@arcforgelabs/flow 2026.10.45 → 2026.10.47

package/README.md

@@ -36,6 +36,7 @@ run a lab.
 | `docs/releases/` | One release notes page per version (`<version>.md`), shown on the docs site |
 | `docs/DESIGN.md` | The design systems (theme families), how pages and Clerk's components take them, and the screens |
 | `docs/DESIGN_SYSTEM.md` | The Flow Design System artifact: how `npm run design-system` builds it from the code, the card per shared component, publishing and review |
+| `docs/MOBILE_TESTS.md` | The phone suite: every screen at phone, tablet and desk sizes in WebKit and Chromium, its checks and budget, the three widths, saved images |
 | `docs/DATA_MODEL.md` | The PostgreSQL records, the rules the database holds, and how to change the schema |
 | `docs/DATA_SPINE.md` | The design of the tables and jobs every integration shares: mirror, identity map, job queue, outbox, review queue |
 | `docs/JOB_INVOICE_LINKS.md` | The pipeline: how each job links to its customer and to the accounting invoice that bills it |

package/VISION.md

@@ -54,16 +54,16 @@ column per stage, a card per job), with a list view of the same jobs. It
 shows every job from the case system and from Flow, with its practice, due
 date and department. Lab staff and the manager work from it.
 
-Two parts follow the board (#48):
-
-- **An intake reader.** A photo, a form or a note becomes a proposed job
-  action: update a job, create one, or add a note. A handwriting reader and a
-  low-cost decision model propose it; a person confirms it. Nothing changes
-  until a person accepts. The model steps are optional and cost money per
-  page, so the manager sees the month's cost.
-- **A practice portal.** Practice staff sign in to follow their own jobs,
-  on desktop first, with a simpler view on phones. The server limits each
-  person to their practice.
+Two parts follow the board:
+
+- **An intake reader** (#267). A photo, a form or a note becomes a proposed
+  job action: update a job, create one, or add a note. A handwriting reader
+  and a low-cost decision model propose it; a person confirms it. Nothing
+  changes until a person accepts. The model steps are optional and cost money
+  per page, so the manager sees the month's cost.
+- **A practice portal** (#268). Practice staff sign in to follow their own
+  jobs, on desktop first, with a simpler view on phones. The server limits
+  each person to their practice.
 
 Job management is a bundled module, built the same way as the integrations,
 and a lab can remove it. Where the case system cannot take a change through

