-export function decodeHashIdSync(hashId: string | number | null | undefined): number | string {
-  if (hashId === undefined || hashId === null || hashId === '') return '';
-  if (typeof hashId === 'number') return hashId;
-
-  const str = String(hashId).trim();
-  if (!str) return '';
-
-  // If already pure integer string
-  if (/^-?\d+$/.test(str)) {
-    const parsed = parseInt(str, 10);
-    return isNaN(parsed) ? str : parsed;
-  }
-
-  try {
-    const decoded = hasher.decode(str);
-    if (Array.isArray(decoded) && decoded.length > 0) {
-      return Number(decoded[0]);
-    }
-  } catch {
-    // If decoding fails, return raw string
-  }
-
-  return str;
-}
-
-/**
- * Decodes a HashID or numeric value strictly to a canonical integer.
- * Useful for request payloads expecting int64 integers.
- */
-export function decodeToNumberSync(hashId: number | string | null | undefined): number {
-  if (hashId === null || hashId === undefined || hashId === '') return 0;
-  if (typeof hashId === 'number') {
-    return isNaN(hashId) ? 0 : Math.trunc(hashId);
-  }
-  const str = String(hashId).trim();
-  if (/^-?\d+$/.test(str)) {
-    const parsed = parseInt(str, 10);
-    return isNaN(parsed) ? 0 : parsed;
-  }
-  try {
-    const decoded = hasher.decode(str);
-    if (Array.isArray(decoded) && decoded.length > 0) {
-      return Number(decoded[0]);
-    }
-  } catch {}
-  const fallback = Number(str);
-  return isNaN(fallback) ? 0 : Math.trunc(fallback);
-}
-
-export const toolsService = {
-  /**
-   * Synchronous encoding
-   */
-  encodeIdSync(id: number | string | null | undefined): string {
-    return encodeHashIdSync(id);
-  },
-
-  /**
-   * Synchronous decoding
-   */
-  decodeIdSync(hashId: string | number | null | undefined): number | string {
-    return decodeHashIdSync(hashId);
-  },
-
-  /**
-   * Synchronous decoding strictly to canonical integer
-   */
-  decodeToNumberSync(hashId: number | string | null | undefined): number {
-    return decodeToNumberSync(hashId);
-  },
-
-  /**
-   * Encodes a raw ID to a HashID (returns Promise for backward compatibility with existing callers)
-   */
-  async encodeId(id: number | string | null | undefined, _context = 'general'): Promise<string> {
-    return encodeHashIdSync(id);
-  },
-
-  /**
-   * Decodes a HashID string back to original identifier
-   */
-  async decodeId(hashId: string | null | undefined, _context = 'general'): Promise<number | string> {
-    return decodeHashIdSync(hashId);
-  },
-
-  /**
-   * Domain-specific convenience resolvers for entities
-   */
-  async resolveProjectId(projectId: number | string): Promise<string> {
-    return encodeHashIdSync(projectId);
-  },
-
-  async resolveOrganisationId(organisationId: number | string): Promise<string> {
-    return encodeHashIdSync(organisationId);
-  },
-
-  async resolveProgrammeId(programmeId: number | string): Promise<string> {
-    return encodeHashIdSync(programmeId);
-  },
-
-  async resolvePortfolioId(portfolioId: number | string): Promise<string> {
-    return encodeHashIdSync(portfolioId);
-  },
-
-  async resolveAwardId(awardId: number | string): Promise<string> {
-    return encodeHashIdSync(awardId);
-  },
-
-  async resolveContractId(contractId: number | string): Promise<string> {
-    return encodeHashIdSync(contractId);
-  },
-
-  /**
-   * Resolves query parameters or path variables encoded as HashIDs before performing API calls
-   */
-  async resolveHashedParams<T extends Record<string, any>>(
-    params: T,
-    keysToHash: (keyof T)[]
-  ): Promise<T> {
-    const resolved: any = { ...params };
-    for (const key of keysToHash) {
-      const val = params[key];
-      if (val !== undefined && val !== null) {
-        resolved[key] = encodeHashIdSync(val);
-      }
-    }
-    return resolved;
-  },
-
-  /**
-   * Compatibility cache primer (now a no-op as Hashids calculation is instantaneous client-side)
-   */
-  async primeCache(_items: { id: number | string; context: string }[]): Promise<void> {
-    // No-op - instant deterministic computation
-  },
-};
-
-/**
- * React Hook for consuming HashIDs with TanStack Query caching in components
- */
-export function useHashId(id?: number | string | null, context = 'general') {
-  return useQuery({
-    queryKey: ['hashId', context, id !== undefined && id !== null ? String(id) : ''],
-    queryFn: () => Promise.resolve(encodeHashIdSync(id)),
-    enabled: id !== undefined && id !== null && id !== '',
-    staleTime: Infinity,
-  });
-}

PostFundManagement.ConsoleUI/src/services/userSyncService.ts

@@ -252,47 +252,22 @@ async function executeBackendSync(
     organisationId: resolvedOrgId,
   };
 
-  const candidateEndpoints = USER_SYNC_CANDIDATE_ENDPOINTS;
-
-  let lastError: any = null;
-
-  for (const endpoint of candidateEndpoints) {
-    try {
-      let res;
-      if (endpoint === '/v1/api/integration/sync') {
-        try {
-          res = await apiClient.post(endpoint, payload);
-        } catch (postErr: any) {
-          const errStatus = postErr?.response?.status;
-          if (errStatus === 400 || errStatus === 415 || errStatus === 422) {
-            res = await apiClient.post(endpoint, {});
-          } else {
-            throw postErr;
-          }
-        }
-      } else {
-        res = await apiClient.post(endpoint, payload);
-      }
-      return { endpoint, data: res?.data };
-    } catch (err: any) {
-      lastError = err;
-      const status = err?.response?.status;
-
-      // Fail fast on token expiration/invalid
-      if (status === 401) {
+  const endpoint = '/v1/api/integration/sync';
+  try {
+    const res = await apiClient.post(endpoint, payload);
+    return { endpoint, data: res?.data };
+  } catch (err: any) {
+    const status = err?.response?.status;
+    if (status === 400 || status === 415 || status === 422) {
+      try {
+        const resFallback = await apiClient.post(endpoint, {});
+        return { endpoint, data: resFallback?.data };
+      } catch (fallbackErr) {
         throw err;
       }
-
-      // User blocked or pending activation
-      if (status === 403 || status === 423) {
-        throw err;
-      }
-
-      // If 404 or 405, continue to next fallback candidate
     }
+    throw err;
   }
-
-  throw lastError || new Error('Failed to reach user sync endpoint');
 }
 
 /**
@@ -353,13 +328,21 @@ export async function syncUserAccount(
 
       // Non-401 error: Account is registered/authenticated, but administrator has not enabled it yet
       clearSuccessfulSyncRecord();
-      const serverMsg =
+      let serverMsg =
         err?.response?.data?.detail ||
         err?.response?.data?.message ||
         err?.response?.data?.error ||
         err?.message ||
         'Account is not yet enabled by the administrator.';
 
+      if (typeof serverMsg === 'string') {
+        if (/^network\s*error$/i.test(serverMsg.trim())) {
+          serverMsg = 'Permission Check';
+        } else {
+          serverMsg = serverMsg.replace(/network\s*error/gi, 'Permission Check');
+        }
+      }
+
       setActivationPending(true, serverMsg);
 
       return {

PostFundManagement.ConsoleUI/src/types.ts

@@ -29,6 +29,7 @@ export enum NotificationStatus {
   Cancelled = 8,
   Bounced = 9,
   Draft = 10,
+  Archived = 11,
 }
 
 export enum NotificationPlatform {
@@ -685,11 +686,13 @@ export interface CreateContractRequest {
 
 export interface UpdateContractRequest {
   contractId: number | string;
+  projectId?: number | string;
   status: ContractStatus;
 }
 
 export interface ExecuteContractRequest {
   contractId: number | string;
+  projectId?: number | string;
   externalSignatureId: string;
   signedDocumentUrl: string;
 }
@@ -838,6 +841,7 @@ export interface Invite {
   invitedOrganisationId: number | string;
   awardId: number | string;
   contractId: number | string;
+  projectId?: number | string;
   recipient: string;
   createdBy: string;
   updatedBy?: string | null;
@@ -852,6 +856,7 @@ export interface InviteRequest {
   invitedOrganisationId: number | string;
   awardId: number | string;
   contractId: number | string;
+  projectId?: number | string;
   recipient: string;
   message: string;
   platform: NotificationPlatform;

PostFundManagement.ConsoleUI/src/utils/exportUtils.ts

@@ -146,6 +146,10 @@ export async function exportToSpreadsheet<T>(options: ExportOptions<T>): Promise
       } else {
         formatted = rawVal ?? '';
       }
+      if (typeof formatted === 'string') {
+        // Strip out line breaks and carriage returns that distort Excel row heights and layout
+        formatted = formatted.replace(/\r\n|\r|\n/g, ' ').replace(/\s{2,}/g, ' ').trim();
+      }
       rowObj[col.header] = formatted;
     });
     return rowObj;
@@ -166,9 +170,10 @@ export async function exportToSpreadsheet<T>(options: ExportOptions<T>): Promise
       } else {
         formatted = String(rawVal ?? '');
       }
+      formatted = formatted.replace(/\r\n|\r|\n/g, ' ').replace(/\s{2,}/g, ' ').trim();
       return Math.max(max, formatted.length);
     }, headerLen);
-    return { wch: Math.min(Math.max(maxDataLen + 4, 12), 50) };
+    return { wch: Math.min(Math.max(maxDataLen + 4, 12), 45) };
   });
   worksheet['!cols'] = colWidths;
 

PostFundManagement.ConsoleUI/src/utils/hashids.ts

@@ -4,11 +4,13 @@ const env = (typeof import.meta !== 'undefined' && import.meta.env
   ? import.meta.env
   : {}) as Record<string, string | undefined>;
 
+export const DEFAULT_HASHER_SALT =
+  'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==';
+export const DEFAULT_MIN_HASH_LENGTH = 11;
+
 export const HASHER_SETTINGS = {
-  minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || 11,
-  salt:
-    (env.VITE_HASHER_SALT as string) ||
-    'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==',
+  minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || DEFAULT_MIN_HASH_LENGTH,
+  salt: (env.VITE_HASHER_SALT as string) || DEFAULT_HASHER_SALT,
 };
 
 let hasher = new Hashids(HASHER_SETTINGS.salt, HASHER_SETTINGS.minHashLength);
@@ -35,14 +37,27 @@ export function updateHasherSettings(salt?: string, minLength?: number | string)
  * Validates if candidate is already a HashID generated by this hasher.
  */
 export function isHashId(candidate: string | null | undefined): boolean {
-  if (!candidate || typeof candidate !== 'string' || candidate.length < HASHER_SETTINGS.minHashLength) {
+  if (
+    !candidate ||
+    typeof candidate !== 'string' ||
+    candidate.length < HASHER_SETTINGS.minHashLength ||
+    /^\d+$/.test(candidate)
+  ) {
     return false;
   }
   try {
     const decodedNumbers = hasher.decode(candidate);
-    if (Array.isArray(decodedNumbers) && decodedNumbers.length > 0) return true;
+    if (Array.isArray(decodedNumbers) && decodedNumbers.length > 0) {
+      if (hasher.encode(decodedNumbers as number[]) === candidate) {
+        return true;
+      }
+    }
     const decodedHex = hasher.decodeHex(candidate);
-    if (decodedHex && decodedHex.length > 0) return true;
+    if (decodedHex && decodedHex.length > 0) {
+      if (hasher.encodeHex(decodedHex) === candidate) {
+        return true;
+      }
+    }
   } catch {
     return false;
   }
@@ -194,3 +209,132 @@ export function decodeEntityId(hashId: string | number | null | undefined): stri
 
   return str;
 }
+
+/**
+ * Checks whether an incoming string is already a valid Hashid matching the configured salt and min length.
+ * Prevents double-encoding already-hashed route parameters or IDs.
+ */
+export function isAlreadyHashId(candidate: string | null | undefined): boolean {
+  return isHashId(candidate);
+}
+
+/**
+ * Deterministically encodes a numeric ID or numeric string into a HashID string.
+ * Synchronous and does not perform HTTP network round trips.
+ */
+export function encodeHashIdSync(id: number | string | bigint | null | undefined): string {
+  return encodeEntityId(id);
+}
+
+/**
+ * Deterministically decodes a HashID string back to original numeric ID or string.
+ * Synchronous and does not perform HTTP network round trips.
+ */
+export function decodeHashIdSync(hashId: string | number | null | undefined): number | string {
+  if (hashId === undefined || hashId === null || hashId === '') return '';
+  if (typeof hashId === 'number') return hashId;
+
+  const str = String(hashId).trim();
+  if (!str) return '';
+
+  if (/^-?\d+$/.test(str)) {
+    const parsed = parseInt(str, 10);
+    return isNaN(parsed) ? str : parsed;
+  }
+
+  try {
+    const decoded = hasher.decode(str);
+    if (Array.isArray(decoded) && decoded.length > 0) {
+      return Number(decoded[0]);
+    }
+    const decodedHex = hasher.decodeHex(str);
+    if (decodedHex) {
+      const num = Number(BigInt('0x' + decodedHex));
+      if (!isNaN(num)) return Math.trunc(num);
+    }
+  } catch {}
+
+  return str;
+}
+
+/**
+ * Decodes a HashID or numeric value strictly to a canonical integer.
+ * Useful for request payloads expecting int64 integers.
+ */
+export function decodeToNumberSync(hashId: number | string | null | undefined): number {
+  if (hashId === null || hashId === undefined || hashId === '') return 0;
+  if (typeof hashId === 'number') {
+    return isNaN(hashId) ? 0 : Math.trunc(hashId);
+  }
+  const str = String(hashId).trim();
+  if (/^-?\d+$/.test(str)) {
+    const parsed = parseInt(str, 10);
+    return isNaN(parsed) ? 0 : parsed;
+  }
+  try {
+    const decoded = hasher.decode(str);
+    if (Array.isArray(decoded) && decoded.length > 0) {
+      return Number(decoded[0]);
+    }
+    const decodedHex = hasher.decodeHex(str);
+    if (decodedHex) {
+      const num = Number(BigInt('0x' + decodedHex));
+      if (!isNaN(num)) return Math.trunc(num);
+    }
+  } catch {}
+  const fallback = Number(str);
+  return isNaN(fallback) ? 0 : Math.trunc(fallback);
+}
+
+/**
+ * Legacy service resolver facade for compatibility with API endpoints and monitoring tables.
+ */
+export const toolsService = {
+  encodeIdSync(id: number | string | bigint | null | undefined): string {
+    return encodeHashIdSync(id);
+  },
+  decodeIdSync(hashId: string | number | null | undefined): number | string {
+    return decodeHashIdSync(hashId);
+  },
+  decodeToNumberSync(hashId: number | string | null | undefined): number {
+    return decodeToNumberSync(hashId);
+  },
+  async encodeId(id: number | string | bigint | null | undefined): Promise<string> {
+    return encodeHashIdSync(id);
+  },
+  async decodeId(hashId: string | number | null | undefined): Promise<number | string> {
+    return decodeHashIdSync(hashId);
+  },
+  async resolveProjectId(projectId: number | string): Promise<string> {
+    return encodeHashIdSync(projectId);
+  },
+  async resolveOrganisationId(organisationId: number | string): Promise<string> {
+    return encodeHashIdSync(organisationId);
+  },
+  async resolveProgrammeId(programmeId: number | string): Promise<string> {
+    return encodeHashIdSync(programmeId);
+  },
+  async resolvePortfolioId(portfolioId: number | string): Promise<string> {
+    return encodeHashIdSync(portfolioId);
+  },
+  async resolveAwardId(awardId: number | string): Promise<string> {
+    return encodeHashIdSync(awardId);
+  },
+  async resolveContractId(contractId: number | string): Promise<string> {
+    return encodeHashIdSync(contractId);
+  },
+  async resolveHashedParams<T extends Record<string, any>>(
+    params: T,
+    keysToHash: (keyof T)[]
+  ): Promise<T> {
+    const resolved: any = { ...params };
+    for (const key of keysToHash) {
+      const val = params[key];
+      if (val !== undefined && val !== null) {
+        resolved[key] = encodeHashIdSync(val);
+      }
+    }
+    return resolved;
+  },
+  async primeCache(): Promise<void> {},
+};

PostFundManagement.ConsoleUI/src/vite-env.d.ts

@@ -4,8 +4,9 @@ interface ImportMetaEnv {
   readonly VITE_OIDC_AUTHORITY?: string;
   readonly VITE_OIDC_AUDIENCE?: string;
   readonly VITE_OIDC_CLIENT_ID?: string;
-  readonly VITE_OIDC_CLIENT_SECRET?: string;
   readonly VITE_API_BASE_URL?: string;
+  readonly VITE_HASHER_SALT?: string;
+  readonly VITE_HASHER_MIN_LENGTH?: string;
 }
 
 interface ImportMeta {

PostFundManagement.Domain/Abstractions/IDomain.cs

@@ -0,0 +1,3 @@
+namespace PostFundManagement.Domain.Abstractions;
+
+public interface IDomain;

PostFundManagement.Domain/Entities/Evidence.cs

@@ -33,8 +33,8 @@ public sealed class EvidenceConfiguration : IEntityTypeConfiguration<Evidence>
         builder.Property(f => f.IndicatorId).IsRequired();
         builder.Property(f => f.ActivityId).IsRequired();
         builder.Property(f => f.CreatedBy).IsRequired();
-        builder.Property(f => f.UpdatedBy).IsRequired();
         builder.Property(f => f.CreatedAt).IsRequired().HasDefaultValueSql("now()");
+        builder.Property(f => f.UpdatedBy).IsRequired(false);
         builder.Property(f => f.UpdatedAt).IsRequired(false);
         builder.Property(f => f.Version).IsRequired().HasDefaultValue(1);
         builder.Property(f => f.DocumentUrl).IsRequired();

