diff --git a/src/Yavsc.Api.Test/EstimateApiControllerTests.cs b/src/Yavsc.Api.Test/EstimateApiControllerTests.cs
index cb945f51a..d8cae0265 100644
--- a/src/Yavsc.Api.Test/EstimateApiControllerTests.cs
+++ b/src/Yavsc.Api.Test/EstimateApiControllerTests.cs
@@ -209,9 +209,12 @@ public sealed class EstimateApiControllerTests : IClassFixture<ApiWebServerFixtu
 
     /// <summary>
     /// Seeds an estimate owned by alice (the provider) for the given
-    /// client, optionally already validated by the client.
+    /// client, optionally already validated by the client. By default the
+    /// estimate is also provider-validated (i.e. the provider has submitted
+    /// it); pass <paramref name="providerValidated"/> = false to seed a
+    /// freshly inserted request the provider hasn't worked on yet.
     /// </summary>
-    private long SeedEstimate(string clientId, bool clientValidated)
+    private long SeedEstimate(string clientId, bool clientValidated, bool providerValidated = true)
     {
         using var scope = _fixture.Services.CreateScope();
         var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
@@ -229,6 +232,7 @@ public sealed class EstimateApiControllerTests : IClassFixture<ApiWebServerFixtu
             {
                 new() { Name = "Prestation", Description = "Prestation de base", Count = 1, UnitaryCost = 120m, Currency = "EUR" },
             },
+            ProviderValidationDate = providerValidated ? DateTime.UtcNow : default,
             ClientValidationDate = clientValidated ? DateTime.UtcNow : default,
         };
         db.Estimates.Add(estimate);
@@ -259,6 +263,26 @@ public sealed class EstimateApiControllerTests : IClassFixture<ApiWebServerFixtu
         Assert.Equal("alice", item.GetProperty("ownerId").GetString());
     }
 
+    [Fact]
+    public async Task GetOngoingEstimatesAsClient_excludes_inserted_requests_not_yet_provider_validated()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+        var submittedId = SeedEstimate(clientId: "bob", clientValidated: false);                  // provider submitted: visible
+        SeedEstimate(clientId: "bob", clientValidated: false, providerValidated: false);          // inserted, not worked on: excluded
+
+        using var http = NewClient("bob");
+
+        var response = await http.GetAsync("/api/v1/estimate/asclient", TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        using var doc = JsonDocument.Parse(body);
+        var items = doc.RootElement.EnumerateArray().ToArray();
+        var item = Assert.Single(items);
+        Assert.Equal(submittedId, item.GetProperty("id").GetInt64());
+    }
+
     [Fact]
     public async Task GetOngoingEstimatesAsProvider_returns_only_ongoing_estimates_established_by_the_provider()
     {
diff --git a/src/Yavsc.Api/Controllers/Business/EstimateApiController.cs b/src/Yavsc.Api/Controllers/Business/EstimateApiController.cs
index b72c6d7a2..1ee88f953 100644
--- a/src/Yavsc.Api/Controllers/Business/EstimateApiController.cs
+++ b/src/Yavsc.Api/Controllers/Business/EstimateApiController.cs
@@ -201,12 +201,18 @@ namespace Yavsc.Controllers
         // GET: api/estimate/asclient
         // Ongoing estimates (not yet validated by the client) where the
         // current user is the client who initiated the request.
+        // An estimate only becomes visible to the client once the provider
+        // has actually established and submitted it (ProviderValidationDate);
+        // a freshly inserted request the provider hasn't worked on yet is
+        // not something the client can validate, so it's excluded.
         [HttpGet("asclient")]
         public IActionResult GetOngoingEstimatesAsClient()
         {
             var uid = User.GetUserId();
             return Ok(_context.Estimates.Include(e => e.Bill)
-                .Where(e => e.ClientId == uid && e.ClientValidationDate == default));
+                .Where(e => e.ClientId == uid
+                    && e.ProviderValidationDate != default
+                    && e.ClientValidationDate == default));
         }
 
         // GET: api/estimate/asprovider
diff --git a/src/Yavsc.Org.Tests/Smoke/AccountSmokeTests.cs b/src/Yavsc.Org.Tests/Smoke/AccountSmokeTests.cs
index 61d774c57..5e7ab7776 100644
--- a/src/Yavsc.Org.Tests/Smoke/AccountSmokeTests.cs
+++ b/src/Yavsc.Org.Tests/Smoke/AccountSmokeTests.cs
@@ -1,4 +1,7 @@
+using System.Net;
+using System.Net.Http;
 using IdentityServer8.Stores;
+using Microsoft.AspNetCore.Mvc.Testing;
 using Microsoft.Extensions.DependencyInjection;
 using Xunit;
 
@@ -40,4 +43,26 @@ public class AccountSmokeTests : IClassFixture<TestWebApplicationFactory>
 
         Assert.Null(exception);
     }
+
+    // Regression: anonymous access to a restricted page used to redirect to
+    // the ASP.NET Identity default LoginPath "/Account/Login", which has no
+    // controller here. The application cookie must redirect to the real
+    // sign-in endpoint at /signin instead.
+    [Fact]
+    public async Task Anonymous_access_to_protected_page_redirects_to_signin()
+    {
+        var client = _factory.CreateClient(new WebApplicationFactoryClientOptions
+        {
+            AllowAutoRedirect = false,
+        });
+
+        // EstimateController is [Authorize]; GET /Estimate hits Index().
+        var response = await client.GetAsync("/Estimate", TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Redirect, response.StatusCode);
+        var location = response.Headers.Location;
+        Assert.NotNull(location);
+        Assert.Equal("/signin", location.AbsolutePath);
+        Assert.Contains("ReturnUrl=%2FEstimate", location.Query);
+    }
 }
diff --git a/src/Yavsc.Org/Extensions/HostingExtensions.cs b/src/Yavsc.Org/Extensions/HostingExtensions.cs
index 8c1db2a73..ea035001c 100644
--- a/src/Yavsc.Org/Extensions/HostingExtensions.cs
+++ b/src/Yavsc.Org/Extensions/HostingExtensions.cs
@@ -215,6 +215,18 @@ public static class HostingExtensions
 
         services.AddScoped<IUserClaimsPrincipalFactory<ApplicationUser>, UserClaimsPrincipalFactory<ApplicationUser, IdentityRole>>();
 
+        // The default application cookie LoginPath is "/Account/Login", which
+        // has no controller here — anonymous access to a restricted page must
+        // redirect to the actual sign-in endpoint instead. The paths mirror
+        // the route attributes on AccountController (Constants.SigninPath etc.,
+        // which carry a "~/" prefix that the cookie middleware does not want).
+        services.ConfigureApplicationCookie(options =>
+        {
+            options.LoginPath = "/signin";
+            options.LogoutPath = "/signout";
+            options.AccessDeniedPath = "/Account/AccessDenied";
+        });
+
         // Dev-only: Chromium rejects SameSite=None without Secure on http://
         // (e.g. http://localhost:5000). The default Identity cookie policy
         // sets SameSite=None, which is invalid without Secure. Force Lax in