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@arcforgelabs/flow",
-  "version": "2026.10.45",
+  "version": "2026.10.47",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@arcforgelabs/flow",
-      "version": "2026.10.45",
+      "version": "2026.10.47",
       "license": "MIT",
       "dependencies": {
         "@clerk/backend": "3.25.0",
@@ -33,6 +33,8 @@
         "flow-server": "server/flow-server.js"
       },
       "devDependencies": {
+        "@axe-core/playwright": "4.13.0",
+        "@playwright/test": "1.56.1",
         "drizzle-kit": "0.31.11",
         "esbuild": "0.25.12"
       },
@@ -40,6 +42,19 @@
         "node": ">=24"
       }
     },
+    "node_modules/@axe-core/playwright": {
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/@axe-core/playwright/-/playwright-4.13.0.tgz",
+      "integrity": "sha512-6YLx+kxXu5GJceG4ozFg+33a2EMTdjYwWGloJ3sb9Kta5pp+ZNS53uxGVog5JetIY8s++P5UrtX+cri+u0VAVg==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "axe-core": "~4.13.0"
+      },
+      "peerDependencies": {
+        "playwright-core": ">= 1.0.0"
+      }
+    },
     "node_modules/@clerk/backend": {
       "version": "3.25.0",
       "resolved": "https://registry.npmjs.org/@clerk/backend/-/backend-3.25.0.tgz",
@@ -1029,6 +1044,22 @@
         "url": "https://github.com/sponsors/oxc-project"
       }
     },
+    "node_modules/@playwright/test": {
+      "version": "1.56.1",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.56.1.tgz",
+      "integrity": "sha512-vSMYtL/zOcFpvJCW71Q/OEGQb7KYBPAdKh35WNSkaZA75JlAO8ED8UN6GUNTm3drWomcbcqRPFqQbLae8yBTdg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.56.1"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@sentry/bundler-plugins": {
       "version": "11.8.0",
       "resolved": "https://registry.npmjs.org/@sentry/bundler-plugins/-/bundler-plugins-11.8.0.tgz",
@@ -1183,6 +1214,16 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/axe-core": {
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.13.0.tgz",
+      "integrity": "sha512-UzGt8zg7Ny8djbYMhxl2zuEevVa7r2gJjYY5Lwr1xM7+XU2nd6CkIWFTVcCIbAP63vSz71NaVyyuSk9lHKcy0A==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "engines": {
+        "node": ">=4"
+      }
+    },
     "node_modules/balanced-match": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
@@ -2380,6 +2421,67 @@
         "split2": "^4.1.0"
       }
     },
+    "node_modules/playwright": {
+      "version": "1.56.1",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.56.1.tgz",
+      "integrity": "sha512-aFi5B0WovBHTEvpM3DzXTUaeN6eN0qWnTkKx4NQaH4Wvcmc153PdaY2UBdSYKaGYw+UyWXSVyxDUg5DoPEttjw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.56.1"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.64.1",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.64.1.tgz",
+      "integrity": "sha512-BC4s8y6SEVA6Q1rSxZTto8hI1KUI3xXlHGZgvGqP4IqPdI/a6FX9H29IDNz7vKo9l21b6LfYosScPL6M3xxyDQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "peer": true,
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/playwright/node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/playwright/node_modules/playwright-core": {
+      "version": "1.56.1",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.56.1.tgz",
+      "integrity": "sha512-hutraynyn31F+Bifme+Ps9Vq59hKuUCz7H1kDOcBs+2oGguKkWTU50bBWrtz34OUWmIwpBTWDxaRPXrIXkgvmQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/png-js": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/png-js/-/png-js-2.0.0.tgz",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcforgelabs/flow",
-  "version": "2026.10.45",
+  "version": "2026.10.47",
   "description": "Invoicing, bill entry and a financial dashboard for labs, with Seazona and Xero integrations.",
   "license": "MIT",
   "repository": {
@@ -37,7 +37,9 @@
     "db:generate": "drizzle-kit generate && node scripts/db-guard-migrations.js",
     "db:follow-production": "node scripts/replit-workspace-db.js sync",
     "db:follow-production:status": "node scripts/replit-workspace-db.js status",
-    "design-system": "node scripts/design-system/build.mjs"
+    "design-system": "node scripts/design-system/build.mjs",
+    "test:mobile": "playwright test -c test/mobile/playwright.config.js",
+    "test:mobile:budget": "node test/mobile/budget.mjs"
   },
   "dependencies": {
     "@clerk/backend": "3.25.0",
@@ -61,6 +63,8 @@
     "pg": "8.23.1"
   },
   "devDependencies": {
+    "@axe-core/playwright": "4.13.0",
+    "@playwright/test": "1.56.1",
     "drizzle-kit": "0.31.11",
     "esbuild": "0.25.12"
   },

