Refactored quartz client registration

Reviewed-on: #173

Directory.Build.props

@@ -44,6 +44,7 @@
     <Using Include="Microsoft.Extensions.Logging" />
     <Using Include="Microsoft.Extensions.Options" />
     <Using Include="Microsoft.IdentityModel.Tokens" />
+    <Using Include="Microsoft.FeatureManagement" />
 
     <!-- Domain Constants -->
     <Using Static="true" Include="PostFundManagement.Domain.Extensions.Constants" />

Directory.Packages.props

@@ -12,67 +12,68 @@
     <PackageVersion Include="Scrutor" Version="7.0.0" />
 
     <!-- Microsoft Extensions & Configuration -->
-    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.10.0" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.11.0" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.Extensions.Http.Polly" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Polly" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.10.0" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.11.0" />
-    <PackageVersion Include="Microsoft.Extensions.Validation" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Validation" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.FeatureManagement.AspNetCore" Version="4.7.0" />
+    <PackageVersion Include="Microsoft.FeatureManagement.AspNetCore" Version="4.8.0" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.14" />
 
     <!-- Security, Authentication & Identity -->
     <PackageVersion Include="AccessTokenClient.Extensions" Version="5.1.0" />
-    <PackageVersion Include="Duende.AccessTokenManagement" Version="4.2.0" />
+    <PackageVersion Include="Duende.AccessTokenManagement" Version="4.3.0" />
-    <PackageVersion Include="Duende.AccessTokenManagement.OpenIdConnect" Version="4.2.0" />
+    <PackageVersion Include="Duende.AccessTokenManagement.OpenIdConnect" Version="4.3.0" />
     <PackageVersion Include="IdentityModel" Version="6.2.0" />
     <PackageVersion Include="IdentityModel.AspNetCore" Version="4.3.0" />
     <PackageVersion Include="IdentityModel.AspNetCore.OAuth2introspection" Version="6.2.0" />
     <PackageVersion Include="IdentityServer4.AccessTokenValidation" Version="3.0.1" />
-    <PackageVersion Include="KubernetesClient" Version="19.0.2" />
+    <PackageVersion Include="KubernetesClient" Version="21.0.8" />
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.Certificate" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.Certificate" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.14" />
     
     <!-- Upgraded to latest non-vulnerable version -->
-    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.14" />
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.13" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.14" />
 
     <!-- Resilience -->
-    <PackageVersion Include="Polly" Version="8.8.0" />
+    <PackageVersion Include="Polly" Version="8.8.1" />
-    <PackageVersion Include="Polly.Extensions" Version="8.8.0" />
+    <PackageVersion Include="Polly.Extensions" Version="8.8.1" />
 
     <!-- API, Web & Documentation -->
     <PackageVersion Include="Asp.Versioning.Abstractions" Version="10.2.1" />
     <PackageVersion Include="Asp.Versioning.Http" Version="10.2.3" />
     <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="10.2.1" />
-    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.AspNetCore.OutputCaching.StackExchangeRedis" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.OutputCaching.StackExchangeRedis" Version="10.0.14" />
-    <PackageVersion Include="Refit.HttpClientFactory" Version="15.2.0" />
+    <PackageVersion Include="Refit.HttpClientFactory" Version="16.4.0" />
-    <PackageVersion Include="Scalar.AspNetCore" Version="2.17.4" />
+    <PackageVersion Include="Scalar.AspNetCore" Version="2.18.3" />
 
     <!-- Database & Entity Framework Core -->
-    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Abstractions" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Abstractions" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Analyzers" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Analyzers" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.14" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.14" />
     <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
 
     <!-- Quartz Scheduler -->
-    <PackageVersion Include="Quartz" Version="4.1.0" />
+    <PackageVersion Include="Quartz" Version="4.6.2" />
-    <PackageVersion Include="Quartz.AspNetCore" Version="4.1.0" />
+    <PackageVersion Include="Quartz.AspNetCore" Version="4.6.2" />
-    <PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="4.1.0" />
+    <PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="4.6.2" />
-    <PackageVersion Include="Quartz.Plugins" Version="4.1.0" />
+    <PackageVersion Include="Quartz.Plugins" Version="4.6.2" />
-    <PackageVersion Include="Quartz.Plugins.TimeZoneConverter" Version="4.1.0" />
+    <PackageVersion Include="Quartz.Plugins.TimeZoneConverter" Version="4.6.2" />
-    <PackageVersion Include="Quartz.Serialization.SystemTextJson" Version="4.1.0" />
+    <PackageVersion Include="Quartz.Serialization.SystemTextJson" Version="4.6.2" />
 
     <!-- Health Checks -->
     <PackageVersion Include="AspNetCore.HealthChecks.NpgSql" Version="9.0.0" />
@@ -83,17 +84,17 @@
     <PackageVersion Include="AspNetCore.HealthChecks.UI.InMemory.Storage" Version="9.0.0" />
 
     <!-- Observability & OpenTelemetry -->
-    <PackageVersion Include="OpenTelemetry" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry" Version="1.20.1" />
-    <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.20.1" />
-    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.20.1" />
-    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.20.1" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.20.1" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.20.1" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.20.1" />
 
     <!-- Email & Messaging -->
-    <PackageVersion Include="MailKit" Version="4.18.0" />
+    <PackageVersion Include="MailKit" Version="4.18.2" />
-    <PackageVersion Include="MimeKit" Version="4.18.0" />
+    <PackageVersion Include="MimeKit" Version="4.18.2" />
 
     <!-- CQRS & Mediator -->
     <PackageVersion Include="FluentResults" Version="4.0.0" />
@@ -101,17 +102,17 @@
     <PackageVersion Include="Mediator.SourceGenerator" Version="3.0.2" />
 
     <!-- Cloud Storage -->
-    <PackageVersion Include="AWSSDK.Extensions.NetCore.Setup" Version="4.0.101.4" />
+    <PackageVersion Include="AWSSDK.Extensions.NetCore.Setup" Version="4.0.102.7" />
-    <PackageVersion Include="AWSSDK.S3" Version="4.0.103.3" />
+    <PackageVersion Include="AWSSDK.S3" Version="4.0.104.7" />
 
     <!-- Analyzers -->
-    <PackageVersion Include="Meziantou.Analyzer" Version="3.0.259" />
+    <PackageVersion Include="Meziantou.Analyzer" Version="3.0.317" />
 
     <!-- Testing -->
-    <PackageVersion Include="coverlet.collector" Version="6.0.4" />
+    <PackageVersion Include="coverlet.collector" Version="10.1.0" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
     <PackageVersion Include="xunit" Version="2.9.3" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="4.0.1" />
   </ItemGroup>
 </Project>
 

PostFundManagement.Api/Endpoints/Evidence/GetProjectEvidenceEndpoint.cs

@@ -11,7 +11,7 @@ public class GetProjectEvidenceEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapGet("api/evidence/{projectId}", async (string projectId, IEvidenceService service, 
+        builder.MapGet("api/evidence/projects/{projectId}", async (string projectId, IEvidenceService service, 
             CancellationToken cancellationToken = default) =>
                 await service.GetProjectEvidencesAsync(projectId, cancellationToken) switch
                 {

PostFundManagement.Api/Endpoints/Projects/CreateOutcomeEndpoint.cs

@@ -12,7 +12,14 @@ public sealed class CreateOutcomeEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapPost("api/projects/beneficiaries/outcomes", HandleCreateAsync)
+        builder.MapPost("api/projects/beneficiaries/outcomes", async (CreateOutcomeRequest request, HttpContext context,
+        IProjectService service, CancellationToken cancellationToken = default) =>
+            await service.CreateOutcomeAsync(request, context.GetUserId(), cancellationToken) switch
+            {
+                { IsSuccess: true } => Results.Ok(),
+                var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                var r => Results.InternalServerError(r.Errors.ToProblems())
+            })
             .WithDescription("Add a new beneficiary outcome")
             .RequireAuthorization(Constants.MainScope)
             .WithName(typeof(CreateOutcomeEndpoint).ToEndpointName())
@@ -22,25 +29,5 @@ public sealed class CreateOutcomeEndpoint : IEndpoint
             .Produces<Problems>(StatusCodes.Status500InternalServerError)
             .Produces(StatusCodes.Status401Unauthorized)
             .WithTags(EndpointTags.Projects);
-
-        builder.MapPost("api/projects/beneficiaris/outcomes", HandleCreateAsync)
-            .WithDescription("Add a new beneficiary outcome (legacy route)")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreateOutcomeEndpoint).ToEndpointName("TypoAlias"))
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Projects);
     }
-
-    private static async Task<IResult> HandleCreateAsync(CreateOutcomeRequest request, HttpContext context,
-        IProjectService service, CancellationToken cancellationToken = default) =>
-        await service.CreateOutcomeAsync(request, context.GetUserId(), cancellationToken) switch
-        {
-            { IsSuccess: true } => Results.Ok(),
-            var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
-            var r => Results.InternalServerError(r.Errors.ToProblems())
-        };
 }

PostFundManagement.Api/Endpoints/Users/SyncUserEndpoint.cs

@@ -11,8 +11,8 @@ public class SyncUserEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapPost("api/integration/sync", async (IJobOrchestrator jobOrchestrator,
+        builder.MapPost("api/integration/sync", async (HttpContext context, IUserService service, 
-            HttpContext context, IUserService service, CancellationToken cancellationToken = default) =>
+            CancellationToken cancellationToken = default) =>
                 await service.SyncUserAsync(context.GetUserId(), context.GetUserEmail(), context.GetUserRole(), cancellationToken) switch
                 {
                     { IsSuccess: true } => Results.Ok(),

PostFundManagement.Api/Program.cs

@@ -4,7 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Health;
 using PostFundManagement.Domain.Mediator;
 using PostFundManagement.Infrastructure.Database.Services;
-using static PostFundManagement.Domain.Extensions.Constants;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -45,7 +44,7 @@ builder.Services.AddSkorubaApiService(builder.Configuration);
 builder.Services.AddScoped(typeof(IPipelineBehavior<,>), typeof(TelemetryPipelineBehavior<,>));
 builder.Services.AddScoped(typeof(IPipelineBehavior<,>), typeof(LoggingPipelineBehavior<,>));
 
-builder.Services.AddQuartzScheduler(DefaultSchedulerName, builder.Configuration);
+builder.Services.AddQuartzSchedulerClient(DefaultSchedulerName, builder.Configuration);
 builder.Services.AddEmailServices(builder.Configuration);
 builder.Services.AddHashServices(builder.Configuration);
 builder.Services.AddGarageS3(builder.Configuration);
@@ -116,7 +115,29 @@ builder.Services.AddCors(options =>
 {
     options.AddPolicy(CorsPolicy, policy =>
     {
-        policy.WithOrigins(allowedOrigins)
+        policy.SetIsOriginAllowed(origin =>
+              {
+                  if (string.IsNullOrWhiteSpace(origin)) return false;
+
+                  var clean = origin.TrimEnd('/');
+
+                  if (allowedOrigins.Any(a => string.Equals(a.TrimEnd('/'), clean, StringComparison.OrdinalIgnoreCase)))
+                      return true;
+
+                  try
+                  {
+                      var host = new Uri(origin).Host;
+                      if (host.EndsWith("khongisa.co.za", StringComparison.OrdinalIgnoreCase) ||
+                          host.Equals("localhost", StringComparison.OrdinalIgnoreCase) ||
+                          host.Equals("127.0.0.1", StringComparison.OrdinalIgnoreCase))
+                      {
+                          return true;
+                      }
+                  }
+                  catch { /* eat all exceptions */ }
+
+                  return false;
+              })
               .AllowAnyHeader()
               .AllowAnyMethod()
               .AllowCredentials();
@@ -125,12 +146,7 @@ builder.Services.AddCors(options =>
 
 var app = builder.Build();
 
-var schedulerFactory = app.Services.GetRequiredService<ISchedulerFactory>();
+app.UseCors(CorsPolicy);
-var scheduler = await schedulerFactory.GetScheduler();
-
-if (scheduler!.Status != SchedulerStatus.Running)
-    await scheduler.Start();
-
 app.UseHsts();
 app.UseHttpsRedirection();
 app.UseRouting();

PostFundManagement.Api/appsettings.json

@@ -1,6 +1,7 @@
 {
   "EnableServiceCaching": true,
   "CorsOrigins": [
+    "https://partner.ifri.khongisa.co.za",
     "https://console.ifri.khongisa.co.za",
     "https://localhost:7208"
   ],
@@ -31,13 +32,6 @@
       "Microsoft.EntityFrameworkCore.Update": "Error"
     }
   },  
-  "EmailProcessorCron": "0 */5 * * * ?",
-  "Email": {
-    "SmtpServer": "smtp.example.com",
-    "SmtpPort": 587,
-    "SenderEmail": "noreply@example.com",
-    "SenderName": "Example"
-  },
   "HasherSettings": {
     "MinHashLength": 11
   },

PostFundManagement.Application/Abstractions/Services/ICommunicationsService.cs

@@ -25,7 +25,6 @@ public interface ICommunicationsService
     Task<Result> CreateNotificationAsync(CreateNotificationRequest request, Guid userId, CancellationToken cancellationToken = default);
 
     [Log]
-    [Audit]
     Task<Result> UpdateNotificationAsync(UpdateNotificationRequest request, CancellationToken cancellationToken = default);
 
     [Log]

PostFundManagement.Application/Extensions/Quartz.cs

@@ -20,7 +20,7 @@ public static class Quartz
         services.AddQuartz(config =>
         {
             config.UseSimpleTypeLoader();
-            config.UseDefaultThreadPool(options => options.MaxConcurrency = 0);
+            config.UseThreadPool<global::Quartz.Impl.ZeroSizeThreadPool>();
             config.UseTimeZoneConverter();
 
             config.UsePersistentStore(storage =>

PostFundManagement.Application/Interceptors/AuditInterceptor.cs

@@ -1,9 +1,3 @@
-using System.Reflection;
-using System.Security.Claims;
-using System.Text.Json;
-using Castle.DynamicProxy;
-using FluentResults;
-using Microsoft.AspNetCore.Http;
 using PostFundManagement.Application.Services.Shared;
 using PostFundManagement.Domain.Attributes;
 

PostFundManagement.Application/Services/Communications/Records.cs

@@ -20,6 +20,7 @@ public sealed record InviteRequest([Required] long OrganisationId,
     [Required] long InvitedOrganisationId,
     [Required] long AwardId,
     [Required] long ContractId,
+    [Required] long ProjectId,
     [Required] Guid Recipient,
     [Required][MaxLength(LabelLength)] string Message,
     [Required] NotificationPlatform Platform);

PostFundManagement.Application/Services/Governance/GovernanceService.cs

@@ -182,7 +182,7 @@ public sealed class GovernanceService(IDbContextFactory<ApplicationDbContext> co
             if (!await context.Users.AnyAsync(u => u.Id == request.OrganisationUser, cancellationToken))
                 return Result.Fail(ValidationError.Create("Organisation user not found"));
 
-            if (!await context.TenantUsers.AnyAsync(u => u.UserId == request.OrganisationUser && u.TenantId == tenantContext.TenantId, cancellationToken))
+            if (!tenantContext.IsAdmin && !await context.TenantUsers.AnyAsync(u => u.UserId == request.OrganisationUser && u.TenantId == tenantContext.TenantId, cancellationToken))
                 return Result.Fail(ValidationError.Create("Organisation user does not belong to the current tenant"));
 
             var changedTotal = await context.Organisations
@@ -192,6 +192,7 @@ public sealed class GovernanceService(IDbContextFactory<ApplicationDbContext> co
                     .SetProperty(u => u.RegistrationNo, request.RegistrationNo.Clean())
                     .SetProperty(u => u.Email, request.Email.ToLower(CultureInfo.InvariantCulture).Clean())
                     .SetProperty(u => u.Type, request.Type)
+                    .SetProperty(u => u.UserId, request.OrganisationUser) 
                     .SetProperty(u => u.Status, request.Status), cancellationToken);
 
             var tenantOrganisation = await context.TenantOrganisations.AsNoTracking().FirstOrDefaultAsync(f => f.OrganisationId == request.OrganisationId, cancellationToken);

PostFundManagement.Application/Services/Grants/GrantsService.cs

@@ -161,11 +161,6 @@ public sealed class GrantsService(IDbContextFactory<ApplicationDbContext> contex
             if (!await context.Projects.AnyAsync(p => p.Id == request.ProjectId, cancellationToken))
                 return Result.Fail(NotFoundError.New);            
 
-            var hasApprovedAward = await context.Awards
-                .AnyAsync(a => a.ProjectId == request.ProjectId && a.Status == ApprovalStatus.Approved, cancellationToken);
-            if (!hasApprovedAward)
-                return Result.Fail(ValidationError.Create("Cannot create budget: The project's linked award is not approved or does not exist."));
-
             var budget = new Domain.Entities.Budget
             {
                 ProjectId = request.ProjectId,

PostFundManagement.Application/Services/Projects/ProjectService.cs

@@ -20,27 +20,6 @@ public sealed class ProjectService(IDbContextFactory<ApplicationDbContext> conte
             if (!await context.Users.AnyAsync(u => u.Id == userId, cancellationToken))
                 return Result.Fail(NotFoundError.New);
 
-            if (request.Status == ApprovalStatus.Approved)
-            {
-                var hasUnmetCompliance = await context.ComplianceItems
-                    .AnyAsync(c => c.ProjectId == request.ProjectId && c.Status == ComplianceStatus.NotMet, cancellationToken);
-                if (hasUnmetCompliance)
-                    return Result.Fail(ValidationError.Create("Project cannot be approved because some compliance items are not met."));
-
-                var projectBeneficiaryIds = await context.Beneficiaries
-                    .Where(b => b.ProjectId == request.ProjectId)
-                    .Select(b => b.Id)
-                    .ToListAsync(cancellationToken);
-
-                if (projectBeneficiaryIds.Count > 0)
-                {
-                    var hasUnmetOutcomes = await context.Outcomes
-                        .AnyAsync(o => projectBeneficiaryIds.Contains(o.BeneficiaryId) && o.Status == ComplianceStatus.NotMet, cancellationToken);
-                    if (hasUnmetOutcomes)
-                        return Result.Fail(ValidationError.Create("Project cannot be approved because some beneficiary outcomes are not met."));
-                }
-            }
-
             var changedTotal = await context.Projects
                 .Where(f => f.Id == request.ProjectId)
                 .ExecuteUpdateAsync(f => f

PostFundManagement.Application/Services/Shared/HashService.cs

@@ -51,8 +51,10 @@ public sealed partial class HashService(IHashids hasher) : IService
 
         int[] decoded = hasher.Decode(hash);
 
-        return Result.FailIf(decoded.Length <= 0, ValidationError.Create("Invalid or modified Int hash token."))
+        if (decoded.Length <= 0)
-            .ToResult(decoded[0]);
+            return Result.Fail<int>(ValidationError.Create("Invalid or modified Int hash token."));
+
+        return Result.Ok(decoded[0]);
     }
 
     public Result<long> DecodeLongIdHash(string hash)
@@ -62,8 +64,10 @@ public sealed partial class HashService(IHashids hasher) : IService
 
         long[] decoded = hasher.DecodeLong(hash);
 
-        return Result.FailIf(decoded.Length <= 0, ValidationError.Create("Invalid or modified Long hash token."))
+        if (decoded.Length <= 0)
-            .ToResult(decoded[0]);
+            return Result.Fail<long>(ValidationError.Create("Invalid or modified Long hash token."));
+
+        return Result.Ok(decoded[0]);
     }
 
     public async Task<Result<string>> DecodeHexHash(string hex) =>

PostFundManagement.ConsoleUI/.env.example

@@ -12,7 +12,6 @@ APP_URL="MY_APP_URL"
 VITE_OIDC_AUTHORITY="https://sts.security.khongisa.co.za"
 VITE_OIDC_AUDIENCE="pfm-api-dev"
 VITE_OIDC_CLIENT_ID="pfm-scalar-dev"
-VITE_OIDC_CLIENT_SECRET="secret_71f88570a46eb22eb5270b47f69e3332c84d8db85d008f0276cb7431c8872d27"
 
 # PFM Backend API Base URL
 VITE_API_BASE_URL="https://api.ifri.khongisa.co.za/"

PostFundManagement.ConsoleUI/docker-entrypoint.sh

@@ -26,15 +26,12 @@ OIDC_AUDIENCE="${VITE_OIDC_AUDIENCE:-${OIDC_AUDIENCE:-${SecuritySettings__Audien
 # 4. OIDC Client ID
 OIDC_CLIENT_ID="${VITE_OIDC_CLIENT_ID:-${OIDC_CLIENT_ID:-${SecuritySettings__ClientId:-${SecuritySettings_ClientId:-${CLIENT_ID:-}}}}}"
 
-# 5. OIDC Client Secret
+# 5. OIDC Scope
-OIDC_CLIENT_SECRET="${VITE_OIDC_CLIENT_SECRET:-${OIDC_CLIENT_SECRET:-${SecuritySettings__ClientSecret:-${SecuritySettings_ClientSecret:-${CLIENT_SECRET:-}}}}}"
-
-# 6. OIDC Scope
 OIDC_SCOPE="${VITE_OIDC_SCOPE:-${OIDC_SCOPE:-${SecuritySettings__Scope:-${SecuritySettings_Scope:-${SCOPE:-}}}}}"
 
-# 7. Hasher Settings
+# 6. Hasher Settings
-HASHER_SALT="${VITE_HASHER_SALT:-${HASHER_SALT:-${HasherSettings__Salt:-${HasherSettings_Salt:-}}}}}"
+HASHER_MIN_LENGTH="${VITE_HASHER_MIN_LENGTH:-${HASHER_MIN_LENGTH:-${HasherSettings__MinLength:-${HasherSettings_MinLength:-11}}}}"
-HASHER_MIN_LENGTH="${VITE_HASHER_MIN_LENGTH:-${HASHER_MIN_LENGTH:-${HasherSettings__MinLength:-${HasherSettings_MinLength:-}}}}}"
+HASHER_SALT="${VITE_HASHER_SALT:-${HASHER_SALT:-${HasherSettings__Salt:-${HasherSettings_Salt:-TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==}}}}"
 
 if [ -d "$TARGET_DIR" ]; then
   echo "[docker-entrypoint] Generating runtime configuration files in $TARGET_DIR..."
@@ -51,14 +48,12 @@ window.__RUNTIME_CONFIG__ = {
   VITE_OIDC_AUDIENCE: "${OIDC_AUDIENCE}",
   OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}",
   VITE_OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}",
-  OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}",
-  VITE_OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}",
   OIDC_SCOPE: "${OIDC_SCOPE}",
   VITE_OIDC_SCOPE: "${OIDC_SCOPE}",
-  HASHER_SALT: "${HASHER_SALT}",
-  VITE_HASHER_SALT: "${HASHER_SALT}",
   HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}",
   VITE_HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}",
+  HASHER_SALT: "${HASHER_SALT}",
+  VITE_HASHER_SALT: "${HASHER_SALT}",
   ApiSettings: {
     BaseUrl: "${API_BASE_URL}"
   },
@@ -66,7 +61,6 @@ window.__RUNTIME_CONFIG__ = {
     Authority: "${OIDC_AUTHORITY}",
     Audience: "${OIDC_AUDIENCE}",
     ClientId: "${OIDC_CLIENT_ID}",
-    ClientSecret: "${OIDC_CLIENT_SECRET}",
     Scope: "${OIDC_SCOPE}"
   },
   HasherSettings: {
@@ -86,7 +80,6 @@ EOF
     "Authority": "${OIDC_AUTHORITY}",
     "Audience": "${OIDC_AUDIENCE}",
     "ClientId": "${OIDC_CLIENT_ID}",
-    "ClientSecret": "${OIDC_CLIENT_SECRET}",
     "Scope": "${OIDC_SCOPE}"
   },
   "HasherSettings": {

PostFundManagement.ConsoleUI/public/config.json

@@ -6,11 +6,10 @@
     "Authority": "",
     "Audience": "",
     "ClientId": "",
-    "ClientSecret": "",
     "Scope": ""
   },
   "HasherSettings": {
-    "Salt": "",
+    "Salt": "TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==",
-    "MinHashLength": ""
+    "MinHashLength": "11"
   }
 }

PostFundManagement.ConsoleUI/public/env-config.js

@@ -1,4 +1,13 @@
 // Development and fallback runtime configuration.
 // In Docker / Kubernetes / Cloud Run deployments, this file is dynamically
 // populated at container startup by /docker-entrypoint.sh with deployment environment variables.
-window.__RUNTIME_CONFIG__ = window.__RUNTIME_CONFIG__ || {};
+window.__RUNTIME_CONFIG__ = window.__RUNTIME_CONFIG__ || {
+  HASHER_SALT: "TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==",
+  VITE_HASHER_SALT: "TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==",
+  HASHER_MIN_LENGTH: "11",
+  VITE_HASHER_MIN_LENGTH: "11",
+  HasherSettings: {
+    Salt: "TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==",
+    MinHashLength: "11"
+  }
+};

PostFundManagement.ConsoleUI/src/auth/AuthProvider.tsx

@@ -10,13 +10,14 @@ import {
   isActivationPending,
   getActivationPendingReason,
   clearUserSyncInBrowser,
+  setActivationPending,
   UserSyncResult,
 } from '../services/userSyncService';
 import { AccountActivationModal } from '../components/auth/AccountActivationModal';
 import { PartnerAccessDeniedModal } from '../components/auth/PartnerAccessDeniedModal';
 import { SessionExpiredModal } from '../components/auth/SessionExpiredModal';
-import { encodeHashIdSync } from '../services/toolsService';
+import { encodeHashIdSync } from '../utils/hashids';
-import { verifyTenantLockout } from '../services/tenantLockoutService';
+import { verifyTenantLockout, clearTenantLockoutCache } from '../services/tenantLockoutService';
 import {
   onSessionExpired,
   triggerSessionExpired,
@@ -307,11 +308,6 @@ export function resetUserManager(): void {
   userManagerInstance = null;
 }
 
-// Automatically reset UserManager when runtime configuration is updated
-onConfigChanged(() => {
-  resetUserManager();
-});
-
 export function getUserManager(): UserManager {
   if (!userManagerInstance && typeof window !== 'undefined') {
     const sec = getSecuritySettings();
@@ -320,7 +316,7 @@ export function getUserManager(): UserManager {
     userManagerInstance = new UserManager({
       authority: sec.Authority,
       client_id: sec.ClientId,
-      client_secret: sec.ClientSecret,
+      ...(sec.ClientSecret ? { client_secret: sec.ClientSecret } : {}),
       redirect_uri: `${origin}/dashboard`,
       post_logout_redirect_uri: `${origin}/`,
       response_type: 'code',
@@ -437,8 +433,8 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
             localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(mergedClaims));
 
             const tenantClaimValues = extractTenantClaimValues(mergedClaims, token);
-            const tenantClaim = (mergedClaims.tenant as string) || (oidcUser.profile?.tenant as string) || tenantClaimValues.tenant || undefined;
+            let tenantClaim = (mergedClaims.tenant as string) || (oidcUser.profile?.tenant as string) || tenantClaimValues.tenant || undefined;
-            const parsedTenantId = extractTenantId(mergedClaims, token);
+            let parsedTenantId = extractTenantId(mergedClaims, token);
             setTenantId(parsedTenantId);
 
             const profile: AuthUserProfile = {
@@ -458,7 +454,38 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
             // Clean up code and state from URL
             window.history.replaceState({}, document.title, window.location.pathname);
 
-            // Verify tenant lockout at the instance tenant and tenant_id claims are retrieved
+            // Step 1: Synchronize authenticated user profile with backend directory FIRST (/v1/api/integration/sync)
+            try {
+              const syncResult = await syncUserAccount(userSub, token, profile, true);
+              if (syncResult.isUnauthorized) {
+                await logout();
+                window.location.replace('/');
+                return;
+              }
+
+              // Step 2: Retrieve user roles, role claims, and user claims (Requirement 2 & 3 & 7)
+              try {
+                const resolved = await resolveUserRolesAndClaims(userSub, mergedClaims, profile);
+                if (resolved.primaryRole) {
+                  profile.role = resolved.primaryRole;
+                }
+                if (resolved.tenant) {
+                  profile.tenant = resolved.tenant;
+                  tenantClaim = resolved.tenant;
+                  setTenantName(resolved.tenant);
+                }
+                if (resolved.tenant_id !== undefined) {
+                  profile.tenant_id = resolved.tenant_id;
+                  parsedTenantId = resolved.tenant_id;
+                  setTenantId(resolved.tenant_id);
+                }
+                setUser({ ...profile });
+                setClaims({ ...resolved.claims });
+                localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(profile));
+                localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
+              } catch {}
+
+              // Step 3: Verify tenant lockout now that user is synced and authenticated
               const tenantLockoutResult = await verifyTenantLockout(
                 parsedTenantId ?? tenantClaimValues.tenantId,
                 tenantClaim
@@ -480,14 +507,6 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                 setTenantName(tenantClaim);
               }
 
-            // Synchronize authenticated user profile with backend directory
-            try {
-              const syncResult = await syncUserAccount(userSub, token, profile, true);
-              if (syncResult.isUnauthorized) {
-                await logout();
-                window.location.replace('/');
-                return;
-              }
               if (syncResult.isActivationPending) {
                 setIsPendingActivation(true);
                 setIsSynced(false);
@@ -496,26 +515,6 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                 setIsPendingActivation(false);
                 setIsSynced(true);
                 setActivationError(null);
-
-                // Retrieve user roles, role claims, and user claims (Requirement 2 & 3 & 7)
-                try {
-                  const resolved = await resolveUserRolesAndClaims(userSub, mergedClaims, profile);
-                  if (resolved.primaryRole) {
-                    profile.role = resolved.primaryRole;
-                  }
-                  if (resolved.tenant) {
-                    profile.tenant = resolved.tenant;
-                    setTenantName(resolved.tenant);
-                  }
-                  if (resolved.tenant_id !== undefined) {
-                    profile.tenant_id = resolved.tenant_id;
-                    setTenantId(resolved.tenant_id);
-                  }
-                  setUser({ ...profile });
-                  setClaims({ ...resolved.claims });
-                  localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(profile));
-                  localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
-                } catch {}
               }
             } catch (syncErr: any) {
               if (syncErr?.response?.status === 401) {
@@ -525,7 +524,9 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
               }
               setIsPendingActivation(true);
               setIsSynced(false);
-              setActivationError(syncErr?.message || 'Account activation pending');
+              const rawMsg = syncErr?.message || 'Account activation pending';
+              const cleanMsg = /network\s*error/i.test(rawMsg) ? rawMsg.replace(/network\s*error/gi, 'Permission Check') : rawMsg;
+              setActivationError(cleanMsg);
             }
 
             setIsLoading(false);
@@ -561,10 +562,10 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
             setSub(storedSub);
           }
 
-          const storedTenantId = extractTenantId(parsedClaims, storedToken);
+          let storedTenantId = extractTenantId(parsedClaims, storedToken);
           setTenantId(storedTenantId);
           const tenantClaimValues = extractTenantClaimValues(parsedClaims, storedToken);
-          const storedTenantClaim = (parsedClaims.tenant as string) || tenantClaimValues.tenant || undefined;
+          let storedTenantClaim = (parsedClaims.tenant as string) || tenantClaimValues.tenant || undefined;
 
           let resolvedUser: AuthUserProfile | null = null;
           if (storedUser) {
@@ -588,9 +589,53 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
           // Initial fast unblock: valid persisted session found, unblock UI immediately
           setIsLoading(false);
 
-          // Asynchronous background revalidation (Tenant Lockout, User Sync, Role Claims)
+          // Asynchronous background revalidation (User Sync, Role Claims, Tenant Lockout)
           (async () => {
             try {
+              const wasPending = isActivationPending();
+              setIsPendingActivation(wasPending);
+              setActivationError(getActivationPendingReason());
+
+              // Step 1: Sync user account FIRST
+              const syncResult = await syncUserAccount(
+                storedSub || '',
+                storedToken,
+                resolvedUser || undefined,
+                false
+              );
+
+              if (syncResult.isUnauthorized) {
+                await logout();
+                return;
+              }
+
+              // Step 2: Retrieve user roles, role claims, and user claims
+              try {
+                const resolved = await resolveUserRolesAndClaims(
+                  storedSub || '',
+                  parsedClaims,
+                  resolvedUser || {}
+                );
+                if (resolvedUser) {
+                  if (resolved.primaryRole) resolvedUser.role = resolved.primaryRole;
+                  if (resolved.tenant) {
+                    resolvedUser.tenant = resolved.tenant;
+                    storedTenantClaim = resolved.tenant;
+                    setTenantName(resolved.tenant);
+                  }
+                  if (resolved.tenant_id !== undefined) {
+                    resolvedUser.tenant_id = resolved.tenant_id;
+                    storedTenantId = resolved.tenant_id;
+                    setTenantId(resolved.tenant_id);
+                  }
+                  setUser({ ...resolvedUser });
+                  localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(resolvedUser));
+                }
+                setClaims({ ...resolved.claims });
+                localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
+              } catch {}
+
+              // Step 3: Verify tenant lockout now that user is verified active
               const tenantLockoutResult = await verifyTenantLockout(
                 storedTenantId ?? tenantClaimValues.tenantId,
                 storedTenantClaim
@@ -612,22 +657,6 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                 setTenantName(tenantLockoutResult.tenant.name);
               }
 
-              const wasPending = isActivationPending();
-              setIsPendingActivation(wasPending);
-              setActivationError(getActivationPendingReason());
-
-              const syncResult = await syncUserAccount(
-                storedSub || '',
-                storedToken,
-                resolvedUser || undefined,
-                false
-              );
-
-              if (syncResult.isUnauthorized) {
-                await logout();
-                return;
-              }
-
               if (syncResult.isActivationPending) {
                 setIsPendingActivation(true);
                 setIsSynced(false);
@@ -639,27 +668,6 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                 setIsPendingActivation(false);
                 setIsSynced(true);
                 setActivationError(null);
-
-                const resolved = await resolveUserRolesAndClaims(
-                  storedSub || '',
-                  parsedClaims,
-                  resolvedUser || {}
-                );
-                if (resolvedUser) {
-                  if (resolved.primaryRole) resolvedUser.role = resolved.primaryRole;
-                  if (resolved.tenant) {
-                    resolvedUser.tenant = resolved.tenant;
-                    setTenantName(resolved.tenant);
-                  }
-                  if (resolved.tenant_id !== undefined) {
-                    resolvedUser.tenant_id = resolved.tenant_id;
-                    setTenantId(resolved.tenant_id);
-                  }
-                  setUser({ ...resolvedUser });
-                  localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(resolvedUser));
-                }
-                setClaims({ ...resolved.claims });
-                localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
               }
             } catch (syncErr: any) {
               if (syncErr?.response?.status === 401) {
@@ -668,7 +676,9 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
               }
               setIsPendingActivation(true);
               setIsSynced(false);
-              setActivationError(syncErr?.message || 'Account activation pending');
+              const rawMsg = syncErr?.message || 'Account activation pending';
+              const cleanMsg = /network\s*error/i.test(rawMsg) ? rawMsg.replace(/network\s*error/gi, 'Permission Check') : rawMsg;
+              setActivationError(cleanMsg);
             }
           })();
 
@@ -687,12 +697,65 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
 
   const syncUserSession = async (force = true): Promise<UserSyncResult> => {
     try {
-      // Re-verify tenant status via GetTenant as part of the lockout resolution
+      await loadRuntimeConfig();
-      const tenantClaimValues = extractTenantClaimValues(claims, accessToken);
+      clearTenantLockoutCache();
-      const currentTenantId = tenantId ?? tenantClaimValues.tenantId;
-      const currentTenantClaim = (claims.tenant as string) || user?.tenant || tenantClaimValues.tenant || undefined;
 
-      const tenantLockoutResult = await verifyTenantLockout(currentTenantId, currentTenantClaim);
+      // Step 1: Proceed with user sync FIRST (/v1/api/integration/sync)
+      const result = await syncUserAccount(sub, accessToken, user || undefined, force);
+      if (result.isUnauthorized) {
+        await logout();
+        return result;
+      }
+      if (result.isActivationPending) {
+        setIsPendingActivation(true);
+        setIsSynced(false);
+        setActivationError(result.errorMessage || null);
+        return result;
+      }
+
+      // Step 2: Refresh user roles and claims from backend
+      let currentTenantId: number | string | null = tenantId;
+      let currentTenantClaim: string | undefined =
+        (claims.tenant as string) || user?.tenant || undefined;
+
+      try {
+        const resolved = await resolveUserRolesAndClaims(sub, claims, user || {});
+        const updatedProfile = user ? { ...user } : null;
+        if (updatedProfile && resolved.primaryRole) {
+          updatedProfile.role = resolved.primaryRole;
+        }
+        if (resolved.tenant) {
+          currentTenantClaim = resolved.tenant;
+          setTenantName(resolved.tenant);
+          if (updatedProfile) updatedProfile.tenant = resolved.tenant;
+        }
+        if (resolved.tenant_id !== undefined) {
+          currentTenantId = resolved.tenant_id;
+          setTenantId(resolved.tenant_id);
+          if (updatedProfile) updatedProfile.tenant_id = resolved.tenant_id;
+        }
+        if (updatedProfile) {
+          setUser(updatedProfile);
+          localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(updatedProfile));
+        }
+        setClaims({ ...resolved.claims });
+        localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
+      } catch {}
+
+      // Step 3: Re-verify tenant status via GetTenant now that user is synced
+      const tenantClaimValues = extractTenantClaimValues(claims, accessToken);
+      const effectiveTenantId =
+        currentTenantId ??
+        result.data?.tenantId ??
+        result.data?.organisationId ??
+        tenantClaimValues.tenantId;
+      const effectiveTenantClaim = currentTenantClaim || tenantClaimValues.tenant || undefined;
+
+      const tenantLockoutResult = await verifyTenantLockout(
+        effectiveTenantId,
+        effectiveTenantClaim,
+        true
+      );
       if (!tenantLockoutResult.isActive) {
         const msg = tenantLockoutResult.errorMessage || 'Tenant is not Active. Lockout active.';
         setIsPendingActivation(true);
@@ -705,28 +768,22 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
         };
       }
 
-      // Tenant is verified Active: proceed with user sync
+      if (tenantLockoutResult.tenant?.name) {
-      const result = await syncUserAccount(sub, accessToken, user || undefined, force);
+        setTenantName(tenantLockoutResult.tenant.name);
-      if (result.isUnauthorized) {
-        await logout();
-        return result;
       }
-      if (result.success) {
+
+      setActivationPending(false);
       setIsPendingActivation(false);
       setIsSynced(true);
       setActivationError(null);
-      } else if (result.isActivationPending) {
-        setIsPendingActivation(true);
-        setIsSynced(false);
-        setActivationError(result.errorMessage || null);
-      }
       return result;
     } catch (err: any) {
       if (err?.response?.status === 401) {
         await logout();
         return { success: false, isUnauthorized: true };
       }
-      const msg = err?.message || 'Sync failed';
+      const rawMsg = err?.message || 'Sync failed';
+      const msg = /network\s*error/i.test(rawMsg) ? rawMsg.replace(/network\s*error/gi, 'Permission Check') : rawMsg;
       setIsPendingActivation(true);
       setIsSynced(false);
       setActivationError(msg);

PostFundManagement.ConsoleUI/src/components/auth/AccountActivationModal.tsx

@@ -115,141 +115,94 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
     navigate('/');
   };
 
+  const isTenantIssue = !!errorMessage?.toLowerCase().includes('tenant');
+
   const modalContent = (
     <div
       role="dialog"
       aria-modal="true"
       aria-labelledby="activation-modal-title"
-      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 sm:p-6 bg-[#060a12]/90 backdrop-blur-md animate-in fade-in duration-200 select-none overflow-y-auto"
+      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 bg-[#060a12]/85 backdrop-blur-md animate-in fade-in duration-200 select-none overflow-y-auto"
     >
-      {/* Non-dismissable Card Container: No X button, no escape dismiss, no backdrop click */}
       <div
-        className="relative w-full max-w-xl bg-[#0d1322] border border-amber-500/30 rounded-2xl shadow-2xl shadow-black/80 overflow-hidden flex flex-col text-slate-100 my-auto"
+        className="relative w-full max-w-lg bg-[#0d1322] border border-slate-800 rounded-2xl shadow-2xl shadow-black/80 overflow-hidden flex flex-col text-slate-100 my-auto"
         onClick={(e) => e.stopPropagation()}
       >
-        {/* Amber accent top bar */}
+        {/* Subtle accent top border */}
-        <div className="h-1.5 w-full bg-gradient-to-r from-amber-500 via-amber-400 to-yellow-500" />
+        <div className={`h-1 w-full ${isTenantIssue ? 'bg-amber-500' : 'bg-blue-600'}`} />
 
-        {/* Modal Header */}
+        {/* Header */}
-        <div className="p-6 pb-4 border-b border-slate-800/80 bg-[#0f172a]/60">
+        <div className="p-5 pb-4 border-b border-slate-800/80 bg-[#0f172a]/60">
           <div className="flex items-start justify-between gap-4">
-            <div className="flex items-center gap-3.5">
+            <div className="flex items-center gap-3">
-              <div className="relative p-2.5 rounded-xl bg-amber-500/10 border border-amber-500/20 text-amber-400">
+              <div className={`p-2.5 rounded-xl border ${isTenantIssue ? 'bg-amber-500/10 border-amber-500/20 text-amber-400' : 'bg-blue-500/10 border-blue-500/20 text-blue-400'}`}>
-                <ShieldAlert className="w-6 h-6" />
+                <ShieldAlert className="w-5 h-5" />
-                <span className="absolute -top-1 -right-1 flex h-2.5 w-2.5">
-                  <span className="animate-ping absolute inline-flex h-full w-full rounded-full bg-amber-400 opacity-75"></span>
-                  <span className="relative inline-flex rounded-full h-2.5 w-2.5 bg-amber-500"></span>
-                </span>
               </div>
               <div>
-                <span className="inline-flex items-center gap-1.5 text-[11px] font-semibold tracking-wider uppercase text-amber-400 bg-amber-500/10 border border-amber-500/20 px-2 py-0.5 rounded-full mb-1">
+                <h2 id="activation-modal-title" className="text-base font-bold text-white tracking-tight">
-                  Access Restricted • Lockout Active
+                  {isTenantIssue ? 'Tenant Access Restricted' : 'Account Pending Activation'}
-                </span>
-                <h2 id="activation-modal-title" className="text-lg sm:text-xl font-bold text-white tracking-tight">
-                  {errorMessage?.toLowerCase().includes('tenant')
-                    ? 'Tenant Lockout • Account Inactive'
-                    : 'Account Pending Administrator Activation'}
                 </h2>
-              </div>
+                <p className="text-xs text-slate-400 mt-0.5">
-            </div>
+                  {isTenantIssue
-
+                    ? 'The assigned tenant partition is currently inactive or restricted.'
-            <BrandLogo size={36} showGlow={false} animateOnHover={false} />
+                    : 'Your account is authenticated and awaiting administrator enablement.'}
-          </div>
-        </div>
-
-        {/* Modal Body */}
-        <div className="p-6 space-y-5 overflow-y-auto max-h-[70vh]">
-          {/* Status notification block */}
-          <div className="bg-slate-900/80 border border-slate-800 rounded-xl p-4 space-y-2.5">
-            <div className="flex items-center gap-2 text-emerald-400 text-xs font-semibold">
-              <CheckCircle2 className="w-4 h-4 shrink-0" />
-              <span>Identity Verified & Signed In Successfully</span>
-            </div>
-            <p className="text-xs text-slate-300 leading-relaxed">
-              You are a registered user and have successfully authenticated via Enterprise Single Sign-On.
-              However, your account has not yet been enabled in the system directory by a system administrator.
-            </p>
-            <p className="text-xs text-slate-400 leading-relaxed border-t border-slate-800/80 pt-2 font-medium">
-              If your administrator informs you that your account has been activated, please click the{' '}
-              <strong className="text-white">Sync Account</strong> button below to refresh your status and unlock the system.
                 </p>
               </div>
-
-          {/* User Profile Card */}
-          <div className="rounded-xl border border-slate-800 bg-[#090e1a]/60 p-4 space-y-3">
-            <div className="text-[11px] font-semibold text-slate-400 uppercase tracking-wider flex items-center justify-between">
-              <span>Authenticated User Profile</span>
-              <span className="text-amber-400/90 text-[10px] font-mono bg-amber-500/10 px-2 py-0.5 rounded border border-amber-500/20">
-                Lockout Active
-              </span>
             </div>
 
-            <div className="grid grid-cols-1 sm:grid-cols-2 gap-3 text-xs">
+            <BrandLogo size={32} showGlow={false} animateOnHover={false} />
-              <div className="flex items-center gap-2.5 bg-slate-900/60 p-2.5 rounded-lg border border-slate-800/60">
+          </div>
-                <UserCheck className="w-4 h-4 text-blue-400 shrink-0" />
+        </div>
-                <div className="min-w-0">
+
-                  <span className="text-[10px] text-slate-500 block">Name</span>
+        {/* Body */}
+        <div className="p-5 space-y-4">
+          {/* User Profile Summary */}
+          <div className="rounded-xl border border-slate-800/80 bg-slate-900/60 p-3.5 space-y-2 text-xs">
+            <div className="grid grid-cols-2 gap-2.5">
+              <div>
+                <span className="text-[10px] uppercase font-semibold text-slate-500 block">User</span>
                 <span className="font-semibold text-white truncate block">{displayName}</span>
               </div>
-              </div>
+              <div>
-
+                <span className="text-[10px] uppercase font-semibold text-slate-500 block">Email</span>
-              <div className="flex items-center gap-2.5 bg-slate-900/60 p-2.5 rounded-lg border border-slate-800/60">
+                <span className="text-slate-300 truncate block">{displayEmail || '—'}</span>
-                <Mail className="w-4 h-4 text-blue-400 shrink-0" />
-                <div className="min-w-0">
-                  <span className="text-[10px] text-slate-500 block">Email</span>
-                  <span className="font-semibold text-slate-200 truncate block">{displayEmail || 'Not specified'}</span>
               </div>
             </div>
-
+            <div className="grid grid-cols-2 gap-2.5 border-t border-slate-800/60 pt-2">
-              <div className="flex items-center gap-2.5 bg-slate-900/60 p-2.5 rounded-lg border border-slate-800/60">
+              <div>
-                <Building2 className="w-4 h-4 text-indigo-400 shrink-0" />
+                <span className="text-[10px] uppercase font-semibold text-slate-500 block">Tenant</span>
-                <div className="min-w-0">
+                <span className="text-slate-300 truncate block">{tenant}</span>
-                  <span className="text-[10px] text-slate-500 block">Tenant / Role</span>
-                  <span className="font-semibold text-slate-200 truncate block">
-                    {tenant} ({role})
-                  </span>
-                </div>
-              </div>
-
-              <div className="flex items-center gap-2.5 bg-slate-900/60 p-2.5 rounded-lg border border-slate-800/60">
-                <Fingerprint className="w-4 h-4 text-slate-400 shrink-0" />
-                <div className="min-w-0">
-                  <span className="text-[10px] text-slate-500 block">Subject ID</span>
-                  <span className="font-mono text-[11px] text-slate-400 truncate block">{sub || 'SSO-Principal'}</span>
               </div>
+              <div>
+                <span className="text-[10px] uppercase font-semibold text-slate-500 block">Role</span>
+                <span className="text-blue-400 font-medium truncate block">{role}</span>
               </div>
             </div>
           </div>
 
