Enforce same-user maker-checker restriction

Replaces the previous DefaultApiClientBootstrapper (ApplicationRunner
minting a random key on first startup) with a plain Liquibase seed on the
tenant-store database: one fixed, well-known api_key_hash row, inserted
once via migration 0012, same on every deployment and every tenant --
exactly like this fork already seeds default codes/permissions, rather
than generating a secret at runtime.

The trade-off is explicit in the migration's own comment: a fixed key
checked into source is a bootstrap convenience, not a secret, and any
deployment beyond local/dev must rotate it (insert a new hash, deactivate
this row) before going live -- rotation is a direct m_api_client write,
same as the seed itself, since POST /v1/apiclients stays disabled.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

fineract-accounting/src/main/java/org/apache/fineract/accounting/producttoaccountmapping/service/SavingsProductToGLAccountMappingHelper.java

@@ -264,6 +264,13 @@ public class SavingsProductToGLAccountMappingHelper extends ProductToGLAccountMa
                         savingsProductId, CashAccountsForSavings.ESCHEAT_LIABILITY.getValue(), changes);
                 createOrmergeSavingsToExpenseAccountMappingChanges(element, SavingProductAccountingParams.ROUNDING_ADJUSTMENT.getValue(),
                         savingsProductId, CashAccountsForSavings.ROUNDING_ADJUSTMENT.getValue(), changes);
+                // Interest Payable is editable on cash too, and optional. Interest posting routes
+                // through it on either basis, so a product can name one to carry interest declared
+                // but not yet credited; a product that names none still posts straight to Savings
+                // Control. Created-or-merged because a product configured before this row existed
+                // has no mapping to merge into.
+                createOrmergeSavingsToLiabilityAccountMappingChanges(element, SavingProductAccountingParams.INTEREST_PAYABLE.getValue(),
+                        savingsProductId, AccrualAccountsForSavings.INTEREST_PAYABLE.getValue(), changes);
             break;
             case ACCRUAL_PERIODIC:
                 // asset

fineract-core/src/main/java/org/apache/fineract/commands/service/CommandSourceService.java

@@ -137,7 +137,16 @@ public class CommandSourceService {
         String permission = commandSource.getPermissionCode();
         boolean isMakerChecker = configurationDomainService.isMakerCheckerEnabledForTask(permission);
         if (isMakerChecker || result.isRollbackTransaction()) {
-            if (isApprovedByChecker || isSuperUserBypassAllowed(commandSource, user)) {
+            // isApprovedByChecker is only ever true here for a genuine checker approval
+            // (PortfolioCommandSourceWritePlatformServiceImpl.approveEntry(), which has already run
+            // validateMakerCheckerTransaction() and confirmed the approver is not the maker) or a user
+            // editing their own account details (CommandWrapper.isChangeOfOwnUserDetails() - maker-checker
+            // genuinely does not apply there). On the ORIGINAL submission this is always false and `user`
+            // here is always the maker themselves, so there is deliberately no CHECKER_SUPER_USER (or any
+            // other) bypass at this point: holding CHECKER_SUPER_USER lets a user approve someone ELSE's
+            // request without needing the specific <TASK>_CHECKER permission, it must never let a maker
+            // auto-approve their own submission just by holding it.
+            if (isApprovedByChecker) {
                 commandSource.markAsChecked(user);
             } else {
                 if (commandSource.isSanitized()) {
@@ -151,25 +160,6 @@ public class CommandSourceService {
         return result;
     }
 
-    private boolean isSuperUserBypassAllowed(CommandSource commandSource, AppUser user) {
-        if (!user.isCheckerSuperUser()) {
-            return false;
-        }
-        if ("GLACCOUNT".equalsIgnoreCase(commandSource.getEntityName())
-                || "CBSBASEINTERESTRATE".equalsIgnoreCase(commandSource.getEntityName())
-                || "CHARGE".equalsIgnoreCase(commandSource.getEntityName())
-                || "LOANPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "SAVINGSPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "CURRENTPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "SHAREPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "FIXEDDEPOSITPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "USER".equalsIgnoreCase(commandSource.getEntityName())
-                || "ROLE".equalsIgnoreCase(commandSource.getEntityName())) {
-            return false;
-        }
-        return true;
-    }
-
     private void sanitizeJson(@NonNull CommandSource commandSource, Set<String> sanitizeKeys) {
         if (sanitizeKeys == null || sanitizeKeys.isEmpty()) {
             return;

fineract-core/src/main/java/org/apache/fineract/commands/service/PortfolioCommandSourceWritePlatformServiceImpl.java

@@ -48,6 +48,12 @@ public class PortfolioCommandSourceWritePlatformServiceImpl implements Portfolio
     private final FromJsonHelper fromApiJsonHelper;
     private final CommandProcessingService processAndLogCommandService;
     private final SchedulerJobRunnerReadService schedulerJobRunnerReadService;
+    // No longer consulted by validateMakerCheckerTransaction() below: the maker-identity rule (a user
+    // can never approve their own submission) is now unconditional and isSameMakerCheckerEnabled() no
+    // longer overrides it. Left injected rather than removed - enable-same-maker-checker is still a
+    // live, independently-configurable global switch (System -> Configurations); deleting this field,
+    // and by extension deciding that switch should stop existing altogether, is a separate decision
+    // from closing this specific self-approval loophole.
     private final ConfigurationDomainService configurationService;
 
     @Override
@@ -123,14 +129,20 @@ public class PortfolioCommandSourceWritePlatformServiceImpl implements Portfolio
         AppUser appUser = this.context.authenticatedUser();
         String permissionCode = commandSource.getPermissionCode();
         appUser.validateHasCheckerPermissionTo(permissionCode);
-        if (!configurationService.isSameMakerCheckerEnabled() && !appUser.isCheckerSuperUser()) {
+        // Maker-identity rule: the user who submitted a command may never be the one who approves
-            AppUser maker = commandSource.getMaker();
+        // (or rejects) it - this is a fixed platform rule, not overridable by CHECKER_SUPER_USER (that
-            if (maker == null) {
+        // permission still lets its holder action a DIFFERENT user's request without needing the
-                throw new UnsupportedCommandException(permissionCode, "Maker user is missing.");
+        // specific <TASK>_CHECKER permission - see validateHasCheckerPermissionTo() above - it just no
-            }
+        // longer lets them action their own) and not overridable by the enable-same-maker-checker
-            if (Objects.equals(appUser.getId(), maker.getId())) {
+        // global switch (isSameMakerCheckerEnabled() is deliberately no longer consulted here; that
-                throw new UnsupportedCommandException(permissionCode, "Can not be checked by the same user.");
+        // configuration is left in place and unused for this decision rather than removed, since
-            }
+        // deleting a still-configurable global setting is a separate decision from this one).
+        AppUser maker = commandSource.getMaker();
+        if (maker == null) {
+            throw new UnsupportedCommandException(permissionCode, "Maker user is missing.");
+        }
+        if (Objects.equals(appUser.getId(), maker.getId())) {
+            throw new UnsupportedCommandException(permissionCode, "Can not be checked by the same user.");
         }
         return commandSource;
     }

fineract-core/src/main/java/org/apache/fineract/infrastructure/jobs/service/JobName.java

@@ -73,6 +73,7 @@ public enum JobName {
     CTR_REPORT_GENERATION("AML Monthly CTR Report Generation"), //
     AML_STR_WEEKLY_DIGEST("AML STR Weekly Digest"), //
     CLIENT_BEHAVIOUR_WINDOW("Client Behaviour Window Computation"), //
+    SAVE_RBI_FORM_A_RETURN("Save RBI Form A Return"), //
     ; //
 
     private final String name;

fineract-core/src/main/java/org/apache/fineract/portfolio/PortfolioProductType.java

@@ -55,17 +55,25 @@ public enum PortfolioProductType {
             return null;
         }
 
+        // Matched against each constant's own declared value above, not its declaration position --
+        // those two orderings diverge (CLIENT is declared 3rd but its value is 5), so a switch written
+        // by position silently mapped every id past SAVING to the wrong type: 3 (really PROVISIONING)
+        // returned CLIENT, 4 (really SHARES) returned PROVISIONING, 5 (really CLIENT) returned SHARES,
+        // and 6 (CURRENT) fell through to null -- a live NPE the moment a Current-product GL entry
+        // (entity_type_enum=6) reached this on the Journal Entries screen.
         switch (v) {
             case 1:
                 return LOAN;
             case 2:
                 return SAVING;
             case 3:
-                return CLIENT;
-            case 4:
                 return PROVISIONING;
-            case 5:
+            case 4:
                 return SHARES;
+            case 5:
+                return CLIENT;
+            case 6:
+                return CURRENT;
             default:
                 return null;
         }

fineract-provider/src/main/java/org/apache/fineract/accounting/productaccountmapping/service/ProductToGLAccountMappingWritePlatformServiceImpl.java

@@ -329,6 +329,18 @@ public class ProductToGLAccountMappingWritePlatformServiceImpl implements Produc
             break;
             case CASH_BASED:
                 saveSavingsBaseAccountMapping(savingProductId, accountType, command, element);
+                // Interest Payable is saved on cash too, and optionally: interest posting routes
+                // through it on either basis (see AccountingProcessorHelper
+                // .createInterestPostingJournalEntriesForSavings), so that interest declared but not
+                // yet credited to the member reads as the bank's own liability rather than appearing
+                // only at the moment it is paid. Mapped only when the screen supplies it - a product
+                // naming none still posts straight to Savings Control, as it always did.
+                if (this.fromApiJsonHelper.parameterExists(SavingProductAccountingParams.INTEREST_PAYABLE.getValue(),
+                        element)) {
+                    this.savingsProductToGLAccountMappingHelper.saveSavingsToLiabilityAccountMapping(element,
+                            SavingProductAccountingParams.INTEREST_PAYABLE.getValue(), savingProductId,
+                            AccrualAccountsForSavings.INTEREST_PAYABLE.getValue());
+                }
             break;
 
             case ACCRUAL_PERIODIC:

fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/SecurityConfig.java

@@ -165,9 +165,11 @@ public class SecurityConfig {
                     // envelope's RSA signature/encryption (NpciCryptoUtil) inside the handler.
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/npci/**")).permitAll()
                     // Client account summary, third-party callers — a partner integration calls this
-                    // with an X-Api-Key header instead of a Fineract username/password (issued via
+                    // with an X-Api-Key header instead of a Fineract username/password. The key itself
-                    // POST /v1/apiclients, super-user only). Same posture as IMPS/NPCI above: the
+                    // is issued by inserting directly into m_api_client in the tenant-store database
-                    // outer gate stays open for this one narrow GET path, and
+                    // (see ApiClientAdminApiResource — its POST /v1/apiclients is deliberately disabled,
+                    // since any bank's own super user reaching it could mint a platform-wide key). Same
+                    // posture as IMPS/NPCI above: the outer gate stays open for this one narrow GET path, and
                     // ClientAllAccountsApiResource#retrieveByClientNo is what actually authenticates
                     // the caller (ApiClientCredentialService checks the key's hash, active flag and
                     // IP allowlist) — a request with no key and no Fineract login still gets nothing,

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/apiclient/ApiClientAdminApiResource.java

@@ -20,7 +20,6 @@ package org.apache.fineract.infrastructure.security.apiclient;
 
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
-import com.google.gson.JsonElement;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.DELETE;
@@ -35,17 +34,26 @@ import jakarta.ws.rs.core.Response;
 import java.util.List;
 import java.util.Map;
 import lombok.RequiredArgsConstructor;
-import org.apache.fineract.infrastructure.core.serialization.FromJsonHelper;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
 import org.apache.fineract.useradministration.domain.AppUser;
 import org.springframework.stereotype.Component;
 