package/server/api/invoicing.js

@@ -1,10 +1,12 @@
 import { and, asc, desc, eq, ilike, inArray, isNull, or, sql } from 'drizzle-orm';
 import express from 'express';
-import { invoicePage, INVOICE_SORTS, normaliseInvoicesView } from '../ui/list-views.js';
+import { invoiceKindOf, invoicePage, INVOICE_SORTS, normaliseInvoicesView } from '../ui/list-views.js';
+import { fieldIdOf, filterRows } from '../ui/job-view.js';
+import { listFields, listJobFieldValues } from '../core/custom-fields.js';
 import { FlowError } from '../core/errors.js';
 import { createActionGuard } from '../integrations/call-guard.js';
 import {
-  createDraftInvoice, getInvoice, issueInvoice, listInvoiceVersions, reviseInvoice, updateDraftInvoice, voidInvoice,
+  createDraftInvoice, deleteDraft, getInvoice, issueInvoice, listInvoiceVersions, reviseInvoice, updateDraftInvoice, voidInvoice,
 } from '../core/invoices.js';
 import { listAutomations, saveAutomation, workStatuses } from '../core/automations.js';
 import {
@@ -45,7 +47,9 @@ import {
 //   POST  /invoices/mark-not-ready    { invoiceIds }: back to To check
 //   POST  /invoices/send-ready        owner or admin: issue every ready draft and queue it for the
 //                                     accounting system { issueDate, invoiceIds? (only these; one that fails
-//                                     a check now stays on Pending and counts as held) }
+//                                     a check now stays on Pending and counts as held; one id is all or
+//                                     nothing when its job cannot be confirmed, more than one id sends the
+//                                     rest and counts the unconfirmed in waiting) }
 //   POST  /invoices/send-again        owner or admin: queue failed sends again { invoiceIds? }
 //   GET   /invoices/:id               one invoice: lines, contact, job, issued versions, and where it sends
 //   GET   /invoices/:id/pdf?version=  the invoice as a PDF, drawn by Flow (server/core/invoice-pdf.js),
@@ -56,6 +60,8 @@ import {
 //   POST  /invoices/:id/issue         owner or admin: number it and keep the document as sent
 //   POST  /invoices/:id/revise        owner or admin: an issued invoice back to a draft
 //   POST  /invoices/:id/void          owner or admin
+//   DELETE /invoices/:id              owner or admin: a draft that was never issued.
+//                                     Frees its job, and the lab's rules then decide.
 //   GET   /contacts?q=&limit=         customers, by name
 //   GET   /price-items?q=             the price list, by code
 //   GET   /jobs?view=&limit=          billable jobs (the obligation ledger), with counts by view;
@@ -124,7 +130,7 @@ const MAX_UNIT_CENTS = 100_000_000;
 
 const ERROR_STATUS = {
   invalid: 400, organisation_required: 400, not_found: 404, not_draft: 409, not_issued: 409,
-  never_issued: 409, not_ready: 409, live_check_unavailable: 409, conflict: 409,
+  never_issued: 409, was_issued: 409, not_ready: 409, live_check_unavailable: 409, conflict: 409,
   accounting_not_connected: 409, accounting_writes_off: 409,
 };
 