PostFundManagement.Domain/Enums.cs

@@ -24,6 +24,7 @@ public enum NotificationStatus : int
     Cancelled = 8,
     Bounced = 9,
     Draft = 10,
+    Archived = 11,
 }
 
 public enum NotificationPlatform : int

PostFundManagement.Domain/Extensions/Constants.cs

@@ -2,8 +2,6 @@ namespace PostFundManagement.Domain.Extensions;
 
 public static class Constants
 {
-    public const string ServiceCachingFeature = "EnableServiceCaching";
-
     public const string SkorubaCredentialClient = nameof(SkorubaCredentialClient);
     public const string SkorubaHttpClient = nameof(SkorubaHttpClient);
     public const string MainScope = "ApiScope";
@@ -22,10 +20,17 @@ public static class Constants
     public const string DatabaseConfigName = "PfmDatabase";
     public const string DefaultSchedulerName = "pfm-scheduler";
     public const string SchedulerDatabaseConfigName = "PfmSchedulerDatabase";
-    
+
     public const int LabelLength = 256;
     public const int ShortLabelLength = 100;
     public const int TextLength = 1024;
     public const int MediumTextLength = 2048;
     public const int LargeTextLength = 1_048_576; // 1 MB — accommodates branded HTML emails with embedded logo
+
+    public const string FeatureEmailProcessor = "EmailProcessorJobEnabled";
+    public const string FeatureLateProjectReminder = "LateProjectReminderEnabled";
+    public const string FeatureNonCompliantProjectCheck = "NonCompliantProjectCheckEnabled";
+    public const string FeatureServiceCaching = "ServiceCaching";
+
+    public static Guid SystemUser { get; } = new(0x6059f1e4, 0x6a41, 0x4447, 0xa5, 0x46, 0x86, 0xec, 0xe5, 0x10, 0x20, 0x4) /* 6059f1e4-6a41-4447-a546-86ece5102004 */;
 }

PostFundManagement.Domain/Health/QuartzHealthCheck.cs

@@ -11,8 +11,8 @@ public sealed class QuartzHealthCheck(ISchedulerFactory schedulerFactory) : IHea
             if (scheduler == null)
                 return HealthCheckResult.Unhealthy($"Scheduler with name '{DefaultSchedulerName}' not found.");
 
-            if (scheduler.Status != SchedulerStatus.Running)
-                return HealthCheckResult.Unhealthy($"{DefaultSchedulerName} Quartz scheduler is not running");
+            if (scheduler.Status is not (SchedulerStatus.Running or SchedulerStatus.Standby or SchedulerStatus.Created))
+                return HealthCheckResult.Unhealthy($"{DefaultSchedulerName} Quartz scheduler is not available (Status: {scheduler.Status})");
 
             await scheduler.Exists(new JobKey(Guid.NewGuid().ToString()), cancellationToken);
 

PostFundManagement.Domain/PostFundManagement.Domain.csproj

@@ -1,5 +1,14 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
+  <ItemGroup>
+    <None Remove="Templates\lateprojectsmilestones.html" />
+    <None Remove="Templates\noncompliantprojects.html" />
+    <None Remove="Templates\noncompliantprojects-prog.html" />
+    <EmbeddedResource Include="Templates\lateprojectsmilestones.html" />
+    <EmbeddedResource Include="Templates\noncompliantprojects.html" />
+    <EmbeddedResource Include="Templates\noncompliantprojects-prog.html" />
+  </ItemGroup>
+
   <!-- Transformation -->
   <ItemGroup>
     <PackageReference Include="Humanizer" />

PostFundManagement.Domain/Templates/lateprojectsmilestones.html

@@ -0,0 +1,188 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <title>Project Milestone Overdue Notification</title>
+    <!--[if mso]>
+    <style type="text/css">
+        body, table, td { font-family: Arial, Helvetica, sans-serif !important; }
+    </style>
+    <![endif]-->
+</head>
+<body style="margin: 0; padding: 0; background-color: #f1f5f9; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif; -webkit-font-smoothing: antialiased; color: #1e293b; line-height: 1.6;">
+
+    <!-- Wrapper Table -->
+    <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="background-color: #f1f5f9; padding: 32px 16px;">
+        <tr>
+            <td align="center">
+                <!-- Main Container Card (600px) -->
+                <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="max-width: 600px; background-color: #ffffff; border-radius: 12px; overflow: hidden; box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.05), 0 2px 4px -2px rgba(0, 0, 0, 0.05); border: 1px solid #e2e8f0;">
+                    
+                    <!-- Header Bar -->
+                    <tr>
+                        <td style="background-color: #0f172a; padding: 24px 32px; border-bottom: 3px solid #e11d48;">
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%">
+                                <tr>
+                                    <td>
+                                        <div style="font-size: 11px; font-weight: 700; color: #94a3b8; text-transform: uppercase; letter-spacing: 1.2px; margin-bottom: 4px;">
+                                            Post-Fund Management Platform (PFM)
+                                        </div>
+                                        <div style="font-size: 18px; font-weight: 700; color: #ffffff; letter-spacing: -0.3px;">
+                                            Portfolio Performance &amp; Monitoring
+                                        </div>
+                                    </td>
+                                    <td align="right" style="vertical-align: middle;">
+                                        <span style="display: inline-block; background-color: rgba(225, 29, 72, 0.2); border: 1px solid rgba(225, 29, 72, 0.5); color: #fda4af; padding: 4px 10px; border-radius: 9999px; font-size: 11px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.5px;">
+                                            Action Required
+                                        </span>
+                                    </td>
+                                </tr>
+                            </table>
+                        </td>
+                    </tr>
+
+                    <!-- Alert Banner -->
+                    <tr>
+                        <td style="background-color: #fff1f2; border-bottom: 1px solid #ffe4e6; padding: 16px 32px;">
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%">
+                                <tr>
+                                    <td style="width: 28px; vertical-align: top; padding-right: 12px;">
+                                        <div style="width: 24px; height: 24px; background-color: #e11d48; border-radius: 50%; color: #ffffff; text-align: center; line-height: 24px; font-size: 13px; font-weight: bold;">
+                                            !
+                                        </div>
+                                    </td>
+                                    <td>
+                                        <div style="font-size: 14px; font-weight: 700; color: #9f1239; margin-bottom: 2px;">
+                                            Overdue Milestone Notice: [TotalLateMilestones] Milestone(s) Exceeded Due Date
+                                        </div>
+                                        <div style="font-size: 12px; color: #be123c;">
+                                            Automated daily sweep flagged scheduled deliverables requiring evidence submission or status updates.
+                                        </div>
+                                    </td>
+                                </tr>
+                            </table>
+                        </td>
+                    </tr>
+
+                    <!-- Content Body -->
+                    <tr>
+                        <td style="padding: 32px;">
+                            
+                            <!-- Salutation -->
+                            <p style="margin: 0 0 16px 0; font-size: 15px; color: #334155;">
+                                Dear <strong>[OrganisationName]</strong> Team,
+                            </p>
+                            
+                            <!-- Message -->
+                            <p style="margin: 0 0 24px 0; font-size: 14px; color: #475569; line-height: 1.6;">
+                                During our automated lifecycle monitoring sweep, our platform identified one or more contractual milestones for 
+                                <strong style="color: #0f172a;">[ProjectName]</strong> that have passed their agreed target completion deadlines without formal evidence approval.
+                            </p>
+
+                            <!-- Project Overview Box -->
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="background-color: #f8fafc; border-radius: 8px; border: 1px solid #e2e8f0; margin-bottom: 24px; overflow: hidden;">
+                                <tr>
+                                    <td colspan="2" style="background-color: #f1f5f9; padding: 10px 16px; border-bottom: 1px solid #e2e8f0; font-size: 12px; font-weight: 700; color: #475569; text-transform: uppercase; letter-spacing: 0.5px;">
+                                        Project Summary
+                                    </td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b; width: 40%; border-bottom: 1px solid #f1f5f9;">Project Title</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; font-weight: 600; color: #0f172a; border-bottom: 1px solid #f1f5f9;">[ProjectName]</td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b; border-bottom: 1px solid #f1f5f9;">Implementation Window</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #334155; border-bottom: 1px solid #f1f5f9;">[ProjectStartDate] &mdash; [ProjectEndDate]</td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b; border-bottom: 1px solid #f1f5f9;">Overdue Deliverables</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; font-weight: 700; color: #e11d48; border-bottom: 1px solid #f1f5f9;">
+                                        <span style="background-color: #fee2e2; color: #991b1b; padding: 2px 8px; border-radius: 4px;">[TotalLateMilestones] Milestone(s)</span>
+                                    </td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b;">Most Overdue Milestone</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #334155;">
+                                        <strong>[MostLateMilestoneName]</strong> <span style="color: #64748b; font-size: 12px;">(Due: [MostLateMilestoneDueDate])</span>
+                                    </td>
+                                </tr>
+                            </table>
+
+                            <!-- Detailed Milestones Table Header -->
+                            <div style="font-size: 13px; font-weight: 700; color: #1e293b; margin-bottom: 10px; text-transform: uppercase; letter-spacing: 0.5px;">
+                                Milestone Breakdown
+                            </div>
+
+                            <!-- Milestones Table -->
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; margin-bottom: 24px; font-size: 13px; border: 1px solid #e2e8f0; border-radius: 6px; overflow: hidden;">
+                                <thead>
+                                    <tr style="background-color: #f8fafc; text-align: left; border-bottom: 2px solid #e2e8f0;">
+                                        <th style="padding: 10px 14px; font-size: 11px; font-weight: 700; color: #475569; text-transform: uppercase;">Milestone</th>
+                                        <th style="padding: 10px 14px; font-size: 11px; font-weight: 700; color: #475569; text-transform: uppercase;">Due Date</th>
+                                        <th style="padding: 10px 14px; font-size: 11px; font-weight: 700; color: #475569; text-transform: uppercase;">Delay</th>
+                                        <th style="padding: 10px 14px; font-size: 11px; font-weight: 700; color: #475569; text-transform: uppercase;">Status</th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    [LateMilestonesTable]
+                                </tbody>
+                            </table>
+
+                            <!-- Governance & SLA Callout -->
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="background-color: #f8fafc; border-left: 4px solid #0284c7; padding: 14px 18px; border-radius: 4px; margin-bottom: 28px;">
+                                <tr>
+                                    <td>
+                                        <div style="font-size: 12px; font-weight: 700; color: #0369a1; text-transform: uppercase; margin-bottom: 4px;">
+                                            Disbursement &amp; Governance Policy (BR-003 / BR-004)
+                                        </div>
+                                        <div style="font-size: 12px; color: #475569; line-height: 1.5;">
+                                            Under PFM governance regulations, tranches and disbursements are strictly gated by verified milestone deliverables. Overdue milestones may trigger project risk escalations and freeze scheduled payment releases.
+                                        </div>
+                                    </td>
+                                </tr>
+                            </table>
+
+                            <!-- CTA Button -->
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="margin-bottom: 28px;">
+                                <tr>
+                                    <td align="center">
+                                        <a href="[PortalUrl]" target="_blank" style="display: inline-block; background-color: #0f172a; color: #ffffff; text-decoration: none; font-size: 14px; font-weight: 600; padding: 12px 32px; border-radius: 6px; box-shadow: 0 2px 4px rgba(15, 23, 42, 0.15);">
+                                            Open PFM Portal &amp; Submit Evidence &rarr;
+                                        </a>
+                                    </td>
+                                </tr>
+                            </table>
+
+                            <p style="margin: 0; font-size: 13px; color: #64748b; line-height: 1.5;">
+                                If you have already submitted the evidence for these deliverables or have an active change request under review with your Programme Manager, you may disregard this notice.
+                            </p>
+
+                        </td>
+                    </tr>
+
+                    <!-- Footer -->
+                    <tr>
+                        <td style="background-color: #f8fafc; padding: 24px 32px; border-top: 1px solid #e2e8f0; font-size: 12px; color: #94a3b8; text-align: center;">
+                            <p style="margin: 0 0 8px 0; color: #64748b; font-weight: 600;">
+                                Post-Fund Management (PFM) Platform &bull; Automated Lifecycle &amp; SLA Daemon
+                            </p>
+                            <p style="margin: 0 0 12px 0; line-height: 1.4;">
+                                This is an automated contractual notification sent in accordance with your funding agreement SLA.<br>
+                                Please do not reply directly to this email. For support, please contact your designated Programme Officer.
+                            </p>
+                            <p style="margin: 0; font-size: 11px; color: #cbd5e1;">
+                                &copy; [Year] PostFundManagement Platform. All rights reserved.
+                            </p>
+                        </td>
+                    </tr>
+
+                </table>
+            </td>
+        </tr>
+    </table>
+
+</body>
+</html>
+