 /**
  * Admin-only management of the third-party API keys {@link ApiClientCredentialService} authenticates.
- * This resource itself requires a normal Fineract login, same as everything else -- ordinary
+ * List/deactivate/reactivate still require a normal Fineract login restricted to a super user
- * username/password, restricted to a super user (ALL_FUNCTIONS). Only the endpoints that use a minted
+ * (ALL_FUNCTIONS) -- but minting a NEW key ({@link #create}) is disabled here entirely, on purpose.
- * key to skip login (e.g. GET /v1/clientaccounts) are the ones exempted in SecurityConfig; issuing that
+ *
- * key in the first place is not something to hand to just anyone.
+ * {@code ALL_FUNCTIONS} is a per-TENANT role grant -- and {@code TenantMenuAccessApiResource}'s whole
+ * point is that a bank's own super user (or a role simply misconfigured to carry ALL_FUNCTIONS, as the
+ * "Clerk" role was found to in two tenants this session) must never be able to lift its own menu-access
+ * ceiling. If this endpoint minted keys for any ALL_FUNCTIONS holder, that same bank super user could
+ * call {@code POST /v1/apiclients} and hand themselves a brand-new platform-operator credential -- one
+ * that authenticates against every tenant, not just their own -- completely bypassing the ceiling this
+ * key mechanism exists to enforce. A super user being able to read/deactivate the client list is fine
+ * (visibility and revocation are not privilege escalation); being able to mint a fresh one is exactly
+ * the escalation path being closed. New keys are issued the same way this fix issued the first one: a
+ * direct insert into {@code m_api_client} (see {@link ApiClientCredentialService#createClient}), by
+ * whoever already has direct database access -- never over HTTP.
  */
 @Path("/v1/apiclients")
 @Component
@@ -55,20 +63,18 @@ public class ApiClientAdminApiResource {
 
     private final PlatformSecurityContext context;
     private final ApiClientCredentialService credentialService;
-    private final FromJsonHelper fromJsonHelper;
     private final Gson gson = new GsonBuilder().serializeNulls().create();
 
+    /** Disabled -- see the class comment. Minting a key is a direct-database operation only. */
     @POST
     @Consumes(MediaType.APPLICATION_JSON)
     @Produces(MediaType.APPLICATION_JSON)
     public String create(final String body) {
-        final AppUser user = requireSuperUser();
+        requireSuperUser();
-        final JsonElement root = fromJsonHelper.parse(body);
+        throw new WebApplicationException(Response.status(403)
-        final String clientName = fromJsonHelper.extractStringNamed("clientName", root);
+                .entity("{\"message\":\"Minting a new platform API key over HTTP is disabled. "
-        final String allowedIps = fromJsonHelper.extractStringNamed("allowedIps", root);
+                        + "Insert directly into m_api_client in the tenant-store database instead.\"}")
-
+                .type(MediaType.APPLICATION_JSON).build());
-        final Map<String, Object> result = credentialService.createClient(clientName, allowedIps, user.getId());
-        return gson.toJson(result);
     }
 
     @GET

fineract-provider/src/main/java/org/apache/fineract/portfolio/branchday/api/BranchDayRegisterApiResource.java

@@ -200,7 +200,7 @@ public class BranchDayRegisterApiResource {
         final BigDecimal countedIn = zero(jdbcTemplate.queryForObject("""
                 SELECT COALESCE(SUM(std.total_amount), 0) FROM m_savings_txn_denomination std
                  WHERE std.txn_date = ? AND std.txn_type = 'DEPOSIT'
-                   AND """ + CountedCashLedger.REAL_TXN_ID + """
+                   AND """ + CountedCashLedger.COUNTED_ROW + """
                    AND (std.officer_id IS NULL
                         OR NOT EXISTS (SELECT 1 FROM m_appuser au JOIN m_cashiers c ON c.staff_id = au.staff_id
                                         WHERE au.id = std.officer_id)
@@ -211,7 +211,7 @@ public class BranchDayRegisterApiResource {
         final BigDecimal countedOut = zero(jdbcTemplate.queryForObject("""
                 SELECT COALESCE(SUM(std.total_amount), 0) FROM m_savings_txn_denomination std
                  WHERE std.txn_date = ? AND std.txn_type = 'WITHDRAWAL'
-                   AND """ + CountedCashLedger.REAL_TXN_ID + """
+                   AND """ + CountedCashLedger.COUNTED_ROW + """
                    AND (std.officer_id IS NULL
                         OR NOT EXISTS (SELECT 1 FROM m_appuser au JOIN m_cashiers c ON c.staff_id = au.staff_id
                                         WHERE au.id = std.officer_id)

fineract-provider/src/main/java/org/apache/fineract/portfolio/cashierdeposit/api/CashierDepositRequestApiResource.java

@@ -192,7 +192,7 @@ public class CashierDepositRequestApiResource {
         // reject() will delete these records so the vault position is reversed.
         if (denominationData != null && !denominationData.isBlank()) {
             savePendingDenomination(denominationData, newId, savingsAccountId, accountNo, clientId,
-                currentUser.getId(), currentUser.getUsername(), paymentTypeName);
+                currentUser.getId(), currentUser.getUsername(), paymentTypeName, txnDate);
         }
 
         return gson.toJson(Map.of("resourceId", newId, "status", "PENDING", "voucherNo", voucherNo));
@@ -364,6 +364,17 @@ public class CashierDepositRequestApiResource {
             updatedLog, Timestamp.from(Instant.now()), id
         );
 
+        // Rejection deleted this request's notes (the cash went back to the customer). Resubmitting
+        // means the cashier took the cash again, so the notes are recorded again -- without this an
+        // approved resubmission credited the account while the drawer never received its notes.
+        // Cleared first so a resubmit can never leave the old breakdown alongside the new one.
+        jdbcTemplate.update("DELETE FROM m_savings_txn_denomination WHERE txn_id = ?", id + PENDING_DEPOSIT_TXN_ID_OFFSET);
+        if (denominationData != null && !denominationData.isBlank()) {
+            savePendingDenomination(denominationData, id, toLong(record.get("savings_account_id")),
+                (String) record.get("account_no"), toLong(record.get("client_id")),
+                currentUser.getId(), currentUser.getUsername(), paymentTypeName, txnDate);
+        }
+
         // Keep the central voucher register in sync with the edited amount
         voucherService.updateAmount(VoucherService.REF_CASHIER_DEPOSIT_REQUEST, id, amount);
 
@@ -1004,9 +1015,14 @@ public class CashierDepositRequestApiResource {
      */
     // Called at submit time — uses request id as temporary txn_id.
     // approve() updates txn_id to real Fineract id; reject() deletes these records.
+    private static Long toLong(final Object value) {
+        return value instanceof Number n ? n.longValue() : null;
+    }
+
     private void savePendingDenomination(final String denominationData,
             final Long requestId, final Long savingsAccountId, final String accountNo,
-            final Long clientId, final Long cashierId, final String cashierUsername, final String paymentTypeName) {
+            final Long clientId, final Long cashierId, final String cashierUsername, final String paymentTypeName,
+            final String txnDate) {
         final JsonObject denomMap;
         try {
             denomMap = gson.fromJson(denominationData, JsonObject.class);
@@ -1037,10 +1053,14 @@ public class CashierDepositRequestApiResource {
                 INSERT INTO m_savings_txn_denomination
                 (txn_id, savings_account_id, account_no, client_id, denomination_id,
                  denomination_value, count, total_amount, txn_date, txn_type, officer_id, officer_username, payment_type)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, CURRENT_DATE, 'DEPOSIT', ?, ?, ?)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, COALESCE(CAST(? AS DATE), CURRENT_DATE), 'DEPOSIT', ?, ?, ?)
                 """,
                 requestId + PENDING_DEPOSIT_TXN_ID_OFFSET, savingsAccountId, accountNo, clientId, denomId,
                 value, count, BigDecimal.valueOf((long) value * count),
+                // Dated on the request's own date, which is what the branch day's book figure reads.
+                // CURRENT_DATE is the database clock, so a deposit keyed on one date could land in the
+                // drawer on another and leave both days' cash wrong.
+                txnDate != null && !txnDate.isBlank() ? Date.valueOf(txnDate) : null,
                 cashierId, cashierUsername, paymentTypeName
             );
         }

fineract-provider/src/main/java/org/apache/fineract/portfolio/cashreconciliation/api/CashReconciliationApiResource.java

@@ -90,7 +90,7 @@ public class CashReconciliationApiResource {
                 + "LEFT JOIN m_denomination_master dm ON dm.id = std.denomination_id "
                 + "WHERE std.txn_type = 'DEPOSIT' "
                 + "AND std.txn_date <= CAST(? AS DATE) "
-                + "AND " + CountedCashLedger.REAL_TXN_ID
+                + "AND " + CountedCashLedger.COUNTED_ROW
                 + "AND std.officer_id IN ("
                 + "  SELECT au.id FROM m_appuser au "
                 + "  JOIN m_cashiers mc ON mc.staff_id = au.staff_id WHERE mc.id = ?) "
@@ -120,7 +120,7 @@ public class CashReconciliationApiResource {
                 + "LEFT JOIN m_denomination_master dm ON dm.id = std.denomination_id "
                 + "WHERE std.txn_type = 'WITHDRAWAL' "
                 + "AND std.txn_date <= CAST(? AS DATE) "
-                + "AND " + CountedCashLedger.REAL_TXN_ID
+                + "AND " + CountedCashLedger.COUNTED_ROW
                 + "AND std.officer_id IN ("
                 + "  SELECT au.id FROM m_appuser au "
                 + "  JOIN m_cashiers mc ON mc.staff_id = au.staff_id WHERE mc.id = ?) "

fineract-provider/src/main/java/org/apache/fineract/portfolio/cashreport/api/CashReportApiResource.java

@@ -60,34 +60,11 @@ public class CashReportApiResource {
      * </ul>
      *
      * <p>
-     * Which ids are real and which are stamped timestamps is {@link CountedCashLedger}'s rule, shared
+     * The rule itself, including the mis-keyed-breakdown test, is {@link CountedCashLedger#COUNTED_ROW},
-     * with the day register, the reconciliation screen and the withdrawal stock check, so a drawer
+     * shared with the day register, the reconciliation screen and the withdrawal stock check, so a
-     * reads the same on all four.
+     * drawer reads the same on all four.
      */
-    private static final String COUNTER_NOT_REVERSED = "AND NOT EXISTS ("
+    private static final String COUNTER_NOT_REVERSED = "AND " + CountedCashLedger.COUNTED_ROW;
-            + "  SELECT 1 FROM m_savings_account_transaction rt "
-            + "   WHERE rt.id = std.txn_id AND rt.is_reversed = true) "
-            + "AND " + CountedCashLedger.REAL_TXN_ID
-            // A breakdown has to add up to the transaction it belongs to. Where it does not, the
-            // notes were mis-keyed and the transaction amount is the fact -- ₹1,60,000 of notes
-            // recorded against a ₹918 deposit is not ₹1,60,000 of cash in anybody's drawer. Seven
-            // such transactions in this database were carrying ₹1.68 lakh that never existed.
-            //
-            // The tolerance is sub-rupee, not exact: Indian cash has no paisa coins in circulation,
-            // so a paisa-exact ledger amount (e.g. 12998.56) is legitimately handed over as the
-            // nearest whole rupee (12999) -- a 44-paisa gap is real rounding, not a mis-keyed
-            // breakdown, and treating it as one silently dropped an entire genuine withdrawal (and
-            // everything counted after it) out of the cashier's position.
-            //
-            // Compared per transaction inside a correlated subquery rather than as a join, so a
-            // breakdown with no transaction behind it -- a Demand Draft keyed by its request id, or a
-            // manual GL entry keyed by its decoded reference -- is untouched by this test and left to
-            // CountedCashLedger's rule above.
-            + "AND NOT EXISTS ("
-            + "  SELECT 1 FROM m_savings_account_transaction mt "
-            + "   WHERE mt.id = std.txn_id"
-            + "     AND ABS(mt.amount - (SELECT SUM(sd.count * sd.denomination_value)"
-            + "                            FROM m_savings_txn_denomination sd WHERE sd.txn_id = std.txn_id)) >= 1) ";
 
     /**
      * Day book — every voucher raised on one date, in one list, newest first.