-          {/* Sync Attempt Feedback / Error Notice */}
+          {/* Feedback notice if sync failed */}
           {errorMessage && (
-            <div className="rounded-xl border border-rose-500/30 bg-rose-500/10 p-3.5 flex items-start gap-3 animate-in fade-in duration-150">
+            <div className="rounded-xl border border-amber-500/25 bg-amber-500/10 p-3 flex items-start gap-2.5 text-xs text-amber-200">
-              <AlertTriangle className="w-4 h-4 text-rose-400 shrink-0 mt-0.5" />
+              <AlertTriangle className="w-4 h-4 text-amber-400 shrink-0 mt-0.5" />
-              <div className="space-y-1">
+              <div className="min-w-0">
-                <p className="text-xs font-semibold text-rose-300">
+                <span className="font-semibold text-amber-300 block">Notice:</span>
-                  {errorMessage?.toLowerCase().includes('tenant')
+                <p className="text-[11px] text-amber-200/90 leading-relaxed mt-0.5">{errorMessage}</p>
-                    ? 'Tenant Lockout In Effect'
-                    : 'Account Not Activated Yet'}
-                </p>
-                <p className="text-xs text-rose-200/90 leading-relaxed">{errorMessage}</p>
-                {syncAttemptCount > 0 && (
-                  <p className="text-[11px] text-rose-400/80 pt-1">
-                    Attempt #{syncAttemptCount} checked at {new Date().toLocaleTimeString()}
-                  </p>
-                )}
               </div>
             </div>
           )}
+
+          <p className="text-[11px] text-slate-400 text-center">
+            Once your administrator enables your account, click <strong className="text-white">Sync Account</strong> to enter the console.
+          </p>
         </div>
 
-        {/* Modal Actions */}
+        {/* Footer Actions */}
-        <div className="p-5 border-t border-slate-800/80 bg-[#0a0f1d] flex flex-col sm:flex-row items-center justify-between gap-3">
+        <div className="p-4 border-t border-slate-800 bg-[#0a0f1d] flex flex-col sm:flex-row items-center justify-between gap-2.5">
           <div className="flex items-center gap-2 w-full sm:w-auto">
             <button
               onClick={handleNavigateLanding}
               type="button"
-              className="flex-1 sm:flex-none inline-flex items-center justify-center gap-1.5 px-3.5 py-2 text-xs font-medium text-slate-400 hover:text-slate-200 bg-slate-900 hover:bg-slate-800 border border-slate-800 rounded-xl transition cursor-pointer"
+              className="flex-1 sm:flex-none inline-flex items-center justify-center gap-1.5 px-3 py-2 text-xs font-medium text-slate-400 hover:text-white bg-slate-900 hover:bg-slate-800 border border-slate-800 rounded-xl transition cursor-pointer"
-              title="View public landing page. Entering the console again will display this modal until enabled."
             >
               <ArrowLeft className="w-3.5 h-3.5" />
               <span>Landing Page</span>
@@ -258,8 +211,7 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
             <button
               onClick={handleSignOut}
               type="button"
-              className="flex-1 sm:flex-none inline-flex items-center justify-center gap-1.5 px-3.5 py-2 text-xs font-medium text-slate-400 hover:text-rose-400 bg-slate-900 hover:bg-rose-500/10 border border-slate-800 hover:border-rose-500/30 rounded-xl transition cursor-pointer"
+              className="flex-1 sm:flex-none inline-flex items-center justify-center gap-1.5 px-3 py-2 text-xs font-medium text-slate-400 hover:text-rose-400 bg-slate-900 hover:bg-rose-500/10 border border-slate-800 hover:border-rose-500/20 rounded-xl transition cursor-pointer"
-              title="Sign out of current SSO session"
             >
               <LogOut className="w-3.5 h-3.5" />
               <span>Sign Out</span>
@@ -271,10 +223,10 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
             disabled={isSyncing}
             type="button"
             id="activation-sync-btn"
-            className="w-full sm:w-auto inline-flex items-center justify-center gap-2 px-5 py-2.5 text-xs font-semibold text-white bg-blue-600 hover:bg-blue-500 active:bg-blue-700 disabled:opacity-50 disabled:pointer-events-none rounded-xl shadow-lg shadow-blue-600/30 transition cursor-pointer"
+            className="w-full sm:w-auto inline-flex items-center justify-center gap-2 px-4 py-2 text-xs font-semibold text-white bg-blue-600 hover:bg-blue-500 active:bg-blue-700 disabled:opacity-50 rounded-xl shadow-md transition cursor-pointer"
           >
-            <RefreshCw className={`w-4 h-4 ${isSyncing ? 'animate-spin' : ''}`} />
+            <RefreshCw className={`w-3.5 h-3.5 ${isSyncing ? 'animate-spin' : ''}`} />
-            <span>{isSyncing ? 'Verifying Activation...' : 'Sync Account'}</span>
+            <span>{isSyncing ? 'Checking...' : 'Sync Account'}</span>
           </button>
         </div>
       </div>

PostFundManagement.ConsoleUI/src/components/auth/PartnerAccessDeniedModal.tsx

@@ -61,114 +61,57 @@ export const PartnerAccessDeniedModal: React.FC<PartnerAccessDeniedModalProps> =
       aria-modal="true"
       aria-labelledby="partner-denied-title"
       aria-describedby="partner-denied-description"
-      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 bg-black/85 backdrop-blur-md animate-in fade-in duration-200 overflow-y-auto"
+      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 bg-black/80 backdrop-blur-md animate-in fade-in duration-150 overflow-y-auto"
     >
-      <div className="relative w-full max-w-lg overflow-hidden rounded-2xl bg-[#0e1424] border border-rose-900/60 shadow-2xl shadow-rose-950/50 my-auto">
+      <div className="relative w-full max-w-md overflow-hidden rounded-2xl bg-[#0d1322] border border-slate-800 shadow-2xl my-auto text-slate-100">
-        {/* Glow Header Accent */}
+        <div className="h-1 w-full bg-rose-600" />
-        <div className="h-2 w-full bg-linear-to-r from-rose-600 via-red-500 to-amber-500" />
 
-        <div className="p-6 sm:p-8 space-y-6">
+        <div className="p-5 space-y-4">
-          {/* Header */}
+          <div className="flex items-start gap-3">
-          <div className="flex items-start gap-4">
+            <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-xl bg-rose-500/10 border border-rose-500/20 text-rose-400">
-            <div className="flex h-12 w-12 shrink-0 items-center justify-center rounded-2xl bg-rose-500/15 border border-rose-500/30 text-rose-400">
+              <Ban className="h-5 w-5" />
-              <Ban className="h-6 w-6 text-rose-400" />
             </div>
-            <div className="space-y-1">
+            <div>
-              <div className="flex items-center gap-2">
+              <h2 id="partner-denied-title" className="text-base font-bold text-white tracking-tight">
-                <span className="inline-flex items-center gap-1 text-[11px] font-semibold text-rose-400 bg-rose-950/60 px-2 py-0.5 rounded-md border border-rose-800/60">
+                Partner Portal Required
-                  <Lock className="w-3 h-3" />
-                  Restricted Role
-                </span>
-                <span className="text-xs text-slate-500">Security Policy</span>
-              </div>
-              <h2 id="partner-denied-title" className="text-lg font-bold text-white tracking-tight">
-                Access Denied: Partner Role
               </h2>
-              <p id="partner-denied-description" className="text-xs text-slate-400 leading-relaxed">
+              <p id="partner-denied-description" className="text-xs text-slate-400 mt-0.5">
-                Users assigned the <strong className="text-rose-300">Partner</strong> role by security are not permitted to access the PFM Backoffice Console.
+                Accounts with the Partner role must access the Partner Portal.
               </p>
             </div>
           </div>
 
-          {/* User & Identity Summary Card */}
+          <div className="rounded-xl bg-slate-900/60 border border-slate-800 p-3.5 space-y-2 text-xs">
-          <div className="rounded-xl bg-slate-900/80 border border-slate-800 p-4 space-y-3 text-xs">
+            <div className="flex items-center justify-between">
-            <div className="flex items-center justify-between pb-2 border-b border-slate-800/80">
+              <span className="text-slate-500 text-[11px] uppercase font-semibold">User</span>
-              <span className="text-slate-400 font-medium">Account Name</span>
+              <span className="text-white font-medium">{displayName}</span>
-              <span className="text-white font-semibold">{displayName}</span>
             </div>
-
             {displayEmail && (
-              <div className="flex items-center justify-between pb-2 border-b border-slate-800/80">
+              <div className="flex items-center justify-between border-t border-slate-800/60 pt-2">
-                <span className="text-slate-400 font-medium flex items-center gap-1.5">
+                <span className="text-slate-500 text-[11px] uppercase font-semibold">Email</span>
-                  <Mail className="w-3.5 h-3.5 text-slate-500" />
+                <span className="text-slate-300 font-mono text-[11px]">{displayEmail}</span>
-                  Email
-                </span>
-                <span className="text-slate-200 font-mono">{displayEmail}</span>
               </div>
             )}
-
+            <div className="flex items-center justify-between border-t border-slate-800/60 pt-2">
-            <div className="flex items-center justify-between pb-2 border-b border-slate-800/80">
+              <span className="text-slate-500 text-[11px] uppercase font-semibold">Role</span>
-              <span className="text-slate-400 font-medium flex items-center gap-1.5">
+              <span className="text-rose-400 font-medium">{role}</span>
-                <Building2 className="w-3.5 h-3.5 text-slate-500" />
+            </div>
-                Assigned Role
-              </span>
-              <span className="text-rose-400 font-semibold bg-rose-950/60 px-2 py-0.5 rounded border border-rose-800/50">
-                {role}
-              </span>
           </div>
 
-            {tenant && (
+          <p className="text-[11px] text-slate-400 text-center leading-relaxed">
-              <div className="flex items-center justify-between pb-2 border-b border-slate-800/80">
+            The Console is reserved for statutory administrators and programme managers.
-                <span className="text-slate-400 font-medium flex items-center gap-1.5">
-                  <Building2 className="w-3.5 h-3.5 text-slate-500" />
-                  Tenant Context
-                </span>
-                <span className="text-slate-200 font-medium truncate max-w-[220px]">{tenant}</span>
-              </div>
-            )}
-
-            {sub && (
-              <div className="flex items-center justify-between text-[11px] text-slate-500">
-                <span className="flex items-center gap-1">
-                  <Fingerprint className="w-3 h-3" />
-                  Subject Key
-                </span>
-                <span className="font-mono text-slate-400 truncate max-w-[200px]">{sub}</span>
-              </div>
-            )}
-          </div>
-
-          {/* Security Policy Information */}
-          <div className="p-4 rounded-xl bg-rose-950/20 border border-rose-900/40 text-xs text-rose-200 leading-relaxed space-y-1.5">
-            <p className="font-semibold text-rose-300 flex items-center gap-1.5">
-              <ShieldAlert className="w-4 h-4 text-rose-400" />
-              Administrative Boundary Notice
           </p>
-            <p className="text-[11px] text-rose-300/90">
-              The PFM Console is reserved for statutory administrators, sponsors, programme managers, and governance officers. Partner credentials cannot access this environment. If you require backoffice administrative access, please request an updated role assignment from your system administrator.
-            </p>
-          </div>
 
-          {/* Actions */}
+          <div className="pt-1">
-          <div className="pt-2">
             <button
               onClick={handleLogoutClick}
-              className="w-full flex items-center justify-center gap-2 py-2.5 px-4 rounded-xl bg-slate-800 hover:bg-slate-700 text-slate-200 hover:text-white text-xs font-semibold border border-slate-700 transition cursor-pointer shadow-sm"
+              className="w-full flex items-center justify-center gap-2 py-2.5 px-4 rounded-xl bg-blue-600 hover:bg-blue-500 text-white text-xs font-semibold shadow-md transition cursor-pointer"
             >
-              <LogOut className="w-4 h-4 text-rose-400" />
+              <LogOut className="w-4 h-4" />
-              <span>Sign Out & Return to Home</span>
+              <span>Sign Out & Return Home</span>
             </button>
           </div>
         </div>
-
-        {/* Footer Brand watermark */}
-        <div className="px-6 py-3 bg-[#0a0f1d] border-t border-slate-800/80 flex items-center justify-between text-[11px] text-slate-500">
-          <div className="flex items-center gap-2">
-            <BrandLogo size={16} showGlow={false} animateOnHover={false} />
-            <span>Post Fund Management (PFM)</span>
-          </div>
-          <span>National Security Gateway</span>
-        </div>
       </div>
     </div>
   );

PostFundManagement.ConsoleUI/src/components/auth/SessionExpiredModal.tsx

@@ -87,7 +87,7 @@ export const SessionExpiredModal: React.FC<SessionExpiredModalProps> = ({
   const modalContent = (
     <div
       id="session-expired-modal-backdrop"
-      className="fixed inset-0 z-[9999] flex items-center justify-center bg-black/85 backdrop-blur-md p-4 animate-in fade-in duration-200 overflow-y-auto"
+      className="fixed inset-0 z-[9999] flex items-center justify-center bg-black/80 backdrop-blur-md p-4 animate-in fade-in duration-150 overflow-y-auto"
       onMouseEnter={() => setIsPaused(true)}
       onMouseLeave={() => setIsPaused(false)}
       role="dialog"
@@ -96,27 +96,20 @@ export const SessionExpiredModal: React.FC<SessionExpiredModalProps> = ({
     >
       <div
         id="session-expired-modal-content"
-        className="relative w-full max-w-md bg-[#0c121e] border border-amber-500/40 rounded-2xl shadow-2xl shadow-black/90 p-6 overflow-hidden text-slate-200 space-y-5 my-auto"
+        className="relative w-full max-w-md bg-[#0d1322] border border-slate-800 rounded-2xl shadow-2xl p-5 overflow-hidden text-slate-200 space-y-4 my-auto"
       >
-        {/* Subtle decorative top accent bar */}
+        <div className="absolute top-0 left-0 right-0 h-1 bg-amber-500" />
-        <div className="absolute top-0 left-0 right-0 h-1 bg-gradient-to-r from-amber-500 via-orange-500 to-rose-500" />
 
-        {/* Top bar with close button */}
         <div className="flex items-start justify-between pt-1">
           <div className="flex items-center gap-3">
-            <div className="w-12 h-12 rounded-2xl bg-amber-500/10 border border-amber-500/30 flex items-center justify-center text-amber-400 shrink-0 shadow-lg shadow-amber-500/10">
+            <div className="w-10 h-10 rounded-xl bg-amber-500/10 border border-amber-500/20 flex items-center justify-center text-amber-400 shrink-0">
-              <ShieldAlert className="w-6 h-6" />
+              <ShieldAlert className="w-5 h-5" />
             </div>
             <div>
-              <div className="flex items-center gap-2">
               <h3 id="session-expired-title" className="text-base font-bold text-white tracking-tight">
                 Session Expired
               </h3>
-                <span className="text-[10px] font-mono font-semibold px-2 py-0.5 rounded bg-rose-950/60 text-rose-300 border border-rose-800/60">
+              <p className="text-xs text-slate-400">Authorization credentials expired</p>
-                  HTTP 401
-                </span>
-              </div>
-              <p className="text-xs text-slate-400 mt-0.5">Authorization token invalidated</p>
             </div>
           </div>
 
@@ -125,60 +118,46 @@ export const SessionExpiredModal: React.FC<SessionExpiredModalProps> = ({
             type="button"
             onClick={handleAction}
             aria-label="Dismiss and return to landing page"
-            className="p-1.5 text-slate-400 hover:text-white rounded-lg hover:bg-slate-800/80 transition-colors"
+            className="p-1.5 text-slate-400 hover:text-white rounded-lg hover:bg-slate-800 transition-colors cursor-pointer"
           >
             <X className="w-4 h-4" />
           </button>
         </div>
 
-        {/* Informative Explanation (non-technical and clear) */}
+        <div className="text-xs text-slate-300 leading-relaxed bg-slate-900/60 p-3.5 rounded-xl border border-slate-800/80 space-y-1.5">
-        <div className="space-y-2.5 text-xs text-slate-300 leading-relaxed bg-slate-900/60 p-4 rounded-xl border border-slate-800/80">
           <p>
-            Your active working session has ended or your security credentials have expired. To protect your data and prevent unauthorized changes, your session has been closed.
+            Your active session has ended to protect account security. Please sign in again to continue working.
           </p>
           {reason && (
-            <div className="flex items-start gap-2 pt-1 text-[11px] text-amber-300/90 font-mono">
+            <div className="flex items-start gap-1.5 pt-1 text-[11px] text-amber-300/90 font-mono">
               <AlertTriangle className="w-3.5 h-3.5 shrink-0 mt-0.5 text-amber-400" />
               <span className="break-words">{reason}</span>
             </div>
           )}
         </div>
 
-        {/* Progress Bar Countdown */}
+        <div className="flex items-center justify-between text-xs text-slate-400">
-        <div className="space-y-2">
+          <span className="flex items-center gap-1.5">
-          <div className="flex items-center justify-between text-xs">
-            <span className="text-slate-400 flex items-center gap-1.5">
             <Clock className="w-3.5 h-3.5 text-amber-400" />
-              Returning to landing page in{' '}
+            Redirecting in <strong className="text-white font-mono">{secondsRemaining}s</strong>
-              <strong className="text-white font-mono">{secondsRemaining}s</strong>
           </span>
           {isPaused && (
-              <span className="text-[10px] text-amber-400/80 font-medium px-1.5 py-0.2 rounded bg-amber-950/40 border border-amber-900/60">
+            <span className="text-[10px] text-amber-400/80 px-1.5 py-0.5 rounded bg-amber-500/10 border border-amber-500/20">
-                Paused on hover
+              Paused
             </span>
           )}
         </div>
 
-          {/* Progress bar line */}
+        <div className="pt-1">
-          <div className="w-full h-2 bg-slate-800/90 rounded-full overflow-hidden border border-slate-700/60 p-0.5">
-            <div
-              className="h-full rounded-full bg-gradient-to-r from-amber-500 via-orange-500 to-rose-500 transition-all duration-75 ease-linear"
-              style={{ width: `${progressPercent}%` }}
-            />
-          </div>
-        </div>
-
-        {/* Actions */}
-        <div className="pt-2 flex flex-col sm:flex-row items-center gap-2.5">
           <button
             id="session-expired-return-btn"
             type="button"
             onClick={handleAction}
-            className="w-full py-2.5 px-4 text-xs font-semibold text-white bg-gradient-to-r from-blue-600 to-indigo-600 hover:from-blue-500 hover:to-indigo-500 rounded-xl shadow-lg shadow-blue-500/20 transition-all flex items-center justify-center gap-2"
+            className="w-full py-2.5 px-4 text-xs font-semibold text-white bg-blue-600 hover:bg-blue-500 rounded-xl shadow-md transition-all flex items-center justify-center gap-2 cursor-pointer"
           >
             <LogOut className="w-4 h-4" />
-            <span>Return to Landing Page Now</span>
+            <span>Return to Landing Page</span>
-            <ArrowRight className="w-3.5 h-3.5 ml-0.5" />
+            <ArrowRight className="w-3.5 h-3.5" />
           </button>
         </div>
       </div>

PostFundManagement.ConsoleUI/src/components/layout/AppLayout.tsx

@@ -1,5 +1,5 @@
 import React, { useState } from 'react';
-import { NavLink, Outlet, useNavigate, Link } from 'react-router-dom';
+import { NavLink, Outlet, useNavigate, Link, useLocation } from 'react-router-dom';
 import { NotificationBell } from './NotificationBell';
 import {
   Inbox,
@@ -144,6 +144,27 @@ export const AppLayout: React.FC = () => {
   const [sidebarOpen, setSidebarOpen] = useState(true);
   const [userMenuOpen, setUserMenuOpen] = useState(false);
   const navigate = useNavigate();
+  const location = useLocation();
+  const [collapsedSections, setCollapsedSections] = useState<Record<string, boolean>>({});
+
+  const isSectionCollapsed = (path: string, subItems?: SubNavItem[]): boolean => {
+    if (collapsedSections[path] !== undefined) {
+      return collapsedSections[path];
+    }
+    if (subItems?.some((s) => location.pathname.startsWith(s.path))) {
+      return false;
+    }
+    return false;
+  };
+
+  const toggleSection = (path: string, e: React.MouseEvent) => {
+    e.preventDefault();
+    e.stopPropagation();
+    setCollapsedSections((prev) => ({
+      ...prev,
+      [path]: !isSectionCollapsed(path),
+    }));
+  };
 
   const handleLogout = async () => {
     await logout();
@@ -186,7 +207,6 @@ export const AppLayout: React.FC = () => {
   useQuery({
     queryKey: ['users-directory'],
     queryFn: () => getUsers(1, 200),
-    staleTime: 5 * 60 * 1000,
   });
 
   // Query tenant endpoint to resolve tenant name if not provided in claims or profile
@@ -194,7 +214,6 @@ export const AppLayout: React.FC = () => {
     queryKey: ['active-tenant-header', tenantId],
     queryFn: () => getTenant(tenantId!),
     enabled: !!tenantId && !claims?.tenant && !user?.tenant && !authTenantName,
-    staleTime: 5 * 60 * 1000,
   });
 
   // Ensure current logged-in user is registered in the email cache
@@ -346,13 +365,16 @@ export const AppLayout: React.FC = () => {
               );
             }
 
+            const isCollapsed = isSectionCollapsed(item.path, item.subItems);
+
             return (
               <div key={item.path} className="space-y-1">
+                <div className="flex items-center gap-1">
                   <NavLink
                     to={item.path}
                     end={hasSub}
                     className={({ isActive }) =>
-                    `flex items-center gap-3 px-3.5 py-2.5 rounded-xl text-xs font-medium transition-all min-w-0 ${
+                      `flex-1 flex items-center gap-3 px-3.5 py-2.5 rounded-xl text-xs font-medium transition-all min-w-0 ${
                         isActive
                           ? 'bg-gradient-to-r from-blue-600 to-indigo-600 text-white shadow-md shadow-blue-600/25 font-semibold'
                           : 'text-slate-400 hover:text-slate-100 hover:bg-slate-800/60'
@@ -363,9 +385,25 @@ export const AppLayout: React.FC = () => {
                     <Icon className="w-4.5 h-4.5 shrink-0" />
                     <span className="truncate flex-1">{item.name}</span>
                   </NavLink>
+                  {hasSub && (
+                    <button
+                      type="button"
+                      onClick={(e) => toggleSection(item.path, e)}
+                      className="p-2 text-slate-400 hover:text-white hover:bg-slate-800/80 rounded-lg transition-colors cursor-pointer"
+                      title={isCollapsed ? `Expand ${item.name}` : `Collapse ${item.name}`}
+                      aria-label={isCollapsed ? `Expand ${item.name}` : `Collapse ${item.name}`}
+                    >
+                      <ChevronDown
+                        className={`w-3.5 h-3.5 transition-transform duration-200 ${
+                          isCollapsed ? '-rotate-90 text-slate-500' : 'rotate-0 text-slate-300'
+                        }`}
+                      />
+                    </button>
+                  )}
+                </div>
 
                 {/* Sub-items under parent item */}
-                {hasSub && (
+                {hasSub && !isCollapsed && (
                   <div className="pl-6 pr-1 py-1 space-y-1 border-l border-slate-800/80 ml-5">
                     {item.subItems?.map((subItem) => {
                       const SubIcon = subItem.icon;

PostFundManagement.ConsoleUI/src/components/monitoring/ContractsManagement.tsx

@@ -36,7 +36,7 @@ import {
   getAllProgrammes,
   getProjects,
 } from '../../services/api';
-import { toolsService } from '../../services/toolsService';
+import { toolsService } from '../../utils/hashids';
 import { Modal } from '../ui/Modal';
 import { useToast } from '../ui/Toast';
 import { ProblemDetailsAlert } from '../ui/ProblemDetailsAlert';
@@ -1247,7 +1247,7 @@ export const ContractsManagement: React.FC<ContractsManagementProps> = ({
             {Number(contractToUpdate?.status) === ContractStatus.Active ? (
               <div className="w-full bg-[#151b2c] border border-emerald-500/30 rounded-xl px-3 py-2 text-xs text-emerald-300 font-semibold flex items-center gap-1.5 cursor-default">
                 <Lock className="w-3.5 h-3.5 text-emerald-400" />
-                <span>Active / Executed (Immutable - Cannot Be Changed)</span>
+                <span>Active / Executed</span>
               </div>
             ) : (
               (() => {

PostFundManagement.ConsoleUI/src/components/monitoring/EvidenceReviewQueue.tsx

@@ -807,7 +807,7 @@ export const EvidenceReviewQueue: React.FC<EvidenceReviewQueueProps> = ({
                           title="Approved evidence is immutable. Status cannot be modified."
                         >
                           <Lock className="w-3.5 h-3.5 text-emerald-400" />
-                          <span>Approved (Immutable)</span>
+                          <span>Approved</span>
                         </span>
                       ) : (
                         <>

PostFundManagement.ConsoleUI/src/components/notifications/UserSearchPicker.tsx

@@ -58,7 +58,6 @@ export const UserSearchPicker: React.FC<UserSearchPickerProps> = ({
   const { data: users = [], isLoading } = useQuery<User[]>({
     queryKey: ['users-directory'],
     queryFn: () => getUsers(1, 200),
-    staleTime: 5 * 60 * 1000,
   });
 
   // Filter active users and exclude the current logged-in user so they can never message themselves

PostFundManagement.ConsoleUI/src/components/projects/ProjectActivitiesModal.tsx

@@ -37,7 +37,7 @@ const activitySchema = z.object({
   title: z.string().min(3, 'Activity title required'),
   description: z.string().min(5, 'Description required'),
   category: z.string().min(2, 'Category required'),
-  amount: z.coerce.number().min(1, 'Amount must be positive'),
+  amount: z.coerce.number().min(0, 'Amount must be non-negative'),
   milestoneId: z.string().optional().nullable(),
   performedAt: z.string().optional().nullable(),
 });

PostFundManagement.ConsoleUI/src/components/projects/ProjectExpandedRow.tsx

@@ -20,6 +20,7 @@ import {
   getProjectIndicators,
   getProjectRisks,
   getBudgets,
+  getDisbursements,
 } from '../../services/api';
 import { Project, ApprovalStatus, Budget } from '../../types';
 import {
@@ -86,9 +87,21 @@ export const ProjectExpandedRow: React.FC<ProjectExpandedRowProps> = ({
   );
   const approvedBudgetTotal = approvedBudgets.reduce((sum, b) => sum + (Number(b.amount) || 0), 0);
 
+  const { data: disbursements = [] } = useQuery({
+    queryKey: ['disbursements', projectId],
+    queryFn: () => getDisbursements(1, 100),
+  });
+
+  const projectDisbursements = disbursements.filter(
+    (d) => String(d.projectId) === String(projectId) && (Number(d.status) === ApprovalStatus.Approved || Number(d.status) === 3)
+  );
+  const totalDisbursed = projectDisbursements.reduce((sum, d) => sum + (Number(d.amount) || 0), 0);
+
   const verifiedMilestonesCount = milestones.filter((m) => m.status === ApprovalStatus.Approved).length;
   const milestoneProgress = milestones.length > 0 ? Math.round((verifiedMilestonesCount / milestones.length) * 100) : 0;
   const totalActivityBudget = activities.reduce((sum, a) => sum + (Number(a.amount) || 0), 0);
+  const projectValue = totalActivityBudget - totalDisbursed;
+  const projectVariance = approvedBudgetTotal - projectValue;
 
   return (
     <div className="p-4 sm:p-5 lg:p-6 bg-[#090d16]/95 border-t border-b border-blue-500/20 space-y-6 animate-in fade-in duration-200 w-full min-w-0">
@@ -108,6 +121,19 @@ export const ProjectExpandedRow: React.FC<ProjectExpandedRowProps> = ({
                 <span className="text-xs text-emerald-400 font-mono font-semibold shrink-0">
                   Approved Budget: {formatZAR(approvedBudgetTotal)}
                 </span>
+                <span className="text-slate-600">&bull;</span>
+                <span className="text-xs text-blue-400 font-mono font-semibold shrink-0" title={`Activities: ${formatZAR(totalActivityBudget)} - Disbursements: ${formatZAR(totalDisbursed)}`}>
+                  Project Value: {formatZAR(projectValue)}
+                </span>
+                <span className="text-slate-600">&bull;</span>
+                <span
+                  className={`text-xs font-mono font-semibold shrink-0 ${
+                    projectVariance >= 0 ? 'text-emerald-400' : 'text-rose-400'
+                  }`}
+                  title="Approved Budget minus Net Project Value"
+                >
+                  Variance: {projectVariance >= 0 ? '+' : ''}{formatZAR(projectVariance)}
+                </span>
               </>
             )}
           </div>

PostFundManagement.ConsoleUI/src/components/projects/ProjectViewModal.tsx

@@ -33,6 +33,7 @@ import {
   getProjectIndicators,
   getProjectRisks,
   getBudgets,
+  getDisbursements,
   updateProjectStatus,
 } from '../../services/api';
 import { Project, ApprovalStatus, Programme } from '../../types';
@@ -150,11 +151,23 @@ export const ProjectViewModal: React.FC<ProjectViewModalProps> = ({
   );
   const approvedBudgetTotal = approvedBudgets.reduce((sum, b) => sum + (Number(b.amount) || 0), 0);
 
-  // Milestone Progress
+  // Milestone Progress & Disbursements
   const verifiedMilestonesCount = milestones.filter((m) => m.status === ApprovalStatus.Approved).length;
   const milestoneProgress = milestones.length > 0 ? Math.round((verifiedMilestonesCount / milestones.length) * 100) : 0;
   const totalActivityBudget = activities.reduce((sum, a) => sum + (Number(a.amount) || 0), 0);
 
+  const { data: disbursements = [] } = useQuery({
+    queryKey: ['disbursements', project?.id],
+    queryFn: () => getDisbursements(1, 100),
+    enabled: !!project?.id,
+  });
+  const projectDisbursements = disbursements.filter(
+    (d) => String(d.projectId) === String(project?.id) && (Number(d.status) === ApprovalStatus.Approved || Number(d.status) === 3)
+  );
+  const totalDisbursed = projectDisbursements.reduce((sum, d) => sum + (Number(d.amount) || 0), 0);
+  const projectValue = totalActivityBudget - totalDisbursed;
+  const projectVariance = approvedBudgetTotal - projectValue;
+
   // Schedule Risk
   const scheduleRisk = useMemo(() => {
     if (!project) return null;
@@ -244,20 +257,20 @@ export const ProjectViewModal: React.FC<ProjectViewModalProps> = ({
                   Budget: {formatZAR(approvedBudgetTotal)}
                 </span>
                 <span className="text-slate-600">&bull;</span>
-                <span className="text-blue-400 font-mono font-bold">
+                <span className="text-blue-400 font-mono font-bold" title={`Activities Total: ${formatZAR(totalActivityBudget)} minus Disbursements: ${formatZAR(totalDisbursed)}`}>
-                  Project Value: {formatZAR(totalActivityBudget)}
+                  Project Value: {formatZAR(projectValue)}
                 </span>
                 <span className="text-slate-600">&bull;</span>
                 <span
                   className={`font-mono font-bold px-2 py-0.5 rounded text-[11px] border ${
-                    approvedBudgetTotal - totalActivityBudget >= 0
+                    projectVariance >= 0
                       ? 'text-emerald-400 bg-emerald-500/10 border-emerald-500/30'
                       : 'text-rose-400 bg-rose-500/10 border-rose-500/30'
                   }`}
-                  title="Approved Budget minus Total Project Value"
+                  title={`Approved Budget: ${formatZAR(approvedBudgetTotal)} | Net Project Value: ${formatZAR(projectValue)} (Activities: ${formatZAR(totalActivityBudget)} - Disbursements: ${formatZAR(totalDisbursed)}) | Variance: ${projectVariance >= 0 ? '+' : ''}${formatZAR(projectVariance)}`}
                 >
-                  Variance: {approvedBudgetTotal - totalActivityBudget >= 0 ? '+' : ''}
+                  Variance: {projectVariance >= 0 ? '+' : ''}
-                  {formatZAR(approvedBudgetTotal - totalActivityBudget)}
+                  {formatZAR(projectVariance)}
                 </span>
               </div>
             </div>

PostFundManagement.ConsoleUI/src/components/users/UserSecurityModal.tsx

@@ -32,6 +32,7 @@ import { clearCachedUserRbac, fetchAndCacheRoleClaims } from '../../services/rol
 import { HelpTooltip } from '../ui/HelpTooltip';
 import { ObfuscatedIdNumber } from '../ui/ObfuscatedIdNumber';
 import { decodeIdNumberHex } from '../../utils/hashids';
+import { useAuth } from '../../auth/AuthProvider';
 import { User, Role, Claim, ActivityStatus } from '../../types';
 import { formatDate, getActivityStatusBadge, getUserRoleBadge } from '../../lib/formatters';
 import { useRbac, ROLE_CLAIM_DEFINITIONS } from '../../auth/rbac';
@@ -49,9 +50,15 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
 }) => {
   const queryClient = useQueryClient();
   const { success, error: toastError } = useToast();
+  const { user: currentAuthUser } = useAuth();
   const { canApprove, canAdd, canView, canAccess, isUnrestricted } = useRbac();
   const hasTenantSelfHelpAccess = canAccess('tenant_self_service') || canView('tenant_self_service');
 
+  const userId = user?.id || '';
+  const isSelf =
+    Boolean(currentAuthUser?.id && userId && String(currentAuthUser.id).toLowerCase() === String(userId).toLowerCase()) ||
+    Boolean(currentAuthUser?.email && user?.email && currentAuthUser.email.toLowerCase() === user.email.toLowerCase());
+
   const canManageRolesAndClaims =
     canApprove('settings_users') ||
     canApprove('tenant_management') ||
@@ -63,18 +70,17 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
     hasTenantSelfHelpAccess ||
     isUnrestricted;
   const canChangeStatus =
-    canAdd('settings_users') ||
+    !isSelf &&
+    (canAdd('settings_users') ||
       canAdd('tenant_management') ||
       canAdd('tenant_self_service') ||
       canApprove('settings_users') ||
-    isUnrestricted;
+      isUnrestricted);
 
   const [activeTab, setActiveTab] = useState<'overview' | 'roles' | 'claims' | 'sessions'>('overview');
 
   const [selectedRoleToAdd, setSelectedRoleToAdd] = useState('');
 
-  const userId = user?.id || '';
-
   // 1. Fetch fresh user details
   const { data: freshUser, isLoading: loadingUser, refetch: refetchUser } = useQuery<User | null>({
     queryKey: ['user-detail', userId],
@@ -237,20 +243,35 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
     onError: (err: unknown) => toastError('Logout Failed', err),
   });
 
-  const lockoutMutation = useMutation({
+  const lockUserMutation = useMutation({
-    mutationFn: (disableLock: boolean) => setUserLockout(userId, disableLock),
+    mutationFn: () => setUserLockout(userId, true),
-    onSuccess: (_, disableLock) => {
+    onSuccess: () => {
-      success(
+      success('Account Locked', 'User account lockout enabled (disable = true).');
-        disableLock ? 'Account Unlocked' : 'Account Locked',
-        `User account lockout status successfully modified.`
-      );
       refetchUser();
+      queryClient.invalidateQueries({ queryKey: ['users'] });
+      queryClient.invalidateQueries({ queryKey: ['user-detail', userId] });
     },
-    onError: (err: unknown) => toastError('Lockout Update Failed', err),
+    onError: (err: unknown) => toastError('Lock User Failed', err),
+  });
+
+  const unlockUserMutation = useMutation({
+    mutationFn: () => setUserLockout(userId, false),
+    onSuccess: () => {
+      success('Account Unlocked', 'User account lockout disabled (disable = false).');
+      refetchUser();
+      queryClient.invalidateQueries({ queryKey: ['users'] });
+      queryClient.invalidateQueries({ queryKey: ['user-detail', userId] });
+    },
+    onError: (err: unknown) => toastError('Unlock User Failed', err),
   });
 
   const statusMutation = useMutation({
-    mutationFn: (newStatus: ActivityStatus) => updateUserStatus(userId, newStatus),
+    mutationFn: (newStatus: ActivityStatus) => {
+      if (isSelf) {
+        throw new Error('Maker-Checker Violation: You cannot alter your own account activity status.');
+      }
+      return updateUserStatus(userId, newStatus);
+    },
     onSuccess: () => {
       success('Status Updated', 'User activity status changed.');
       refetchUser();
@@ -280,18 +301,18 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
     <Modal
       isOpen={isOpen}
       onClose={onClose}
-      title={`User Administration: ${effectiveUser.email || effectiveUser.id}`}
+      title={`User Security: ${effectiveUser.email || effectiveUser.id}`}
-      subtitle="Direct tenant-level user, role, claims, and session administration without database intervention."
+      subtitle="Manage account status, role assignment, permissions, and active sessions."
     >
       <div className="space-y-4 text-xs">
         {/* Navigation Tabs */}
-        <div className="flex gap-2 border-b border-slate-800 pb-2">
+        <div className="flex gap-1.5 border-b border-slate-800 pb-2">
           <button
             type="button"
             onClick={() => setActiveTab('overview')}
-            className={`px-3 py-1.5 rounded-lg font-semibold transition cursor-pointer ${
+            className={`px-3 py-1.5 rounded-lg font-medium transition cursor-pointer ${
               activeTab === 'overview'
-                ? 'bg-blue-600 text-white'
+                ? 'bg-blue-600 text-white font-semibold'
                 : 'text-slate-400 hover:text-white hover:bg-slate-800'
             }`}
           >
@@ -300,21 +321,21 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
           <button
             type="button"
             onClick={() => setActiveTab('roles')}
-            className={`px-3 py-1.5 rounded-lg font-semibold transition cursor-pointer flex items-center gap-1.5 ${
+            className={`px-3 py-1.5 rounded-lg font-medium transition cursor-pointer flex items-center gap-1.5 ${
               activeTab === 'roles'
-                ? 'bg-blue-600 text-white'
+                ? 'bg-blue-600 text-white font-semibold'
                 : 'text-slate-400 hover:text-white hover:bg-slate-800'
             }`}
           >
             <Shield className="w-3.5 h-3.5" />
-            <span>Roles ({(Array.isArray(userRoles) ? userRoles : []).length})</span>
+            <span>Role ({(Array.isArray(userRoles) ? userRoles : []).length})</span>
           </button>
           <button
             type="button"
             onClick={() => setActiveTab('claims')}
-            className={`px-3 py-1.5 rounded-lg font-semibold transition cursor-pointer flex items-center gap-1.5 ${
+            className={`px-3 py-1.5 rounded-lg font-medium transition cursor-pointer flex items-center gap-1.5 ${
               activeTab === 'claims'
-                ? 'bg-blue-600 text-white'
+                ? 'bg-blue-600 text-white font-semibold'
                 : 'text-slate-400 hover:text-white hover:bg-slate-800'
             }`}
           >
@@ -324,9 +345,9 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
           <button
             type="button"
             onClick={() => setActiveTab('sessions')}
-            className={`px-3 py-1.5 rounded-lg font-semibold transition cursor-pointer flex items-center gap-1.5 ${
+            className={`px-3 py-1.5 rounded-lg font-medium transition cursor-pointer flex items-center gap-1.5 ${
               activeTab === 'sessions'
-                ? 'bg-blue-600 text-white'
+                ? 'bg-blue-600 text-white font-semibold'
                 : 'text-slate-400 hover:text-white hover:bg-slate-800'
             }`}
           >
@@ -386,7 +407,14 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
                   </span>
                 </div>
                 <div className="flex items-center gap-2">
-                  {effectiveUser?.status === ActivityStatus.Active ? (
+                  {isSelf ? (
+                    <span
+                      className="px-2.5 py-1 text-[11px] font-semibold text-slate-400 bg-slate-900 border border-slate-800 rounded-lg"
+                      title="Maker-Checker policy: Administrators cannot change their own account activity status"
+                    >
+                      Self-Account (Protected)
+                    </span>
+                  ) : effectiveUser?.status === ActivityStatus.Active ? (
                     <button
                       type="button"
                       onClick={() => statusMutation.mutate(ActivityStatus.Inactive)}
@@ -592,70 +620,66 @@ export const UserSecurityModal: React.FC<UserSecurityModalProps> = ({
           </div>
         )}
 
-        {/* TAB 4: Sessions & Direct Account Interventions */}
+        {/* TAB 4: Sessions & Security Interventions */}
         {activeTab === 'sessions' && (
           <div className="space-y-3">
             <div className="p-4 bg-slate-900/60 rounded-xl border border-slate-800 space-y-4">
               {/* Force Logout Action */}
-              <div className="flex items-center justify-between border-b border-slate-800/80 pb-3">
+              <div className="flex items-center justify-between border-b border-slate-800/80 pb-3 gap-3">
                 <div>
                   <h4 className="text-white font-semibold flex items-center gap-1.5">
                     <LogOut className="w-4 h-4 text-amber-400" />
                     <span>Revoke Active User Session</span>
-                    <HelpTooltip
-                      title="User Session Invalidation"
-                      content="Enables a tenant self-service user to immediately logout a user if they are currently logged in, terminating their active token and session."
-                      size="sm"
-                      placement="top"
-                    />
                   </h4>
                   <p className="text-[11px] text-slate-400 mt-0.5">
-                    Terminates all active JWT tokens and sessions immediately without direct database intervention.
+                    Immediately invalidates active JWT tokens and logs the user out.
                   </p>
                 </div>
                 <button
                   type="button"
                   onClick={() => logoutMutation.mutate()}
                   disabled={logoutMutation.isPending || !canManageSessions}
-                  className="px-3 py-1.5 bg-amber-500/10 hover:bg-amber-500/20 text-amber-400 border border-amber-500/20 rounded-xl font-semibold transition cursor-pointer disabled:opacity-50"
+                  className="px-3 py-1.5 bg-amber-500/10 hover:bg-amber-500/20 text-amber-400 border border-amber-500/20 rounded-xl font-semibold transition cursor-pointer disabled:opacity-50 shrink-0"
                 >
                   {logoutMutation.isPending ? 'Revoking...' : 'Force Logout'}
                 </button>
               </div>
 
               {/* Lock / Unlock Account */}
-              <div className="flex items-center justify-between">
+              <div className="flex items-center justify-between gap-3">
                 <div>
                   <h4 className="text-white font-semibold flex items-center gap-1.5">
                     <Lock className="w-4 h-4 text-rose-400" />
-                    <span>Account Lockout Control</span>
+                    <span>Account Lockout</span>
-                    <HelpTooltip
-                      title="Account Lockout Control"
-                      content="Enables a tenant self-service user to change a user's lockout status. The system defaults to a lockout period of 100 years when locking a user account."
-                      size="sm"
-                      placement="top"
-                    />
                   </h4>
                   <p className="text-[11px] text-slate-400 mt-0.5">
-                    Temporarily lock out or re-enable the user from logging into this tenant. The system defaults to a lockout period of 100 years.
+                    Control tenant login authorization for this account.
                   </p>
                 </div>
-                <div className="flex items-center gap-2">
+                <div className="flex items-center gap-2 shrink-0">
                   <button
                     type="button"
-                    onClick={() => lockoutMutation.mutate(false)}
+                    onClick={(e) => {
-                    disabled={lockoutMutation.isPending || !canManageSessions}
+                      e.preventDefault();
+                      e.stopPropagation();
+                      lockUserMutation.mutate();
+                    }}
+                    disabled={lockUserMutation.isPending || unlockUserMutation.isPending || !canManageSessions}
                     className="px-3 py-1.5 bg-rose-500/10 hover:bg-rose-500/20 text-rose-400 border border-rose-500/20 rounded-xl font-semibold transition cursor-pointer disabled:opacity-50"
                   >
-                    Lock User
+                    {lockUserMutation.isPending ? 'Locking...' : 'Lock User'}
                   </button>
                   <button
                     type="button"
-                    onClick={() => lockoutMutation.mutate(true)}
+                    onClick={(e) => {
-                    disabled={lockoutMutation.isPending || !canManageSessions}
+                      e.preventDefault();
+                      e.stopPropagation();
+                      unlockUserMutation.mutate();
+                    }}
+                    disabled={unlockUserMutation.isPending || lockUserMutation.isPending || !canManageSessions}
                     className="px-3 py-1.5 bg-emerald-500/10 hover:bg-emerald-500/20 text-emerald-400 border border-emerald-500/20 rounded-xl font-semibold transition cursor-pointer disabled:opacity-50"
                   >
-                    Unlock User
+                    {unlockUserMutation.isPending ? 'Unlocking...' : 'Unlock User'}
                   </button>
                 </div>
               </div>

PostFundManagement.ConsoleUI/src/config.ts

@@ -1,10 +1,10 @@
-import { updateHasherSettings } from './services/toolsService';
+import { updateHasherSettings } from './utils/hashids';
 
 export interface SecuritySettings {
   Authority: string;
   Audience: string;
   ClientId: string;
-  ClientSecret: string;
+  ClientSecret?: string;
   Scope?: string;
 }
 
@@ -13,7 +13,7 @@ export interface ApiSettings {
 }
 
 export interface HasherSettings {
-  Salt: string;
+  Salt?: string;
   MinHashLength: number;
 }
 
@@ -36,7 +36,6 @@ export const defaultSecuritySettings: SecuritySettings = {
   Authority: 'https://sts.security.khongisa.co.za',
   Audience: 'pfm-api-dev',
   ClientId: 'pfm-console-dev',
-  ClientSecret: 'secret_dcaeaa28097d9ba5b06ec324d9eac9d9c81de96e0a203cf2c6154c6dd7c89e94',
   Scope: 'openid profile roles email address pfm-api-dev',
 };
 
@@ -49,6 +48,10 @@ export const defaultHasherSettings: HasherSettings = {
   MinHashLength: 11,
 };
 
+function syncAllHasherSettings(salt: string | undefined, minHashLength: number): void {
+  updateHasherSettings(salt, minHashLength);
+}
+
 /**
  * Extracts first non-empty, trimmed string from candidate values.
  */
@@ -255,9 +258,8 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
   const clientSecret = pickFirstNonEmpty(
     windowConfig.clientSecret,
     fetchedConfig.clientSecret,
-    buildEnvConfig.clientSecret,
+    buildEnvConfig.clientSecret
-    defaultSecuritySettings.ClientSecret
+  );
-  )!;
 
   const scope = pickFirstNonEmpty(
     windowConfig.scope,
@@ -278,7 +280,7 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
     fetchedConfig.hasherSalt,
     buildEnvConfig.hasherSalt,
     defaultHasherSettings.Salt
-  )!;
+  );
 
   const minHashLength =
     windowConfig.hasherMinLength ||
@@ -291,14 +293,14 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
       Authority: normalizeAuthorityUrl(authority),
       Audience: audience,
       ClientId: clientId,
-      ClientSecret: clientSecret,
+      ...(clientSecret ? { ClientSecret: clientSecret } : {}),
       Scope: scope,
     },
     ApiSettings: {
       BaseUrl: normalizeBaseUrl(baseUrl),
     },
     HasherSettings: {
-      Salt: salt,
+      Salt: salt || defaultHasherSettings.Salt,
       MinHashLength: minHashLength,
     },
     ConfigSource: source,
@@ -310,7 +312,7 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
 let runtimeConfig: AppConfig = resolveConfig();
 
 // Immediately apply deterministic hasher settings
-updateHasherSettings(runtimeConfig.HasherSettings.Salt, runtimeConfig.HasherSettings.MinHashLength);
+syncAllHasherSettings(runtimeConfig.HasherSettings.Salt, runtimeConfig.HasherSettings.MinHashLength);
 
 const configListeners: Array<(config: AppConfig) => void> = [];
 
@@ -360,7 +362,7 @@ export async function loadRuntimeConfig(): Promise<AppConfig> {
     runtimeConfig = resolveConfig(fetchedJson);
 
     // Synchronize deterministic hasher settings
-    updateHasherSettings(runtimeConfig.HasherSettings.Salt, runtimeConfig.HasherSettings.MinHashLength);
+    syncAllHasherSettings(runtimeConfig.HasherSettings.Salt, runtimeConfig.HasherSettings.MinHashLength);
 
     console.info(
       `[Config] Active runtime configuration: source=${runtimeConfig.ConfigSource}, API=${runtimeConfig.ApiSettings.BaseUrl}, STS=${runtimeConfig.SecuritySettings.Authority}`