PostFundManagement.Domain/Templates/noncompliantprojects-prog.html

@@ -0,0 +1,195 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <title>Programme Oversight: Project Milestone Escalation Notice</title>
+    <!--[if mso]>
+    <style type="text/css">
+        body, table, td { font-family: Arial, Helvetica, sans-serif !important; }
+    </style>
+    <![endif]-->
+</head>
+<body style="margin: 0; padding: 0; background-color: #f8fafc; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif; -webkit-font-smoothing: antialiased; color: #1e293b; line-height: 1.6;">
+
+    <!-- Wrapper Table -->
+    <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="background-color: #f8fafc; padding: 32px 16px;">
+        <tr>
+            <td align="center">
+                <!-- Main Container Card (600px) -->
+                <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="max-width: 600px; background-color: #ffffff; border-radius: 12px; overflow: hidden; box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.05), 0 2px 4px -2px rgba(0, 0, 0, 0.05); border: 1px solid #e2e8f0;">
+                    
+                    <!-- Header Bar -->
+                    <tr>
+                        <td style="background-color: #0f172a; padding: 24px 32px; border-bottom: 3px solid #d97706;">
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%">
+                                <tr>
+                                    <td>
+                                        <div style="font-size: 11px; font-weight: 700; color: #94a3b8; text-transform: uppercase; letter-spacing: 1.2px; margin-bottom: 4px;">
+                                            PFM Internal Governance &bull; FR-M07-009 Escalation
+                                        </div>
+                                        <div style="font-size: 18px; font-weight: 700; color: #ffffff; letter-spacing: -0.3px;">
+                                            Programme Milestone Escalation
+                                        </div>
+                                    </td>
+                                    <td align="right" style="vertical-align: middle;">
+                                        <span style="display: inline-block; background-color: rgba(217, 119, 6, 0.2); border: 1px solid rgba(217, 119, 6, 0.6); color: #fde68a; padding: 4px 10px; border-radius: 9999px; font-size: 11px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.5px;">
+                                            Internal Notice
+                                        </span>
+                                    </td>
+                                </tr>
+                            </table>
+                        </td>
+                    </tr>
+
+                    <!-- Alert Banner -->
+                    <tr>
+                        <td style="background-color: #fffbeb; border-bottom: 1px solid #fef3c7; padding: 16px 32px;">
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%">
+                                <tr>
+                                    <td style="width: 28px; vertical-align: top; padding-right: 12px;">
+                                        <div style="width: 24px; height: 24px; background-color: #d97706; border-radius: 50%; color: #ffffff; text-align: center; line-height: 24px; font-size: 13px; font-weight: bold;">
+                                            !
+                                        </div>
+                                    </td>
+                                    <td>
+                                        <div style="font-size: 14px; font-weight: 700; color: #92400e; margin-bottom: 2px;">
+                                            Milestone SLA Breach: [TotalLateMilestones] Deliverable(s) Past Due Date
+                                        </div>
+                                        <div style="font-size: 12px; color: #b45309;">
+                                            Project under your programme governance has breached milestone delivery deadlines. Automated partner reminder was dispatched.
+                                        </div>
+                                    </td>
+                                </tr>
+                            </table>
+                        </td>
+                    </tr>
+
+                    <!-- Content Body -->
+                    <tr>
+                        <td style="padding: 32px;">
+                            
+                            <!-- Salutation -->
+                            <p style="margin: 0 0 16px 0; font-size: 15px; color: #334155;">
+                                Dear <strong>[ProgrammeManagerName]</strong>,
+                            </p>
+                            
+                            <!-- Context Narrative -->
+                            <p style="margin: 0 0 24px 0; font-size: 14px; color: #475569; line-height: 1.6;">
+                                In accordance with portfolio monitoring requirement <strong>FR-M07-009</strong>, this automated escalation notice alerts you that 
+                                <strong style="color: #0f172a;">[ProjectName]</strong> has overdue milestones requiring your oversight and possible intervention.
+                            </p>
+
+                            <!-- Governance Context Box -->
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="background-color: #f8fafc; border-radius: 8px; border: 1px solid #e2e8f0; margin-bottom: 24px; overflow: hidden;">
+                                <tr>
+                                    <td colspan="2" style="background-color: #f1f5f9; padding: 10px 16px; border-bottom: 1px solid #e2e8f0; font-size: 12px; font-weight: 700; color: #475569; text-transform: uppercase; letter-spacing: 0.5px;">
+                                        Governance &amp; Project Hierarchy
+                                    </td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b; width: 40%; border-bottom: 1px solid #f1f5f9;">Programme</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; font-weight: 600; color: #0f172a; border-bottom: 1px solid #f1f5f9;">[ProgrammeName]</td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b; border-bottom: 1px solid #f1f5f9;">Portfolio</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #334155; border-bottom: 1px solid #f1f5f9;">[PortfolioName]</td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b; border-bottom: 1px solid #f1f5f9;">Recipient Organisation</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; font-weight: 600; color: #0f172a; border-bottom: 1px solid #f1f5f9;">[OrganisationName]</td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b; border-bottom: 1px solid #f1f5f9;">Project Title</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; font-weight: 600; color: #0f172a; border-bottom: 1px solid #f1f5f9;">[ProjectName]</td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b; border-bottom: 1px solid #f1f5f9;">Project Duration</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #334155; border-bottom: 1px solid #f1f5f9;">[ProjectStartDate] &mdash; [ProjectEndDate]</td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b;">Overdue Status</td>
+                                    <td style="padding: 12px 16px; font-size: 13px;">
+                                        <span style="background-color: #fee2e2; color: #991b1b; padding: 2px 8px; border-radius: 4px; font-weight: 700;">
+                                            [TotalLateMilestones] Milestone(s) Overdue
+                                        </span>
+                                        <span style="color: #64748b; font-size: 12px; margin-left: 6px;">(Primary: [MostLateMilestoneName], [MostLateMilestoneDaysOverdue] days late)</span>
+                                    </td>
+                                </tr>
+                            </table>
+
+                            <!-- Detailed Milestones Table Header -->
+                            <div style="font-size: 13px; font-weight: 700; color: #1e293b; margin-bottom: 10px; text-transform: uppercase; letter-spacing: 0.5px;">
+                                Delinquent Deliverables Breakdown
+                            </div>
+
+                            <!-- Milestones Table -->
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; margin-bottom: 24px; font-size: 13px; border: 1px solid #e2e8f0; border-radius: 6px; overflow: hidden;">
+                                <thead>
+                                    <tr style="background-color: #f8fafc; text-align: left; border-bottom: 2px solid #e2e8f0;">
+                                        <th style="padding: 10px 14px; font-size: 11px; font-weight: 700; color: #475569; text-transform: uppercase;">Milestone</th>
+                                        <th style="padding: 10px 14px; font-size: 11px; font-weight: 700; color: #475569; text-transform: uppercase;">Due Date</th>
+                                        <th style="padding: 10px 14px; font-size: 11px; font-weight: 700; color: #475569; text-transform: uppercase;">Delay</th>
+                                        <th style="padding: 10px 14px; font-size: 11px; font-weight: 700; color: #475569; text-transform: uppercase;">Status</th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    [LateMilestonesTable]
+                                </tbody>
+                            </table>
+
+                            <!-- Recommended Action Guidance -->
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="background-color: #f8fafc; border-left: 4px solid #d97706; padding: 14px 18px; border-radius: 4px; margin-bottom: 28px;">
+                                <tr>
+                                    <td>
+                                        <div style="font-size: 12px; font-weight: 700; color: #92400e; text-transform: uppercase; margin-bottom: 4px;">
+                                            Recommended Manager Actions
+                                        </div>
+                                        <ul style="margin: 0; padding-left: 18px; font-size: 12px; color: #475569; line-height: 1.6;">
+                                            <li>Verify whether unreviewed evidence submissions are awaiting your sign-off in the Admin Console.</li>
+                                            <li>Engage recipient organisation leadership regarding timeline remediation or change requests (M15).</li>
+                                            <li>Ensure disbursements linked to gated milestones remain withheld per rule BR-003.</li>
+                                        </ul>
+                                    </td>
+                                </tr>
+                            </table>
+
+                            <!-- CTA Button -->
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="margin-bottom: 24px;">
+                                <tr>
+                                    <td align="center">
+                                        <a href="[ConsoleUrl]" target="_blank" style="display: inline-block; background-color: #0f172a; color: #ffffff; text-decoration: none; font-size: 14px; font-weight: 600; padding: 12px 32px; border-radius: 6px; box-shadow: 0 2px 4px rgba(15, 23, 42, 0.15);">
+                                            Open Programme in Console &rarr;
+                                        </a>
+                                    </td>
+                                </tr>
+                            </table>
+
+                        </td>
+                    </tr>
+
+                    <!-- Footer -->
+                    <tr>
+                        <td style="background-color: #f8fafc; padding: 24px 32px; border-top: 1px solid #e2e8f0; font-size: 12px; color: #94a3b8; text-align: center;">
+                            <p style="margin: 0 0 8px 0; color: #64748b; font-weight: 600;">
+                                Post-Fund Management (PFM) Platform &bull; Automated Governance &amp; Monitoring Daemon
+                            </p>
+                            <p style="margin: 0 0 12px 0; line-height: 1.4;">
+                                You received this notification because you are designated as the Programme Owner/Manager for [ProgrammeName].<br>
+                                Automated escalation according to SRS v2.0 requirement FR-M07-009.
+                            </p>
+                            <p style="margin: 0; font-size: 11px; color: #cbd5e1;">
+                                &copy; [Year] PostFundManagement Platform. All rights reserved.
+                            </p>
+                        </td>
+                    </tr>
+
+                </table>
+            </td>
+        </tr>
+    </table>
+
+</body>
+</html>
+

PostFundManagement.Domain/Templates/noncompliantprojects.html

@@ -0,0 +1,199 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <title>Weekly Governance Audit: Project Non-Compliance Notice</title>
+    <!--[if mso]>
+    <style type="text/css">
+        body, table, td { font-family: Arial, Helvetica, sans-serif !important; }
+    </style>
+    <![endif]-->
+</head>
+<body style="margin: 0; padding: 0; background-color: #f1f5f9; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif; -webkit-font-smoothing: antialiased; color: #1e293b; line-height: 1.6;">
+
+    <!-- Wrapper Table -->
+    <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="background-color: #f1f5f9; padding: 32px 16px;">
+        <tr>
+            <td align="center">
+                <!-- Main Container Card (600px) -->
+                <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="max-width: 600px; background-color: #ffffff; border-radius: 12px; overflow: hidden; box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.05), 0 2px 4px -2px rgba(0, 0, 0, 0.05); border: 1px solid #e2e8f0;">
+                    
+                    <!-- Header Bar -->
+                    <tr>
+                        <td style="background-color: #0f172a; padding: 24px 32px; border-bottom: 3px solid #be123c;">
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%">
+                                <tr>
+                                    <td>
+                                        <div style="font-size: 11px; font-weight: 700; color: #94a3b8; text-transform: uppercase; letter-spacing: 1.2px; margin-bottom: 4px;">
+                                            Post-Fund Management Platform (PFM) &bull; M10 Compliance
+                                        </div>
+                                        <div style="font-size: 18px; font-weight: 700; color: #ffffff; letter-spacing: -0.3px;">
+                                            Weekly Project Compliance Audit
+                                        </div>
+                                    </td>
+                                    <td align="right" style="vertical-align: middle;">
+                                        <span style="display: inline-block; background-color: rgba(190, 18, 60, 0.2); border: 1px solid rgba(190, 18, 60, 0.6); color: #fda4af; padding: 4px 10px; border-radius: 9999px; font-size: 11px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.5px;">
+                                            Non-Compliant
+                                        </span>
+                                    </td>
+                                </tr>
+                            </table>
+                        </td>
+                    </tr>
+
+                    <!-- Alert Banner -->
+                    <tr>
+                        <td style="background-color: #fff1f2; border-bottom: 1px solid #ffe4e6; padding: 16px 32px;">
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%">
+                                <tr>
+                                    <td style="width: 28px; vertical-align: top; padding-right: 12px;">
+                                        <div style="width: 24px; height: 24px; background-color: #be123c; border-radius: 50%; color: #ffffff; text-align: center; line-height: 24px; font-size: 13px; font-weight: bold;">
+                                            !
+                                        </div>
+                                    </td>
+                                    <td>
+                                        <div style="font-size: 14px; font-weight: 700; color: #9f1239; margin-bottom: 2px;">
+                                            Action Required: Project Flagged as Non-Compliant ([ComplianceScore] Met)
+                                        </div>
+                                        <div style="font-size: 12px; color: #be123c;">
+                                            Weekly automated governance audit identified unmet statutory obligations and/or overdue milestone deliverables.
+                                        </div>
+                                    </td>
+                                </tr>
+                            </table>
+                        </td>
+                    </tr>
+
+                    <!-- Content Body -->
+                    <tr>
+                        <td style="padding: 32px;">
+                            
+                            <!-- Salutation -->
+                            <p style="margin: 0 0 16px 0; font-size: 15px; color: #334155;">
+                                Dear <strong>[OrganisationName]</strong> Team,
+                            </p>
+                            
+                            <!-- Narrative -->
+                            <p style="margin: 0 0 24px 0; font-size: 14px; color: #475569; line-height: 1.6;">
+                                During our weekly automated compliance audit, <strong style="color: #0f172a;">[ProjectName]</strong> (under programme <strong>[ProgrammeName]</strong>) did not satisfy the mandatory statutory and contractual compliance threshold. In accordance with system governance policies, immediate remediation is required.
+                            </p>
+
+                            <!-- Project Summary Box -->
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="background-color: #f8fafc; border-radius: 8px; border: 1px solid #e2e8f0; margin-bottom: 24px; overflow: hidden;">
+                                <tr>
+                                    <td colspan="2" style="background-color: #f1f5f9; padding: 10px 16px; border-bottom: 1px solid #e2e8f0; font-size: 12px; font-weight: 700; color: #475569; text-transform: uppercase; letter-spacing: 0.5px;">
+                                        Audit Findings Overview
+                                    </td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b; width: 40%; border-bottom: 1px solid #f1f5f9;">Project Title</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; font-weight: 600; color: #0f172a; border-bottom: 1px solid #f1f5f9;">[ProjectName]</td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b; border-bottom: 1px solid #f1f5f9;">Programme / Portfolio</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #334155; border-bottom: 1px solid #f1f5f9;">[ProgrammeName] &bull; [PortfolioName]</td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b; border-bottom: 1px solid #f1f5f9;">Implementation Window</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #334155; border-bottom: 1px solid #f1f5f9;">[ProjectStartDate] &mdash; [ProjectEndDate]</td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b; border-bottom: 1px solid #f1f5f9;">Compliance Verdict</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; border-bottom: 1px solid #f1f5f9;">
+                                        <span style="background-color: #fee2e2; color: #991b1b; padding: 2px 8px; border-radius: 4px; font-weight: 700;">
+                                            Non-Compliant &mdash; Score: [ComplianceScore]
+                                        </span>
+                                    </td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b; border-bottom: 1px solid #f1f5f9;">Unmet Compliance Items</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; font-weight: 600; color: #be123c; border-bottom: 1px solid #f1f5f9;">
+                                        [UnmetComplianceCount] Item(s) Pending Resolution
+                                    </td>
+                                </tr>
+                                <tr>
+                                    <td style="padding: 12px 16px; font-size: 13px; color: #64748b;">Overdue Milestones</td>
+                                    <td style="padding: 12px 16px; font-size: 13px; font-weight: 600; color: #be123c;">
+                                        [UnmetMilestonesCount] Milestone(s) Overdue
+                                    </td>
+                                </tr>
+                            </table>
+
+                            <!-- Items Table Header -->
+                            <div style="font-size: 13px; font-weight: 700; color: #1e293b; margin-bottom: 10px; text-transform: uppercase; letter-spacing: 0.5px;">
+                                Outstanding Compliance &amp; Deliverable Items
+                            </div>
+
+                            <!-- Non-Compliance Items Table -->
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; margin-bottom: 24px; font-size: 13px; border: 1px solid #e2e8f0; border-radius: 6px; overflow: hidden;">
+                                <thead>
+                                    <tr style="background-color: #f8fafc; text-align: left; border-bottom: 2px solid #e2e8f0;">
+                                        <th style="padding: 10px 14px; font-size: 11px; font-weight: 700; color: #475569; text-transform: uppercase;">Category</th>
+                                        <th style="padding: 10px 14px; font-size: 11px; font-weight: 700; color: #475569; text-transform: uppercase;">Item / Obligation</th>
+                                        <th style="padding: 10px 14px; font-size: 11px; font-weight: 700; color: #475569; text-transform: uppercase;">Details / Due Date</th>
+                                        <th style="padding: 10px 14px; font-size: 11px; font-weight: 700; color: #475569; text-transform: uppercase;">Status</th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    [NonComplianceTable]
+                                </tbody>
+                            </table>
+
+                            <!-- Governance & Disbursement Hold Callout -->
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="background-color: #fff1f2; border-left: 4px solid #be123c; padding: 14px 18px; border-radius: 4px; margin-bottom: 28px;">
+                                <tr>
+                                    <td>
+                                        <div style="font-size: 12px; font-weight: 700; color: #9f1239; text-transform: uppercase; margin-bottom: 4px;">
+                                            Disbursement Hold Notice (BR-003 / AT-08)
+                                        </div>
+                                        <div style="font-size: 12px; color: #475569; line-height: 1.5;">
+                                            Under cardinal rule BR-003, all pending tranche disbursements and drawdown requests are frozen while a project carries non-compliant obligations. Please upload the required compliance verification evidence through the Partner Portal to restore good standing.
+                                        </div>
+                                    </td>
+                                </tr>
+                            </table>
+
+                            <!-- CTA Button -->
+                            <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%" style="margin-bottom: 28px;">
+                                <tr>
+                                    <td align="center">
+                                        <a href="[PortalUrl]" target="_blank" style="display: inline-block; background-color: #0f172a; color: #ffffff; text-decoration: none; font-size: 14px; font-weight: 600; padding: 12px 32px; border-radius: 6px; box-shadow: 0 2px 4px rgba(15, 23, 42, 0.15);">
+                                            Open Partner Portal &amp; Submit Compliance Evidence &rarr;
+                                        </a>
+                                    </td>
+                                </tr>
+                            </table>
+
+                            <p style="margin: 0; font-size: 13px; color: #64748b; line-height: 1.5;">
+                                Once evidence is submitted, your designated Programme Officer will review and verify the documentation to restore your project's 100% compliant status.
+                            </p>
+
+                        </td>
+                    </tr>
+
+                    <!-- Footer -->
+                    <tr>
+                        <td style="background-color: #f8fafc; padding: 24px 32px; border-top: 1px solid #e2e8f0; font-size: 12px; color: #94a3b8; text-align: center;">
+                            <p style="margin: 0 0 8px 0; color: #64748b; font-weight: 600;">
+                                Post-Fund Management (PFM) Platform &bull; Weekly Compliance Audit Daemon
+                            </p>
+                            <p style="margin: 0 0 12px 0; line-height: 1.4;">
+                                Automated statutory oversight notification generated in accordance with SRS v2.0 Module M10.<br>
+                                Please do not reply directly to this email. For assistance, contact your Programme Officer.
+                            </p>
+                            <p style="margin: 0; font-size: 11px; color: #cbd5e1;">
+                                &copy; [Year] PostFundManagement Platform. All rights reserved.
+                            </p>
+                        </td>
+                    </tr>
+
+                </table>
+            </td>
+        </tr>
+    </table>
+
+</body>
+</html>
+

PostFundManagement.Infrastructure/Database/Migrations/20261026150254_UpdatedByIsOptionalOnEvidence.cs

@@ -0,0 +1,37 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace PostFundManagement.Infrastructure.Database.Migrations
+{
+    /// <inheritdoc />
+    public partial class UpdatedByIsOptionalOnEvidence : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<Guid>(
+                name: "UpdatedBy",
+                table: "Evidences",
+                type: "uuid",
+                nullable: true,
+                oldClrType: typeof(Guid),
+                oldType: "uuid");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<Guid>(
+                name: "UpdatedBy",
+                table: "Evidences",
+                type: "uuid",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"),
+                oldClrType: typeof(Guid),
+                oldType: "uuid",
+                oldNullable: true);
+        }
+    }
+}

PostFundManagement.Infrastructure/Database/Migrations/ApplicationDbContextModelSnapshot.cs

@@ -604,7 +604,7 @@ namespace PostFundManagement.Infrastructure.Database.Migrations
                     b.Property<DateTime?>("UpdatedAt")
                         .HasColumnType("timestamp with time zone");
 
-                    b.Property<Guid>("UpdatedBy")
+                    b.Property<Guid?>("UpdatedBy")
                         .HasColumnType("uuid");
 
                     b.Property<int>("Version")

PostFundManagement.Infrastructure/Database/Services/HeadlessTenantContextService.cs

@@ -0,0 +1,16 @@
+using PostFundManagement.Domain.Abstractions;
+
+namespace PostFundManagement.Infrastructure.Database.Services;
+
+public sealed class HeadlessTenantContextService : ITenantContextService
+{
+    public string? TenantName => "Ifri Technologies";
+
+    public long TenantId => 1;
+
+    public bool ByPassTenantQueryFilter { get; set; } = true;
+
+    public bool IsAdmin => true;
+
+    public bool HasTenantFilter => true;
+}

PostFundManagement.Jobs/Dockerfile

@@ -0,0 +1,40 @@
+# Stage 1: Runtime base
+FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS base
+USER app
+WORKDIR /app
+EXPOSE 8080
+
+# Stage 2: Build & Restore
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+
+# Copy props and csproj files for layer caching
+COPY ["Directory.Build.props", "./"]
+COPY ["Directory.Packages.props", "./"]
+COPY ["PostFundManagement.snk", "./"]
+COPY ["LICENSE", "./"]
+COPY ["PostFundManagement.Jobs/PostFundManagement.Jobs.csproj", "PostFundManagement.Jobs/"]
+COPY ["PostFundManagement.Application/PostFundManagement.Application.csproj", "PostFundManagement.Application/"]
+COPY ["PostFundManagement.Domain/PostFundManagement.Domain.csproj", "PostFundManagement.Domain/"]
+COPY ["PostFundManagement.Infrastructure/PostFundManagement.Infrastructure.csproj", "PostFundManagement.Infrastructure/"]
+
+# Restore packages
+RUN dotnet restore "PostFundManagement.Jobs/PostFundManagement.Jobs.csproj"
+
+# Copy full source code
+COPY . .
+
+# Build from the project folder using relative filename
+WORKDIR "/src/PostFundManagement.Jobs"
+RUN dotnet build "PostFundManagement.Jobs.csproj" -c Release -o /app/build
+
+# Stage 3: Publish
+FROM build AS publish
+ARG BUILD_CONFIGURATION=Release
+RUN dotnet publish "PostFundManagement.Jobs.csproj" -c Release -o /app/publish /p:UseAppHost=false
+
+# Stage 4: Final Runtime
+FROM base AS final
+WORKDIR /app
+COPY --from=publish /app/publish .
+ENTRYPOINT ["dotnet", "PostFundManagement.Jobs.dll"]