fineract-provider/src/main/java/org/apache/fineract/portfolio/clerkdisbursement/api/ClerkDisbursementRequestApiResource.java

@@ -631,7 +631,15 @@ public class ClerkDisbursementRequestApiResource {
                         return ps;
                     }, btLogKh);
                     final long btLogId = Objects.requireNonNull(btLogKh.getKey()).longValue();
-                    final String btVoucherNo = generateBtVoucherNo(btLogId, currentUser, finalBtTotal);
+                    // submit() already raised this request's voucher (every request type does, so it
+                    // shows in My Vouchers the moment a clerk submits it, before any checker acts) --
+                    // minting a second one here for Bank Transfer specifically double-counted the same
+                    // transfer under two different names, "Entered by" whoever raised it AND whoever
+                    // approved it. Reuse that voucher; only fall back to raising a fresh one if this
+                    // request somehow reached approval without it (defensive, not the normal path).
+                    final Object existingVoucherNo = record.get("voucher_no");
+                    final String btVoucherNo = existingVoucherNo != null ? (String) existingVoucherNo
+                        : generateBtVoucherNo(btLogId, currentUser, finalBtTotal);
                     jdbcTemplate.update("UPDATE m_bank_transfer_log SET voucher_no = ? WHERE id = ?", btVoucherNo, btLogId);
                 }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/clerkwithdrawal/api/ClerkWithdrawalRequestApiResource.java

@@ -722,10 +722,13 @@ public class ClerkWithdrawalRequestApiResource {
                 INSERT INTO m_savings_txn_denomination
                 (txn_id, savings_account_id, account_no, client_id, denomination_id,
                  denomination_value, count, total_amount, txn_date, txn_type, officer_id, officer_username, payment_type)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, CURRENT_DATE, 'WITHDRAWAL', ?, ?, ?)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, COALESCE(CAST(? AS DATE), CURRENT_DATE), 'WITHDRAWAL', ?, ?, ?)
                 """,
                 txnId, savingsAccountId, accountNo, clientId, denomId,
                 value, count, BigDecimal.valueOf((long) value * count),
+                // The request's own date, which the branch day's paid-out figure reads -- not the
+                // database clock, which put the notes on a different day from the withdrawal.
+                record.get("txn_date"),
                 cashier.getId(), cashier.getUsername(), paymentTypeName
             );
         }

fineract-provider/src/main/java/org/apache/fineract/portfolio/denominationmaster/service/CountedCashLedger.java

@@ -87,4 +87,53 @@ public final class CountedCashLedger {
             + " OR CAST(to_timestamp(std.txn_id / 1000.0) AS DATE) NOT BETWEEN"
             + "    COALESCE(std.txn_date, CAST(std.created_at AS DATE)) - " + SAME_DAY_TOLERANCE_DAYS
             + " AND COALESCE(std.txn_date, CAST(std.created_at AS DATE)) + " + SAME_DAY_TOLERANCE_DAYS + ") ";
+
+    /**
+     * {@link #REAL_TXN_ID} plus the two tests a real id can still fail, as one predicate over the alias
+     * {@code std}. Every drawer figure reads this, not {@code REAL_TXN_ID} alone.
+     *
+     * <p>
+     * Only the cashier position report used to apply the two extra tests, so it and the reconciliation
+     * screen disagreed: a reversed ₹200 deposit left the settlement screen expecting three ₹100 notes
+     * while the settlement check, reading the position, allowed one — and refused the hand-over.
+     *
+     * <ul>
+     * <li>a breakdown whose savings transaction is reversed -- the money went back, so the notes did too.
+     * The table has no reversal marker of its own, so it is read off the transaction;
+     * <li>a breakdown that does not add up to its transaction -- ₹1,60,000 of notes against a ₹918
+     * deposit is mis-keyed, not cash. Sub-rupee tolerance, because a paisa-exact amount is handed
+     * over as the nearest whole rupee.
+     * </ul>
+     *
+     * <p>
+     * <b>The transaction is found by id and account number together.</b> Savings and current
+     * transactions keep separate id sequences, and a current-account deposit writes its own
+     * transaction id into {@code txn_id}. Matched on id alone, a ₹210 current-account deposit was
+     * judged against an unrelated savings transaction that happened to share its id, failed the
+     * amount test, and vanished from the cashier's drawer. A row with no account number (older
+     * writers) is still matched on id alone, as before.
+     *
+     * <p>
+     * All tests are correlated {@code NOT EXISTS} rather than joins, so a breakdown with no account
+     * transaction behind it (a Demand Draft, a manual GL entry) is untouched by them.
+     */
+    public static final String COUNTED_ROW = " (NOT EXISTS ("
+            + "  SELECT 1 FROM m_savings_account_transaction rt"
+            + "    JOIN m_savings_account rsa ON rsa.id = rt.savings_account_id"
+            + "   WHERE rt.id = std.txn_id"
+            + "     AND (std.account_no IS NULL OR rsa.account_no = std.account_no)"
+            + "     AND (rt.is_reversed = true OR " + breakdownDiffersFrom("rt.amount") + "))"
+            + " AND NOT EXISTS ("
+            + "  SELECT 1 FROM m_current_account_transaction rct"
+            + "    JOIN m_current_account rca ON rca.id = rct.current_account_id"
+            + "   WHERE rct.id = std.txn_id AND rca.account_no = std.account_no"
+            + "     AND (rct.is_reversed = true OR " + breakdownDiffersFrom("rct.amount") + "))"
+            + " AND" + REAL_TXN_ID + ") ";
+
+    /** Sub-rupee tolerance: a paisa-exact amount is handed over as the nearest whole rupee. */
+    private static String breakdownDiffersFrom(final String amountColumn) {
+        return "ABS(" + amountColumn + " - (SELECT SUM(sd.count * sd.denomination_value)"
+                + " FROM m_savings_txn_denomination sd WHERE sd.txn_id = std.txn_id"
+                + " AND sd.account_no IS NOT DISTINCT FROM std.account_no)) >= 1";
+    }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/denominationmaster/service/DenominationBreakdownWriter.java

@@ -286,7 +286,7 @@ public class DenominationBreakdownWriter {
                 + "    SELECT std.denomination_id, CAST(SUM(std.count) AS BIGINT)"
                 + "    FROM m_savings_txn_denomination std"
                 + "    WHERE std.txn_type = 'DEPOSIT'"
-                + "    AND " + CountedCashLedger.REAL_TXN_ID
+                + "    AND " + CountedCashLedger.COUNTED_ROW
                 + "    AND std.officer_id IN (SELECT au.id FROM m_appuser au"
                 + "      JOIN m_cashiers mc ON mc.staff_id = au.staff_id WHERE mc.id = ?)"
                 + "    GROUP BY std.denomination_id"
@@ -310,7 +310,7 @@ public class DenominationBreakdownWriter {
                 + "    SELECT std.denomination_id, CAST(-SUM(std.count) AS BIGINT)"
                 + "    FROM m_savings_txn_denomination std"
                 + "    WHERE std.txn_type = 'WITHDRAWAL'"
-                + "    AND " + CountedCashLedger.REAL_TXN_ID
+                + "    AND " + CountedCashLedger.COUNTED_ROW
                 + "    AND std.officer_id IN (SELECT au.id FROM m_appuser au"
                 + "      JOIN m_cashiers mc ON mc.staff_id = au.staff_id WHERE mc.id = ?)"
                 + "    GROUP BY std.denomination_id"
@@ -407,7 +407,7 @@ public class DenominationBreakdownWriter {
                 + "  SELECT std.denomination_id, CAST(SUM(std.count) AS BIGINT)"
                 + "  FROM m_savings_txn_denomination std"
                 + "  WHERE std.txn_type = 'DEPOSIT'"
-                + "  AND " + CountedCashLedger.REAL_TXN_ID
+                + "  AND " + CountedCashLedger.COUNTED_ROW
                 + "  AND std.officer_id IN (SELECT au.id FROM m_appuser au"
                 + "    JOIN m_cashiers mc ON mc.staff_id = au.staff_id WHERE mc.id = ?)"
                 + "  GROUP BY std.denomination_id"
@@ -431,7 +431,7 @@ public class DenominationBreakdownWriter {
                 + "  SELECT std.denomination_id, CAST(-SUM(std.count) AS BIGINT)"
                 + "  FROM m_savings_txn_denomination std"
                 + "  WHERE std.txn_type = 'WITHDRAWAL'"
-                + "  AND " + CountedCashLedger.REAL_TXN_ID
+                + "  AND " + CountedCashLedger.COUNTED_ROW
                 + "  AND std.officer_id IN (SELECT au.id FROM m_appuser au"
                 + "    JOIN m_cashiers mc ON mc.staff_id = au.staff_id WHERE mc.id = ?)"
                 + "  GROUP BY std.denomination_id"

fineract-provider/src/main/java/org/apache/fineract/portfolio/rbireserve/api/RbiFormAFilingApiResource.java