PostFundManagement.ConsoleUI/src/hooks/useInAppNotifications.ts

@@ -6,6 +6,7 @@ import {
   getNotifications,
   createNotification,
   markNotificationAsRead,
+  archiveNotification,
   updateNotification,
   getCurrentUserTenantId,
 } from '../services/api';
@@ -124,7 +125,6 @@ export function useInAppNotifications() {
     },
     // Live polling every 30 seconds
     refetchInterval: 30000,
-    staleTime: 10000,
   });
 
   // InApp notifications (strictly platform === InApp 5) for Bell & Counters
@@ -137,7 +137,10 @@ export function useInAppNotifications() {
   // Active in-app notifications in inbox (excluding trashed and drafts)
   const inboxNotifications = useMemo(() => {
     return inAppNotifications.filter(
-      n => !trashedIds.includes(String(n.id)) && Number(n.status) !== NotificationStatus.Draft
+      n =>
+        !trashedIds.includes(String(n.id)) &&
+        Number(n.status) !== NotificationStatus.Archived &&
+        Number(n.status) !== NotificationStatus.Draft
     );
   }, [inAppNotifications, trashedIds]);
 
@@ -168,7 +171,9 @@ export function useInAppNotifications() {
 
   // Trashed notifications (In-App only)
   const trashedNotifications = useMemo(() => {
-    return inAppNotifications.filter(n => trashedIds.includes(String(n.id)));
+    return inAppNotifications.filter(
+      n => trashedIds.includes(String(n.id)) || Number(n.status) === NotificationStatus.Archived
+    );
   }, [inAppNotifications, trashedIds]);
 
   // Mutation to mark notification as read
@@ -211,8 +216,8 @@ export function useInAppNotifications() {
     });
   }, [starredStorageKey]);
 
-  // Delete message (move to trash)
+  // Delete message (NotificationStatus == Archived & move to trash)
-  const deleteMessage = useCallback((id: string | number) => {
+  const deleteMessage = useCallback(async (id: string | number) => {
     const strId = String(id);
     setTrashedIds(prev => {
       const next = prev.includes(strId) ? prev : [...prev, strId];
@@ -222,10 +227,22 @@ export function useInAppNotifications() {
       } catch {}
       return next;
     });
-  }, [trashStorageKey]);
 
-  // Restore from trash
+    queryClient.setQueryData<Notification[]>(['inapp-notifications', userId], (old = []) =>
-  const restoreMessage = useCallback((id: string | number) => {
+      old.map(n => (String(n.id) === strId ? { ...n, status: NotificationStatus.Archived } : n))
+    );
+
+    try {
+      await archiveNotification(id);
+    } catch (err) {
+      console.warn('[deleteMessage] Error archiving notification on server:', err);
+    } finally {
+      queryClient.invalidateQueries({ queryKey: ['inapp-notifications'] });
+    }
+  }, [trashStorageKey, userId, queryClient]);
+
+  // Restore from trash / unarchive
+  const restoreMessage = useCallback(async (id: string | number) => {
     const strId = String(id);
     setTrashedIds(prev => {
       const next = prev.filter(x => x !== strId);
@@ -235,7 +252,19 @@ export function useInAppNotifications() {
       } catch {}
       return next;
     });
-  }, [trashStorageKey]);
+
+    queryClient.setQueryData<Notification[]>(['inapp-notifications', userId], (old = []) =>
+      old.map(n => (String(n.id) === strId ? { ...n, status: NotificationStatus.Read } : n))
+    );
+
+    try {
+      await markNotificationAsRead(id);
+    } catch (err) {
+      console.warn('[restoreMessage] Error restoring notification on server:', err);
+    } finally {
+      queryClient.invalidateQueries({ queryKey: ['inapp-notifications'] });
+    }
+  }, [trashStorageKey, userId, queryClient]);
 
   // Permanent delete
   const permanentDelete = useCallback((id: string | number) => {

PostFundManagement.ConsoleUI/src/lib/formatters.ts

@@ -80,6 +80,7 @@ export const NOTIFICATION_STATUS_OPTIONS = [
   { value: NotificationStatus.Cancelled, label: 'Cancelled' },
   { value: NotificationStatus.Bounced, label: 'Bounced' },
   { value: NotificationStatus.Draft, label: 'Draft' },
+  { value: NotificationStatus.Archived, label: 'Archived' },
 ];
 
 export const NOTIFICATION_PLATFORM_OPTIONS = [
@@ -510,6 +511,8 @@ export const getEmailStatusBadge = (status?: EmailStatuses | number | null) => {
 export const getNotificationStatusBadge = (status?: NotificationStatus | number | null) => {
   const s = Number(status);
   switch (s) {
+    case NotificationStatus.Archived:
+      return { label: 'Archived', className: 'bg-slate-800 text-slate-300 border-slate-700 font-semibold' };
     case NotificationStatus.Draft:
       return { label: 'Draft', className: 'bg-purple-50 text-purple-800 border-purple-300 font-semibold' };
     case NotificationStatus.Delivered:

PostFundManagement.ConsoleUI/src/lib/queryClient.ts

@@ -4,15 +4,38 @@ import { bumpMutationEpoch } from '../services/httpClient';
 export const queryClient = new QueryClient({
   defaultOptions: {
     queries: {
-      staleTime: 1000 * 60 * 2, // 2 minutes fresh in memory
+      // Remove caching from all pages: zero stale time and zero cache retention
-      gcTime: 1000 * 60 * 10,   // 10 minutes cache retention
+      // Whenever a component needs data, it must call its corresponding endpoint(s)
-      refetchOnWindowFocus: false,
+      staleTime: 0,
-      refetchOnReconnect: true,
+      gcTime: 0,
+      refetchOnMount: 'always',
+      refetchOnWindowFocus: 'always',
+      refetchOnReconnect: 'always',
       retry: 1,
     },
   },
 });
 
+// Retain caching ONLY for sync status, auth token, roles and grants
+const RETAINED_CACHE_OPTIONS = {
+  staleTime: 5 * 60 * 1000,
+  gcTime: 10 * 60 * 1000,
+  refetchOnMount: false,
+  refetchOnWindowFocus: false,
+};
+
+queryClient.setQueryDefaults(['roles'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['system-roles'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['role-claims'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['user-roles'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['user-claims'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['grants'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['user-grants'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['user-sync'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['sync-status'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['auth'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['auth-token'], RETAINED_CACHE_OPTIONS);
+
 /**
  * Invalidates queries while simultaneously bumping the mutation epoch.
  * This guarantees that the background refetch generates a fresh query parameter (_v)

PostFundManagement.ConsoleUI/src/pages/BeneficiariesPage.tsx

@@ -353,6 +353,12 @@ export const BeneficiariesPage: React.FC = () => {
   const updateCompMutation = useMutation({
     mutationFn: (vals: ComplianceFormValues) => {
       if (!editingComp) throw new Error('No item selected');
+      if (
+        (vals.status === ComplianceStatus.Met || vals.status === ComplianceStatus.Exceeded) &&
+        isMaker(editingComp.createdBy)
+      ) {
+        throw new Error('Maker-Checker Violation: You created this compliance item and cannot approve it.');
+      }
       return updateComplianceItem({
         complianceItemId: editingComp.id,
         title: vals.title,
@@ -399,6 +405,12 @@ export const BeneficiariesPage: React.FC = () => {
   const updateOutcomeMutation = useMutation({
     mutationFn: (vals: OutcomeFormValues) => {
       if (!editingOutcome) throw new Error('No outcome selected for update');
+      if (
+        (vals.status === ComplianceStatus.Met || vals.status === ComplianceStatus.Exceeded) &&
+        isMaker(editingOutcome.createdBy)
+      ) {
+        throw new Error('Maker-Checker Violation: You created this outcome record and cannot approve or certify fulfillment.');
+      }
       return updateOutcome({
         outcomeId: editingOutcome.id,
         name: vals.name,
@@ -1467,11 +1479,15 @@ export const BeneficiariesPage: React.FC = () => {
               {...compForm.register('status')}
               className="w-full bg-slate-900 border border-slate-800 rounded-xl px-3 py-2 text-xs text-white focus:outline-none focus:border-blue-500 cursor-pointer"
             >
-              {COMPLIANCE_STATUS_OPTIONS.map((opt) => (
+              {COMPLIANCE_STATUS_OPTIONS.map((opt) => {
-                <option key={opt.value} value={opt.value}>
+                const isApprovedOpt = opt.value === ComplianceStatus.Met || opt.value === ComplianceStatus.Exceeded;
-                  {opt.label}
+                const makerRestricted = editingComp && isApprovedOpt && isMaker(editingComp.createdBy);
+                return (
+                  <option key={opt.value} value={opt.value} disabled={makerRestricted}>
+                    {opt.label} {makerRestricted ? '(Maker-Checker: Restricted)' : ''}
                   </option>
-              ))}
+                );
+              })}
             </select>
           </div>
 
@@ -1680,11 +1696,15 @@ export const BeneficiariesPage: React.FC = () => {
               {...outcomeForm.register('status')}
               className="w-full bg-slate-900 border border-slate-800 rounded-xl px-3 py-2 text-xs text-white focus:outline-none focus:border-blue-500 cursor-pointer"
             >
-              {COMPLIANCE_STATUS_OPTIONS.map((opt) => (
+              {COMPLIANCE_STATUS_OPTIONS.map((opt) => {
-                <option key={opt.value} value={opt.value}>
+                const isMetOpt = opt.value === ComplianceStatus.Met || opt.value === ComplianceStatus.Exceeded;
-                  {opt.label}
+                const makerRestricted = editingOutcome && isMetOpt && isMaker(editingOutcome.createdBy);
+                return (
+                  <option key={opt.value} value={opt.value} disabled={makerRestricted}>
+                    {opt.label} {makerRestricted ? '(Maker-Checker: Restricted)' : ''}
                   </option>
-              ))}
+                );
+              })}
             </select>
           </div>
 

PostFundManagement.ConsoleUI/src/pages/ChangeManagementPage.tsx

@@ -1020,7 +1020,7 @@ export const ChangeManagementPage: React.FC = () => {
                             {Number(cr.status) === ApprovalStatus.Approved ? (
                               <span className="inline-flex items-center gap-1 text-xs font-semibold text-emerald-400 bg-emerald-500/10 px-2.5 py-1 rounded-lg border border-emerald-500/20 cursor-default" title="Approved and enacted change requests are immutable.">
                                 <Lock className="w-3 h-3 text-emerald-400" />
-                                <span>Resolved &amp; Enacted (Immutable)</span>
+                                <span>Resolved &amp; Enacted</span>
                               </span>
                             ) : (
                               <>
@@ -1528,7 +1528,7 @@ export const ChangeManagementPage: React.FC = () => {
                   title="Approved and enacted change requests are immutable."
                 >
                   <Lock className="w-3.5 h-3.5 text-emerald-400" />
-                  <span>Approved &amp; Enacted (Immutable - Cannot Be Changed)</span>
+                  <span>Approved &amp; Enacted</span>
                 </div>
               ) : (
                 <select

PostFundManagement.ConsoleUI/src/pages/GovernancePage.tsx

@@ -11,6 +11,7 @@ import {
   Edit2,
   Mail,
   Shield,
+  ShieldCheck,
   Layers,
   ChevronRight,
   Search,
@@ -24,9 +25,11 @@ import {
   UserPlus,
   ChevronDown,
   ChevronUp,
+  CheckCircle,
   CheckCircle2,
   Loader2,
   Lock,
+  AlertTriangle,
 } from 'lucide-react';
 import {
   getOrganisations,
@@ -69,6 +72,7 @@ import { ExportButton } from '../components/ui/ExportButton';
 import { ExportColumn } from '../utils/exportUtils';
 import { useAuth } from '../auth/AuthProvider';
 import { useRbac } from '../auth/rbac';
+import { bumpMutationEpoch } from '../services/httpClient';
 import { useTableSort, SortableTh } from '../utils/tableSort';
 import { FundingInstrumentsSection, InstructionsSection } from '../components/governance/InstructionsSection';
 import { RulesSection } from '../components/governance/RulesSection';
@@ -110,6 +114,7 @@ const organisationSchema = z.object({
   registrationNo: z.string().min(4, 'Registration number is mandatory'),
   email: z.string().email('Enter a valid email address'),
   organisationUser: z.string().min(1, 'Please select a linked executive or manager user'),
+  idNumber: z.string().optional(),
   type: z.coerce.number().min(1).max(27),
   status: z.coerce.number().optional(),
 });
@@ -134,8 +139,8 @@ type ProgrammeFormValues = z.infer<typeof programmeSchema>;
 
 export const GovernancePage: React.FC = () => {
   const queryClient = useQueryClient();
-  const { sub, user, claims } = useAuth();
+  const { sub, user, claims, roles, tenantId } = useAuth();
-  const { canAdd, canApprove, canExport, canApproveRecord, isMaker } = useRbac();
+  const { canAdd, canApprove, canExport, canApproveRecord, isMaker, isUnrestricted } = useRbac();
   const currentUserId = sub || user?.id || '';
   const { success, error: toastError } = useToast();
 
@@ -241,7 +246,6 @@ export const GovernancePage: React.FC = () => {
   const { data: usersDirectory = [] } = useQuery({
     queryKey: ['users-directory'],
     queryFn: () => getUsers(1, 200),
-    staleTime: 5 * 60 * 1000,
   });
 
   const { data: systemRoles = [] } = useQuery<Role[]>({
@@ -263,6 +267,37 @@ export const GovernancePage: React.FC = () => {
     });
   }, [usersDirectory]);
 
+  const modalExecutiveUsers = React.useMemo(() => {
+    const list: User[] = [...executiveAndManagerUsers];
+    const linkedUserId =
+      editingOrg?.userId ||
+      editingOrg?.UserId ||
+      '';
+
+    if (linkedUserId) {
+      const linkedStr = String(linkedUserId).toLowerCase();
+      const alreadyIncluded = list.some((u) => u.id && String(u.id).toLowerCase() === linkedStr);
+      if (!alreadyIncluded) {
+        const inDirectory = usersDirectory.find((u) => u.id && String(u.id).toLowerCase() === linkedStr);
+        if (inDirectory) {
+          list.unshift(inDirectory);
+        } else {
+          const email = getUserEmail(linkedUserId);
+          const hasRealEmail = email && email !== '—' && email.includes('@') && email !== String(linkedUserId);
+          list.unshift({
+            id: String(linkedUserId),
+            email: hasRealEmail ? email : String(linkedUserId),
+            role: 'Executive',
+            status: ActivityStatus.Active,
+            lastLoginAt: null,
+          });
+        }
+      }
+    }
+
+    return list;
+  }, [executiveAndManagerUsers, usersDirectory, editingOrg?.id, editingOrg?.userId]);
+
   // Quick Add Executive User Subform state
   const [isQuickAddUserOpen, setIsQuickAddUserOpen] = useState(false);
   const [quickUserEmail, setQuickUserEmail] = useState('');
@@ -560,11 +595,23 @@ export const GovernancePage: React.FC = () => {
       registrationNo: '',
       email: '',
       organisationUser: '',
+      idNumber: '',
       type: OrganisationType.Enterprise,
-      status: ActivityStatus.Active,
+      status: ActivityStatus.Inactive,
     },
   });
 
+  const watchedOrgUser = orgForm.watch('organisationUser');
+  const selectedExecutiveUser = React.useMemo(() => {
+    if (!watchedOrgUser) return null;
+    const str = String(watchedOrgUser).toLowerCase();
+    return (
+      usersDirectory.find((u) => u.id && String(u.id).toLowerCase() === str) ||
+      modalExecutiveUsers.find((u) => u.id && String(u.id).toLowerCase() === str) ||
+      null
+    );
+  }, [watchedOrgUser, usersDirectory, modalExecutiveUsers]);
+
   const portfolioForm = useForm<PortfolioFormValues>({
     resolver: zodResolver(portfolioSchema),
     defaultValues: {
@@ -580,7 +627,7 @@ export const GovernancePage: React.FC = () => {
     defaultValues: {
       name: '',
       portfolioId: portfolios[0]?.id ? Number(portfolios[0].id) : 201,
-      status: ApprovalStatus.Approved,
+      status: ApprovalStatus.Pending,
       ownerEmail: effectiveUserEmail,
     },
   });
@@ -589,11 +636,20 @@ export const GovernancePage: React.FC = () => {
   const orgMutation = useMutation({
     mutationFn: (data: OrganisationFormValues) => {
       if (editingOrg) {
+        if (!data.idNumber || !data.idNumber.trim()) {
+          orgForm.setError('idNumber', {
+            type: 'manual',
+            message: 'Government ID number is required to assign this executive user.',
+          });
+          throw new Error('Executive user ID number is required when updating an organisation.');
+        }
+
         return updateOrganisation({
           organisationId: editingOrg.id,
           name: data.name,
           registrationNo: data.registrationNo,
           email: data.email,
+          idNumber: data.idNumber.trim(),
           organisationUser: data.organisationUser,
           type: Number(data.type),
           status: data.status !== undefined ? Number(data.status) : ActivityStatus.Active,
@@ -603,11 +659,13 @@ export const GovernancePage: React.FC = () => {
         name: data.name,
         registrationNo: data.registrationNo,
         email: data.email,
+        idNumber: data.idNumber?.trim() || null,
         organisationUser: data.organisationUser,
         type: Number(data.type),
       });
     },
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['organisations'] });
       success(editingOrg ? 'Organisation updated' : 'Organisation registered successfully');
       setIsOrgModalOpen(false);
@@ -639,6 +697,7 @@ export const GovernancePage: React.FC = () => {
       });
     },
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['portfolios'] });
       success(editingPortfolio ? 'Portfolio updated successfully' : 'Portfolio created successfully');
       setIsPortfolioModalOpen(false);
@@ -650,15 +709,43 @@ export const GovernancePage: React.FC = () => {
     },
   });
 
+  const approveProgrammeMutation = useMutation({
+    mutationFn: async (pr: Programme) => {
+      if (isMaker(pr.createdBy)) {
+        throw new Error('Maker-Checker policy: Record creator cannot approve their own programme.');
+      }
+      return updateProgramme({
+        programmeId: pr.id,
+        name: pr.name || '',
+        portfolioId: Number(pr.portfolioId),
+        status: ApprovalStatus.Approved,
+        ownerId: pr.ownedBy,
+      });
+    },
+    onSuccess: () => {
+      bumpMutationEpoch();
+      queryClient.invalidateQueries({ queryKey: ['programmes'] });
+      queryClient.invalidateQueries({ queryKey: ['programme'] });
+      success('Programme Approved', 'Programme governance status successfully updated to Approved.');
+    },
+    onError: (err: unknown) => {
+      toastError('Programme Approval Failed', err);
+    },
+  });
+
   const programmeMutation = useMutation({
     mutationFn: (data: ProgrammeFormValues) => {
       const resolvedOwnerId = resolveOwnerId(data.ownerEmail, editingProgramme?.ownedBy);
       if (editingProgramme) {
+        const targetStatus = (data.status !== undefined ? Number(data.status) : 1) as ApprovalStatus;
+        if (targetStatus === ApprovalStatus.Approved && isMaker(editingProgramme.createdBy)) {
+          throw new Error('Maker-Checker policy violation: Record creators cannot approve their own programmes.');
+        }
         return updateProgramme({
           programmeId: editingProgramme.id,
           name: data.name,
           portfolioId: Number(data.portfolioId),
-          status: (data.status !== undefined ? Number(data.status) : 1) as ApprovalStatus,
+          status: targetStatus,
           ownerId: resolvedOwnerId,
         });
       }
@@ -669,7 +756,9 @@ export const GovernancePage: React.FC = () => {
       });
     },
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['programmes'] });
+      queryClient.invalidateQueries({ queryKey: ['programme'] });
       success(editingProgramme ? 'Programme updated successfully' : 'Programme created successfully');
       setIsProgrammeModalOpen(false);
       setEditingProgramme(null);
@@ -688,8 +777,9 @@ export const GovernancePage: React.FC = () => {
       registrationNo: '',
       email: '',
       organisationUser: defaultUser?.id || '',
+      idNumber: defaultUser?.idNumber || '',
       type: OrganisationType.Enterprise,
-      status: ActivityStatus.Active,
+      status: ActivityStatus.Inactive,
     });
     setIsQuickAddUserOpen(false);
     setQuickUserError(null);
@@ -702,26 +792,51 @@ export const GovernancePage: React.FC = () => {
     const targetUserId =
       org.userId ||
       org.UserId ||
-      org.organisationUser ||
-      org.OrganisationUser ||
-      org.createdBy ||
       '';
 
-    const matchedUser = targetUserId
+    let selectedUserId = '';
-      ? usersDirectory.find((u) => u.id && String(u.id).toLowerCase() === String(targetUserId).toLowerCase())
+    let matchedUser: User | undefined;
-      : null;
+    if (targetUserId) {
+      const targetStr = String(targetUserId).toLowerCase();
+      matchedUser = usersDirectory.find(
+        (u) =>
+          (u.id && String(u.id).toLowerCase() === targetStr) ||
+          (u.email && u.email.toLowerCase() === targetStr)
+      );
 
-    const selectedUserId = matchedUser?.id || targetUserId || '';
+      if (matchedUser) {
+        selectedUserId = matchedUser.id;
+        if (matchedUser.email) {
+          registerUserEmail(matchedUser.id, matchedUser.email);
+        }
+      } else {
+        selectedUserId = String(targetUserId);
+        const email = getUserEmail(targetUserId);
+        if (email && email !== '—' && email.includes('@')) {
+          registerUserEmail(selectedUserId, email);
+        }
+      }
+    }
+
+    const resolvedIdNumber = matchedUser?.idNumber || org.idNumber || '';
 
     orgForm.reset({
       name: org.name || '',
       registrationNo: org.registrationNo || '',
       email: org.email || '',
       organisationUser: selectedUserId,
+      idNumber: resolvedIdNumber,
       type: org.type || OrganisationType.Enterprise,
       status: org.status ?? ActivityStatus.Active,
     });
 
+    if (selectedUserId && !resolvedIdNumber) {
+      orgForm.setError('idNumber', {
+        type: 'manual',
+        message: 'This executive user has no ID number on file. An ID number is required to update the organisation.',
+      });
+    }
+
     setIsQuickAddUserOpen(false);
     setQuickUserError(null);
     setIsOrgModalOpen(true);
@@ -755,7 +870,7 @@ export const GovernancePage: React.FC = () => {
     programmeForm.reset({
       name: '',
       portfolioId: portfolios[0]?.id ? Number(portfolios[0].id) : 201,
-      status: ApprovalStatus.Approved,
+      status: ApprovalStatus.Pending,
       ownerEmail: effectiveUserEmail,
     });
     setIsProgrammeModalOpen(true);
@@ -833,6 +948,7 @@ export const GovernancePage: React.FC = () => {
     status: (p) => getApprovalStatusBadge(p.status).label,
     createdAt: (p) => p.createdAt,
     ownedBy: (p) => getUserEmail(p.ownedBy),
+    createdBy: (p) => getUserEmail(p.createdBy),
   });
 
   // Export Columns Definitions
@@ -863,6 +979,7 @@ export const GovernancePage: React.FC = () => {
       format: (id) => programmes.filter((pr) => String(pr.portfolioId) === String(id)).length,
     },
     { header: 'Owner Email', key: 'ownedBy', format: (val) => getUserEmail(val) },
+    { header: 'Created By (Maker)', key: 'createdBy', format: (val) => getUserEmail(val) },
     { header: 'Creation Date', key: 'createdAt', format: (val) => formatDate(val) },
     { header: 'Description', key: 'description', format: (val) => val || '—' },
   ];
@@ -881,6 +998,7 @@ export const GovernancePage: React.FC = () => {
     { header: 'Governance Status', key: 'status', format: (val) => getApprovalStatusBadge(val).label },
     { header: 'Creation Date', key: 'createdAt', format: (val) => formatDate(val) },
     { header: 'Owner Email', key: 'ownedBy', format: (val) => getUserEmail(val) },
+    { header: 'Created By (Maker)', key: 'createdBy', format: (val) => getUserEmail(val) },
   ];
 
   return (
@@ -1150,6 +1268,11 @@ export const GovernancePage: React.FC = () => {
                             <Mail className="w-3.5 h-3.5 text-slate-500" />
                             {org.email}
                           </span>
+                          {org.userId && (
+                            <span className="text-[10px] text-blue-400/90 font-mono block mt-0.5" title={`Executive User: ${org.userId}`}>
+                              Exec: {getUserEmail(org.userId)}
+                            </span>
+                          )}
                         </td>
                         <td className="py-3.5 px-4">
                           <span className={`inline-flex items-center px-2.5 py-0.5 rounded-full text-[10px] font-semibold border ${statusBadge.className}`}>
@@ -1382,19 +1505,22 @@ export const GovernancePage: React.FC = () => {
                   <SortableTh column="ownedBy" currentColumn={progSortCol} direction={progSortDir} onSort={handleProgSort} className="py-3.5 px-4">
                     Owner Email
                   </SortableTh>
+                  <SortableTh column="createdBy" currentColumn={progSortCol} direction={progSortDir} onSort={handleProgSort} className="py-3.5 px-4">
+                    Created By
+                  </SortableTh>
                   <th className="py-3.5 px-5 text-right font-medium">Actions</th>
                 </tr>
               </thead>
               <tbody className="divide-y divide-slate-800/60">
                 {loadingProgrammes ? (
                   <tr>
-                    <td colSpan={6} className="py-8 text-center text-slate-500">
+                    <td colSpan={7} className="py-8 text-center text-slate-500">
                       Loading programmes...
                     </td>
                   </tr>
                 ) : sortedProgrammes.length === 0 ? (
                   <tr>
-                    <td colSpan={6} className="py-8 text-center text-slate-500">
+                    <td colSpan={7} className="py-8 text-center text-slate-500">
                       No programmes found matching query.
                     </td>
                   </tr>
@@ -1402,6 +1528,7 @@ export const GovernancePage: React.FC = () => {
                   sortedProgrammes.map((pr) => {
                     const port = portfolios.find((p) => String(p.id) === String(pr.portfolioId));
                     const statusBadge = getApprovalStatusBadge(pr.status);
+                    const isApproved = Number(pr.status) === ApprovalStatus.Approved;
                     return (
                       <tr key={pr.id} className="hover:bg-slate-800/40 transition-colors">
                         <td className="py-3.5 px-5">
@@ -1420,8 +1547,49 @@ export const GovernancePage: React.FC = () => {
                         <td className="py-3.5 px-4 font-mono text-slate-300 font-medium text-[11px]">
                           {getUserEmail(pr.ownedBy)}
                         </td>
+                        <td className="py-3.5 px-4 font-mono text-slate-400 text-[11px]">
+                          {getUserEmail(pr.createdBy)}
+                        </td>
                         <td className="py-3.5 px-5 text-right">
-                          <div className="flex items-center justify-end gap-1.5">
+                          <div className="flex items-center justify-end gap-1.5 flex-wrap sm:flex-nowrap">
+                            {isApproved ? (
+                              <span
+                                className="inline-flex items-center gap-1 text-xs font-semibold text-emerald-400 bg-emerald-500/10 px-2.5 py-1 rounded-lg border border-emerald-500/20 cursor-default"
+                                title="Approved programmes cannot be modified."
+                              >
+                                <Lock className="w-3 h-3 text-emerald-400" />
+                                <span>Approved</span>
+                              </span>
+                            ) : (
+                              <>
+                                <button
+                                  type="button"
+                                  onClick={() => openEditProgramme(pr)}
+                                  className="inline-flex items-center gap-1 text-xs font-semibold text-slate-200 hover:text-white bg-slate-900/80 hover:bg-slate-800 border border-slate-700/80 px-2.5 py-1 rounded-lg transition shadow-xs cursor-pointer"
+                                  title="Edit Programme"
+                                >
+                                  <Edit2 className="w-3 h-3" />
+                                  Edit
+                                </button>
+                                {canApproveRecord('governance', pr.createdBy) && (
+                                  <button
+                                    type="button"
+                                    disabled={approveProgrammeMutation.isPending}
+                                    onClick={() => approveProgrammeMutation.mutate(pr)}
+                                    className="inline-flex items-center gap-1 text-xs font-semibold text-emerald-300 hover:text-white bg-emerald-500/10 hover:bg-emerald-500/20 border border-emerald-500/30 px-2.5 py-1 rounded-lg transition shadow-xs cursor-pointer"
+                                    title="Approve Programme"
+                                  >
+                                    <CheckCircle className="w-3 h-3" />
+                                    <span>Approve</span>
+                                  </button>
+                                )}
+                                {canApprove('governance') && isMaker(pr.createdBy) && (
+                                  <span className="text-[10px] text-amber-400 font-mono italic px-1.5 py-0.5 bg-amber-500/10 border border-amber-500/20 rounded">
+                                    Maker-Checker: Record creator cannot approve
+                                  </span>
+                                )}
+                              </>
+                            )}
                             <button
                               type="button"
                               onClick={() => {
@@ -1458,14 +1626,6 @@ export const GovernancePage: React.FC = () => {
                               <Scale className="w-3 h-3" />
                               Rules
                             </button>
-                            <button
-                              type="button"
-                              onClick={() => openEditProgramme(pr)}
-                              className="inline-flex items-center gap-1 text-xs font-semibold text-slate-200 hover:text-white bg-slate-900/80 hover:bg-slate-800 border border-slate-700/80 px-2.5 py-1 rounded-lg transition shadow-xs cursor-pointer"
-                            >
-                              <Edit2 className="w-3 h-3" />
-                              Edit
-                            </button>
                           </div>
                         </td>
                       </tr>
@@ -1611,11 +1771,11 @@ export const GovernancePage: React.FC = () => {
               <div className="flex items-center justify-between mb-1">
                 <div className="flex items-center gap-1">
                   <label className="block text-xs font-semibold text-slate-300">
-                    Linked Executive / Manager User *
+                    Responsible Executive User *
                   </label>
                   <HelpTooltip
-                    title="Designated Organisation User"
+                    title="Executive / Organisation User"
-                    content="Only users with an Executive or Manager role can be assigned to an organisation."
+                    content="The Executive user responsible for this organisation. Stored as userId in the organisation record and submitted as organisationUser to the API."
                     size="sm"
                     placement="top"
                   />
@@ -1636,11 +1796,36 @@ export const GovernancePage: React.FC = () => {
                 )}
               </div>
               <select
-                {...orgForm.register('organisationUser')}
+                {...orgForm.register('organisationUser', {
+                  onChange: (e) => {
+                    const selectedId = e.target.value;
+                    if (!selectedId) {
+                      orgForm.setValue('idNumber', '');
+                      return;
+                    }
+                    const str = String(selectedId).toLowerCase();
+                    const matched =
+                      usersDirectory.find((u) => u.id && String(u.id).toLowerCase() === str) ||
+                      modalExecutiveUsers.find((u) => u.id && String(u.id).toLowerCase() === str);
+
+                    if (matched?.idNumber && matched.idNumber.trim()) {
+                      orgForm.setValue('idNumber', matched.idNumber.trim(), { shouldValidate: true });
+                      orgForm.clearErrors('idNumber');
+                    } else {
+                      orgForm.setValue('idNumber', '', { shouldValidate: true });
+                      if (editingOrg) {
+                        orgForm.setError('idNumber', {
+                          type: 'manual',
+                          message: 'Selected user has no ID number on file. Please enter their ID number to enable executive assignment.',
+                        });
+                      }
+                    }
+                  },
+                })}
                 className="w-full px-3 py-2 text-xs border border-slate-700/80 rounded-xl focus:outline-none focus:ring-1 focus:ring-blue-500 bg-[#090d16] text-white font-medium"
               >
                 <option value="">-- Select linked executive or manager account --</option>
-                {executiveAndManagerUsers.map((u) => (
+                {modalExecutiveUsers.map((u) => (
                   <option key={u.id} value={u.id}>
                     {u.email || u.id} ({u.role || 'Executive'})
                   </option>
@@ -1654,7 +1839,59 @@ export const GovernancePage: React.FC = () => {
                   No Executive or Manager user found. Create one below to continue.
                 </p>
               )}
+              {watchedOrgUser && selectedExecutiveUser && selectedExecutiveUser.idNumber && selectedExecutiveUser.idNumber.trim() && (
+                <div className="flex items-center gap-1.5 text-[11px] text-emerald-400 mt-1">
+                  <CheckCircle className="w-3.5 h-3.5 text-emerald-400 shrink-0" />
+                  <span>ID on file: <strong className="font-mono text-emerald-300">{selectedExecutiveUser.idNumber}</strong></span>
                 </div>
+              )}
+            </div>
+          </div>
+
+          {/* Missing ID Number Alert */}
+          {watchedOrgUser && selectedExecutiveUser && (!selectedExecutiveUser.idNumber || !selectedExecutiveUser.idNumber.trim()) && (
+            <div className="p-3 rounded-xl border border-amber-500/30 bg-amber-500/10 text-amber-300 text-xs flex items-start gap-2.5">
+              <AlertTriangle className="w-4 h-4 text-amber-400 shrink-0 mt-0.5" />
+              <div className="space-y-1">
+                <p className="font-semibold text-amber-200">
+                  Missing Executive ID Number
+                </p>
+                <p className="text-[11px] text-amber-300/90 leading-relaxed">
+                  The selected executive (<strong className="font-mono text-white">{selectedExecutiveUser.email || watchedOrgUser}</strong>) does not have a Government ID Number on file. An ID number is required to assign this executive user; otherwise the update will be ignored. Please enter their ID number below.
+                </p>
+              </div>
+            </div>
+          )}
+
+          {/* Executive User ID Number Input */}
+          <div>
+            <div className="flex items-center justify-between mb-1">
+              <div className="flex items-center gap-1">
+                <label className="block text-xs font-semibold text-slate-300">
+                  Executive ID Number {editingOrg ? '*' : '(Optional)'}
+                </label>
+                <HelpTooltip
+                  title="Executive ID Requirement"
+                  content="Government Issued ID or Passport of the executive. Required when updating to persist the executive user link; otherwise the update will be ignored."
+                  size="sm"
+                  placement="top"
+                />
+              </div>
+              {selectedExecutiveUser?.idNumber && (
+                <span className="text-[10px] text-emerald-400 font-mono">Sourced from profile</span>
+              )}
+            </div>
+            <input
+              type="text"
+              {...orgForm.register('idNumber')}
+              className={`w-full px-3 py-2 text-xs border rounded-xl focus:outline-none focus:ring-1 focus:ring-blue-500 text-white bg-[#090d16] font-mono ${
+                orgForm.formState.errors.idNumber ? 'border-rose-500 ring-1 ring-rose-500' : 'border-slate-700/80'
+              }`}
+              placeholder="Enter 13-digit ID or Passport Number"
+            />
+            {orgForm.formState.errors.idNumber && (
+              <p className="text-[10px] text-rose-500 mt-1">{orgForm.formState.errors.idNumber.message}</p>
+            )}
           </div>
 
           {/* Inline Collapsible Subform to Create Executive User */}
@@ -2004,18 +2241,18 @@ export const GovernancePage: React.FC = () => {
                   placement="top"
                 />
               </div>
-              {selectedProgrammeForDetail && Number(selectedProgrammeForDetail.status) === ApprovalStatus.Approved ? (
+              {editingProgramme && Number(editingProgramme.status) === ApprovalStatus.Approved ? (
                 <div
                   className="w-full px-3 py-2 text-xs border border-emerald-500/30 bg-emerald-500/10 rounded-xl text-emerald-300 font-semibold flex items-center gap-1.5 cursor-default"
-                  title="Approved programmes are immutable."
+                  title="Approved programmes cannot be modified."
                 >
                   <Lock className="w-3.5 h-3.5 text-emerald-400" />
-                  <span>Approved (Immutable - Cannot Be Changed)</span>
+                  <span>Approved</span>
                 </div>
               ) : (
                 (() => {
-                  const canApproveProgramme = canApproveRecord('governance', selectedProgrammeForDetail?.createdBy);
+                  const canApproveProgramme = canApproveRecord('governance', editingProgramme?.createdBy);
-                  const isSelf = isMaker(selectedProgrammeForDetail?.createdBy);
+                  const isSelf = isMaker(editingProgramme?.createdBy);
 
                   return (
                     <select
@@ -2460,11 +2697,17 @@ export const GovernancePage: React.FC = () => {
                     <span className="text-slate-300">{getOrganisationTypeLabel(orgFreshDetail?.type ?? selectedOrgForDetail?.type ?? OrganisationType.Enterprise)}</span>
                   </div>
                   <div className="flex items-center gap-2 min-w-0">
-                    <span className="text-slate-400 font-semibold text-[11px] uppercase tracking-wider shrink-0">Linked User:</span>
+                    <span className="text-slate-400 font-semibold text-[11px] uppercase tracking-wider shrink-0">Executive User:</span>
                     <span className="text-blue-400 font-mono text-[11px] truncate">
                       {getUserEmail(orgFreshDetail?.userId || selectedOrgForDetail?.userId) || orgFreshDetail?.userId || selectedOrgForDetail?.userId || '—'}
                     </span>
                   </div>
+                  <div className="flex items-center gap-2 min-w-0">
+                    <span className="text-slate-400 font-semibold text-[11px] uppercase tracking-wider shrink-0">Created By:</span>
+                    <span className="text-slate-300 font-mono text-[11px] truncate">
+                      {getUserEmail(orgFreshDetail?.createdBy || selectedOrgForDetail?.createdBy) || orgFreshDetail?.createdBy || selectedOrgForDetail?.createdBy || '—'}
+                    </span>
+                  </div>
                 </div>
               </div>
 
@@ -2717,13 +2960,38 @@ export const GovernancePage: React.FC = () => {
                     <span className="text-slate-400 font-semibold block text-[11px] uppercase tracking-wider mb-1">Programme Title</span>
                     <span className="text-white font-semibold text-sm block">{programmeFreshDetail?.name || selectedProgrammeForDetail?.name}</span>
                   </div>
+                  <div className="flex items-center gap-2">
                     <span className={`inline-flex items-center px-2.5 py-0.5 rounded-full text-[10px] font-semibold border whitespace-nowrap ${getApprovalStatusBadge(programmeFreshDetail?.status ?? selectedProgrammeForDetail?.status ?? ApprovalStatus.Approved).className}`}>
                       {getApprovalStatusBadge(programmeFreshDetail?.status ?? selectedProgrammeForDetail?.status ?? ApprovalStatus.Approved).label}
                     </span>
+                    {selectedProgrammeForDetail && Number(programmeFreshDetail?.status ?? selectedProgrammeForDetail.status) !== ApprovalStatus.Approved && (
+                      canApproveRecord('governance', selectedProgrammeForDetail.createdBy) ? (
+                        <button
+                          type="button"
+                          disabled={approveProgrammeMutation.isPending}
+                          onClick={async () => {
+                            await approveProgrammeMutation.mutateAsync(selectedProgrammeForDetail);
+                            setIsProgrammeDetailModalOpen(false);
+                            setSelectedProgrammeForDetail(null);
+                          }}
+                          className="inline-flex items-center gap-1 text-xs font-semibold text-emerald-300 hover:text-white bg-emerald-500/10 hover:bg-emerald-500/20 border border-emerald-500/30 px-2.5 py-1 rounded-lg transition shadow-xs cursor-pointer"
+                        >
+                          <CheckCircle className="w-3.5 h-3.5" />
+                          <span>Approve Programme</span>
+                        </button>
+                      ) : (
+                        isMaker(selectedProgrammeForDetail.createdBy) && canApprove('governance') && (
+                          <span className="text-[10px] text-amber-400 font-mono italic px-1.5 py-0.5 bg-amber-500/10 border border-amber-500/20 rounded">
+                            Maker-Checker: Record creator cannot approve
+                          </span>
+                        )
+                      )
+                    )}
+                  </div>
                 </div>
 
-                {/* Core Details Grid: Owner & Creation Date */}
+                {/* Core Details Grid: Owner, Maker, Creation Date */}
-                <div className="grid grid-cols-1 sm:grid-cols-2 gap-3 text-xs">
+                <div className="grid grid-cols-1 sm:grid-cols-3 gap-3 text-xs">
                   {/* Creation Date */}
                   <div className="p-3 bg-[#080d1a] rounded-lg border border-slate-800 flex items-center gap-2.5">
                     <Calendar className="w-4 h-4 text-slate-400 shrink-0" />
@@ -2745,6 +3013,17 @@ export const GovernancePage: React.FC = () => {
                       </span>
                     </div>
                   </div>
+
+                  {/* Maker */}
+                  <div className="p-3 bg-[#080d1a] rounded-lg border border-slate-800 flex items-center gap-2.5">
+                    <ShieldCheck className="w-4 h-4 text-slate-400 shrink-0" />
+                    <div className="min-w-0 flex-1">
+                      <span className="text-slate-500 font-medium block text-[10px] uppercase tracking-wider">Created By (Maker)</span>
+                      <span className="font-mono text-slate-200 text-xs truncate block" title={getUserEmail(programmeFreshDetail?.createdBy || selectedProgrammeForDetail?.createdBy)}>
+                        {getUserEmail(programmeFreshDetail?.createdBy || selectedProgrammeForDetail?.createdBy)}
+                      </span>
+                    </div>
+                  </div>
                 </div>
 
                 {/* Metrics: Total Rules and Total Instructions */}

PostFundManagement.ConsoleUI/src/pages/GrantsPage.tsx

@@ -47,6 +47,7 @@ import { ExportButton } from '../components/ui/ExportButton';
 import { ExportColumn } from '../utils/exportUtils';
 import { useTableSort, SortableTh } from '../utils/tableSort';
 import { useRbac } from '../auth/rbac';
+import { bumpMutationEpoch } from '../services/httpClient';
 import {
   Award,
   Budget,
@@ -123,7 +124,7 @@ export const GrantsPage: React.FC = () => {
   const [isBudgetModalOpen, setIsBudgetModalOpen] = useState(false);
   const [editingBudget, setEditingBudget] = useState<Budget | null>(null);
   const [isEditBudgetModalOpen, setIsEditBudgetModalOpen] = useState(false);
-  const [selectedBudgetStatus, setSelectedBudgetStatus] = useState<ApprovalStatus>(ApprovalStatus.Approved);
+  const [selectedBudgetStatus, setSelectedBudgetStatus] = useState<ApprovalStatus>(ApprovalStatus.Pending);
   const [isDisbursementModalOpen, setIsDisbursementModalOpen] = useState(false);
   const [editingDisbursement, setEditingDisbursement] = useState<Disbursement | null>(null);
 