PostFundManagement.Jobs/JobsWorker.cs

@@ -0,0 +1,32 @@
+using PostFundManagement.Application.Events;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Configuration.Email;
+
+namespace PostFundManagement.Jobs;
+
+public class JobsWorker(IJobOrchestrator jobOrchestrator, IFeatureManager featureManager,
+    ILogger<JobsWorker> logger, IOptions<SmtpSettings> emailOptions) : BackgroundService
+{
+    readonly SmtpSettings emailSettings = emailOptions.Value;
+
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        if (!await featureManager.IsEnabledAsync(nameof(JobsWorker)))
+        {
+            logger.LogInformation("Recurring job automatic registration disabled.");
+
+            return;
+        }
+
+        if (await featureManager.IsEnabledAsync(FeatureEmailProcessor))
+            await jobOrchestrator.ScheduleAsync(ProcessEmailEvent.Create(), "0 */5 * * * ?", stoppingToken);
+
+        if (await featureManager.IsEnabledAsync(FeatureLateProjectReminder))
+            await jobOrchestrator.ScheduleAsync(LateProjectEvent.Create(), "0 30 6 * * ?", stoppingToken);
+
+        if (await featureManager.IsEnabledAsync(FeatureNonCompliantProjectCheck))
+            await jobOrchestrator.ScheduleAsync(NonCompliantProjectEvent.Create(), "0 0 7 ? * MON", stoppingToken);
+
+        logger.LogInformation("Recurring jobs have been registered or updated.");
+    }
+}

PostFundManagement.Jobs/PostFundManagement.Jobs.csproj

@@ -0,0 +1,31 @@
+<Project Sdk="Microsoft.NET.Sdk.Worker">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <UserSecretsId>dotnet-PostFundManagement.Jobs-97b98845-fddb-4212-b877-8dac9f7f86e3</UserSecretsId>
+  </PropertyGroup>
+
+  <!-- File Nesting -->
+  <ItemGroup>
+    <ProjectCapability Include="ConfigurableFileNesting" />
+    <ProjectCapability Include="ConfigurableFileNestingFeatureEnabled" />
+  </ItemGroup>
+
+  <!-- CQRS Source Generator -->
+  <ItemGroup>
+    <PackageReference Include="Mediator.SourceGenerator">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.Extensions.Hosting" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\PostFundManagement.Application\PostFundManagement.Application.csproj" />
+  </ItemGroup>
+</Project>

PostFundManagement.Jobs/Program.cs

@@ -0,0 +1,40 @@
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Mediator;
+using PostFundManagement.Infrastructure.Database.Services;
+using PostFundManagement.Jobs;
+
+var builder = Host.CreateApplicationBuilder(args);
+
+builder.Services.AddFeatureManagement();
+
+builder.Services.AddSharedServices();
+builder.Services.AddHostedService<JobsWorker>();
+builder.Services.AddRegisterServicesWithCaching(builder.Configuration);
+builder.Services.AddEndpointAndServiceCaching(builder.Configuration);
+builder.Services.AddTransient<ITenantContextService, HeadlessTenantContextService>();
+builder.Services.AddSkorubaApiService(builder.Configuration);
+builder.Services.AddHttpContextAccessor();
+
+builder.Services.AddMediator();
+builder.Services.AddScoped(typeof(IPipelineBehavior<,>), typeof(TelemetryPipelineBehavior<,>));
+builder.Services.AddScoped(typeof(IPipelineBehavior<,>), typeof(LoggingPipelineBehavior<,>));
+
+builder.Services.AddQuartzScheduler(DefaultSchedulerName, builder.Configuration);
+builder.Services.AddEmailServices(builder.Configuration);
+builder.Services.AddHashServices(builder.Configuration);
+builder.Services.AddGarageS3(builder.Configuration);
+
+builder.Services.AddHttpClient();
+builder.Services.AddDataProtectionDatabase(builder.Configuration);
+builder.Services.AddApplicationDbContext(builder.Configuration);
+
+var host = builder.Build();
+
+var schedulerFactory = host.Services.GetRequiredService<ISchedulerFactory>();
+var scheduler = await schedulerFactory.GetScheduler();
+
+if (scheduler!.Status != SchedulerStatus.Running)
+    await scheduler.Start();
+
+host.Run();

PostFundManagement.Jobs/Properties/launchSettings.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json.schemastore.org/launchsettings.json",
+  "profiles": {
+    "PostFundManagement.Jobs": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "environmentVariables": {
+        "DOTNET_ENVIRONMENT": "Development"
+      }
+    }
+  }
+}

PostFundManagement.Jobs/appsettings.json

@@ -0,0 +1,41 @@
+{
+  "FeatureManagement": {
+    "JobsWorker": true,
+    "EmailProcessorJobEnabled": true,
+    "LateProjectReminderEnabled": true,
+    "ServiceCaching": false
+  },
+  "GeneralS3Settings": {
+    "ServiceUrl": "https://s3.garage.khongisa.co.za",
+    "Region": "garage",
+    "BucketName": "pfm",
+    "CdnBaseUrl": "https://pfm.cdn.khongisa.co.za"
+  },
+  "MachineIdentitySettings": {
+    "Authority": "https://sts.security.khongisa.co.za",
+    "Scope": "skoruba_identity_admin_api"
+  },
+  "Monitoring": {
+    "Address": "http://aspire-dashboard-service.aspire.svc.cluster.local:18889",
+    "ServiceName": "Pfm.Jobs.DEV"
+  },
+  "Logging": {
+    "LogLevel": {
+      "Default": "Warning",
+      "Quartz": "Error",
+      "Microsoft.AspNetCore": "Warning",
+      "Microsoft.EntityFrameworkCore.Database": "Error",
+      "Microsoft.EntityFrameworkCore.Update": "Error"
+    }
+  },
+  "Email": {
+    "SmtpServer": "smtp.example.com",
+    "SmtpPort": 587,
+    "SenderEmail": "noreply@example.com",
+    "SenderName": "Example"
+  },
+  "HasherSettings": {
+    "MinHashLength": 11
+  },
+  "AllowedHosts": "*"
+}

PostFundManagement.PartnerUI/.env.example

@@ -1,9 +1,9 @@
 # GEMINI_API_KEY: Required for Gemini AI API calls.
-# AI Studio automatically injects this at runtime from user secrets.
-# Users configure this via the Secrets panel in the AI Studio UI.
 GEMINI_API_KEY="MY_GEMINI_API_KEY"
 
 # APP_URL: The URL where this applet is hosted.
-# AI Studio automatically injects this at runtime with the Cloud Run service URL.
-# Used for self-referential links, OAuth callbacks, and API endpoints.
 APP_URL="MY_APP_URL"
+
+# HasherSettings for HashIds compatibility with backend pfm-api
+VITE_HASHER_MIN_LENGTH="11"
+VITE_HASHER_SALT="TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ=="

PostFundManagement.PartnerUI/docker-entrypoint.sh

@@ -26,22 +26,18 @@ OIDC_AUDIENCE="${VITE_OIDC_AUDIENCE:-${OIDC_AUDIENCE:-${SecuritySettings__Audien
 # 4. OIDC Client ID
 OIDC_CLIENT_ID="${VITE_OIDC_CLIENT_ID:-${OIDC_CLIENT_ID:-${SecuritySettings__ClientId:-${SecuritySettings_ClientId:-${CLIENT_ID:-}}}}}"
 
-# 5. OIDC Client Secret
-OIDC_CLIENT_SECRET="${VITE_OIDC_CLIENT_SECRET:-${OIDC_CLIENT_SECRET:-${SecuritySettings__ClientSecret:-${SecuritySettings_ClientSecret:-${CLIENT_SECRET:-}}}}}"
-
-# 6. OIDC Scope
+# 5. OIDC Scope
 OIDC_SCOPE="${VITE_OIDC_SCOPE:-${OIDC_SCOPE:-${SecuritySettings__Scope:-${SecuritySettings_Scope:-${SCOPE:-}}}}}"
 
-# 7. Hasher Settings
-HASHER_SALT="${VITE_HASHER_SALT:-${HASHER_SALT:-${HasherSettings__Salt:-${HasherSettings_Salt:-}}}}}"
-HASHER_MIN_LENGTH="${VITE_HASHER_MIN_LENGTH:-${HASHER_MIN_LENGTH:-${HasherSettings__MinLength:-${HasherSettings_MinLength:-}}}}}"
+# 6. Hasher Settings (Fix: Exactly 4 closing braces matching the 4 open variable expansions)
+HASHER_MIN_LENGTH="${VITE_HASHER_MIN_LENGTH:-${HASHER_MIN_LENGTH:-${HasherSettings__MinLength:-${HasherSettings_MinLength:-11}}}}"
 
 if [ -d "$TARGET_DIR" ]; then
   echo "[docker-entrypoint] Generating runtime configuration files in $TARGET_DIR..."
 
   # Generate env-config.js for instant, synchronous window.__RUNTIME_CONFIG__ initialization
+  # Public SPA clients: salt secrets and client secrets must NEVER be injected or exposed in public static files.
   cat <<EOF > "$TARGET_DIR/env-config.js"
-// Generated dynamically at container startup from deployment environment variables
 window.__RUNTIME_CONFIG__ = {
   API_BASE_URL: "${API_BASE_URL}",
   VITE_API_BASE_URL: "${API_BASE_URL}",
@@ -51,12 +47,8 @@ window.__RUNTIME_CONFIG__ = {
   VITE_OIDC_AUDIENCE: "${OIDC_AUDIENCE}",
   OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}",
   VITE_OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}",
-  OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}",
-  VITE_OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}",
   OIDC_SCOPE: "${OIDC_SCOPE}",
   VITE_OIDC_SCOPE: "${OIDC_SCOPE}",
-  HASHER_SALT: "${HASHER_SALT}",
-  VITE_HASHER_SALT: "${HASHER_SALT}",
   HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}",
   VITE_HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}",
   ApiSettings: {
@@ -66,11 +58,9 @@ window.__RUNTIME_CONFIG__ = {
     Authority: "${OIDC_AUTHORITY}",
     Audience: "${OIDC_AUDIENCE}",
     ClientId: "${OIDC_CLIENT_ID}",
-    ClientSecret: "${OIDC_CLIENT_SECRET}",
     Scope: "${OIDC_SCOPE}"
   },
   HasherSettings: {
-    Salt: "${HASHER_SALT}",
     MinHashLength: "${HASHER_MIN_LENGTH}"
   }
 };
@@ -86,11 +76,9 @@ EOF
     "Authority": "${OIDC_AUTHORITY}",
     "Audience": "${OIDC_AUDIENCE}",
     "ClientId": "${OIDC_CLIENT_ID}",
-    "ClientSecret": "${OIDC_CLIENT_SECRET}",
     "Scope": "${OIDC_SCOPE}"
   },
   "HasherSettings": {
-    "Salt": "${HASHER_SALT}",
     "MinHashLength": "${HASHER_MIN_LENGTH}"
   }
 }

PostFundManagement.PartnerUI/index.html

@@ -1,5 +1,5 @@
 <!doctype html>
-<html lang="en" class="h-full bg-slate-950 text-slate-100">
+<html lang="en" class="dark h-full bg-slate-950 text-slate-100">
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
@@ -10,8 +10,8 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@300;400;500;600;700;800&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet" />
   </head>
-  <body class="h-full bg-slate-950 font-sans text-slate-100 antialiased selection:bg-emerald-500/20 selection:text-emerald-300">
-    <div id="root" class="min-h-full flex flex-col"></div>
+  <body class="dark h-full bg-slate-950 font-sans text-slate-100 antialiased selection:bg-emerald-500/20 selection:text-emerald-300">
+    <div id="root" class="min-h-full flex flex-col bg-slate-950 text-slate-100"></div>
     <script src="/env-config.js"></script>
     <script type="module" src="/src/main.tsx"></script>
   </body>

PostFundManagement.PartnerUI/public/config.json

@@ -1,16 +1,15 @@
 {
-  "ApiSettings": {
-    "BaseUrl": "https://api.ifri.khongisa.co.za/"
-  },
+  "_comment": "Runtime configuration for Docker/Kubernetes deployments. Leave values empty in source control so local .env (VITE_*) variables are used during development. Container entrypoint scripts can populate these fields at container startup.",
   "SecuritySettings": {
-    "Authority": "https://sts.security.khongisa.co.za",
-    "Audience": "pfm-api-dev",
-    "ClientId": "pfm-scalar-dev",
-    "ClientSecret": "secret_71f88570a46eb22eb5270b47f69e3332c84d8db85d008f0276cb7431c8872d27",
-    "Scope": "openid profile roles email address pfm-api-dev"
+    "Authority": "",
+    "Audience": "",
+    "ClientId": "",
+    "Scope": ""
+  },
+  "ApiSettings": {
+    "BaseUrl": ""
   },
   "HasherSettings": {
-    "Salt": "TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==",
-    "MinHashLength": 11
+    "MinHashLength": "11"
   }
 }

PostFundManagement.PartnerUI/public/env-config.js

@@ -1 +1,9 @@
-window.__RUNTIME_CONFIG__ = window.__RUNTIME_CONFIG__ || {};
+// Runtime configuration for development or container environments
+// Note: Secret values (like hashing salt or client secrets) are not exposed here.
+window.__RUNTIME_CONFIG__ = window.__RUNTIME_CONFIG__ || {
+  HASHER_MIN_LENGTH: "11",
+  VITE_HASHER_MIN_LENGTH: "11",
+  HasherSettings: {
+    MinHashLength: "11"
+  }
+};

PostFundManagement.PartnerUI/src/App.tsx

@@ -2,29 +2,10 @@ import React from 'react';
 import { BrowserRouter, Routes, Route, Navigate } from 'react-router-dom';
 import { QueryClientProvider } from '@tanstack/react-query';
 import { queryClient } from './lib/queryClient';
-import { AuthProvider, useAuth } from './auth/AuthProvider';
+import { AuthProvider, ProtectedRoute, useAuth } from './auth/AuthProvider';
+import { ToastProvider } from './components/ui/Toast';
 import { LandingPage } from './components/landing/LandingPage';
 import { DashboardPage } from './components/dashboard/DashboardPage';
-import { LaserDivider } from './components/layout/LaserDivider';
-
-function AuthenticatedLayout() {
-  return (
-    <div className="h-screen w-screen overflow-hidden bg-slate-950 text-slate-100 flex flex-row select-none">
-      {/* Fixed-width vertical navigation pane on the left */}
-      <aside className="w-64 sm:w-72 md:w-80 shrink-0 h-full relative flex flex-col">
-        {/* Navigation placeholder / empty clean pane */}
-      </aside>
-
-      {/* Laser beam divider with central light source */}
-      <LaserDivider />
-
-      {/* Content pane occupying the rest of the screen */}
-      <main className="flex-1 h-full min-w-0 relative flex flex-col overflow-y-auto">
-        <DashboardPage />
-      </main>
-    </div>
-  );
-}
 
 function AppRoutes() {
   const { isAuthenticated, isLoading, login } = useAuth();
@@ -55,16 +36,14 @@ function AppRoutes() {
       <Route
         path="/dashboard"
         element={
-          isAuthenticated ? (
-            <AuthenticatedLayout />
-          ) : (
-            <LandingPage onLogin={login} isLoading={isLoading} />
-          )
+          <ProtectedRoute>
+            <DashboardPage />
+          </ProtectedRoute>
         }
       />
       <Route
         path="*"
-        element={<Navigate to={isAuthenticated ? "/dashboard" : "/"} replace />}
+        element={<Navigate to={isAuthenticated ? '/dashboard' : '/'} replace />}
       />
     </Routes>
   );
@@ -73,11 +52,13 @@ function AppRoutes() {
 export default function App() {
   return (
     <QueryClientProvider client={queryClient}>
-      <AuthProvider>
-        <BrowserRouter>
-          <AppRoutes />
-        </BrowserRouter>
-      </AuthProvider>
+      <ToastProvider>
+        <AuthProvider>
+          <BrowserRouter>
+            <AppRoutes />
+          </BrowserRouter>
+        </AuthProvider>
+      </ToastProvider>
     </QueryClientProvider>
   );
 }

