@arcforgelabs/flow 2026.10.50 → 2026.10.52

package/server/db/migrations/meta/_journal.json

@@ -162,6 +162,20 @@
       "when": 1792733287865,
       "tag": "0022_contacts",
       "breakpoints": true
+    },
+    {
+      "idx": 23,
+      "version": "7",
+      "when": 1793110575758,
+      "tag": "0023_captures",
+      "breakpoints": true
+    },
+    {
+      "idx": 24,
+      "version": "7",
+      "when": 1793233782043,
+      "tag": "0024_rule_icon",
+      "breakpoints": true
     }
   ]
 }

package/server/db/schema.js

@@ -694,6 +694,8 @@ export const invoiceRules = pgTable('invoice_rules', {
   id: id(),
   organisationId: organisationId().references(() => organisations.id),
   name: text('name').notNull(),
+  // A Lucide icon name for the rule's card; null shows the action's mark.
+  icon: text('icon'),
   position: integer('position').notNull(),
   enabled: boolean('enabled').notNull().default(true),
   trigger: text('trigger').notNull().default('job_ready'),
@@ -707,6 +709,7 @@ export const invoiceRules = pgTable('invoice_rules', {
   uniqueIndex('invoice_rules_starter_key').on(t.organisationId, t.starterKey),
   check('invoice_rules_trigger_valid', sql`${t.trigger} in ('job_ready')`),
   check('invoice_rules_name_valid', sql`length(${t.name}) between 1 and 120`),
+  check('invoice_rules_icon_valid', sql`${t.icon} is null or (length(${t.icon}) between 1 and 64 and ${t.icon} !~ '[^a-z0-9-]')`),
 ]);
 
 // Automations (server/core/automations.js): Flow's routines, each on or off,
@@ -858,3 +861,50 @@ export const jobFieldEvents = pgTable('job_field_events', {
   foreignKey({ name: 'job_field_events_field_same_org', columns: [t.organisationId, t.fieldId], foreignColumns: [jobFields.organisationId, jobFields.id] }).onDelete('cascade'),
   index('job_field_events_job').on(t.organisationId, t.sourceSystem, t.sourceJobRef, t.createdAt),
 ]);
+
+// A photo of a handwritten lab form (server/core/captures.js). The bytes live
+// in the object storage adapter; this row keeps the key, size, type and
+// checksum. `read` is what the vision reader returned (server/core/reader.js):
+// the fields, the model, the tokens and the cost. A new row is `reading`
+// while that runs, or `problem` when the reader is off. A person may type
+// the proposal either way. `done` means someone applied or discarded it.
+// The photo bytes are deleted then, and a row with no decision is deleted
+// after 7 days.
+export const CAPTURE_STATES = ['reading', 'ready', 'done', 'problem'];
+export const CAPTURE_SOURCES = ['phone', 'desk', 'api'];
+export const CAPTURE_DECISIONS = ['applied', 'discarded'];
+export const captures = pgTable('captures', {
+  id: id(),
+  organisationId: organisationId().references(() => organisations.id),
+  state: text('state').notNull(),
+  source: text('source').notNull(),
+  fileKey: text('file_key').notNull(),
+  fileType: text('file_type').notNull(),
+  fileSize: integer('file_size').notNull(),
+  fileSha256: text('file_sha256').notNull(),
+  idempotencyKey: text('idempotency_key').notNull(),
+  // Fields, model, token counts and cost in micros. Null until a read finishes.
+  read: jsonb('read'),
+  match: jsonb('match'),
+  proposal: jsonb('proposal').notNull().default(sql`'{"action":null,"jobId":null,"changes":[]}'::jsonb`),
+  problem: text('problem'),
+  decision: text('decision'),
+  decidedBy: uuid('decided_by').references(() => people.id, { onDelete: 'set null' }),
+  decidedAt: timestamp('decided_at', { withTimezone: true }),
+  photoDeletedAt: timestamp('photo_deleted_at', { withTimezone: true }),
+  createdBy: uuid('created_by').references(() => people.id, { onDelete: 'set null' }),
+  createdAt: createdAt(),
+  updatedAt: updatedAt(),
+}, (t) => [
+  unique('captures_org_id').on(t.organisationId, t.id),
+  unique('captures_org_idempotency').on(t.organisationId, t.idempotencyKey),
+  unique('captures_file_key').on(t.fileKey),
+  index('captures_photo_open').on(t.createdAt).where(sql`photo_deleted_at is null`),
+  check('captures_state_valid', inList('state', CAPTURE_STATES)),
+  check('captures_source_valid', inList('source', CAPTURE_SOURCES)),
+  check('captures_decision_valid', sql`${t.decision} is null or ${t.decision} in ('applied', 'discarded')`),
+  check('captures_done_has_decision', sql`(${t.state} = 'done') = (${t.decision} is not null)`),
+  check('captures_file_size_valid', sql`${t.fileSize} >= 0`),
+  check('captures_sha256_valid', sql`${t.fileSha256} ~ '^[0-9a-f]{64}$'`),
+  check('captures_problem_valid', sql`${t.problem} is null or length(${t.problem}) between 1 and 200`),
+]);