@@ -233,6 +234,7 @@ export const GrantsPage: React.FC = () => {
   const updateAwardMutation = useMutation({
     mutationFn: (data: UpdateAwardRequest) => updateAward(data),
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['awards'] });
       queryClient.invalidateQueries({ queryKey: ['dashboard'] });
       success('Award Updated', 'Award details saved successfully.');
@@ -248,6 +250,7 @@ export const GrantsPage: React.FC = () => {
   const budgetMutation = useMutation({
     mutationFn: (data: CreateBudgetRequest) => createBudget(data),
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['budgets'] });
       success('Budget line established', 'Budget line created against project');
       setIsBudgetModalOpen(false);
@@ -261,6 +264,7 @@ export const GrantsPage: React.FC = () => {
   const updateBudgetMutation = useMutation({
     mutationFn: (data: UpdateBudgetRequest) => updateBudget(data),
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['budgets'] });
       success('Budget Updated', 'Budget compliance and approval status updated.');
       setIsEditBudgetModalOpen(false);
@@ -287,6 +291,7 @@ export const GrantsPage: React.FC = () => {
       });
     },
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['disbursements'] });
       success(
         editingDisbursement ? 'Disbursement Updated' : 'Disbursement Scheduled',
@@ -497,6 +502,7 @@ export const GrantsPage: React.FC = () => {
   const approveMutation = useMutation({
     mutationFn: (id: string | number) => approveDisbursement(id),
     onSuccess: () => {
+      bumpMutationEpoch();
       queryClient.invalidateQueries({ queryKey: ['disbursements'] });
       queryClient.invalidateQueries({ queryKey: ['dashboard'] });
       success(
@@ -637,8 +643,14 @@ export const GrantsPage: React.FC = () => {
     handleSort: handleAwardSort,
   } = useTableSort(filteredAwards, null, null, {
     referenceNo: (a) => a.referenceNo,
-    organisationId: (a) => a.organisationName || `Org #${a.organisationId}`,
+    organisationId: (a) => {
-    programmeId: (a) => a.programmeName || `Programme #${a.programmeId}`,
+      const org = organisations.find((o) => String(o.id) === String(a.organisationId));
+      return (org?.name || a.organisationName || `Organisation #${a.organisationId}`).toLowerCase();
+    },
+    programmeId: (a) => {
+      const prog = programmes.find((p) => String(p.id) === String(a.programmeId));
+      return (prog?.name || a.programmeName || `Programme #${a.programmeId}`).toLowerCase();
+    },
     amount: (a) => a.amount,
     status: (a) => getApprovalStatusBadge(a.status).label,
     createdAt: (a) => a.createdAt,
@@ -651,7 +663,10 @@ export const GrantsPage: React.FC = () => {
     handleSort: handleBudgetSort,
   } = useTableSort(filteredBudgets, null, null, {
     name: (b) => b.name,
-    projectId: (b) => b.projectId,
+    projectId: (b) => {
+      const proj = projects.find((p) => String(p.id) === String(b.projectId));
+      return (proj?.name || `Project #${b.projectId}`).toLowerCase();
+    },
     amount: (b) => b.amount,
     createdAt: (b) => b.createdAt,
     status: (b) => getApprovalStatusBadge(b.status ?? ApprovalStatus.Approved).label,
@@ -665,8 +680,15 @@ export const GrantsPage: React.FC = () => {
     handleSort: handleDisbSort,
   } = useTableSort(filteredDisbursements, null, null, {
     id: (d) => d.id,
-    projectId: (d) => d.projectId,
+    projectId: (d) => {
-    milestoneId: (d) => d.milestoneId || 0,
+      const proj = projects.find((p) => String(p.id) === String(d.projectId));
+      return (proj?.name || `Project #${d.projectId}`).toLowerCase();
+    },
+    milestoneId: (d) => {
+      if (!d.milestoneId) return 'Advance Tranche';
+      const ms = milestones.find((m) => String(m.id) === String(d.milestoneId));
+      return (ms?.name || `Milestone #${d.milestoneId}`).toLowerCase();
+    },
     amount: (d) => d.amount,
     paymentReference: (d) => d.paymentReference || '',
     status: (d) => getApprovalStatusBadge(d.status).label,
@@ -826,8 +848,10 @@ export const GrantsPage: React.FC = () => {
             <div className="flex items-center gap-2 self-end sm:self-center">
               <button
                 type="button"
-                onClick={() => {
+                onClick={async () => {
-                  refetchAwards();
+                  bumpMutationEpoch();
+                  await queryClient.invalidateQueries({ queryKey: ['awards'] });
+                  await refetchAwards();
                   success('Refreshed', 'Awards intake list refreshed from API.');
                 }}
                 disabled={isFetchingAwards}
@@ -899,10 +923,28 @@ export const GrantsPage: React.FC = () => {
                             <span className="text-[10px] text-slate-500 font-mono">System ID: #{awd.id}</span>
                           </td>
                           <td className="py-3.5 px-4 text-slate-200 font-medium">
-                            {awd.organisationName || `Org #${awd.organisationId}`}
+                            {(() => {
+                              const org = organisations.find((o) => String(o.id) === String(awd.organisationId));
+                              const orgName = org?.name || awd.organisationName || (awd.organisationId ? `Organisation #${awd.organisationId}` : '—');
+                              return (
+                                <div>
+                                  <span className="text-white block font-medium">{orgName}</span>
+                                  {awd.organisationId && <span className="text-[10px] text-slate-500 font-mono">ID: #{awd.organisationId}</span>}
+                                </div>
+                              );
+                            })()}
                           </td>
                           <td className="py-3.5 px-4 text-slate-400">
-                            {awd.programmeName || `Programme #${awd.programmeId}`}
+                            {(() => {
+                              const prog = programmes.find((p) => String(p.id) === String(awd.programmeId));
+                              const progName = prog?.name || awd.programmeName || (awd.programmeId ? `Programme #${awd.programmeId}` : '—');
+                              return (
+                                <div>
+                                  <span className="text-slate-200 block">{progName}</span>
+                                  {awd.programmeId && <span className="text-[10px] text-slate-500 font-mono">Programme #{awd.programmeId}</span>}
+                                </div>
+                              );
+                            })()}
                           </td>
                           <td className="py-3.5 px-4 text-right font-mono font-bold text-white text-xs">
                             {formatZAR(awd.amount)}
@@ -919,10 +961,10 @@ export const GrantsPage: React.FC = () => {
                             {Number(awd.status) === ApprovalStatus.Approved ? (
                               <span
                                 className="inline-flex items-center gap-1 text-xs font-semibold text-emerald-400 bg-emerald-500/10 px-2.5 py-1.5 rounded-lg border border-emerald-500/20 cursor-default"
-                                title="Approved award is immutable. Details cannot be modified."
+                                title="Approved award details cannot be modified."
                               >
                                 <Lock className="w-3 h-3 text-emerald-400" />
-                                <span>Approved (Immutable)</span>
+                                <span>Approved</span>
                               </span>
                             ) : (
                               <button
@@ -973,8 +1015,10 @@ export const GrantsPage: React.FC = () => {
             <div className="flex items-center gap-2 self-end sm:self-center">
               <button
                 type="button"
-                onClick={() => {
+                onClick={async () => {
-                  refetchBudgets();
+                  bumpMutationEpoch();
+                  await queryClient.invalidateQueries({ queryKey: ['budgets'] });
+                  await refetchBudgets();
                   success('Refreshed', 'Budget line categories refreshed from API.');
                 }}
                 disabled={isFetchingBudgets}
@@ -1004,7 +1048,7 @@ export const GrantsPage: React.FC = () => {
                       Budget Line Category
                     </SortableTh>
                     <SortableTh column="projectId" currentColumn={budgetSortCol} direction={budgetSortDir} onSort={handleBudgetSort} className="py-3.5 px-4">
-                      Project ID
+                      Project
                     </SortableTh>
                     <SortableTh column="amount" currentColumn={budgetSortCol} direction={budgetSortDir} onSort={handleBudgetSort} align="right" className="py-3.5 px-4 text-right">
                       Approved Amount (ZAR)
@@ -1043,7 +1087,18 @@ export const GrantsPage: React.FC = () => {
                             <span className="font-semibold text-white block">{b.name}</span>
                             <span className="text-[10px] text-slate-500 font-mono">ID: #{b.id}</span>
                           </td>
-                          <td className="py-3.5 px-4 text-slate-400 font-mono">Project #{b.projectId}</td>
+                          <td className="py-3.5 px-4 text-slate-200">
+                            {(() => {
+                              const proj = projects.find((p) => String(p.id) === String(b.projectId));
+                              const projName = proj?.name || `Project #${b.projectId}`;
+                              return (
+                                <div>
+                                  <span className="font-medium text-white block">{projName}</span>
+                                  <span className="text-[10px] text-slate-500 font-mono">ID: #{b.projectId}</span>
+                                </div>
+                              );
+                            })()}
+                          </td>
                           <td className="py-3.5 px-4 text-right font-mono font-bold text-white">
                             {formatZAR(b.amount)}
                           </td>
@@ -1059,10 +1114,10 @@ export const GrantsPage: React.FC = () => {
                               {Number(b.status) === ApprovalStatus.Approved ? (
                                 <span
                                   className="inline-flex items-center gap-1 text-xs font-semibold text-emerald-400 bg-emerald-500/10 px-2.5 py-1.5 rounded-lg border border-emerald-500/20 cursor-default"
-                                  title="Approved budget is immutable. Status cannot be modified."
+                                  title="Approved budget status cannot be modified."
                                 >
                                   <Lock className="w-3 h-3 text-emerald-400" />
-                                  <span>Approved (Immutable)</span>
+                                  <span>Approved</span>
                                 </span>
                               ) : (
                                 <>
@@ -1133,8 +1188,10 @@ export const GrantsPage: React.FC = () => {
             <div className="flex items-center gap-2 self-end sm:self-center">
               <button
                 type="button"
-                onClick={() => {
+                onClick={async () => {
-                  refetchDisbursements();
+                  bumpMutationEpoch();
+                  await queryClient.invalidateQueries({ queryKey: ['disbursements'] });
+                  await refetchDisbursements();
                   success('Refreshed', 'Disbursement tranches refreshed from API.');
                 }}
                 disabled={isFetchingDisbursements}
@@ -1172,7 +1229,7 @@ export const GrantsPage: React.FC = () => {
                       Disbursement ID
                     </SortableTh>
                     <SortableTh column="projectId" currentColumn={disbSortCol} direction={disbSortDir} onSort={handleDisbSort} className="py-3.5 px-4">
-                      Project ID
+                      Project
                     </SortableTh>
                     <SortableTh column="milestoneId" currentColumn={disbSortCol} direction={disbSortDir} onSort={handleDisbSort} className="py-3.5 px-4">
                       Milestone Association
@@ -1211,9 +1268,32 @@ export const GrantsPage: React.FC = () => {
                           <td className="py-3.5 px-5 font-mono font-bold text-white">
                             DSB-{d.id}
                           </td>
-                          <td className="py-3.5 px-4 text-slate-300 font-mono">Project #{d.projectId}</td>
+                          <td className="py-3.5 px-4 text-slate-200">
+                            {(() => {
+                              const proj = projects.find((p) => String(p.id) === String(d.projectId));
+                              const projName = proj?.name || `Project #${d.projectId}`;
+                              return (
+                                <div>
+                                  <span className="font-medium text-white block">{projName}</span>
+                                  <span className="text-[10px] text-slate-500 font-mono">Project ID: #{d.projectId}</span>
+                                </div>
+                              );
+                            })()}
+                          </td>
                           <td className="py-3.5 px-4 text-slate-400 font-medium">
-                            {d.milestoneId ? `Milestone #${d.milestoneId}` : 'Initial Advance Tranche'}
+                            {(() => {
+                              if (!d.milestoneId) {
+                                return <span className="text-slate-400 italic">Initial Advance Tranche</span>;
+                              }
+                              const ms = milestones.find((m) => String(m.id) === String(d.milestoneId));
+                              const msName = ms?.name || `Milestone #${d.milestoneId}`;
+                              return (
+                                <div>
+                                  <span className="font-medium block">{msName}</span>
+                                  <span className="text-[10px] text-slate-500 font-mono">Milestone ID: #{d.milestoneId}</span>
+                                </div>
+                              );
+                            })()}
                           </td>
                           <td className="py-3.5 px-4 text-right font-mono font-bold text-white text-xs">
                             {formatZAR(d.amount)}
@@ -1549,7 +1629,14 @@ export const GrantsPage: React.FC = () => {
           onSubmit={editAwardForm.handleSubmit((values) => {
             if (!editingAward) return;
             if (Number(editingAward.status) === ApprovalStatus.Approved) {
-              toastError('Record Immutable', 'Approved awards cannot be modified.');
+              toastError('Record Approved', 'Approved awards cannot be modified.');
+              return;
+            }
+            if (
+              selectedAwardStatus === ApprovalStatus.Approved &&
+              !canApproveRecord('grant_financials', editingAward.createdBy)
+            ) {
+              toastError('Maker-Checker Violation', 'Record creators cannot approve their own award records.');
               return;
             }
             updateAwardMutation.mutate({
@@ -1630,7 +1717,7 @@ export const GrantsPage: React.FC = () => {
             {Number(editingAward?.status) === ApprovalStatus.Approved ? (
               <div className="w-full px-3 py-2 text-xs border border-emerald-500/30 bg-emerald-500/10 rounded-xl text-emerald-300 font-semibold flex items-center gap-1.5 cursor-default">
                 <Lock className="w-3.5 h-3.5 text-emerald-400" />
-                <span>Approved (Immutable - Cannot Be Changed)</span>
+                <span>Approved</span>
               </div>
             ) : (
               <select
@@ -1640,7 +1727,21 @@ export const GrantsPage: React.FC = () => {
               >
                 <option value={ApprovalStatus.Pending}>Pending Approval</option>
                 <option value={ApprovalStatus.Review}>Under Review</option>
-                <option value={ApprovalStatus.Approved}>Approved &amp; Activated</option>
+                {(() => {
+                  const canApproveAwd = canApproveRecord('grant_financials', editingAward?.createdBy);
+                  const isSelf = isMaker(editingAward?.createdBy);
+                  let reason = '';
+                  if (!canApprove('grant_financials')) {
+                    reason = ' (Requires Update Permission)';
+                  } else if (isSelf) {
+                    reason = ' (Maker-Checker: Cannot approve own record)';
+                  }
+                  return (
+                    <option value={ApprovalStatus.Approved} disabled={!canApproveAwd}>
+                      Approved &amp; Activated {reason}
+                    </option>
+                  );
+                })()}
                 <option value={ApprovalStatus.Rejected}>Rejected</option>
               </select>
             )}
@@ -1783,7 +1884,7 @@ export const GrantsPage: React.FC = () => {
             {Number(editingBudget?.status) === ApprovalStatus.Approved ? (
               <div className="w-full px-3 py-2 text-xs border border-emerald-500/30 bg-emerald-500/10 rounded-xl text-emerald-300 font-semibold flex items-center gap-1.5 cursor-default">
                 <Lock className="w-3.5 h-3.5 text-emerald-400" />
-                <span>Approved (Immutable - Status Cannot Be Changed)</span>
+                <span>Approved</span>
               </div>
             ) : (
               <select

PostFundManagement.ConsoleUI/src/pages/InboxPage.tsx

@@ -42,7 +42,6 @@ export const InboxPage: React.FC = () => {
   const { data: directoryUsers = [] } = useQuery<User[]>({
     queryKey: ['users-directory'],
     queryFn: () => getUsers(1, 200),
-    staleTime: 5 * 60 * 1000,
   });
 
   const {
@@ -149,7 +148,11 @@ export const InboxPage: React.FC = () => {
         }
       }
     } else if (!selectedMessage && folderMessages.length > 0 && activeFolder !== 'drafts') {
-      setSelectedMessage(folderMessages[0]);
+      const first = folderMessages[0];
+      setSelectedMessage(first);
+      if (activeFolder === 'inbox' && Number(first.status) !== NotificationStatus.Read) {
+        markAsRead(first.id);
+      }
     }
   }, [targetIdParam, folderMessages, activeFolder]);
 
@@ -666,6 +669,22 @@ export const InboxPage: React.FC = () => {
                         >
                           <Star className={`w-3.5 h-3.5 ${isStarred ? 'fill-amber-400' : ''}`} />
                         </button>
+
+                        <button
+                          type="button"
+                          onClick={e => {
+                            e.stopPropagation();
+                            deleteMessage(item.id);
+                            if (selectedMessage?.id === item.id) {
+                              setSelectedMessage(null);
+                            }
+                          }}
+                          className="p-0.5 rounded text-slate-400 hover:text-rose-400 transition cursor-pointer"
+                          title="Delete message (Archive)"
+                        >
+                          <Trash2 className="w-3.5 h-3.5" />
+                        </button>
+
                         <span className="text-[10px] text-slate-400 font-mono">
                           {formatDate(item.createdAt)}
                         </span>

PostFundManagement.ConsoleUI/src/pages/ProjectsPage.tsx

@@ -42,6 +42,7 @@ import {
   recordIndicatorActual,
   getBudgets,
   getActivities,
+  getDisbursements,
 } from '../services/api';
 import { Modal } from '../components/ui/Modal';
 import { HelpTooltip } from '../components/ui/HelpTooltip';
@@ -242,6 +243,11 @@ export const ProjectsPage: React.FC = () => {
     queryFn: () => getBudgets(1, 100),
   });
 
+  const { data: allDisbursements = [] } = useQuery({
+    queryKey: ['disbursements'],
+    queryFn: () => getDisbursements(1, 200),
+  });
+
   const { data: allProjectActivities = new Map<string | number, any[]>() } = useQuery({
     queryKey: ['allProjectActivities', projects.map((p) => p.id)],
     queryFn: async () => {
@@ -311,6 +317,18 @@ export const ProjectsPage: React.FC = () => {
     return map;
   }, [allBudgets]);
 
+  // Disbursed capital per project
+  const disbursedByProject = useMemo(() => {
+    const map = new Map<string | number, number>();
+    allDisbursements.forEach((d) => {
+      if (Number(d.status) === ApprovalStatus.Approved || Number(d.status) === 3) {
+        const current = map.get(d.projectId) || 0;
+        map.set(d.projectId, current + (Number(d.amount) || 0));
+      }
+    });
+    return map;
+  }, [allDisbursements]);
+
   // Filtered Projects
   const filteredProjects = useMemo(() => {
     return projects.filter((p) => {
@@ -380,9 +398,22 @@ export const ProjectsPage: React.FC = () => {
         return amt > 0 ? formatZAR(amt) : 'R 0';
       },
     },
+    {
+      header: 'Project Variance (ZAR)',
+      key: 'id',
+      format: (_, p) => {
+        const approvedBudget = approvedBudgetsByProject.get(p.id) || 0;
+        const pActs = allProjectActivities.get(p.id) || [];
+        const pActsTotal = pActs.reduce((sum, a) => sum + (Number(a.amount) || 0), 0);
+        const pDisbursedTotal = disbursedByProject.get(p.id) || 0;
+        const projectValue = pActsTotal - pDisbursedTotal;
+        const pVariance = approvedBudget - projectValue;
+        return `${pVariance >= 0 ? '+' : ''}${formatZAR(pVariance)}`;
+      },
+    },
     { header: 'Approval Status', key: 'status', format: (val) => getApprovalStatusBadge(val).label },
     { header: 'Created By', key: 'createdBy', format: (val) => getUserEmail(val) },
-  ], [programmeMap, milestonesByProject, approvedBudgetsByProject]);
+  ], [programmeMap, milestonesByProject, approvedBudgetsByProject, allProjectActivities, disbursedByProject]);
 
   // Table Sorting
   const customExtractors = {
@@ -404,6 +435,14 @@ export const ProjectsPage: React.FC = () => {
       if (risk.isAtRisk) return 2;
       return 3;
     },
+    variance: (p: Project) => {
+      const approvedBudget = approvedBudgetsByProject.get(p.id) || 0;
+      const pActs = allProjectActivities.get(p.id) || [];
+      const pActsTotal = pActs.reduce((sum, a) => sum + (Number(a.amount) || 0), 0);
+      const pDisbursedTotal = disbursedByProject.get(p.id) || 0;
+      const projectValue = pActsTotal - pDisbursedTotal;
+      return approvedBudget - projectValue;
+    },
   };
 
   const { sortedData: sortedProjects, sortColumn, sortDirection, handleSort } = useTableSort(
@@ -1007,17 +1046,17 @@ export const ProjectsPage: React.FC = () => {
                     />
                   </div>
                 </SortableTh>
-                <th className="py-3.5 px-4 text-right font-semibold whitespace-nowrap w-36">
+                <SortableTh column="variance" currentColumn={sortColumn} direction={sortDirection} onSort={handleSort} align="right" className="py-3.5 px-4 text-right whitespace-nowrap w-36">
                   <div className="flex items-center justify-end gap-1">
                     <span>Project Variance</span>
                     <HelpTooltip
                       title="Project Variance"
-                      content="Approved allocated budget minus scheduled milestone activity values. Positive (green) indicates within budget constraints; negative (red) indicates cost overrun."
+                      content="Approved allocated budget minus net project value (milestone activity commitments minus disbursements). Positive (green) indicates remaining budget headroom; negative (red) indicates cost overrun."
                       size="sm"
                       placement="bottom"
                     />
                   </div>
-                </th>
+                </SortableTh>
                 <th className="py-3.5 px-4 text-right font-semibold whitespace-nowrap w-56">Actions</th>
               </tr>
             </thead>
@@ -1212,7 +1251,9 @@ export const ProjectsPage: React.FC = () => {
                           const approvedBudget = approvedBudgetsByProject.get(p.id) || 0;
                           const pActs = allProjectActivities.get(p.id) || [];
                           const pActsTotal = pActs.reduce((sum, a) => sum + (Number(a.amount) || 0), 0);
-                          const pVariance = approvedBudget - pActsTotal;
+                          const pDisbursedTotal = disbursedByProject.get(p.id) || 0;
+                          const projectValue = pActsTotal - pDisbursedTotal;
+                          const pVariance = approvedBudget - projectValue;
                           const isPos = pVariance >= 0;
                           return (
                             <td className="py-3.5 px-4 text-right whitespace-nowrap w-36 font-mono font-bold" onClick={(e) => e.stopPropagation()}>
@@ -1222,7 +1263,7 @@ export const ProjectsPage: React.FC = () => {
                                     ? 'text-emerald-400 bg-emerald-500/10 border-emerald-500/30'
                                     : 'text-rose-400 bg-rose-500/10 border-rose-500/30'
                                 }`}
-                                title={`Approved Budget: ${formatZAR(approvedBudget)} | Milestone Activities: ${formatZAR(pActsTotal)} | Variance: ${isPos ? '+' : ''}${formatZAR(pVariance)}`}
+                                title={`Approved Budget: ${formatZAR(approvedBudget)} | Milestone Activities: ${formatZAR(pActsTotal)} | Disbursements: ${formatZAR(pDisbursedTotal)} | Project Value: ${formatZAR(projectValue)} | Variance: ${isPos ? '+' : ''}${formatZAR(pVariance)}`}
                               >
                                 {isPos ? `+${formatZAR(pVariance)}` : `-${formatZAR(Math.abs(pVariance))}`}
                               </span>

PostFundManagement.ConsoleUI/src/pages/SettingsPage.tsx

@@ -57,6 +57,7 @@ import {
   getOrganisations,
   getAwards,
   getContracts,
+  getProjects,
   getAuditLogs,
   getNotifications,
   notifyInviteApproved,
@@ -79,6 +80,8 @@ import {
   NotificationStatus,
   NotificationPlatform,
   ActivityStatus,
+  ApprovalStatus,
+  ContractStatus,
   User,
   Invite,
   InviteRequest,
@@ -110,7 +113,7 @@ export const SettingsPage: React.FC = () => {
 
   const [activeTab, setActiveTab] = useState<'users' | 'invites' | 'notifications' | 'audit'>('users');
 
-  const { canView, canAdd, canExport } = useRbac();
+  const { canView, canAdd, canExport, canApproveRecord, isMaker } = useRbac();
   const canViewUsers = canView('settings_users') || canView('tenant_self_service');
   const canViewInvites = canView('settings_invites');
   const canViewNotifications = canView('settings_notifications');
@@ -152,7 +155,6 @@ export const SettingsPage: React.FC = () => {
   const { data: usersDirectory = [] } = useQuery({
     queryKey: ['users-directory'],
     queryFn: () => getUsers(1, 200),
-    staleTime: 5 * 60 * 1000,
   });
 
   const {
@@ -241,6 +243,7 @@ export const SettingsPage: React.FC = () => {
   const [invitedOrgId, setInvitedOrgId] = useState<string | number>('');
   const [inviteAwardId, setInviteAwardId] = useState<string | number>('');
   const [inviteContractId, setInviteContractId] = useState<string | number>('');
+  const [inviteProjectId, setInviteProjectId] = useState<string | number>('');
   const [inviteRecipientUuid, setInviteRecipientUuid] = useState('');
   const [inviteMessage, setInviteMessage] = useState('');
   const [invitePlatform, setInvitePlatform] = useState<NotificationPlatform>(NotificationPlatform.Email);
@@ -253,6 +256,10 @@ export const SettingsPage: React.FC = () => {
   );
 
   const handleApproveInvite = async (inv: Invite, idx: number) => {
+    if (isMaker(inv.createdBy)) {
+      toastError('Maker-Checker Violation', 'You cannot approve an invitation that you created.');
+      return;
+    }
     const inviteKey = inv.id ? String(inv.id) : `inv_${idx}`;
     markInviteAsApprovedInStorage(inviteKey, currentTenantId);
     setApprovedInviteIds((prev) => (prev.includes(inviteKey) ? prev : [...prev, inviteKey]));
@@ -270,32 +277,6 @@ export const SettingsPage: React.FC = () => {
     );
   };
 
-  // Invites filtering & search
-  const [inviteSearchTerm, setInviteSearchTerm] = useState('');
-  const [invitePlatformFilter, setInvitePlatformFilter] = useState<'all' | number>('all');
-
-  const {
-    data: invitesList = [],
-    isLoading: loadingInvites,
-    isFetching: isFetchingInvites,
-    refetch: refetchInvites,
-  } = useQuery({
-    queryKey: ['invites'],
-    queryFn: () => getInvites(1, 100),
-  });
-
-  const filteredInvites = useMemo(() => {
-    return invitesList.filter((inv) => {
-      const matchSearch =
-        !inviteSearchTerm.trim() ||
-        (inv.recipient && inv.recipient.toLowerCase().includes(inviteSearchTerm.toLowerCase())) ||
-        (inv.message && inv.message.toLowerCase().includes(inviteSearchTerm.toLowerCase()));
-      const matchPlatform =
-        invitePlatformFilter === 'all' || Number(inv.platform) === Number(invitePlatformFilter);
-      return matchSearch && matchPlatform;
-    });
-  }, [invitesList, inviteSearchTerm, invitePlatformFilter]);
-
   const { data: organisations = [] } = useQuery({
     queryKey: ['organisations'],
     queryFn: () => getOrganisations(1, 50),
@@ -311,6 +292,104 @@ export const SettingsPage: React.FC = () => {
     queryFn: () => getContracts(1, 50),
   });
 
+  const { data: projects = [] } = useQuery({
+    queryKey: ['projects'],
+    queryFn: () => getProjects(1, 100),
+  });
+
+  // Only awards that are Approved AND have an Approved/Active contract are eligible for invitations
+  const eligibleAwards = useMemo(() => {
+    return awards.filter((aw) => {
+      const isApprovedAward = Number(aw.status) === ApprovalStatus.Approved;
+      if (!isApprovedAward) return false;
+      const hasApprovedContract = contracts.some(
+        (c) =>
+          String(c.awardId) === String(aw.id) &&
+          (Number(c.status) === ContractStatus.Active || Number(c.status) === ContractStatus.Executed)
+      );
+      return hasApprovedContract;
+    });
+  }, [awards, contracts]);
+
+  const handleSelectAward = (awardId: string | number) => {
+    setInviteAwardId(awardId);
+    const selected = eligibleAwards.find((a) => String(a.id) === String(awardId));
+    if (selected) {
+      setInvitedOrgId(selected.organisationId);
+      const matchingContract = contracts.find(
+        (c) =>
+          String(c.awardId) === String(selected.id) &&
+          (Number(c.status) === ContractStatus.Active || Number(c.status) === ContractStatus.Executed)
+      );
+      if (matchingContract) {
+        setInviteContractId(matchingContract.id);
+      }
+      setInviteProjectId(selected.projectId || '');
+    }
+  };
+
+  React.useEffect(() => {
+    if (isSendInviteModalOpen) {
+      if (eligibleAwards.length > 0) {
+        const currentAward =
+          eligibleAwards.find((a) => String(a.id) === String(inviteAwardId)) || eligibleAwards[0];
+        setInviteAwardId(currentAward.id);
+        setInvitedOrgId(currentAward.organisationId);
+        const matchingContract = contracts.find(
+          (c) =>
+            String(c.awardId) === String(currentAward.id) &&
+            (Number(c.status) === ContractStatus.Active || Number(c.status) === ContractStatus.Executed)
+        );
+        if (matchingContract) {
+          setInviteContractId(matchingContract.id);
+        }
+        setInviteProjectId(currentAward.projectId || '');
+      } else {
+        setInviteAwardId('');
+        setInvitedOrgId('');
+        setInviteContractId('');
+        setInviteProjectId('');
+      }
+    }
+  }, [isSendInviteModalOpen, eligibleAwards, contracts]);
+
+  // Invites filtering & search
+  const [inviteSearchTerm, setInviteSearchTerm] = useState('');
+  const [invitePlatformFilter, setInvitePlatformFilter] = useState<'all' | number>('all');
+
+  const {
+    data: invitesList = [],
+    isLoading: loadingInvites,
+    isFetching: isFetchingInvites,
+    refetch: refetchInvites,
+  } = useQuery({
+    queryKey: ['invites'],
+    queryFn: () => getInvites(1, 100),
+  });
+
+  const getStoredInvitePlatform = (inviteId?: string | number): NotificationPlatform | undefined => {
+    if (!inviteId) return undefined;
+    try {
+      const raw = localStorage.getItem(`pfm_invite_platform_${inviteId}`);
+      return raw !== null ? (Number(raw) as NotificationPlatform) : undefined;
+    } catch {
+      return undefined;
+    }
+  };
+
+  const storeInvitePlatform = (inviteId: string | number, platform: NotificationPlatform) => {
+    try {
+      localStorage.setItem(`pfm_invite_platform_${inviteId}`, String(platform));
+    } catch {}
+  };
+
+  const resolveUserEmail = (userIdOrUuid?: string | null): string => {
+    if (!userIdOrUuid) return '—';
+    const u = usersDirectory.find((usr) => String(usr.id).toLowerCase() === String(userIdOrUuid).toLowerCase());
+    const email = u?.email || getUserEmail(userIdOrUuid);
+    return email && email !== '—' ? email : String(userIdOrUuid);
+  };
+
   const sendInviteMutation = useMutation({
     mutationFn: (payload: InviteRequest) => sendInvite(payload),
     onSuccess: (data, variables) => {
@@ -320,8 +399,10 @@ export const SettingsPage: React.FC = () => {
       setInviteRecipientUuid('');
       setInviteMessage('');
 
-      if (inviteAutoApprove) {
       const invId = (data as any)?.id ? String((data as any).id) : `inv_${Date.now()}`;
+      storeInvitePlatform(invId, variables.platform);
+
+      if (inviteAutoApprove) {
         markInviteAsApprovedInStorage(invId, currentTenantId);
         setApprovedInviteIds((prev) => (prev.includes(invId) ? prev : [...prev, invId]));
 
@@ -333,6 +414,7 @@ export const SettingsPage: React.FC = () => {
             organisationId: variables.organisationId,
             awardId: variables.awardId,
             contractId: variables.contractId,
+            projectId: variables.projectId,
             message: variables.message,
           },
         }).then(() => {
@@ -418,6 +500,38 @@ export const SettingsPage: React.FC = () => {
     handleSort: handleNotifSort,
   } = useTableSort(filteredNotifications, 'createdAt', 'desc');
 
+  const resolveInvitePlatform = (inv: Invite): NotificationPlatform => {
+    if (inv.platform !== undefined && inv.platform !== null) {
+      return Number(inv.platform) as NotificationPlatform;
+    }
+    const stored = getStoredInvitePlatform(inv.id);
+    if (stored !== undefined) return stored;
+
+    const linkedNotif = fetchedNotifications.find(
+      (n) =>
+        (inv.recipient && n.recipient?.toLowerCase() === inv.recipient?.toLowerCase()) ||
+        (inv.invitedOrganisationId && String(n.organisationId) === String(inv.invitedOrganisationId))
+    );
+    if (linkedNotif?.platform !== undefined && linkedNotif.platform !== null) {
+      return Number(linkedNotif.platform) as NotificationPlatform;
+    }
+    return NotificationPlatform.Email;
+  };
+
+  const filteredInvites = useMemo(() => {
+    return invitesList.filter((inv) => {
+      const recipientEmail = resolveUserEmail(inv.recipient).toLowerCase();
+      const matchSearch =
+        !inviteSearchTerm.trim() ||
+        (inv.recipient && inv.recipient.toLowerCase().includes(inviteSearchTerm.toLowerCase())) ||
+        recipientEmail.includes(inviteSearchTerm.toLowerCase());
+      const resolvedPlatform = resolveInvitePlatform(inv);
+      const matchPlatform =
+        invitePlatformFilter === 'all' || Number(resolvedPlatform) === Number(invitePlatformFilter);
+      return matchSearch && matchPlatform;
+    });
+  }, [invitesList, inviteSearchTerm, invitePlatformFilter, fetchedNotifications, usersDirectory]);
+
   // ==========================================
   // 4. Audit Log Ledger State
   // ==========================================
@@ -486,9 +600,22 @@ export const SettingsPage: React.FC = () => {
     {
       header: 'Changes / Arguments',
       key: 'changes',
-      format: (val) => (Array.isArray(val) ? val.join('; ') : val || '—'),
+      format: (val) => {
+        if (!val) return '—';
+        let str = Array.isArray(val) ? val.join('; ') : typeof val === 'object' ? JSON.stringify(val) : String(val);
+        str = str.replace(/\r\n|\r|\n/g, ' ').replace(/\s{2,}/g, ' ').trim();
+        return str.length > 250 ? `${str.slice(0, 247)}...` : str;
+      },
+    },
+    {
+      header: 'Error Details',
+      key: 'error',
+      format: (val) => {
+        if (!val) return '—';
+        let str = String(val).replace(/\r\n|\r|\n/g, ' ').replace(/\s{2,}/g, ' ').trim();
+        return str.length > 250 ? `${str.slice(0, 247)}...` : str;
+      },
     },
-    { header: 'Error Details', key: 'error', format: (val) => val || '—' },
   ];
 
   const uniqueAuditEntities = Array.from(
@@ -558,13 +685,25 @@ export const SettingsPage: React.FC = () => {
   ];
 
   const inviteExportColumns: ExportColumn<Invite>[] = [
-    { header: 'Recipient (UUID)', key: 'recipient' },
+    {
-    { header: 'Channel / Platform', key: 'platform', format: (val) => getNotificationPlatformLabel(val) },
+      header: 'Recipient Email',
-    { header: 'Invitation Message', key: 'message' },
+      key: 'recipient',
+      format: (val) => resolveUserEmail(val),
+    },
+    {
+      header: 'Channel / Platform',
+      key: 'platform',
+      format: (_val, inv) => getNotificationPlatformLabel(resolveInvitePlatform(inv)),
+    },
     {
       header: 'Target Organisation / Grant',
       key: 'invitedOrganisationId',
-      format: (val, inv) => `Org #${val || inv.organisationId || '—'} (Award #${inv.awardId || '—'})`,
+      format: (val, inv) => {
+        const orgId = val || inv.organisationId;
+        const org = organisations.find((o) => String(o.id) === String(orgId));
+        const orgName = org?.name || `Organisation #${orgId || '—'}`;
+        return `${orgName} • Award #${inv.awardId || '—'}`;
+      },
     },
     { header: 'Date Dispatched', key: 'createdAt', format: (val) => (val ? formatDate(val) : '—') },
   ];
@@ -590,7 +729,15 @@ export const SettingsPage: React.FC = () => {
     sortColumn: inviteSortCol,
     sortDirection: inviteSortDir,
     handleSort: handleInviteSort,
-  } = useTableSort(filteredInvites, 'createdAt', 'desc');
+  } = useTableSort(filteredInvites, 'createdAt', 'desc', {
+    recipient: (inv: Invite) => resolveUserEmail(inv.recipient),
+    platform: (inv: Invite) => getNotificationPlatformLabel(resolveInvitePlatform(inv)),
+    invitedOrganisationId: (inv: Invite) => {
+      const orgId = inv.invitedOrganisationId || inv.organisationId;
+      const org = organisations.find((o) => String(o.id) === String(orgId));
+      return org?.name || `Organisation #${orgId || ''}`;
+    },
+  });
 
   const getActionBadge = (action?: string | null) => {
     const act = (action || 'GENERAL_EVENT').toUpperCase();
@@ -1181,14 +1328,11 @@ export const SettingsPage: React.FC = () => {
                 <thead>
                   <tr className="bg-slate-900/60 border-b border-slate-800/80 text-slate-400 uppercase tracking-wider font-semibold">
                     <SortableTh column="recipient" currentColumn={inviteSortCol} direction={inviteSortDir} onSort={handleInviteSort} className="py-3.5 px-5">
-                      Recipient (UUID)
+                      Recipient Email
                     </SortableTh>
                     <SortableTh column="platform" currentColumn={inviteSortCol} direction={inviteSortDir} onSort={handleInviteSort} className="py-3.5 px-4">
                       Channel
                     </SortableTh>
-                    <SortableTh column="message" currentColumn={inviteSortCol} direction={inviteSortDir} onSort={handleInviteSort} className="py-3.5 px-4">
-                      Message
-                    </SortableTh>
                     <SortableTh column="invitedOrganisationId" currentColumn={inviteSortCol} direction={inviteSortDir} onSort={handleInviteSort} className="py-3.5 px-4">
                       Target Org / Grant
                     </SortableTh>
@@ -1206,13 +1350,13 @@ export const SettingsPage: React.FC = () => {
                 <tbody className="divide-y divide-slate-800/50">
                   {loadingInvites ? (
                     <tr>
-                      <td colSpan={7} className="py-8 text-center text-slate-500">
+                      <td colSpan={6} className="py-8 text-center text-slate-500">
                         Loading invitations ledger...
                       </td>
                     </tr>
                   ) : sortedInvites.length === 0 ? (
                     <tr>
-                      <td colSpan={7} className="py-8 text-center text-slate-500">
+                      <td colSpan={6} className="py-8 text-center text-slate-500">
                         No invitations recorded yet. Use &ldquo;Dispatch Invitation&rdquo; to send one.
                       </td>
                     </tr>
@@ -1222,22 +1366,34 @@ export const SettingsPage: React.FC = () => {
                         approvedInviteIds.includes(String(inv.id)) ||
                         approvedInviteIds.includes(`inv_${idx}`) ||
                         approvedInviteIds.includes(String(idx));
+                      const resolvedPlatform = resolveInvitePlatform(inv);
+                      const userEmail = resolveUserEmail(inv.recipient);
+                      const orgId = inv.invitedOrganisationId || inv.organisationId;
+                      const org = organisations.find((o) => String(o.id) === String(orgId));
+                      const orgName = org?.name || `Organisation #${orgId || '—'}`;
+                      const isCreator = isMaker(inv.createdBy);
 
                       return (
                         <tr key={idx} className="hover:bg-slate-800/40 transition-colors">
-                          <td className="py-3.5 px-5 font-mono text-slate-300 text-[11px]">
+                          <td className="py-3.5 px-5 text-slate-200 text-xs">
+                            <div className="font-medium text-white flex items-center gap-1.5">
+                              <Mail className="w-3.5 h-3.5 text-blue-400 shrink-0" />
+                              <span className="truncate">{userEmail}</span>
+                            </div>
+                            <div className="font-mono text-slate-500 text-[10px] truncate max-w-xs mt-0.5">
                               {inv.recipient}
+                            </div>
                           </td>
                           <td className="py-3.5 px-4">
                             <span className="inline-flex items-center px-2 py-0.5 rounded text-[10px] font-semibold bg-blue-500/10 text-blue-400 border border-blue-500/20">
-                              {getNotificationPlatformLabel(inv.platform)}
+                              {getNotificationPlatformLabel(resolvedPlatform)}
                             </span>
                           </td>
-                          <td className="py-3.5 px-4 text-white font-medium max-w-xs truncate">
+                          <td className="py-3.5 px-4 text-slate-300 text-xs">
-                            {inv.message}
+                            <div className="font-medium text-white">{orgName}</div>
-                          </td>
+                            <div className="text-slate-400 text-[11px] mt-0.5">
-                          <td className="py-3.5 px-4 text-slate-400 text-[11px]">
+                              Award #{inv.awardId || '—'}
-                            Org #{inv.invitedOrganisationId || inv.organisationId} &bull; Award #{inv.awardId}
+                            </div>
                           </td>
                           <td className="py-3.5 px-4">
                             {isApproved ? (
@@ -1261,7 +1417,7 @@ export const SettingsPage: React.FC = () => {
                                 <Check className="w-3 h-3" />
                                 Partner Notified
                               </span>
-                            ) : (
+                            ) : canApproveRecord('settings_invites', inv.createdBy) ? (
                               <button
                                 type="button"
                                 onClick={() => handleApproveInvite(inv, idx)}
@@ -1271,6 +1427,17 @@ export const SettingsPage: React.FC = () => {
                                 <Check className="w-3 h-3" />
                                 <span>Approve</span>
                               </button>
+                            ) : isCreator ? (
+                              <span
+                                className="inline-flex items-center gap-1 px-2 py-0.5 rounded text-[10px] font-semibold bg-amber-500/10 text-amber-400 border border-amber-500/20"
+                                title="Maker-Checker: You created this invite and cannot approve it"
+                              >
+                                Maker (Creator)
+                              </span>
+                            ) : (
+                              <span className="text-[11px] text-slate-500">
+                                Pending Review
+                              </span>
                             )}
                           </td>
                         </tr>
@@ -2491,15 +2658,20 @@ export const SettingsPage: React.FC = () => {
         <form
           onSubmit={(e) => {
             e.preventDefault();
+            if (!inviteAwardId) {
+              toastError('Policy Violation', 'An approved award with an approved contract must be selected.');
+              return;
+            }
             if (!inviteRecipientUuid || !inviteMessage) {
-              toastError('Validation Error', 'Recipient UUID and message content are mandatory.');
+              toastError('Validation Error', 'Recipient identifier and message content are mandatory.');
               return;
             }
             sendInviteMutation.mutate({
               organisationId: inviteOrgId || (organisations[0]?.id ? Number(organisations[0].id) : 101),
               invitedOrganisationId: invitedOrgId || (organisations[1]?.id ? Number(organisations[1].id) : 102),
-              awardId: inviteAwardId || (awards[0]?.id ? Number(awards[0].id) : 301),
+              awardId: inviteAwardId,
-              contractId: inviteContractId || (contracts[0]?.id ? Number(contracts[0].id) : 401),
+              contractId: inviteContractId,
+              projectId: inviteProjectId || 0,
               recipient: inviteRecipientUuid,
               message: inviteMessage,
               platform: invitePlatform,
@@ -2507,18 +2679,51 @@ export const SettingsPage: React.FC = () => {
           }}
           className="space-y-4"
         >
+          {eligibleAwards.length === 0 ? (
+            <div className="p-3.5 rounded-xl bg-amber-500/10 border border-amber-500/30 text-amber-300 text-xs flex items-start gap-2.5">
+              <RotateCcw className="w-4 h-4 shrink-0 text-amber-400 mt-0.5" />
               <div>
-            <div className="flex items-center gap-1 mb-1.5">
+                <span className="font-semibold block text-white">No Approved Awards Eligible for Invitation</span>
+                <span className="text-[11px] text-amber-300/90 leading-relaxed block mt-0.5">
+                  System governance policy strictly requires that invitations may only be dispatched for awards that have been formally <strong>Approved</strong> and whose associated contract is <strong>Approved &amp; Active</strong>.
+                </span>
+              </div>
+            </div>
+          ) : null}
+
+          <div className="space-y-1.5">
+            <div className="flex items-center justify-between">
+              <div className="flex items-center gap-1">
                 <label className="block text-xs font-semibold text-slate-300">
-                Recipient User UUID *
+                  Recipient User *
                 </label>
                 <HelpTooltip
-                title="Recipient UUID"
+                  title="Recipient Directory Identifier"
-                content="Unique directory user identifier or email for targeted delivery."
+                  content="Select a registered recipient user from directory or enter their unique user UUID."
                   size="sm"
                   placement="right"
                 />
               </div>
+              {usersDirectory.length > 0 && (
+                <span className="text-[10px] text-slate-400">Quick-select from registered users</span>
+              )}
+            </div>
+            {usersDirectory.length > 0 && (
+              <select
+                value={usersDirectory.some((u) => String(u.id).toLowerCase() === inviteRecipientUuid.toLowerCase()) ? inviteRecipientUuid : ''}
+                onChange={(e) => {
+                  if (e.target.value) setInviteRecipientUuid(e.target.value);
+                }}
+                className="w-full px-3 py-2 text-xs bg-slate-900/80 border border-slate-700/80 rounded-xl text-white focus:outline-none focus:ring-2 focus:ring-blue-500/50 [&>option]:bg-slate-900 [&>option]:text-white mb-1"
+              >
+                <option value="">-- Choose from Registered Users --</option>
+                {usersDirectory.map((u) => (
+                  <option key={u.id} value={u.id}>
+                    {u.name ? `${u.name} — ` : ''}{u.email} ({u.id})
+                  </option>
+                ))}
+              </select>
+            )}
             <input
               type="text"
               value={inviteRecipientUuid}
@@ -2529,6 +2734,98 @@ export const SettingsPage: React.FC = () => {
             />
           </div>
 
+          <div className="grid grid-cols-2 gap-3">
+            <div>
+              <div className="flex items-center gap-1 mb-1.5">
+                <label className="block text-xs font-semibold text-slate-300">
+                  Approved Award *
+                </label>
+                <HelpTooltip
+                  title="Approved Award Required"
+                  content="Only awards with status Approved and an Active/Approved contract are eligible for invitations."
+                  size="sm"
+                  placement="top"
+                />
+              </div>
+              <select
+                value={inviteAwardId}
+                onChange={(e) => handleSelectAward(e.target.value)}
+                disabled={eligibleAwards.length === 0}
+                className="w-full px-3 py-2 text-xs bg-slate-900/80 border border-slate-700/80 rounded-xl text-white focus:outline-none focus:ring-2 focus:ring-blue-500/50 [&>option]:bg-slate-900 [&>option]:text-white disabled:opacity-50"
+                required
+              >
+                {eligibleAwards.length === 0 ? (
+                  <option value="">No approved awards available</option>
+                ) : (
+                  eligibleAwards.map((aw) => {
+                    const recipientOrg = organisations.find((o) => String(o.id) === String(aw.organisationId));
+                    return (
+                      <option key={aw.id} value={aw.id}>
+                        Award #{aw.id} — {recipientOrg?.name || `Org #${aw.organisationId}`}
+                      </option>
+                    );
+                  })
+                )}
+              </select>
+            </div>
+
+            <div>
+              <div className="flex items-center gap-1 mb-1.5">
+                <label className="block text-xs font-semibold text-slate-300">
+                  Approved Contract *
+                </label>
+                <HelpTooltip
+                  title="Associated Approved Contract"
+                  content="The active/approved contract linked to the selected award."
+                  size="sm"
+                  placement="top"
+                />
+              </div>
+              <input
+                type="text"
+                value={inviteContractId ? `Contract #${inviteContractId} (Approved & Active)` : 'No active contract'}
+                readOnly
+                className="w-full px-3 py-2 text-xs bg-slate-900/50 border border-slate-800 rounded-xl text-slate-300 font-mono focus:outline-none cursor-not-allowed"
+              />
+            </div>
+          </div>
+
+          <div className="grid grid-cols-2 gap-3">
+            <div>
+              <div className="flex items-center gap-1 mb-1.5">
+                <label className="block text-xs font-semibold text-slate-300">
+                  Target Organisation (Recipient Org)
+                </label>
+              </div>
+              <input
+                type="text"
+                value={(() => {
+                  const o = organisations.find((org) => String(org.id) === String(invitedOrgId));
+                  return o ? `${o.name} (#${o.id})` : invitedOrgId ? `Org #${invitedOrgId}` : '—';
+                })()}
+                readOnly
+                className="w-full px-3 py-2 text-xs bg-slate-900/50 border border-slate-800 rounded-xl text-slate-300 focus:outline-none cursor-not-allowed"
+              />
+            </div>
+
+            <div>
+              <div className="flex items-center gap-1 mb-1.5">
+                <label className="block text-xs font-semibold text-slate-300">
+                  Associated Project
+                </label>
+              </div>
+              <input
+                type="text"
+                value={(() => {
+                  const prj = projects.find((p) => String(p.id) === String(inviteProjectId));
+                  return prj ? `${prj.name || 'Project'} (#${prj.id})` : inviteProjectId ? `Project #${inviteProjectId}` : 'Initial Award Project';
+                })()}
+                readOnly
+                className="w-full px-3 py-2 text-xs bg-slate-900/50 border border-slate-800 rounded-xl text-slate-300 focus:outline-none cursor-not-allowed"
+              />
+            </div>
+          </div>
+
           <div className="grid grid-cols-2 gap-3">
             <div>
               <div className="flex items-center gap-1 mb-1.5">
@@ -2558,7 +2855,7 @@ export const SettingsPage: React.FC = () => {
             <div>
               <div className="flex items-center gap-1 mb-1.5">
                 <label className="block text-xs font-semibold text-slate-300">
-                  Originating Organisation
+                  Originating Authority
                 </label>
                 <HelpTooltip
                   title="Inviting Authority"
@@ -2581,58 +2878,6 @@ export const SettingsPage: React.FC = () => {
             </div>
           </div>
 
-          <div className="grid grid-cols-2 gap-3">
-            <div>
-              <div className="flex items-center gap-1 mb-1.5">
-                <label className="block text-xs font-semibold text-slate-300">
-                  Associated Award
-                </label>
-                <HelpTooltip
-                  title="Linked Grant Award"
-                  content="Optional award attachment to link recipient permissions directly to grant administration."
-                  size="sm"
-                  placement="top"
-                />
-              </div>
-              <select
-                value={inviteAwardId}
-                onChange={(e) => setInviteAwardId(e.target.value)}
-                className="w-full px-3 py-2 text-xs bg-slate-900/80 border border-slate-700/80 rounded-xl text-white focus:outline-none focus:ring-2 focus:ring-blue-500/50 [&>option]:bg-slate-900 [&>option]:text-white"
-              >
-                {awards.map((aw) => (
-                  <option key={aw.id} value={aw.id}>
-                    Award #{aw.id}
-                  </option>
-                ))}
-              </select>
-            </div>
-
-            <div>
-              <div className="flex items-center gap-1 mb-1.5">
-                <label className="block text-xs font-semibold text-slate-300">
-                  Associated Contract
-                </label>
-                <HelpTooltip
-                  title="Linked Contract"
-                  content="Optional bilateral agreement linking the recipient to contract execution."
-                  size="sm"
-                  placement="top"
-                />
-              </div>
-              <select
-                value={inviteContractId}
-                onChange={(e) => setInviteContractId(e.target.value)}
-                className="w-full px-3 py-2 text-xs bg-slate-900/80 border border-slate-700/80 rounded-xl text-white focus:outline-none focus:ring-2 focus:ring-blue-500/50 [&>option]:bg-slate-900 [&>option]:text-white"
-              >
-                {contracts.map((ctr) => (
-                  <option key={ctr.id} value={ctr.id}>
-                    Contract #{ctr.id}
-                  </option>
-                ))}
-              </select>
-            </div>
-          </div>
-
           <div>
             <div className="flex items-center gap-1 mb-1.5">
               <label className="block text-xs font-semibold text-slate-300">
@@ -2681,7 +2926,7 @@ export const SettingsPage: React.FC = () => {
             </button>
             <button
               type="submit"
-              disabled={sendInviteMutation.isPending}
+              disabled={sendInviteMutation.isPending || eligibleAwards.length === 0}
               className="px-4 py-2 text-xs font-semibold text-white bg-gradient-to-r from-blue-600 to-indigo-600 hover:from-blue-500 hover:to-indigo-500 rounded-xl shadow-lg shadow-blue-500/20 transition disabled:opacity-50"
             >
               {sendInviteMutation.isPending ? 'Sending...' : 'Send Invitation'}