PostFundManagement.PartnerUI/src/auth/rbac.ts

@@ -0,0 +1,323 @@
+import React, { useMemo } from 'react';
+import { Navigate } from 'react-router-dom';
+import { useAuth } from './AuthProvider';
+
+export type RoleClaim =
+  | 'dashboard'
+  | 'governance'
+  | 'projects_milestones'
+  | 'grant_financials'
+  | 'evidence_risks'
+  | 'beneficiaries'
+  | 'change_management'
+  | 'site_visits'
+  | 'compliance'
+  | 'settings_invites'
+  | 'settings_users'
+  | 'settings_auditlog'
+  | 'settings_notifications'
+  | 'tenant_self_service'
+  | 'tenant_management'
+  | 'unrestricted';
+
+export type ClaimAction = 'view' | 'add' | 'update' | 'export' | 'all';
+
+export interface RoleClaimDefinition {
+  claim: RoleClaim;
+  label: string;
+  description: string;
+}
+
+export const ROLE_CLAIM_DEFINITIONS: RoleClaimDefinition[] = [
+  { claim: 'dashboard', label: 'Partner Dashboard', description: 'Overview of ongoing projects, funding awards, and inbox' },
+  { claim: 'governance', label: 'Governance & Structure', description: 'Holding entities, investment portfolios, and statutory programmes' },
+  { claim: 'projects_milestones', label: 'Projects & Milestones', description: 'Work breakdown structure, scheduled milestones, and progress' },
+  { claim: 'grant_financials', label: 'Grant & Financials', description: 'Funding awards, budget line allocations, and disbursements' },
+  { claim: 'evidence_risks', label: 'M&E, Evidence & Risks', description: 'Evidence submission and risk registers' },
+  { claim: 'beneficiaries', label: 'Beneficiaries', description: 'Target demographics, compliance tracking, and outcomes' },
+  { claim: 'change_management', label: 'Change Management', description: 'Contractual change requests, issues, and enactments' },
+  { claim: 'site_visits', label: 'Site Visits', description: 'Physical field inspection reports and inspector findings' },
+  { claim: 'compliance', label: 'Compliance', description: 'Statutory compliance, outcome fulfillment, and risk monitoring' },
+  { claim: 'settings_invites', label: 'Settings Invites', description: 'Statutory onboarding invitations and applicant notifications' },
+  { claim: 'settings_users', label: 'Settings Users', description: 'Direct user account administration and role memberships' },
+  { claim: 'settings_auditlog', label: 'Settings Audit Log', description: 'System-wide activity ledger and telemetry records' },
+  { claim: 'settings_notifications', label: 'Notifications & Messages', description: 'In-app and email communications with the funding organisation' },
+  { claim: 'tenant_self_service', label: 'Tenant Self-Service', description: 'Tenant configuration parameters and self-managed sub-users' },
+  { claim: 'tenant_management', label: 'Tenant Management', description: 'Multi-tenant partition directory and cross-tenant isolation' },
+  { claim: 'unrestricted', label: 'Unrestricted Access', description: 'Full system-wide control' },
+];
+
+export const CLAIM_ACTION_OPTIONS: { action: ClaimAction; label: string; description: string }[] = [
+  { action: 'view', label: 'view', description: 'Can view records based on role' },
+  { action: 'add', label: 'add', description: 'Can create records or give feedback; change non-approve statuses' },
+  { action: 'update', label: 'update', description: 'Can use approve status change in dropdowns' },
+  { action: 'export', label: 'export', description: 'Can click export buttons (Spreadsheet/PDF)' },
+  { action: 'all', label: 'all', description: 'Can do everything' },
+];
+
+/**
+ * RBAC on PartnerUI ONLY functions for Partner roles.
+ * No other roles (Admin, Executive, Supervisor, Manager, Contributor) are permitted on this app.
+ */
+export const ROLE_CLAIM_MAP: Record<string, RoleClaim[]> = {
+  partner: [
+    'dashboard',
+    'projects_milestones',
+    'grant_financials',
+    'evidence_risks',
+    'beneficiaries',
+    'change_management',
+    'site_visits',
+    'compliance',
+    'settings_notifications',
+  ],
+};
+
+/**
+ * Checks whether the user's roles include the mandatory 'Partner' role.
+ * On PartnerUI, ONLY users with the 'Partner' role are permitted.
+ */
+export function isPartnerRoleOnlyPermitted(roles: string[] = []): boolean {
+  return Array.isArray(roles) && roles.some((r) => r.toLowerCase().trim() === 'partner');
+}
+
+/**
+ * Resolves action capability set given a claim value string for a Partner user.
+ */
+export function resolveClaimActionSet(
+  claimValue: string | null | undefined,
+  roleName?: string
+): Set<ClaimAction> {
+  const actions = new Set<ClaimAction>();
+  if (!claimValue && !roleName) return actions;
+
+  const rawVal = (claimValue || '').toLowerCase().trim();
+  const role = (roleName || '').toLowerCase().trim();
+
+  // Only Partner role is recognized in PartnerUI
+  if (role && role !== 'partner') {
+    return actions;
+  }
+
+  if (rawVal) {
+    if (rawVal === 'all' || rawVal === 'unrestricted' || rawVal === 'true' || rawVal === '1') {
+      actions.add('all');
+      actions.add('view');
+      actions.add('add');
+      actions.add('update');
+      actions.add('export');
+      return actions;
+    }
+    if (rawVal === 'none' || rawVal === 'restricted' || rawVal === 'false' || rawVal === '0') {
+      return actions;
+    }
+
+    const tokens = rawVal.split(',').map((t) => t.trim());
+    for (const val of tokens) {
+      if (val === 'all') {
+        actions.add('all');
+        actions.add('view');
+        actions.add('add');
+        actions.add('update');
+        actions.add('export');
+      } else if (val === 'view' || val === 'read') {
+        actions.add('view');
+      } else if (val === 'add' || val === 'edit' || val === 'write' || val === 'create') {
+        actions.add('view');
+        actions.add('add');
+      } else if (val === 'update' || val === 'approve' || val === 'verify') {
+        actions.add('view');
+        actions.add('add');
+        actions.add('update');
+      } else if (val === 'export') {
+        actions.add('view');
+        actions.add('export');
+      }
+    }
+    return actions;
+  }
+
+  // Default fallback for Partner role: view, add (submit evidence, log activities, send messages, execute contract), export
+  if (role === 'partner') {
+    actions.add('view');
+    actions.add('add');
+    actions.add('export');
+  }
+
+  return actions;
+}
+
+/**
+ * Helper to extract explicit claim value from varied dictionary structures
+ */
+export function extractExplicitClaimValue(
+  claims: Record<string, any> = {},
+  claim: RoleClaim
+): string | null {
+  if (!claims || typeof claims !== 'object') return null;
+
+  if (claims[claim] !== undefined && claims[claim] !== null) {
+    return String(claims[claim]).trim();
+  }
+  if (claims[`role_claim:${claim}`] !== undefined) {
+    return String(claims[`role_claim:${claim}`]).trim();
+  }
+  if (claims[`claim:${claim}`] !== undefined) {
+    return String(claims[`claim:${claim}`]).trim();
+  }
+
+  const noUnderscore = claim.replace(/_/g, '');
+  if (claims[noUnderscore] !== undefined) {
+    return String(claims[noUnderscore]).trim();
+  }
+
+  const arrayCandidates = [
+    claims.claims,
+    claims.UserClaims,
+    claims.user_claims,
+    claims.role_claims,
+  ];
+  for (const arr of arrayCandidates) {
+    if (Array.isArray(arr)) {
+      for (const item of arr) {
+        if (typeof item === 'object' && item !== null) {
+          const type = (item.type || item.claimType || item.name || '').toLowerCase().trim();
+          if (type === claim || type === noUnderscore) {
+            return String(item.value || item.claimValue || 'all').trim();
+          }
+        } else if (typeof item === 'string') {
+          const [type, val] = item.split(':').map((s) => s.trim().toLowerCase());
+          if (type === claim || type === noUnderscore) {
+            return val || 'all';
+          }
+        }
+      }
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Evaluates whether a user with given roles and token claims has permission for a specific claim and action.
+ *
+ * CRITICAL RULE FOR PARTNER UI:
+ * RBAC on PartnerUI ONLY functions for Partner roles. No other roles are permitted on this app.
+ */
+export function evaluateUserPermission(
+  roles: string[] = [],
+  claims: Record<string, any> = {},
+  claim: RoleClaim,
+  action: ClaimAction = 'view'
+): boolean {
+  // Security Gate: Only users with the 'Partner' role are permitted on PartnerUI.
+  const isPartner = isPartnerRoleOnlyPermitted(roles);
+  if (!isPartner) return false;
+
+  // 1. Check if Partner user has explicit claim in claims dictionary
+  const rawClaimValue = extractExplicitClaimValue(claims, claim);
+  if (rawClaimValue !== null && rawClaimValue !== '') {
+    const actionSet = resolveClaimActionSet(rawClaimValue, 'partner');
+    return actionSet.has('all') || actionSet.has(action);
+  }
+
+  // 2. Check Partner base role mappings
+  const allowedClaims = ROLE_CLAIM_MAP['partner'];
+  if (allowedClaims && allowedClaims.includes(claim)) {
+    const actionSet = resolveClaimActionSet(undefined, 'partner');
+    if (actionSet.has('all') || actionSet.has(action)) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Evaluates Maker-Checker separation of duties constraint.
+ */
+export function isRecordMaker(
+  createdBy?: string | null,
+  currentUserId?: string | null,
+  currentUserSub?: string | null,
+  currentUserEmail?: string | null
+): boolean {
+  if (!createdBy) return false;
+  const creator = createdBy.trim().toLowerCase();
+  if (currentUserId && creator === currentUserId.trim().toLowerCase()) return true;
+  if (currentUserSub && creator === currentUserSub.trim().toLowerCase()) return true;
+  if (currentUserEmail && creator === currentUserEmail.trim().toLowerCase()) return true;
+  return false;
+}
+
+/**
+ * React hook exposing RBAC evaluation helpers for PartnerUI components.
+ * Enforces that only the Partner role has permissions in this application.
+ */
+export function useRbac() {
+  const { roles, claims, user, sub } = useAuth();
+
+  const permissions = useMemo(() => {
+    const isPartner = isPartnerRoleOnlyPermitted(roles);
+
+    const canAccess = (claim: RoleClaim, action: ClaimAction = 'view'): boolean => {
+      if (!isPartner) return false;
+      return evaluateUserPermission(roles, claims, claim, action);
+    };
+
+    const canView = (claim: RoleClaim): boolean => canAccess(claim, 'view');
+    const canAdd = (claim: RoleClaim): boolean => canAccess(claim, 'add');
+    const canApprove = (claim: RoleClaim): boolean => canAccess(claim, 'update');
+    const canExport = (claim: RoleClaim): boolean => canAccess(claim, 'export');
+
+    const isMaker = (createdBy?: string | null): boolean => {
+      return isRecordMaker(createdBy, user?.id, sub, user?.email);
+    };
+
+    const canApproveRecord = (claim: RoleClaim, createdBy?: string | null): boolean => {
+      if (!canApprove(claim)) return false;
+      return !isMaker(createdBy);
+    };
+
+    const getApprovalRestrictionReason = (claim: RoleClaim, createdBy?: string | null): string | null => {
+      if (!isPartner) return 'Partner role required';
+      if (!canApprove(claim)) return 'Requires approval permission from the funding organisation';
+      if (isMaker(createdBy)) return 'Maker-Checker policy: Record creators cannot approve their own records';
+      return null;
+    };
+
+    return {
+      isPartner,
+      isUnrestricted: false,
+      canAccess,
+      canView,
+      canAdd,
+      canApprove,
+      canExport,
+      isMaker,
+      canApproveRecord,
+      getApprovalRestrictionReason,
+    };
+  }, [roles, claims, user, sub]);
+
+  return permissions;
+}
+
+/**
+ * Route protection component for claim-restricted screens in PartnerUI.
+ */
+export const ClaimProtectedRoute: React.FC<{
+  claim: RoleClaim;
+  action?: ClaimAction;
+  children: React.ReactNode;
+}> = ({ claim, action = 'view', children }) => {
+  const { canAccess } = useRbac();
+  const allowed = canAccess(claim, action);
+
+  if (!allowed) {
+    return React.createElement(Navigate, { to: '/dashboard', replace: true });
+  }
+
+  return React.createElement(React.Fragment, null, children);
+};
+

PostFundManagement.PartnerUI/src/components/auth/AccountActivationModal.tsx

@@ -0,0 +1,202 @@
+import React, { useState, useEffect } from 'react';
+import { createPortal } from 'react-dom';
+import { useNavigate } from 'react-router-dom';
+import {
+  RefreshCw,
+  LogOut,
+  Building2,
+  Clock,
+  ArrowLeft,
+  Sparkles,
+} from 'lucide-react';
+import { PfmPartnerLogo } from '../common/PfmPartnerLogo';
+import { AuthUserProfile, UserClaims } from '../../auth/AuthProvider';
+import { cancelSessionExpiration, dismissSubordinateModals } from '../../services/sessionExpiration';
+
+interface AccountActivationModalProps {
+  user: AuthUserProfile | null;
+  claims: UserClaims;
+  sub: string;
+  onSync: (force?: boolean) => Promise<{ success: boolean; isUnauthorized?: boolean; errorMessage?: string }>;
+  onLogout: () => Promise<void>;
+  initialError?: string | null;
+}
+
+const formatLockoutMessage = (msg?: string | null): string | null => {
+  if (!msg) return null;
+  const trimmed = msg.trim();
+  if (/^network\s*error$/i.test(trimmed)) {
+    return 'Permission Check';
+  }
+  return trimmed.replace(/network\s*error/gi, 'Permission Check');
+};
+
+export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
+  user,
+  claims,
+  onSync,
+  onLogout,
+  initialError,
+}) => {
+  const navigate = useNavigate();
+  const [isSyncing, setIsSyncing] = useState(false);
+  const [errorMessage, setErrorMessage] = useState<string | null>(formatLockoutMessage(initialError) || null);
+
+  useEffect(() => {
+    if (initialError !== undefined) {
+      setErrorMessage(formatLockoutMessage(initialError));
+    }
+  }, [initialError]);
+
+  useEffect(() => {
+    cancelSessionExpiration();
+    dismissSubordinateModals();
+  }, []);
+
+  const displayName =
+    user?.name ||
+    (claims.name as string) ||
+    (claims.preferred_username as string) ||
+    'Partner';
+
+  const tenant = user?.tenant || (claims.tenant as string) || (claims.org as string) || 'Partner Organisation';
+
+  const handleSyncClick = async () => {
+    if (isSyncing) return;
+    setIsSyncing(true);
+    setErrorMessage(null);
+
+    try {
+      const result = await onSync(true);
+
+      if (result.isUnauthorized) {
+        await onLogout();
+        navigate('/', { replace: true });
+        return;
+      }
+
+      if (!result.success) {
+        setErrorMessage(
+          formatLockoutMessage(
+            result.errorMessage ||
+              'Activation is still being reviewed by your funding administrator. Please check back shortly.'
+          )
+        );
+      }
+    } catch (err: unknown) {
+      const errObj = err as { response?: { status?: number }; message?: string };
+      if (errObj?.response?.status === 401) {
+        await onLogout();
+        navigate('/', { replace: true });
+        return;
+      }
+      setErrorMessage('Permission Check: Unable to verify activation right now. Please try again in a few moments.');
+    } finally {
+      setIsSyncing(false);
+    }
+  };
+
+  const handleSignOut = async () => {
+    await onLogout();
+    navigate('/', { replace: true });
+  };
+
+  const handleNavigateLanding = () => {
+    navigate('/');
+  };
+
+  const modalContent = (
+    <div
+      role="dialog"
+      aria-modal="true"
+      aria-labelledby="activation-modal-title"
+      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 sm:p-6 bg-slate-950/80 backdrop-blur-2xl animate-in fade-in duration-300 select-none overflow-y-auto"
+    >
+      {/* Background ambient lighting matching LandingPage */}
+      <div className="pointer-events-none absolute inset-0 overflow-hidden">
+        <div className="absolute top-1/2 left-1/2 -translate-x-1/2 -translate-y-1/2 w-[500px] h-[500px] bg-gradient-to-tr from-emerald-500/15 via-teal-500/10 to-cyan-500/15 blur-[120px] rounded-full" />
+      </div>
+
+      <div
+        className="relative w-full max-w-md rounded-3xl border border-white/10 bg-slate-900/85 backdrop-blur-xl shadow-[0_25px_60px_rgba(0,0,0,0.85),inset_0_1px_1px_rgba(255,255,255,0.15)] overflow-hidden flex flex-col items-center text-center p-8 sm:p-10 my-auto space-y-6"
+        onClick={(e) => e.stopPropagation()}
+      >
+        {/* Glowing Brand Icon Lockup */}
+        <div className="relative flex items-center justify-center pt-2">
+          <div className="absolute -inset-3 rounded-full bg-emerald-500/20 blur-xl animate-pulse" />
+          <PfmPartnerLogo className="h-16 w-16 drop-shadow-[0_8px_24px_rgba(16,185,129,0.35)] relative z-10" />
+        </div>
+
+        {/* Title & Organization Pill */}
+        <div className="space-y-2">
+          <div className="inline-flex items-center gap-1.5 px-3 py-1 rounded-full bg-emerald-500/10 border border-emerald-500/20 text-[11px] font-semibold text-emerald-300">
+            <Clock className="w-3.5 h-3.5 text-emerald-400" />
+            <span>Activation Pending</span>
+          </div>
+          <h2 id="activation-modal-title" className="text-2xl font-bold tracking-tight text-white">
+            Welcome,{' '}
+            <span className="bg-gradient-to-r from-emerald-300 via-teal-200 to-cyan-300 bg-clip-text text-transparent">
+              {displayName}
+            </span>
+          </h2>
+          <div className="inline-flex items-center gap-1.5 text-xs text-slate-400 font-medium">
+            <Building2 className="w-3.5 h-3.5 text-teal-400 shrink-0" />
+            <span>{tenant}</span>
+          </div>
+        </div>
+
+        {/* Core Friendly Message */}
+        <p className="text-sm text-slate-300 leading-relaxed max-w-sm">
+          Your credentials have been authenticated. Your funding administrator is finalizing your portfolio access.
+        </p>
+
+        {/* Notice badge if check returned not yet ready */}
+        {errorMessage && (
+          <div className="w-full rounded-2xl bg-amber-500/10 border border-amber-500/20 p-3 text-xs text-amber-300/90 leading-relaxed text-center flex items-center justify-center gap-2">
+            <Sparkles className="w-4 h-4 text-amber-400 shrink-0" />
+            <span>{formatLockoutMessage(errorMessage)}</span>
+          </div>
+        )}
+
+        {/* Action Button matching Specular / Landing styling */}
+        <div className="w-full space-y-3 pt-2">
+          <button
+            onClick={handleSyncClick}
+            disabled={isSyncing}
+            type="button"
+            id="activation-sync-btn"
+            className="w-full py-3.5 px-6 rounded-2xl bg-gradient-to-r from-emerald-600 via-teal-600 to-emerald-500 hover:from-emerald-500 hover:to-teal-500 active:scale-[0.99] disabled:opacity-60 disabled:pointer-events-none text-white font-bold text-sm tracking-wide shadow-[0_12px_30px_rgba(16,185,129,0.35),inset_0_1px_1px_rgba(255,255,255,0.3)] hover:shadow-[0_16px_36px_rgba(16,185,129,0.5)] transition-all flex items-center justify-center gap-2 cursor-pointer"
+          >
+            <RefreshCw className={`w-4 h-4 text-emerald-100 ${isSyncing ? 'animate-spin' : ''}`} />
+            <span>{isSyncing ? 'Checking Status...' : 'Check Account Status'}</span>
+          </button>
+
+          {/* Minimal Secondary Actions */}
+          <div className="flex items-center justify-center gap-4 text-xs pt-1">
+            <button
+              onClick={handleNavigateLanding}
+              type="button"
+              className="inline-flex items-center gap-1.5 text-slate-400 hover:text-slate-200 transition-colors py-1 cursor-pointer"
+            >
+              <ArrowLeft className="w-3.5 h-3.5" />
+              <span>Landing Page</span>
+            </button>
+            <span className="text-slate-700">•</span>
+            <button
+              onClick={handleSignOut}
+              type="button"
+              className="inline-flex items-center gap-1.5 text-slate-400 hover:text-rose-400 transition-colors py-1 cursor-pointer"
+            >
+              <LogOut className="w-3.5 h-3.5" />
+              <span>Sign Out</span>
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+
+  return typeof document !== 'undefined'
+    ? createPortal(modalContent, document.body)
+    : modalContent;
+};