@@ -449,17 +455,43 @@ export function createInvoicingRouter({
       const pattern = containing(q);
       where.push(or(ilike(invoices.number, pattern), ilike(invoices.reference, pattern), ilike(contacts.name, pattern)));
     }
-    // First the few columns the filter and sort read, for every row; then
-    // the whole rows of the one page.
-    const light = (await db.select({
+    // First the columns the filter and sort read, for every row; then the
+    // whole rows of the one page. A job column and a custom field read the
+    // invoice's job, so those values are on every row before the page is cut.
+    const lightRows = await db.select({
       id: invoices.id, number: invoices.number, reference: invoices.reference, issueDate: invoices.issueDate,
-      createdAt: invoices.createdAt, totalCents: invoices.totalCents, contactName: contacts.name,
+      dueDate: invoices.dueDate, createdAt: invoices.createdAt, totalCents: invoices.totalCents, contactName: contacts.name,
     }).from(invoices)
       .leftJoin(contacts, eq(contacts.id, invoices.contactId))
       .where(and(...where))
-      .orderBy(desc(invoices.createdAt), desc(invoices.id)))
-      .map((row) => ({ ...row, problems: tabs.problems.get(row.id) ?? [] }));
-    const page = invoicePage(light, { view, sort, dir, offset, limit, today: day });
+      .orderBy(desc(invoices.createdAt), desc(invoices.id));
+    const jobs = await jobsByInvoice(db, organisationId, lightRows.map((r) => r.id));
+    const customOn = filterRows(view).some((f) => fieldIdOf(f.field));
+    const [fieldDefs, fieldValues] = customOn
+      ? await Promise.all([
+        listFields(db, organisationId),
+        listJobFieldValues(db, organisationId, { jobs: [...jobs.values()].filter(Boolean) }),
+      ])
+      : [[], []];
+    const valuesOf = new Map();
+    for (const v of fieldValues) {
+      const key = `${v.sourceSystem}\u0000${v.sourceJobRef}`;
+      const bag = valuesOf.get(key) ?? {};
+      bag[v.fieldId] = v.value;
+      valuesOf.set(key, bag);
+    }
+    const light = lightRows.map((row) => {
+      const job = jobs.get(row.id) ?? null;
+      return {
+        ...row,
+        problems: tabs.problems.get(row.id) ?? [],
+        tab: tabs.tabOf.get(row.id) ?? null,
+        sending: tabs.sending.has(row.id),
+        job,
+        fields: job ? valuesOf.get(`${job.sourceSystem}\u0000${job.sourceJobRef}`) ?? {} : {},
+      };
+    });
+    const page = invoicePage(light, { view, sort, dir, offset, limit, today: day, kindOf: invoiceKindOf(fieldDefs), me: req.person.id });
     const pageIds = page.rows.map((r) => r.id);
     const full = pageIds.length
       ? await db.select({ invoice: invoices, contactName: contacts.name }).from(invoices)
@@ -468,7 +500,6 @@ export function createInvoicingRouter({
       : [];
     const byId = new Map(full.map((r) => [r.invoice.id, r]));
     const rows = pageIds.map((id) => byId.get(id)).filter(Boolean);
-    const jobs = await jobsByInvoice(db, organisationId, rows.map((r) => r.invoice.id));
     const systems = work();
     res.json({
       ok: true,
@@ -486,8 +517,9 @@ export function createInvoicingRouter({
       limit,
       total: page.total,
       totalCents: page.totalCents,
-      // The Filter chip's Client choices: every client of the tab.
+      // The Filter chip's choices, from every row of the tab.
       clients: [...new Set(light.map((r) => r.contactName).filter(Boolean))].sort((a, b) => a.localeCompare(b)),
+      practitioners: [...new Set(light.map((r) => r.job?.practitioner).filter(Boolean))].sort((a, b) => a.localeCompare(b)),
       sendsTo: system?.name ?? null,
       sendMode: mode,
       // The Linked column: one icon for each connected system.
@@ -593,8 +625,8 @@ export function createInvoicingRouter({
     // the job at its source or adopt the change (ledger.js), as Move to
     // Ready and Send do.
     const { problems } = await invoiceView(db, organisationId, await getInvoice(db, organisationId, invoiceId));
-    // A lab's pending rule (invoice-rules.js) is a gate too: fix its cause
-    // or turn the rule off.
+    // A lab's pending rule, or a skip rule the job matches (invoice-rules.js),
+    // is a gate too: fix its cause, void the draft, or turn the rule off.
     const held = problems.find((p) => p.code === 'job_review' || p.code === 'rule');
     if (held) throw new FlowError('not_ready', `${held.message.replace(/\.?$/, '.')} Nothing was approved.`);
     const issued = await issueInvoice(db, organisationId, invoiceId, { issuedBy: `person:${req.person.id}`, issueDate });
@@ -618,6 +650,14 @@ export function createInvoicingRouter({
     res.json({ ok: true, invoice: await invoiceDetail(db, organisationId, invoiceId, accounting(), work()) });
   }));
 
+  router.delete('/invoices/:id', ...manager, handle(log, async (req, res) => {
+    const invoiceId = pathId(req.params.id, 'invoice');
+    const organisationId = await organisationOf(req);
+    await deleteDraft(db, organisationId, invoiceId, { actor: `person:${req.person.id}` });
+    log.info?.(`[invoicing] organisation ${organisationId}: person ${req.person.id} deleted draft invoice ${invoiceId}`);
+    res.json({ ok: true });
+  }));
+
   router.get('/contacts', ...signedIn, handle(log, async (req, res) => {
     const organisationId = await organisationOf(req);
     const q = text(req.query.q);
@@ -842,7 +882,7 @@ export function createInvoicingRouter({
     res.json({
       ok: true,
       fields: Object.entries(FIELDS).map(([key, f]) => ({
-        key, label: f.label, kind: f.kind, options: f.options ?? null, tests: TESTS[f.kind], draftOnly: Boolean(f.draftOnly),
+        key, label: f.label, kind: f.kind, options: f.options ?? null, tests: f.tests ?? TESTS[f.kind], draftOnly: Boolean(f.draftOnly),
       })),
       actions: ACTIONS,
       options: {