PostFundManagement.ConsoleUI/src/pages/SiteVisitsPage.tsx

@@ -528,7 +528,7 @@ export const SiteVisitsPage: React.FC = () => {
                   title="Approved site visits are immutable."
                 >
                   <Lock className="w-3.5 h-3.5 text-emerald-400" />
-                  <span>Approved &amp; Verified (Immutable - Cannot Be Changed)</span>
+                  <span>Approved &amp; Verified</span>
                 </div>
               ) : (
                 <select

PostFundManagement.ConsoleUI/src/pages/TenantManagementPage.tsx

@@ -68,14 +68,12 @@ const TenantOrganisationsSubList: React.FC<{ tenantId: number | string; tenantNa
   } = useQuery<TenantOrganisation[]>({
     queryKey: ['tenant-organisations', tenantId],
     queryFn: () => getTenantOrganisations(tenantId),
-    staleTime: 30000,
   });
 
   // Fetch tenant users directory to resolve linked user email per organisation
   const { data: tenantUsers = [] } = useQuery<TenantUser[]>({
     queryKey: ['tenant-users', tenantId],
     queryFn: () => getTenantUsers(tenantId),
-    staleTime: 5 * 60 * 1000,
   });
 
   React.useEffect(() => {
@@ -261,7 +259,6 @@ const TenantUsersSubList: React.FC<{
   const { data: tenantUsers = [], isLoading, refetch } = useQuery<TenantUser[]>({
     queryKey: ['tenant-users', tenantId],
     queryFn: () => getTenantUsers(tenantId),
-    staleTime: 30000,
   });
 
   const { canAdd } = useRbac();
@@ -460,7 +457,6 @@ export const TenantManagementPage: React.FC = () => {
   } = useQuery<Tenant[]>({
     queryKey: ['tenants-list'],
     queryFn: () => getTenants(),
-    staleTime: 30000,
   });
 
   // Forms
@@ -962,6 +958,7 @@ export const TenantManagementPage: React.FC = () => {
         isOpen={isCreateModalOpen}
         onClose={() => setIsCreateModalOpen(false)}
         title="Provision New Tenant Partition"
+        subtitle="Define an isolated multi-tenant partition for grants, portfolios, and users."
         size="md"
       >
         <form
@@ -970,17 +967,6 @@ export const TenantManagementPage: React.FC = () => {
           )}
           className="space-y-4"
         >
-          <div className="p-3.5 rounded-xl bg-blue-950/20 border border-blue-800/30 text-xs text-blue-200 flex items-start gap-2.5">
-            <Info className="w-4 h-4 text-blue-400 shrink-0 mt-0.5" />
-            <div className="space-y-1 leading-relaxed">
-              <p className="font-semibold text-white">Multi-Tenant Partition Boundary</p>
-              <p>
-                Creating a new tenant defines an isolated partition boundary for grants, portfolios, projects, and users.
-                New tenants are automatically initialized in the Active state.
-              </p>
-            </div>
-          </div>
-
           <div>
             <label className="block text-xs font-semibold text-slate-300 mb-1.5">
               Tenant Organization Name <span className="text-rose-400">*</span>
@@ -1007,7 +993,7 @@ export const TenantManagementPage: React.FC = () => {
             <button
               type="submit"
               disabled={createMutation.isPending}
-              className="flex items-center gap-1.5 px-4 py-2 bg-gradient-to-r from-blue-600 to-indigo-600 hover:from-blue-500 hover:to-indigo-500 text-white text-xs font-semibold rounded-xl shadow-md transition disabled:opacity-50 cursor-pointer"
+              className="flex items-center gap-1.5 px-4 py-2 bg-blue-600 hover:bg-blue-500 text-white text-xs font-semibold rounded-xl shadow-md transition disabled:opacity-50 cursor-pointer"
             >
               {createMutation.isPending && <RefreshCw className="w-3.5 h-3.5 animate-spin" />}
               <span>{createMutation.isPending ? 'Provisioning...' : 'Create Tenant'}</span>
@@ -1021,6 +1007,7 @@ export const TenantManagementPage: React.FC = () => {
         isOpen={isUpdateModalOpen}
         onClose={() => setIsUpdateModalOpen(false)}
         title={`Update Tenant: ${selectedTenant?.name || ''}`}
+        subtitle="Modify tenant partition name and operational access status."
         size="md"
       >
         {selectedTenant && (
@@ -1064,13 +1051,12 @@ export const TenantManagementPage: React.FC = () => {
 
             {/* Warning when selecting Inactive or Disabled */}
             {Number(updateForm.watch('status')) !== ActivityStatus.Active && (
-              <div className="p-3 rounded-xl bg-amber-950/30 border border-amber-800/40 text-xs text-amber-200 flex items-start gap-2.5">
+              <div className="p-3 rounded-xl bg-amber-500/10 border border-amber-500/20 text-xs text-amber-200 flex items-start gap-2.5">
                 <AlertTriangle className="w-4 h-4 text-amber-400 shrink-0 mt-0.5" />
-                <div className="space-y-1">
+                <div className="space-y-0.5">
-                  <p className="font-semibold text-white">Multitenancy Lockout Warning</p>
+                  <p className="font-semibold text-amber-300">Lockout Notice</p>
-                  <p className="text-[11px] leading-relaxed text-amber-300/90">
+                  <p className="text-[11px] text-amber-200/90 leading-relaxed">
-                    Changing this tenant's status to Inactive or Disabled immediately locks out all users assigned to this partition.
+                    Setting this tenant to Inactive or Disabled immediately locks out assigned users from accessing the API.
-                    The backend API will deny requests until the tenant is restored to Active status.
                   </p>
                 </div>
               </div>
@@ -1087,7 +1073,7 @@ export const TenantManagementPage: React.FC = () => {
               <button
                 type="submit"
                 disabled={updateMutation.isPending}
-                className="flex items-center gap-1.5 px-4 py-2 bg-gradient-to-r from-blue-600 to-indigo-600 hover:from-blue-500 hover:to-indigo-500 text-white text-xs font-semibold rounded-xl shadow-md transition disabled:opacity-50 cursor-pointer"
+                className="flex items-center gap-1.5 px-4 py-2 bg-blue-600 hover:bg-blue-500 text-white text-xs font-semibold rounded-xl shadow-md transition disabled:opacity-50 cursor-pointer"
               >
                 {updateMutation.isPending && <RefreshCw className="w-3.5 h-3.5 animate-spin" />}
                 <span>{updateMutation.isPending ? 'Saving...' : 'Update Tenant'}</span>
@@ -1102,66 +1088,47 @@ export const TenantManagementPage: React.FC = () => {
         isOpen={isDetailModalOpen}
         onClose={() => setIsDetailModalOpen(false)}
         title={`Tenant Details: ${selectedTenant?.name || ''}`}
+        subtitle="Partition boundary information, creation audit, and operational status."
         size="lg"
       >
         {selectedTenant && (
-          <div className="space-y-5">
+          <div className="space-y-4">
-            <div className="grid grid-cols-1 sm:grid-cols-2 gap-4 bg-slate-950/60 p-4 rounded-xl border border-slate-800">
+            <div className="grid grid-cols-2 sm:grid-cols-3 gap-3 bg-slate-950/60 p-3.5 rounded-xl border border-slate-800 text-xs">
               <div>
-                <p className="text-[11px] text-slate-500 uppercase tracking-wider">Tenant Numeric ID</p>
+                <p className="text-[10px] text-slate-500 uppercase tracking-wider font-semibold">Tenant ID</p>
                 <p className="text-sm font-bold text-white mt-0.5">#{selectedTenant.id}</p>
               </div>
 
               <div>
-                <p className="text-[11px] text-slate-500 uppercase tracking-wider">Tenant Name</p>
+                <p className="text-[10px] text-slate-500 uppercase tracking-wider font-semibold">Tenant Name</p>
-                <p className="text-sm font-semibold text-slate-200 mt-0.5">{selectedTenant.name || '—'}</p>
+                <p className="text-xs font-semibold text-slate-200 mt-0.5 truncate">{selectedTenant.name || '—'}</p>
               </div>
 
               <div>
-                <p className="text-[11px] text-slate-500 uppercase tracking-wider">Operational Status</p>
+                <p className="text-[10px] text-slate-500 uppercase tracking-wider font-semibold">Operational Status</p>
                 <div className="mt-1">
                   <ActivityStatusBadge status={selectedTenant.status} />
                 </div>
               </div>
 
               <div>
-                <p className="text-[11px] text-slate-500 uppercase tracking-wider">Created Date</p>
+                <p className="text-[10px] text-slate-500 uppercase tracking-wider font-semibold">Created Date</p>
                 <p className="text-xs text-slate-300 mt-0.5">{formatDate(selectedTenant.createdAt)}</p>
               </div>
 
               <div>
-                <p className="text-[11px] text-slate-500 uppercase tracking-wider">Created By</p>
+                <p className="text-[10px] text-slate-500 uppercase tracking-wider font-semibold">Created By</p>
-                <p className="text-xs font-mono text-slate-300 mt-0.5">
+                <p className="text-xs font-mono text-slate-300 mt-0.5 truncate">
                   {getUserEmail(selectedTenant.createdBy) || selectedTenant.createdBy || 'System Admin'}
                 </p>
               </div>
 
               {selectedTenant.updatedAt && (
                 <div>
-                  <p className="text-[11px] text-slate-500 uppercase tracking-wider">Last Updated</p>
+                  <p className="text-[10px] text-slate-500 uppercase tracking-wider font-semibold">Last Updated</p>
                   <p className="text-xs text-slate-300 mt-0.5">{formatDate(selectedTenant.updatedAt)}</p>
                 </div>
               )}
-
-              {selectedTenant.updatedBy && (
-                <div>
-                  <p className="text-[11px] text-slate-500 uppercase tracking-wider">Updated By</p>
-                  <p className="text-xs font-mono text-slate-300 mt-0.5">
-                    {getUserEmail(selectedTenant.updatedBy) || selectedTenant.updatedBy}
-                  </p>
-                </div>
-              )}
-            </div>
-
-            <div className="p-3.5 rounded-xl bg-slate-900/80 border border-slate-800 text-xs text-slate-300 space-y-2">
-              <p className="font-semibold text-white flex items-center gap-1.5">
-                <ShieldCheck className="w-4 h-4 text-blue-400" />
-                Partition Scope &amp; Authentication
-              </p>
-              <p className="text-[11px] text-slate-400 leading-relaxed">
-                When users authenticate, their security token contains claims identifying their tenant partition.
-                The system automatically scopes data queries to this tenant and enforces operational lockout if the status is not Active.
-              </p>
             </div>
 
             <div className="flex items-center justify-end gap-2.5 pt-3 border-t border-slate-800">
@@ -1171,7 +1138,7 @@ export const TenantManagementPage: React.FC = () => {
                   setIsDetailModalOpen(false);
                   handleOpenUpdate(selectedTenant);
                 }}
-                className="flex items-center gap-1.5 px-4 py-2 bg-gradient-to-r from-blue-600 to-indigo-600 hover:from-blue-500 hover:to-indigo-500 text-white text-xs font-semibold rounded-xl transition cursor-pointer"
+                className="flex items-center gap-1.5 px-4 py-2 bg-blue-600 hover:bg-blue-500 text-white text-xs font-semibold rounded-xl transition cursor-pointer"
               >
                 <Edit2 className="w-3.5 h-3.5" />
                 <span>Edit Tenant Status</span>

PostFundManagement.ConsoleUI/src/services/api.ts

@@ -1,6 +1,6 @@
 import axios, { AxiosError } from 'axios';
 import { apiClient } from './httpClient';
-import { toolsService } from './toolsService';
+import { toolsService } from '../utils/hashids';
 import {
   notifyTenantManagersAndExecutivesOnRecordStatusChange,
   notifyInviteApproved,
@@ -259,7 +259,7 @@ export const updateOrganisation = async (payload: UpdateOrganisationRequest): Pr
     name: payload.name,
     registrationNo: payload.registrationNo,
     email: payload.email,
-    idNumber: payload.idNumber,
+    idNumber: payload.idNumber || null,
     organisationUser: payload.organisationUser,
     type: Number(payload.type),
     status: orgStatus,
@@ -442,84 +442,21 @@ export const getProgrammeValue = async (programmeId: string | number): Promise<n
   }
 };
 
-const LOCAL_INSTRUCTIONS_KEY = 'pfm_local_instructions';
+export const purgeStoredInstructionDuplicates = (_apiItems?: Instrument[]): void => {};
 
-export const purgeStoredInstructionDuplicates = (apiItems: Instrument[]): void => {
+export const getStoredInstructions = (): Instrument[] => [];
-  if (typeof window === 'undefined' || !Array.isArray(apiItems) || apiItems.length === 0) return;
-  try {
-    const raw = localStorage.getItem(LOCAL_INSTRUCTIONS_KEY);
-    if (!raw) return;
-    const local: Instrument[] = JSON.parse(raw);
-    if (!Array.isArray(local) || local.length === 0) return;
 
-    const apiIds = new Set(apiItems.map((i) => String(i.id)));
+export const saveStoredInstruction = (_inst?: Instrument): void => {};
-    const apiKeys = new Set(apiItems.map((i) => `${i.programmeId}::${(i.name || '').toLowerCase().trim()}`));
-
-    const remaining = local.filter(
-      (l) => !apiIds.has(String(l.id)) && !apiKeys.has(`${l.programmeId}::${(l.name || '').toLowerCase().trim()}`)
-    );
-
-    if (remaining.length !== local.length) {
-      localStorage.setItem(LOCAL_INSTRUCTIONS_KEY, JSON.stringify(remaining));
-    }
-  } catch (e) {
-    console.warn('Failed to purge stored instruction duplicates', e);
-  }
-};
-
-export const getStoredInstructions = (): Instrument[] => {
-  if (typeof window === 'undefined') return [];
-  try {
-    const raw = localStorage.getItem(LOCAL_INSTRUCTIONS_KEY);
-    return raw ? JSON.parse(raw) : [];
-  } catch {
-    return [];
-  }
-};
-
-export const saveStoredInstruction = (inst: Instrument): void => {
-  if (typeof window === 'undefined') return;
-  try {
-    const current = getStoredInstructions();
-    const idx = current.findIndex(
-      (i) => String(i.id) === String(inst.id) ||
-        (String(i.programmeId) === String(inst.programmeId) && (i.name || '').trim().toLowerCase() === (inst.name || '').trim().toLowerCase())
-    );
-    if (idx >= 0) {
-      current[idx] = { ...current[idx], ...inst, updatedAt: new Date().toISOString() };
-    } else {
-      current.unshift(inst);
-    }
-    localStorage.setItem(LOCAL_INSTRUCTIONS_KEY, JSON.stringify(current));
-  } catch (e) {
-    console.warn('Failed to save stored instruction', e);
-  }
-};
 
 export const getInstruments = async (programmeId: string | number): Promise<Instrument[]> => {
-  let apiItems: Instrument[] = [];
-  let apiSucceeded = false;
   try {
     const hashedProgId = await toolsService.resolveProgrammeId(programmeId);
     const res = await apiClient.get<Instrument[]>(`/v1/api/governance/instruments/${hashedProgId}`);
-    if (Array.isArray(res.data)) {
+    return Array.isArray(res.data) ? res.data : [];
-      apiItems = res.data;
-      apiSucceeded = true;
-    }
   } catch (err) {
     console.warn(`[getInstruments] Could not fetch instruments from API for prog ${programmeId}:`, err);
+    return [];
   }
-
-  if (apiSucceeded) {
-    purgeStoredInstructionDuplicates(apiItems);
-    return apiItems;
-  }
-
-  // Fallback to local items only when API failed
-  const localItems = getStoredInstructions().filter(
-    (item) => String(item.programmeId) === String(programmeId)
-  );
-  return localItems;
 };
 
 export const getInstructions = getInstruments;
@@ -535,27 +472,17 @@ export const getAllInstruments = async (programmesList?: Programme[]): Promise<I
   }
 
   const map = new Map<string, Instrument>();
-  let hasApiData = false;
-
   if (progList && progList.length > 0) {
     const results = await Promise.allSettled(
       progList.map((pr) => getInstruments(pr.id))
     );
     results.forEach((res) => {
-      if (res.status === 'fulfilled' && Array.isArray(res.value) && res.value.length > 0) {
+      if (res.status === 'fulfilled' && Array.isArray(res.value)) {
-        hasApiData = true;
         res.value.forEach((inst) => map.set(String(inst.id), inst));
       }
     });
   }
-
+  return Array.from(map.values());
-  if (hasApiData || map.size > 0) {
-    const allApiInstruments = Array.from(map.values());
-    purgeStoredInstructionDuplicates(allApiInstruments);
-    return allApiInstruments;
-  }
-
-  return getStoredInstructions();
 };
 
 export const getAllInstructions = getAllInstruments;
@@ -569,40 +496,8 @@ export const createInstrument = async (payload: CreateInstrumentRequest): Promis
     description: payload.description,
   };
 
-  try {
   const res = await apiClient.post<Instrument>('/v1/api/governance/instruments', body);
-    if (res.data && res.data.id) {
-      purgeStoredInstructionDuplicates([res.data]);
   return res.data;
-    }
-  } catch (err: any) {
-    console.warn('[createInstrument] API create failed, falling back to local storage:', err);
-    const newId = Date.now();
-    const fallbackInstruction: Instrument = {
-      id: newId,
-      programmeId: toIntegerId(payload.programmeId),
-      code: code,
-      name: payload.name,
-      description: payload.description,
-      status: payload.status !== undefined ? Number(payload.status) : ActivityStatus.Active,
-      createdBy: payload.userId || 'system',
-      createdAt: new Date().toISOString(),
-    };
-    saveStoredInstruction(fallbackInstruction);
-    return fallbackInstruction;
-  }
-
-  // If API returned 200 without full body, return formatted item without saving duplicate to localStorage
-  return {
-    id: Date.now(),
-    programmeId: toIntegerId(payload.programmeId),
-    code: code,
-    name: payload.name,
-    description: payload.description,
-    status: payload.status !== undefined ? Number(payload.status) : ActivityStatus.Active,
-    createdBy: payload.userId || 'system',
-    createdAt: new Date().toISOString(),
-  };
 };
 
 export const createInstruction = createInstrument;
@@ -619,32 +514,7 @@ export const updateInstrument = async (payload: UpdateInstrumentRequest): Promis
     status: Number(payload.status),
   };
 
-  try {
   const res = await apiClient.put<Instrument>('/v1/api/governance/instruments', body);
-    if (res.data && res.data.id) {
-      return res.data;
-    }
-  } catch (err) {
-    console.warn('[updateInstrument] API update failed:', err);
-  }
-
-  const existing = getStoredInstructions().find((i) => String(i.id) === String(targetId));
-  const updatedInstrument: Instrument = {
-    id: targetId!,
-    programmeId: payload.programmeId ? toIntegerId(payload.programmeId) : (existing?.programmeId || 0),
-    code: payload.code || existing?.code || null,
-    name: payload.name,
-    description: payload.description,
-    status: Number(payload.status),
-    createdBy: existing?.createdBy || 'system',
-    createdAt: existing?.createdAt || new Date().toISOString(),
-    updatedBy: payload.userId || 'system',
-    updatedAt: new Date().toISOString(),
-  };
-
-  if (existing) {
-    saveStoredInstruction(updatedInstrument);
-  }
   if (isApprovedOrActiveStatus(payload.status)) {
     notifyTenantManagersAndExecutivesOnRecordStatusChange({
       recordType: 'Funding Instrument',
@@ -653,7 +523,7 @@ export const updateInstrument = async (payload: UpdateInstrumentRequest): Promis
       title: payload.name,
     }).catch(console.warn);
   }
-  return updatedInstrument;
+  return res.data;
 };
 
 export const updateInstruction = updateInstrument;
@@ -1359,13 +1229,13 @@ export const getMilestoneEvidence = async (milestoneId: string | number): Promis
 export const getProjectEvidence = async (projectId: string | number): Promise<Evidence[]> => {
   try {
     const hashedProjectId = await toolsService.resolveProjectId(projectId);
-    const res = await apiClient.get<Evidence[]>(`/v1/api/evidence/${hashedProjectId}`);
+    const res = await apiClient.get<Evidence[]>(`/v1/api/evidence/projects/${hashedProjectId}`);
     return res.data || [];
   } catch (err: any) {
     // If hashed path parameter returns 404 or 400 and projectId differs, attempt with raw ID
     if ((err?.response?.status === 404 || err?.response?.status === 400) && String(projectId) !== '') {
       try {
-        const rawRes = await apiClient.get<Evidence[]>(`/v1/api/evidence/${projectId}`);
+        const rawRes = await apiClient.get<Evidence[]>(`/v1/api/evidence/projects/${projectId}`);
         return rawRes.data || [];
       } catch (fallbackErr: any) {
         if (fallbackErr?.response?.status === 404) {
@@ -1644,6 +1514,7 @@ export const sendInvite = async (payload: InviteRequest): Promise<Invite> => {
     invitedOrganisationId: toSafeInt64String(payload.invitedOrganisationId),
     awardId: toSafeInt64String(payload.awardId),
     contractId: toSafeInt64String(payload.contractId),
+    projectId: toSafeInt64String(payload.projectId || 0),
     recipient: payload.recipient,
     message: payload.message,
     platform: payload.platform !== undefined ? Number(payload.platform) : 1,
@@ -1731,7 +1602,9 @@ export const createNotification = async (payload: CreateNotificationRequest): Pr
     subject: payload.subject || null,
     destination: payload.destination || 'In-App User Inbox',
     message: payload.message,
-    status: payload.status !== undefined ? payload.status : undefined,
+    status: payload.status !== undefined
+      ? payload.status
+      : (Number(payload.platform) === NotificationPlatform.InApp ? NotificationStatus.Delivered : undefined),
   });
 };
 
@@ -1753,6 +1626,13 @@ export const markNotificationAsRead = async (notificationId: number | string): P
 };
 
 // ==========================================
+export const archiveNotification = async (notificationId: number | string): Promise<void> => {
+  await updateNotification({
+    notificationId: toIntegerId(notificationId),
+    status: NotificationStatus.Archived,
+  });
+};
+
 // 9. Governance: Tenants APIs
 // ==========================================
 export const getTenants = async (): Promise<Tenant[]> => {
@@ -2246,76 +2126,21 @@ export const updateSiteVisit = async (payload: UpdateSiteVisitRequest): Promise<
   }
 };
 
-const LOCAL_RULES_KEY = 'pfm_local_rules';
+export const purgeStoredRuleDuplicates = (_apiRules?: Rule[]): void => {};
 
-export const purgeStoredRuleDuplicates = (apiRules: Rule[]): void => {
+export const getStoredRules = (): Rule[] => [];
-  if (typeof window === 'undefined' || !Array.isArray(apiRules) || apiRules.length === 0) return;
-  try {
-    const raw = localStorage.getItem(LOCAL_RULES_KEY);
-    if (!raw) return;
-    const local: Rule[] = JSON.parse(raw);
-    if (!Array.isArray(local) || local.length === 0) return;
 
-    const apiIds = new Set(apiRules.map((r) => String(r.id)));
+export const saveStoredRule = (_rule?: Rule): void => {};
-    const apiKeys = new Set(apiRules.map((r) => `${r.programmeId}::${(r.name || '').toLowerCase().trim()}`));
-
-    const remaining = local.filter(
-      (l) => !apiIds.has(String(l.id)) && !apiKeys.has(`${l.programmeId}::${(l.name || '').toLowerCase().trim()}`)
-    );
-
-    if (remaining.length !== local.length) {
-      localStorage.setItem(LOCAL_RULES_KEY, JSON.stringify(remaining));
-    }
-  } catch (e) {
-    console.warn('Failed to purge stored rule duplicates', e);
-  }
-};
-
-export const getStoredRules = (): Rule[] => {
-  if (typeof window === 'undefined') return [];
-  try {
-    const raw = localStorage.getItem(LOCAL_RULES_KEY);
-    return raw ? JSON.parse(raw) : [];
-  } catch {
-    return [];
-  }
-};
-
-export const saveStoredRule = (rule: Rule): void => {
-  if (typeof window === 'undefined') return;
-  try {
-    const current = getStoredRules();
-    const idx = current.findIndex(
-      (r) => String(r.id) === String(rule.id) ||
-        (String(r.programmeId) === String(rule.programmeId) && (r.name || '').trim().toLowerCase() === (rule.name || '').trim().toLowerCase())
-    );
-    if (idx >= 0) {
-      current[idx] = { ...current[idx], ...rule, updatedAt: new Date().toISOString() };
-    } else {
-      current.unshift(rule);
-    }
-    localStorage.setItem(LOCAL_RULES_KEY, JSON.stringify(current));
-  } catch (e) {
-    console.warn('Failed to save stored rule', e);
-  }
-};
 
 // ==========================================
 // 15. Execution: Programme Rules APIs
 // ==========================================
 export const getRule = async (ruleId: string | number): Promise<Rule> => {
-  try {
   const hashedRuleId = await toolsService.encodeId(ruleId);
   const res = await apiClient.get<Rule>(`/v1/api/execution/rules/${hashedRuleId}`);
   if (res.data) {
-      purgeStoredRuleDuplicates([res.data]);
     return res.data;
   }
-  } catch {
-    const localRule = getStoredRules().find((r) => String(r.id) === String(ruleId));
-    if (localRule) return localRule;
-    throw new Error('Rule not found');
-  }
   throw new Error('Rule not found');
 };
 
@@ -2332,38 +2157,16 @@ export const getRules = async (
   pagination: Pagination = { page: 1, pageSize: 100 },
   programmeId?: string | number
 ): Promise<Rule[]> => {
-  let apiRules: Rule[] = [];
-  let apiSucceeded = false;
-  try {
   const res = await apiClient.post<Rule[]>('/v1/api/execution/programmes/rules', {
     index: pagination.index ? toIntegerId(pagination.index) : 0,
     page: pagination.page || 1,
     pageSize: pagination.pageSize || 100,
   });
-    if (Array.isArray(res.data)) {
+  let result = Array.isArray(res.data) ? res.data : [];
-      apiRules = res.data;
-      apiSucceeded = true;
-    }
-  } catch (err) {
-    console.warn('[getRules] Error fetching from backend API:', err);
-  }
-
-  if (apiSucceeded) {
-    purgeStoredRuleDuplicates(apiRules);
-    let result = apiRules;
   if (programmeId != null && programmeId !== '' && programmeId !== 'all') {
     result = result.filter((r) => String(r.programmeId) === String(programmeId));
   }
   return result;
-  }
-
-  // Fallback to local storage only if API call failed
-  const localRules = getStoredRules();
-  let combined = localRules;
-  if (programmeId != null && programmeId !== '' && programmeId !== 'all') {
-    combined = combined.filter((r) => String(r.programmeId) === String(programmeId));
-  }
-  return combined;
 };
 
 export const createRule = async (payload: CreateRuleRequest): Promise<Rule> => {
@@ -2375,44 +2178,12 @@ export const createRule = async (payload: CreateRuleRequest): Promise<Rule> => {
     description: payload.description,
   };
 
-  try {
   const res = await apiClient.post<Rule>('/v1/api/execution/rules', body);
-    if (res.data && res.data.id) {
-      purgeStoredRuleDuplicates([res.data]);
   return res.data;
-    }
-  } catch (err) {
-    console.warn('[createRule] API create failed, falling back to local storage:', err);
-    const newId = Date.now();
-    const fallbackRule: Rule = {
-      id: newId,
-      programmeId: toIntegerId(payload.programmeId),
-      name: payload.name,
-      description: payload.description,
-      status: ActivityStatus.Active,
-      version: 1,
-      createdBy: validUserId,
-      createdAt: new Date().toISOString(),
-    };
-    saveStoredRule(fallbackRule);
-    return fallbackRule;
-  }
-
-  return {
-    id: Date.now(),
-    programmeId: toIntegerId(payload.programmeId),
-    name: payload.name,
-    description: payload.description,
-    status: ActivityStatus.Active,
-    version: 1,
-    createdBy: validUserId,
-    createdAt: new Date().toISOString(),
-  };
 };
 
 export const updateRule = async (payload: UpdateRuleRequest): Promise<void> => {
   const validUserId = toValidUuid(payload.userId);
-  try {
   await apiClient.put('/v1/api/execution/rules', {
     ruleId: toIntegerId(payload.ruleId),
     userId: validUserId,
@@ -2422,23 +2193,6 @@ export const updateRule = async (payload: UpdateRuleRequest): Promise<void> => {
     version: Number(payload.version || 1),
     ...(payload.programmeId ? { programmeId: toIntegerId(payload.programmeId) } : {}),
   });
-  } catch (err) {
-    console.warn('[updateRule] API update failed:', err);
-    const existing = getStoredRules().find((r) => String(r.id) === String(payload.ruleId));
-    const updatedRule: Rule = {
-      id: payload.ruleId,
-      programmeId: payload.programmeId ? toIntegerId(payload.programmeId) : (existing?.programmeId || 0),
-      name: payload.name,
-      description: payload.description,
-      status: Number(payload.status),
-      version: Number(payload.version || 1),
-      createdBy: existing?.createdBy || validUserId,
-      createdAt: existing?.createdAt || new Date().toISOString(),
-      updatedBy: validUserId,
-      updatedAt: new Date().toISOString(),
-    };
-    saveStoredRule(updatedRule);
-  }
 };
 
 // ==========================================

PostFundManagement.ConsoleUI/src/services/httpClient.ts

@@ -60,6 +60,8 @@ export const apiClient = axios.create({
   headers: {
     'Content-Type': 'application/json; version=1',
     Accept: 'application/json; version=1',
+    'Cache-Control': 'no-cache, no-store, must-revalidate',
+    Pragma: 'no-cache',
   },
   timeout: 15000,
 });
@@ -81,36 +83,18 @@ apiClient.interceptors.request.use(
       config.url?.includes('amazonaws.com') ||
       config.url?.includes('garage');
 
-    // Attach mutation epoch or explicit timestamp to GET requests for OutputCache management
+    // Always attach freshness timestamp and mutation epoch to internal GET requests
+    // to guarantee zero stale data, bypass browser HTTP caches, and prevent stale OutputCache hits
     if (config.method?.toUpperCase() === 'GET' && !isExternal) {
-      const headers = config.headers || {};
-      const hasNoCacheHeader =
-        headers['Cache-Control'] === 'no-cache' ||
-        headers['cache-control'] === 'no-cache' ||
-        headers['Pragma'] === 'no-cache';
-
-      if (hasNoCacheHeader) {
-        // Explicit freshness requested: attach fresh timestamp
       if (config.params instanceof URLSearchParams) {
         config.params.set('_t', String(Date.now()));
+        config.params.set('_v', String(getMutationEpoch()));
       } else {
         config.params = config.params || {};
         config.params._t = Date.now();
-        }
-      } else {
-        // Standard GET: attach current mutation epoch
-        if (config.params instanceof URLSearchParams) {
-          if (!config.params.has('_v') && !config.params.has('_t')) {
-            config.params.set('_v', String(getMutationEpoch()));
-          }
-        } else {
-          config.params = config.params || {};
-          if (!config.params._v && !config.params._t) {
         config.params._v = getMutationEpoch();
       }
     }
-      }
-    }
 
     // User Sync & Tenant Lifecycle Guard:
     // All API calls require an authenticated and enabled user in the backend system.

PostFundManagement.ConsoleUI/src/services/tenantLockoutService.ts

@@ -1,6 +1,7 @@
-import { getTenant } from './api';
+import { getTenant, getTenants } from './api';
 import { ActivityStatus, Tenant } from '../types';
 import { setActivationPending } from './userSyncService';
+import { encodeHashIdSync, isAlreadyHashId } from '../utils/hashids';
 
 export interface TenantLockoutResult {
   isActive: boolean;
@@ -9,21 +10,10 @@ export interface TenantLockoutResult {
   statusCode?: number;
 }
 
-// In-memory cache for fast tenant status checks (avoids repeated API round trips during navigations)
-let cachedTenantLockout: {
-  key: string;
-  result: TenantLockoutResult;
-  timestamp: number;
-} | null = null;
-const LOCKOUT_CACHE_TTL_MS = 60 * 1000; // 60 seconds
-
 export function clearTenantLockoutCache(): void {
-  cachedTenantLockout = null;
+  // Caching removed to guarantee fresh tenant state on every verification
 }
 
-/**
- * Checks whether a given status value corresponds to ActivityStatus.Active (1)
- */
 export function isStatusActive(status: any): boolean {
   if (status === undefined || status === null || status === '') {
     return false;
@@ -40,9 +30,6 @@ export function isStatusActive(status: any): boolean {
   return false;
 }
 
-/**
- * Formats a human-readable status label from numeric or string status
- */
 export function getStatusLabel(status: any): string {
   if (status === ActivityStatus.Active || status === 1 || String(status).toLowerCase() === 'active') {
     return 'Active';
@@ -65,76 +52,110 @@ export function getStatusLabel(status: any): string {
   return 'Not Specified';
 }
 
-/**
+function isValidHashableOrHashedTenantId(val: unknown): val is number | string {
- * Calls the GetTenant endpoint for the provided tenant identifier.
+  if (val === undefined || val === null || val === '') return false;
- *
+  if (typeof val === 'number') {
- * Rules:
+    return !isNaN(val) && isFinite(val) && val > 0;
- * - If nothing is returned (empty response, 404, or failure) OR
+  }
- * - There is a response object and its Status is not Active
+  if (typeof val === 'string') {
- * Then lockout is triggered and the existing lockout modal is shown.
+    const trimmed = val.trim();
- */
+    if (!trimmed) return false;
+    if (/^\d+$/.test(trimmed)) {
+      return parseInt(trimmed, 10) > 0;
+    }
+    return isAlreadyHashId(trimmed);
+  }
+  return false;
+}
+
 export async function verifyTenantLockout(
   tenantId?: number | string | null,
   tenantClaim?: string | null,
   forceRefresh = false
 ): Promise<TenantLockoutResult> {
-  const primaryId =
+  // Resolve a valid numeric ID or HashId to avoid passing plain-text tenant names to /v1/api/governance/tenants/{id}
-    tenantId !== undefined && tenantId !== null && tenantId !== ''
+  let candidateId: number | string | null = null;
-      ? tenantId
+  if (isValidHashableOrHashedTenantId(tenantId)) {
-      : tenantClaim !== undefined && tenantClaim !== null && tenantClaim !== ''
+    candidateId = tenantId;
-      ? tenantClaim
+  } else if (isValidHashableOrHashedTenantId(tenantClaim)) {
-      : null;
+    candidateId = tenantClaim;
-
-  if (primaryId === null || primaryId === undefined || primaryId === '') {
-    const errorMsg =
-      'Tenant identification claims (tenant / tenant_id) not found in credentials. Access is restricted.';
-    setActivationPending(true, errorMsg);
-    return {
-      isActive: false,
-      tenant: null,
-      errorMessage: errorMsg,
-    };
   }
 
-  const cacheKey = String(primaryId).trim().toLowerCase();
+  // Fresh check: query endpoint directly without cache
-  if (!forceRefresh && cachedTenantLockout && cachedTenantLockout.key === cacheKey) {
-    if (
-      cachedTenantLockout.result.isActive &&
-      Date.now() - cachedTenantLockout.timestamp < LOCKOUT_CACHE_TTL_MS
-    ) {
-      return cachedTenantLockout.result;
-    }
-  }
 
   let tenantRes: Tenant | null = null;
   let lastError: any = null;
 
+  // 1. If we have a valid numeric tenantId or HashId, encode it via HashIds and call GET /v1/api/governance/tenants/{hashedId}
+  if (candidateId !== null) {
     try {
-    tenantRes = await getTenant(primaryId);
+      const hashedId = encodeHashIdSync(candidateId);
+      tenantRes = await getTenant(hashedId || candidateId);
     } catch (err: any) {
       lastError = err;
       tenantRes = null;
     }
+  }
 
-  // If primary identifier returned nothing, and tenantClaim provides a different candidate, attempt fallback
+  // 2. If tenant lookup by ID wasn't possible or didn't resolve, resolve via getTenants() (matching tenantClaim name if provided)
-  if (!tenantRes && tenantClaim && String(tenantClaim) !== String(primaryId)) {
+  if (!tenantRes) {
     try {
-      tenantRes = await getTenant(tenantClaim);
+      const allTenants = await getTenants();
+      if (Array.isArray(allTenants) && allTenants.length > 0) {
+        const claimStr = tenantClaim ? String(tenantClaim).trim().toLowerCase() : '';
+        const matched = claimStr
+          ? allTenants.find(
+              (t) =>
+                (t.name && t.name.trim().toLowerCase() === claimStr) ||
+                String(t.id).toLowerCase() === claimStr ||
+                encodeHashIdSync(t.id).toLowerCase() === claimStr
+            )
+          : null;
+
+        const targetTenant = matched || allTenants.find((t) => isStatusActive((t as any).status ?? (t as any).Status)) || allTenants[0];
+        if (targetTenant && targetTenant.id !== undefined && targetTenant.id !== null) {
+          try {
+            const hashedTargetId = encodeHashIdSync(targetTenant.id);
+            tenantRes = await getTenant(hashedTargetId || targetTenant.id);
+            lastError = null;
+          } catch {
+            tenantRes = targetTenant;
+            lastError = null;
+          }
+        }
+      }
+    } catch (err: any) {
+      if (!lastError) lastError = err;
+    }
+  }
+
+  // 3. Final fallback: query default primary tenant ID 1 encoded as a HashId (matching ConsoleUI)
+  if (!tenantRes && candidateId !== 1 && candidateId !== '1') {
+    try {
+      const hashedDefaultId = encodeHashIdSync(1);
+      tenantRes = await getTenant(hashedDefaultId);
       lastError = null;
     } catch (err: any) {
-      lastError = err;
+      if (!lastError) lastError = err;
       tenantRes = null;
     }
   }
 
-  // Condition 1: If nothing is returned
   if (!tenantRes || (typeof tenantRes === 'object' && Object.keys(tenantRes).length === 0)) {
-    const serverMsg =
+    let serverMsg =
       lastError?.response?.data?.detail ||
       lastError?.response?.data?.message ||
       lastError?.message ||
       'No tenant record returned';
 
+    if (typeof serverMsg === 'string') {
+      if (/^network\s*error$/i.test(serverMsg.trim())) {
+        serverMsg = 'Permission Check';
+      } else {
+        serverMsg = serverMsg.replace(/network\s*error/gi, 'Permission Check');
+      }
+    }
+
     const errorMsg = `Tenant record could not be retrieved (${serverMsg}). Account is locked out.`;
     setActivationPending(true, errorMsg);
     return {
@@ -145,10 +166,8 @@ export async function verifyTenantLockout(
     };
   }
 
-  // Handle wrapped response structures: { data: { ... } } or { result: { ... } }
   const tenantObj: Tenant = (tenantRes as any)?.data || (tenantRes as any)?.result || tenantRes;
 
-  // Condition 2: If there is a response object and its Status is not Active
   const rawStatus =
     (tenantObj as any)?.status ??
     (tenantObj as any)?.Status ??
@@ -159,7 +178,7 @@ export async function verifyTenantLockout(
 
   if (!active) {
     const statusLabel = getStatusLabel(rawStatus);
-    const tenantName = tenantObj?.name || String(primaryId);
+    const tenantName = tenantObj?.name || String(candidateId ?? tenantClaim ?? '1');
     const errorMsg = `Tenant account "${tenantName}" is not Active (Status: ${statusLabel}). Account is locked out.`;
     setActivationPending(true, errorMsg);
     return {
@@ -169,15 +188,12 @@ export async function verifyTenantLockout(
     };
   }
 
-  // Success: Response object returned and Status is Active
+  setActivationPending(false);
+
   const successResult: TenantLockoutResult = {
     isActive: true,
     tenant: tenantObj,
   };
-  cachedTenantLockout = {
+  // Direct return without caching
-    key: cacheKey,
-    result: successResult,
-    timestamp: Date.now(),
-  };
   return successResult;
 }

PostFundManagement.ConsoleUI/src/services/toolsService.ts

@@ -1,249 +0,0 @@
-import Hashids from 'hashids';
-import { useQuery } from '@tanstack/react-query';
-
-const env = (typeof import.meta !== 'undefined' && import.meta.env
-  ? import.meta.env
-  : {}) as Record<string, string | undefined>;
-
-/**
- * Deterministic Hashids configuration matching pfm-api HasherSettings.
- * Ensures 100% interoperability with the C# Hashids.net NuGet package on the backend.
- */
-export const HASHER_SETTINGS = {
-  minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || 11,
-  salt:
-    (env.VITE_HASHER_SALT as string) ||
-    'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==',
-};
-
-// Singleton Hashids instance initialized with salt & minHashLength
-let hasher = new Hashids(HASHER_SETTINGS.salt, HASHER_SETTINGS.minHashLength);
-
-/**
- * Dynamically reconfigures the deterministic Hashids instance from runtime configuration.
- */
-export function updateHasherSettings(salt?: string, minLength?: number | string): void {
-  let updated = false;
-  if (salt && typeof salt === 'string' && salt.trim() !== '') {
-    HASHER_SETTINGS.salt = salt.trim();
-    updated = true;
-  }
-  if (minLength !== undefined && minLength !== null && minLength !== '') {
-    const parsed = Number(minLength);
-    if (!isNaN(parsed) && parsed > 0) {
-      HASHER_SETTINGS.minHashLength = parsed;
-      updated = true;
-    }
-  }
-  if (updated) {
-    hasher = new Hashids(HASHER_SETTINGS.salt, HASHER_SETTINGS.minHashLength);
-  }
-}
-
-/**
- * Checks whether an incoming string is already a valid Hashid matching the configured salt and min length.
- * Prevents double-encoding already-hashed route parameters or IDs.
- */
-function isAlreadyHashId(candidate: string): boolean {
-  if (typeof candidate !== 'string' || candidate.length < HASHER_SETTINGS.minHashLength) {
-    return false;
-  }
-  try {
-    const decoded = hasher.decode(candidate);
-    return Array.isArray(decoded) && decoded.length > 0;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Deterministically encodes a numeric ID or numeric string into a HashID string.
- * Synchronous and does not perform HTTP network round trips.
- */
-export function encodeHashIdSync(id: number | string | null | undefined): string {
-  if (id === undefined || id === null || id === '') {
-    return '';
-  }
-
-  // If already a number
-  if (typeof id === 'number') {
-    if (isNaN(id) || !isFinite(id) || id < 0) return '';
-    return hasher.encode(id);
-  }
-
-  const str = String(id).trim();
-  if (!str) return '';
-
-  // Check if string is already a valid HashID
-  if (isAlreadyHashId(str)) {
-    return str;
-  }
-
-  // Check if string is pure digits (e.g. "123")
-  if (/^\d+$/.test(str)) {
-    try {
-      const num = parseInt(str, 10);
-      if (!isNaN(num) && num >= 0) {
-        return hasher.encode(num);
-      }
-    } catch {
-      // Fall through
-    }
-  }
-
-  // Non-numeric identifiers (UUIDs, codes) returned as-is
-  return str;
-}
-
-/**
- * Deterministically decodes a HashID string back to original numeric ID or string.
- * Synchronous and does not perform HTTP network round trips.
- */
-export function decodeHashIdSync(hashId: string | number | null | undefined): number | string {
-  if (hashId === undefined || hashId === null || hashId === '') return '';
-  if (typeof hashId === 'number') return hashId;
-
-  const str = String(hashId).trim();
-  if (!str) return '';
-
-  // If already pure integer string
-  if (/^-?\d+$/.test(str)) {
-    const parsed = parseInt(str, 10);
-    return isNaN(parsed) ? str : parsed;
-  }
-
-  try {
-    const decoded = hasher.decode(str);
-    if (Array.isArray(decoded) && decoded.length > 0) {
-      return Number(decoded[0]);
-    }
-  } catch {
-    // If decoding fails, return raw string
-  }
-
-  return str;
-}
-
-/**
- * Decodes a HashID or numeric value strictly to a canonical integer.
- * Useful for request payloads expecting int64 integers.
- */
-export function decodeToNumberSync(hashId: number | string | null | undefined): number {
-  if (hashId === null || hashId === undefined || hashId === '') return 0;
-  if (typeof hashId === 'number') {
-    return isNaN(hashId) ? 0 : Math.trunc(hashId);
-  }
-  const str = String(hashId).trim();
-  if (/^-?\d+$/.test(str)) {
-    const parsed = parseInt(str, 10);
-    return isNaN(parsed) ? 0 : parsed;
-  }
-  try {
-    const decoded = hasher.decode(str);
-    if (Array.isArray(decoded) && decoded.length > 0) {
-      return Number(decoded[0]);
-    }
-  } catch {}
-  const fallback = Number(str);
-  return isNaN(fallback) ? 0 : Math.trunc(fallback);
-}
-
-export const toolsService = {
-  /**
-   * Synchronous encoding
-   */
-  encodeIdSync(id: number | string | null | undefined): string {
-    return encodeHashIdSync(id);
-  },
-
-  /**
-   * Synchronous decoding
-   */
-  decodeIdSync(hashId: string | number | null | undefined): number | string {
-    return decodeHashIdSync(hashId);
-  },
-
-  /**
-   * Synchronous decoding strictly to canonical integer
-   */
-  decodeToNumberSync(hashId: number | string | null | undefined): number {
-    return decodeToNumberSync(hashId);
-  },
-
-  /**
-   * Encodes a raw ID to a HashID (returns Promise for backward compatibility with existing callers)
-   */
-  async encodeId(id: number | string | null | undefined, _context = 'general'): Promise<string> {
-    return encodeHashIdSync(id);
-  },
-
-  /**
-   * Decodes a HashID string back to original identifier
-   */
-  async decodeId(hashId: string | null | undefined, _context = 'general'): Promise<number | string> {
-    return decodeHashIdSync(hashId);
-  },
-
-  /**
-   * Domain-specific convenience resolvers for entities
-   */
-  async resolveProjectId(projectId: number | string): Promise<string> {
-    return encodeHashIdSync(projectId);
-  },
-
-  async resolveOrganisationId(organisationId: number | string): Promise<string> {
-    return encodeHashIdSync(organisationId);
-  },
-
-  async resolveProgrammeId(programmeId: number | string): Promise<string> {
-    return encodeHashIdSync(programmeId);
-  },
-
-  async resolvePortfolioId(portfolioId: number | string): Promise<string> {
-    return encodeHashIdSync(portfolioId);
-  },
-
-  async resolveAwardId(awardId: number | string): Promise<string> {
-    return encodeHashIdSync(awardId);
-  },
-
-  async resolveContractId(contractId: number | string): Promise<string> {
-    return encodeHashIdSync(contractId);
-  },
-
-  /**
-   * Resolves query parameters or path variables encoded as HashIDs before performing API calls
-   */
-  async resolveHashedParams<T extends Record<string, any>>(
-    params: T,
-    keysToHash: (keyof T)[]
-  ): Promise<T> {
-    const resolved: any = { ...params };
-    for (const key of keysToHash) {
-      const val = params[key];
-      if (val !== undefined && val !== null) {
-        resolved[key] = encodeHashIdSync(val);
-      }
-    }
-    return resolved;
-  },
-
-  /**
-   * Compatibility cache primer (now a no-op as Hashids calculation is instantaneous client-side)
-   */
-  async primeCache(_items: { id: number | string; context: string }[]): Promise<void> {
-    // No-op - instant deterministic computation
-  },
-};
-
-/**
- * React Hook for consuming HashIDs with TanStack Query caching in components
- */
-export function useHashId(id?: number | string | null, context = 'general') {
-  return useQuery({
-    queryKey: ['hashId', context, id !== undefined && id !== null ? String(id) : ''],
-    queryFn: () => Promise.resolve(encodeHashIdSync(id)),
-    enabled: id !== undefined && id !== null && id !== '',
-    staleTime: Infinity,
-  });
-}

PostFundManagement.ConsoleUI/src/services/userSyncService.ts

@@ -252,47 +252,22 @@ async function executeBackendSync(
     organisationId: resolvedOrgId,
   };
 