@@ -0,0 +1,305 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.rbireserve.api;
+
+import com.google.gson.Gson;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
+import org.apache.fineract.infrastructure.core.serialization.FromJsonHelper;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+
+/**
+ * Saved Form A / Form 9 returns: keeping a generated return so it can be read again later exactly as
+ * it was generated.
+ *
+ * A saved return is served from its stored snapshot, never recomputed. Recomputing would quietly
+ * produce a different statement from the one that was reviewed or filed - a backdated journal entry,
+ * a changed GL mapping or a corrected rate all move figures that were already reported - and a
+ * report whose figures change after it was filed is worse than no report at all.
+ *
+ * Deliberately not maker-checker: saving a snapshot changes no balance and posts no entry. The
+ * filing lifecycle (draft, checked, approved, submitted) is what carries the approval, and that is
+ * recorded on the row's status rather than in a separate command queue.
+ */
+@Path("/v1/rbiformafiling")
+@Component
+@RequiredArgsConstructor
+@Produces({ MediaType.APPLICATION_JSON })
+public class RbiFormAFilingApiResource {
+
+    private static final String RESOURCE_NAME_FOR_PERMISSION = "RBIFORMAFILING";
+
+    /**
+     * The filing lifecycle RBI's own timetable implies: a return is drafted, checked and approved
+     * inside the bank, sent provisionally within a week of the fortnight ending and finally within
+     * twenty days, and revised if a figure turns out wrong after that.
+     */
+    private static final List<String> STATUSES = List.of("DRAFT", "GENERATED", "CHECKED", "APPROVED",
+            "PROVISIONAL_SUBMITTED", "FINAL_SUBMITTED", "REVISED");
+
+    private final JdbcTemplate jdbcTemplate;
+    private final PlatformSecurityContext context;
+    private final FromJsonHelper fromJsonHelper;
+    private final Gson gson = new Gson();
+
+    /** Saved returns, newest first. The stored snapshot is left out - the list does not need it. */
+    @GET
+    public String retrieveAll(@QueryParam("formCode") final String formCode) {
+        this.context.authenticatedUser().validateHasReadPermission(RESOURCE_NAME_FOR_PERMISSION);
+
+        final StringBuilder sql = new StringBuilder("""
+                SELECT f.id, f.form_code, f.reporting_date, f.fortnight_end, f.period_start, f.period_end,
+                       f.status, f.ndtl_amount, f.required_amount, f.maintained_amount, f.average_maintained,
+                       f.rate_percentage, f.remarks, f.submitted_on, f.created_on, u.username AS created_by_name
+                  FROM m_rbi_form_a_filing f
+                  LEFT JOIN m_appuser u ON u.id = f.created_by
+                """);
+        final List<Object> args = new ArrayList<>();
+        if (formCode != null && !formCode.isBlank()) {
+            sql.append(" WHERE f.form_code = ?");
+            args.add(formCode);
+        }
+        sql.append(" ORDER BY f.reporting_date DESC, f.id DESC");
+
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList(sql.toString(), args.toArray());
+        final List<Map<String, Object>> out = new ArrayList<>();
+        for (final Map<String, Object> row : rows) {
+            out.add(toSummary(row));
+        }
+        return gson.toJson(out);
+    }
+
+    /** One saved return, with the snapshot, so the screen can render exactly what was saved. */
+    @GET
+    @Path("{filingId}")
+    public String retrieveOne(@PathParam("filingId") final Long filingId) {
+        this.context.authenticatedUser().validateHasReadPermission(RESOURCE_NAME_FOR_PERMISSION);
+
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList("""
+                SELECT f.id, f.form_code, f.reporting_date, f.fortnight_end, f.period_start, f.period_end,
+                       f.status, f.ndtl_amount, f.required_amount, f.maintained_amount, f.average_maintained,
+                       f.rate_percentage, f.remarks, f.submitted_on, f.created_on, f.report_json,
+                       u.username AS created_by_name
+                  FROM m_rbi_form_a_filing f
+                  LEFT JOIN m_appuser u ON u.id = f.created_by
+                 WHERE f.id = ?
+                """, filingId);
+        if (rows.isEmpty()) {
+            throw new PlatformDataIntegrityException("error.msg.rbiformafiling.not.found",
+                    "Saved return " + filingId + " was not found.");
+        }
+        final Map<String, Object> row = rows.get(0);
+        final Map<String, Object> out = toSummary(row);
+
+        // The snapshot is embedded as JSON rather than as a string, so the screen receives the same
+        // shape the live endpoint returns and can render it through the same code path.
+        final String json = (String) row.get("report_json");
+        out.put("report", json == null || json.isBlank() ? null : gson.fromJson(json, JsonObject.class));
+        return gson.toJson(out);
+    }
+
+    /**
+     * Saves a generated return. Re-saving the same form for the same reporting date replaces that
+     * snapshot: regenerating a return for a date already saved is a correction of it, not a second
+     * statement for the same day.
+     */
+    @POST
+    @Consumes({ MediaType.APPLICATION_JSON })
+    public String create(final String body) {
+        this.context.authenticatedUser().validateHasPermissionTo("UPDATE_" + RESOURCE_NAME_FOR_PERMISSION);
+
+        final JsonElement root = this.fromJsonHelper.parse(body);
+        final String formCode = this.fromJsonHelper.extractStringNamed("formCode", root);
+        final LocalDate reportingDate = this.fromJsonHelper.extractLocalDateNamed("reportingDate", root);
+        final String remarks = this.fromJsonHelper.extractStringNamed("remarks", root);
+        final Long officeId = this.fromJsonHelper.extractLongNamed("officeId", root);
+
+        if (formCode == null || formCode.isBlank()) {
+            throw new PlatformDataIntegrityException("error.msg.rbiformafiling.no.form.code",
+                    "The form being saved must be named.");
+        }
+        if (reportingDate == null) {
+            throw new PlatformDataIntegrityException("error.msg.rbiformafiling.no.reporting.date",
+                    "A reporting date is required.");
+        }
+
+        // The return itself, as the screen received it. Stored verbatim: the point of a saved return
+        // is that it does not change afterwards, so nothing here re-derives a figure from it.
+        final JsonObject report = root.getAsJsonObject().getAsJsonObject("report");
+        if (report == null) {
+            throw new PlatformDataIntegrityException("error.msg.rbiformafiling.no.report",
+                    "The generated return must be supplied with the save.");
+        }
+
+        final LocalDate periodStart = localDate(report, "fortnightStart");
+        final LocalDate periodEnd = localDate(report, "fortnightEnd");
+        final BigDecimal ndtl = decimal(report, "ndtlAmount");
+        final BigDecimal required = decimal(report, "requiredAmount");
+        final BigDecimal maintained = decimal(report, "maintainedAmount");
+        final BigDecimal rate = decimal(report, "ratePercentage");
+        BigDecimal average = null;
+        if (report.has("maintenance") && report.get("maintenance").isJsonObject()) {
+            average = decimal(report.getAsJsonObject("maintenance"), "average");
+        }
+
+        final Integer existing = jdbcTemplate.queryForObject(
+                "SELECT COUNT(*) FROM m_rbi_form_a_filing WHERE form_code = ? AND reporting_date = ?", Integer.class,
+                formCode, java.sql.Date.valueOf(reportingDate));
+
+        if (existing != null && existing > 0) {
+            jdbcTemplate.update("""
+                    UPDATE m_rbi_form_a_filing
+                       SET report_json = ?, ndtl_amount = ?, required_amount = ?, maintained_amount = ?,
+                           average_maintained = ?, rate_percentage = ?, remarks = ?, office_id = ?,
+                           period_start = ?, period_end = ?, fortnight_end = ?,
+                           lastmodified_on = now(), lastmodified_by = ?
+                     WHERE form_code = ? AND reporting_date = ?
+                    """, gson.toJson(report), ndtl, required, maintained, average, rate, remarks, officeId,
+                    sqlDate(periodStart), sqlDate(periodEnd), sqlDate(periodEnd == null ? reportingDate : periodEnd),
+                    this.context.authenticatedUser().getId(), formCode, java.sql.Date.valueOf(reportingDate));
+        } else {
+            jdbcTemplate.update("""
+                    INSERT INTO m_rbi_form_a_filing
+                        (form_code, reporting_date, fortnight_end, period_start, period_end, status,
+                         report_json, ndtl_amount, required_amount, maintained_amount, average_maintained,
+                         rate_percentage, remarks, office_id, created_on, created_by)
+                    VALUES (?, ?, ?, ?, ?, 'GENERATED', ?, ?, ?, ?, ?, ?, ?, ?, now(), ?)
+                    """, formCode, java.sql.Date.valueOf(reportingDate),
+                    sqlDate(periodEnd == null ? reportingDate : periodEnd), sqlDate(periodStart), sqlDate(periodEnd),
+                    gson.toJson(report), ndtl, required, maintained, average, rate, remarks, officeId,
+                    this.context.authenticatedUser().getId());
+        }
+        return retrieveAll(formCode);
+    }
+
+    /**
+     * Moves a saved return along its filing lifecycle. The snapshot is untouched: a return that has
+     * been checked and submitted must still show the figures it was checked on.
+     */
+    @POST
+    @Path("{filingId}/status")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    public String updateStatus(@PathParam("filingId") final Long filingId, final String body) {
+        this.context.authenticatedUser().validateHasPermissionTo("UPDATE_" + RESOURCE_NAME_FOR_PERMISSION);
+
+        final JsonElement root = this.fromJsonHelper.parse(body);
+        final String status = this.fromJsonHelper.extractStringNamed("status", root);
+        final String remarks = this.fromJsonHelper.extractStringNamed("remarks", root);
+
+        if (status == null || !STATUSES.contains(status)) {
+            throw new PlatformDataIntegrityException("error.msg.rbiformafiling.unknown.status",
+                    "Status must be one of " + STATUSES + ".");
+        }
+        final Integer exists = jdbcTemplate.queryForObject("SELECT COUNT(*) FROM m_rbi_form_a_filing WHERE id = ?",
+                Integer.class, filingId);
+        if (exists == null || exists == 0) {
+            throw new PlatformDataIntegrityException("error.msg.rbiformafiling.not.found",
+                    "Saved return " + filingId + " was not found.");
+        }
+
+        // The submission date is stamped when a return is actually sent, and only then - an earlier
+        // stage has nothing to date, and re-stamping on a later stage would lose when it was sent.
+        final boolean submitted = "PROVISIONAL_SUBMITTED".equals(status) || "FINAL_SUBMITTED".equals(status);
+        jdbcTemplate.update("""
+                UPDATE m_rbi_form_a_filing
+                   SET status = ?,
+                       remarks = COALESCE(?, remarks),
+                       submitted_on = CASE WHEN ? THEN COALESCE(submitted_on, CURRENT_DATE) ELSE submitted_on END,
+                       lastmodified_on = now(), lastmodified_by = ?
+                 WHERE id = ?
+                """, status, remarks, submitted, this.context.authenticatedUser().getId(), filingId);
+        return retrieveAll(null);
+    }
+
+    /** Discards a saved return. Only ever removes the snapshot; nothing in the ledger is touched. */
+    @DELETE
+    @Path("{filingId}")
+    public String delete(@PathParam("filingId") final Long filingId) {
+        this.context.authenticatedUser().validateHasPermissionTo("UPDATE_" + RESOURCE_NAME_FOR_PERMISSION);
+
+        final Integer removed = jdbcTemplate.update("DELETE FROM m_rbi_form_a_filing WHERE id = ?", filingId);
+        if (removed == 0) {
+            throw new PlatformDataIntegrityException("error.msg.rbiformafiling.not.found",
+                    "Saved return " + filingId + " was not found.");
+        }
+        return retrieveAll(null);
+    }
+
+    private Map<String, Object> toSummary(final Map<String, Object> row) {
+        final Map<String, Object> out = new LinkedHashMap<>();
+        out.put("id", row.get("id"));
+        out.put("formCode", row.get("form_code"));
+        out.put("reportingDate", str(row.get("reporting_date")));
+        out.put("periodStart", str(row.get("period_start")));
+        out.put("periodEnd", str(row.get("period_end")));
+        out.put("status", row.get("status"));
+        out.put("ndtlAmount", row.get("ndtl_amount"));
+        out.put("requiredAmount", row.get("required_amount"));
+        out.put("maintainedAmount", row.get("maintained_amount"));
+        out.put("averageMaintained", row.get("average_maintained"));
+        out.put("ratePercentage", row.get("rate_percentage"));
+        out.put("remarks", row.get("remarks"));
+        out.put("submittedOn", str(row.get("submitted_on")));
+        out.put("createdOn", str(row.get("created_on")));
+        out.put("createdBy", row.get("created_by_name"));
+        return out;
+    }
+
+    private static String str(final Object value) {
+        return value == null ? null : String.valueOf(value);
+    }
+
+    private static java.sql.Date sqlDate(final LocalDate date) {
+        return date == null ? null : java.sql.Date.valueOf(date);
+    }
+
+    private static BigDecimal decimal(final JsonObject object, final String field) {
+        if (object == null || !object.has(field) || object.get(field).isJsonNull()) {
+            return null;
+        }
+        return object.get(field).getAsBigDecimal();
+    }
+
+    private static LocalDate localDate(final JsonObject object, final String field) {
+        if (object == null || !object.has(field) || object.get(field).isJsonNull()) {
+            return null;
+        }
+        final String value = object.get(field).getAsString();
+        return value == null || value.isBlank() ? null : LocalDate.parse(value);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/rbireserve/api/RbiReserveConfigApiResource.java

@@ -228,13 +228,18 @@ public class RbiReserveConfigApiResource {
     private static final List<String> RATE_TYPES = List.of("CRR", "SLR", "SAVINGS_DEMAND");
 
     /** The four treatments a head can be given, each naming a branch the returns already have. */
-    private static final List<String> ROLE_USAGES = List.of("LIABILITY", "ASSET_NET", "MAINTAINED", "MEMO");
+    private static final List<String> ROLE_USAGES = List.of("LIABILITY", "ASSET_NET", "MAINTAINED", "SLR_ASSET",
+            "MEMO");
 
     private static final Map<String, String> USAGE_DESCRIPTIONS = new LinkedHashMap<>();
     static {
         USAGE_DESCRIPTIONS.put("LIABILITY", "Added into the DTL base, under its Demand or Time head");
         USAGE_DESCRIPTIONS.put("ASSET_NET", "Netted off the base to arrive at NDTL");
-        USAGE_DESCRIPTIONS.put("MAINTAINED", "Counted toward what is maintained against the requirement");
+        USAGE_DESCRIPTIONS.put("MAINTAINED", "Counted toward CRR maintained (Form 1)");
+        // Separate from MAINTAINED because the two returns admit different assets: CRR is met in
+        // cash and balances, SLR in cash, gold and unencumbered approved securities. One usage for
+        // both would let a head meant for one return quietly satisfy the other.
+        USAGE_DESCRIPTIONS.put("SLR_ASSET", "Counted toward SLR maintained (Form 9)");
         USAGE_DESCRIPTIONS.put("MEMO", "Shown on the return but entering no total");
     }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/rbireserve/api/RbiReserveReturnApiResource.java

