App/.env.example

@@ -78,9 +78,8 @@ FORGEJO_TOKEN=
 # Let submitters (TECHNICAL/MANNING) read & export every PO and open the History
 # page (read-only). Opt-in — on only when exactly "true".
 # NEXT_PUBLIC_SUBMITTER_VIEW_ALL_ENABLED=true
-# Let a PO's own submitter (plus Accounts/Manager/SuperUser) add attachments to it
+# Let a CLOSED PO's own submitter (plus Accounts/Manager/SuperUser) add attachments
-# in any state except rejected/cancelled — remediation for POs whose uploads were
+# to it — remediation for POs whose uploads were lost to the document-upload bug.
-# lost to the document-upload bug, and the general "attach after the fact" affordance.
 # Opt-in — on only when exactly "true".
 # NEXT_PUBLIC_CLOSED_PO_ATTACHMENTS_ENABLED=true
 

App/CLAUDE.md

@@ -295,7 +295,7 @@ APP_INTERNAL_URL        # Base URL PdfService reaches the app at (falls back to
 NEXT_PUBLIC_INVENTORY_ENABLED   # Inventory feature flag
 NEXT_PUBLIC_SUBMITTER_VIEW_ALL_ENABLED  # Opt-in ("true"): submitters (TECHNICAL/MANNING) read & export every PO + History (read-only)
 NEXT_PUBLIC_CREWING_ENABLED     # Crewing module feature flag (opt-in "true"; off by default)
-NEXT_PUBLIC_CLOSED_PO_ATTACHMENTS_ENABLED  # Opt-in ("true"): a PO's own submitter + Accounts/Manager/SuperUser may add attachments in any state except rejected/cancelled (upload-bug remediation + general "attach after the fact"). Off by default.
+NEXT_PUBLIC_CLOSED_PO_ATTACHMENTS_ENABLED  # Opt-in ("true"): a CLOSED PO's own submitter + Accounts/Manager/SuperUser may add attachments (remediation for the upload bug). Off by default.
 NEXT_PUBLIC_ENV_LABEL   # When set, shows a non-prod banner (EnvBanner). Leave unset in prod.
 ```
 

App/app/(portal)/po/new/new-po-form.tsx

@@ -38,21 +38,9 @@ interface Props {
   initialVendorId?: string;
   initialVesselId?: string;
   initialCompanyId?: string;
-  // Duplicate-PO prefill (issue #142) — copy editable order fields onto a new draft.
-  initialTitle?: string;
-  initialAccountId?: string;
-  initialMultiAccount?: boolean;
-  initialProjectCode?: string | null;
-  initialPlaceOfDelivery?: string | null;
-  initialDateRequired?: string;
-  initialPiQuotationNo?: string;
-  initialPiQuotationDate?: string;
-  initialRequisitionNo?: string;
-  initialRequisitionDate?: string;
-  initialTerms?: PoTerm[];
 }
 
-export function NewPoForm({ vessels, accounts, vendors, companies, deliveryOptions, projectCodeOptions, termsCatalogue, defaultTerms, initialLineItems, initialVendorId, initialVesselId, initialCompanyId, initialTitle, initialAccountId, initialMultiAccount, initialProjectCode, initialPlaceOfDelivery, initialDateRequired, initialPiQuotationNo, initialPiQuotationDate, initialRequisitionNo, initialRequisitionDate, initialTerms }: Props) {
+export function NewPoForm({ vessels, accounts, vendors, companies, deliveryOptions, projectCodeOptions, termsCatalogue, defaultTerms, initialLineItems, initialVendorId, initialVesselId, initialCompanyId }: Props) {
   const router = useRouter();
   const [lineItems, setLineItems] = useState<LineItemInput[]>(
     initialLineItems && initialLineItems.length > 0 ? initialLineItems : [EMPTY_LINE]
@@ -60,11 +48,9 @@ export function NewPoForm({ vessels, accounts, vendors, companies, deliveryOptio
   const [files, setFiles] = useState<File[]>([]);
   const [submitting, setSubmitting] = useState<"draft" | "submit" | null>(null);
   const [error, setError] = useState("");
-  const [multiAccount, setMultiAccount] = useState(initialMultiAccount ?? false);
+  const [multiAccount, setMultiAccount] = useState(false);
-  const [defaultAccountId, setDefaultAccountId] = useState(initialAccountId ?? "");
+  const [defaultAccountId, setDefaultAccountId] = useState("");
-  const [terms, setTerms] = useState<PoTerm[]>(
+  const [terms, setTerms] = useState<PoTerm[]>(defaultTerms);
-    initialTerms && initialTerms.length > 0 ? initialTerms : defaultTerms
-  );
   const [dirty, setDirty] = useState(false);
   const markDirty = () => setDirty(true);
 
@@ -128,7 +114,7 @@ export function NewPoForm({ vessels, accounts, vendors, companies, deliveryOptio
             <label className="block text-sm font-medium text-neutral-700 mb-1.5">
               Title <span className="text-danger">*</span>
             </label>
-            <input name="title" required defaultValue={initialTitle ?? ""} className={INPUT_CLS} placeholder="Brief description of what is being ordered" />
+            <input name="title" required className={INPUT_CLS} placeholder="Brief description of what is being ordered" />
           </div>
 
           {/* Cost Centre — vessels only */}
@@ -177,7 +163,7 @@ export function NewPoForm({ vessels, accounts, vendors, companies, deliveryOptio
           </div>
           <div>
             <label className="block text-sm font-medium text-neutral-700 mb-1.5">Project Code</label>
-            <ProjectCodeField options={projectCodeOptions} current={initialProjectCode} className={INPUT_CLS} />
+            <ProjectCodeField options={projectCodeOptions} className={INPUT_CLS} />
             {projectCodeOptions.length === 0 && (
               <p className="mt-1.5 text-xs text-neutral-500">
                 No project codes configured yet — a Manager can add them under Administration → Project Codes.