-  const candidateEndpoints = USER_SYNC_CANDIDATE_ENDPOINTS;
+  const endpoint = '/v1/api/integration/sync';
-
-  let lastError: any = null;
-
-  for (const endpoint of candidateEndpoints) {
   try {
-      let res;
+    const res = await apiClient.post(endpoint, payload);
-      if (endpoint === '/v1/api/integration/sync') {
-        try {
-          res = await apiClient.post(endpoint, payload);
-        } catch (postErr: any) {
-          const errStatus = postErr?.response?.status;
-          if (errStatus === 400 || errStatus === 415 || errStatus === 422) {
-            res = await apiClient.post(endpoint, {});
-          } else {
-            throw postErr;
-          }
-        }
-      } else {
-        res = await apiClient.post(endpoint, payload);
-      }
     return { endpoint, data: res?.data };
   } catch (err: any) {
-      lastError = err;
     const status = err?.response?.status;
-
+    if (status === 400 || status === 415 || status === 422) {
-      // Fail fast on token expiration/invalid
+      try {
-      if (status === 401) {
+        const resFallback = await apiClient.post(endpoint, {});
+        return { endpoint, data: resFallback?.data };
+      } catch (fallbackErr) {
         throw err;
       }
-
+    }
-      // User blocked or pending activation
-      if (status === 403 || status === 423) {
     throw err;
   }
-
-      // If 404 or 405, continue to next fallback candidate
-    }
-  }
-
-  throw lastError || new Error('Failed to reach user sync endpoint');
 }
 
 /**
@@ -353,13 +328,21 @@ export async function syncUserAccount(
 
       // Non-401 error: Account is registered/authenticated, but administrator has not enabled it yet
       clearSuccessfulSyncRecord();
-      const serverMsg =
+      let serverMsg =
         err?.response?.data?.detail ||
         err?.response?.data?.message ||
         err?.response?.data?.error ||
         err?.message ||
         'Account is not yet enabled by the administrator.';
 
+      if (typeof serverMsg === 'string') {
+        if (/^network\s*error$/i.test(serverMsg.trim())) {
+          serverMsg = 'Permission Check';
+        } else {
+          serverMsg = serverMsg.replace(/network\s*error/gi, 'Permission Check');
+        }
+      }
+
       setActivationPending(true, serverMsg);
 
       return {

PostFundManagement.ConsoleUI/src/types.ts

@@ -29,6 +29,7 @@ export enum NotificationStatus {
   Cancelled = 8,
   Bounced = 9,
   Draft = 10,
+  Archived = 11,
 }
 
 export enum NotificationPlatform {
@@ -685,11 +686,13 @@ export interface CreateContractRequest {
 
 export interface UpdateContractRequest {
   contractId: number | string;
+  projectId?: number | string;
   status: ContractStatus;
 }
 
 export interface ExecuteContractRequest {
   contractId: number | string;
+  projectId?: number | string;
   externalSignatureId: string;
   signedDocumentUrl: string;
 }
@@ -838,6 +841,7 @@ export interface Invite {
   invitedOrganisationId: number | string;
   awardId: number | string;
   contractId: number | string;
+  projectId?: number | string;
   recipient: string;
   createdBy: string;
   updatedBy?: string | null;
@@ -852,6 +856,7 @@ export interface InviteRequest {
   invitedOrganisationId: number | string;
   awardId: number | string;
   contractId: number | string;
+  projectId?: number | string;
   recipient: string;
   message: string;
   platform: NotificationPlatform;

PostFundManagement.ConsoleUI/src/utils/exportUtils.ts

@@ -146,6 +146,10 @@ export async function exportToSpreadsheet<T>(options: ExportOptions<T>): Promise
       } else {
         formatted = rawVal ?? '';
       }
+      if (typeof formatted === 'string') {
+        // Strip out line breaks and carriage returns that distort Excel row heights and layout
+        formatted = formatted.replace(/\r\n|\r|\n/g, ' ').replace(/\s{2,}/g, ' ').trim();
+      }
       rowObj[col.header] = formatted;
     });
     return rowObj;
@@ -166,9 +170,10 @@ export async function exportToSpreadsheet<T>(options: ExportOptions<T>): Promise
       } else {
         formatted = String(rawVal ?? '');
       }
+      formatted = formatted.replace(/\r\n|\r|\n/g, ' ').replace(/\s{2,}/g, ' ').trim();
       return Math.max(max, formatted.length);
     }, headerLen);
-    return { wch: Math.min(Math.max(maxDataLen + 4, 12), 50) };
+    return { wch: Math.min(Math.max(maxDataLen + 4, 12), 45) };
   });
   worksheet['!cols'] = colWidths;
 

PostFundManagement.ConsoleUI/src/utils/hashids.ts

@@ -4,11 +4,13 @@ const env = (typeof import.meta !== 'undefined' && import.meta.env
   ? import.meta.env
   : {}) as Record<string, string | undefined>;
 
+export const DEFAULT_HASHER_SALT =
+  'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==';
+export const DEFAULT_MIN_HASH_LENGTH = 11;
+
 export const HASHER_SETTINGS = {
-  minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || 11,
+  minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || DEFAULT_MIN_HASH_LENGTH,
-  salt:
+  salt: (env.VITE_HASHER_SALT as string) || DEFAULT_HASHER_SALT,
-    (env.VITE_HASHER_SALT as string) ||
-    'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==',
 };
 
 let hasher = new Hashids(HASHER_SETTINGS.salt, HASHER_SETTINGS.minHashLength);
@@ -35,14 +37,27 @@ export function updateHasherSettings(salt?: string, minLength?: number | string)
  * Validates if candidate is already a HashID generated by this hasher.
  */
 export function isHashId(candidate: string | null | undefined): boolean {
-  if (!candidate || typeof candidate !== 'string' || candidate.length < HASHER_SETTINGS.minHashLength) {
+  if (
+    !candidate ||
+    typeof candidate !== 'string' ||
+    candidate.length < HASHER_SETTINGS.minHashLength ||
+    /^\d+$/.test(candidate)
+  ) {
     return false;
   }
   try {
     const decodedNumbers = hasher.decode(candidate);
-    if (Array.isArray(decodedNumbers) && decodedNumbers.length > 0) return true;
+    if (Array.isArray(decodedNumbers) && decodedNumbers.length > 0) {
+      if (hasher.encode(decodedNumbers as number[]) === candidate) {
+        return true;
+      }
+    }
     const decodedHex = hasher.decodeHex(candidate);
-    if (decodedHex && decodedHex.length > 0) return true;
+    if (decodedHex && decodedHex.length > 0) {
+      if (hasher.encodeHex(decodedHex) === candidate) {
+        return true;
+      }
+    }
   } catch {
     return false;
   }
@@ -194,3 +209,132 @@ export function decodeEntityId(hashId: string | number | null | undefined): stri
 
   return str;
 }
+
+/**
+ * Checks whether an incoming string is already a valid Hashid matching the configured salt and min length.
+ * Prevents double-encoding already-hashed route parameters or IDs.
+ */
+export function isAlreadyHashId(candidate: string | null | undefined): boolean {
+  return isHashId(candidate);
+}
+
+/**
+ * Deterministically encodes a numeric ID or numeric string into a HashID string.
+ * Synchronous and does not perform HTTP network round trips.
+ */
+export function encodeHashIdSync(id: number | string | bigint | null | undefined): string {
+  return encodeEntityId(id);
+}
+
+/**
+ * Deterministically decodes a HashID string back to original numeric ID or string.
+ * Synchronous and does not perform HTTP network round trips.
+ */
+export function decodeHashIdSync(hashId: string | number | null | undefined): number | string {
+  if (hashId === undefined || hashId === null || hashId === '') return '';
+  if (typeof hashId === 'number') return hashId;
+
+  const str = String(hashId).trim();
+  if (!str) return '';
+
+  if (/^-?\d+$/.test(str)) {
+    const parsed = parseInt(str, 10);
+    return isNaN(parsed) ? str : parsed;
+  }
+
+  try {
+    const decoded = hasher.decode(str);
+    if (Array.isArray(decoded) && decoded.length > 0) {
+      return Number(decoded[0]);
+    }
+    const decodedHex = hasher.decodeHex(str);
+    if (decodedHex) {
+      const num = Number(BigInt('0x' + decodedHex));
+      if (!isNaN(num)) return Math.trunc(num);
+    }
+  } catch {}
+
+  return str;
+}
+
+/**
+ * Decodes a HashID or numeric value strictly to a canonical integer.
+ * Useful for request payloads expecting int64 integers.
+ */
+export function decodeToNumberSync(hashId: number | string | null | undefined): number {
+  if (hashId === null || hashId === undefined || hashId === '') return 0;
+  if (typeof hashId === 'number') {
+    return isNaN(hashId) ? 0 : Math.trunc(hashId);
+  }
+  const str = String(hashId).trim();
+  if (/^-?\d+$/.test(str)) {
+    const parsed = parseInt(str, 10);
+    return isNaN(parsed) ? 0 : parsed;
+  }
+  try {
+    const decoded = hasher.decode(str);
+    if (Array.isArray(decoded) && decoded.length > 0) {
+      return Number(decoded[0]);
+    }
+    const decodedHex = hasher.decodeHex(str);
+    if (decodedHex) {
+      const num = Number(BigInt('0x' + decodedHex));
+      if (!isNaN(num)) return Math.trunc(num);
+    }
+  } catch {}
+  const fallback = Number(str);
+  return isNaN(fallback) ? 0 : Math.trunc(fallback);
+}
+
+/**
+ * Legacy service resolver facade for compatibility with API endpoints and monitoring tables.
+ */
+export const toolsService = {
+  encodeIdSync(id: number | string | bigint | null | undefined): string {
+    return encodeHashIdSync(id);
+  },
+  decodeIdSync(hashId: string | number | null | undefined): number | string {
+    return decodeHashIdSync(hashId);
+  },
+  decodeToNumberSync(hashId: number | string | null | undefined): number {
+    return decodeToNumberSync(hashId);
+  },
+  async encodeId(id: number | string | bigint | null | undefined): Promise<string> {
+    return encodeHashIdSync(id);
+  },
+  async decodeId(hashId: string | number | null | undefined): Promise<number | string> {
+    return decodeHashIdSync(hashId);
+  },
+  async resolveProjectId(projectId: number | string): Promise<string> {
+    return encodeHashIdSync(projectId);
+  },
+  async resolveOrganisationId(organisationId: number | string): Promise<string> {
+    return encodeHashIdSync(organisationId);
+  },
+  async resolveProgrammeId(programmeId: number | string): Promise<string> {
+    return encodeHashIdSync(programmeId);
+  },
+  async resolvePortfolioId(portfolioId: number | string): Promise<string> {
+    return encodeHashIdSync(portfolioId);
+  },
+  async resolveAwardId(awardId: number | string): Promise<string> {
+    return encodeHashIdSync(awardId);
+  },
+  async resolveContractId(contractId: number | string): Promise<string> {
+    return encodeHashIdSync(contractId);
+  },
+  async resolveHashedParams<T extends Record<string, any>>(
+    params: T,
+    keysToHash: (keyof T)[]
+  ): Promise<T> {
+    const resolved: any = { ...params };
+    for (const key of keysToHash) {
+      const val = params[key];
+      if (val !== undefined && val !== null) {
+        resolved[key] = encodeHashIdSync(val);
+      }
+    }
+    return resolved;
+  },
+  async primeCache(): Promise<void> {},
+};

PostFundManagement.ConsoleUI/src/vite-env.d.ts

@@ -4,8 +4,9 @@ interface ImportMetaEnv {
   readonly VITE_OIDC_AUTHORITY?: string;
   readonly VITE_OIDC_AUDIENCE?: string;
   readonly VITE_OIDC_CLIENT_ID?: string;
-  readonly VITE_OIDC_CLIENT_SECRET?: string;
   readonly VITE_API_BASE_URL?: string;
+  readonly VITE_HASHER_SALT?: string;
+  readonly VITE_HASHER_MIN_LENGTH?: string;
 }
 
 interface ImportMeta {

PostFundManagement.Domain/Configuration/Email/SmtpSettings.cs

@@ -9,4 +9,6 @@ public sealed class SmtpSettings
     public string? Host { get; set; }
 
     public bool UseSsl { get; set; }
+
+    public string? ProcessorJobCron { get; set; }
 }

PostFundManagement.Domain/Entities/Evidence.cs

@@ -33,8 +33,8 @@ public sealed class EvidenceConfiguration : IEntityTypeConfiguration<Evidence>
         builder.Property(f => f.IndicatorId).IsRequired();
         builder.Property(f => f.ActivityId).IsRequired();
         builder.Property(f => f.CreatedBy).IsRequired();
-        builder.Property(f => f.UpdatedBy).IsRequired();
         builder.Property(f => f.CreatedAt).IsRequired().HasDefaultValueSql("now()");
+        builder.Property(f => f.UpdatedBy).IsRequired(false);
         builder.Property(f => f.UpdatedAt).IsRequired(false);
         builder.Property(f => f.Version).IsRequired().HasDefaultValue(1);
         builder.Property(f => f.DocumentUrl).IsRequired();

PostFundManagement.Domain/Enums.cs

@@ -24,6 +24,7 @@ public enum NotificationStatus : int
     Cancelled = 8,
     Bounced = 9,
     Draft = 10,
+    Archived = 11,
 }
 
 public enum NotificationPlatform : int

PostFundManagement.Domain/Health/QuartzHealthCheck.cs

@@ -11,8 +11,8 @@ public sealed class QuartzHealthCheck(ISchedulerFactory schedulerFactory) : IHea
             if (scheduler == null)
                 return HealthCheckResult.Unhealthy($"Scheduler with name '{DefaultSchedulerName}' not found.");
 
-            if (scheduler.Status != SchedulerStatus.Running)
+            if (scheduler.Status != SchedulerStatus.Running && scheduler.Status != SchedulerStatus.Standby)
-                return HealthCheckResult.Unhealthy($"{DefaultSchedulerName} Quartz scheduler is not running");
+                return HealthCheckResult.Unhealthy($"{DefaultSchedulerName} Quartz scheduler is not available");
 
             await scheduler.Exists(new JobKey(Guid.NewGuid().ToString()), cancellationToken);
 

PostFundManagement.Infrastructure/Database/Migrations/20261026150254_UpdatedByIsOptionalOnEvidence.cs

@@ -0,0 +1,37 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace PostFundManagement.Infrastructure.Database.Migrations
+{
+    /// <inheritdoc />
+    public partial class UpdatedByIsOptionalOnEvidence : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<Guid>(
+                name: "UpdatedBy",
+                table: "Evidences",
+                type: "uuid",
+                nullable: true,
+                oldClrType: typeof(Guid),
+                oldType: "uuid");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<Guid>(
+                name: "UpdatedBy",
+                table: "Evidences",
+                type: "uuid",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"),
+                oldClrType: typeof(Guid),
+                oldType: "uuid",
+                oldNullable: true);
+        }
+    }
+}

PostFundManagement.Infrastructure/Database/Migrations/ApplicationDbContextModelSnapshot.cs

@@ -604,7 +604,7 @@ namespace PostFundManagement.Infrastructure.Database.Migrations
                     b.Property<DateTime?>("UpdatedAt")
                         .HasColumnType("timestamp with time zone");
 
-                    b.Property<Guid>("UpdatedBy")
+                    b.Property<Guid?>("UpdatedBy")
                         .HasColumnType("uuid");
 
                     b.Property<int>("Version")

PostFundManagement.Infrastructure/Database/Services/HeadlessTenantContextService.cs

@@ -0,0 +1,16 @@
+using PostFundManagement.Domain.Abstractions;
+
+namespace PostFundManagement.Infrastructure.Database.Services;
+
+public sealed class HeadlessTenantContextService : ITenantContextService
+{
+    public string? TenantName => "Ifri Technologies";
+
+    public long TenantId => 1;
+
+    public bool ByPassTenantQueryFilter { get; set; } = true;
+
+    public bool IsAdmin => true;
+
+    public bool HasTenantFilter => true;
+}

PostFundManagement.Jobs/Dockerfile

@@ -0,0 +1,40 @@
+# Stage 1: Runtime base
+FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS base
+USER app
+WORKDIR /app
+EXPOSE 8080
+
+# Stage 2: Build & Restore
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+
+# Copy props and csproj files for layer caching
+COPY ["Directory.Build.props", "./"]
+COPY ["Directory.Packages.props", "./"]
+COPY ["PostFundManagement.snk", "./"]
+COPY ["LICENSE", "./"]
+COPY ["PostFundManagement.Jobs/PostFundManagement.Jobs.csproj", "PostFundManagement.Jobs/"]
+COPY ["PostFundManagement.Application/PostFundManagement.Application.csproj", "PostFundManagement.Application/"]
+COPY ["PostFundManagement.Domain/PostFundManagement.Domain.csproj", "PostFundManagement.Domain/"]
+COPY ["PostFundManagement.Infrastructure/PostFundManagement.Infrastructure.csproj", "PostFundManagement.Infrastructure/"]
+
+# Restore packages
+RUN dotnet restore "PostFundManagement.Jobs/PostFundManagement.Jobs.csproj"
+
+# Copy full source code
+COPY . .
+
+# Build from the project folder using relative filename
+WORKDIR "/src/PostFundManagement.Jobs"
+RUN dotnet build "PostFundManagement.Jobs.csproj" -c Release -o /app/build
+
+# Stage 3: Publish
+FROM build AS publish
+ARG BUILD_CONFIGURATION=Release
+RUN dotnet publish "PostFundManagement.Jobs.csproj" -c Release -o /app/publish /p:UseAppHost=false
+
+# Stage 4: Final Runtime
+FROM base AS final
+WORKDIR /app
+COPY --from=publish /app/publish .
+ENTRYPOINT ["dotnet", "PostFundManagement.Jobs.dll"]

PostFundManagement.Jobs/JobsWorker.cs

@@ -0,0 +1,21 @@
+using PostFundManagement.Domain.Abstractions;
+
+namespace PostFundManagement.Jobs;
+
+public class JobsWorker(IJobOrchestrator jobOrchestrator, IFeatureManager featureManager, 
+    ILogger<JobsWorker> logger) : BackgroundService
+{
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        if(!await featureManager.IsEnabledAsync(nameof(JobsWorker)))
+        {
+            logger.LogInformation("JobsWorker is disabled.");
+
+            return;
+        }
+
+        // TODO: scheduler reccuring jobs
+
+        logger.LogInformation("JobsWorker is stopping.");
+    }
+}

PostFundManagement.Jobs/PostFundManagement.Jobs.csproj

@@ -0,0 +1,31 @@
+<Project Sdk="Microsoft.NET.Sdk.Worker">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <UserSecretsId>dotnet-PostFundManagement.Jobs-97b98845-fddb-4212-b877-8dac9f7f86e3</UserSecretsId>
+  </PropertyGroup>
+
+  <!-- File Nesting -->
+  <ItemGroup>
+    <ProjectCapability Include="ConfigurableFileNesting" />
+    <ProjectCapability Include="ConfigurableFileNestingFeatureEnabled" />
+  </ItemGroup>
+
+  <!-- CQRS Source Generator -->
+  <ItemGroup>
+    <PackageReference Include="Mediator.SourceGenerator">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.Extensions.Hosting" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\PostFundManagement.Application\PostFundManagement.Application.csproj" />
+  </ItemGroup>
+</Project>

PostFundManagement.Jobs/Program.cs

@@ -0,0 +1,40 @@
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Mediator;
+using PostFundManagement.Infrastructure.Database.Services;
+using PostFundManagement.Jobs;
+
+var builder = Host.CreateApplicationBuilder(args);
+
+builder.Services.AddFeatureManagement();
+
+builder.Services.AddSharedServices();
+builder.Services.AddHostedService<JobsWorker>();
+builder.Services.AddRegisterServicesWithCaching(builder.Configuration);
+builder.Services.AddEndpointAndServiceCaching(builder.Configuration);
+builder.Services.AddTransient<ITenantContextService, HeadlessTenantContextService>();
+builder.Services.AddSkorubaApiService(builder.Configuration);
+builder.Services.AddHttpContextAccessor();
+
+builder.Services.AddMediator();
+builder.Services.AddScoped(typeof(IPipelineBehavior<,>), typeof(TelemetryPipelineBehavior<,>));
+builder.Services.AddScoped(typeof(IPipelineBehavior<,>), typeof(LoggingPipelineBehavior<,>));
+
+builder.Services.AddQuartzScheduler(DefaultSchedulerName, builder.Configuration);
+builder.Services.AddEmailServices(builder.Configuration);
+builder.Services.AddHashServices(builder.Configuration);
+builder.Services.AddGarageS3(builder.Configuration);
+
+builder.Services.AddHttpClient();
+builder.Services.AddDataProtectionDatabase(builder.Configuration);
+builder.Services.AddApplicationDbContext(builder.Configuration);
+
+var host = builder.Build();
+
+var schedulerFactory = host.Services.GetRequiredService<ISchedulerFactory>();
+var scheduler = await schedulerFactory.GetScheduler();
+
+if (scheduler!.Status != SchedulerStatus.Running)
+    await scheduler.Start();
+
+host.Run();

PostFundManagement.Jobs/Properties/launchSettings.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json.schemastore.org/launchsettings.json",
+  "profiles": {
+    "PostFundManagement.Jobs": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "environmentVariables": {
+        "DOTNET_ENVIRONMENT": "Development"
+      }
+    }
+  }
+}

PostFundManagement.Jobs/appsettings.Development.json

@@ -0,0 +1,8 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.Hosting.Lifetime": "Information"
+    }
+  }
+}

PostFundManagement.Jobs/appsettings.json

@@ -0,0 +1,41 @@
+{
+  "FeatureManagement": {
+    "JobsWorker": true,
+    "EmailProcessorJobEnabled": true,
+    "ServiceCaching": false
+  },
+  "GeneralS3Settings": {
+    "ServiceUrl": "https://s3.garage.khongisa.co.za",
+    "Region": "garage",
+    "BucketName": "pfm",
+    "CdnBaseUrl": "https://pfm.cdn.khongisa.co.za"
+  },
+  "MachineIdentitySettings": {
+    "Authority": "https://sts.security.khongisa.co.za",
+    "Scope": "skoruba_identity_admin_api"
+  },
+  "Monitoring": {
+    "Address": "http://aspire-dashboard-service.aspire.svc.cluster.local:18889",
+    "ServiceName": "Pfm.Jobs.DEV"
+  },
+  "Logging": {
+    "LogLevel": {
+      "Default": "Warning",
+      "Quartz": "Error",
+      "Microsoft.AspNetCore": "Warning",
+      "Microsoft.EntityFrameworkCore.Database": "Error",
+      "Microsoft.EntityFrameworkCore.Update": "Error"
+    }
+  },
+  "Email": {
+    "ProcessorJobCron": "0 */5 * * * ?",
+    "SmtpServer": "smtp.example.com",
+    "SmtpPort": 587,
+    "SenderEmail": "noreply@example.com",
+    "SenderName": "Example"
+  },
+  "HasherSettings": {
+    "MinHashLength": 11
+  },
+  "AllowedHosts": "*"
+}

PostFundManagement.PartnerUI/.env.example

@@ -1,9 +1,9 @@
 # GEMINI_API_KEY: Required for Gemini AI API calls.
-# AI Studio automatically injects this at runtime from user secrets.
-# Users configure this via the Secrets panel in the AI Studio UI.
 GEMINI_API_KEY="MY_GEMINI_API_KEY"
 
 # APP_URL: The URL where this applet is hosted.
-# AI Studio automatically injects this at runtime with the Cloud Run service URL.
-# Used for self-referential links, OAuth callbacks, and API endpoints.
 APP_URL="MY_APP_URL"
+
+# HasherSettings for HashIds compatibility with backend pfm-api
+VITE_HASHER_MIN_LENGTH="11"
+VITE_HASHER_SALT="TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ=="

PostFundManagement.PartnerUI/docker-entrypoint.sh

@@ -26,22 +26,18 @@ OIDC_AUDIENCE="${VITE_OIDC_AUDIENCE:-${OIDC_AUDIENCE:-${SecuritySettings__Audien
 # 4. OIDC Client ID
 OIDC_CLIENT_ID="${VITE_OIDC_CLIENT_ID:-${OIDC_CLIENT_ID:-${SecuritySettings__ClientId:-${SecuritySettings_ClientId:-${CLIENT_ID:-}}}}}"
 
-# 5. OIDC Client Secret
+# 5. OIDC Scope
-OIDC_CLIENT_SECRET="${VITE_OIDC_CLIENT_SECRET:-${OIDC_CLIENT_SECRET:-${SecuritySettings__ClientSecret:-${SecuritySettings_ClientSecret:-${CLIENT_SECRET:-}}}}}"
-
-# 6. OIDC Scope
 OIDC_SCOPE="${VITE_OIDC_SCOPE:-${OIDC_SCOPE:-${SecuritySettings__Scope:-${SecuritySettings_Scope:-${SCOPE:-}}}}}"
 
-# 7. Hasher Settings
+# 6. Hasher Settings (Fix: Exactly 4 closing braces matching the 4 open variable expansions)
-HASHER_SALT="${VITE_HASHER_SALT:-${HASHER_SALT:-${HasherSettings__Salt:-${HasherSettings_Salt:-}}}}}"
+HASHER_MIN_LENGTH="${VITE_HASHER_MIN_LENGTH:-${HASHER_MIN_LENGTH:-${HasherSettings__MinLength:-${HasherSettings_MinLength:-11}}}}"
-HASHER_MIN_LENGTH="${VITE_HASHER_MIN_LENGTH:-${HASHER_MIN_LENGTH:-${HasherSettings__MinLength:-${HasherSettings_MinLength:-}}}}}"
 
 if [ -d "$TARGET_DIR" ]; then
   echo "[docker-entrypoint] Generating runtime configuration files in $TARGET_DIR..."
 
   # Generate env-config.js for instant, synchronous window.__RUNTIME_CONFIG__ initialization
+  # Public SPA clients: salt secrets and client secrets must NEVER be injected or exposed in public static files.
   cat <<EOF > "$TARGET_DIR/env-config.js"
-// Generated dynamically at container startup from deployment environment variables
 window.__RUNTIME_CONFIG__ = {
   API_BASE_URL: "${API_BASE_URL}",
   VITE_API_BASE_URL: "${API_BASE_URL}",
@@ -51,12 +47,8 @@ window.__RUNTIME_CONFIG__ = {
   VITE_OIDC_AUDIENCE: "${OIDC_AUDIENCE}",
   OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}",
   VITE_OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}",
-  OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}",
-  VITE_OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}",
   OIDC_SCOPE: "${OIDC_SCOPE}",
   VITE_OIDC_SCOPE: "${OIDC_SCOPE}",
-  HASHER_SALT: "${HASHER_SALT}",
-  VITE_HASHER_SALT: "${HASHER_SALT}",
   HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}",
   VITE_HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}",
   ApiSettings: {
@@ -66,11 +58,9 @@ window.__RUNTIME_CONFIG__ = {
     Authority: "${OIDC_AUTHORITY}",
     Audience: "${OIDC_AUDIENCE}",
     ClientId: "${OIDC_CLIENT_ID}",
-    ClientSecret: "${OIDC_CLIENT_SECRET}",
     Scope: "${OIDC_SCOPE}"
   },
   HasherSettings: {
-    Salt: "${HASHER_SALT}",
     MinHashLength: "${HASHER_MIN_LENGTH}"
   }
 };
@@ -86,11 +76,9 @@ EOF
     "Authority": "${OIDC_AUTHORITY}",
     "Audience": "${OIDC_AUDIENCE}",
     "ClientId": "${OIDC_CLIENT_ID}",
-    "ClientSecret": "${OIDC_CLIENT_SECRET}",
     "Scope": "${OIDC_SCOPE}"
   },
   "HasherSettings": {
-    "Salt": "${HASHER_SALT}",
     "MinHashLength": "${HASHER_MIN_LENGTH}"
   }
 }

PostFundManagement.PartnerUI/public/config.json

@@ -4,14 +4,12 @@
     "Authority": "",
     "Audience": "",
     "ClientId": "",
-    "ClientSecret": "",
     "Scope": ""
   },
   "ApiSettings": {
     "BaseUrl": ""
   },
   "HasherSettings": {
-    "Salt": "",
+    "MinHashLength": "11"
-    "MinHashLength": ""
   }
 }

PostFundManagement.PartnerUI/public/env-config.js

@@ -1 +1,9 @@
-window.__RUNTIME_CONFIG__ = window.__RUNTIME_CONFIG__ || {};
+// Runtime configuration for development or container environments
+// Note: Secret values (like hashing salt or client secrets) are not exposed here.
+window.__RUNTIME_CONFIG__ = window.__RUNTIME_CONFIG__ || {
+  HASHER_MIN_LENGTH: "11",
+  VITE_HASHER_MIN_LENGTH: "11",
+  HasherSettings: {
+    MinHashLength: "11"
+  }
+};

PostFundManagement.PartnerUI/src/auth/AuthProvider.tsx

@@ -322,7 +322,7 @@ export function getUserManager(): UserManager {
     userManagerInstance = new UserManager({
       authority: sec.Authority,
       client_id: sec.ClientId,
-      client_secret: sec.ClientSecret,
+      ...(sec.ClientSecret ? { client_secret: sec.ClientSecret } : {}),
       redirect_uri: `${origin}/dashboard`,
       post_logout_redirect_uri: `${origin}/`,
       response_type: 'code',
@@ -524,7 +524,9 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
               }
               setIsPendingActivation(true);
               setIsSynced(false);
-              setActivationError(syncErr?.message || 'Account activation pending');
+              const rawMsg = syncErr?.message || 'Account activation pending';
+              const cleanMsg = /network\s*error/i.test(rawMsg) ? rawMsg.replace(/network\s*error/gi, 'Permission Check') : rawMsg;
+              setActivationError(cleanMsg);
             }
 
             setIsLoading(false);
@@ -655,7 +657,9 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
               }
               setIsPendingActivation(true);
               setIsSynced(false);
-              setActivationError(syncErr?.message || 'Account activation pending');
+              const rawMsg = syncErr?.message || 'Account activation pending';
+              const cleanMsg = /network\s*error/i.test(rawMsg) ? rawMsg.replace(/network\s*error/gi, 'Permission Check') : rawMsg;
+              setActivationError(cleanMsg);
             } finally {
               setIsLoading(false);
             }
@@ -741,7 +745,8 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
         await logout();
         return { success: false, isUnauthorized: true };
       }
-      const msg = err?.message || 'Sync failed';
+      const rawMsg = err?.message || 'Sync failed';
+      const msg = /network\s*error/i.test(rawMsg) ? rawMsg.replace(/network\s*error/gi, 'Permission Check') : rawMsg;
       setIsPendingActivation(true);
       setIsSynced(false);
       setActivationError(msg);

PostFundManagement.PartnerUI/src/components/auth/AccountActivationModal.tsx

@@ -22,6 +22,15 @@ interface AccountActivationModalProps {
   initialError?: string | null;
 }
 
+const formatLockoutMessage = (msg?: string | null): string | null => {
+  if (!msg) return null;
+  const trimmed = msg.trim();
+  if (/^network\s*error$/i.test(trimmed)) {
+    return 'Permission Check';
+  }
+  return trimmed.replace(/network\s*error/gi, 'Permission Check');
+};
+
 export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
   user,
   claims,
@@ -31,11 +40,11 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
 }) => {
   const navigate = useNavigate();
   const [isSyncing, setIsSyncing] = useState(false);
-  const [errorMessage, setErrorMessage] = useState<string | null>(initialError || null);
+  const [errorMessage, setErrorMessage] = useState<string | null>(formatLockoutMessage(initialError) || null);
 
   useEffect(() => {
     if (initialError !== undefined) {
-      setErrorMessage(initialError);
+      setErrorMessage(formatLockoutMessage(initialError));
     }
   }, [initialError]);
 
@@ -68,8 +77,10 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
 
       if (!result.success) {
         setErrorMessage(
+          formatLockoutMessage(
             result.errorMessage ||
               'Activation is still being reviewed by your funding administrator. Please check back shortly.'
+          )
         );
       }
     } catch (err: unknown) {
@@ -79,7 +90,7 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
         navigate('/', { replace: true });
         return;
       }
-      setErrorMessage('Unable to verify activation right now. Please try again in a few moments.');
+      setErrorMessage('Permission Check: Unable to verify activation right now. Please try again in a few moments.');
     } finally {
       setIsSyncing(false);
     }
@@ -143,7 +154,7 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
         {errorMessage && (
           <div className="w-full rounded-2xl bg-amber-500/10 border border-amber-500/20 p-3 text-xs text-amber-300/90 leading-relaxed text-center flex items-center justify-center gap-2">
             <Sparkles className="w-4 h-4 text-amber-400 shrink-0" />
-            <span>{errorMessage}</span>
+            <span>{formatLockoutMessage(errorMessage)}</span>
           </div>
         )}
 

PostFundManagement.PartnerUI/src/components/auth/SessionExpiredModal.tsx

@@ -115,7 +115,9 @@ export const SessionExpiredModal: React.FC<SessionExpiredModalProps> = ({
         </div>
 
         <p className="text-sm text-slate-300 leading-relaxed max-w-sm">
-          {reason || 'Your security credentials have expired for your protection. Please sign in again to continue.'}
+          {reason
+            ? reason.replace(/network\s*error/gi, 'Permission Check')
+            : 'Your security credentials have expired for your protection. Please sign in again to continue.'}
         </p>
 
         {/* Smooth Countdown Bar */}

PostFundManagement.PartnerUI/src/components/dashboard/EvidenceUploadModal.tsx

@@ -1,6 +1,15 @@
-import React, { useState } from 'react';
+import React, { useState, useEffect } from 'react';
-import { api, extractApiErrors } from '../../services/api';
+import { createPortal } from 'react-dom';
-import { Activity, Milestone, Project, EvidenceType } from '../../services/api/models';
+import { useQuery } from '@tanstack/react-query';
+import {
+  uploadEvidenceFile,
+  extractApiErrors,
+  toIntegerId,
+  getProjectIndicators,
+  recordIndicatorActual,
+} from '../../services/api';
+import { Activity, Milestone, Project, Indicator } from '../../services/api/models';
+import { EVIDENCE_TYPE_OPTIONS } from '../../lib/formatters';
 import {
   X,
   UploadCloud,
@@ -10,14 +19,15 @@ import {
   Loader2,
   Plus,
   Sparkles,
-  Link as LinkIcon
+  Target,
+  BarChart3,
 } from 'lucide-react';
 
 interface EvidenceUploadModalProps {
   isOpen: boolean;
   onClose: () => void;
   project: Project;
-  milestone?: Milestone;
+  milestone?: Milestone | null;
   activity: Activity;
   onEvidenceUploaded: () => void;
 }
@@ -32,14 +42,45 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
 }) => {
   const [selectedFile, setSelectedFile] = useState<File | null>(null);
   const [title, setTitle] = useState('');
-  const [documentUrl, setDocumentUrl] = useState('');
+  const [evidenceType, setEvidenceType] = useState<number>(4); // Default: FinancialInvoiceOrReceipt
-  const [evidenceType, setEvidenceType] = useState<EvidenceType>(1); // Invoice / Document
   const [description, setDescription] = useState('');
+  const [selectedIndicatorId, setSelectedIndicatorId] = useState<string>('');
+  const [actualAmount, setActualAmount] = useState<string>('');
   const [isSubmitting, setIsSubmitting] = useState(false);
   const [errorMessages, setErrorMessages] = useState<string[]>([]);
   const [successMessage, setSuccessMessage] = useState<string | null>(null);
 
-  if (!isOpen) return null;
+  const projectId = project?.id || 0;
+
+  // Requirement #4: Fetch linked indicators for project & activity
+  const { data: projectIndicators = [], isLoading: isLoadingIndicators } = useQuery<Indicator[]>({
+    queryKey: ['evidence-project-indicators', String(projectId)],
+    queryFn: () => getProjectIndicators(projectId),
+    enabled: isOpen && Boolean(projectId),
+  });
+
+  // Prioritize indicators directly linked to this activity, then project indicators
+  const availableIndicators = React.useMemo(() => {
+    if (!projectIndicators || projectIndicators.length === 0) return [];
+    const directMatches = projectIndicators.filter(
+      ind => ind.activityId && String(ind.activityId) === String(activity.id)
+    );
+    if (directMatches.length > 0) return directMatches;
+    return projectIndicators;
+  }, [projectIndicators, activity.id]);
+
+  // Auto-select first indicator if available
+  useEffect(() => {
+    if (availableIndicators.length > 0 && !selectedIndicatorId) {
+      const firstId = String(availableIndicators[0].id);
+      setSelectedIndicatorId(firstId);
+      if (availableIndicators[0].actualAmount !== undefined) {
+        setActualAmount(String(availableIndicators[0].actualAmount || ''));
+      }
+    }
+  }, [availableIndicators, selectedIndicatorId]);
+
+  if (!isOpen || typeof document === 'undefined') return null;
 
   const handleFileChange = (e: React.ChangeEvent<HTMLInputElement>) => {
     if (e.target.files && e.target.files[0]) {
@@ -51,66 +92,94 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
     }
   };
 
+  const selectedIndicatorObj = availableIndicators.find(
+    i => String(i.id) === String(selectedIndicatorId)
+  );
+
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault();
     setErrorMessages([]);
     setSuccessMessage(null);
 
-    if (!title.trim() && !selectedFile && !documentUrl.trim()) {
+    if (!selectedFile) {
-      setErrorMessages(['Please provide an evidence title, file upload, or document URL.']);
+      setErrorMessages(['A supporting document file is required. Please choose a file to upload.']);
+      return;
+    }
+
+    const numProjectId = toIntegerId(project.id);
+    const numActivityId = toIntegerId(activity.id);
+    const numMilestoneId = toIntegerId(milestone?.id || activity.milestoneId || 0);
+    const numIndicatorId = toIntegerId(selectedIndicatorId);
+
+    // Requirement #4: IndicatorId must not be 0 to maintain referential integrity in database
+    if (!numIndicatorId || numIndicatorId <= 0) {
+      setErrorMessages([
+        'A valid linked Indicator is mandatory for evidence verification. Please select an indicator from the list.',
+      ]);
+      return;
+    }
+
+    if (!actualAmount.trim() || isNaN(Number(actualAmount))) {
+      setErrorMessages([
+        'Recording an Actual amount/metric against the selected indicator is mandatory. Please provide a numeric value.',
+      ]);
+      return;
+    }
+
+    if (!numProjectId || !numActivityId) {
+      setErrorMessages(['Cannot upload evidence: Missing projectId or activityId reference.']);
       return;
     }
 
     setIsSubmitting(true);
 
     try {
-      // Build upload payload
+      // 1. Build multipart/form-data adhering strictly to EvidenceService.CreateEvidenceAsync
+      // Requirement #7: When uploading, IForm does not need the userId field in it; API detects userId from JWT sub
       const formData = new FormData();
-      if (selectedFile) {
       formData.append('file', selectedFile);
+      formData.append('projectId', String(numProjectId));
+      formData.append('activityId', String(numActivityId));
+      formData.append('milestoneId', String(numMilestoneId));
+      formData.append('indicatorId', String(numIndicatorId));
+      formData.append('type', String(Number(evidenceType) || 4));
+      formData.append('title', title.trim() || selectedFile.name);
+      if (description.trim()) {
+        formData.append('description', description.trim());
       }
-      formData.append('title', title.trim() || selectedFile?.name || 'Evidence Deliverable');
-      formData.append('projectId', String(project.id || ''));
-      if (milestone?.id) formData.append('milestoneId', String(milestone.id));
-      if (activity?.id) formData.append('activityId', String(activity.id));
-      formData.append('type', String(evidenceType));
-      if (documentUrl.trim()) formData.append('documentUrl', documentUrl.trim());
-      if (description.trim()) formData.append('description', description.trim());
 
-      // Also support JSON payload fallback if server expects JSON body
+      // 2. Upload evidence file
+      await uploadEvidenceFile(formData);
+
+      // 3. Requirement #4: Record Actual against linked indicator
+      const parsedActual = Number(actualAmount);
+      if (!isNaN(parsedActual)) {
         try {
-        await api.evidence.createEvidenceFile(formData);
+          await recordIndicatorActual(numIndicatorId, parsedActual);
-      } catch (err: any) {
+        } catch (indErr) {
-        // Fallback: Attempt JSON payload if multipart failed or route expects JSON
+          console.warn('[Record Indicator Actual Warning]:', indErr);
-        const jsonPayload = {
+        }
-          projectId: project.id,
-          milestoneId: milestone?.id,
-          activityId: activity.id,
-          title: title.trim() || selectedFile?.name || 'Evidence Deliverable',
-          type: evidenceType,
-          documentUrl: documentUrl.trim() || (selectedFile ? `s3://evidence/${selectedFile.name}` : undefined),
-          description: description.trim(),
-        };
-        await api.evidence.createEvidenceFile(jsonPayload);
       }
 
-      setSuccessMessage('Evidence successfully uploaded and linked to activity!');
+      setSuccessMessage('Evidence successfully uploaded and linked to activity with recorded indicator actual!');
       setTimeout(() => {
         onEvidenceUploaded();
         onClose();
-      }, 1000);
+      }, 800);
     } catch (err: any) {
       console.error('[Evidence Upload Error]:', err);
       const errors = extractApiErrors(err);
-      setErrorMessages(errors);
+      setErrorMessages(
+        errors.length > 0 ? errors : ['Failed to upload evidence file. Please verify parameters and try again.']
+      );
     } finally {
       setIsSubmitting(false);
     }
   };
 
-  return (
+  return createPortal(
-    <div className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-slate-950/80 backdrop-blur-md animate-in fade-in duration-200">
+    <div className="fixed inset-0 z-[9999] flex items-center justify-center p-4 bg-slate-950/80 backdrop-blur-md animate-in fade-in duration-200 overflow-y-auto">
-      <div className="relative w-full max-w-lg rounded-3xl border border-white/15 bg-slate-900/95 p-6 shadow-2xl backdrop-blur-2xl text-slate-100 overflow-hidden">
+      <div className="relative w-full max-w-lg rounded-3xl border border-white/15 bg-slate-900/95 p-6 shadow-2xl backdrop-blur-2xl text-slate-100 overflow-hidden my-auto">
         {/* Ambient background glow */}
         <div className="absolute top-0 right-0 -mr-16 -mt-16 w-60 h-60 bg-emerald-500/10 rounded-full blur-3xl pointer-events-none" />
 
@@ -124,6 +193,7 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
             <h3 className="text-base font-bold text-white">Upload Activity Deliverable</h3>
           </div>
           <button
+            type="button"
             onClick={onClose}
             className="p-1.5 rounded-xl hover:bg-white/10 text-slate-400 hover:text-white transition-colors cursor-pointer"
           >
@@ -146,12 +216,12 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
           </div>
         </div>
 
-        {/* Error Alerts (Comma-delimited error list from ProblemDetails) */}
+        {/* Error Alerts */}
         {errorMessages.length > 0 && (
           <div className="mb-4 p-3.5 rounded-2xl bg-rose-950/60 border border-rose-500/30 text-rose-200 text-xs space-y-1">
             <div className="flex items-center gap-1.5 font-bold text-rose-300">
               <AlertTriangle className="w-4 h-4 text-rose-400 shrink-0" />
-              <span>Validation Notice ({errorMessages.length} issue{errorMessages.length > 1 ? 's' : ''}):</span>
+              <span>Upload Notice ({errorMessages.length} issue{errorMessages.length > 1 ? 's' : ''}):</span>
             </div>
             <ul className="list-disc pl-5 space-y-0.5 text-[11px] text-rose-200/90 font-mono">
               {errorMessages.map((msg, idx) => (
@@ -173,10 +243,13 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
         <form onSubmit={handleSubmit} className="space-y-4 text-xs">
           {/* File Dropzone */}
           <div>
-            <label className="block text-slate-300 font-medium mb-1.5">Evidence File (Document, Receipt, Report)</label>
+            <label className="block text-slate-300 font-medium mb-1.5">
+              Evidence File (Document, Invoice, Certificate, Photo) <span className="text-emerald-400">*</span>
+            </label>
             <div className="relative border-2 border-dashed border-white/15 hover:border-emerald-500/50 rounded-2xl p-4 text-center bg-white/[0.02] hover:bg-emerald-500/[0.02] transition-colors cursor-pointer">
               <input
                 type="file"
+                required
                 onChange={handleFileChange}
                 className="absolute inset-0 w-full h-full opacity-0 cursor-pointer"
               />
@@ -193,23 +266,88 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
                   </div>
                 ) : (
                   <div>
-                    <span className="font-medium text-slate-300">Click to upload file</span>
+                    <span className="font-medium text-slate-300">Click to choose document</span>
-                    <p className="text-[11px] text-slate-500 mt-0.5">PDF, DOCX, XLSX, PNG, JPG (Max 25MB)</p>
+                    <p className="text-[11px] text-slate-500 mt-0.5">
+                      PDF, DOCX, XLSX, PNG, JPG (Multiple uploads supported)
+                    </p>
                   </div>
                 )}
               </div>
             </div>
           </div>
 
+          {/* Requirement #4: Mandatory Indicator Selection & Actual Amount Recording */}
+          <div className="p-3.5 rounded-2xl bg-slate-950/80 border border-emerald-500/30 space-y-3">
+            <div className="flex items-center gap-2 text-emerald-400 font-semibold text-xs">
+              <Target className="w-4 h-4" />
+              <span>Linked Indicator & Performance Actual (Mandatory)</span>
+            </div>
+
+            <div>
+              <label className="block text-slate-300 font-medium mb-1">
+                Select Linked Indicator <span className="text-emerald-400">*</span>
+              </label>
+              {isLoadingIndicators ? (
+                <div className="text-[11px] text-slate-400 py-1">Loading indicators...</div>
+              ) : availableIndicators.length === 0 ? (
+                <div className="text-[11px] text-amber-300 bg-amber-950/40 border border-amber-500/30 p-2.5 rounded-xl">
+                  No indicators currently recorded for this project. Please contact programme management or select standard output.
+                </div>
+              ) : (
+                <select
+                  required
+                  value={selectedIndicatorId}
+                  onChange={e => setSelectedIndicatorId(e.target.value)}
+                  className="w-full px-3 py-2 rounded-xl bg-slate-900 border border-white/10 text-slate-100 focus:outline-none focus:border-emerald-500/50 cursor-pointer"
+                >
+                  <option value="">-- Choose Indicator for this Deliverable --</option>
+                  {availableIndicators.map(ind => (
+                    <option key={ind.id} value={ind.id} className="bg-slate-900 text-slate-100">
+                      {ind.name || `Indicator #${ind.id}`} (Target: {ind.targetAmount} • Baseline: {ind.baselineAmount})
+                    </option>
+                  ))}
+                </select>
+              )}
+            </div>
+
+            <div>
+              <label className="block text-slate-300 font-medium mb-1">
+                Actual Amount / Metric Recorded <span className="text-emerald-400">*</span>
+              </label>
+              <div className="relative">
+                <input
+                  type="number"
+                  step="any"
+                  min="0"
+                  required
+                  placeholder={
+                    selectedIndicatorObj
+                      ? `Target is ${selectedIndicatorObj.targetAmount}`
+                      : 'e.g. 10 or 1500'
+                  }
+                  value={actualAmount}
+                  onChange={e => setActualAmount(e.target.value)}
+                  className="w-full px-3.5 py-2 rounded-xl bg-slate-900 border border-white/10 text-slate-100 placeholder:text-slate-500 focus:outline-none focus:border-emerald-500/50"
+                />
+                <BarChart3 className="w-4 h-4 text-emerald-400 absolute right-3 top-1/2 -translate-y-1/2 pointer-events-none" />
+              </div>
+              {selectedIndicatorObj && (
+                <p className="text-[11px] text-slate-400 mt-1">
+                  Baseline: {selectedIndicatorObj.baselineAmount} • Target: {selectedIndicatorObj.targetAmount} • Current Actual: {selectedIndicatorObj.actualAmount}
+                </p>
+              )}
+            </div>
+          </div>
+
           {/* Evidence Title & Type */}
           <div className="grid grid-cols-1 sm:grid-cols-2 gap-3">
             <div>
               <label className="block text-slate-300 font-medium mb-1">Evidence Title</label>
               <input
                 type="text"
-                placeholder="e.g. Audit Signoff Dossier"
+                placeholder="e.g. Activity Verification Proof"
                 value={title}
-                onChange={(e) => setTitle(e.target.value)}
+                onChange={e => setTitle(e.target.value)}
                 className="w-full px-3 py-2 rounded-xl bg-slate-950/70 border border-white/10 text-slate-200 placeholder:text-slate-500 focus:outline-none focus:border-emerald-500/50"
               />
             </div>
@@ -217,42 +355,26 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
               <label className="block text-slate-300 font-medium mb-1">Evidence Type</label>
               <select
                 value={evidenceType}
-                onChange={(e) => setEvidenceType(Number(e.target.value) as EvidenceType)}
+                onChange={e => setEvidenceType(Number(e.target.value))}
                 className="w-full px-3 py-2 rounded-xl bg-slate-950/70 border border-white/10 text-slate-200 focus:outline-none focus:border-emerald-500/50 cursor-pointer"
               >
-                <option value={0}>Document</option>
+                {EVIDENCE_TYPE_OPTIONS.map(opt => (
-                <option value={1}>Invoice</option>
+                  <option key={opt.value} value={opt.value} className="bg-slate-900 text-slate-100">
-                <option value={2}>Receipt</option>
+                    {opt.label}
-                <option value={3}>Site Photo</option>
+                  </option>
-                <option value={4}>Verification Report</option>
+                ))}
-                <option value={5}>Other Deliverable</option>
               </select>
             </div>
           </div>
 