@@ -117,6 +117,13 @@ public class RbiReserveReturnApiResource {
     private static final String USAGE_LIABILITY = "LIABILITY";
     private static final String USAGE_ASSET_NET = "ASSET_NET";
     private static final String USAGE_MAINTAINED = "MAINTAINED";
+    /**
+     * Counts toward SLR rather than CRR. The two are separate because the returns admit different
+     * assets: CRR is met in cash and balances with banks, SLR in cash, gold and unencumbered
+     * approved securities. A single "maintained" usage would let a head meant for one return
+     * quietly satisfy the other.
+     */
+    private static final String USAGE_SLR_ASSET = "SLR_ASSET";
 
     private final JdbcTemplate jdbcTemplate;
     private final PlatformSecurityContext context;
@@ -256,21 +263,29 @@ public class RbiReserveReturnApiResource {
             // average across the fortnight AND a daily minimum on every single day of it, so a bank
             // that held nothing for thirteen days and topped up on the last one fails even though
             // its closing position looks ample.
-            final LocalDate fortnightStart = LocalDate.parse((String) response.get("fortnightStart"));
+            // The maintenance table covers the whole calendar month, not the fortnight alone: a
-            final LocalDate fortnightEnd = LocalDate.parse((String) response.get("fortnightEnd"));
+            // reviewer comparing two filings of the same month otherwise has to stitch two
+            // fortnights together by hand to see how the position moved across it.
+            final LocalDate fortnightStart = reportingDate.withDayOfMonth(1);
+            final LocalDate fortnightEnd = reportingDate.with(TemporalAdjusters.lastDayOfMonth());
             final List<String> maintainedRoles = new ArrayList<>(List.of("CASH_IN_HAND", "BALANCE_WITH_OTHER_BANKS"));
             maintainedRoles.addAll(customKeysWithUsage("RESERVE", USAGE_MAINTAINED));
 
             // Only up to the reporting date: days after it have not happened, and averaging an
             // unfinished fortnight over its whole length would understate what is held so far.
             final LocalDate averageTo = reportingDate.isBefore(fortnightEnd) ? reportingDate : fortnightEnd;
-            final Map<String, Object> daily = dailyMaintained(fortnightStart, averageTo, officeId, maintainedRoles);
+            final Map<String, Object> daily = dailyMaintained(fortnightStart, averageTo, officeId, maintainedRoles,
+                    required);
 
             final BigDecimal average = (BigDecimal) daily.get("average");
             final BigDecimal lowest = (BigDecimal) daily.get("lowest");
             final BigDecimal dailyFloor = required.multiply(DAILY_MINIMUM_PERCENT).divide(HUNDRED, 2,
                     RoundingMode.HALF_UP);
 
+            daily.put("periodStart", fortnightStart.toString());
+            daily.put("periodEnd", fortnightEnd.toString());
+            daily.put("periodLabel", fortnightStart.getMonth().getDisplayName(java.time.format.TextStyle.FULL,
+                    java.util.Locale.ENGLISH) + " " + fortnightStart.getYear());
             daily.put("fortnightComplete", !reportingDate.isBefore(fortnightEnd));
             daily.put("requiredAverage", required);
             daily.put("dailyMinimumPercent", DAILY_MINIMUM_PERCENT);
@@ -398,31 +413,49 @@ public class RbiReserveReturnApiResource {
         }
         lines.add(subLine("Net Demand and Time Liabilities (NDTL)", ndtl, dtl.configured, monthEnd));
         lines.add(line("SLR-eligible investments (government securities)", investments, monthEnd));
+        // The heads that DO count toward SLR - gold, approved securities, eligible cash - each on
+        // its own line, so what makes up the maintained figure is visible rather than a single total
+        // a reader has to take on trust.
+        for (final CustomHead head : heads) {
+            if (USAGE_SLR_ASSET.equals(head.usage) && !inNamedSection(head)) {
+                lines.add(line(head.label, head.figure, monthEnd));
+            }
+        }
         // Shown for completeness of the month-end liquid position; not added into SLR maintained.
-        // A custom MAINTAINED head IS added: it was declared as counting toward the requirement,
-        // and Form 9's requirement is the SLR one.
         lines.add(line("Cash in hand (memo)", cash, monthEnd));
         for (final CustomHead head : heads) {
-            if (!USAGE_LIABILITY.equals(head.usage) && !USAGE_ASSET_NET.equals(head.usage)) {
+            if (USAGE_LIABILITY.equals(head.usage) || USAGE_ASSET_NET.equals(head.usage)
-                // Every such head is a memo on THIS return, including one marked MAINTAINED: only
+                    || USAGE_SLR_ASSET.equals(head.usage) || inNamedSection(head)) {
-                // SLR-eligible investments count toward SLR, so the label must not suggest the
+                continue;
-                // figure was added into the maintained total when it was not.
-                lines.add(line(head.label + " (memo)", head.figure, monthEnd));
             }
+            // Every remaining head is a memo on THIS return, including one marked MAINTAINED: that
+            // usage means CRR, so the label must not suggest the figure was added into SLR.
+            lines.add(line(head.label + " (memo)", head.figure, monthEnd));
         }
         response.put("lines", lines);
 
-        final boolean computable = rate != null && dtl.configured && investments.configured;
+        // Form A's Memorandum and Annexures appear on Form 9 too - the same heads, under the same
+        // headings, so a reviewer reading either return finds them in the same place.
+        response.put("memorandum", sectionOf(heads, "Memorandum - "));
+        response.put("annexureA", sectionOf(heads, "Annexure A - "));
+        response.put("annexureB", sectionOf(heads, "Annexure B - "));
+
+        // Heads the bank declared as SLR assets - gold, approved securities, eligible cash. Summed
+        // here rather than on the built-in investments role alone, because SLR is maintained in
+        // more than government securities and a bank holding gold has no other place to state it.
+        final BigDecimal slrHeads = totalOf(heads, USAGE_SLR_ASSET);
+        final boolean anySlrAsset = investments.configured || hasUsage(heads, USAGE_SLR_ASSET);
+
+        final boolean computable = rate != null && dtl.configured && anySlrAsset;
         response.put("computable", computable);
 
         if (computable) {
             final BigDecimal required = ndtl.multiply(rate.percentage).divide(HUNDRED, 2, RoundingMode.HALF_UP);
-            // SLR admits government securities, not cash. A head marked MAINTAINED is therefore NOT
+            // A head marked MAINTAINED is deliberately NOT added: that usage means CRR, which is met
-            // added here the way it is on Form 1: it was declared as counting toward a requirement,
+            // in cash and balances with banks. Letting it count here would allow a head configured
-            // and on Form 9 only SLR-eligible investments do. Adding it would let a cash-like head
+            // for Form 1 to inflate the SLR position - exactly the error this return exists to
-            // configured for CRR inflate the SLR position, which is the error this return exists to
+            // detect. Only SLR_ASSET heads and the built-in investments role count.
-            // detect. A bank with more eligible securities maps them to SLR_INVESTMENTS.
+            final BigDecimal held = investments.amount.add(slrHeads);
-            final BigDecimal held = investments.amount;
             response.put("dtlAmount", liabilities);
             response.put("demandLiabilities", dtl.configured ? demand : null);
             response.put("timeLiabilities", dtl.configured ? time : null);
@@ -434,7 +467,11 @@ public class RbiReserveReturnApiResource {
             response.put("compliant", held.compareTo(required) >= 0);
             response.put("maintainedPercentage", percentageOf(held, ndtl));
         }
-        response.put("unmetRequirements", unmet(rate, "SLR", dtl, investments));
+        // The investments role is only reported as missing when nothing else stands in for it: a
+        // bank that maintains SLR in gold, or in securities mapped to its own heads, has configured
+        // the return even though that one built-in role is empty.
+        final List<String> slrUnmet = anySlrAsset ? unmet(rate, "SLR", dtl) : unmet(rate, "SLR", dtl, investments);
+        response.put("unmetRequirements", slrUnmet);
 
         return gson.toJson(response);
     }
@@ -645,6 +682,11 @@ public class RbiReserveReturnApiResource {
     }
 
     /** The total a set of custom heads contributes under one treatment. */
+    /** Whether any head was declared with one usage, so "nothing mapped" can be told from "nil". */
+    private static boolean hasUsage(final List<CustomHead> heads, final String usage) {
+        return heads.stream().anyMatch(h -> usage.equals(h.usage) && h.figure.configured);
+    }
+
     private static BigDecimal totalOf(final List<CustomHead> heads, final String usage) {
         BigDecimal total = BigDecimal.ZERO;
         for (final CustomHead head : heads) {
@@ -753,7 +795,7 @@ public class RbiReserveReturnApiResource {
      * excluding those days would let a fortnight ending on a long weekend average away a shortfall.
      */
     private Map<String, Object> dailyMaintained(final LocalDate from, final LocalDate to, final Long officeId,
-            final List<String> maintainedRoles) {
+            final List<String> maintainedRoles, final BigDecimal required) {
         final List<Map<String, Object>> days = new ArrayList<>();
         BigDecimal total = BigDecimal.ZERO;
         BigDecimal lowest = null;
@@ -771,7 +813,11 @@ public class RbiReserveReturnApiResource {
             }
             final Map<String, Object> row = new LinkedHashMap<>();
             row.put("date", day.toString());
+            // Each day carries the requirement it was measured against and the gap, so a reader can
+            // see WHY a day passed or failed without recomputing the percentage themselves.
+            row.put("required", required);
             row.put("amount", held);
+            row.put("surplus", held.subtract(required));
             days.add(row);
         }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/rbireserve/jobs/saveformareturn/SaveRbiFormAReturnJobConfig.java

@@ -0,0 +1,60 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.rbireserve.jobs.saveformareturn;
+
+import org.apache.fineract.infrastructure.jobs.service.JobName;
+import org.apache.fineract.portfolio.rbireserve.service.RbiFormAAutoSaveService;
+import org.springframework.batch.core.Job;
+import org.springframework.batch.core.Step;
+import org.springframework.batch.core.job.builder.JobBuilder;
+import org.springframework.batch.core.launch.support.RunIdIncrementer;
+import org.springframework.batch.core.repository.JobRepository;
+import org.springframework.batch.core.step.builder.StepBuilder;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.transaction.PlatformTransactionManager;
+
+@Configuration
+public class SaveRbiFormAReturnJobConfig {
+
+    @Autowired
+    private JobRepository jobRepository;
+    @Autowired
+    private PlatformTransactionManager transactionManager;
+    @Autowired
+    private RbiFormAAutoSaveService rbiFormAAutoSaveService;
+
+    @Bean
+    public SaveRbiFormAReturnTasklet saveRbiFormAReturnTasklet() {
+        return new SaveRbiFormAReturnTasklet(rbiFormAAutoSaveService);
+    }
+
+    @Bean
+    protected Step saveRbiFormAReturnStep() {
+        return new StepBuilder(JobName.SAVE_RBI_FORM_A_RETURN.name(), jobRepository)
+                .tasklet(saveRbiFormAReturnTasklet(), transactionManager).build();
+    }
+
+    @Bean
+    public Job saveRbiFormAReturnJob() {
+        return new JobBuilder(JobName.SAVE_RBI_FORM_A_RETURN.name(), jobRepository).start(saveRbiFormAReturnStep())
+                .incrementer(new RunIdIncrementer()).build();
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/rbireserve/jobs/saveformareturn/SaveRbiFormAReturnTasklet.java