@@ -186,7 +172,7 @@ export function NewPoForm({ vessels, accounts, vendors, companies, deliveryOptio
           </div>
           <div>
             <label className="block text-sm font-medium text-neutral-700 mb-1.5">Delivery Date Required</label>
-            <input name="dateRequired" type="date" defaultValue={initialDateRequired ?? ""} className={INPUT_CLS} />
+            <input name="dateRequired" type="date" className={INPUT_CLS} />
           </div>
         </div>
       </section>
@@ -197,11 +183,11 @@ export function NewPoForm({ vessels, accounts, vendors, companies, deliveryOptio
         <div className="grid grid-cols-1 gap-4 sm:grid-cols-2">
           <div>
             <label className="block text-sm font-medium text-neutral-700 mb-1.5">PI / Quotation No.</label>
-            <input name="piQuotationNo" defaultValue={initialPiQuotationNo ?? ""} className={INPUT_CLS} placeholder='e.g. Verbal, INV-001' />
+            <input name="piQuotationNo" className={INPUT_CLS} placeholder='e.g. Verbal, INV-001' />
           </div>
           <div>
             <label className="block text-sm font-medium text-neutral-700 mb-1.5">PI / Quotation Date</label>
-            <input name="piQuotationDate" type="date" defaultValue={initialPiQuotationDate ?? ""} className={INPUT_CLS} />
+            <input name="piQuotationDate" type="date" className={INPUT_CLS} />
           </div>
         </div>
       </section>
@@ -212,11 +198,11 @@ export function NewPoForm({ vessels, accounts, vendors, companies, deliveryOptio
         <div className="grid grid-cols-1 gap-4 sm:grid-cols-2">
           <div>
             <label className="block text-sm font-medium text-neutral-700 mb-1.5">Cost Centre / Office Requisition No.</label>
-            <input name="requisitionNo" defaultValue={initialRequisitionNo ?? ""} className={INPUT_CLS} placeholder="Optional" />
+            <input name="requisitionNo" className={INPUT_CLS} placeholder="Optional" />
           </div>
           <div>
             <label className="block text-sm font-medium text-neutral-700 mb-1.5">Requisition Date</label>
-            <input name="requisitionDate" type="date" defaultValue={initialRequisitionDate ?? ""} className={INPUT_CLS} />
+            <input name="requisitionDate" type="date" className={INPUT_CLS} />
           </div>
         </div>
       </section>
@@ -226,7 +212,7 @@ export function NewPoForm({ vessels, accounts, vendors, companies, deliveryOptio
         <h2 className="text-base font-semibold text-neutral-900 mb-4">Delivery</h2>
         <div>
           <label className="block text-sm font-medium text-neutral-700 mb-1.5">Place of Delivery</label>
-          <DeliveryLocationField options={deliveryOptions} current={initialPlaceOfDelivery} className={INPUT_CLS} />
+          <DeliveryLocationField options={deliveryOptions} className={INPUT_CLS} />
           {deliveryOptions.length === 0 && (
             <p className="mt-1.5 text-xs text-neutral-500">
               No delivery locations configured yet — a Manager can add them under Administration → Delivery Locations.

App/app/(portal)/po/new/page.tsx

@@ -6,7 +6,6 @@ import { NewPoForm } from "./new-po-form";
 import { buildAccountGroups } from "@/lib/cost-centre-groups";
 import { formatDeliveryLocation } from "@/lib/delivery-location";
 import { getTermsCatalogue, getDefaultPoTerms } from "@/lib/terms-data";
-import { buildDuplicatePrefill, type DuplicatePrefill } from "@/lib/duplicate-po";
 import type { Metadata } from "next";
 import type { LineItemInput } from "@/lib/validations/po";
 import type { CartItem } from "@/lib/cart";
@@ -14,7 +13,7 @@ import type { CartItem } from "@/lib/cart";
 export const metadata: Metadata = { title: "New Purchase Order" };
 
 interface Props {
-  searchParams: Promise<{ cart?: string; vesselId?: string; duplicate?: string }>;
+  searchParams: Promise<{ cart?: string; vesselId?: string }>;
 }
 
 export default async function NewPoPage({ searchParams }: Props) {
@@ -23,23 +22,11 @@ export default async function NewPoPage({ searchParams }: Props) {
 
   if (!hasPermission(session.user.role, "create_po")) redirect("/dashboard");
 
-  const { cart, vesselId, duplicate } = await searchParams;
+  const { cart, vesselId: initialVesselId } = await searchParams;
 
-  // Duplicate-PO prefill (issue #142): copy a source PO's editable order fields
-  // onto a fresh draft. Nothing is written until the user saves/submits — same
-  // shape as the cart→new-PO prefill below, just a richer field set.
-  let dup: DuplicatePrefill | null = null;
   let initialLineItems: LineItemInput[] | undefined;
   let initialVendorId: string | undefined;
-  let initialVesselId: string | undefined = vesselId;
+  if (cart) {
-
-  if (duplicate) {
-    const source = await db.purchaseOrder.findUnique({
-      where: { id: duplicate },
-      include: { lineItems: { orderBy: { sortOrder: "asc" } } },
-    });
-    if (source) dup = buildDuplicatePrefill(source);
-  } else if (cart) {
     try {
       const cartItems: CartItem[] = JSON.parse(decodeURIComponent(cart));
       if (Array.isArray(cartItems) && cartItems.length > 0) {
@@ -96,21 +83,9 @@ export default async function NewPoPage({ searchParams }: Props) {
         projectCodeOptions={projectCodeOptions}
         termsCatalogue={termsCatalogue}
         defaultTerms={defaultTerms}
-        initialLineItems={dup?.initialLineItems ?? initialLineItems}
+        initialLineItems={initialLineItems}
-        initialVendorId={dup?.initialVendorId ?? initialVendorId}
+        initialVendorId={initialVendorId}
-        initialVesselId={dup?.initialVesselId ?? initialVesselId}
+        initialVesselId={initialVesselId}
-        initialCompanyId={dup?.initialCompanyId}
-        initialTitle={dup?.initialTitle}
-        initialAccountId={dup?.initialAccountId}
-        initialMultiAccount={dup?.initialMultiAccount}
-        initialProjectCode={dup?.initialProjectCode}
-        initialPlaceOfDelivery={dup?.initialPlaceOfDelivery}
-        initialDateRequired={dup?.initialDateRequired}
-        initialPiQuotationNo={dup?.initialPiQuotationNo}
-        initialPiQuotationDate={dup?.initialPiQuotationDate}
-        initialRequisitionNo={dup?.initialRequisitionNo}
-        initialRequisitionDate={dup?.initialRequisitionDate}
-        initialTerms={dup?.initialTerms}
       />
     </div>
   );

App/app/actions/upload-po-documents.ts

@@ -3,8 +3,7 @@
 import { auth } from "@/auth";
 import { db } from "@/lib/db";
 import { buildStorageKey, uploadBuffer } from "@/lib/storage";
-import { canAddPoAttachment } from "@/lib/permissions";
+import { canAddClosedPoAttachment } from "@/lib/permissions";
-import { CLOSED_PO_ATTACHMENTS_ENABLED } from "@/lib/feature-flags";
 import { revalidatePath } from "next/cache";
 
 // Matches the FileUploader hint ("up to 10 MB each") and
@@ -44,26 +43,17 @@ export async function uploadPoDocuments(
   });
   if (!po) return { error: "PO not found" };
 
-  // A voided PO never accepts attachments, regardless of the flag.