package/server/app.js

@@ -26,7 +26,8 @@ import { createUiAssetsRouter } from './ui/routes.js';
 // per client, sized for a lab of a few people: `rateLimitPerMinute` for /api,
 // `signInRateLimitPerMinute` for the sign-in page and its config, and
 // `clerkProxyRateLimitPerMinute` for Clerk's Frontend API, which a signed-in
-// browser calls often. `build` is what GET /health reports
+// browser calls often, and `assetRateLimitPerMinute` for the scripts, styles
+// and faces every page loads. `build` is what GET /health reports
 // (server/deployed-build.js); `updates` is a server/update-check.js checker.
 // `integrations` is the started registry (server/integrations/index.js); each
 // adapter's own routes are mounted under /api/<id>, and GET /health reports
@@ -51,6 +52,7 @@ export function createApp({
   rateLimitPerMinute = 120,
   signInRateLimitPerMinute = 30,
   clerkProxyRateLimitPerMinute = 300,
+  assetRateLimitPerMinute = 600,
   defaultFamily = DEFAULT_FAMILY,
   // Buttons that call Xero or Seazona wait between presses (the action
   // guard, server/integrations/call-guard.js). Off only in tests.
@@ -95,7 +97,7 @@ export function createApp({
   }
 
   // The design systems, Flow's components and the faces every page loads.
-  app.use(createUiAssetsRouter());
+  app.use(createUiAssetsRouter({ rateLimitPerMinute: assetRateLimitPerMinute }));
 
   app.use('/api', rateLimit({ limit: rateLimitPerMinute, windowMs: 60_000 }));
 

package/server/auth/people.js

@@ -2,8 +2,9 @@ import { and, asc, eq, isNull, ne, sql } from 'drizzle-orm';
 import { people, PERSON_ROLES } from '../db/schema.js';
 import { FlowError } from '../core/errors.js';
 import { isThemeFamily, normalizeAccent } from '../theme/themes.js';
-import { INVOICE_COLUMNS, normaliseJobsView, normaliseListView, PRICE_COLUMNS, RECONCILE_COLUMNS } from '../ui/job-view.js';
+import { invoiceColumnsView, normaliseJobsView, normaliseListView, PRICE_COLUMNS, RECONCILE_COLUMNS } from '../ui/job-view.js';
 import { normaliseSavedViews, SAVED_VIEW_PAGES } from '../ui/list-views.js';
+import { normaliseNavPins } from '../ui/nav-pins.js';
 import { isPlainEmail } from './settings.js';
 
 // The people who may sign in, and their roles. Only an owner changes this
@@ -58,13 +59,14 @@ export async function setPersonAppearance(db, { id, appearance }) {
 function viewCheck(page) {
   switch (page) {
     case 'jobs': return normaliseJobsView;
-    case 'invoices': return (view) => normaliseListView(view, INVOICE_COLUMNS);
+    case 'invoices': return invoiceColumnsView;
     case 'reconcile': return (view) => normaliseListView(view, RECONCILE_COLUMNS);
     case 'price-list': return (view) => normaliseListView(view, PRICE_COLUMNS);
+    case 'nav': return normaliseNavPins;
     default: return null;
   }
 }
-const VIEW_PAGE_NAMES = ['jobs', 'invoices', 'reconcile', 'price-list'];
+const VIEW_PAGE_NAMES = ['jobs', 'invoices', 'reconcile', 'price-list', 'nav'];
 
 // A person's saved views as Flow sends them: only the known pages, each
 // checked, so a view saved by an older Flow still loads.

package/server/auth/routes.js

@@ -19,6 +19,7 @@ import {
 } from './people.js';
 import { isPlainEmail } from './settings.js';
 import { APP_PATHS, appPage } from '../ui/app-page.js';
+import { navPinsFromViews } from '../ui/nav-pins.js';
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const ERROR_STATUS = { invalid: 400, forbidden: 403, not_found: 404, conflict: 409 };
 