@@ -0,0 +1,42 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.rbireserve.jobs.saveformareturn;
+
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.portfolio.rbireserve.service.RbiFormAAutoSaveService;
+import org.springframework.batch.core.StepContribution;
+import org.springframework.batch.core.scope.context.ChunkContext;
+import org.springframework.batch.core.step.tasklet.Tasklet;
+import org.springframework.batch.repeat.RepeatStatus;
+
+/**
+ * Runs the Form A auto-save. The service decides whether today actually closes a fortnight, so the
+ * tasklet stays a thin trigger and the rule lives in one place.
+ */
+@RequiredArgsConstructor
+public class SaveRbiFormAReturnTasklet implements Tasklet {
+
+    private final RbiFormAAutoSaveService service;
+
+    @Override
+    public RepeatStatus execute(final StepContribution contribution, final ChunkContext chunkContext) {
+        service.saveCurrentFortnight();
+        return RepeatStatus.FINISHED;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/rbireserve/service/RbiFormAAutoSaveService.java

@@ -0,0 +1,153 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.rbireserve.service;
+
+import com.google.gson.Gson;
+import com.google.gson.JsonObject;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.time.temporal.TemporalAdjusters;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.apache.fineract.portfolio.rbireserve.api.RbiReserveReturnApiResource;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+/**
+ * Keeps a copy of each fortnight's Form A without anyone having to remember to.
+ *
+ * Form 1 is filed twice a month, and what it reports is a position that cannot be recovered later: a
+ * backdated journal entry, a re-mapped GL account or a corrected rate all move figures that were
+ * already reported, so a fortnight nobody saved is a fortnight whose filed statement no longer
+ * exists anywhere. The job runs on the days the fortnight closes and stores the return as it stands
+ * at that close.
+ *
+ * It saves as DRAFT and nothing more. Checking, approving and submitting stay human acts - the job
+ * exists so the figures survive, not so a return files itself.
+ *
+ * It never overwrites: a fortnight already saved, by hand or by an earlier run, is left exactly as
+ * it is. Re-running the job must not replace a statement somebody has already reviewed.
+ */
+@Service
+@RequiredArgsConstructor
+@Slf4j
+public class RbiFormAAutoSaveService {
+
+    private static final String FORM_CODE = "FORM_1";
+
+    private final JdbcTemplate jdbcTemplate;
+    private final RbiReserveReturnApiResource returnApiResource;
+    private final Gson gson = new Gson();
+
+    /**
+     * Saves the fortnight that closes on the business date, if it has not been saved already.
+     *
+     * Scheduled for the 15th and the last day of each month, but it does not trust the schedule: it
+     * checks the date itself, so a mis-set cron or a manual run on the wrong day cannot file a
+     * fortnight that has not closed.
+     */
+    @Transactional
+    public void saveCurrentFortnight() {
+        final LocalDate today = DateUtils.getBusinessLocalDate();
+        final LocalDate monthEnd = today.with(TemporalAdjusters.lastDayOfMonth());
+
+        final boolean fortnightCloses = today.getDayOfMonth() == 15 || today.equals(monthEnd);
+        if (!fortnightCloses) {
+            log.debug("RBI Form A auto-save: {} is not a fortnight end, nothing to save.", today);
+            return;
+        }
+
+        final Integer existing = jdbcTemplate.queryForObject(
+                "SELECT COUNT(*) FROM m_rbi_form_a_filing WHERE form_code = ? AND reporting_date = ?", Integer.class,
+                FORM_CODE, java.sql.Date.valueOf(today));
+        if (existing != null && existing > 0) {
+            log.info("RBI Form A auto-save: {} is already saved, leaving it untouched.", today);
+            return;
+        }
+
+        final JsonObject report;
+        try {
+            // Computed through the same endpoint the screen uses, so an auto-saved return and one
+            // saved by hand cannot come out differently.
+            report = gson.fromJson(returnApiResource.form1(today.toString(), null), JsonObject.class);
+        } catch (final RuntimeException e) {
+            // A return that cannot be computed is not an error worth failing the batch over - an
+            // unmapped role or a missing rate is a configuration gap, and the next run picks it up
+            // once it is filled. Logged rather than thrown so one tenant's gap does not stop others.
+            log.warn("RBI Form A auto-save: could not compute the return for {}: {}", today, e.getMessage());
+            return;
+        }
+
+        if (report == null || !report.has("computable") || !report.get("computable").getAsBoolean()) {
+            log.info("RBI Form A auto-save: the return for {} is not computable yet; not saving a partial statement.",
+                    today);
+            return;
+        }
+
+        final LocalDate periodStart = date(report, "fortnightStart");
+        final LocalDate periodEnd = date(report, "fortnightEnd");
+        BigDecimal average = null;
+        if (report.has("maintenance") && report.get("maintenance").isJsonObject()) {
+            average = decimal(report.getAsJsonObject("maintenance"), "average");
+        }
+
+        jdbcTemplate.update("""
+                INSERT INTO m_rbi_form_a_filing
+                    (form_code, reporting_date, fortnight_end, period_start, period_end, status, report_json,
+                     ndtl_amount, required_amount, maintained_amount, average_maintained, rate_percentage,
+                     remarks, created_on)
+                VALUES (?, ?, ?, ?, ?, 'DRAFT', ?, ?, ?, ?, ?, ?, ?, now())
+                """, FORM_CODE, java.sql.Date.valueOf(today),
+                java.sql.Date.valueOf(periodEnd == null ? today : periodEnd), sqlDate(periodStart), sqlDate(periodEnd),
+                gson.toJson(report), decimal(report, "ndtlAmount"), decimal(report, "requiredAmount"),
+                decimal(report, "maintainedAmount"), average, decimal(report, "ratePercentage"),
+                "Saved automatically at the close of the fortnight.");
+
+        log.info("RBI Form A auto-save: saved the return for {} as a draft.", today);
+    }
+
+    /** Offices the return could be scoped to. Unused today - the job saves the consolidated return. */
+    @SuppressWarnings("unused")
+    private List<Map<String, Object>> offices() {
+        return jdbcTemplate.queryForList("SELECT id, name FROM m_office ORDER BY id");
+    }
+
+    private static java.sql.Date sqlDate(final LocalDate date) {
+        return date == null ? null : java.sql.Date.valueOf(date);
+    }
+
+    private static BigDecimal decimal(final JsonObject object, final String field) {
+        if (object == null || !object.has(field) || object.get(field).isJsonNull()) {
+            return null;
+        }
+        return object.get(field).getAsBigDecimal();
+    }
+
+    private static LocalDate date(final JsonObject object, final String field) {
+        if (object == null || !object.has(field) || object.get(field).isJsonNull()) {
+            return null;
+        }
+        final String value = object.get(field).getAsString();
+        return value == null || value.isBlank() ? null : LocalDate.parse(value);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/CurrentAccountEditWritePlatformServiceJpaRepositoryImpl.java

@@ -250,7 +250,11 @@ public class CurrentAccountEditWritePlatformServiceJpaRepositoryImpl implements
                 .findByCurrentAccountIdAndStatus(currentAccountId, CurrentAccountPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new CurrentAccountNoPendingEditException(currentAccountId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see ShareAccountEditWritePlatformServiceJpaRepositoryImpl and
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement elsewhere.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new CurrentAccountEditSelfApprovalNotAllowedException(currentAccountId);
         }
 
@@ -306,7 +310,11 @@ public class CurrentAccountEditWritePlatformServiceJpaRepositoryImpl implements
                 .findByCurrentAccountIdAndStatus(currentAccountId, CurrentAccountPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new CurrentAccountNoPendingEditException(currentAccountId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see ShareAccountEditWritePlatformServiceJpaRepositoryImpl and
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement elsewhere.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new CurrentAccountEditSelfApprovalNotAllowedException(currentAccountId);
         }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/FixedDepositProductWritePlatformServiceJpaRepositoryImpl.java

@@ -260,7 +260,11 @@ public class FixedDepositProductWritePlatformServiceJpaRepositoryImpl implements
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_FD, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsProductSelfApprovalNotAllowedException(productId);
         }
 
@@ -350,7 +354,11 @@ public class FixedDepositProductWritePlatformServiceJpaRepositoryImpl implements
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_FD, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsProductSelfApprovalNotAllowedException(productId);
         }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/RecurringDepositProductWritePlatformServiceJpaRepositoryImpl.java

@@ -264,7 +264,11 @@ public class RecurringDepositProductWritePlatformServiceJpaRepositoryImpl implem
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_RD, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsProductSelfApprovalNotAllowedException(productId);
         }
 
@@ -357,7 +361,11 @@ public class RecurringDepositProductWritePlatformServiceJpaRepositoryImpl implem
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_RD, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsProductSelfApprovalNotAllowedException(productId);
         }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountEditWritePlatformServiceJpaRepositoryImpl.java

@@ -203,7 +203,11 @@ public class SavingsAccountEditWritePlatformServiceJpaRepositoryImpl implements
                 .findBySavingsAccountIdAndStatus(savingsId, SavingsAccountPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsAccountNoPendingEditException(savingsId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsAccountEditSelfApprovalNotAllowedException(savingsId);
         }
 
@@ -265,7 +269,11 @@ public class SavingsAccountEditWritePlatformServiceJpaRepositoryImpl implements
                 .findBySavingsAccountIdAndStatus(savingsId, SavingsAccountPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsAccountNoPendingEditException(savingsId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsAccountEditSelfApprovalNotAllowedException(savingsId);
         }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsProductWritePlatformServiceJpaRepositoryImpl.java

@@ -420,7 +420,11 @@ public class SavingsProductWritePlatformServiceJpaRepositoryImpl implements Savi
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_SAVINGS, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsProductSelfApprovalNotAllowedException(productId);
         }
 
@@ -524,7 +528,11 @@ public class SavingsProductWritePlatformServiceJpaRepositoryImpl implements Savi
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_SAVINGS, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsProductSelfApprovalNotAllowedException(productId);
         }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/shareaccounts/service/ShareAccountEditWritePlatformServiceJpaRepositoryImpl.java

@@ -172,7 +172,12 @@ public class ShareAccountEditWritePlatformServiceJpaRepositoryImpl implements Sh
                 .findByShareAccountIdAndStatus(shareAccountId, ShareAccountPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new ShareAccountNoPendingEditException(shareAccountId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - that permission still lets them approve someone ELSE's request,
+        // it just no longer lets them bypass the hold on their own (matches
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction(), the
+        // equivalent rule for the classic command pipeline).
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new ShareAccountEditSelfApprovalNotAllowedException(shareAccountId);
         }
 
@@ -214,7 +219,12 @@ public class ShareAccountEditWritePlatformServiceJpaRepositoryImpl implements Sh
                 .findByShareAccountIdAndStatus(shareAccountId, ShareAccountPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new ShareAccountNoPendingEditException(shareAccountId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - that permission still lets them approve someone ELSE's request,
+        // it just no longer lets them bypass the hold on their own (matches
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction(), the
+        // equivalent rule for the classic command pipeline).
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new ShareAccountEditSelfApprovalNotAllowedException(shareAccountId);
         }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/shareproducts/service/ShareProductWritePlatformServiceJpaRepositoryImpl.java

@@ -882,7 +882,11 @@ public class ShareProductWritePlatformServiceJpaRepositoryImpl implements ShareP
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_SHARE, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new ShareProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new ShareProductSelfApprovalNotAllowedException(productId);
         }
 
@@ -968,7 +972,11 @@ public class ShareProductWritePlatformServiceJpaRepositoryImpl implements ShareP
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_SHARE, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new ShareProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new ShareProductSelfApprovalNotAllowedException(productId);
         }
 

fineract-provider/src/main/resources/db/changelog/tenant-store/changelog-tenant-store.xml

@@ -32,4 +32,5 @@
      <include file="parts/0009_set_and_encrypt_ro_if_not_exists.xml" relativeToChangelogFile="true"/>
      <include file="parts/0010_set_datetime_precision.xml" relativeToChangelogFile="true"/>
      <include file="parts/0011_create_api_client.xml" relativeToChangelogFile="true"/>
+     <include file="parts/0012_seed_default_platform_api_client.xml" relativeToChangelogFile="true"/>
 </databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant-store/parts/0012_seed_default_platform_api_client.xml