+  // A CLOSED PO is otherwise immutable; attaching to one is only allowed via the
-  if (po.status === "REJECTED" || po.status === "CANCELLED") {
+  // feature-flagged remediation path (canAddClosedPoAttachment). The normal create
-    return { error: "Attachments can't be added to a rejected or cancelled purchase order." };
+  // and receipt flows upload while the PO is pre-CLOSED, so they're unaffected.
-  }
+  if (po.status === "CLOSED") {
-
+    const allowed = canAddClosedPoAttachment(session.user.role, {
-  if (CLOSED_PO_ATTACHMENTS_ENABLED) {
-    // Feature on: only the PO's submitter + Accounts / Manager / SuperUser may
-    // attach, in any non-voided state. The normal create / receipt flows are run
-    // by exactly those actors, so they keep working.
-    const allowed = canAddPoAttachment(session.user.role, po.status, {
       isSubmitter: po.submitterId === session.user.id,
     });
     if (!allowed) {
-      return { error: "Adding attachments to this purchase order isn't allowed." };
-    }
-  } else if (po.status === "CLOSED") {
-    // Feature off: a closed PO stays immutable (legacy behaviour). The create /
-    // receipt flows upload while the PO is pre-CLOSED, so they're unaffected.
       return { error: "Adding attachments to a closed purchase order isn't allowed." };
     }
+  }
 
   for (const file of files) {
     if (!(file instanceof File) || file.size === 0) continue;

App/components/po/closed-po-attachment-uploader.tsx

@@ -6,12 +6,12 @@ import { FileUploader } from "@/components/po/file-uploader";
 import { uploadPoDocuments } from "@/app/actions/upload-po-documents";
 
 /**
- * Feature-flagged uploader shown on a PO's detail page so its submitter (or
+ * Feature-flagged uploader shown on a CLOSED PO's detail page so its submitter (or
- * Accounts / Manager / SuperUser) can add documents after the fact — in any state
+ * Accounts / Manager / SuperUser) can attach documents that were lost to the upload
- * except rejected/cancelled. Gating is decided server-side in po-detail.tsx; the
+ * bug. Gating is decided server-side in po-detail.tsx; the server action re-checks
- * server action re-checks the permission, so this component is only the UI.
+ * the permission, so this component is only the UI.
  */
-export function PoAttachmentUploader({ poId }: { poId: string }) {
+export function ClosedPoAttachmentUploader({ poId }: { poId: string }) {
   const router = useRouter();
   const [files, setFiles] = useState<File[]>([]);
   const [busy, setBusy] = useState(false);
@@ -36,7 +36,7 @@ export function PoAttachmentUploader({ poId }: { poId: string }) {
     <div className="mt-5 border-t border-neutral-100 pt-4">
       <p className="text-xs font-semibold uppercase tracking-wide text-neutral-500">Add attachments</p>
       <p className="mt-0.5 text-xs text-neutral-400">
-        Attach any documents that are missing from this purchase order.
+        This purchase order is closed. Attach any documents that are missing.
       </p>
       <div className="mt-3">
         <FileUploader files={files} onChange={setFiles} disabled={busy} />

App/components/po/po-detail.tsx

@@ -5,14 +5,13 @@ import { DiscardDraftButton } from "@/components/po/discard-draft-button";
 import { SubmitDraftButton } from "@/components/po/submit-draft-button";
 import { CancelPoButton, SupersedeForm } from "@/components/po/cancel-po-controls";
 import { EmailVendorButton } from "@/components/po/email-vendor-button";
-import { PoAttachmentUploader } from "@/components/po/po-attachment-uploader";
+import { ClosedPoAttachmentUploader } from "@/components/po/closed-po-attachment-uploader";
 import { formatCurrency, formatDate, formatDateTime } from "@/lib/utils";
 import { generateDownloadUrl } from "@/lib/storage";
 import { groupAttachments } from "@/lib/attachments";
-import { canAddPoAttachment, hasPermission } from "@/lib/permissions";
+import { canAddClosedPoAttachment } from "@/lib/permissions";
 import { TC_FIXED_LINE } from "@/lib/validations/po";
 import { parsePoTerms } from "@/lib/terms";
-import { actionLabel } from "@/lib/po-activity";
 import type { LineItemInput } from "@/lib/validations/po";
 import type { Role } from "@prisma/client";
 
@@ -90,6 +89,26 @@ interface Props {
   vendorEmail?: string | null;
 }
 
+const ACTION_LABELS: Record<string, string> = {
+  CREATED: "Created",
+  SUBMITTED: "Submitted for review",
+  APPROVED: "Approved",
+  APPROVED_WITH_NOTE: "Approved with note",
+  REJECTED: "Rejected",
+  EDITS_REQUESTED: "Edits requested",
+  VENDOR_ID_REQUESTED: "Vendor ID requested",
+  VENDOR_ID_PROVIDED: "Vendor ID provided",
+  PAYMENT_SENT: "Payment confirmed",
+  PARTIAL_PAYMENT_CONFIRMED: "Partial payment confirmed",
+  RECEIPT_CONFIRMED: "Receipt confirmed",
+  PARTIAL_RECEIPT_CONFIRMED: "Partial receipt confirmed",
+  CLOSED: "Closed",
+  MANAGER_LINE_EDIT: "Manager amended line items",
+  PRODUCT_PRICE_UPDATED: "Product prices updated",
+  CANCELLED: "Cancelled",
+  SUPERSEDED: "Superseded",
+};
+
 export async function PoDetail({ po, currentUserId, currentRole, readOnly = false, vendorEmail = null }: Props) {
   const lineItemsForEditor = po.lineItems.map((li) => ({
     name: li.name,
@@ -154,12 +173,12 @@ export async function PoDetail({ po, currentUserId, currentRole, readOnly = fals
   );
   const attachmentGroups = groupAttachments(docsWithUrls);
 
-  // Feature-flagged: the PO's submitter (or Accounts / Manager / SuperUser) may add
+  // Feature-flagged remediation: a closed PO's submitter (or Accounts / Manager /
-  // attachments after the fact, in any state except rejected/cancelled. Never in
+  // SuperUser) may attach documents that the upload bug dropped. Never in readOnly.
