TELSPAY EDUCATION v2026.9.5.1 CHANGE MANIFEST
Build date: 2026-09-08
Upgrade basis: validated v2026.9.5 + Student Login Access security module

ADMIN / CONTROL CENTER
- Education demographics and local Chart.js analytics.
- Full school profile/document/media/KYB workspace.
- Required-document assignment, review, rejection/revocation and correction requests.
- Partner-school onboarding/action modal fixes retained.
- School Portal Users & Roles management modal with ACTIVE/LOCKED/SUSPENDED/DISABLED controls.
- Email/SMS notification events for school/user/role changes.
- Education Finance Settings for school-fee commission, loan-eligibility ratios and Student Wallet policy.
- Global Education transaction reference search.
- Student Wallet control, withdrawal review and Student Loan controls.
- Student education-store content approval/control.
- Subscription evidence review and manual subscription grant/upgrade/downgrade/extend/suspend/revoke/reactivate controls.
- School Growth AI usage/control page.

MEMBER EDUCATION FINANCE
- Separate Education Invest ledger/account.
- Savings -> Education Invest transfer with transaction-PIN controls.
- Verified Mobile Money Education Invest top-up for Member App flow.
- School-fees payment from Savings or Education Invest.
- Shares explicitly excluded as a school-fees payment source.
- Shares retained only as a configured school-fees-loan eligibility component.
- Student payment-number validation and registered-school/student context.
- QR-verifiable School Fees PDF receipt.

PUBLIC EDUCATION PAYMENTS
- Public Pay School Fees page.
- Student payment-number lookup before payment.
- Verified Flutterwave Mobile Money checkout/callback/webhook path.
- Public receipt route after successful posting.

SUBSCRIPTIONS
- Flutterwave Mobile Money/Card collection retained.
- Bank Transfer and Cash payment evidence flows.
- Evidence remains pending until SACCO Admin decision.
- Private evidence preview and approve/reject/revoke actions.
- Audited manual subscription package overrides by SACCO Admin.

STUDENT WALLET PORTAL
- New `student.telspay.com` portal using the Member banking design direction.
- School-linked Student Wallet ledger.
- 4-digit transaction PIN and attempt lockout.
- Provider-verified top-ups.
- Same-school student-to-student internal transfers.
- Education Notes, Study Tours and Requirements marketplace/purchases.
- SACCO-controlled Mobile Money withdrawal requests and configurable withdrawal charges.
- Wallet states: PENDING/ACTIVE/LOCKED/SUSPENDED/BANNED/DEACTIVATED/CLOSED as applicable to workflow.
- SACCO-created Student Loan products.
- School review + SACCO credit approval.
- Loan proceeds credited to Student Wallet only.
- Wallet loan repayment with overpayment/overdraft protection.
- Student loan/repayment visibility restricted to SACCO and associated school administration.

SCHOOL PORTAL
- Student Wallet monitoring.
- Student Loan review.
- Notes/Tours/Requirements management with SACCO publication approval.
- Compliance/correction document upload workflow.
- School Growth AI paid feature surface.
- Bank/Cash subscription evidence upload.
- Uganda district/city selectors.


STUDENT LOGIN ACCESS v2026.9.5.1
- New SACCO Admin `Education_Student_Login_Access.php` module.
- Search Student Wallet login accounts and resend secure access by Email, SMS or both.
- New `education.student_wallet.credentials` Admin permission.
- Single-use password setup/reset token stored as a keyed hash in `edu_student_login_access_tokens`.
- Configurable token expiry and resend cooldown.
- Issuing a new link revokes previous unused links for that wallet.
- Existing passwords and 4-digit transaction PINs are never displayed or transmitted.
- Student reset page at `student.telspay.com/reset_password.php`.
- Password reset requires at least 10 characters including a letter and number.
- Notification outbox redacts Student Login Access URLs after successful send.
- Expired/revoked queued Student Login messages are cancelled and scrubbed.
- Admin issuance and student use are written to audit/security events.
- New additive migration: `TELSPAY_EDUCATION_STUDENT_LOGIN_ACCESS_V2026_9_5_1.sql`.

SECURITY / RELIABILITY
- Consolidates QR class collision, header/output buffering, Partner School query and action-modal hotfixes.
- Education delta contains no `mysqli_stmt::get_result()` dependency.
- Server-side payment verification before value posting.
- Idempotent local references/ledgers for financial flows.
- Private evidence/content storage.
- Non-blocking Email/SMS outbox.
- Dependency-free School Fees PDF renderer with embedded verification QR.
- Prepared-statement and schema-reference validation performed before release packaging.
- Existing Admin/Member CSS preserved; Student Portal CSS added separately.

DATABASE
- New migration: database/TELSPAY_EDUCATION_FINANCE_AI_V2026_9_5.sql
- Migration mirrors are also included under Admin deployment locations.
- Migration is additive and does not use DROP/TRUNCATE/destructive bulk DELETE.