@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership. The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License. You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied. See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <!-- Seeds ONE fixed, well-known platform-operator API key on every deployment, so
+         #/platform-admin/menu-access works out of the box the first time the app is stood up,
+         without anyone needing shell/DB access to mint the first key by hand. It is deliberately
+         the SAME raw value on every deployment/tenant (requested behaviour) rather than a random
+         one generated per install - the trade-off, on purpose: this value is visible to anyone who
+         can read this source file, exactly like a default admin password shipped in a seed script.
+         It is a bootstrap convenience, not a secret. Rotate it for any deployment that is not purely
+         local/dev: insert a new row with a real random key's hash (see ApiClientCredentialService's
+         hashing) and either deactivate or DELETE this row - POST /v1/apiclients is intentionally
+         disabled (see ApiClientAdminApiResource), so rotation is a direct m_api_client write, same
+         as this seed.
+
+         Raw key (only shown here, since it is fixed and not a secret to rotate away from):
+             cbsx_default_platform_operator_key_2026
+         api_key_hash below is SHA-256 of that exact string, hex-encoded, lowercase - matching
+         ApiClientCredentialService#sha256Hex. -->
+    <changeSet id="0012_seed_default_platform_api_client" author="cbs-nitesh">
+        <preConditions onFail="MARK_RAN">
+            <and>
+                <tableExists tableName="m_api_client"/>
+                <sqlCheck expectedResult="0">
+                    SELECT COUNT(*) FROM m_api_client
+                    WHERE api_key_hash = '9d6d4dfa7a1953e33e0acde4fd775aad11689ec540340c7224796447118a3edd'
+                </sqlCheck>
+            </and>
+        </preConditions>
+        <insert tableName="m_api_client">
+            <column name="client_name" value="Default Platform Operator (rotate before real production use)"/>
+            <column name="api_key_hash" value="9d6d4dfa7a1953e33e0acde4fd775aad11689ec540340c7224796447118a3edd"/>
+            <column name="api_key_prefix" value="cbsx_default"/>
+            <column name="allowed_ips"/>
+            <column name="created_by"/>
+            <column name="created_by_tenant" value="ALL"/>
+        </insert>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/final-changelog-tenant.xml

@@ -141,6 +141,9 @@
     <include file="parts/0579_current_product_gl_mappings_own_product_type.xml" relativeToChangelogFile="true"/>
     <include file="parts/0580_unique_core_product_gl_mapping.xml" relativeToChangelogFile="true"/>
     <include file="parts/0581_form_a_completion.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0582_form_a_saved_report.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0583_save_rbi_form_a_return_job.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0584_form9_slr_assets.xml" relativeToChangelogFile="true"/>
     <include file="parts/0582_create_tds_config.xml" relativeToChangelogFile="true"/>
     <!-- Our local 0575 Loan Originator checker-permission migration collided with dev-latest's own
          0575_rbi_reserve_custom_roles.xml once merged (it was only stashed/uncommitted locally, so it
@@ -152,4 +155,6 @@
     <include file="parts/0584_add_manage_survey_permissions.xml" relativeToChangelogFile="true"/>
     <include file="parts/0585_add_loan_cob_catchup_permission.xml" relativeToChangelogFile="true"/>
     <include file="parts/0586_add_system_module_checker_permissions.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0587_fix_current_product_od_scheme_pending_columns.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0588_persist_manually_enabled_maker_checker_permissions.xml" relativeToChangelogFile="true"/>
 </databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0582_form_a_saved_report.xml

@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership. The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License. You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied. See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.9.xsd">
+
+    <!--
+        Lets a generated Form A be kept, so a filed return can be looked at again later exactly as it
+        was filed.
+
+        The summary columns 0581 added are enough to list saved returns, but not to reopen one: a
+        return is a statement, not five numbers, and reopening it has to show the same lines, the
+        same account breakdown and the same daily table that were on it when it was saved. Those
+        cannot be recomputed later and come out the same - a backdated journal entry, a changed GL
+        mapping or a corrected rate all move figures that were already reported. So the rendered
+        return is stored alongside the summary, and a saved report is served from that snapshot
+        rather than recomputed.
+
+        Keyed by (reporting date, form code) rather than by fortnight alone: Form 1 and Form 9 are
+        separate returns that can both be saved for dates in one month, and a bank re-running Form 1
+        for a different date within the same fortnight is saving a different statement, not
+        overwriting the earlier one.
+    -->
+
+    <changeSet author="fineract" id="0582-1-form-a-filing-report-json">
+        <preConditions onFail="MARK_RAN">
+            <and>
+                <tableExists tableName="m_rbi_form_a_filing"/>
+                <not><columnExists tableName="m_rbi_form_a_filing" columnName="report_json"/></not>
+            </and>
+        </preConditions>
+        <addColumn tableName="m_rbi_form_a_filing">
+            <!-- The whole computed return as it was served when saved. TEXT rather than a typed
+                 column set: the return's shape is the API's own, and mirroring it in columns would
+                 mean a migration every time a line is added to the statement. -->
+            <column name="report_json" type="TEXT"/>
+            <!-- FORM_1 or FORM_9. Both are saved through the same screen and the same table. -->
+            <column name="form_code" type="VARCHAR(20)" defaultValue="FORM_1">
+                <constraints nullable="false"/>
+            </column>
+            <column name="office_id" type="BIGINT"/>
+            <!-- Denormalised from the snapshot so the list can show them without parsing the JSON. -->
+            <column name="period_start" type="DATE"/>
+            <column name="period_end" type="DATE"/>
+        </addColumn>
+    </changeSet>
+
+    <changeSet author="fineract" id="0582-2-form-a-filing-rekey-by-date-and-form">
+        <preConditions onFail="MARK_RAN">
+            <and>
+                <tableExists tableName="m_rbi_form_a_filing"/>
+                <columnExists tableName="m_rbi_form_a_filing" columnName="form_code"/>
+            </and>
+        </preConditions>
+        <!--
+            0581 made the fortnight alone unique, which was right while a filing was one row per
+            fortnight. Saving a rendered return makes that wrong: Form 1 and Form 9 both save against
+            dates in the same fortnight and would collide, and re-saving Form 1 for a different
+            reporting date inside one fortnight is a second statement rather than a replacement.
+
+            Dropped and replaced rather than added alongside: leaving the old constraint in place
+            would keep rejecting exactly the rows this change exists to allow.
+        -->
+        <dropUniqueConstraint tableName="m_rbi_form_a_filing" constraintName="uk_rbi_form_a_filing_fortnight"/>
+        <addUniqueConstraint tableName="m_rbi_form_a_filing"
+                             columnNames="form_code, reporting_date"
+                             constraintName="uk_rbi_form_a_filing_form_date"/>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0583_save_rbi_form_a_return_job.xml

@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership. The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License. You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied. See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.9.xsd">
+
+    <!--
+        Saves each fortnight's Form A at the close of that fortnight.
+
+        What a Form A reports cannot be recovered afterwards: a backdated journal entry, a re-mapped
+        GL account or a corrected rate all move figures that were already reported, so a fortnight
+        nobody saved is one whose filed statement no longer exists anywhere. Leaving that to someone
+        remembering to press Save is leaving the bank's own record of what it filed to chance.
+
+        The cron fires at 23:30 on the 15th and on the last day of each month - the two days a
+        fortnight closes under RBI's reckoning. Late enough that the day's postings are in, and the
+        job re-checks the date itself rather than trusting the schedule, so a mis-set cron cannot
+        file a fortnight that has not closed.
+
+        It saves as DRAFT and stops there. Checking, approving and submitting remain human acts; the
+        job exists so the figures survive, not so a return files itself. It also never overwrites a
+        fortnight already saved, by hand or by an earlier run - re-running must not replace a
+        statement somebody has reviewed.
+    -->
+
+    <changeSet author="fineract" id="0583-1-save-rbi-form-a-return-job">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="0">SELECT COUNT(*) FROM job WHERE name = 'Save RBI Form A Return'</sqlCheck>
+        </preConditions>
+        <insert tableName="job">
+            <column name="name" value="Save RBI Form A Return"/>
+            <column name="display_name" value="Save RBI Form A Return"/>
+            <!-- short_name is NOT NULL and capped at 8 characters; see 0145_job_short_name.xml. -->
+            <column name="short_name" value="RBIFRMA"/>
+            <!-- 23:30 on the 15th and on the last day of the month. "L" is Quartz's last-day-of-month
+                 token, which is what makes one expression cover both 28th-of-February and 31st-of-
+                 January without a month-by-month list. -->
+            <column name="cron_expression" value="0 30 23 15,L * ? *"/>
+            <column name="create_time" valueDate="${current_datetime}"/>
+            <column name="task_priority" valueNumeric="5"/>
+            <column name="group_name"/>
+            <column name="previous_run_start_time"/>
+            <column name="job_key" value="Save RBI Form A ReturnJobDetail1 _ DEFAULT"/>
+            <column name="initializing_errorlog"/>
+            <column name="is_active" valueBoolean="true"/>
+            <column name="currently_running" valueBoolean="false"/>
+            <column name="updates_allowed" valueBoolean="true"/>
+            <column name="scheduler_group" valueNumeric="1"/>
+            <column name="is_misfired" valueBoolean="false"/>
+            <column name="node_id" valueNumeric="1"/>
+            <column name="is_mismatched_job" valueBoolean="true"/>
+        </insert>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0584_form9_slr_assets.xml

@@ -0,0 +1,118 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership. The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License. You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied. See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.9.xsd">
+
+    <!--
+        Gives Form 9 the assets SLR is actually maintained in.
+
+        The statutory return is a statement of "cash, gold and unencumbered approved securities" -
+        three classes, not one. The return could previously only read a single built-in role for
+        government securities, so a bank holding gold had nowhere to state it and a bank holding
+        several categories of approved security had to collapse them into one figure.
+
+        Three changes:
+
+          - A new role usage, SLR_ASSET, separate from MAINTAINED. The two returns admit different
+            assets: CRR is met in cash and balances with banks, SLR in cash, gold and approved
+            securities. One usage for both would let a head configured for Form 1 inflate the SLR
+            position, which is the error the return exists to detect.
+
+          - A Gold head, which did not exist at all.
+
+          - The three approved-securities heads seeded by 0581 move from MEMO to SLR_ASSET. They
+            were memo only because nothing counted them; now something does. The advances and
+            money-at-call heads deliberately stay MEMO - they are reported on Form A, and neither is
+            an SLR asset.
+
+        What this does NOT do is decide eligibility. A security that is pledged or encumbered is not
+        SLR-eligible however it is classified, and a GL balance cannot express that - it needs a
+        security master holding each holding's eligibility and encumbrance. Until that exists, these
+        heads report what the ledger holds and an administrator maps only what is genuinely eligible.
+
+        Every changeSet is guarded so this migration is a safe no-op where already applied.
+    -->
+
+    <changeSet author="fineract" id="0584-1-widen-role-usage-constraint">
+        <preConditions onFail="MARK_RAN">
+            <tableExists tableName="m_rbi_reserve_role"/>
+        </preConditions>
+        <!--
+            0575 constrained role_usage to four values. SLR_ASSET is a fifth, so the check has to be
+            widened before any row can carry it - otherwise the inserts below are rejected by the
+            constraint rather than by anything meaningful.
+
+            Dropped and recreated rather than altered: a CHECK constraint has no in-place edit, and
+            recreating it keeps the guard rather than quietly leaving the column unconstrained.
+        -->
+        <sql>
+            ALTER TABLE m_rbi_reserve_role DROP CONSTRAINT IF EXISTS ck_rbi_reserve_role_usage;
+            ALTER TABLE m_rbi_reserve_role ADD CONSTRAINT ck_rbi_reserve_role_usage
+                CHECK (role_usage IN ('LIABILITY', 'ASSET_NET', 'MAINTAINED', 'SLR_ASSET', 'MEMO'));
+        </sql>
+    </changeSet>
+
+    <changeSet author="fineract" id="0584-2-seed-gold-head">
+        <preConditions onFail="MARK_RAN">
+            <and>
+                <tableExists tableName="m_rbi_reserve_role"/>
+                <sqlCheck expectedResult="0">
+                    SELECT COUNT(*) FROM m_rbi_reserve_role WHERE config_key = 'FORMA_SLR_GOLD'
+                </sqlCheck>
+            </and>
+        </preConditions>
+        <insert tableName="m_rbi_reserve_role">
+            <column name="config_key" value="FORMA_SLR_GOLD"/>
+            <column name="label" value="Gold held in India"/>
+            <column name="description" value="Gold held in India, valued as the applicable rules require. Counts toward SLR maintained on Form 9. Map the GL that carries the gold holding - the return reads its balance, so that balance must already be at the valuation the return is to report."/>
+            <column name="role_group" value="RESERVE"/>
+            <column name="role_usage" value="SLR_ASSET"/>
+            <column name="position" valueNumeric="210"/>
+            <column name="created_on" valueComputed="now()"/>
+        </insert>
+    </changeSet>
+
+    <changeSet author="fineract" id="0584-3-securities-count-toward-slr">
+        <preConditions onFail="MARK_RAN">
+            <and>
+                <tableExists tableName="m_rbi_reserve_role"/>
+                <sqlCheck expectedResult="3">
+                    SELECT COUNT(*) FROM m_rbi_reserve_role
+                     WHERE config_key IN ('FORMA_INV_CENTRAL_GOVT', 'FORMA_INV_STATE_GOVT',
+                                          'FORMA_INV_OTHER_APPROVED')
+                </sqlCheck>
+            </and>
+        </preConditions>
+        <!--
+            Approved securities are what SLR is principally maintained in, so they count rather than
+            merely appear. Advances and money at call are left MEMO: both are reported on Form A and
+            neither is an SLR asset, and promoting them here would overstate the position.
+        -->
+        <update tableName="m_rbi_reserve_role">
+            <column name="role_usage" value="SLR_ASSET"/>
+            <where>
+                config_key IN ('FORMA_INV_CENTRAL_GOVT', 'FORMA_INV_STATE_GOVT', 'FORMA_INV_OTHER_APPROVED')
+                AND role_usage = 'MEMO'
+            </where>
+        </update>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0587_fix_current_product_od_scheme_pending_columns.xml