-  // readOnly. The server action re-checks this permission.
+  const canAddClosedAttachment =
-  const canAddAttachment =
     !readOnly &&
-    canAddPoAttachment(currentRole, po.status, { isSubmitter: po.submitter.id === currentUserId });
+    po.status === "CLOSED" &&
+    canAddClosedPoAttachment(currentRole, { isSubmitter: po.submitter.id === currentUserId });
 
   const canConfirmReceipt =
     (po.status === "PAID_DELIVERED" || po.status === "PARTIALLY_CLOSED" || po.status === "PARTIALLY_PAID") &&
@@ -206,16 +225,6 @@ export async function PoDetail({ po, currentUserId, currentRole, readOnly = fals
             !readOnly && (
             <DiscardDraftButton poId={po.id} />
           )}
-          {/* Duplicate — anyone who can create POs (issue #142). Opens a new PO
-              form prefilled from this PO; nothing is written until they save. */}
-          {!readOnly && hasPermission(currentRole, "create_po") && (
-            <Link
-              href={`/po/new?duplicate=${po.id}`}
-              className="rounded-lg border border-neutral-300 bg-white px-3 py-2 text-sm font-medium text-neutral-700 hover:bg-neutral-50"
-            >
-              Duplicate
-            </Link>
-          )}
           {/* Export buttons — available once approved, and for cancelled POs (watermarked) */}
           {["MGR_APPROVED", "SENT_FOR_PAYMENT", "PARTIALLY_PAID", "PAID_DELIVERED", "PARTIALLY_CLOSED", "CLOSED", "CANCELLED"].includes(po.status) && (<>
             <a
@@ -498,7 +507,7 @@ export async function PoDetail({ po, currentUserId, currentRole, readOnly = fals
       })()}
 
       {/* Documents — grouped by lifecycle stage (submission / payment / delivery) */}
-      {(attachmentGroups.length > 0 || canAddAttachment) && (
+      {(attachmentGroups.length > 0 || canAddClosedAttachment) && (
         <div className="rounded-lg border border-neutral-200 bg-white p-6">
           <h3 className="text-sm font-semibold text-neutral-900 mb-4">Attachments</h3>
           {attachmentGroups.length === 0 && (
@@ -534,7 +543,7 @@ export async function PoDetail({ po, currentUserId, currentRole, readOnly = fals
               </div>
             ))}
           </div>
-          {canAddAttachment && <PoAttachmentUploader poId={po.id} />}
+          {canAddClosedAttachment && <ClosedPoAttachmentUploader poId={po.id} />}
         </div>
       )}
 
@@ -581,7 +590,7 @@ export async function PoDetail({ po, currentUserId, currentRole, readOnly = fals
               <div className="absolute -left-1.5 mt-1.5 h-3 w-3 rounded-full border-2 border-white bg-neutral-400" />
               <div className="flex items-baseline gap-2">
                 <span className="text-sm font-medium text-neutral-900">
-                  {actionLabel(action, po.currency)}
+                  {ACTION_LABELS[action.actionType] ?? action.actionType}
                 </span>
                 <span className="text-xs text-neutral-400">by {action.actor.name}</span>
                 <span className="text-xs text-neutral-400 ml-auto">{formatDateTime(action.createdAt)}</span>

App/lib/duplicate-po.ts

@@ -1,105 +0,0 @@
-/**
- * Duplicate-PO prefill (issue #142) — map a source PurchaseOrder onto the
- * initial-value props the New PO form consumes. Pure (no DB / no I/O) so the
- * mapping is unit-testable; the page just fetches the PO and hands it here.
- *
- * Nothing is written: a duplicate is only a prefilled draft. Attachments,
- * status/dates, payment data and audit history are intentionally NOT copied —
- * a duplicate starts as a clean draft of the editable order fields.
- */
-import { parsePoTerms, legacyPoTerms } from "@/lib/terms";
-import type { PoTerm } from "@/lib/terms";
-import type { LineItemInput } from "@/lib/validations/po";
-
-type DecimalLike = { toNumber: () => number } | number | null | undefined;
-
-const num = (v: DecimalLike, fallback = 0): number =>
-  v == null ? fallback : typeof v === "number" ? v : v.toNumber();
-
-export type DuplicateSourceLineItem = {
-  name: string;
-  description?: string | null;
-  quantity: DecimalLike;
-  unit: string;
-  size?: string | null;
-  unitPrice: DecimalLike;
-  gstRate?: DecimalLike;
-  productId?: string | null;
-  accountId?: string | null;
-};
-
-export type DuplicateSourcePo = {
-  title: string;
-  vesselId: string;
-  accountId: string;
-  companyId?: string | null;
-  vendorId?: string | null;
-  projectCode?: string | null;
-  placeOfDelivery?: string | null;
-  dateRequired?: Date | null;
-  piQuotationNo?: string | null;
-  piQuotationDate?: Date | null;
-  requisitionNo?: string | null;
-  requisitionDate?: Date | null;
-  terms?: unknown;
-  tcDelivery?: string | null;
-  tcDispatch?: string | null;
-  tcInspection?: string | null;
-  tcTransitInsurance?: string | null;
-  tcPaymentTerms?: string | null;
-  tcOthers?: string | null;
-  lineItems: DuplicateSourceLineItem[];
-};
-
-export type DuplicatePrefill = {
-  initialLineItems: LineItemInput[];
-  initialMultiAccount: boolean;
-  initialVendorId?: string;
-  initialVesselId: string;
-  initialCompanyId?: string;
-  initialTitle: string;
-  initialAccountId: string;
-  initialProjectCode: string | null;
-  initialPlaceOfDelivery: string | null;
-  initialDateRequired?: string;
-  initialPiQuotationNo?: string;
-  initialPiQuotationDate?: string;
-  initialRequisitionNo?: string;
-  initialRequisitionDate?: string;
-  initialTerms: PoTerm[];
-};
-
-/** Format a Date to a `yyyy-MM-dd` value for a native date input. */