package/server/index.js

@@ -9,7 +9,12 @@ import { migrateDatabase, openDatabase } from './db/index.js';
 import {
   importEarlierAtStart, importEarlierLinksAtStart, importEarlierMappingsAtStart, resolveImportAtStart,
 } from './import/at-start.js';
+import { createAiPort, resolveReader } from './core/ai.js';
+import { createBedrockClient } from './core/ai-bedrock.js';
+import { createCaptureRetentionWorker } from './core/captures.js';
 import { createMonitoredLog } from './core/monitoring.js';
+import { createCaptureReader } from './core/reader.js';
+import { resolveObjectStorage } from './core/storage.js';
 import { createTracing, traceQueries } from './core/tracing.js';
 import { createPipelineWorker } from './core/pipeline.js';
 import { createReconcileWorker } from './core/reconcile.js';
@@ -117,6 +122,43 @@ if (jobsOn) createReconcileWorker({ db: database.db, integrations, log }).start(
 // with Send all ready, to the accounting integration that is on.
 if (jobsOn) createSendWorker({ db: database.db, integrations, log }).start();
 
+// Capture photos (server/core/storage.js). A bad storage setting stops boot.
+// On Replit, and where the local folder cannot be created, the default is
+// off. The retention pass
+// only deletes Flow's own files, so it still runs where background jobs are
+// off: a second copy deleting the same key does nothing.
+let storage = null;
+try {
+  const resolved = await resolveObjectStorage({ env: process.env, secrets });
+  storage = resolved.storage;
+  if (storage) console.log(`[storage] ${resolved.mode}`);
+  else console.log(`[storage] captures off (${resolved.reason})`);
+} catch (error) {
+  console.error(`[storage] ${error.message}`);
+  process.exit(1);
+}
+if (storage) createCaptureRetentionWorker({ db: database.db, storage, log }).start();
+
+// The vision reader (server/core/reader.js). A bad region or a model id that
+// is not an Australia profile stops boot. Off, or on without keys, stores
+// the photo and leaves the capture for a person to type.
+let reader = null;
+try {
+  const resolved = resolveReader({ env: process.env });
+  if (!resolved.on) console.log(`[reader] off (${resolved.reason})`);
+  else if (!storage) console.log('[reader] captures off (no file store)');
+  else {
+    const port = createAiPort(createBedrockClient(resolved));
+    reader = createCaptureReader({ db: database.db, storage, port, settings: resolved, log, jobsOn });
+    if (jobsOn) reader.worker.start();
+    else console.log('[reader] background jobs off: each capture is read in the upload');
+    console.log(`[reader] on (${resolved.region})`);
+  }
+} catch (error) {
+  console.error(`[reader] ${error.message}`);
+  process.exit(1);
+}
+
 let auth = null;
 if (settings.mode === 'clerk') {
   const { keys } = settings;
@@ -158,7 +200,11 @@ const trustProxy = process.env.REPL_ID || process.env.REPLIT_DEPLOYMENT ? 1 : fa
 
 const updates = createUpdateChecker();
 