@@ -104,6 +105,8 @@ export function createSignInRouter({ settings, db, clerk, personAuth, defaultFam
     }
     body.appearance = req.person.appearance ? normaliseAppearance(req.person.appearance) : null;
     body.views = normaliseViews(req.person.views);
+    // No pins saved yet: today's sidebar. A saved choice is checked the same way.
+    body.views.nav = navPinsFromViews(req.person.views);
     res.json(body);
   });
 
@@ -118,7 +121,7 @@ export function createSignInRouter({ settings, db, clerk, personAuth, defaultFam
   });
 
   // Each person sets their own view of a page (how Jobs groups, sorts and
-  // filters); it follows their account.
+  // filters, and which pages are pinned: `nav`). It follows their account.
   router.put('/api/me/views/:page', requireSession, express.json({ limit: '8kb' }), async (req, res) => {
     try {
       const view = await setPersonView(db, { id: req.person.id, page: req.params.page, view: req.body });

package/server/core/invoice-rules.js

@@ -47,7 +47,14 @@ export const FIELDS = Object.freeze({
   practitioner: { label: 'Practitioner', kind: 'text', options: 'practitioners', read: (j, { customer }) => j.practitioner || customer.defaultPractitioner || null },
   // Only a draft has a Reference, so only a pending rule may read it.
   reference: { label: 'Reference', kind: 'text', draftOnly: true, read: (j) => j.reference || null },
-  customer: { label: 'Customer', kind: 'choice', options: 'customers', read: (j) => j.contactId },
+  // Menu tests read the contact id. Contains and does not contain read the
+  // customer's name (matches): a lab can exclude every name that contains
+  // one marker, so a new branch needs no new rule.
+  customer: {
+    label: 'Customer', kind: 'choice', options: 'customers',
+    tests: ['is', 'is_not', 'is_one_of', 'contains', 'does_not_contain', 'is_empty'],
+    read: (j) => j.contactId,
+  },
   customer_billable: { label: 'Customer is billable', kind: 'boolean', read: (j, { customer }) => customer.billable !== false },
   line_item: { label: 'Line item', kind: 'items', options: 'items', read: (j) => (j.lines ?? []).flatMap((l) => [norm(l.itemCode), norm(l.label)].filter(Boolean)) },
   line_share: { label: 'Line share of other lines (%)', kind: 'share', options: 'items', read: (j) => j.lines ?? [] },
@@ -71,7 +78,8 @@ function readCondition(raw, index) {
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw invalid(`condition ${index + 1} must be an object`);
   const field = FIELDS[raw.field];
   if (!field) throw invalid(`condition ${index + 1}: unknown field ${raw.field}`);
-  if (!TESTS[field.kind].includes(raw.test)) throw invalid(`condition ${index + 1}: ${field.label} takes ${TESTS[field.kind].join(', ')}`);
+  const allowed = field.tests ?? TESTS[field.kind];
+  if (!allowed.includes(raw.test)) throw invalid(`condition ${index + 1}: ${field.label} takes ${allowed.join(', ')}`);
   const out = { field: raw.field, test: raw.test };
   if (NO_VALUE.has(raw.test)) return out;
   const { value } = raw;
@@ -125,9 +133,13 @@ function matches(condition, job, context) {
   const { test, value } = condition;
   if (test === 'is_empty') return have === null || have === '' || have === undefined;
   if (test === 'is_not_empty') return !(have === null || have === '' || have === undefined);
-  if (field.kind === 'text' && !['is', 'is_not', 'is_one_of'].includes(test)) {
+  // Customer contains reads the contact's name, in any case and with the
+  // spaces trimmed, the same way a practitioner's name is read. is, is not
+  // and is one of still compare the contact id. `customer.name` is that name.
+  const named = condition.field === 'customer' && (test === 'contains' || test === 'does_not_contain');
+  if ((field.kind === 'text' || named) && !['is', 'is_not', 'is_one_of'].includes(test)) {
     // An empty text matches no test that reads its words; is_empty finds it.
-    const left = norm(have);
+    const left = norm(named ? (context.customer?.name ?? job.customerName ?? null) : have);
     if (!left) return false;
     if (test === 'is_not_one_of') return !value.some((v) => norm(v) === left);
     if (test === 'has_number') return /\d/.test(left);
@@ -195,6 +207,24 @@ export function rulePending(rules, job, { customer = {}, now = new Date() } = {}
     .map((r) => ({ code: 'rule', message: r.action.note, short: r.name.slice(0, 40), rule: r.id ?? null, fields: [...new Set(r.conditions.map((c) => c.field))] }));
 }
 