PostFundManagement.PartnerUI/src/components/auth/NonPartnerAccessDeniedModal.tsx

@@ -0,0 +1,111 @@
+import React, { useEffect } from 'react';
+import { createPortal } from 'react-dom';
+import { useNavigate } from 'react-router-dom';
+import { ShieldCheck, LogOut, ArrowLeft, Lock } from 'lucide-react';
+import { PfmPartnerLogo } from '../common/PfmPartnerLogo';
+import { AuthUserProfile, UserClaims } from '../../auth/AuthProvider';
+import { cancelSessionExpiration, dismissSubordinateModals } from '../../services/sessionExpiration';
+
+interface NonPartnerAccessDeniedModalProps {
+  user: AuthUserProfile | null;
+  claims: UserClaims;
+  sub: string;
+  roles: string[];
+  onLogout: () => Promise<void>;
+}
+
+export const NonPartnerAccessDeniedModal: React.FC<NonPartnerAccessDeniedModalProps> = ({
+  user,
+  claims,
+  roles,
+  onLogout,
+}) => {
+  const navigate = useNavigate();
+
+  useEffect(() => {
+    cancelSessionExpiration();
+    dismissSubordinateModals();
+  }, []);
+
+  const displayEmail =
+    user?.email ||
+    (claims.email as string) ||
+    (claims['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'] as string) ||
+    'Authenticated User';
+
+  const assignedRolesDisplay = roles.length > 0 ? roles.join(', ') : user?.role || (claims.role as string) || 'Standard User';
+
+  const handleLogoutClick = async () => {
+    await onLogout();
+    navigate('/', { replace: true });
+  };
+
+  const handleLandingClick = () => {
+    navigate('/');
+  };
+
+  const modalContent = (
+    <div
+      role="alertdialog"
+      aria-modal="true"
+      aria-labelledby="non-partner-denied-title"
+      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 bg-slate-950/85 backdrop-blur-2xl animate-in fade-in duration-300 overflow-y-auto"
+    >
+      <div className="pointer-events-none absolute inset-0 overflow-hidden">
+        <div className="absolute top-1/2 left-1/2 -translate-x-1/2 -translate-y-1/2 w-[450px] h-[450px] bg-rose-500/10 blur-[120px] rounded-full" />
+      </div>
+
+      <div
+        className="relative w-full max-w-md rounded-3xl border border-white/10 bg-slate-900/85 backdrop-blur-xl shadow-[0_25px_60px_rgba(0,0,0,0.85),inset_0_1px_1px_rgba(255,255,255,0.15)] overflow-hidden flex flex-col items-center text-center p-8 sm:p-10 my-auto space-y-6"
+        onClick={(e) => e.stopPropagation()}
+      >
+        <div className="relative flex items-center justify-center pt-2">
+          <div className="absolute -inset-3 rounded-full bg-rose-500/20 blur-xl" />
+          <PfmPartnerLogo className="h-16 w-16 drop-shadow-[0_8px_24px_rgba(244,63,94,0.35)] relative z-10" />
+        </div>
+
+        <div className="space-y-2">
+          <div className="inline-flex items-center gap-1.5 px-3 py-1 rounded-full bg-rose-500/10 border border-rose-500/20 text-[11px] font-semibold text-rose-300">
+            <Lock className="w-3.5 h-3.5 text-rose-400" />
+            <span>Partner Access Only</span>
+          </div>
+          <h2 id="non-partner-denied-title" className="text-2xl font-bold tracking-tight text-white">
+            Role Authorization Required
+          </h2>
+        </div>
+
+        <p className="text-sm text-slate-300 leading-relaxed max-w-sm">
+          This portal is reserved for registered Grantee and Partner accounts. Your current profile (<strong className="text-rose-300">{assignedRolesDisplay}</strong>) does not have access.
+        </p>
+
+        <div className="w-full rounded-2xl bg-slate-950/50 border border-white/5 p-3 text-xs text-slate-400 font-mono truncate">
+          Signed in as {displayEmail}
+        </div>
+
+        <div className="w-full space-y-3 pt-2">
+          <button
+            onClick={handleLogoutClick}
+            type="button"
+            className="w-full py-3.5 px-6 rounded-2xl bg-gradient-to-r from-rose-600 via-rose-500 to-amber-600 hover:from-rose-500 hover:to-amber-500 text-white font-bold text-sm tracking-wide shadow-[0_12px_30px_rgba(244,63,94,0.35),inset_0_1px_1px_rgba(255,255,255,0.3)] hover:shadow-[0_16px_36px_rgba(244,63,94,0.5)] transition-all flex items-center justify-center gap-2 cursor-pointer"
+          >
+            <LogOut className="w-4 h-4 text-rose-100" />
+            <span>Switch Account / Sign Out</span>
+          </button>
+
+          <button
+            onClick={handleLandingClick}
+            type="button"
+            className="inline-flex items-center gap-1.5 text-xs text-slate-400 hover:text-slate-200 transition-colors py-1 cursor-pointer"
+          >
+            <ArrowLeft className="w-3.5 h-3.5" />
+            <span>Return to Landing Page</span>
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+
+  return typeof document !== 'undefined'
+    ? createPortal(modalContent, document.body)
+    : modalContent;
+};

PostFundManagement.PartnerUI/src/components/auth/SessionExpiredModal.tsx

@@ -0,0 +1,153 @@
+import React, { useEffect, useState, useRef } from 'react';
+import { createPortal } from 'react-dom';
+import { Clock, LogOut, RefreshCw } from 'lucide-react';
+import { PfmPartnerLogo } from '../common/PfmPartnerLogo';
+import { clearSessionAndRedirectToLanding, dismissSubordinateModals } from '../../services/sessionExpiration';
+
+interface SessionExpiredModalProps {
+  isOpen: boolean;
+  onDismiss?: () => void;
+  reason?: string | null;
+  countdownSeconds?: number;
+}
+
+export const SessionExpiredModal: React.FC<SessionExpiredModalProps> = ({
+  isOpen,
+  onDismiss,
+  reason,
+  countdownSeconds = 8,
+}) => {
+  const [timeLeftMs, setTimeLeftMs] = useState(countdownSeconds * 1000);
+  const [isPaused, setIsPaused] = useState(false);
+  const totalDurationMs = countdownSeconds * 1000;
+  const isClearingRef = useRef(false);
+
+  useEffect(() => {
+    if (isOpen) {
+      dismissSubordinateModals();
+    }
+  }, [isOpen]);
+
+  useEffect(() => {
+    const handleCancelled = () => {
+      setTimeLeftMs(countdownSeconds * 1000);
+      setIsPaused(false);
+      isClearingRef.current = false;
+    };
+    window.addEventListener('pfm:session-expired-cancelled', handleCancelled);
+    return () => {
+      window.removeEventListener('pfm:session-expired-cancelled', handleCancelled);
+    };
+  }, [countdownSeconds]);
+
+  useEffect(() => {
+    if (!isOpen) {
+      setTimeLeftMs(countdownSeconds * 1000);
+      setIsPaused(false);
+      isClearingRef.current = false;
+      return;
+    }
+
+    const intervalMs = 50;
+    const interval = setInterval(() => {
+      setTimeLeftMs((prev) => {
+        if (isPaused) return prev;
+        const next = prev - intervalMs;
+        if (next <= 0) {
+          clearInterval(interval);
+          handleAction();
+          return 0;
+        }
+        return next;
+      });
+    }, intervalMs);
+
+    return () => clearInterval(interval);
+  }, [isOpen, isPaused, countdownSeconds]);
+
+  const handleAction = () => {
+    if (isClearingRef.current) return;
+    isClearingRef.current = true;
+
+    if (onDismiss) {
+      onDismiss();
+    } else {
+      clearSessionAndRedirectToLanding();
+    }
+  };
+
+  if (!isOpen) return null;
+
+  const secondsRemaining = Math.max(0, Math.ceil(timeLeftMs / 1000));
+  const progressPercent = Math.max(0, Math.min(100, (timeLeftMs / totalDurationMs) * 100));
+
+  const modalContent = (
+    <div
+      id="session-expired-modal-backdrop"
+      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 bg-slate-950/85 backdrop-blur-2xl animate-in fade-in duration-300 overflow-y-auto"
+      onMouseEnter={() => setIsPaused(true)}
+      onMouseLeave={() => setIsPaused(false)}
+      role="dialog"
+      aria-modal="true"
+      aria-labelledby="session-expired-title"
+    >
+      <div className="pointer-events-none absolute inset-0 overflow-hidden">
+        <div className="absolute top-1/2 left-1/2 -translate-x-1/2 -translate-y-1/2 w-[450px] h-[450px] bg-amber-500/10 blur-[120px] rounded-full" />
+      </div>
+
+      <div
+        id="session-expired-modal-content"
+        className="relative w-full max-w-md rounded-3xl border border-white/10 bg-slate-900/85 backdrop-blur-xl shadow-[0_25px_60px_rgba(0,0,0,0.85),inset_0_1px_1px_rgba(255,255,255,0.15)] overflow-hidden flex flex-col items-center text-center p-8 sm:p-10 my-auto space-y-6"
+      >
+        <div className="relative flex items-center justify-center pt-2">
+          <div className="absolute -inset-3 rounded-full bg-amber-500/20 blur-xl" />
+          <PfmPartnerLogo className="h-16 w-16 drop-shadow-[0_8px_24px_rgba(245,158,11,0.35)] relative z-10" />
+        </div>
+
+        <div className="space-y-2">
+          <div className="inline-flex items-center gap-1.5 px-3 py-1 rounded-full bg-amber-500/10 border border-amber-500/20 text-[11px] font-semibold text-amber-300">
+            <Clock className="w-3.5 h-3.5 text-amber-400" />
+            <span>Session Expired</span>
+          </div>
+          <h2 id="session-expired-title" className="text-2xl font-bold tracking-tight text-white">
+            Security Session Ended
+          </h2>
+        </div>
+
+        <p className="text-sm text-slate-300 leading-relaxed max-w-sm">
+          {reason
+            ? reason.replace(/network\s*error/gi, 'Permission Check')
+            : 'Your security credentials have expired for your protection. Please sign in again to continue.'}
+        </p>
+
+        {/* Smooth Countdown Bar */}
+        <div className="w-full space-y-2">
+          <div className="h-1.5 w-full bg-slate-800 rounded-full overflow-hidden">
+            <div
+              className="h-full bg-gradient-to-r from-emerald-400 to-teal-400 transition-all duration-75 ease-linear rounded-full"
+              style={{ width: `${progressPercent}%` }}
+            />
+          </div>
+          <span className="text-[11px] text-slate-400 font-mono">
+            Redirecting in {secondsRemaining}s
+          </span>
+        </div>
+
+        <div className="w-full pt-1">
+          <button
+            onClick={handleAction}
+            type="button"
+            className="w-full py-3.5 px-6 rounded-2xl bg-gradient-to-r from-emerald-600 via-teal-600 to-emerald-500 hover:from-emerald-500 hover:to-teal-500 text-white font-bold text-sm tracking-wide shadow-[0_12px_30px_rgba(16,185,129,0.35),inset_0_1px_1px_rgba(255,255,255,0.3)] hover:shadow-[0_16px_36px_rgba(16,185,129,0.5)] transition-all flex items-center justify-center gap-2 cursor-pointer"
+          >
+            <RefreshCw className="w-4 h-4 text-emerald-100" />
+            <span>Sign In Again Now</span>
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+
+  return typeof document !== 'undefined'
+    ? createPortal(modalContent, document.body)
+    : modalContent;
+};

PostFundManagement.PartnerUI/src/components/dashboard/EvidenceUploadModal.tsx

@@ -1,23 +1,33 @@
-import React, { useState } from 'react';
-import { api, extractApiErrors } from '../../services/api';
-import { Activity, Milestone, Project, EvidenceType } from '../../services/api/models';
-import { 
-  X, 
-  UploadCloud, 
-  FileText, 
-  CheckCircle2, 
-  AlertTriangle, 
-  Loader2, 
-  Plus, 
+import React, { useState, useEffect } from 'react';
+import { createPortal } from 'react-dom';
+import { useQuery } from '@tanstack/react-query';
+import {
+  uploadEvidenceFile,
+  extractApiErrors,
+  toIntegerId,
+  getProjectIndicators,
+  recordIndicatorActual,
+} from '../../services/api';
+import { Activity, Milestone, Project, Indicator } from '../../services/api/models';
+import { EVIDENCE_TYPE_OPTIONS } from '../../lib/formatters';
+import {
+  X,
+  UploadCloud,
+  FileText,
+  CheckCircle2,
+  AlertTriangle,
+  Loader2,
+  Plus,
   Sparkles,
-  Link as LinkIcon
+  Target,
+  BarChart3,
 } from 'lucide-react';
 
 interface EvidenceUploadModalProps {
   isOpen: boolean;
   onClose: () => void;
   project: Project;
-  milestone?: Milestone;
+  milestone?: Milestone | null;
   activity: Activity;
   onEvidenceUploaded: () => void;
 }
@@ -32,14 +42,45 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
 }) => {
   const [selectedFile, setSelectedFile] = useState<File | null>(null);
   const [title, setTitle] = useState('');
-  const [documentUrl, setDocumentUrl] = useState('');
-  const [evidenceType, setEvidenceType] = useState<EvidenceType>(1); // Invoice / Document
+  const [evidenceType, setEvidenceType] = useState<number>(4); // Default: FinancialInvoiceOrReceipt
   const [description, setDescription] = useState('');
+  const [selectedIndicatorId, setSelectedIndicatorId] = useState<string>('');
+  const [actualAmount, setActualAmount] = useState<string>('');
   const [isSubmitting, setIsSubmitting] = useState(false);
   const [errorMessages, setErrorMessages] = useState<string[]>([]);
   const [successMessage, setSuccessMessage] = useState<string | null>(null);
 
-  if (!isOpen) return null;
+  const projectId = project?.id || 0;
+
+  // Requirement #4: Fetch linked indicators for project & activity
+  const { data: projectIndicators = [], isLoading: isLoadingIndicators } = useQuery<Indicator[]>({
+    queryKey: ['evidence-project-indicators', String(projectId)],
+    queryFn: () => getProjectIndicators(projectId),
+    enabled: isOpen && Boolean(projectId),
+  });
+
+  // Prioritize indicators directly linked to this activity, then project indicators
+  const availableIndicators = React.useMemo(() => {
+    if (!projectIndicators || projectIndicators.length === 0) return [];
+    const directMatches = projectIndicators.filter(
+      ind => ind.activityId && String(ind.activityId) === String(activity.id)
+    );
+    if (directMatches.length > 0) return directMatches;
+    return projectIndicators;
+  }, [projectIndicators, activity.id]);
+
+  // Auto-select first indicator if available
+  useEffect(() => {
+    if (availableIndicators.length > 0 && !selectedIndicatorId) {
+      const firstId = String(availableIndicators[0].id);
+      setSelectedIndicatorId(firstId);
+      if (availableIndicators[0].actualAmount !== undefined) {
+        setActualAmount(String(availableIndicators[0].actualAmount || ''));
+      }
+    }
+  }, [availableIndicators, selectedIndicatorId]);
+
+  if (!isOpen || typeof document === 'undefined') return null;
 
   const handleFileChange = (e: React.ChangeEvent<HTMLInputElement>) => {
     if (e.target.files && e.target.files[0]) {
@@ -51,66 +92,94 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
     }
   };
 
+  const selectedIndicatorObj = availableIndicators.find(
+    i => String(i.id) === String(selectedIndicatorId)
+  );
+
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault();
     setErrorMessages([]);
     setSuccessMessage(null);
 