-export const toDateInputValue = (d: Date | null | undefined): string | undefined =>
-  d ? new Date(d).toISOString().split("T")[0] : undefined;
-
-export function buildDuplicatePrefill(source: DuplicateSourcePo): DuplicatePrefill {
-  const savedTerms = parsePoTerms(source.terms);
-  return {
-    initialLineItems: source.lineItems.map((li) => ({
-      name: li.name,
-      description: li.description ?? "",
-      quantity: num(li.quantity, 1),
-      unit: li.unit,
-      size: li.size ?? "",
-      unitPrice: num(li.unitPrice, 0),
-      gstRate: li.gstRate != null ? num(li.gstRate, 0.18) : 0.18,
-      productId: li.productId ?? undefined,
-      accountId: li.accountId ?? undefined,
-    })),
-    initialMultiAccount: source.lineItems.some((li) => !!li.accountId),
-    initialVendorId: source.vendorId ?? undefined,
-    initialVesselId: source.vesselId,
-    initialCompanyId: source.companyId ?? undefined,
-    initialTitle: source.title,
-    initialAccountId: source.accountId,
-    initialProjectCode: source.projectCode ?? null,
-    initialPlaceOfDelivery: source.placeOfDelivery ?? null,
-    initialDateRequired: toDateInputValue(source.dateRequired),
-    initialPiQuotationNo: source.piQuotationNo ?? undefined,
-    initialPiQuotationDate: toDateInputValue(source.piQuotationDate),
-    initialRequisitionNo: source.requisitionNo ?? undefined,
-    initialRequisitionDate: toDateInputValue(source.requisitionDate),
-    initialTerms: savedTerms.length > 0 ? savedTerms : legacyPoTerms(source),
-  };
-}

App/lib/feature-flags.ts

@@ -16,12 +16,11 @@
  *   keeping it dark by default leaves production unchanged. See lib/permissions.ts (§6 matrix)
  *   and wiki Crewing-Implementation-Spec.
  *
- * NEXT_PUBLIC_CLOSED_PO_ATTACHMENTS_ENABLED=true  →  lets a PO's own submitter, plus
+ * NEXT_PUBLIC_CLOSED_PO_ATTACHMENTS_ENABLED=true  →  lets a CLOSED PO's own submitter, plus
- *   Accounts / Manager / SuperUser, add attachments to it in any state EXCEPT
+ *   Accounts / Manager / SuperUser, add attachments to it. Remediation path for the upload
- *   rejected/cancelled. Remediation path for the upload bug where documents never persisted
+ *   bug where documents never persisted (no PODocument row): closed POs whose files were lost
- *   (no PODocument row), and the general "attach a document after the fact" affordance.
+ *   can be fixed without reopening them. Opt-in (off unless "true") so production is unchanged
- *   Opt-in (off unless "true") so production is unchanged until enabled.
+ *   until enabled. See lib/permissions.ts (canAddClosedPoAttachment).
- *   See lib/permissions.ts (canAddPoAttachment).
  */
 
 export const INVENTORY_ENABLED =

App/lib/permissions.ts

@@ -1,4 +1,4 @@
-import type { Role, POStatus } from "@prisma/client";
+import type { Role } from "@prisma/client";
 import { SUBMITTER_VIEW_ALL_ENABLED, CLOSED_PO_ATTACHMENTS_ENABLED } from "./feature-flags";
 
 export type Permission =
@@ -279,30 +279,23 @@ export function canViewAllPos(role: Role): boolean {
   return hasPermission(role, "view_all_pos") || submitterCanViewAll(role);
 }
 
-// ── PO attachments (feature-flagged) ──────────────────────────────────────────
+// ── Closed-PO attachments (feature-flagged remediation) ───────────────────────
-// Roles that may attach to a PO (besides the PO's own submitter, who is always
+// Roles that may attach to ANY closed PO (the PO's own submitter is allowed too,
-// allowed) when NEXT_PUBLIC_CLOSED_PO_ATTACHMENTS_ENABLED=true.
+// regardless of role) when NEXT_PUBLIC_CLOSED_PO_ATTACHMENTS_ENABLED=true.
-const PO_ATTACHMENT_ROLES: Role[] = ["ACCOUNTS", "MANAGER", "SUPERUSER"];
+const CLOSED_PO_ATTACHMENT_ROLES: Role[] = ["ACCOUNTS", "MANAGER", "SUPERUSER"];
-
-// A PO in one of these terminal/voided states never accepts new attachments.
-const NO_ATTACHMENT_STATUSES: POStatus[] = ["REJECTED", "CANCELLED"];
 
 /**
- * Feature-flagged: whether the current user may add attachments to a PO.
+ * Feature-flagged: whether the current user may add attachments to a CLOSED PO.
+ * This is the remediation path for the upload bug where documents never persisted
+ * — closed POs that lost their files can be re-attached without reopening them.
  *
- * When `NEXT_PUBLIC_CLOSED_PO_ATTACHMENTS_ENABLED` is on, the PO's own submitter
+ * Allowed (only when the flag is on) for the PO's own submitter, or for
- * — plus Accounts / Manager / SuperUser — may attach documents to a PO in **any
+ * Accounts / Manager / SuperUser. Off by default ⇒ closed POs stay immutable.
- * state except `REJECTED` / `CANCELLED`** (a voided PO is never editable). This
- * is the remediation path for the upload bug where documents never persisted, and
- * the general "add a document after the fact" affordance. Off by default ⇒ no
- * post-hoc attachment UI and closed POs stay immutable.
  */
-export function canAddPoAttachment(
+export function canAddClosedPoAttachment(
   role: Role,
-  status: POStatus,
   opts: { isSubmitter: boolean }
 ): boolean {
   if (!CLOSED_PO_ATTACHMENTS_ENABLED) return false;
-  if (NO_ATTACHMENT_STATUSES.includes(status)) return false;
+  return opts.isSubmitter || CLOSED_PO_ATTACHMENT_ROLES.includes(role);
-  return opts.isSubmitter || PO_ATTACHMENT_ROLES.includes(role);
 }

App/lib/po-activity.ts

@@ -1,40 +0,0 @@
-import type { Prisma } from "@prisma/client";
-import { formatCurrency } from "@/lib/utils";
-
-// Human-readable labels for each POAction type, shown in the PO Activity timeline.