+// Drafts an enabled skip rule matches stay on Pending at Send (sending.js).
+// A person drafted the job by hand, or the rule was made after the draft.
+// The list shows the rule's name. The note says to void the draft or change
+// the rule. A wait rule does not hold a draft: a person may still send one.
+export function ruleSkip(rules, job, { customer = {}, now = new Date() } = {}) {
+  const context = { customer, now };
+  return rules
+    .filter((r) => r.enabled && r.trigger === 'job_ready' && r.action.kind === 'skip')
+    .filter((r) => r.conditions.every((c) => matches(c, job, context)))
+    .map((r) => ({
+      code: 'rule',
+      message: `Rule "${r.name}": not invoiced. Void this draft or change the rule.`,
+      short: r.name.slice(0, 40),
+      rule: r.id ?? null,
+      fields: [...new Set(r.conditions.map((c) => c.field))],
+    }));
+}
+
 // The starter rules made from the earlier fixed settings.
 export function starterRules(settings) {
   const rules = [

package/server/core/invoices.js

@@ -1,5 +1,5 @@
 import { and, asc, desc, eq, sql } from 'drizzle-orm';
-import { contacts, invoiceLines, invoices, invoiceVersions, organisations, priceItems } from '../db/schema.js';
+import { billingObligations, contacts, invoiceLines, invoices, invoiceVersions, obligationEvents, organisations, priceItems } from '../db/schema.js';
 import { FlowError, notFound } from './errors.js';
 import { invoiceTotals, lineTotals } from './money.js';
 
@@ -7,6 +7,7 @@ import { invoiceTotals, lineTotals } from './money.js';
 // invoice its number and stores the document exactly as sent, as a new
 // version. To change an issued invoice, revise it back to a draft and issue
 // it again: the number stays and the earlier versions stay as they were.
+// A draft that was never issued can be deleted. An issued invoice is voided.
 
 async function loadInvoice(tx, organisationId, invoiceId, { lock = false } = {}) {
   let query = tx.select().from(invoices)
@@ -182,6 +183,44 @@ export async function voidInvoice(db, organisationId, invoiceId) {
   });
 }
 
+// Removes a draft that was never issued. The job it billed is free again:
+// its obligation no longer points at the draft, so the lab's rules decide
+// whether Flow drafts it once more. An invoice that was issued is voided,
+// not deleted (the database holds the same rule).
+export async function deleteDraft(db, organisationId, invoiceId, { actor = null } = {}) {
+  return db.transaction(async (tx) => {
+    const invoice = await loadInvoice(tx, organisationId, invoiceId, { lock: true });
+    if (invoice.status !== 'draft' || invoice.issuedVersion !== 0) {
+      throw new FlowError('was_issued', 'an invoice that was issued cannot be deleted; void it');
+    }
+    const linked = await tx.select().from(billingObligations)
+      .where(and(eq(billingObligations.organisationId, organisationId), eq(billingObligations.invoiceId, invoice.id)))
+      .for('update');
+    if (linked.length && !actor) throw new FlowError('invalid', 'actor is required');
+    for (const obligation of linked) {
+      await tx.update(billingObligations)
+        .set({ invoiceId: null, draftBasis: null, updatedAt: sql`now()` })
+        .where(eq(billingObligations.id, obligation.id));
+      await tx.insert(obligationEvents).values({
+        createdAt: sql`clock_timestamp()`,
+        organisationId,
+        obligationId: obligation.id,
+        kind: 'draft_deleted',
+        actor,
+        evidence: { invoiceId: invoice.id },
+      });
+    }
+    try {
+      await tx.delete(invoices).where(eq(invoices.id, invoice.id));
+    } catch (error) {
+      const code = error?.code ?? error?.cause?.code;
+      if (code === '23503') throw new FlowError('conflict', 'this draft is still linked; remove the link, then delete it');
+      throw error;
+    }
+    return invoice;
+  });
+}
+
 export async function getInvoice(db, organisationId, invoiceId) {
   const invoice = await loadInvoice(db, organisationId, invoiceId);
   const lines = await db.select().from(invoiceLines)