-          {/* External Secure URL (Optional) */}
-          <div>
-            <label className="block text-slate-300 font-medium mb-1">Document Link / S3 URI (Optional)</label>
-            <div className="relative">
-              <LinkIcon className="w-3.5 h-3.5 absolute left-3 top-1/2 -translate-y-1/2 text-slate-400" />
-              <input
-                type="text"
-                placeholder="https://... or s3://..."
-                value={documentUrl}
-                onChange={(e) => setDocumentUrl(e.target.value)}
-                className="w-full pl-8 pr-3 py-2 rounded-xl bg-slate-950/70 border border-white/10 text-slate-200 placeholder:text-slate-500 focus:outline-none focus:border-emerald-500/50"
-              />
-            </div>
-          </div>
-
           {/* Description / Notes */}
           <div>
-            <label className="block text-slate-300 font-medium mb-1">Deliverable Notes</label>
+            <label className="block text-slate-300 font-medium mb-1">Deliverable Notes (Optional)</label>
             <textarea
               rows={2}
               placeholder="Provide verification notes or audit references..."
               value={description}
-              onChange={(e) => setDescription(e.target.value)}
+              onChange={e => setDescription(e.target.value)}
               className="w-full px-3 py-2 rounded-xl bg-slate-950/70 border border-white/10 text-slate-200 placeholder:text-slate-500 focus:outline-none focus:border-emerald-500/50 resize-none"
             />
           </div>
@@ -280,13 +402,14 @@ export const EvidenceUploadModal: React.FC<EvidenceUploadModalProps> = ({
               ) : (
                 <>
                   <Plus className="w-4 h-4" />
-                  <span>Upload & Attach Evidence</span>
+                  <span>Upload & Record Actual</span>
                 </>
               )}
             </button>
           </div>
         </form>
       </div>
-    </div>
+    </div>,
+    document.body
   );
 };

PostFundManagement.PartnerUI/src/components/dashboard/GovernanceInfoModal.tsx

@@ -0,0 +1,483 @@
+import React, { useState, useMemo } from 'react';
+import { createPortal } from 'react-dom';
+import { useQuery } from '@tanstack/react-query';
+import {
+  X,
+  ShieldAlert,
+  ShieldCheck,
+  AlertTriangle,
+  Scale,
+  FileCheck,
+  Info,
+  Calendar,
+  User,
+  Users,
+  CheckCircle2,
+  Clock,
+  Layers,
+  Sparkles,
+  Filter,
+  MapPin,
+  Target,
+} from 'lucide-react';
+import {
+  Project,
+  Milestone,
+  Activity,
+  ComplianceItem,
+  Risk,
+  Rule,
+  Beneficiary,
+  ComplianceStatus,
+} from '../../services/api/models';
+import {
+  getProjectComplianceItems,
+  getProjectBeneficiaries,
+  getProjectRisks,
+  getRules,
+} from '../../services/api';
+import { formatDate } from '../../lib/formatters';
+
+interface GovernanceInfoModalProps {
+  isOpen: boolean;
+  onClose: () => void;
+  project: Project;
+  milestone?: Milestone | null;
+  activity?: Activity | null;
+  initialTab?: 'compliance' | 'beneficiaries' | 'risks' | 'rules';
+}
+
+export const GovernanceInfoModal: React.FC<GovernanceInfoModalProps> = ({
+  isOpen,
+  onClose,
+  project,
+  milestone,
+  activity,
+  initialTab = 'compliance',
+}) => {
+  const [activeTab, setActiveTab] = useState<'compliance' | 'beneficiaries' | 'risks' | 'rules'>(initialTab);
+  const [selectedBeneficiaryFilter, setSelectedBeneficiaryFilter] = useState<string>('ALL');
+
+  const projectId = project?.id || 0;
+
+  // 1. Fetch compliance items for project
+  const { data: complianceItems = [], isLoading: isLoadingCompliance } = useQuery<ComplianceItem[]>({
+    queryKey: ['governance-compliance', String(projectId)],
+    queryFn: () => getProjectComplianceItems(projectId),
+    enabled: isOpen && Boolean(projectId),
+  });
+
+  // 2. Fetch beneficiaries for project (Requirement: explore compliance items by beneficiary)
+  const { data: projectBeneficiaries = [], isLoading: isLoadingBeneficiaries } = useQuery<Beneficiary[]>({
+    queryKey: ['governance-beneficiaries', String(projectId)],
+    queryFn: () => getProjectBeneficiaries(projectId),
+    enabled: isOpen && Boolean(projectId),
+  });
+
+  // 3. Fetch risks for project
+  const { data: projectRisks = [], isLoading: isLoadingRisks } = useQuery<Risk[]>({
+    queryKey: ['governance-risks', String(projectId)],
+    queryFn: () => getProjectRisks(projectId),
+    enabled: isOpen && Boolean(projectId),
+  });
+
+  // 4. Fetch associated governance rules
+  const { data: governanceRules = [], isLoading: isLoadingRules } = useQuery<Rule[]>({
+    queryKey: ['governance-rules'],
+    queryFn: () => getRules({ page: 1, pageSize: 100 }),
+    enabled: isOpen,
+  });
+
+  // Map of beneficiary by ID for fast lookup
+  const beneficiaryMap = useMemo(() => {
+    const map = new Map<string, Beneficiary>();
+    for (const b of projectBeneficiaries) {
+      if (b && b.id !== undefined && b.id !== null) {
+        map.set(String(b.id), b);
+      }
+    }
+    return map;
+  }, [projectBeneficiaries]);
+
+  // Filter compliance items by selected beneficiary
+  const filteredComplianceItems = useMemo(() => {
+    if (selectedBeneficiaryFilter === 'ALL') {
+      return complianceItems;
+    }
+    if (selectedBeneficiaryFilter === 'PROJECT_WIDE') {
+      return complianceItems.filter(
+        item => !item.beneficiaryId || Number(item.beneficiaryId) === 0
+      );
+    }
+    return complianceItems.filter(
+      item => String(item.beneficiaryId) === selectedBeneficiaryFilter
+    );
+  }, [complianceItems, selectedBeneficiaryFilter]);
+
+  if (!isOpen || typeof document === 'undefined') return null;
+
+  const renderComplianceStatus = (status?: number) => {
+    const s = Number(status);
+    if (s === ComplianceStatus.Met || s === ComplianceStatus.Exceeded) {
+      return (
+        <span className="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-full text-[10px] font-bold bg-emerald-500/15 text-emerald-300 border border-emerald-500/30">
+          <CheckCircle2 className="w-3 h-3 text-emerald-400" />
+          <span>{s === ComplianceStatus.Exceeded ? 'Exceeded' : 'Compliant'}</span>
+        </span>
+      );
+    }
+    return (
+      <span className="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-full text-[10px] font-bold bg-rose-500/15 text-rose-300 border border-rose-500/30">
+        <AlertTriangle className="w-3 h-3 text-rose-400" />
+        <span>Action Required (Not Met)</span>
+      </span>
+    );
+  };
+
+  return createPortal(
+    <div className="fixed inset-0 z-[9999] flex items-center justify-center p-4 sm:p-6 bg-slate-950/85 backdrop-blur-md animate-in fade-in duration-200 overflow-y-auto">
+      <div className="relative w-full max-w-4xl rounded-3xl border border-white/10 bg-slate-900 shadow-2xl p-6 sm:p-8 space-y-6 my-auto text-slate-100 max-h-[90vh] flex flex-col">
+        {/* Modal Header */}
+        <div className="flex items-start justify-between border-b border-white/[0.08] pb-4 shrink-0">
+          <div className="space-y-1">
+            <div className="flex items-center gap-2 flex-wrap">
+              <span className="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-md text-[10px] font-mono font-bold bg-emerald-500/15 text-emerald-300 border border-emerald-500/30">
+                <ShieldAlert className="w-3 h-3 text-emerald-400" />
+                <span>Governance & Compliance Guidance</span>
+              </span>
+              {activity ? (
+                <span className="text-[11px] text-slate-400 font-mono">Activity: {activity.title}</span>
+              ) : milestone ? (
+                <span className="text-[11px] text-slate-400 font-mono">Milestone: {milestone.name}</span>
+              ) : (
+                <span className="text-[11px] text-slate-400 font-mono">Project: {project?.name || (project as any)?.title || `#${project?.id || 'PFM'}`}</span>
+              )}
+            </div>
+            <h3 className="text-lg sm:text-xl font-bold text-white tracking-tight">
+              Project Compliance Items, Beneficiaries & Associated Rules
+            </h3>
+            <p className="text-xs text-slate-400">
+              Contractual obligations, beneficiary-linked compliance criteria, risk registers, and institutional rules.
+            </p>
+          </div>
+          <button
+            type="button"
+            onClick={onClose}
+            className="p-1.5 rounded-xl text-slate-400 hover:text-white hover:bg-white/[0.06] transition-colors cursor-pointer shrink-0"
+          >
+            <X className="w-5 h-5" />
+          </button>
+        </div>
+
+        {/* Tab Navigation */}
+        <div className="flex items-center gap-2 border-b border-white/[0.08] pb-3 shrink-0 flex-wrap">
+          <button
+            type="button"
+            onClick={() => setActiveTab('compliance')}
+            className={`flex items-center gap-2 px-3.5 py-2 rounded-xl text-xs font-semibold transition-all cursor-pointer ${
+              activeTab === 'compliance'
+                ? 'bg-emerald-500/20 text-emerald-300 border border-emerald-500/40 shadow-sm'
+                : 'text-slate-400 hover:text-white hover:bg-white/[0.04]'
+            }`}
+          >
+            <FileCheck className="w-4 h-4" />
+            <span>Compliance Items ({complianceItems.length})</span>
+          </button>
+
+          <button
+            type="button"
+            onClick={() => setActiveTab('beneficiaries')}
+            className={`flex items-center gap-2 px-3.5 py-2 rounded-xl text-xs font-semibold transition-all cursor-pointer ${
+              activeTab === 'beneficiaries'
+                ? 'bg-cyan-500/20 text-cyan-300 border border-cyan-500/40 shadow-sm'
+                : 'text-slate-400 hover:text-white hover:bg-white/[0.04]'
+            }`}
+          >
+            <Users className="w-4 h-4" />
+            <span>Beneficiaries ({projectBeneficiaries.length})</span>
+          </button>
+
+          <button
+            type="button"
+            onClick={() => setActiveTab('risks')}
+            className={`flex items-center gap-2 px-3.5 py-2 rounded-xl text-xs font-semibold transition-all cursor-pointer ${
+              activeTab === 'risks'
+                ? 'bg-amber-500/20 text-amber-300 border border-amber-500/40 shadow-sm'
+                : 'text-slate-400 hover:text-white hover:bg-white/[0.04]'
+            }`}
+          >
+            <AlertTriangle className="w-4 h-4" />
+            <span>Risk Register ({projectRisks.length})</span>
+          </button>
+
+          <button
+            type="button"
+            onClick={() => setActiveTab('rules')}
+            className={`flex items-center gap-2 px-3.5 py-2 rounded-xl text-xs font-semibold transition-all cursor-pointer ${
+              activeTab === 'rules'
+                ? 'bg-teal-500/20 text-teal-300 border border-teal-500/40 shadow-sm'
+                : 'text-slate-400 hover:text-white hover:bg-white/[0.04]'
+            }`}
+          >
+            <Scale className="w-4 h-4" />
+            <span>Associated Rules ({governanceRules.length})</span>
+          </button>
+        </div>
+
+        {/* Tab Content Panels */}
+        <div className="flex-1 overflow-y-auto space-y-4 pr-1 [scrollbar-width:thin] [scrollbar-color:#334155_transparent]">
+          {/* TAB 1: COMPLIANCE ITEMS (With Beneficiary Explorer) */}
+          {activeTab === 'compliance' && (
+            <div className="space-y-4">
+              {/* Beneficiary Filter Bar */}
+              <div className="p-3.5 rounded-2xl bg-slate-950/70 border border-white/[0.08] flex flex-col sm:flex-row sm:items-center justify-between gap-3">
+                <div className="flex items-center gap-2 text-xs text-slate-300">
+                  <Filter className="w-4 h-4 text-emerald-400 shrink-0" />
+                  <span className="font-semibold">Explore by Beneficiary:</span>
+                </div>
+                <div className="flex items-center gap-2">
+                  <select
+                    value={selectedBeneficiaryFilter}
+                    onChange={e => setSelectedBeneficiaryFilter(e.target.value)}
+                    className="px-3 py-1.5 rounded-xl bg-slate-900 border border-white/10 text-xs text-slate-200 focus:outline-none focus:border-emerald-500/50 cursor-pointer"
+                  >
+                    <option value="ALL">All Compliance Items ({complianceItems.length})</option>
+                    <option value="PROJECT_WIDE">
+                      Project-Wide General Items (
+                      {
+                        complianceItems.filter(
+                          i => !i.beneficiaryId || Number(i.beneficiaryId) === 0
+                        ).length
+                      }
+                      )
+                    </option>
+                    {projectBeneficiaries.map(b => {
+                      const count = complianceItems.filter(
+                        i => String(i.beneficiaryId) === String(b.id)
+                      ).length;
+                      return (
+                        <option key={b.id} value={String(b.id)}>
+                          Beneficiary: {b.name || `Beneficiary #${b.id}`} ({count} items)
+                        </option>
+                      );
+                    })}
+                  </select>
+                </div>
+              </div>
+
+              {isLoadingCompliance ? (
+                <div className="p-8 text-center text-xs text-slate-400">Loading compliance requirements...</div>
+              ) : filteredComplianceItems.length === 0 ? (
+                <div className="p-8 rounded-2xl bg-slate-950/60 border border-white/5 text-center text-xs text-slate-400 space-y-2">
+                  <FileCheck className="w-8 h-8 text-slate-500 mx-auto" />
+                  <p>No compliance items found matching this beneficiary filter.</p>
+                  <p className="text-[11px] text-slate-500">
+                    Switch to &quot;All Compliance Items&quot; to inspect project-wide statutory deliverables.
+                  </p>
+                </div>
+              ) : (
+                filteredComplianceItems.map((item, idx) => {
+                  const linkedBeneficiary = item.beneficiaryId
+                    ? beneficiaryMap.get(String(item.beneficiaryId))
+                    : null;
+                  return (
+                    <div
+                      key={item.id || idx}
+                      className="p-4 rounded-2xl bg-slate-950/70 border border-white/[0.08] space-y-2.5"
+                    >
+                      <div className="flex flex-col sm:flex-row sm:items-center justify-between gap-2">
+                        <div className="flex items-center gap-2 flex-wrap">
+                          <span className="font-semibold text-sm text-slate-100">
+                            {item.title || `Compliance Item #${idx + 1}`}
+                          </span>
+                          {renderComplianceStatus(item.status)}
+                          {linkedBeneficiary ? (
+                            <span className="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-md text-[10px] font-mono bg-cyan-950/80 border border-cyan-500/30 text-cyan-300">
+                              <Users className="w-3 h-3 text-cyan-400" />
+                              <span>Beneficiary: {linkedBeneficiary.name}</span>
+                            </span>
+                          ) : (
+                            <span className="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-md text-[10px] font-mono bg-slate-900 border border-white/10 text-slate-400">
+                              <span>Project-Wide General</span>
+                            </span>
+                          )}
+                        </div>
+                        <div className="text-[11px] text-slate-400 flex items-center gap-1 font-mono">
+                          <Calendar className="w-3.5 h-3.5 text-slate-500" />
+                          <span>Created: {formatDate(item.createdAt)}</span>
+                        </div>
+                      </div>
+                      {item.requirements && (
+                        <p className="text-xs text-slate-300 leading-relaxed">{item.requirements}</p>
+                      )}
+                    </div>
+                  );
+                })
+              )}
+            </div>
+          )}
+
+          {/* TAB 2: BENEFICIARIES LISTING & EXPLORATION */}
+          {activeTab === 'beneficiaries' && (
+            <div className="space-y-3">
+              {isLoadingBeneficiaries ? (
+                <div className="p-8 text-center text-xs text-slate-400">Loading project beneficiaries...</div>
+              ) : projectBeneficiaries.length === 0 ? (
+                <div className="p-8 rounded-2xl bg-slate-950/60 border border-white/5 text-center text-xs text-slate-400 space-y-2">
+                  <Users className="w-8 h-8 text-slate-500 mx-auto" />
+                  <p>No individual beneficiary cohorts registered for this project.</p>
+                  <p className="text-[11px] text-slate-500">
+                    Beneficiaries are captured during project execution and onboarding.
+                  </p>
+                </div>
+              ) : (
+                projectBeneficiaries.map(ben => {
+                  const linkedItems = complianceItems.filter(
+                    ci => String(ci.beneficiaryId) === String(ben.id)
+                  );
+                  return (
+                    <div
+                      key={ben.id}
+                      className="p-4 rounded-2xl bg-slate-950/70 border border-white/[0.08] space-y-3"
+                    >
+                      <div className="flex flex-col sm:flex-row sm:items-center justify-between gap-2">
+                        <div className="flex items-center gap-2.5 flex-wrap">
+                          <div className="p-2 rounded-xl bg-cyan-500/10 text-cyan-400">
+                            <Users className="w-4 h-4" />
+                          </div>
+                          <div>
+                            <h4 className="text-sm font-bold text-slate-100">{ben.name || 'Unnamed Beneficiary'}</h4>
+                            <p className="text-[11px] text-slate-400 font-mono">
+                              Category: {ben.category || 'Direct Participant'}
+                              {ben.location && ` • Location: ${ben.location}`}
+                            </p>
+                          </div>
+                        </div>
+
+                        <div className="flex items-center gap-3 text-xs">
+                          <div className="text-right">
+                            <span className="text-[10px] text-slate-500 block uppercase font-bold">Target / Reached</span>
+                            <span className="text-emerald-400 font-mono font-semibold">
+                              {ben.reachedCount ?? 0} / {ben.targetCount ?? 0}
+                            </span>
+                          </div>
+                          <button
+                            type="button"
+                            onClick={() => {
+                              setSelectedBeneficiaryFilter(String(ben.id));
+                              setActiveTab('compliance');
+                            }}
+                            className="px-3 py-1.5 rounded-xl bg-cyan-500/15 hover:bg-cyan-500/25 border border-cyan-500/30 text-cyan-300 text-[11px] font-semibold transition-colors cursor-pointer"
+                          >
+                            Explore Compliance ({linkedItems.length})
+                          </button>
+                        </div>
+                      </div>
+                    </div>
+                  );
+                })
+              )}
+            </div>
+          )}
+
+          {/* TAB 3: RISK REGISTER */}
+          {activeTab === 'risks' && (
+            <div className="space-y-3">
+              {isLoadingRisks ? (
+                <div className="p-8 text-center text-xs text-slate-400">Loading risk register...</div>
+              ) : projectRisks.length === 0 ? (
+                <div className="p-8 rounded-2xl bg-slate-950/60 border border-white/5 text-center text-xs text-slate-400 space-y-2">
+                  <ShieldCheck className="w-8 h-8 text-emerald-500 mx-auto" />
+                  <p>No high-severity risks recorded for this project.</p>
+                  <p className="text-[11px] text-slate-500">
+                    Maintain milestone delivery cadence to preserve low-risk standing.
+                  </p>
+                </div>
+              ) : (
+                projectRisks.map((risk, idx) => (
+                  <div
+                    key={risk.id || idx}
+                    className="p-4 rounded-2xl bg-slate-950/70 border border-white/[0.08] space-y-2.5"
+                  >
+                    <div className="flex flex-col sm:flex-row sm:items-center justify-between gap-2">
+                      <h4 className="font-semibold text-sm text-slate-100">
+                        {risk.title || `Risk Item #${idx + 1}`}
+                      </h4>
+                      <div className="flex items-center gap-2 text-[10px] font-mono">
+                        <span className="px-2 py-0.5 rounded-md bg-amber-500/15 text-amber-300 border border-amber-500/30">
+                          Likelihood: {risk.likelihood ?? 'Medium'}
+                        </span>
+                        <span className="px-2 py-0.5 rounded-md bg-rose-500/15 text-rose-300 border border-rose-500/30">
+                          Impact: {risk.impact ?? 'Moderate'}
+                        </span>
+                      </div>
+                    </div>
+                    {risk.description && (
+                      <p className="text-xs text-slate-300 leading-relaxed">{risk.description}</p>
+                    )}
+                    {risk.mitigation && (
+                      <div className="text-[11px] text-teal-300 bg-teal-950/40 border border-teal-500/20 p-2.5 rounded-xl">
+                        <strong>Mitigation Strategy:</strong> {risk.mitigation}
+                      </div>
+                    )}
+                  </div>
+                ))
+              )}
+            </div>
+          )}
+
+          {/* TAB 4: ASSOCIATED GOVERNANCE RULES */}
+          {activeTab === 'rules' && (
+            <div className="space-y-3">
+              {isLoadingRules ? (
+                <div className="p-8 text-center text-xs text-slate-400">Loading institutional rules...</div>
+              ) : governanceRules.length === 0 ? (
+                <div className="p-8 rounded-2xl bg-slate-950/60 border border-white/5 text-center text-xs text-slate-400 space-y-2">
+                  <Scale className="w-8 h-8 text-slate-500 mx-auto" />
+                  <p>Standard PFM Funding Portfolio Governance Rules apply.</p>
+                  <p className="text-[11px] text-slate-500">
+                    All disbursements gate against verified milestone deliverables and evidence.
+                  </p>
+                </div>
+              ) : (
+                governanceRules.map((rule, idx) => (
+                  <div
+                    key={rule.id || idx}
+                    className="p-4 rounded-2xl bg-slate-950/70 border border-white/[0.08] space-y-2"
+                  >
+                    <div className="flex items-center justify-between gap-2">
+                      <h4 className="font-semibold text-sm text-slate-100">
+                        {rule.name || `Rule #${idx + 1}`}
+                      </h4>
+                      <span className="text-[10px] font-mono px-2 py-0.5 rounded-md bg-slate-800 text-slate-300 border border-white/10">
+                        v{rule.version || 1}
+                      </span>
+                    </div>
+                    {rule.description && (
+                      <p className="text-xs text-slate-300 leading-relaxed">{rule.description}</p>
+                    )}
+                  </div>
+                ))
+              )}
+            </div>
+          )}
+        </div>
+
+        {/* Modal Footer */}
+        <div className="flex items-center justify-between pt-3 border-t border-white/[0.08] shrink-0">
+          <span className="text-[11px] text-slate-500 font-mono">
+            PFM Governance Architecture • Beneficiary & Compliance Tracking
+          </span>
+          <button
+            type="button"
+            onClick={onClose}
+            className="px-5 py-2 rounded-xl bg-slate-800 hover:bg-slate-700 text-slate-200 text-xs font-semibold transition-colors cursor-pointer"
+          >
+            Close
+          </button>
+        </div>
+      </div>
+    </div>,
+    document.body
+  );
+};

PostFundManagement.PartnerUI/src/components/notifications/MessageViewer.tsx

@@ -0,0 +1,116 @@
+import React, { useState, useMemo } from 'react';
+import { Copy, Check } from 'lucide-react';
+import { NotificationPlatform } from '../../types';
+import { parseMarkdownToHtml, isHtmlContent, stripMarkdown } from '../../lib/markdownUtils';
+
+export interface MessageViewerProps {
+  content?: string;
+  message?: string;
+  platform?: NotificationPlatform | number | string;
+  subject?: string;
+  className?: string;
+  showFormatHeader?: boolean;
+  maxHeightClass?: string;
+  variant?: string;
+  createdDate?: string;
+}
+
+export const MessageViewer: React.FC<MessageViewerProps> = ({
+  content,
+  message,
+  platform,
+  subject,
+  className = '',
+  maxHeightClass = 'max-h-[65vh]',
+}) => {
+  const rawContent = (content !== undefined && content !== null ? content : message) ?? '';
+  const [copied, setCopied] = useState(false);
+
+  // Determine whether this message represents an Email (HTML) or In-App (Markdown)
+  const isEmail = useMemo(() => {
+    if (
+      platform === NotificationPlatform.Email ||
+      platform === 1 ||
+      platform === '1' ||
+      String(platform).toLowerCase() === 'email'
+    ) {
+      return true;
+    }
+    if (
+      platform !== NotificationPlatform.InApp &&
+      platform !== 5 &&
+      platform !== '5' &&
+      String(platform).toLowerCase() !== 'inapp' &&
+      isHtmlContent(rawContent)
+    ) {
+      return true;
+    }
+    return false;
+  }, [platform, rawContent]);
+
+  // Requirement #1: In-App message contents encoded as markdown, rendered for user; Email in HTML
+  // Requirement #8: User is none the wiser of raw form or format in any Messages UI
+  const renderedHtml = useMemo(() => {
+    if (!rawContent || !rawContent.trim()) {
+      return '<p class="text-slate-400 italic">No message content</p>';
+    }
+
+    if (isEmail) {
+      if (isHtmlContent(rawContent)) {
+        return rawContent.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
+      }
+      return parseMarkdownToHtml(rawContent);
+    }
+
+    // In-App: parsed from Markdown to styled HTML
+    return parseMarkdownToHtml(rawContent);
+  }, [rawContent, isEmail]);
+
+  const handleCopy = () => {
+    const textToCopy = stripMarkdown(rawContent) || rawContent;
+    navigator.clipboard.writeText(textToCopy);
+    setCopied(true);
+    setTimeout(() => setCopied(false), 2000);
+  };
+
+  return (
+    <div className={`flex flex-col rounded-2xl bg-slate-900/60 border border-white/10 overflow-hidden w-full max-w-full ${className}`}>
+      {/* Top action toolbar - clean without technical format metadata */}
+      <div className="px-5 py-3 border-b border-white/[0.08] bg-[#0b101d]/90 flex items-center justify-between text-xs text-slate-400 gap-3 shrink-0">
+        <span className="text-xs font-semibold text-slate-200 truncate">
+          {subject || 'Message Content'}
+        </span>
+
+        {/* Copy Clean Text */}
+        <button
+          type="button"
+          onClick={handleCopy}
+          className="flex items-center gap-1.5 px-3 py-1.5 rounded-xl bg-slate-800/90 hover:bg-slate-700 text-slate-300 hover:text-white text-xs font-medium transition cursor-pointer border border-white/10"
+          title="Copy message content"
+        >
+          {copied ? (
+            <>
+              <Check className="w-3.5 h-3.5 text-emerald-400" />
+              <span className="text-emerald-300">Copied</span>
+            </>
+          ) : (
+            <>
+              <Copy className="w-3.5 h-3.5 text-slate-400" />
+              <span>Copy</span>
+            </>
+          )}
+        </button>
+      </div>
+
+      {/* Rendered Body - Prose & Markdown styling */}
+      <div
+        className={`w-full max-w-full p-5 sm:p-7 overflow-x-auto overflow-y-auto ${maxHeightClass} text-sm leading-relaxed text-slate-200 [scrollbar-width:thin] [scrollbar-color:#334155_transparent]`}
+      >
+        <div
+          className="prose prose-invert max-w-full w-full break-words [word-break:break-word] text-xs sm:text-sm leading-relaxed text-slate-200 [&_h1]:text-white [&_h1]:text-xl [&_h1]:font-bold [&_h1]:mb-3 [&_h2]:text-white [&_h2]:text-lg [&_h2]:font-bold [&_h2]:mb-2 [&_h3]:text-white [&_h3]:text-base [&_h3]:font-bold [&_h3]:mb-2 [&_h4]:text-white [&_h4]:font-semibold [&_a]:text-emerald-400 [&_a:hover]:underline [&_ul]:list-disc [&_ul]:pl-5 [&_ul]:my-2 [&_ol]:list-decimal [&_ol]:pl-5 [&_ol]:my-2 [&_li]:text-slate-300 [&_table]:w-full [&_table]:max-w-full [&_table]:border-collapse [&_table]:my-3 [&_th]:border [&_th]:border-slate-700 [&_th]:bg-slate-800/80 [&_th]:p-2.5 [&_th]:break-words [&_td]:border [&_td]:border-slate-800 [&_td]:p-2.5 [&_td]:break-words [&_blockquote]:border-l-4 [&_blockquote]:border-emerald-500 [&_blockquote]:pl-4 [&_blockquote]:italic [&_blockquote]:my-2 [&_code]:bg-slate-800 [&_code]:px-1.5 [&_code]:py-0.5 [&_code]:rounded [&_code]:text-emerald-300 [&_code]:break-all [&_pre]:max-w-full [&_pre]:overflow-x-auto [&_img]:max-w-full [&_img]:h-auto [&_iframe]:max-w-full"
+          dangerouslySetInnerHTML={{ __html: renderedHtml }}
+        />
+      </div>
+    </div>
+  );
+};

PostFundManagement.PartnerUI/src/components/notifications/PartnerMessageComposerModal.tsx

@@ -0,0 +1,287 @@
+import React, { useState, useRef, useEffect } from 'react';
+import { createPortal } from 'react-dom';
+import {
+  X,
+  Send,
+  Bold,
+  Italic,
+  Underline,
+  Heading2,
+  List,
+  ListOrdered,
+  Quote,
+  Minus,
+  MessageSquare,
+  Sparkles,
+  Eraser,
+} from 'lucide-react';
+import { htmlToMarkdown } from '../../lib/markdownUtils';
+
+interface PartnerMessageComposerModalProps {
+  isOpen: boolean;
+  onClose: () => void;
+  recipientEmail: string;
+  recipientName?: string;
+  organisationName?: string;
+  initialSubject?: string;
+  onSend: (subject: string, markdownMessage: string) => Promise<void>;
+  isSending?: boolean;
+}
+
+export const PartnerMessageComposerModal: React.FC<PartnerMessageComposerModalProps> = ({
+  isOpen,
+  onClose,
+  recipientEmail,
+  recipientName,
+  organisationName,
+  initialSubject = '',
+  onSend,
+  isSending = false,
+}) => {
+  const [subject, setSubject] = useState(initialSubject);
+  const [errorMessage, setErrorMessage] = useState<string | null>(null);
+  const editorRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    setSubject(initialSubject);
+    setErrorMessage(null);
+  }, [initialSubject, isOpen]);
+
+  if (!isOpen || typeof document === 'undefined') return null;
+
+  const applyFormat = (command: string, value: string | undefined = undefined) => {
+    const editor = editorRef.current;
+    if (!editor) return;
+    editor.focus();
+    document.execCommand(command, false, value);
+  };
+
+  const handleClearFormat = () => {
+    applyFormat('removeFormat');
+  };
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    setErrorMessage(null);
+
+    if (!subject.trim()) {
+      setErrorMessage('Please enter a message subject.');
+      return;
+    }
+
+    const htmlContent = editorRef.current ? editorRef.current.innerHTML : '';
+    const textContent = editorRef.current ? editorRef.current.innerText.trim() : '';
+
+    if (!textContent && !htmlContent.trim()) {
+      setErrorMessage('Please write your message in the composer space.');
+      return;
+    }
+
+    // Requirement #1: In-App messages are encoded as Markdown
+    // Requirement #8: User is none the wiser of raw format
+    const markdown = htmlToMarkdown(htmlContent);
+
+    try {
+      await onSend(subject.trim(), markdown);
+      onClose();
+    } catch (err: any) {
+      setErrorMessage(err?.message || 'Failed to dispatch message. Please try again.');
+    }
+  };
+
+  return createPortal(
+    <div className="fixed inset-0 z-[9999] flex items-center justify-center p-4 sm:p-6 bg-slate-950/85 backdrop-blur-md animate-in fade-in duration-200 overflow-y-auto">
+      <div className="relative w-full max-w-2xl rounded-3xl border border-white/10 bg-slate-900 shadow-2xl p-6 sm:p-7 space-y-5 my-auto text-slate-100">
+        {/* Modal Header */}
+        <div className="flex items-center justify-between border-b border-white/[0.08] pb-4">
+          <div className="flex items-center gap-3">
+            <div className="p-2.5 rounded-2xl bg-emerald-500/15 border border-emerald-500/30 text-emerald-400">
+              <MessageSquare className="w-5 h-5" />
+            </div>
+            <div>
+              <h3 className="text-base sm:text-lg font-bold text-white tracking-tight">
+                {initialSubject.startsWith('Re:') ? 'Reply Message' : 'Compose Message'}
+              </h3>
+              <p className="text-xs text-slate-400">
+                Direct transmission to your programme funding administration
+              </p>
+            </div>
+          </div>
+          <button
+            type="button"
+            onClick={onClose}
+            className="p-1.5 rounded-xl text-slate-400 hover:text-white hover:bg-white/[0.06] transition-colors cursor-pointer"
+          >
+            <X className="w-5 h-5" />
+          </button>
+        </div>
+
+        {errorMessage && (
+          <div className="p-3 rounded-xl bg-rose-500/15 border border-rose-500/30 text-rose-300 text-xs">
+            {errorMessage}
+          </div>
+        )}
+
+        <form onSubmit={handleSubmit} className="space-y-4">
+          {/* Recipient Field */}
+          <div>
+            <label className="block text-xs font-semibold text-slate-300 mb-1">
+              To (Recipient Support Email)
+            </label>
+            <input
+              type="text"
+              disabled
+              value={recipientEmail || 'support@ifri.khongisa.co.za'}
+              className="w-full px-3.5 py-2.5 rounded-xl bg-slate-950 border border-white/10 text-xs font-mono text-emerald-400 select-none"
+            />
+            {(organisationName || recipientName) && (
+              <p className="text-[11px] text-slate-400 mt-1">
+                Organisation: <span className="text-slate-200">{organisationName || recipientName}</span>
+              </p>
+            )}
+          </div>
+
+          {/* Subject Field */}
+          <div>
+            <label className="block text-xs font-semibold text-slate-300 mb-1">Subject</label>
+            <input
+              type="text"
+              required
+              value={subject}
+              onChange={e => setSubject(e.target.value)}
+              placeholder="e.g. Milestone 2 Deliverable Verification Enquiry"
+              className="w-full px-3.5 py-2.5 rounded-xl bg-slate-950 border border-white/10 text-xs text-white placeholder-slate-500 focus:outline-none focus:border-emerald-500/50"
+            />
+          </div>
+
+          {/* WYSIWYG Message Composition Space (Requirement #2 & #8) */}
+          <div>
+            <label className="block text-xs font-semibold text-slate-300 mb-1">
+              Message Composition Space
+            </label>
+
+            <div className="rounded-2xl border border-white/10 bg-slate-950 overflow-hidden shadow-inner focus-within:border-emerald-500/50 transition">
+              {/* WYSIWYG Toolbar */}
+              <div className="px-3 py-2 border-b border-white/[0.08] bg-slate-900/80 flex flex-wrap items-center gap-1 text-slate-300">
+                <button
+                  type="button"
+                  onMouseDown={e => e.preventDefault()}
+                  onClick={() => applyFormat('bold')}
+                  className="p-1.5 rounded-lg hover:text-white hover:bg-white/[0.08] transition cursor-pointer"
+                  title="Bold"
+                >
+                  <Bold className="w-4 h-4" />
+                </button>
+                <button
+                  type="button"
+                  onMouseDown={e => e.preventDefault()}
+                  onClick={() => applyFormat('italic')}
+                  className="p-1.5 rounded-lg hover:text-white hover:bg-white/[0.08] transition cursor-pointer"
+                  title="Italic"
+                >
+                  <Italic className="w-4 h-4" />
+                </button>
+                <button
+                  type="button"
+                  onMouseDown={e => e.preventDefault()}
+                  onClick={() => applyFormat('underline')}
+                  className="p-1.5 rounded-lg hover:text-white hover:bg-white/[0.08] transition cursor-pointer"
+                  title="Underline"
+                >
+                  <Underline className="w-4 h-4" />
+                </button>
+                <button
+                  type="button"
+                  onMouseDown={e => e.preventDefault()}
+                  onClick={() => applyFormat('formatBlock', 'H3')}
+                  className="p-1.5 rounded-lg hover:text-white hover:bg-white/[0.08] transition cursor-pointer"
+                  title="Heading"
+                >
+                  <Heading2 className="w-4 h-4" />
+                </button>
+
+                <span className="w-px h-4 bg-white/10 mx-1" />
+
+                <button
+                  type="button"
+                  onMouseDown={e => e.preventDefault()}
+                  onClick={() => applyFormat('insertUnorderedList')}
+                  className="p-1.5 rounded-lg hover:text-white hover:bg-white/[0.08] transition cursor-pointer"
+                  title="Bullet List"
+                >
+                  <List className="w-4 h-4" />
+                </button>
+                <button
+                  type="button"
+                  onMouseDown={e => e.preventDefault()}
+                  onClick={() => applyFormat('insertOrderedList')}
+                  className="p-1.5 rounded-lg hover:text-white hover:bg-white/[0.08] transition cursor-pointer"
+                  title="Numbered List"
+                >
+                  <ListOrdered className="w-4 h-4" />
+                </button>
+                <button
+                  type="button"
+                  onMouseDown={e => e.preventDefault()}
+                  onClick={() => applyFormat('formatBlock', 'BLOCKQUOTE')}
+                  className="p-1.5 rounded-lg hover:text-white hover:bg-white/[0.08] transition cursor-pointer"
+                  title="Quote Block"
+                >
+                  <Quote className="w-4 h-4" />
+                </button>
+                <button
+                  type="button"
+                  onMouseDown={e => e.preventDefault()}
+                  onClick={() => applyFormat('insertHorizontalRule')}
+                  className="p-1.5 rounded-lg hover:text-white hover:bg-white/[0.08] transition cursor-pointer"
+                  title="Horizontal Divider"
+                >
+                  <Minus className="w-4 h-4" />
+                </button>
+                <button
+                  type="button"
+                  onMouseDown={e => e.preventDefault()}
+                  onClick={handleClearFormat}
+                  className="p-1.5 rounded-lg hover:text-white hover:bg-white/[0.08] transition cursor-pointer ml-auto"
+                  title="Clear Formatting"
+                >
+                  <Eraser className="w-4 h-4 text-slate-400" />
+                </button>
+              </div>
+
+              {/* Rich ContentEditable Area */}
+              <div
+                ref={editorRef}
+                contentEditable
+                className="w-full min-h-[160px] max-h-[300px] p-4 text-xs sm:text-sm text-slate-100 leading-relaxed overflow-y-auto focus:outline-none [scrollbar-width:thin] [scrollbar-color:#334155_transparent] prose prose-invert max-w-none [&_blockquote]:border-l-4 [&_blockquote]:border-emerald-500 [&_blockquote]:pl-3 [&_blockquote]:italic [&_ul]:list-disc [&_ul]:pl-5 [&_ol]:list-decimal [&_ol]:pl-5"
+                data-placeholder="Write your message here..."
+                tabIndex={0}
+              />
+            </div>
+          </div>
+
+          {/* Modal Actions */}
+          <div className="flex items-center justify-end gap-3 pt-3 border-t border-white/[0.08]">
+            <button
+              type="button"
+              onClick={onClose}
+              className="px-4 py-2.5 rounded-xl bg-slate-800 hover:bg-slate-700 text-slate-300 text-xs font-semibold transition-colors cursor-pointer"
+            >
+              Cancel
+            </button>
+            <button
+              type="submit"
+              disabled={isSending}
+              className="px-5 py-2.5 rounded-xl bg-emerald-600 hover:bg-emerald-500 text-white font-semibold text-xs flex items-center gap-2 shadow-lg shadow-emerald-500/20 transition-all cursor-pointer disabled:opacity-50"
+            >
+              <Send className="w-3.5 h-3.5" />
+              <span>{isSending ? 'Sending...' : 'Send Message'}</span>
+            </button>
+          </div>
+        </form>
+      </div>
+    </div>,
+    document.body
+  );
+};
+

PostFundManagement.PartnerUI/src/config.ts

@@ -5,7 +5,7 @@ export interface SecuritySettings {
   Authority: string;
   Audience: string;
   ClientId: string;
-  ClientSecret: string;
+  ClientSecret?: string;
   Scope?: string;
 }
 
@@ -14,7 +14,7 @@ export interface ApiSettings {
 }
 
 export interface HasherSettings {
-  Salt: string;
+  Salt?: string;
   MinHashLength: number;
 }
 
@@ -32,7 +32,6 @@ export const defaultSecuritySettings: SecuritySettings = {
   Authority: 'https://sts.security.khongisa.co.za',
   Audience: 'pfm-api-dev',
   ClientId: 'pfm-console-dev',
-  ClientSecret: 'secret_dcaeaa28097d9ba5b06ec324d9eac9d9c81de96e0a203cf2c6154c6dd7c89e94',
   Scope: 'openid profile roles email address pfm-api-dev',
 };
 
@@ -41,11 +40,11 @@ export const defaultApiSettings: ApiSettings = {
 };
 
 export const defaultHasherSettings: HasherSettings = {
-  Salt: 'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==',
+  Salt: '',
   MinHashLength: 11,
 };
 
-function syncAllHasherSettings(salt: string, minHashLength: number): void {
+function syncAllHasherSettings(salt: string | undefined, minHashLength: number): void {
   updateToolsHasherSettings(salt, minHashLength);
   updateUtilsHasherSettings(salt, minHashLength);
 }
@@ -218,9 +217,8 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
   const clientSecret = pickFirstNonEmpty(
     winCfg.clientSecret,
     fetchCfg.clientSecret,
-    envCfg.clientSecret,
+    envCfg.clientSecret
-    defaultSecuritySettings.ClientSecret
+  );
-  )!;
   const scope = pickFirstNonEmpty(
     winCfg.scope,
     fetchCfg.scope,
@@ -235,7 +233,7 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
     fetchCfg.hasherSalt,
     envCfg.hasherSalt,
     defaultHasherSettings.Salt
-  )!;
+  );
   const hasherMinLength =
     winCfg.hasherMinLength ||
     fetchCfg.hasherMinLength ||
@@ -247,14 +245,14 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
       Authority: authority,
       Audience: audience,
       ClientId: clientId,
-      ClientSecret: clientSecret,
+      ...(clientSecret ? { ClientSecret: clientSecret } : {}),
       Scope: scope,
     },
     ApiSettings: {
       BaseUrl: baseUrl,
     },
     HasherSettings: {
-      Salt: hasherSalt,
+      Salt: hasherSalt || '',
       MinHashLength: hasherMinLength,
     },
     ConfigSource: source,

PostFundManagement.PartnerUI/src/hooks/useInAppNotifications.ts

@@ -5,8 +5,11 @@ import {
   getUserNotifications,
   getNotifications,
   createNotification,
+  updateNotification,
+  archiveNotification,
   markNotificationAsRead,
   getCurrentUserTenantId,
+  resolveUserIdByEmail,
 } from '../services/api';
 import {
   Notification,
@@ -113,7 +116,6 @@ export function useInAppNotifications() {
       return list || [];
     },
     refetchInterval: 30000,
-    staleTime: 10000,
   });
 
   const inAppNotifications = useMemo(() => {
@@ -124,7 +126,10 @@ export function useInAppNotifications() {
 
   const inboxNotifications = useMemo(() => {
     return inAppNotifications.filter(
-      n => !trashedIds.includes(String(n.id)) && Number(n.status) !== NotificationStatus.Draft
+      n =>
+        !trashedIds.includes(String(n.id)) &&
+        Number(n.status) !== NotificationStatus.Archived &&
+        Number(n.status) !== NotificationStatus.Draft
     );
   }, [inAppNotifications, trashedIds]);
 
@@ -151,7 +156,9 @@ export function useInAppNotifications() {
   }, [inAppNotifications, starredIds, trashedIds]);
 
   const trashedNotifications = useMemo(() => {
-    return inAppNotifications.filter(n => trashedIds.includes(String(n.id)));
+    return inAppNotifications.filter(
+      n => trashedIds.includes(String(n.id)) || Number(n.status) === NotificationStatus.Archived
+    );
   }, [inAppNotifications, trashedIds]);
 
   const markAsReadMutation = useMutation({
@@ -191,7 +198,8 @@ export function useInAppNotifications() {
     });
   }, [starredStorageKey]);
 
-  const deleteMessage = useCallback((id: string | number) => {
+  // Delete message (NotificationStatus == Archived & move to trash)
+  const deleteMessage = useCallback(async (id: string | number) => {
     const strId = String(id);
     setTrashedIds(prev => {
       const next = prev.includes(strId) ? prev : [...prev, strId];
@@ -201,9 +209,22 @@ export function useInAppNotifications() {
       } catch {}
       return next;
     });
-  }, [trashStorageKey]);
 