@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership. The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License. You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied. See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+<!--
+    2033 (savings module changelog) was meant to add the OD-scheme columns from 0577
+    (m_current_product) onto the pending-edit shadow table too, so an approved Current product edit
+    doesn't silently drop them. It guards on tableExists("m_savings_product_temp"), with an "s",
+    but the table 0369 actually created is "m_saving_product_temp" (singular, no "s"). That guard has
+    therefore never once matched, on any tenant: onFail="MARK_RAN" records 2033 as applied without
+    ever running its addColumn, so the columns were never added anywhere, and any edit to a Current
+    product with OD fields set fails the moment it reaches the pending-edit table ("column
+    od_excess_allowed does not exist"). Left 2033 itself untouched, since rewriting an already-applied
+    changeset's history is the wrong fix, and repeats it here against the table name that's actually
+    real, guarded the same way so it's a no-op wherever a hand patch already added these.
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <changeSet author="CBS" id="0587-1-fix-saving-product-temp-od-min-limit">
+        <preConditions onFail="MARK_RAN">
+            <and>
+                <tableExists tableName="m_saving_product_temp"/>
+                <not>
+                    <columnExists tableName="m_saving_product_temp" columnName="od_min_limit"/>
+                </not>
+            </and>
+        </preConditions>
+        <addColumn tableName="m_saving_product_temp">
+            <column name="od_min_limit" type="DECIMAL(19,6)"/>
+            <column name="od_security_type" type="VARCHAR(20)"/>
+        </addColumn>
+    </changeSet>
+
+    <changeSet author="CBS" id="0587-2-fix-saving-product-temp-od-excess-drawing">
+        <preConditions onFail="MARK_RAN">
+            <and>
+                <tableExists tableName="m_saving_product_temp"/>
+                <not>
+                    <columnExists tableName="m_saving_product_temp" columnName="od_excess_allowed"/>
+                </not>
+            </and>
+        </preConditions>
+        <addColumn tableName="m_saving_product_temp">
+            <column name="od_excess_allowed" type="BOOLEAN"/>
+            <column name="od_excess_limit_percent" type="DECIMAL(19,6)"/>
+            <column name="od_penal_rate" type="DECIMAL(19,6)"/>
+        </addColumn>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0588_persist_manually_enabled_maker_checker_permissions.xml

@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <!-- Converts manually-applied Configure Maker Checker Tasks changes into a repeatable migration.
+         During Admin -> Organization and Admin -> System testing, can_maker_checker was switched on
+         (via System -> Configure Maker Checker Tasks) for the 28 permissions below, directly in the
+         dev database - none of that was ever captured by a migration, so a fresh/other environment
+         restored from this changelog history would come up with every one of them still at its
+         originally-seeded false value. Every code here was independently confirmed, via read-only
+         inspection of both its origin changeset and the live database, to be seeded can_maker_checker
+         = false and currently true in the running dev DB with no existing changeset already covering
+         the flip (the one precedent for this pattern, DELETE_OFFICE, was flipped by changeset
+         0538_enable_maker_checker_for_delete_office and is deliberately left untouched here).
+
+         This changeset only ever moves can_maker_checker from false to true for these exact codes -
+         entity_name, action_name, grouping and every other column are left exactly as their origin
+         changeset defined them (including the pre-existing DELETE_ACCOUNTNUMBERFORMAT entity_name
+         drift, which is out of scope for this change and is not corrected here). No _CHECKER row is
+         touched: those already exist for every code below (added earlier by 0583/0586, or by base
+         Fineract for the stock codes), and can_maker_checker is not a column on a _CHECKER row.
+
+         Grouped by the screen each permission belongs to:
+           - Currency Configuration:            UPDATE_CURRENCY
+           - Manage Funds:                      CREATE_FUND
+           - Working Days:                      UPDATE_WORKINGDAYS
+           - Payment Type:                      CREATE_PAYMENTTYPE, UPDATE_PAYMENTTYPE, DELETE_PAYMENTTYPE
+           - Sponsor Banks:                     CREATE_SPONSORBANK, UPDATE_SPONSORBANK
+           - Branch Profile:                    UPDATE_BRANCHPROFILE
+           - Manage Data Tables:                CREATE_DATATABLE, UPDATE_DATATABLE, DELETE_DATATABLE
+           - Manage Codes:                       CREATE_CODE, UPDATE_CODE, DELETE_CODE,
+                                                 CREATE_CODEVALUE, UPDATE_CODEVALUE, DELETE_CODEVALUE
+           - Manage Reports:                    CREATE_REPORT, UPDATE_REPORT, DELETE_REPORT
+           - Manage Hooks:                      CREATE_HOOK, UPDATE_HOOK, DELETE_HOOK
+           - Account Number Preferences:        CREATE_ACCOUNTNUMBERFORMAT, DELETE_ACCOUNTNUMBERFORMAT
+           - Manage User Agreement:             CREATE_USERAGREEMENT
+           - Manage Jobs (COB Workflow Step Reorder): UPDATE_BATCH_BUSINESS_STEP
+
+         Deliberately NOT included (confirmed still false, or out of scope, and left untouched):
+           - UPDATE_PERMISSION, UPDATE_CONFIGURATION (the Configure Maker Checker Tasks self-lockout
+             exclusion added by PermissionReadPlatformServiceImpl stays in effect; these remain false)
+           - UPDATE_SPONSORDDGLMAPPING, all Entity-to-Entity Mapping, External Services and Manage
+             Survey permissions (confirmed still false - never actually toggled on)
+           - CREATE_ROLE/UPDATE_ROLE/DELETE_ROLE/etc., CREATE_GLACCOUNT, CREATE_CHARGE,
+             CREATE_LOANPRODUCT, CREATE_SAVINGSPRODUCT and other permissions observed to already be
+             true in the live DB but belonging to Accounting/Products/Roles modules, not Admin ->
+             Organization or Admin -> System - out of scope for this change and left as pre-existing
+             drift for a separate decision. -->
+    <changeSet id="0588_persist_manually_enabled_maker_checker_permissions" author="cbs-anshul">
+        <update tableName="m_permission">
+            <column name="can_maker_checker" valueBoolean="true"/>
+            <where>code IN (
+                'UPDATE_CURRENCY',
+                'CREATE_FUND',
+                'UPDATE_WORKINGDAYS',
+                'CREATE_PAYMENTTYPE', 'UPDATE_PAYMENTTYPE', 'DELETE_PAYMENTTYPE',
+                'CREATE_SPONSORBANK', 'UPDATE_SPONSORBANK',
+                'UPDATE_BRANCHPROFILE',
+                'CREATE_DATATABLE', 'UPDATE_DATATABLE', 'DELETE_DATATABLE',
+                'CREATE_CODE', 'UPDATE_CODE', 'DELETE_CODE',
+                'CREATE_CODEVALUE', 'UPDATE_CODEVALUE', 'DELETE_CODEVALUE',
+                'CREATE_REPORT', 'UPDATE_REPORT', 'DELETE_REPORT',
+                'CREATE_HOOK', 'UPDATE_HOOK', 'DELETE_HOOK',
+                'CREATE_ACCOUNTNUMBERFORMAT', 'DELETE_ACCOUNTNUMBERFORMAT',
+                'CREATE_USERAGREEMENT',
+                'UPDATE_BATCH_BUSINESS_STEP'
+            )</where>
+        </update>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/test/java/org/apache/fineract/commands/service/CommandSourceServiceTest.java

@@ -116,7 +116,11 @@ public class CommandSourceServiceTest {
     }
 
     @Test
-    public void testProcessCommand_NonGLAccount_SuperUser_BypassesMakerChecker() {
+    public void testProcessCommand_NonGLAccount_SuperUser_OwnSubmission_DoesNotBypassMakerChecker() {
+        // A maker who happens to hold CHECKER_SUPER_USER must not auto-approve their own submission -
+        // CHECKER_SUPER_USER only ever lets its holder approve a DIFFERENT user's request (see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction()). This
+        // replaces the old bypass this test used to assert.
         NewCommandSourceHandler handler = Mockito.mock(NewCommandSourceHandler.class);
         JsonCommand jsonCommand = Mockito.mock(JsonCommand.class);
         CommandSource commandSource = Mockito.mock(CommandSource.class);
@@ -125,6 +129,8 @@ public class CommandSourceServiceTest {
         Mockito.when(commandSource.getPermissionCode()).thenReturn("WITHDRAW_SAVINGSACCOUNT");
         Mockito.when(commandSource.getEntityName()).thenReturn("SAVINGSACCOUNT");
         Mockito.when(commandSource.getActionName()).thenReturn("WITHDRAW");
+        Mockito.when(commandSource.getId()).thenReturn(300L);
+        Mockito.when(commandSource.getResourceId()).thenReturn(400L);
         Mockito.when(configurationDomainService.isMakerCheckerEnabledForTask("WITHDRAW_SAVINGSACCOUNT")).thenReturn(true);
         Mockito.when(superUser.isCheckerSuperUser()).thenReturn(true);
 
@@ -132,12 +138,12 @@ public class CommandSourceServiceTest {
                 .withCommandId(1L).build();
         Mockito.when(handler.processCommand(jsonCommand)).thenReturn(dummyResult);
 
-        org.apache.fineract.infrastructure.core.data.CommandProcessingResult result = underTest.processCommand(handler, jsonCommand,
+        Assertions.assertThrows(org.apache.fineract.commands.exception.RollbackTransactionNotApprovedException.class, () -> {
-                commandSource, superUser, false);
+            underTest.processCommand(handler, jsonCommand, commandSource, superUser, false);
+        });
 
-        Assertions.assertNotNull(result);
+        Mockito.verify(commandSource).markAsAwaitingApproval();
-        Mockito.verify(commandSource).markAsChecked(superUser);
+        Mockito.verify(commandSource, Mockito.never()).markAsChecked(any());
-        Mockito.verify(commandSource, Mockito.never()).markAsAwaitingApproval();
     }
 
     @Test