package/server/core/invoicing-rules.js

@@ -150,6 +150,16 @@ export async function customerBillingByContact(db, organisationId, contactIds) {
   return new Map(rows.map((r) => [r.contactId, pick(r, CUSTOMER_KEYS)]));
 }
 
+// The customers' names, by contact id. Customer "contains" reads the name
+// (invoice-rules.js), not the contact id the menu tests use.
+async function customerNames(db, organisationId, contactIds) {
+  const ids = [...new Set(contactIds.filter(Boolean))];
+  if (!ids.length) return new Map();
+  const rows = await db.select({ id: contacts.id, name: contacts.name }).from(contacts)
+    .where(and(eq(contacts.organisationId, organisationId), inArray(contacts.id, ids)));
+  return new Map(rows.map((r) => [r.id, r.name]));
+}
+
 // The settings that apply to one customer: its own, else the organisation's.
 // `autoDraft` is the customer's own switch for the draft automation.
 export function effectiveSettings(settings, customer = CUSTOMER_DEFAULTS) {
@@ -255,13 +265,16 @@ export async function autoDraftJobs(db, organisationId, { accounting = null, wor
     sql`${billingObligations.contactId} is not null`,
     // Newest first: a backlog of jobs that wait on a rule never hides new work.
   )).orderBy(sql`${billingObligations.jobDate} desc nulls last`, billingObligations.id).limit(limit);
-  const customers = await customerBillingByContact(db, organisationId, candidates.map((o) => o.contactId));
+  const contactIds = candidates.map((o) => o.contactId);
+  const customers = await customerBillingByContact(db, organisationId, contactIds);
+  const names = await customerNames(db, organisationId, contactIds);
+  const named = (contactId) => ({ ...effectiveSettings(settings, customers.get(contactId)), name: names.get(contactId) ?? null });
   const liveCheck = accounting ? copyCheck(accounting, organisationId) : null;
   const invoiceDate = isoDay(now);
   let accountingRead = null;
 
   for (const candidate of candidates) {
-    let effective = effectiveSettings(settings, customers.get(candidate.contactId));
+    let effective = named(candidate.contactId);
     if (!effective.autoDraft) {
       result.off += 1;
       continue;
@@ -302,7 +315,11 @@ export async function autoDraftJobs(db, organisationId, { accounting = null, wor
       }
     }
     if (obligation !== candidate) {
-      effective = effectiveSettings(settings, customers.get(obligation.contactId));
+      if (obligation.contactId && !names.has(obligation.contactId)) {
+        const extra = await customerNames(db, organisationId, [obligation.contactId]);
+        for (const [id, name] of extra) names.set(id, name);
+      }
+      effective = named(obligation.contactId);
       if (!effective.autoDraft || ruleBlockers(obligation, effective, { now, rules }).length) {
         result.waiting += 1;
         continue;

package/server/core/job-board.js

@@ -55,7 +55,7 @@ export async function describeObligations(db, organisationId, listed, { accounti
   // The invoicing rules a job with no invoice waits on, for every view a
   // draft can still come from.
   const waitingFor = (o, v) => (o.invoiceId || !['in_work', 'ready', 'pending', 'held'].includes(v)
-    ? [] : ruleBlockers(o, effectiveSettings(settings, customers.get(o.contactId)), { rules }));
+    ? [] : ruleBlockers(o, { ...effectiveSettings(settings, customers.get(o.contactId)), name: nameOf.get(o.contactId) ?? null }, { rules }));
   return listed.map(({ obligation: { lineFingerprint: _fingerprint, organisationId: _org, draftBasis: _basis, ...o }, view, reasons }) => ({
     ...o,
     canUseNewLines: offers.has(o.id),