-createApp({ database, schemaJournals: expectedSchema({ adapters: shippedAdapters }).journals, auth, trustProxy, updates, integrations, secrets, defaultFamily, log, tracing }).listen(port, () => {
+createApp({
+  database, schemaJournals: expectedSchema({ adapters: shippedAdapters }).journals, auth, trustProxy, updates, integrations, secrets, defaultFamily, log, tracing, storage,
+  publicOrigin: process.env.FLOW_PUBLIC_ORIGIN,
+  reader: reader ? { on: true, schedule: reader.schedule } : null,
+}).listen(port, () => {
   console.log(`[flow] listening on ${port}; design system ${defaultFamily} (FLOW_THEME)`);
 });
 

package/server/integrations/seazona/history/backfill.js

@@ -1,4 +1,4 @@
-import { and, eq, inArray } from 'drizzle-orm';
+import { eq, inArray } from 'drizzle-orm';
 import { FlowError } from '../../../core/errors.js';
 import { mapOrder, parseSeazonaDate, text } from '../map.js';
 import { seazonaHistoryBatchJobs, seazonaLaneState, seazonaOrders } from '../schema.js';
@@ -11,8 +11,9 @@ import { createApiBatch, finishApiBatch, stageApiJobs } from './index.js';
 // detail. It makes at most
 // `historyCallsPerRun` calls a run, through the same rate governor and call
 // guards as the live lanes, and keeps its place in the lane's cursor, so it
-// resumes after a restart. Orders the live copy already holds are not read
-// again. Each order becomes one job in an API batch: reconciled as it is
+// resumes after a restart. Orders the live copy already holds, and orders
+// any earlier backfill read, are not read again, so a read started again over
+// the same days costs only the list calls. Each order becomes one job in an API batch: reconciled as it is
 // read, written to Flow's history when it is new, and kept for a person when
 // it is not. The batch rows are the record of what the API confirmed.
 
@@ -65,7 +66,7 @@ export async function startBackfill(db, { from, through = null, createdBy, setti
     throw Object.assign(new FlowError('conflict', 'A history backfill is already running'), { status: 409 });
   }
   const batch = await createApiBatch(db, { createdBy, from, through: last, at });
-  const cursor = { batchId: batch.id, from, through: last, nextDay: from, page: 1, pending: [], done: false, days: 0, read: 0 };
+  const cursor = { batchId: batch.id, from, through: last, nextDay: from, page: 1, pending: [], done: false, days: 0, read: 0, startedAt: at.toISOString() };
   await db.insert(seazonaLaneState).values({ lane: LANE, status: 'idle', cursor, nextRunAt: at })
     .onConflictDoUpdate({ target: seazonaLaneState.lane, set: { status: 'idle', cursor, nextRunAt: at, failureCount: 0, lastError: null, heldReason: null, updatedAt: at } });
   return describeBackfill(cursor);
@@ -89,19 +90,47 @@ export function describeBackfill(cursor) {
     batchId: cursor.batchId,
     from: cursor.from,
     through: cursor.through,
+    startedAt: cursor.startedAt ?? null,
     nextDay: cursor.done ? null : cursor.nextDay,
+    // The day whose orders it reads now: the last day listed while orders
+    // from it wait, else the next day to list.
+    readingDay: cursor.done ? null : (cursor.pending?.length && cursor.listDay) || cursor.nextDay,
     daysDone: cursor.days ?? 0,
     reachedDay: cursor.reached ?? null,
     ordersRead: cursor.read ?? 0,
     waitingToRead: cursor.pending?.length ?? 0,
     running: !cursor.done,
     stopped: Boolean(cursor.stopped),
+    // Where a stopped read goes on: the day it listed last while orders from
+    // that list were still to read, else the next day.
+    resumeFrom: !cursor.stopped ? null
+      : cursor.pending?.length && cursor.listDay ? cursor.listDay
+        : cursor.nextDay <= cursor.through ? cursor.nextDay : null,
   };
 }
 