-export const ACTION_LABELS: Record<string, string> = {
-  CREATED: "Created",
-  SUBMITTED: "Submitted for review",
-  APPROVED: "Approved",
-  APPROVED_WITH_NOTE: "Approved with note",
-  REJECTED: "Rejected",
-  EDITS_REQUESTED: "Edits requested",
-  VENDOR_ID_REQUESTED: "Vendor ID requested",
-  VENDOR_ID_PROVIDED: "Vendor ID provided",
-  PAYMENT_SENT: "Payment confirmed",
-  PARTIAL_PAYMENT_CONFIRMED: "Partial payment confirmed",
-  RECEIPT_CONFIRMED: "Receipt confirmed",
-  PARTIAL_RECEIPT_CONFIRMED: "Partial receipt confirmed",
-  CLOSED: "Closed",
-  MANAGER_LINE_EDIT: "Manager amended line items",
-  PRODUCT_PRICE_UPDATED: "Product prices updated",
-  CANCELLED: "Cancelled",
-  SUPERSEDED: "Superseded",
-};
-
-// Produce the Activity-timeline label for an action. Most actions use the static
-// ACTION_LABELS map; PARTIAL_PAYMENT_CONFIRMED interpolates the instalment amount
-// from the action's metadata (already persisted by markPaid) — issue #140.
-export function actionLabel(
-  action: { actionType: string; metadata: Prisma.JsonValue },
-  currency: string,
-): string {
-  const fallback = ACTION_LABELS[action.actionType] ?? action.actionType;
-  if (action.actionType === "PARTIAL_PAYMENT_CONFIRMED") {
-    const amount = (action.metadata as { paymentAmount?: unknown } | null)?.paymentAmount;
-    if (typeof amount === "number" && Number.isFinite(amount)) {
-      return `Partial payment of ${formatCurrency(amount, currency)} confirmed`;
-    }
-  }
-  return fallback;
-}

App/tests/integration/closed-po-attachments.test.ts

@@ -1,9 +1,8 @@
 /**
- * Integration test for the feature-flagged PO-attachment permission
+ * Integration test for the feature-flagged closed-PO attachment remediation
- * (NEXT_PUBLIC_CLOSED_PO_ATTACHMENTS_ENABLED). With the flag ON, a PO's own
+ * (NEXT_PUBLIC_CLOSED_PO_ATTACHMENTS_ENABLED). With the flag ON, a CLOSED PO's own
- * submitter — plus Accounts / Manager / SuperUser — may attach documents to a PO
+ * submitter — plus Accounts / Manager / SuperUser — may attach documents; everyone
- * in **any state except REJECTED / CANCELLED**; everyone else, and any voided PO,
+ * else is refused. (The flag-OFF case lives in po-document-upload.test.ts.)
- * is refused. (The flag-OFF behaviour lives in po-document-upload.test.ts.)
  */
 import { vi, describe, it, expect, beforeAll, afterEach } from "vitest";
 
@@ -13,7 +12,7 @@ vi.mock("@/lib/storage", async (importOriginal) => {
   const actual = await importOriginal<typeof import("@/lib/storage")>();
   return { ...actual, uploadBuffer: vi.fn().mockResolvedValue(undefined) };
 });
-// Flip ONLY the attachment flag on; everything else stays real.
+// Flip ONLY the remediation flag on; everything else stays real.
 vi.mock("@/lib/feature-flags", async (importOriginal) => {
   const actual = await importOriginal<typeof import("@/lib/feature-flags")>();
   return { ...actual, CLOSED_PO_ATTACHMENTS_ENABLED: true };
@@ -22,15 +21,12 @@ vi.mock("@/lib/feature-flags", async (importOriginal) => {
 import { auth } from "@/auth";
 import { db } from "@/lib/db";
 import { uploadBuffer } from "@/lib/storage";
-import type { Role, POStatus } from "@prisma/client";
+import type { Role } from "@prisma/client";
 import { createPo } from "@/app/(portal)/po/new/actions";
 import { uploadPoDocuments } from "@/app/actions/upload-po-documents";
 import { makeSession, getSeedUser, getSeedVessel, getSeedAccount, makePoForm, deletePosByTitle } from "./helpers";
 
-const PREFIX = "INTTEST_POATTACH_";
+const PREFIX = "INTTEST_CLOSEDPO_";
-const VOID_ERROR = "Attachments can't be added to a rejected or cancelled purchase order.";
-const DENY_ERROR = "Adding attachments to this purchase order isn't allowed.";
-
 let techId: string;     // the PO's submitter
 let vesselId: string;
 let accountId: string;
@@ -70,21 +66,19 @@ function pdf(name: string): File {
   return new File(["%PDF-1.4 hello"], name, { type: "application/pdf" });
 }
 
-// A PO submitted by the TECHNICAL user, forced into `status`.
+// A CLOSED PO submitted by the TECHNICAL user.
-async function makePo(title: string, status: POStatus): Promise<string> {
+async function makeClosedPo(title: string): Promise<string> {
   as(techId, "TECHNICAL");
   const result = await createPo(makePoForm({ title, vesselId, accountId, intent: "draft" }));
   expect(result).not.toHaveProperty("error");
   const poId = (result as { id: string }).id;
-  if (status !== "DRAFT") {
+  await db.purchaseOrder.update({ where: { id: poId }, data: { status: "CLOSED" } });
-    await db.purchaseOrder.update({ where: { id: poId }, data: { status } });
-  }
   return poId;
 }
 
-describe("PO attachment permissions (flag on)", () => {
+describe("closed-PO attachments (flag on)", () => {
-  it("lets the PO's own submitter attach to their PO", async () => {
+  it("lets the PO's own submitter attach to their closed PO", async () => {
-    const poId = await makePo(`${PREFIX}Submitter`, "CLOSED");
+    const poId = await makeClosedPo(`${PREFIX}Submitter`);
     as(techId, "TECHNICAL");
 
     const err = await uploadPoDocuments(poId, [pdf("missing-invoice.pdf")]);
@@ -97,7 +91,7 @@ describe("PO attachment permissions (flag on)", () => {
     ["MANAGER", "MANAGER"],
     ["SUPERUSER", "SUPERUSER"],
   ])("lets %s attach to a closed PO they did not submit", async (key, role) => {
-    const poId = await makePo(`${PREFIX}${key}`, "CLOSED");
+    const poId = await makeClosedPo(`${PREFIX}${key}`);
     as(userIds[key], role);
 
     const err = await uploadPoDocuments(poId, [pdf("doc.pdf")]);
@@ -105,62 +99,29 @@ describe("PO attachment permissions (flag on)", () => {
     expect(await db.pODocument.count({ where: { poId } })).toBe(1);
   });
 
-  // The headline of this change: not just CLOSED — any live state.