-    if (!title.trim() && !selectedFile && !documentUrl.trim()) {
-      setErrorMessages(['Please provide an evidence title, file upload, or document URL.']);
+    if (!selectedFile) {
+      setErrorMessages(['A supporting document file is required. Please choose a file to upload.']);
+      return;
+    }
+
+    const numProjectId = toIntegerId(project.id);
+    const numActivityId = toIntegerId(activity.id);
+    const numMilestoneId = toIntegerId(milestone?.id || activity.milestoneId || 0);
+    const numIndicatorId = toIntegerId(selectedIndicatorId);
+
+    // Requirement #4: IndicatorId must not be 0 to maintain referential integrity in database
+    if (!numIndicatorId || numIndicatorId <= 0) {
+      setErrorMessages([
+        'A valid linked Indicator is mandatory for evidence verification. Please select an indicator from the list.',
+      ]);
+      return;
+    }
+
+    if (!actualAmount.trim() || isNaN(Number(actualAmount))) {
+      setErrorMessages([
+        'Recording an Actual amount/metric against the selected indicator is mandatory. Please provide a numeric value.',
+      ]);
+      return;
+    }
+
+    if (!numProjectId || !numActivityId) {
+      setErrorMessages(['Cannot upload evidence: Missing projectId or activityId reference.']);
       return;
     }
 
     setIsSubmitting(true);
 
     try {
-      // Build upload payload
+      // 1. Build multipart/form-data adhering strictly to EvidenceService.CreateEvidenceAsync
+      // Requirement #7: When uploading, IForm does not need the userId field in it; API detects userId from JWT sub
       const formData = new FormData();
-      if (selectedFile) {
-        formData.append('file', selectedFile);
-      }
-      formData.append('title', title.trim() || selectedFile?.name || 'Evidence Deliverable');
-      formData.append('projectId', String(project.id || ''));
-      if (milestone?.id) formData.append('milestoneId', String(milestone.id));
-      if (activity?.id) formData.append('activityId', String(activity.id));
-      formData.append('type', String(evidenceType));
-      if (documentUrl.trim()) formData.append('documentUrl', documentUrl.trim());
-      if (description.trim()) formData.append('description', description.trim());
-
-      // Also support JSON payload fallback if server expects JSON body
-      try {
-        await api.evidence.createEvidenceFile(formData);
-      } catch (err: any) {
-        // Fallback: Attempt JSON payload if multipart failed or route expects JSON
-        const jsonPayload = {
-          projectId: project.id,
-          milestoneId: milestone?.id,
-          activityId: activity.id,
-          title: title.trim() || selectedFile?.name || 'Evidence Deliverable',
-          type: evidenceType,
-          documentUrl: documentUrl.trim() || (selectedFile ? `s3://evidence/${selectedFile.name}` : undefined),
-          description: description.trim(),
-        };
-        await api.evidence.createEvidenceFile(jsonPayload);
+      formData.append('file', selectedFile);
+      formData.append('projectId', String(numProjectId));
+      formData.append('activityId', String(numActivityId));
+      formData.append('milestoneId', String(numMilestoneId));
+      formData.append('indicatorId', String(numIndicatorId));
+      formData.append('type', String(Number(evidenceType) || 4));
+      formData.append('title', title.trim() || selectedFile.name);
+      if (description.trim()) {
+        formData.append('description', description.trim());
       }
 
-      setSuccessMessage('Evidence successfully uploaded and linked to activity!');
+      // 2. Upload evidence file
+      await uploadEvidenceFile(formData);
+
+      // 3. Requirement #4: Record Actual against linked indicator
+      const parsedActual = Number(actualAmount);
+      if (!isNaN(parsedActual)) {
+        try {
+          await recordIndicatorActual(numIndicatorId, parsedActual);
+        } catch (indErr) {
+          console.warn('[Record Indicator Actual Warning]:', indErr);
+        }
+      }
+
+      setSuccessMessage('Evidence successfully uploaded and linked to activity with recorded indicator actual!');
       setTimeout(() => {
         onEvidenceUploaded();
         onClose();
-      }, 1000);
+      }, 800);
     } catch (err: any) {
       console.error('[Evidence Upload Error]:', err);
       const errors = extractApiErrors(err);
-      setErrorMessages(errors);
+      setErrorMessages(
+        errors.length > 0 ? errors : ['Failed to upload evidence file. Please verify parameters and try again.']
+      );
     } finally {
       setIsSubmitting(false);
     }
   };
 
-  return (
-    <div className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-slate-950/80 backdrop-blur-md animate-in fade-in duration-200">
-      <div className="relative w-full max-w-lg rounded-3xl border border-white/15 bg-slate-900/95 p-6 shadow-2xl backdrop-blur-2xl text-slate-100 overflow-hidden">
+  return createPortal(
+    <div className="fixed inset-0 z-[9999] flex items-center justify-center p-4 bg-slate-950/80 backdrop-blur-md animate-in fade-in duration-200 overflow-y-auto">
+      <div className="relative w-full max-w-lg rounded-3xl border border-white/15 bg-slate-900/95 p-6 shadow-2xl backdrop-blur-2xl text-slate-100 overflow-hidden my-auto">
         {/* Ambient background glow */}
         <div className="absolute top-0 right-0 -mr-16 -mt-16 w-60 h-60 bg-emerald-500/10 rounded-full blur-3xl pointer-events-none" />
 
@@ -124,6 +193,7 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
             <h3 className="text-base font-bold text-white">Upload Activity Deliverable</h3>
           </div>
           <button
+            type="button"
             onClick={onClose}
             className="p-1.5 rounded-xl hover:bg-white/10 text-slate-400 hover:text-white transition-colors cursor-pointer"
           >
@@ -146,12 +216,12 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
           </div>
         </div>
 
-        {/* Error Alerts (Comma-delimited error list from ProblemDetails) */}
+        {/* Error Alerts */}
         {errorMessages.length > 0 && (
           <div className="mb-4 p-3.5 rounded-2xl bg-rose-950/60 border border-rose-500/30 text-rose-200 text-xs space-y-1">
             <div className="flex items-center gap-1.5 font-bold text-rose-300">
               <AlertTriangle className="w-4 h-4 text-rose-400 shrink-0" />
-              <span>Validation Notice ({errorMessages.length} issue{errorMessages.length > 1 ? 's' : ''}):</span>
+              <span>Upload Notice ({errorMessages.length} issue{errorMessages.length > 1 ? 's' : ''}):</span>
             </div>
             <ul className="list-disc pl-5 space-y-0.5 text-[11px] text-rose-200/90 font-mono">
               {errorMessages.map((msg, idx) => (
@@ -173,10 +243,13 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
         <form onSubmit={handleSubmit} className="space-y-4 text-xs">
           {/* File Dropzone */}
           <div>
-            <label className="block text-slate-300 font-medium mb-1.5">Evidence File (Document, Receipt, Report)</label>
+            <label className="block text-slate-300 font-medium mb-1.5">
+              Evidence File (Document, Invoice, Certificate, Photo) <span className="text-emerald-400">*</span>
+            </label>
             <div className="relative border-2 border-dashed border-white/15 hover:border-emerald-500/50 rounded-2xl p-4 text-center bg-white/[0.02] hover:bg-emerald-500/[0.02] transition-colors cursor-pointer">
               <input
                 type="file"
+                required
                 onChange={handleFileChange}
                 className="absolute inset-0 w-full h-full opacity-0 cursor-pointer"
               />
@@ -193,23 +266,88 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
                   </div>
                 ) : (
                   <div>
-                    <span className="font-medium text-slate-300">Click to upload file</span>
-                    <p className="text-[11px] text-slate-500 mt-0.5">PDF, DOCX, XLSX, PNG, JPG (Max 25MB)</p>
+                    <span className="font-medium text-slate-300">Click to choose document</span>
+                    <p className="text-[11px] text-slate-500 mt-0.5">
+                      PDF, DOCX, XLSX, PNG, JPG (Multiple uploads supported)
+                    </p>
                   </div>
                 )}
               </div>
             </div>
           </div>
 
+          {/* Requirement #4: Mandatory Indicator Selection & Actual Amount Recording */}
+          <div className="p-3.5 rounded-2xl bg-slate-950/80 border border-emerald-500/30 space-y-3">
+            <div className="flex items-center gap-2 text-emerald-400 font-semibold text-xs">
+              <Target className="w-4 h-4" />
+              <span>Linked Indicator & Performance Actual (Mandatory)</span>
+            </div>
+
+            <div>
+              <label className="block text-slate-300 font-medium mb-1">
+                Select Linked Indicator <span className="text-emerald-400">*</span>
+              </label>
+              {isLoadingIndicators ? (
+                <div className="text-[11px] text-slate-400 py-1">Loading indicators...</div>
+              ) : availableIndicators.length === 0 ? (
+                <div className="text-[11px] text-amber-300 bg-amber-950/40 border border-amber-500/30 p-2.5 rounded-xl">
+                  No indicators currently recorded for this project. Please contact programme management or select standard output.
+                </div>
+              ) : (
+                <select
+                  required
+                  value={selectedIndicatorId}
+                  onChange={e => setSelectedIndicatorId(e.target.value)}
+                  className="w-full px-3 py-2 rounded-xl bg-slate-900 border border-white/10 text-slate-100 focus:outline-none focus:border-emerald-500/50 cursor-pointer"
+                >
+                  <option value="">-- Choose Indicator for this Deliverable --</option>
+                  {availableIndicators.map(ind => (
+                    <option key={ind.id} value={ind.id} className="bg-slate-900 text-slate-100">
+                      {ind.name || `Indicator #${ind.id}`} (Target: {ind.targetAmount} • Baseline: {ind.baselineAmount})
+                    </option>
+                  ))}
+                </select>
+              )}
+            </div>
+
+            <div>
+              <label className="block text-slate-300 font-medium mb-1">
+                Actual Amount / Metric Recorded <span className="text-emerald-400">*</span>
+              </label>
+              <div className="relative">
+                <input
+                  type="number"
+                  step="any"
+                  min="0"
+                  required
+                  placeholder={
+                    selectedIndicatorObj
+                      ? `Target is ${selectedIndicatorObj.targetAmount}`
+                      : 'e.g. 10 or 1500'
+                  }
+                  value={actualAmount}
+                  onChange={e => setActualAmount(e.target.value)}
+                  className="w-full px-3.5 py-2 rounded-xl bg-slate-900 border border-white/10 text-slate-100 placeholder:text-slate-500 focus:outline-none focus:border-emerald-500/50"
+                />
+                <BarChart3 className="w-4 h-4 text-emerald-400 absolute right-3 top-1/2 -translate-y-1/2 pointer-events-none" />
+              </div>
+              {selectedIndicatorObj && (
+                <p className="text-[11px] text-slate-400 mt-1">
+                  Baseline: {selectedIndicatorObj.baselineAmount} • Target: {selectedIndicatorObj.targetAmount} • Current Actual: {selectedIndicatorObj.actualAmount}
+                </p>
+              )}
+            </div>
+          </div>
+
           {/* Evidence Title & Type */}
           <div className="grid grid-cols-1 sm:grid-cols-2 gap-3">
             <div>
               <label className="block text-slate-300 font-medium mb-1">Evidence Title</label>
               <input
                 type="text"
-                placeholder="e.g. Audit Signoff Dossier"
+                placeholder="e.g. Activity Verification Proof"
                 value={title}
-                onChange={(e) => setTitle(e.target.value)}
+                onChange={e => setTitle(e.target.value)}
                 className="w-full px-3 py-2 rounded-xl bg-slate-950/70 border border-white/10 text-slate-200 placeholder:text-slate-500 focus:outline-none focus:border-emerald-500/50"
               />
             </div>
@@ -217,42 +355,26 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
               <label className="block text-slate-300 font-medium mb-1">Evidence Type</label>
               <select
                 value={evidenceType}
-                onChange={(e) => setEvidenceType(Number(e.target.value) as EvidenceType)}
+                onChange={e => setEvidenceType(Number(e.target.value))}
                 className="w-full px-3 py-2 rounded-xl bg-slate-950/70 border border-white/10 text-slate-200 focus:outline-none focus:border-emerald-500/50 cursor-pointer"
               >
-                <option value={0}>Document</option>
-                <option value={1}>Invoice</option>
-                <option value={2}>Receipt</option>
-                <option value={3}>Site Photo</option>
-                <option value={4}>Verification Report</option>
-                <option value={5}>Other Deliverable</option>
+                {EVIDENCE_TYPE_OPTIONS.map(opt => (
+                  <option key={opt.value} value={opt.value} className="bg-slate-900 text-slate-100">
+                    {opt.label}
+                  </option>
+                ))}
               </select>
             </div>
           </div>
 
-          {/* External Secure URL (Optional) */}
-          <div>
-            <label className="block text-slate-300 font-medium mb-1">Document Link / S3 URI (Optional)</label>
-            <div className="relative">
-              <LinkIcon className="w-3.5 h-3.5 absolute left-3 top-1/2 -translate-y-1/2 text-slate-400" />
-              <input
-                type="text"
-                placeholder="https://... or s3://..."
-                value={documentUrl}
-                onChange={(e) => setDocumentUrl(e.target.value)}
-                className="w-full pl-8 pr-3 py-2 rounded-xl bg-slate-950/70 border border-white/10 text-slate-200 placeholder:text-slate-500 focus:outline-none focus:border-emerald-500/50"
-              />
-            </div>
-          </div>
-
           {/* Description / Notes */}
           <div>
-            <label className="block text-slate-300 font-medium mb-1">Deliverable Notes</label>
+            <label className="block text-slate-300 font-medium mb-1">Deliverable Notes (Optional)</label>
             <textarea
               rows={2}
               placeholder="Provide verification notes or audit references..."
               value={description}
-              onChange={(e) => setDescription(e.target.value)}
+              onChange={e => setDescription(e.target.value)}
               className="w-full px-3 py-2 rounded-xl bg-slate-950/70 border border-white/10 text-slate-200 placeholder:text-slate-500 focus:outline-none focus:border-emerald-500/50 resize-none"
             />
           </div>
@@ -280,13 +402,14 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
               ) : (
                 <>
                   <Plus className="w-4 h-4" />
-                  <span>Upload & Attach Evidence</span>
+                  <span>Upload & Record Actual</span>
                 </>
               )}
             </button>
           </div>
         </form>
       </div>
-    </div>
+    </div>,
+    document.body
   );
 };