+// A read that failed this many runs in a row shows as failed, not waiting.
+const FAILED_AFTER = 3;
+
+// The card's phase. A held or failed lane waits for its retry at nextRunAt;
+// a lane Seazona halted, or one that failed FAILED_AFTER times, has failed.
+function phaseOf(backfill, state) {
+  if (!backfill.running) return backfill.stopped ? 'stopped' : 'done';
+  if (state.status === 'stopped' || (state.status === 'failed' && state.failureCount >= FAILED_AFTER)) return 'failed';
+  return ['held', 'failed'].includes(state.status) ? 'waiting' : 'running';
+}
+
 export async function readBackfill(db) {
   const [state] = await db.select().from(seazonaLaneState).where(eq(seazonaLaneState.lane, LANE));
-  return describeBackfill(state?.cursor);
+  const backfill = describeBackfill(state?.cursor);
+  if (!backfill) return null;
+  const phase = phaseOf(backfill, state);
+  return {
+    ...backfill,
+    phase,
+    cause: ['waiting', 'failed'].includes(phase) ? state.lastError : null,
+    nextRunAt: backfill.running ? state.nextRunAt : null,
+  };
 }
 
 // One run of the `history` lane. `helpers` are the lane module's failure
@@ -119,10 +148,10 @@ export async function runHistoryBackfill(ctx, { isLaneLevel, describeReadFailure
   let deleted = 0;
   let quarantined = 0;
 
-  const inBatch = async (ids) => {
+  const alreadyRead = async (ids) => {
     if (!ids.length) return new Set();
     const rows = await db.select({ key: seazonaHistoryBatchJobs.jobKey }).from(seazonaHistoryBatchJobs)
-      .where(and(eq(seazonaHistoryBatchJobs.batchId, cursor.batchId), inArray(seazonaHistoryBatchJobs.jobKey, ids.map((id) => `case:${id}`))));
+      .where(inArray(seazonaHistoryBatchJobs.jobKey, ids.map((id) => `case:${id}`)));
     return new Set(rows.map((r) => r.key.slice(5)));
   };
 
@@ -134,6 +163,7 @@ export async function runHistoryBackfill(ctx, { isLaneLevel, describeReadFailure
           break;
         }
         calls += 1;
+        cursor.listDay = cursor.nextDay;
         const list = await client.get('orders/', { ordered: orderedParam(cursor.nextDay), page: cursor.page, pageSize });
         if (!Array.isArray(list)) throw new LaneError(`Seazona order list for ${cursor.nextDay} answer was not a list`, { code: 'seazona_list_invalid' });
         // The guide says the list answers orders placed on or after `ordered`,
@@ -149,7 +179,7 @@ export async function runHistoryBackfill(ctx, { isLaneLevel, describeReadFailure
         const live = ids.length
           ? new Set((await db.select({ id: seazonaOrders.id }).from(seazonaOrders).where(inArray(seazonaOrders.id, ids))).map((r) => r.id))
           : new Set();
-        const seen = await inBatch(ids);
+        const seen = await alreadyRead(ids);
         cursor.pending = ids.filter((id) => !live.has(id) && !seen.has(id));
         if (beyond) {
           cursor.nextDay = dayOf(Date.parse(cursor.through) + DAY_MS);
@@ -163,7 +193,7 @@ export async function runHistoryBackfill(ctx, { isLaneLevel, describeReadFailure
         continue;
       }
       const id = cursor.pending.shift();
-      if ((await inBatch([id])).size) continue;
+      if ((await alreadyRead([id])).size) continue;
       calls += 1;
       try {
         const detail = await client.get(`orders/${encodeURIComponent(id)}`);