-  it.each<POStatus>(["MGR_REVIEW", "MGR_APPROVED", "SENT_FOR_PAYMENT", "PAID_DELIVERED", "EDITS_REQUESTED"])(
-    "lets Manager attach to a PO in %s",
-    async (status) => {
-      const poId = await makePo(`${PREFIX}${status}`, status);
-      as(userIds.MANAGER, "MANAGER");
-
-      const err = await uploadPoDocuments(poId, [pdf("doc.pdf")]);
-      expect(err).toBeNull();
-      expect(await db.pODocument.count({ where: { poId } })).toBe(1);
-    }
-  );
-
-  it.each<POStatus>(["REJECTED", "CANCELLED"])(
-    "refuses attachments to a %s PO, even for Manager",
-    async (status) => {
-      const poId = await makePo(`${PREFIX}${status}`, status);
-      as(userIds.MANAGER, "MANAGER");
-
-      const err = await uploadPoDocuments(poId, [pdf("doc.pdf")]);
-      expect(err).toEqual({ error: VOID_ERROR });
-      expect(uploadBuffer).not.toHaveBeenCalled();
-      expect(await db.pODocument.count({ where: { poId } })).toBe(0);
-    }
-  );
-
-  it("refuses a voided PO even for its own submitter", async () => {
-    const poId = await makePo(`${PREFIX}SubmitterRejected`, "REJECTED");
-    as(techId, "TECHNICAL");
-
-    const err = await uploadPoDocuments(poId, [pdf("doc.pdf")]);
-    expect(err).toEqual({ error: VOID_ERROR });
-    expect(await db.pODocument.count({ where: { poId } })).toBe(0);
-  });
-
   it("refuses a submitter-role user who is not this PO's submitter", async () => {
-    const poId = await makePo(`${PREFIX}OtherSubmitter`, "MGR_APPROVED");
+    const poId = await makeClosedPo(`${PREFIX}OtherSubmitter`);
     as(userIds.MANNING, "MANNING"); // a submitter role, but not the PO's submitter
 
     const err = await uploadPoDocuments(poId, [pdf("doc.pdf")]);
-    expect(err).toEqual({ error: DENY_ERROR });
+    expect(err).toEqual({ error: "Adding attachments to a closed purchase order isn't allowed." });
     expect(uploadBuffer).not.toHaveBeenCalled();
     expect(await db.pODocument.count({ where: { poId } })).toBe(0);
   });
 
   it("refuses a role outside the allow-list (auditor)", async () => {
-    const poId = await makePo(`${PREFIX}Auditor`, "CLOSED");
+    const poId = await makeClosedPo(`${PREFIX}Auditor`);
     as(userIds.AUDITOR, "AUDITOR");
 
     const err = await uploadPoDocuments(poId, [pdf("doc.pdf")]);
-    expect(err).toEqual({ error: DENY_ERROR });
+    expect(err).toEqual({ error: "Adding attachments to a closed purchase order isn't allowed." });
     expect(await db.pODocument.count({ where: { poId } })).toBe(0);
   });
 
-  it("still allows the normal create flow (DRAFT submitter)", async () => {
+  it("still allows uploads to a non-closed PO (normal flow unaffected)", async () => {
-    const poId = await makePo(`${PREFIX}Draft`, "DRAFT");
+    as(techId, "TECHNICAL");
+    const result = await createPo(makePoForm({ title: `${PREFIX}Draft`, vesselId, accountId, intent: "draft" }));
+    const poId = (result as { id: string }).id; // stays DRAFT
     as(techId, "TECHNICAL");
 
     const err = await uploadPoDocuments(poId, [pdf("draft-doc.pdf")]);

App/tests/unit/duplicate-po.test.ts

@@ -1,145 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { buildDuplicatePrefill, toDateInputValue } from "@/lib/duplicate-po";
-import type { DuplicateSourcePo } from "@/lib/duplicate-po";
-
-// A Prisma Decimal stand-in: just needs a toNumber().