-  const restoreMessage = useCallback((id: string | number) => {
+    queryClient.setQueryData<Notification[]>(['inapp-notifications', userId], (old = []) =>
+      old.map(n => (String(n.id) === strId ? { ...n, status: NotificationStatus.Archived } : n))
+    );
+
+    try {
+      await archiveNotification(id);
+    } catch (err) {
+      console.warn('[deleteMessage] Error archiving notification on server:', err);
+    } finally {
+      queryClient.invalidateQueries({ queryKey: ['inapp-notifications'] });
+    }
+  }, [trashStorageKey, userId, queryClient]);
+
+  // Restore from trash / unarchive
+  const restoreMessage = useCallback(async (id: string | number) => {
     const strId = String(id);
     setTrashedIds(prev => {
       const next = prev.filter(x => x !== strId);
@@ -213,7 +234,19 @@ export function useInAppNotifications() {
       } catch {}
       return next;
     });
-  }, [trashStorageKey]);
+
+    queryClient.setQueryData<Notification[]>(['inapp-notifications', userId], (old = []) =>
+      old.map(n => (String(n.id) === strId ? { ...n, status: NotificationStatus.Read } : n))
+    );
+
+    try {
+      await markNotificationAsRead(id);
+    } catch (err) {
+      console.warn('[restoreMessage] Error restoring notification on server:', err);
+    } finally {
+      queryClient.invalidateQueries({ queryKey: ['inapp-notifications'] });
+    }
+  }, [trashStorageKey, userId, queryClient]);
 
   const permanentDelete = useCallback((id: string | number) => {
     const strId = String(id);
@@ -270,8 +303,9 @@ export function useInAppNotifications() {
 
   const sendMessageMutation = useMutation({
     mutationFn: async (payload: {
-      recipientId: string;
+      recipientId?: string;
-      recipientEmail: string;
+      recipientEmail?: string;
+      recipient?: string;
       recipientName?: string;
       subject: string;
       message: string;
@@ -281,11 +315,23 @@ export function useInAppNotifications() {
     }) => {
       const orgId = payload.organisationId || getCurrentUserTenantId() || 1;
       const targetPlatform = payload.platform || NotificationPlatform.InApp;
-      const formattedDestination = `To: ${payload.recipientEmail} | From: ${userEmail || 'Partner User'}`;
+      const email = payload.recipientEmail || (payload.recipient?.includes('@') ? payload.recipient : '') || 'support@ifri.khongisa.co.za';
+      let id = payload.recipientId && payload.recipientId !== '00000000-0000-0000-0000-000000000000'
+        ? payload.recipientId
+        : (!payload.recipient?.includes('@') && payload.recipient !== '00000000-0000-0000-0000-000000000000' ? payload.recipient : '');
+
+      if (!id && email) {
+        id = (await resolveUserIdByEmail(email, orgId)) || '';
+      }
+
+      if (!id) {
+        id = '00000000-0000-0000-0000-000000000000';
+      }
+      const formattedDestination = `To: ${email} | From: ${userEmail || 'Partner User'}`;
 
       const req: CreateNotificationRequest = {
         organisationId: orgId,
-        recipient: payload.recipientId,
+        recipient: id,
         platform: targetPlatform,
         subject: payload.subject,
         destination: formattedDestination,
@@ -298,7 +344,7 @@ export function useInAppNotifications() {
       const sentItem: Notification = {
         id: `sent_${Date.now()}`,
         organisationId: orgId,
-        recipient: payload.recipientId,
+        recipient: payload.recipientId || payload.recipient || "",
         platform: targetPlatform,
         status: NotificationStatus.Sent,
         subject: payload.subject,

PostFundManagement.PartnerUI/src/lib/formatters.ts

@@ -93,6 +93,7 @@ export const NOTIFICATION_STATUS_OPTIONS = [
   { value: NotificationStatus.Cancelled, label: 'Cancelled' },
   { value: NotificationStatus.Bounced, label: 'Bounced' },
   { value: NotificationStatus.Draft, label: 'Draft' },
+  { value: NotificationStatus.Archived, label: 'Archived' },
 ];
 
 export const NOTIFICATION_PLATFORM_OPTIONS = [
@@ -462,14 +463,36 @@ export const getOrganisationTypeLabel = (type: OrganisationType | number): strin
   return opt ? opt.label : 'Organisation';
 };
 
-export const getIndustrySectorLabel = (sector: IndustrySector | number): string => {
+export const getIndustrySectorLabel = (sector?: IndustrySector | number | string | null): string => {
-  const opt = INDUSTRY_SECTOR_OPTIONS.find((o) => o.value === Number(sector));
+  if (sector === undefined || sector === null || sector === '') return '';
-  return opt ? opt.label : 'Industry Sector';
+  const num = Number(sector);
+  if (!isNaN(num)) {
+    const opt = INDUSTRY_SECTOR_OPTIONS.find((o) => o.value === num);
+    if (opt) return opt.label;
+  }
+  const str = String(sector).trim().toLowerCase();
+  for (const opt of INDUSTRY_SECTOR_OPTIONS) {
+    if (opt.label.toLowerCase() === str) return opt.label;
+    const enumKey = (IndustrySector as any)[opt.value];
+    if (enumKey && String(enumKey).toLowerCase() === str) return opt.label;
+  }
+  return String(sector).replace(/([a-z])([A-Z])/g, '$1 $2');
 };
 
-export const getProjectTypeLabel = (type: ProjectType | number): string => {
+export const getProjectTypeLabel = (type?: ProjectType | number | string | null): string => {
-  const opt = PROJECT_TYPE_OPTIONS.find((o) => o.value === Number(type));
+  if (type === undefined || type === null || type === '') return '';
-  return opt ? opt.label : 'Project Type';
+  const num = Number(type);
+  if (!isNaN(num)) {
+    const opt = PROJECT_TYPE_OPTIONS.find((o) => o.value === num);
+    if (opt) return opt.label;
+  }
+  const str = String(type).trim().toLowerCase();
+  for (const opt of PROJECT_TYPE_OPTIONS) {
+    if (opt.label.toLowerCase() === str) return opt.label;
+    const enumKey = (ProjectType as any)[opt.value];
+    if (enumKey && String(enumKey).toLowerCase() === str) return opt.label;
+  }
+  return String(type).replace(/([a-z])([A-Z])/g, '$1 $2');
 };
 
 export const getEvidenceTypeLabel = (type: EvidenceType | number): string => {
@@ -514,6 +537,8 @@ export const getEmailStatusBadge = (status?: EmailStatuses | number | null) => {
 export const getNotificationStatusBadge = (status?: NotificationStatus | number | null) => {
   const s = Number(status);
   switch (s) {
+    case NotificationStatus.Archived:
+      return { label: 'Archived', className: 'bg-slate-800 text-slate-300 border-slate-700 font-semibold' };
     case NotificationStatus.Draft:
       return { label: 'Draft', className: 'bg-purple-50 text-purple-800 border-purple-300 font-semibold' };
     case NotificationStatus.Delivered:

PostFundManagement.PartnerUI/src/lib/markdownUtils.ts

@@ -62,11 +62,62 @@ export function parseMarkdownToHtml(markdown: string): string {
     return `<code style="background:#1e293b;color:#34d399;padding:2px 6px;border-radius:6px;font-family:monospace;font-size:12px;">${escaped}</code>`;
   });
 
+  // Tables (| A | B |\n|---|---|\n| C | D |)
+  html = html.replace(/((?:\|[^\n]+\|\n?)+)/g, (match) => {
+    const rows = match.trim().split('\n');
+    if (rows.length < 2) return match;
+
+    const hasSeparator = rows[1] && rows[1].includes('---');
+    if (!hasSeparator) return match;
+
+    const parseCells = (row: string) =>
+      row
+        .split('|')
+        .slice(1, -1)
+        .map((c) => c.trim());
+
+    const headers = parseCells(rows[0]);
+    const bodyRows = rows.slice(2);
+
+    let tableHtml = `<div style="overflow-x:auto;margin:14px 0;"><table style="width:100%;border-collapse:collapse;border:1px solid #334155;border-radius:8px;font-size:12px;text-align:left;">`;
+    tableHtml += `<thead><tr style="background:#1e293b;color:#f8fafc;">`;
+    headers.forEach((h) => {
+      tableHtml += `<th style="padding:8px 12px;border:1px solid #334155;font-weight:600;">${h}</th>`;
+    });
+    tableHtml += `</tr></thead><tbody>`;
+
+    bodyRows.forEach((row, i) => {
+      const cells = parseCells(row);
+      const bg = i % 2 === 0 ? '#0f172a' : '#1e293b/40';
+      tableHtml += `<tr style="background:${bg};color:#cbd5e1;">`;
+      cells.forEach((c) => {
+        tableHtml += `<td style="padding:8px 12px;border:1px solid #334155;">${c}</td>`;
+      });
+      tableHtml += `</tr>`;
+    });
+
+    tableHtml += `</tbody></table></div>`;
+    return tableHtml;
+  });
+
   html = html.replace(/^#### (.*?)$/gm, '<h4 style="font-size:14px;font-weight:700;color:#f8fafc;margin:12px 0 6px 0;">$1</h4>');
   html = html.replace(/^### (.*?)$/gm, '<h3 style="font-size:16px;font-weight:700;color:#f8fafc;margin:14px 0 8px 0;">$1</h3>');
   html = html.replace(/^## (.*?)$/gm, '<h2 style="font-size:18px;font-weight:800;color:#ffffff;margin:16px 0 8px 0;border-bottom:1px solid #1e293b;padding-bottom:6px;">$1</h2>');
   html = html.replace(/^# (.*?)$/gm, '<h1 style="font-size:22px;font-weight:800;color:#ffffff;margin:18px 0 10px 0;border-bottom:1px solid #334155;padding-bottom:8px;">$1</h1>');
 
+  // Blockquotes and GitHub alerts
+  html = html.replace(/^>\s*\[!NOTE\]\s*(.*?)$/gim, '<div style="background:#0c4a6e22;border-left:4px solid #0284c7;padding:10px 14px;border-radius:8px;margin:10px 0;color:#bae6fd;font-size:12px;"><strong>NOTE:</strong> $1</div>');
+  html = html.replace(/^>\s*\[!IMPORTANT\]\s*(.*?)$/gim, '<div style="background:#83184322;border-left:4px solid #db2777;padding:10px 14px;border-radius:8px;margin:10px 0;color:#fbcfe8;font-size:12px;"><strong>IMPORTANT:</strong> $1</div>');
+  html = html.replace(/^>\s*\[!WARNING\]\s*(.*?)$/gim, '<div style="background:#713f1222;border-left:4px solid #d97706;padding:10px 14px;border-radius:8px;margin:10px 0;color:#fef08a;font-size:12px;"><strong>WARNING:</strong> $1</div>');
+  html = html.replace(/^>\s*\[!TIP\]\s*(.*?)$/gim, '<div style="background:#064e3b22;border-left:4px solid #059669;padding:10px 14px;border-radius:8px;margin:10px 0;color:#a7f3d0;font-size:12px;"><strong>TIP:</strong> $1</div>');
+  html = html.replace(/^>\s*(.*?)$/gm, '<blockquote style="border-left:3px solid #10b981;padding-left:12px;margin:8px 0;color:#94a3b8;font-style:italic;">$1</blockquote>');
+
+  // Horizontal Rules (---)
+  html = html.replace(/^(?:---|\*\*\*|___)\s*$/gm, '<hr style="border:none;border-top:1px solid #334155;margin:16px 0;" />');
+
+  // Strikethrough
+  html = html.replace(/~~(.*?)~~/g, '<del style="color:#64748b;">$1</del>');
+
   html = html.replace(/\*\*\*(.*?)\*\*\*/g, '<strong><em>$1</em></strong>');
   html = html.replace(/\*\*(.*?)\*\*/g, '<strong style="color:#ffffff;">$1</strong>');
   html = html.replace(/__(.*?)__/g, '<strong style="color:#ffffff;">$1</strong>');
@@ -98,3 +149,79 @@ export function parseMarkdownToHtml(markdown: string): string {
   return html;
 }
 
+
+
+/**
+ * Converts formatted HTML from WYSIWYG composition into clean, semantic Markdown.
+ * Preserves headings, bold, italic, blockquotes, lists, dividers, and links.
+ */
+export function htmlToMarkdown(html: string): string {
+  if (!html) return '';
+  let md = html
+    .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
+    .replace(/<style\b[^<]*(?:(?!<\/style>)<[^<]*)*<\/style>/gi, '');
+
+  // Line breaks & paragraph breaks
+  md = md.replace(/<br\s*\/?>/gi, '\n');
+  md = md.replace(/<\/p>/gi, '\n\n');
+  md = md.replace(/<p[^>]*>/gi, '');
+
+  // Headers
+  md = md.replace(/<h1[^>]*>(.*?)<\/h1>/gis, '# $1\n\n');
+  md = md.replace(/<h2[^>]*>(.*?)<\/h2>/gis, '## $1\n\n');
+  md = md.replace(/<h3[^>]*>(.*?)<\/h3>/gis, '### $1\n\n');
+  md = md.replace(/<h4[^>]*>(.*?)<\/h4>/gis, '#### $1\n\n');
+
+  // Bold / Italic / Underline
+  md = md.replace(/<(strong|b)[^>]*>(.*?)<\/\1>/gis, '**$2**');
+  md = md.replace(/<(em|i)[^>]*>(.*?)<\/\1>/gis, '*$2*');
+  md = md.replace(/<u[^>]*>(.*?)<\/u>/gis, '$1');
+
+  // Blockquote
+  md = md.replace(/<blockquote[^>]*>(.*?)<\/blockquote>/gis, (_match, p1) => {
+    return (
+      p1
+        .trim()
+        .split('\n')
+        .map((l: string) => `> ${l.trim()}`)
+        .join('\n') + '\n\n'
+    );
+  });
+
+  // Unordered Lists
+  md = md.replace(/<ul[^>]*>(.*?)<\/ul>/gis, (_match, p1) => {
+    return p1.replace(/<li[^>]*>(.*?)<\/li>/gis, '- $1\n') + '\n';
+  });
+
+  // Ordered Lists
+  md = md.replace(/<ol[^>]*>(.*?)<\/ol>/gis, (_match, p1) => {
+    let index = 1;
+    return p1.replace(/<li[^>]*>(.*?)<\/li>/gis, () => `${index++}. $1\n`) + '\n';
+  });
+
+  // Horizontal Rules
+  md = md.replace(/<hr\s*\/?>/gi, '\n---\n\n');
+
+  // Links
+  md = md.replace(/<a\b[^>]*href=["']([^"']*)["'][^>]*>(.*?)<\/a>/gis, '[$2]($1)');
+
+  // Divs
+  md = md.replace(/<\/div>/gi, '\n');
+  md = md.replace(/<div[^>]*>/gi, '');
+
+  // Strip any remaining HTML tags
+  md = md.replace(/<[^>]+>/g, '');
+
+  // Unescape standard HTML entities
+  md = md
+    .replace(/&nbsp;/g, ' ')
+    .replace(/&amp;/g, '&')
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'");
+
+  // Collapse 3+ newlines into 2
+  return md.replace(/\n{3,}/g, '\n\n').trim();
+}
+

PostFundManagement.PartnerUI/src/lib/queryClient.ts

@@ -4,15 +4,38 @@ import { bumpMutationEpoch } from '../services/httpClient';
 export const queryClient = new QueryClient({
   defaultOptions: {
     queries: {
-      staleTime: 1000 * 60 * 2, // 2 minutes fresh in memory
+      // Remove caching from all pages: zero stale time and zero cache retention
-      gcTime: 1000 * 60 * 10,   // 10 minutes cache retention
+      // Whenever a component needs data, it must call its corresponding endpoint(s)
-      refetchOnWindowFocus: false,
+      staleTime: 0,
-      refetchOnReconnect: true,
+      gcTime: 0,
+      refetchOnMount: 'always',
+      refetchOnWindowFocus: 'always',
+      refetchOnReconnect: 'always',
       retry: 1,
     },
   },
 });
 
+// Retain caching ONLY for sync status, auth token, roles and grants
+const RETAINED_CACHE_OPTIONS = {
+  staleTime: 5 * 60 * 1000,
+  gcTime: 10 * 60 * 1000,
+  refetchOnMount: false,
+  refetchOnWindowFocus: false,
+};
+
+queryClient.setQueryDefaults(['roles'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['system-roles'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['role-claims'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['user-roles'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['user-claims'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['grants'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['user-grants'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['user-sync'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['sync-status'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['auth'], RETAINED_CACHE_OPTIONS);
+queryClient.setQueryDefaults(['auth-token'], RETAINED_CACHE_OPTIONS);
+
 /**
  * Invalidates queries while simultaneously bumping the mutation epoch.
  */

PostFundManagement.PartnerUI/src/services/api/endpoints.ts

@@ -374,7 +374,7 @@ export const evidenceApi = {
     apiClient.get<Models.Evidence[]>(`/v1/api/evidence/milestone/${hashParam(milestoneId)}`),
 
   getProjectEvidence: (projectId: string | number) =>
-    apiClient.get<Models.Evidence[]>(`/v1/api/evidence/${hashParam(projectId)}`),
+    apiClient.get<Models.Evidence[]>(`/v1/api/evidence/projects/${hashParam(projectId)}`),
 
   createMilestoneRequest: (payload: Models.CreateMilestoneRequest) =>
     apiClient.post<Models.Milestone>('/v1/api/evidence/milestones', payload),

PostFundManagement.PartnerUI/src/services/api/index.ts

@@ -109,6 +109,7 @@ import {
   UpdateRuleRequest,
   Pagination,
   Notification,
+  NotificationPlatform,
   NotificationStatus,
   Role,
   Claim,
@@ -810,6 +811,7 @@ export const updateActivity = async (payload: UpdateActivityRequest): Promise<Ac
     : null;
 
   const body = {
+    activityId: toIntegerId(payload.activityId),
     projectId: toIntegerId(payload.projectId),
     milestoneId: toNullableIntegerId(payload.milestoneId),
     category: payload.category || 'Operations',
@@ -830,6 +832,46 @@ export const updateActivity = async (payload: UpdateActivityRequest): Promise<Ac
   }
 };
 
+
+export const submitActivityForApproval = async (
+  activity: Activity,
+  projectId: number | string,
+  evidences?: Evidence[]
+): Promise<void> => {
+  if (evidences && evidences.length > 0) {
+    for (const ev of evidences) {
+      if (Number(ev.status) === ApprovalStatus.Pending) {
+        try {
+          await updateEvidence({
+            evidenceId: ev.id,
+            version: ev.version || 1,
+            evidenceType: (ev as any).evidenceType ?? ev.type,
+            status: ApprovalStatus.Review,
+          });
+        } catch (e) {
+          console.warn('Could not update evidence status', ev.id, e);
+        }
+      }
+    }
+  }
+
+  try {
+    await updateActivity({
+      activityId: activity.id,
+      projectId,
+      milestoneId: activity.milestoneId,
+      category: activity.category || 'Operations',
+      amount: activity.amount || 0,
+      title: activity.title || 'Activity',
+      description: activity.description || '',
+      performedAt: new Date().toISOString(),
+      status: ApprovalStatus.Review,
+    });
+  } catch (e) {
+    console.warn('Could not update activity fulfillment record', e);
+  }
+};
+
 export const getMilestones = async (projectId: string | number): Promise<Milestone[]> => {
   const hashedProjectId = await toolsService.resolveProjectId(projectId);
   try {
@@ -1377,12 +1419,12 @@ export const getMilestoneEvidence = async (milestoneId: string | number): Promis
 export const getProjectEvidence = async (projectId: string | number): Promise<Evidence[]> => {
   try {
     const hashedProjectId = await toolsService.resolveProjectId(projectId);
-    const res = await apiClient.get<Evidence[]>(`/v1/api/evidence/${hashedProjectId}`);
+    const res = await apiClient.get<Evidence[]>(`/v1/api/evidence/projects/${hashedProjectId}`);
     return res.data || [];
   } catch (err: any) {
     if ((err?.response?.status === 404 || err?.response?.status === 400) && String(projectId) !== '') {
       try {
-        const rawRes = await apiClient.get<Evidence[]>(`/v1/api/evidence/${projectId}`);
+        const rawRes = await apiClient.get<Evidence[]>(`/v1/api/evidence/projects/${projectId}`);
         return rawRes.data || [];
       } catch (fallbackErr: any) {
         if (fallbackErr?.response?.status === 404) {
@@ -1857,7 +1899,9 @@ export const createNotification = async (payload: CreateNotificationRequest): Pr
     subject: payload.subject || null,
     destination: payload.destination || 'In-App User Inbox',
     message: payload.message,
-    status: payload.status !== undefined ? payload.status : undefined,
+    status: payload.status !== undefined
+      ? payload.status
+      : (Number(payload.platform) === NotificationPlatform.InApp ? NotificationStatus.Delivered : undefined),
   });
 };
 
@@ -1879,6 +1923,13 @@ export const markNotificationAsRead = async (notificationId: number | string): P
 };
 
 // ==========================================
+export const archiveNotification = async (notificationId: number | string): Promise<void> => {
+  await updateNotification({
+    notificationId: toIntegerId(notificationId),
+    status: NotificationStatus.Archived,
+  });
+};
+
 // 9. Governance: Tenants APIs
 // ==========================================
 export const getTenants = async (): Promise<Tenant[]> => {
@@ -1955,6 +2006,91 @@ export const getTenantUsers = async (tenantId: string | number): Promise<TenantU
 };
 
 // ==========================================
+/**
+ * Resolves a recipient user GUID by email address across TenantUsers and Directory.
+ * Automatically caches any found user emails and IDs in local memory.
+ */
+export const resolveUserIdByEmail = async (
+  email: string,
+  hintTenantOrOrgId?: number | string
+): Promise<string | undefined> => {
+  if (!email || typeof email !== 'string' || !email.includes('@')) {
+    return undefined;
+  }
+  const cleanEmail = email.trim().toLowerCase();
+
+  // 1. Fast cache check
+  const cachedId = getUserIdByEmail(cleanEmail);
+  if (cachedId && cachedId !== '00000000-0000-0000-0000-000000000000') {
+    return cachedId;
+  }
+
+  const matchInTenantUsers = (tenantUsers: TenantUser[]): string | undefined => {
+    if (!Array.isArray(tenantUsers)) return undefined;
+    let match: string | undefined = undefined;
+    for (const tu of tenantUsers) {
+      const uId = tu.userId || tu.user?.id;
+      const uEmail = tu.user?.email || (tu as any)?.email;
+      if (uId && uEmail) {
+        registerUserEmail(uId, uEmail);
+        if (String(uEmail).trim().toLowerCase() === cleanEmail) {
+          match = String(uId).trim();
+        }
+      }
+    }
+    return match;
+  };
+
+  // 2. Query tenant users with hintTenantOrOrgId
+  if (hintTenantOrOrgId) {
+    try {
+      const users = await getTenantUsers(hintTenantOrOrgId);
+      const match = matchInTenantUsers(users);
+      if (match) return match;
+    } catch {}
+  }
+
+  // 3. Query all tenants from getTenants and their users
+  try {
+    const tenants = await getTenants();
+    for (const t of tenants) {
+      if (hintTenantOrOrgId && String(t.id) === String(hintTenantOrOrgId)) continue;
+      try {
+        const users = await getTenantUsers(t.id);
+        const match = matchInTenantUsers(users);
+        if (match) return match;
+      } catch {}
+    }
+  } catch {}
+
+  // 4. Try standard fallback tenant IDs
+  for (const tid of [1, 2, 3]) {
+    if (hintTenantOrOrgId && String(tid) === String(hintTenantOrOrgId)) continue;
+    try {
+      const users = await getTenantUsers(tid);
+      const match = matchInTenantUsers(users);
+      if (match) return match;
+    } catch {}
+  }
+
+  // 5. Query user directory fallback
+  try {
+    const dirUsers = await apiClient.post<User[]>('/v1/api/users/1/200', {});
+    if (Array.isArray(dirUsers.data)) {
+      for (const u of dirUsers.data) {
+        if (u && u.id && u.email) {
+          registerUserEmail(u.id, u.email);
+          if (u.email.trim().toLowerCase() === cleanEmail) {
+            return String(u.id).trim();
+          }
+        }
+      }
+    }
+  } catch {}
+
+  return undefined;
+};
+
 // 10. Projects: Beneficiaries & Outcomes APIs
 // ==========================================
 export const getProjectBeneficiaries = async (projectId: string | number): Promise<Beneficiary[]> => {

PostFundManagement.PartnerUI/src/services/httpClient.ts

@@ -39,6 +39,8 @@ export const apiClient = axios.create({
   headers: {
     'Content-Type': 'application/json; version=1',
     Accept: 'application/json; version=1',
+    'Cache-Control': 'no-cache, no-store, must-revalidate',
+    Pragma: 'no-cache',
   },
   timeout: 15000,
 });
@@ -58,33 +60,18 @@ apiClient.interceptors.request.use(
       config.url?.includes('amazonaws.com') ||
       config.url?.includes('garage');
 
+    // Always attach freshness timestamp and mutation epoch to internal GET requests
+    // to guarantee zero stale data, bypass browser HTTP caches, and prevent stale OutputCache hits
     if (config.method?.toUpperCase() === 'GET' && !isExternal) {
-      const headers = config.headers || {};
-      const hasNoCacheHeader =
-        headers['Cache-Control'] === 'no-cache' ||
-        headers['cache-control'] === 'no-cache' ||
-        headers['Pragma'] === 'no-cache';
-
-      if (hasNoCacheHeader) {
       if (config.params instanceof URLSearchParams) {
         config.params.set('_t', String(Date.now()));
+        config.params.set('_v', String(getMutationEpoch()));
       } else {
         config.params = config.params || {};
         config.params._t = Date.now();
-        }
-      } else {
-        if (config.params instanceof URLSearchParams) {
-          if (!config.params.has('_v') && !config.params.has('_t')) {
-            config.params.set('_v', String(getMutationEpoch()));
-          }
-        } else {
-          config.params = config.params || {};
-          if (!config.params._v && !config.params._t) {
         config.params._v = getMutationEpoch();
       }
     }
-      }
-    }
 
     if (token && !isLifecycleRequest) {
       if (isActivationPending()) {

PostFundManagement.PartnerUI/src/services/tenantLockoutService.ts

@@ -157,12 +157,20 @@ export async function verifyTenantLockout(
   }
 
   if (!tenantRes || (typeof tenantRes === 'object' && Object.keys(tenantRes).length === 0)) {
-    const serverMsg =
+    let serverMsg =
       lastError?.response?.data?.detail ||
       lastError?.response?.data?.message ||
       lastError?.message ||
       'No tenant record returned';
 
+    if (typeof serverMsg === 'string') {
+      if (/^network\s*error$/i.test(serverMsg.trim())) {
+        serverMsg = 'Permission Check';
+      } else {
+        serverMsg = serverMsg.replace(/network\s*error/gi, 'Permission Check');
+      }
+    }
+
     const errorMsg = `Tenant record could not be retrieved (${serverMsg}). Account is locked out.`;
     setActivationPending(true, errorMsg);
     return {

PostFundManagement.PartnerUI/src/services/toolsService.ts

@@ -5,15 +5,17 @@ const env = (typeof import.meta !== 'undefined' && import.meta.env
   ? import.meta.env
   : {}) as Record<string, string | undefined>;
 
+export const DEFAULT_HASHER_SALT =
+  'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==';
+export const DEFAULT_MIN_HASH_LENGTH = 11;
+
 /**
  * Deterministic Hashids configuration matching pfm-api HasherSettings.
  * Ensures 100% interoperability with the C# Hashids.net NuGet package on the backend.
  */
 export const HASHER_SETTINGS = {
-  minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || 11,
+  minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || DEFAULT_MIN_HASH_LENGTH,
-  salt:
+  salt: (env.VITE_HASHER_SALT as string) || DEFAULT_HASHER_SALT,
-    (env.VITE_HASHER_SALT as string) ||
-    'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==',
 };
 
 let hasher = new Hashids(HASHER_SETTINGS.salt, HASHER_SETTINGS.minHashLength);
@@ -23,9 +25,13 @@ export function updateHasherSettings(salt?: string, minLength?: number | string)
   if (salt && typeof salt === 'string' && salt.trim() !== '') {
     HASHER_SETTINGS.salt = salt.trim();
     updated = true;
+  } else if (!HASHER_SETTINGS.salt) {
+    HASHER_SETTINGS.salt = DEFAULT_HASHER_SALT;
+    updated = true;
   }
   if (minLength !== undefined && minLength !== null && minLength !== '') {
-    const parsed = Number(minLength);
+    const cleanMin = String(minLength).replace(/[^0-9]/g, '');
+    const parsed = Number(cleanMin);
     if (!isNaN(parsed) && parsed > 0) {
       HASHER_SETTINGS.minHashLength = parsed;
       updated = true;
@@ -36,8 +42,9 @@ export function updateHasherSettings(salt?: string, minLength?: number | string)
   }
 }
 
-export function isAlreadyHashId(candidate: string): boolean {
+export function isAlreadyHashId(candidate: string | null | undefined): boolean {
   if (
+    !candidate ||
     typeof candidate !== 'string' ||
     candidate.length < HASHER_SETTINGS.minHashLength ||
     /^\d+$/.test(candidate)
@@ -49,21 +56,29 @@ export function isAlreadyHashId(candidate: string): boolean {
     if (!Array.isArray(decoded) || decoded.length === 0) {
       return false;
     }
-    return hasher.encode(decoded as number[]) === candidate;
+    return hasher.encode(decoded as any) === candidate;
   } catch {
     return false;
   }
 }
 
-export function encodeHashIdSync(id: number | string | null | undefined): string {
+export function encodeHashIdSync(id: number | string | bigint | null | undefined): string {
   if (id === undefined || id === null || id === '') {
     return '';
   }
 
+  if (typeof id === 'bigint') {
+    if (id < 0n) return '';
+    return hasher.encode(id);
+  }
+
   if (typeof id === 'number') {
     if (isNaN(id) || !isFinite(id) || id < 0) return '';
+    if (id <= Number.MAX_SAFE_INTEGER) {
       return hasher.encode(id);
     }
+    return hasher.encode(BigInt(Math.trunc(id)));
+  }
 
   const str = String(id).trim();
   if (!str) return '';
@@ -74,10 +89,8 @@ export function encodeHashIdSync(id: number | string | null | undefined): string
 
   if (/^\d+$/.test(str)) {
     try {
-      const num = parseInt(str, 10);
+      // JavaScript hashids v2 natively supports BigInt, matching C# Hashids.net EncodeLong without int64 precision loss
-      if (!isNaN(num) && num >= 0) {
+      return hasher.encode(BigInt(str));
-        return hasher.encode(num);
-      }
     } catch {
       // Fall through
     }
@@ -86,22 +99,37 @@ export function encodeHashIdSync(id: number | string | null | undefined): string
   return str;
 }
 
-export function decodeHashIdSync(hashId: string | number | null | undefined): number | string {
+export function decodeHashIdSync(hashId: string | number | bigint | null | undefined): number | string {
   if (hashId === undefined || hashId === null || hashId === '') return '';
   if (typeof hashId === 'number') return hashId;
+  if (typeof hashId === 'bigint') return hashId.toString();
 
   const str = String(hashId).trim();
   if (!str) return '';
 
   if (/^-?\d+$/.test(str)) {
-    const parsed = parseInt(str, 10);
+    try {
-    return isNaN(parsed) ? str : parsed;
+      const b = BigInt(str);
+      if (b <= BigInt(Number.MAX_SAFE_INTEGER) && b >= BigInt(Number.MIN_SAFE_INTEGER)) {
+        return Number(b);
+      }
+      return str;
+    } catch {
+      return str;
+    }
   }
 
   try {
     const decoded = hasher.decode(str);
     if (Array.isArray(decoded) && decoded.length > 0) {
-      return Number(decoded[0]);
+      const val = decoded[0];
+      if (typeof val === 'bigint') {
+        if (val <= BigInt(Number.MAX_SAFE_INTEGER) && val >= BigInt(Number.MIN_SAFE_INTEGER)) {
+          return Number(val);
+        }
+        return val.toString();
+      }
+      return Number(val);
     }
   } catch {
     // If decoding fails, return raw string
@@ -110,11 +138,14 @@ export function decodeHashIdSync(hashId: string | number | null | undefined): nu
   return str;
 }
 
-export function decodeToNumberSync(hashId: number | string | null | undefined): number {
+export function decodeToNumberSync(hashId: number | string | bigint | null | undefined): number {
   if (hashId === null || hashId === undefined || hashId === '') return 0;
   if (typeof hashId === 'number') {
     return isNaN(hashId) ? 0 : Math.trunc(hashId);
   }
+  if (typeof hashId === 'bigint') {
+    return Number(hashId);
+  }
   const str = String(hashId).trim();
   if (/^-?\d+$/.test(str)) {
     const parsed = parseInt(str, 10);
@@ -131,19 +162,19 @@ export function decodeToNumberSync(hashId: number | string | null | undefined):
 }
 
 export const toolsService = {
-  encodeIdSync(id: number | string | null | undefined): string {
+  encodeIdSync(id: number | string | bigint | null | undefined): string {
     return encodeHashIdSync(id);
   },
 
-  decodeIdSync(hashId: string | number | null | undefined): number | string {
+  decodeIdSync(hashId: string | number | bigint | null | undefined): number | string {
     return decodeHashIdSync(hashId);
   },
 
-  decodeToNumberSync(hashId: number | string | null | undefined): number {
+  decodeToNumberSync(hashId: number | string | bigint | null | undefined): number {
     return decodeToNumberSync(hashId);
   },
 
-  async encodeId(id: number | string | null | undefined, _context = 'general'): Promise<string> {
+  async encodeId(id: number | string | bigint | null | undefined, _context = 'general'): Promise<string> {
     return encodeHashIdSync(id);
   },
 
@@ -151,35 +182,35 @@ export const toolsService = {
     return decodeHashIdSync(hashId);
   },
 
-  async resolveProjectId(projectId: number | string): Promise<string> {
+  async resolveProjectId(projectId: number | string | bigint): Promise<string> {
     return encodeHashIdSync(projectId);
   },
 
-  async resolveOrganisationId(organisationId: number | string): Promise<string> {
+  async resolveOrganisationId(organisationId: number | string | bigint): Promise<string> {
     return encodeHashIdSync(organisationId);
   },
 
-  async resolveProgrammeId(programmeId: number | string): Promise<string> {
+  async resolveProgrammeId(programmeId: number | string | bigint): Promise<string> {
     return encodeHashIdSync(programmeId);
   },
 
-  async resolvePortfolioId(portfolioId: number | string): Promise<string> {
+  async resolvePortfolioId(portfolioId: number | string | bigint): Promise<string> {
     return encodeHashIdSync(portfolioId);
   },
 
-  async resolveAwardId(awardId: number | string): Promise<string> {
+  async resolveAwardId(awardId: number | string | bigint): Promise<string> {
     return encodeHashIdSync(awardId);
   },
 
-  async resolveContractId(contractId: number | string): Promise<string> {
+  async resolveContractId(contractId: number | string | bigint): Promise<string> {
     return encodeHashIdSync(contractId);
   },
 
-  async resolveActivityId(activityId: number | string): Promise<string> {
+  async resolveActivityId(activityId: number | string | bigint): Promise<string> {
     return encodeHashIdSync(activityId);
   },
 
-  async resolveMilestoneId(milestoneId: number | string): Promise<string> {
+  async resolveMilestoneId(milestoneId: number | string | bigint): Promise<string> {
     return encodeHashIdSync(milestoneId);
   },
 
@@ -202,7 +233,7 @@ export const toolsService = {
   },
 };
 
-export function useHashId(id?: number | string | null, context = 'general') {
+export function useHashId(id?: number | string | bigint | null, context = 'general') {
   return useQuery({
     queryKey: ['hashId', context, id !== undefined && id !== null ? String(id) : ''],
     queryFn: () => Promise.resolve(encodeHashIdSync(id)),

PostFundManagement.PartnerUI/src/services/userSyncService.ts

@@ -263,13 +263,21 @@ export async function syncUserAccount(
       }
 
       clearSuccessfulSyncRecord();
-      const serverMsg =
+      let serverMsg =
         err?.response?.data?.detail ||
         err?.response?.data?.message ||
         err?.response?.data?.error ||
         err?.message ||
         'Account is not yet enabled by the administrator.';
 
+      if (typeof serverMsg === 'string') {
+        if (/^network\s*error$/i.test(serverMsg.trim())) {
+          serverMsg = 'Permission Check';
+        } else {
+          serverMsg = serverMsg.replace(/network\s*error/gi, 'Permission Check');
+        }
+      }
+
       setActivationPending(true, serverMsg);
 
       return {

PostFundManagement.PartnerUI/src/types.ts

@@ -29,6 +29,7 @@ export enum NotificationStatus {
   Cancelled = 8,
   Bounced = 9,
   Draft = 10,
+  Archived = 11,
 }
 
 export enum NotificationPlatform {

PostFundManagement.PartnerUI/src/utils/hashids.ts

@@ -4,11 +4,13 @@ const env = (typeof import.meta !== 'undefined' && import.meta.env
   ? import.meta.env
   : {}) as Record<string, string | undefined>;
 
+export const DEFAULT_HASHER_SALT =
+  'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==';
+export const DEFAULT_MIN_HASH_LENGTH = 11;
+
 export const HASHER_SETTINGS = {
-  minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || 11,
+  minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || DEFAULT_MIN_HASH_LENGTH,
-  salt:
+  salt: (env.VITE_HASHER_SALT as string) || DEFAULT_HASHER_SALT,
-    (env.VITE_HASHER_SALT as string) ||
-    'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==',
 };
 
 let hasher = new Hashids(HASHER_SETTINGS.salt, HASHER_SETTINGS.minHashLength);
@@ -18,9 +20,13 @@ export function updateHasherSettings(salt?: string, minLength?: number | string)
   if (salt && typeof salt === 'string' && salt.trim() !== '') {
     HASHER_SETTINGS.salt = salt.trim();
     updated = true;
+  } else if (!HASHER_SETTINGS.salt) {
+    HASHER_SETTINGS.salt = DEFAULT_HASHER_SALT;
+    updated = true;
   }
   if (minLength !== undefined && minLength !== null && minLength !== '') {
-    const parsed = Number(minLength);
+    const cleanMin = String(minLength).replace(/[^0-9]/g, '');
+    const parsed = Number(cleanMin);
     if (!isNaN(parsed) && parsed > 0) {
       HASHER_SETTINGS.minHashLength = parsed;
       updated = true;
@@ -48,7 +54,7 @@ export function isHashId(candidate: string | null | undefined): boolean {
     if (
       Array.isArray(decodedNumbers) &&
       decodedNumbers.length > 0 &&
-      hasher.encode(decodedNumbers as number[]) === candidate
+      hasher.encode(decodedNumbers as any) === candidate
     ) {
       return true;
     }
@@ -151,23 +157,24 @@ export function toSafeInt64String(val: string | number | bigint | null | undefin
 
 /**
  * Deterministically encodes a numeric ID or 64-bit integer into a standard HashID string.
+ * Uses BigInt for full int64 range, interoperable with C# Hashids.net EncodeLong.
  */
 export function encodeEntityId(id: string | number | bigint | null | undefined): string {
   if (id === undefined || id === null || id === '') return '';
 
-  const str = typeof id === 'bigint' ? id.toString() : String(id).trim();
+  if (typeof id === 'bigint') {
+    if (id < 0n) return '';
+    return hasher.encode(id);
+  }
+
+  const str = String(id).trim();
   if (!str) return '';
 
   if (isHashId(str)) return str;
 
   if (/^\d+$/.test(str)) {
     try {
-      const num = Number(str);
+      return hasher.encode(BigInt(str));
-      if (num <= Number.MAX_SAFE_INTEGER && num >= 0) {
-        return hasher.encode(num);
-      }
-      const bigHex = BigInt(str).toString(16);
-      return hasher.encodeHex(bigHex);
     } catch {
       // Fall through
     }
@@ -191,18 +198,9 @@ export function decodeEntityId(hashId: string | number | null | undefined): stri
     if (Array.isArray(decoded) && decoded.length > 0) {
       return decoded[0].toString();
     }
-    const decodedHex = hasher.decodeHex(str);
-    if (decodedHex) {
-      try {
-        return BigInt('0x' + decodedHex).toString();
-      } catch {
-        return decodedHex;
-      }
-    }
   } catch {
     // Return raw
   }
 
   return str;
 }
-

PostFundManagement.PartnerUI/src/vite-env.d.ts

@@ -0,0 +1,16 @@
+/// <reference types="vite/client" />
+
+interface ImportMetaEnv {
+  readonly VITE_OIDC_AUTHORITY?: string;
+  readonly VITE_OIDC_AUDIENCE?: string;
+  readonly VITE_OIDC_CLIENT_ID?: string;
+  readonly VITE_API_BASE_URL?: string;
+  readonly VITE_HASHER_SALT?: string;
+  readonly VITE_HASHER_MIN_LENGTH?: string;
+  readonly [key: string]: any;
+}
+
+interface ImportMeta {
+  readonly env: ImportMetaEnv;
+}
+

PostFundManagement.PartnerUI/tsconfig.json

@@ -4,7 +4,6 @@
     "experimentalDecorators": true,
     "useDefineForClassFields": false,
     "module": "ESNext",
-    "types": ["vite/client"],
     "lib": [
       "ES2022",
       "DOM",

PostFundManagement.slnx

@@ -1,4 +1,13 @@
 <Solution>
+  <Folder Name="/Presentation/">
+    <Project Path="PostFundManagement.Api/PostFundManagement.Api.csproj" />
+    <Project Path="PostFundManagement.Jobs/PostFundManagement.Jobs.csproj" Id="81281806-b5ca-4784-87af-3e8feeac988c" />
+  </Folder>
+  <Folder Name="/Shared/">
+    <Project Path="PostFundManagement.Application/PostFundManagement.Application.csproj" Id="750c7754-53a7-4573-abed-5c436246a04d" />
+    <Project Path="PostFundManagement.Domain/PostFundManagement.Domain.csproj" />
+    <Project Path="PostFundManagement.Infrastructure/PostFundManagement.Infrastructure.csproj" />
+  </Folder>
   <Folder Name="/Solution Items/">
     <File Path=".editorconfig" />
     <File Path=".gitignore" />
@@ -9,9 +18,7 @@
     <File Path="PostFundManagement.snk" />
     <File Path="README.md" />
   </Folder>
-  <Project Path="PostFundManagement.Api/PostFundManagement.Api.csproj" />
+  <Folder Name="/Tests/">
-  <Project Path="PostFundManagement.Application/PostFundManagement.Application.csproj" Id="750c7754-53a7-4573-abed-5c436246a04d" />
-  <Project Path="PostFundManagement.Domain/PostFundManagement.Domain.csproj" />
-  <Project Path="PostFundManagement.Infrastructure/PostFundManagement.Infrastructure.csproj" />
     <Project Path="PostFundManagement.Tests/PostFundManagement.Tests.csproj" Id="ce650d27-8a68-436d-b5c1-db25f2286e85" />
+  </Folder>
 </Solution>

docker-compose.yml

@@ -1,4 +1,62 @@
 services:
+  pfm-scheduler:
+    image: pfm-scheduler
+    build:
+      context: .
+      dockerfile: ./PostFundManagement.Jobs/Dockerfile
+      network: host
+    container_name: pfm-scheduler
+    environment:
+      # Service layer caching feature flag
+      - FeatureManagement__JobsWorker=${FEATURE_JOBS_WORKER}
+      - FeatureManagement__EmailProcessorJobEnabled=${FEATURE_EMAIL_PROCESSOR_JOB_ENABLED}
+      - FeatureManagement__ServiceCaching=${FEATURE_SERVICE_CACHING}
+
+      # Header forwarding overrides
+      - DOTNET_ENVIRONMENT=${ENVIRONMENT:-Development}
+      
+      # Postgres Database Overrides      
+      - ConnectionStrings__PfmDatabase=Server=${POSTGRES_HOST:-192.168.1.170};Port=${POSTGRES_PORT:-5432};Database=${POSTGRES_DB:-pfm};User Id=${POSTGRES_USER:-pfm-user};Password=${POSTGRES_PASSWORD:-};
+      - ConnectionStrings__PfmSchedulerDatabase=Server=${POSTGRES_HOST:-192.168.1.170};Port=${POSTGRES_PORT:-5432};Database=pfm-scheduler;User Id=${POSTGRES_USER:-pfm-user};Password=${POSTGRES_PASSWORD:-};
+      
+      # Garage S3 Settings
+      - GeneralS3Settings__ServiceUrl=${GENERAL_S3_SERVICE_URL:-https://s3.garage.khongisa.co.za}
+      - GeneralS3Settings__Region=${GENERAL_S3_REGION:-garage}
+      - GeneralS3Settings__BucketName=${GENERAL_S3_BUCKET_NAME:-pfm}
+      - GeneralS3Settings__CdnBaseUrl=${GENERAL_S3_CDN_BASE_URL:-https://pfm.cdn.khongisa.co.za}
+      - GeneralS3Settings__AccessKey=${GENERAL_S3_ACCESS_KEY:-}
+      - GeneralS3Settings__SecretKey=${GENERAL_S3_SECRET_KEY:-}
+
+      # Skoruba Duende Administration Security Overrides
+      - ConnectionStrings__SkorubaApi=${SKORUBA_ADMIN_API:-https://api.security.khongisa.co.za/}
+      - MachineIdentitySettings__Authority=${ADMIN_SECURITY_AUTHORITY:-https://sts.security.khongisa.co.za}
+      - MachineIdentitySettings__Scope=${ADMIN_SECURITY_SCOPE:-}
+      - MachineIdentitySettings__ClientId=${ADMIN_SECURITY_CLIENT_ID:-}
+      - MachineIdentitySettings__ClientSecret=${ADMIN_SECURITY_CLIENT_SECRET:-}
+      
+      # HashIds overrides
+      - HasherSettings__MinHashLength=${HASHER_MIN_HASH_LENGTH:-11}
+      - HasherSettings__Salt=${HASHER_SALT:-}      
+
+      # Data Protection Overrides
+      - DataProtection__Certificate=${DATA_PROTECTION_CERTIFICATE:-}
+      - DataProtection__Password=${DATA_PROTECTION_CERTIFICATE_PASSWORD:-}
+
+      # Monitoring Overrides
+      - Monitoring__Address=${MONITORING_ADDRESS:-http://aspire-dashboard-service.aspire.svc.cluster.local:18889}
+      - Monitoring__ServiceName=${MONITORING_SERVICE_NAME:-Pfm.DEV}
+      - Monitoring__ApiKey=${MONITORING_API_KEY:-}
+
+      # Email Processor Overrides
+      - Email__ProcessorJobCron=${EMAIL_PROCESSOR_CRON:-0 */5 * * * ?}
+      - Email__Credentials__Password=${EMAIL_CREDENTIALS_PASSWORD:-}
+      - Email__Credentials__Username=${EMAIL_CREDENTIALS_USERNAME:-}
+      - Email__SmtpServer=${EMAIL_SMTP_SERVER:-}
+      - Email__SmtpPort=${EMAIL_SMTP_PORT:-587}
+      
+      # Redis overrides 
+      - ConnectionStrings__Redis=${REDIS_CONNECTION_STRING:-192.168.1.171:6379,ssl=false,abortConnect=false}
+    restart: unless-stopped
   pfm-api:
     image: pfm-api
     build:
@@ -9,9 +67,6 @@ services:
     ports:
       - "8075:8080"
     environment:      
-      # Service layer caching feature flag
-      - EnableServiceCaching=false
-
       # Header forwarding overrides
       - ASPNETCORE_ENVIRONMENT=${ENVIRONMENT:-Development}
       - ForwardedHeadersConfiguration__Enabled=true
@@ -22,6 +77,7 @@ services:
       - CorsOrigins__0=${CORS_ORIGIN_CONSOLE:-https://console.ifri.khongisa.co.za}
       - CorsOrigins__1=${CORS_ORIGIN_API:-https://api.ifri.khongisa.co.za}
       - CorsOrigins__2=${CORS_ORIGIN_LOCAL:-https://localhost:7208}
+      - CorsOrigins__3=${CORS_ORIGIN_PARTNER:-https://partner.ifri.khongisa.co.za}
       
       # Postgres Database Overrides      
       - ConnectionStrings__PfmDatabase=Server=${POSTGRES_HOST:-192.168.1.170};Port=${POSTGRES_PORT:-5432};Database=${POSTGRES_DB:-pfm};User Id=${POSTGRES_USER:-pfm-user};Password=${POSTGRES_PASSWORD:-};
@@ -61,13 +117,6 @@ services:
       - Monitoring__ServiceName=${MONITORING_SERVICE_NAME:-Pfm.DEV}
       - Monitoring__ApiKey=${MONITORING_API_KEY:-}
       
-      # Email Processor Overrides
-      - EmailProcessorCron=${EMAIL_PROCESSOR_CRON:-}
-      - Email__Credentials__Password=${EMAIL_CREDENTIALS_PASSWORD:-}
-      - Email__Credentials__Username=${EMAIL_CREDENTIALS_USERNAME:-}
-      - Email__SmtpServer=${EMAIL_SMTP_SERVER:-}
-      - Email__SmtpPort=${EMAIL_SMTP_PORT:-587}
-      
       # Redis overrides 
       - ConnectionStrings__Redis=${REDIS_CONNECTION_STRING:-192.168.1.171:6379,ssl=false,abortConnect=false}
     restart: unless-stopped