package/server/integrations/seazona/index.js

@@ -8,7 +8,7 @@ import { readBillableJobs } from './reconcile.js';
 import { SEAZONA_CALL_GUARD } from './governor.js';
 import { createSeazonaRouter } from './routes.js';
 import {
-  cancelStageMove, expiredStageMoves, handOff, readPersonSettings, requestStageMove, settleStageMoves, waitingStageMoves, writePersonSetting,
+  cancelStageMove, handOff, readPersonSettings, requestStageMove, settleStageMoves, waitingStageMoves, writePersonSetting,
 } from './stage-moves.js';
 import { orderPatient } from './patients.js';
 import { createSeazonaScheduler } from './scheduler.js';
@@ -148,17 +148,6 @@ export function createSeazonaAdapter({ env = null, fetchImpl = null, now = Date.
         if (!runtime?.client.governor) return [];
         const status = await runtime.client.governor.status();
         const alerts = guardAlerts('Seazona', status, { fix: 'Check the API client in the Seazona settings, then save them.' });
-        // Stage moves nobody made in Seazona within a day (stage-moves.js).
-        await settleStageMoves(runtime.db, { now: now() });
-        const expired = await expiredStageMoves(runtime.db, { now: now() });
-        if (expired.length) {
-          alerts.push({
-            id: 'stage-moves-expired',
-            tone: 'warn',
-            title: `${expired.length === 1 ? 'One stage move was' : `${expired.length} stage moves were`} not made in Seazona within a day: ${expired.slice(0, 5).map((m) => `${m.orderId} to ${m.toStatus}`).join(', ')}${expired.length > 5 ? ', …' : ''}. The cards went back to their Seazona stage.`,
-            members: expired.map((m) => `${m.orderId}:${m.settledAt?.toISOString() ?? ''}`),
-          });
-        }
         // Issue #143: what the lanes cannot fix by themselves. A refused API
         // client already has its own alert above, so it stops no lane here.
         if (!runtime.settings.scheduled) return alerts;

package/server/integrations/seazona/stage-moves.js

@@ -1,4 +1,4 @@
-import { and, eq, gte, inArray, lt, sql } from 'drizzle-orm';
+import { and, eq, inArray, sql } from 'drizzle-orm';
 import { FlowError } from '../../core/errors.js';
 import { orderStatusLabel } from './map.js';
 import { orderLink } from './settings.js';
@@ -9,12 +9,11 @@ import { seazonaOrders, seazonaPersonSettings, seazonaStageMoves } from './schem
 // hand-off. Flow records the move, the person makes it in Seazona, and the
 // next sync that reads the new status settles it. Until then the card shows
 // "Waiting for Seazona" in the new lane. After a day with no change the move
-// expires, the card goes back to Seazona's stage, and a quiet alert says so.
+// expires and the card goes back to Seazona's stage. No alert follows: the
+// person saw what to do in Seazona when they moved the card.
 // Every function here reads and writes Flow's database only.
 
 export const HAND_OFF_MS = 24 * 60 * 60_000;
-// How long an expired move stays in the alert.
-const EXPIRED_ALERT_MS = 7 * 24 * 60 * 60_000;
 const MAX_STATUS = 80;
 
 // Record a person's move of one order to `toStatus`, and answer the hand-off
@@ -77,15 +76,6 @@ export async function waitingStageMoves(db) {
   return new Map(rows.map((r) => [r.orderId, r]));
 }
 
-// The moves that expired in the last week, for the quiet alert.
-export async function expiredStageMoves(db, { now = Date.now() } = {}) {
-  return db.select().from(seazonaStageMoves).where(and(
-    eq(seazonaStageMoves.state, 'expired'),
-    gte(seazonaStageMoves.settledAt, new Date(Number(now) - EXPIRED_ALERT_MS)),
-    lt(seazonaStageMoves.settledAt, new Date(Number(now) + 1)),
-  ));
-}
-
 // What the board shows for a waiting move. `link` opens the order in
 // Seazona's web app (settings.js, orderLink); `exact` is false when it opens
 // only the lab's Seazona home page.