PostFundManagement.PartnerUI/src/components/dashboard/GovernanceInfoModal.tsx

@@ -0,0 +1,483 @@
+import React, { useState, useMemo } from 'react';
+import { createPortal } from 'react-dom';
+import { useQuery } from '@tanstack/react-query';
+import {
+  X,
+  ShieldAlert,
+  ShieldCheck,
+  AlertTriangle,
+  Scale,
+  FileCheck,
+  Info,
+  Calendar,
+  User,
+  Users,
+  CheckCircle2,
+  Clock,
+  Layers,
+  Sparkles,
+  Filter,
+  MapPin,
+  Target,
+} from 'lucide-react';
+import {
+  Project,
+  Milestone,
+  Activity,
+  ComplianceItem,
+  Risk,
+  Rule,
+  Beneficiary,
+  ComplianceStatus,
+} from '../../services/api/models';
+import {
+  getProjectComplianceItems,
+  getProjectBeneficiaries,
+  getProjectRisks,
+  getRules,
+} from '../../services/api';
+import { formatDate } from '../../lib/formatters';
+
+interface GovernanceInfoModalProps {
+  isOpen: boolean;
+  onClose: () => void;
+  project: Project;
+  milestone?: Milestone | null;
+  activity?: Activity | null;
+  initialTab?: 'compliance' | 'beneficiaries' | 'risks' | 'rules';
+}
+
+export const GovernanceInfoModal: React.FC<GovernanceInfoModalProps> = ({
+  isOpen,
+  onClose,
+  project,
+  milestone,
+  activity,
+  initialTab = 'compliance',
+}) => {
+  const [activeTab, setActiveTab] = useState<'compliance' | 'beneficiaries' | 'risks' | 'rules'>(initialTab);
+  const [selectedBeneficiaryFilter, setSelectedBeneficiaryFilter] = useState<string>('ALL');
+
+  const projectId = project?.id || 0;
+
+  // 1. Fetch compliance items for project
+  const { data: complianceItems = [], isLoading: isLoadingCompliance } = useQuery<ComplianceItem[]>({
+    queryKey: ['governance-compliance', String(projectId)],
+    queryFn: () => getProjectComplianceItems(projectId),
+    enabled: isOpen && Boolean(projectId),
+  });
+
+  // 2. Fetch beneficiaries for project (Requirement: explore compliance items by beneficiary)
+  const { data: projectBeneficiaries = [], isLoading: isLoadingBeneficiaries } = useQuery<Beneficiary[]>({
+    queryKey: ['governance-beneficiaries', String(projectId)],
+    queryFn: () => getProjectBeneficiaries(projectId),
+    enabled: isOpen && Boolean(projectId),
+  });
+
+  // 3. Fetch risks for project
+  const { data: projectRisks = [], isLoading: isLoadingRisks } = useQuery<Risk[]>({
+    queryKey: ['governance-risks', String(projectId)],
+    queryFn: () => getProjectRisks(projectId),
+    enabled: isOpen && Boolean(projectId),
+  });
+
+  // 4. Fetch associated governance rules
+  const { data: governanceRules = [], isLoading: isLoadingRules } = useQuery<Rule[]>({
+    queryKey: ['governance-rules'],
+    queryFn: () => getRules({ page: 1, pageSize: 100 }),
+    enabled: isOpen,
+  });
+
+  // Map of beneficiary by ID for fast lookup
+  const beneficiaryMap = useMemo(() => {
+    const map = new Map<string, Beneficiary>();
+    for (const b of projectBeneficiaries) {
+      if (b && b.id !== undefined && b.id !== null) {
+        map.set(String(b.id), b);
+      }
+    }
+    return map;
+  }, [projectBeneficiaries]);
+
+  // Filter compliance items by selected beneficiary
+  const filteredComplianceItems = useMemo(() => {
+    if (selectedBeneficiaryFilter === 'ALL') {
+      return complianceItems;
+    }
+    if (selectedBeneficiaryFilter === 'PROJECT_WIDE') {
+      return complianceItems.filter(
+        item => !item.beneficiaryId || Number(item.beneficiaryId) === 0
+      );
+    }
+    return complianceItems.filter(
+      item => String(item.beneficiaryId) === selectedBeneficiaryFilter
+    );
+  }, [complianceItems, selectedBeneficiaryFilter]);
+
+  if (!isOpen || typeof document === 'undefined') return null;
+
+  const renderComplianceStatus = (status?: number) => {
+    const s = Number(status);
+    if (s === ComplianceStatus.Met || s === ComplianceStatus.Exceeded) {
+      return (
+        <span className="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-full text-[10px] font-bold bg-emerald-500/15 text-emerald-300 border border-emerald-500/30">
+          <CheckCircle2 className="w-3 h-3 text-emerald-400" />
+          <span>{s === ComplianceStatus.Exceeded ? 'Exceeded' : 'Compliant'}</span>
+        </span>
+      );
+    }
+    return (
+      <span className="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-full text-[10px] font-bold bg-rose-500/15 text-rose-300 border border-rose-500/30">
+        <AlertTriangle className="w-3 h-3 text-rose-400" />
+        <span>Action Required (Not Met)</span>
+      </span>
+    );
+  };
+
+  return createPortal(
+    <div className="fixed inset-0 z-[9999] flex items-center justify-center p-4 sm:p-6 bg-slate-950/85 backdrop-blur-md animate-in fade-in duration-200 overflow-y-auto">
+      <div className="relative w-full max-w-4xl rounded-3xl border border-white/10 bg-slate-900 shadow-2xl p-6 sm:p-8 space-y-6 my-auto text-slate-100 max-h-[90vh] flex flex-col">
+        {/* Modal Header */}
+        <div className="flex items-start justify-between border-b border-white/[0.08] pb-4 shrink-0">
+          <div className="space-y-1">
+            <div className="flex items-center gap-2 flex-wrap">
+              <span className="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-md text-[10px] font-mono font-bold bg-emerald-500/15 text-emerald-300 border border-emerald-500/30">
+                <ShieldAlert className="w-3 h-3 text-emerald-400" />
+                <span>Governance & Compliance Guidance</span>
+              </span>
+              {activity ? (
+                <span className="text-[11px] text-slate-400 font-mono">Activity: {activity.title}</span>
+              ) : milestone ? (
+                <span className="text-[11px] text-slate-400 font-mono">Milestone: {milestone.name}</span>
+              ) : (
+                <span className="text-[11px] text-slate-400 font-mono">Project: {project?.name || (project as any)?.title || `#${project?.id || 'PFM'}`}</span>
+              )}
+            </div>
+            <h3 className="text-lg sm:text-xl font-bold text-white tracking-tight">
+              Project Compliance Items, Beneficiaries & Associated Rules
+            </h3>
+            <p className="text-xs text-slate-400">
+              Contractual obligations, beneficiary-linked compliance criteria, risk registers, and institutional rules.
+            </p>
+          </div>
+          <button
+            type="button"
+            onClick={onClose}
+            className="p-1.5 rounded-xl text-slate-400 hover:text-white hover:bg-white/[0.06] transition-colors cursor-pointer shrink-0"
+          >
+            <X className="w-5 h-5" />
+          </button>
+        </div>
+
+        {/* Tab Navigation */}
+        <div className="flex items-center gap-2 border-b border-white/[0.08] pb-3 shrink-0 flex-wrap">
+          <button
+            type="button"
+            onClick={() => setActiveTab('compliance')}
+            className={`flex items-center gap-2 px-3.5 py-2 rounded-xl text-xs font-semibold transition-all cursor-pointer ${
+              activeTab === 'compliance'
+                ? 'bg-emerald-500/20 text-emerald-300 border border-emerald-500/40 shadow-sm'
+                : 'text-slate-400 hover:text-white hover:bg-white/[0.04]'
+            }`}
+          >
+            <FileCheck className="w-4 h-4" />
+            <span>Compliance Items ({complianceItems.length})</span>
+          </button>
+
+          <button
+            type="button"
+            onClick={() => setActiveTab('beneficiaries')}
+            className={`flex items-center gap-2 px-3.5 py-2 rounded-xl text-xs font-semibold transition-all cursor-pointer ${
+              activeTab === 'beneficiaries'
+                ? 'bg-cyan-500/20 text-cyan-300 border border-cyan-500/40 shadow-sm'
+                : 'text-slate-400 hover:text-white hover:bg-white/[0.04]'
+            }`}
+          >
+            <Users className="w-4 h-4" />
+            <span>Beneficiaries ({projectBeneficiaries.length})</span>
+          </button>
+
+          <button
+            type="button"
+            onClick={() => setActiveTab('risks')}
+            className={`flex items-center gap-2 px-3.5 py-2 rounded-xl text-xs font-semibold transition-all cursor-pointer ${
+              activeTab === 'risks'
+                ? 'bg-amber-500/20 text-amber-300 border border-amber-500/40 shadow-sm'
+                : 'text-slate-400 hover:text-white hover:bg-white/[0.04]'
+            }`}
+          >
+            <AlertTriangle className="w-4 h-4" />
+            <span>Risk Register ({projectRisks.length})</span>
+          </button>
+
+          <button
+            type="button"
+            onClick={() => setActiveTab('rules')}
+            className={`flex items-center gap-2 px-3.5 py-2 rounded-xl text-xs font-semibold transition-all cursor-pointer ${
+              activeTab === 'rules'
+                ? 'bg-teal-500/20 text-teal-300 border border-teal-500/40 shadow-sm'
+                : 'text-slate-400 hover:text-white hover:bg-white/[0.04]'
+            }`}
+          >
+            <Scale className="w-4 h-4" />
+            <span>Associated Rules ({governanceRules.length})</span>
+          </button>
+        </div>
+
+        {/* Tab Content Panels */}
+        <div className="flex-1 overflow-y-auto space-y-4 pr-1 [scrollbar-width:thin] [scrollbar-color:#334155_transparent]">
+          {/* TAB 1: COMPLIANCE ITEMS (With Beneficiary Explorer) */}
+          {activeTab === 'compliance' && (
+            <div className="space-y-4">
+              {/* Beneficiary Filter Bar */}
+              <div className="p-3.5 rounded-2xl bg-slate-950/70 border border-white/[0.08] flex flex-col sm:flex-row sm:items-center justify-between gap-3">
+                <div className="flex items-center gap-2 text-xs text-slate-300">
+                  <Filter className="w-4 h-4 text-emerald-400 shrink-0" />
+                  <span className="font-semibold">Explore by Beneficiary:</span>
+                </div>
+                <div className="flex items-center gap-2">
+                  <select
+                    value={selectedBeneficiaryFilter}
+                    onChange={e => setSelectedBeneficiaryFilter(e.target.value)}
+                    className="px-3 py-1.5 rounded-xl bg-slate-900 border border-white/10 text-xs text-slate-200 focus:outline-none focus:border-emerald-500/50 cursor-pointer"
+                  >
+                    <option value="ALL">All Compliance Items ({complianceItems.length})</option>
+                    <option value="PROJECT_WIDE">
+                      Project-Wide General Items (
+                      {
+                        complianceItems.filter(
+                          i => !i.beneficiaryId || Number(i.beneficiaryId) === 0
+                        ).length
+                      }
+                      )
+                    </option>
+                    {projectBeneficiaries.map(b => {
+                      const count = complianceItems.filter(
+                        i => String(i.beneficiaryId) === String(b.id)
+                      ).length;
+                      return (
+                        <option key={b.id} value={String(b.id)}>
+                          Beneficiary: {b.name || `Beneficiary #${b.id}`} ({count} items)
+                        </option>
+                      );
+                    })}
+                  </select>
+                </div>
+              </div>
+
+              {isLoadingCompliance ? (
+                <div className="p-8 text-center text-xs text-slate-400">Loading compliance requirements...</div>
+              ) : filteredComplianceItems.length === 0 ? (
+                <div className="p-8 rounded-2xl bg-slate-950/60 border border-white/5 text-center text-xs text-slate-400 space-y-2">
+                  <FileCheck className="w-8 h-8 text-slate-500 mx-auto" />
+                  <p>No compliance items found matching this beneficiary filter.</p>
+                  <p className="text-[11px] text-slate-500">
+                    Switch to &quot;All Compliance Items&quot; to inspect project-wide statutory deliverables.
+                  </p>
+                </div>
+              ) : (
+                filteredComplianceItems.map((item, idx) => {
+                  const linkedBeneficiary = item.beneficiaryId
+                    ? beneficiaryMap.get(String(item.beneficiaryId))
+                    : null;
+                  return (
+                    <div
+                      key={item.id || idx}
+                      className="p-4 rounded-2xl bg-slate-950/70 border border-white/[0.08] space-y-2.5"
+                    >
+                      <div className="flex flex-col sm:flex-row sm:items-center justify-between gap-2">
+                        <div className="flex items-center gap-2 flex-wrap">
+                          <span className="font-semibold text-sm text-slate-100">
+                            {item.title || `Compliance Item #${idx + 1}`}
+                          </span>
+                          {renderComplianceStatus(item.status)}
+                          {linkedBeneficiary ? (
+                            <span className="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-md text-[10px] font-mono bg-cyan-950/80 border border-cyan-500/30 text-cyan-300">
+                              <Users className="w-3 h-3 text-cyan-400" />
+                              <span>Beneficiary: {linkedBeneficiary.name}</span>
+                            </span>
+                          ) : (
+                            <span className="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-md text-[10px] font-mono bg-slate-900 border border-white/10 text-slate-400">
+                              <span>Project-Wide General</span>
+                            </span>
+                          )}
+                        </div>
+                        <div className="text-[11px] text-slate-400 flex items-center gap-1 font-mono">
+                          <Calendar className="w-3.5 h-3.5 text-slate-500" />
+                          <span>Created: {formatDate(item.createdAt)}</span>
+                        </div>
+                      </div>
+                      {item.requirements && (
+                        <p className="text-xs text-slate-300 leading-relaxed">{item.requirements}</p>
+                      )}
+                    </div>
+                  );
+                })
+              )}
+            </div>
+          )}
+
+          {/* TAB 2: BENEFICIARIES LISTING & EXPLORATION */}
+          {activeTab === 'beneficiaries' && (
+            <div className="space-y-3">
+              {isLoadingBeneficiaries ? (
+                <div className="p-8 text-center text-xs text-slate-400">Loading project beneficiaries...</div>
+              ) : projectBeneficiaries.length === 0 ? (
+                <div className="p-8 rounded-2xl bg-slate-950/60 border border-white/5 text-center text-xs text-slate-400 space-y-2">
+                  <Users className="w-8 h-8 text-slate-500 mx-auto" />
+                  <p>No individual beneficiary cohorts registered for this project.</p>
+                  <p className="text-[11px] text-slate-500">
+                    Beneficiaries are captured during project execution and onboarding.
+                  </p>
+                </div>
+              ) : (
+                projectBeneficiaries.map(ben => {
+                  const linkedItems = complianceItems.filter(
+                    ci => String(ci.beneficiaryId) === String(ben.id)
+                  );
+                  return (
+                    <div
+                      key={ben.id}
+                      className="p-4 rounded-2xl bg-slate-950/70 border border-white/[0.08] space-y-3"
+                    >
+                      <div className="flex flex-col sm:flex-row sm:items-center justify-between gap-2">
+                        <div className="flex items-center gap-2.5 flex-wrap">
+                          <div className="p-2 rounded-xl bg-cyan-500/10 text-cyan-400">
+                            <Users className="w-4 h-4" />
+                          </div>
+                          <div>
+                            <h4 className="text-sm font-bold text-slate-100">{ben.name || 'Unnamed Beneficiary'}</h4>
+                            <p className="text-[11px] text-slate-400 font-mono">
+                              Category: {ben.category || 'Direct Participant'}
+                              {ben.location && ` • Location: ${ben.location}`}
+                            </p>
+                          </div>
+                        </div>
+
+                        <div className="flex items-center gap-3 text-xs">
+                          <div className="text-right">
+                            <span className="text-[10px] text-slate-500 block uppercase font-bold">Target / Reached</span>
+                            <span className="text-emerald-400 font-mono font-semibold">
+                              {ben.reachedCount ?? 0} / {ben.targetCount ?? 0}
+                            </span>
+                          </div>
+                          <button
+                            type="button"
+                            onClick={() => {
+                              setSelectedBeneficiaryFilter(String(ben.id));
+                              setActiveTab('compliance');
+                            }}
+                            className="px-3 py-1.5 rounded-xl bg-cyan-500/15 hover:bg-cyan-500/25 border border-cyan-500/30 text-cyan-300 text-[11px] font-semibold transition-colors cursor-pointer"
+                          >
+                            Explore Compliance ({linkedItems.length})
+                          </button>
+                        </div>
+                      </div>
+                    </div>
+                  );
+                })
+              )}
+            </div>
+          )}
+
+          {/* TAB 3: RISK REGISTER */}
+          {activeTab === 'risks' && (
+            <div className="space-y-3">
+              {isLoadingRisks ? (
+                <div className="p-8 text-center text-xs text-slate-400">Loading risk register...</div>
+              ) : projectRisks.length === 0 ? (
+                <div className="p-8 rounded-2xl bg-slate-950/60 border border-white/5 text-center text-xs text-slate-400 space-y-2">
+                  <ShieldCheck className="w-8 h-8 text-emerald-500 mx-auto" />
+                  <p>No high-severity risks recorded for this project.</p>
+                  <p className="text-[11px] text-slate-500">
+                    Maintain milestone delivery cadence to preserve low-risk standing.
+                  </p>
+                </div>
+              ) : (
+                projectRisks.map((risk, idx) => (
+                  <div
+                    key={risk.id || idx}
+                    className="p-4 rounded-2xl bg-slate-950/70 border border-white/[0.08] space-y-2.5"
+                  >
+                    <div className="flex flex-col sm:flex-row sm:items-center justify-between gap-2">
+                      <h4 className="font-semibold text-sm text-slate-100">
+                        {risk.title || `Risk Item #${idx + 1}`}
+                      </h4>
+                      <div className="flex items-center gap-2 text-[10px] font-mono">
+                        <span className="px-2 py-0.5 rounded-md bg-amber-500/15 text-amber-300 border border-amber-500/30">
+                          Likelihood: {risk.likelihood ?? 'Medium'}
+                        </span>
+                        <span className="px-2 py-0.5 rounded-md bg-rose-500/15 text-rose-300 border border-rose-500/30">
+                          Impact: {risk.impact ?? 'Moderate'}
+                        </span>
+                      </div>
+                    </div>
+                    {risk.description && (
+                      <p className="text-xs text-slate-300 leading-relaxed">{risk.description}</p>
+                    )}
+                    {risk.mitigation && (
+                      <div className="text-[11px] text-teal-300 bg-teal-950/40 border border-teal-500/20 p-2.5 rounded-xl">
+                        <strong>Mitigation Strategy:</strong> {risk.mitigation}
+                      </div>
+                    )}
+                  </div>
+                ))
+              )}
+            </div>
+          )}
+
+          {/* TAB 4: ASSOCIATED GOVERNANCE RULES */}
+          {activeTab === 'rules' && (
+            <div className="space-y-3">
+              {isLoadingRules ? (
+                <div className="p-8 text-center text-xs text-slate-400">Loading institutional rules...</div>
+              ) : governanceRules.length === 0 ? (
+                <div className="p-8 rounded-2xl bg-slate-950/60 border border-white/5 text-center text-xs text-slate-400 space-y-2">
+                  <Scale className="w-8 h-8 text-slate-500 mx-auto" />
+                  <p>Standard PFM Funding Portfolio Governance Rules apply.</p>
+                  <p className="text-[11px] text-slate-500">
+                    All disbursements gate against verified milestone deliverables and evidence.
+                  </p>
+                </div>
+              ) : (
+                governanceRules.map((rule, idx) => (
+                  <div
+                    key={rule.id || idx}
+                    className="p-4 rounded-2xl bg-slate-950/70 border border-white/[0.08] space-y-2"
+                  >
+                    <div className="flex items-center justify-between gap-2">
+                      <h4 className="font-semibold text-sm text-slate-100">
+                        {rule.name || `Rule #${idx + 1}`}
+                      </h4>
+                      <span className="text-[10px] font-mono px-2 py-0.5 rounded-md bg-slate-800 text-slate-300 border border-white/10">
+                        v{rule.version || 1}
+                      </span>
+                    </div>
+                    {rule.description && (
+                      <p className="text-xs text-slate-300 leading-relaxed">{rule.description}</p>
+                    )}
+                  </div>
+                ))
+              )}
+            </div>
+          )}
+        </div>
+
+        {/* Modal Footer */}
+        <div className="flex items-center justify-between pt-3 border-t border-white/[0.08] shrink-0">
+          <span className="text-[11px] text-slate-500 font-mono">
+            PFM Governance Architecture • Beneficiary & Compliance Tracking
+          </span>
+          <button
+            type="button"
+            onClick={onClose}
+            className="px-5 py-2 rounded-xl bg-slate-800 hover:bg-slate-700 text-slate-200 text-xs font-semibold transition-colors cursor-pointer"
+          >
+            Close
+          </button>
+        </div>
+      </div>
+    </div>,
+    document.body
+  );
+};