-const dec = (n: number) => ({ toNumber: () => n });
-
-function makeSource(overrides: Partial<DuplicateSourcePo> = {}): DuplicateSourcePo {
-  return {
-    title: "Spare parts for HNR1",
-    vesselId: "vsl_1",
-    accountId: "acc_1",
-    companyId: "co_1",
-    vendorId: "ven_1",
-    projectCode: "Haldia Reach",
-    placeOfDelivery: "Pelagia — Cochin yard",
-    dateRequired: new Date("2026-07-15T00:00:00.000Z"),
-    piQuotationNo: "INV-001",
-    piQuotationDate: new Date("2026-06-01T00:00:00.000Z"),
-    requisitionNo: "REQ-42",
-    requisitionDate: new Date("2026-05-20T00:00:00.000Z"),
-    terms: [{ category: "Delivery", text: "Within 4 to 5 days" }],
-    lineItems: [
-      {
-        name: "Gasket",
-        description: "Rubber gasket",
-        quantity: dec(3),
-        unit: "pc",
-        size: "M",
-        unitPrice: dec(120.5),
-        gstRate: dec(0.18),
-        productId: "prod_1",
-        accountId: null,
-      },
-    ],
-    ...overrides,
-  };
-}
-
-describe("buildDuplicatePrefill", () => {
-  it("copies the editable order fields onto the new draft", () => {
-    const r = buildDuplicatePrefill(makeSource());
-    expect(r.initialTitle).toBe("Spare parts for HNR1");
-    expect(r.initialVesselId).toBe("vsl_1");
-    expect(r.initialAccountId).toBe("acc_1");
-    expect(r.initialCompanyId).toBe("co_1");
-    expect(r.initialVendorId).toBe("ven_1");
-    expect(r.initialProjectCode).toBe("Haldia Reach");
-    expect(r.initialPlaceOfDelivery).toBe("Pelagia — Cochin yard");
-    expect(r.initialPiQuotationNo).toBe("INV-001");
-    expect(r.initialRequisitionNo).toBe("REQ-42");
-  });
-
-  it("formats dates as yyyy-MM-dd for native date inputs", () => {
-    const r = buildDuplicatePrefill(makeSource());
-    expect(r.initialDateRequired).toBe("2026-07-15");
-    expect(r.initialPiQuotationDate).toBe("2026-06-01");
-    expect(r.initialRequisitionDate).toBe("2026-05-20");
-  });
-
-  it("maps line items to the editor shape, converting Decimals to numbers", () => {
-    const r = buildDuplicatePrefill(makeSource());
-    expect(r.initialLineItems).toEqual([
-      {
-        name: "Gasket",
-        description: "Rubber gasket",
-        quantity: 3,
-        unit: "pc",
-        size: "M",
-        unitPrice: 120.5,
-        gstRate: 0.18,
-        productId: "prod_1",
-        accountId: undefined,
-      },
-    ]);
-  });
-
-  it("enables per-item accounting codes only when a line item carries one", () => {
-    expect(buildDuplicatePrefill(makeSource()).initialMultiAccount).toBe(false);
-    const multi = makeSource({
-      lineItems: [
-        { name: "A", quantity: dec(1), unit: "pc", unitPrice: dec(10), accountId: "acc_2" },
-      ],
-    });
-    const r = buildDuplicatePrefill(multi);
-    expect(r.initialMultiAccount).toBe(true);
-    expect(r.initialLineItems[0].accountId).toBe("acc_2");
-  });
-
-  it("defaults a missing gstRate to 0.18", () => {
-    const src = makeSource({
-      lineItems: [{ name: "A", quantity: dec(2), unit: "pc", unitPrice: dec(5) }],
-    });
-    expect(buildDuplicatePrefill(src).initialLineItems[0].gstRate).toBe(0.18);
-  });
-
-  it("uses the saved terms snapshot when present", () => {
-    const r = buildDuplicatePrefill(makeSource());
-    expect(r.initialTerms).toEqual([{ category: "Delivery", text: "Within 4 to 5 days" }]);
-  });
-
-  it("falls back to legacy tc* terms when no JSON snapshot exists", () => {
-    const src = makeSource({
-      terms: null,
-      tcDelivery: "Next day",
-      tcPaymentTerms: "Net 15",
-    });
-    const r = buildDuplicatePrefill(src);
-    expect(r.initialTerms).toEqual(
-      expect.arrayContaining([
-        { category: "Delivery", text: "Next day" },
-        { category: "Payment Terms", text: "Net 15" },
-      ])
-    );
-  });
-
-  it("normalises absent optional fields to undefined/null", () => {
-    const src = makeSource({
-      companyId: null,
-      vendorId: null,
-      projectCode: null,
-      placeOfDelivery: null,
-      dateRequired: null,
-      piQuotationNo: null,
-      piQuotationDate: null,
-      requisitionNo: null,
-      requisitionDate: null,
-    });
-    const r = buildDuplicatePrefill(src);
-    expect(r.initialCompanyId).toBeUndefined();
-    expect(r.initialVendorId).toBeUndefined();
-    expect(r.initialDateRequired).toBeUndefined();
-    expect(r.initialPiQuotationNo).toBeUndefined();
-    expect(r.initialProjectCode).toBeNull();
-    expect(r.initialPlaceOfDelivery).toBeNull();
-  });
-});
-
-describe("toDateInputValue", () => {
-  it("returns yyyy-MM-dd for a date and undefined for null", () => {
-    expect(toDateInputValue(new Date("2026-01-09T12:00:00.000Z"))).toBe("2026-01-09");
-    expect(toDateInputValue(null)).toBeUndefined();
-    expect(toDateInputValue(undefined)).toBeUndefined();
-  });
-});

App/tests/unit/po-activity-label.test.ts

@@ -1,54 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { actionLabel } from "@/lib/po-activity";
-import { formatCurrency } from "@/lib/utils";
-
-describe("actionLabel (Activity timeline)", () => {
-  it("interpolates the instalment amount for a partial payment (issue #140)", () => {
-    const label = actionLabel(
-      { actionType: "PARTIAL_PAYMENT_CONFIRMED", metadata: { paymentAmount: 5000 } },
-      "INR"
-    );
-    expect(label).toBe(`Partial payment of ${formatCurrency(5000, "INR")} confirmed`);
-    expect(label).toContain("5,000");
-  });
-
-  it("respects the PO currency", () => {
-    const label = actionLabel(
-      { actionType: "PARTIAL_PAYMENT_CONFIRMED", metadata: { paymentAmount: 1200 } },
-      "USD"
-    );
-    expect(label).toBe(`Partial payment of ${formatCurrency(1200, "USD")} confirmed`);
-  });
-
-  it("falls back to the plain label when paymentAmount is missing (older audit rows)", () => {
-    expect(
-      actionLabel({ actionType: "PARTIAL_PAYMENT_CONFIRMED", metadata: null }, "INR")
-    ).toBe("Partial payment confirmed");
-    expect(
-      actionLabel(
-        { actionType: "PARTIAL_PAYMENT_CONFIRMED", metadata: { paymentRef: "TXN-1" } },
-        "INR"
-      )
-    ).toBe("Partial payment confirmed");
-  });
-
-  it("falls back when paymentAmount is non-numeric, never rendering NaN", () => {
-    const label = actionLabel(
-      { actionType: "PARTIAL_PAYMENT_CONFIRMED", metadata: { paymentAmount: "5000" } },
-      "INR"
-    );
-    expect(label).toBe("Partial payment confirmed");
-    expect(label).not.toContain("NaN");
-  });
-
-  it("leaves other action labels unchanged", () => {
-    expect(
-      actionLabel({ actionType: "PAYMENT_SENT", metadata: { paymentAmount: 5000 } }, "INR")
-    ).toBe("Payment confirmed");
-    expect(actionLabel({ actionType: "APPROVED", metadata: null }, "INR")).toBe("Approved");
-  });
-
-  it("falls back to the raw action type for unknown actions", () => {
-    expect(actionLabel({ actionType: "MYSTERY", metadata: null }, "INR")).toBe("MYSTERY");
-  });
-});