package/server/integrations/sentry/index.js

@@ -44,12 +44,12 @@ export const SENTRY_SETUP = {
     ],
   },
   fields: [
-    { name: 'SENTRY_DSN', label: 'DSN', kind: 'url', help: 'From the Sentry project\'s Client Keys. Browsers see it, so it is not a secret.' },
-    { name: 'SENTRY_ENVIRONMENT', label: 'Environment', help: 'How Sentry labels this installation, for example production. Empty: production, or workspace in a Replit workspace.' },
-    { name: 'SENTRY_CLIENT', label: 'Client', help: 'The name your support desk files this installation\'s reports under. Sent as the client tag. Empty: no client tag.' },
-    { name: 'SENTRY_FEEDBACK', label: 'Report button', kind: 'onoff', help: 'On: everyone signed in can send a report, with a screenshot, to this Sentry project.' },
-    { name: 'SENTRY_REPLAY', label: 'Replay', kind: 'onoff', help: 'On: each report and each browser error keeps up to the last minute of the page, as a replay with every word hidden.' },
-    { name: 'SENTRY_TRACES_SAMPLE_RATE', label: 'Traces', help: 'The share of clicks, page loads and requests timed, from 0 (off) to 1 (all). Empty: 0.2.' },
+    { name: 'SENTRY_DSN', label: 'DSN', kind: 'url', advanced: true, help: 'From the Sentry project\'s Client Keys. Browsers see it, so it is not a secret.' },
+    { name: 'SENTRY_ENVIRONMENT', label: 'Environment', advanced: true, help: 'How Sentry labels this installation, for example production. Empty: production, or workspace in a Replit workspace.' },
+    { name: 'SENTRY_CLIENT', label: 'Client', advanced: true, help: 'The name your support desk files this installation\'s reports under. Sent as the client tag. Empty: no client tag.' },
+    { name: 'SENTRY_FEEDBACK', label: 'Report button', kind: 'onoff', default: 'on', help: 'On: everyone signed in can send a report, with a screenshot, to this Sentry project.' },
+    { name: 'SENTRY_REPLAY', label: 'Replay', kind: 'onoff', default: 'on', help: 'On: each report and each browser error keeps up to the last minute of the page, as a replay with every word hidden.' },
+    { name: 'SENTRY_TRACES_SAMPLE_RATE', label: 'Traces', advanced: true, help: 'The share of clicks, page loads and requests timed, from 0 (off) to 1 (all). Empty: 0.2.' },
   ],
 };
 

package/server/integrations/setup.js

@@ -82,6 +82,7 @@ export function describeSetup({ adapter, row, env, secrets, entry, unreadable =
       choices: field.choices ?? null,
       suggest: field.suggest ?? null,
       default: field.default ?? null,
+      advanced: Boolean(field.advanced),
       source: fromHost ? 'host' : null,
     };
     if (field.secret) {

package/server/integrations/xero/drafts.js

@@ -68,6 +68,23 @@ function xeroDate(value) {
 
 const problem = (code, message, extra = {}) => ({ code, message, ...extra });
 
+// The few words the Invoices list shows for a refusal; the message says how
+// to fix it. Another code shows "Not sent" (sending.js).
+const SHORT = {
+  xero_same_reference_different_amount: 'Duplicate?',
+  xero_earlier_version_in_xero: 'Old version in Xero',
+  xero_earlier_version_unresolved: 'Check old version',
+  xero_tracking_missing: 'Tracking not in Xero',
+  xero_validation_failed: 'Xero refused',
+  xero_reconnect_needed: 'Reconnect Xero',
+  xero_token_failed: 'Reconnect Xero',
+  xero_unreachable: 'Xero offline',
+  xero_writes_off: 'Sending off',
+  xero_push_in_progress: 'Sending now',
+  xero_outcome_unknown: 'Not confirmed',
+};
+const shortFor = (error) => error.short ?? SHORT[error.code];
+
 // A person can always link the Flow contact to a Xero contact of another
 // name (create-contact.js, linkCustomer): no Xero call.
 function missingContact(name, { offerCreate }) {
@@ -292,7 +309,7 @@ export async function previewDrafts(db, runtime, organisationId, invoiceIds) {
     try {
       results.push(await previewOne(db, runtime, organisationId, invoiceId));
     } catch (error) {
-      results.push({ invoiceId, state: 'blocked', problems: [problem(error.code ?? 'xero_preview_failed', error.message)] });
+      results.push({ invoiceId, state: 'blocked', problems: [problem(error.code ?? 'xero_preview_failed', error.message, { short: shortFor(error) })] });
     }
   }
   return { syncedAt, warnings, invoices: results };
@@ -414,7 +431,7 @@ export async function checkDrafts(db, runtime, { organisationId, invoiceIds }) {
 }
 
 function failed(invoiceId, error, outcome = 'failed') {
-  return { invoiceId, outcome, error: { code: error.code ?? 'xero_push_failed', message: error.message, ...(error.details ? { details: error.details } : {}) } };
+  return { invoiceId, outcome, error: { code: error.code ?? 'xero_push_failed', message: error.message, ...(shortFor(error) ? { short: shortFor(error) } : {}), ...(error.details ? { details: error.details } : {}) } };
 }
 
 function summarise(results) {
@@ -489,16 +506,13 @@ async function pushOne(db, runtime, client, organisationId, invoiceId, { pushedB
   const match = await matchContactFor(db, organisationId, { contactId: invoice.contactId, name: document.contact.name });
   if (match.state !== 'matched') {
     const offerCreate = match.state === 'missing' && runtime.settings.createContacts && writesAllowed(runtime.settings);
-    throw xeroError(match.state === 'missing' ? 'xero_contact_missing' : 'xero_contact_ambiguous',
-      match.state === 'missing'
-        ? missingContact(document.contact.name, { offerCreate }).message
-        : twiceContact(document.contact.name).message,
-      { status: 409 });
+    const found = match.state === 'missing' ? missingContact(document.contact.name, { offerCreate }) : twiceContact(document.contact.name);
+    throw xeroError(found.code, found.message, { status: 409, short: found.short });
   }
   const items = await itemsByCode(db, organisationId, document.lines.map((l) => l.itemCode));
   const sendMode = await sendModeFor(db, organisationId, invoice.contactId);
   const { draft, problems } = buildDraft(document, { settings: runtime.settings, contact: match.contact, items, sendMode });
-  if (problems.length) throw xeroError(problems[0].code, problems.map((p) => p.message).join(' '), { status: 409 });
+  if (problems.length) throw xeroError(problems[0].code, problems.map((p) => p.message).join(' '), { status: 409, short: problems[0].short });
 
   // Live duplicate check: invoices in Xero with this reference, made by Flow
   // or by hand. Not needed when Flow's own copy of Xero already answered it
@@ -518,7 +532,7 @@ async function pushOne(db, runtime, client, organisationId, invoiceId, { pushedB
     });
     if (recent) {
       throw xeroError('xero_same_reference_different_amount',
-        `Possible duplicate: Xero ${recent.InvoiceNumber || 'invoice'} (${recent.Status}, ${(cents(recent.Total) / 100).toFixed(2)}) has this contact and reference "${draft.Reference}" at another amount. Nothing was sent. Check it, then send again choosing to send anyway.`,
+        `Xero ${recent.InvoiceNumber || 'invoice'} has the same client and reference at ${(cents(recent.Total) / 100).toFixed(2)}. Nothing was sent. Void the extra one in Xero or in Flow.`,
         { status: 409, details: { xero: shownXero(recent) } });
     }
   }
@@ -570,12 +584,12 @@ async function dispatch(db, client, push, document, { fresh = false } = {}) {
       invoiceId: push.invoiceId,
       version: push.version,
       outcome: 'ambiguous',
-      error: { code: 'xero_outcome_unknown', message: 'Xero did not say whether it made the draft. Send again: Flow repeats the same request within six minutes, and after that looks in Xero first, so no second invoice is made.' },
+      error: { code: 'xero_outcome_unknown', short: SHORT.xero_outcome_unknown, message: 'Xero did not say whether it made the draft. Send again: Flow repeats the same request within six minutes, and after that looks in Xero first, so no second invoice is made.' },
     };
   }
   if (!created?.InvoiceID) {
     await settle(db, push.id, { state: 'ambiguous', errorCode: 'xero_no_invoice_id', errorMessage: 'Xero answered without an invoice id.' });
-    return { invoiceId: push.invoiceId, version: push.version, outcome: 'ambiguous', error: { code: 'xero_outcome_unknown', message: 'Xero answered without an invoice id. Send again to settle it.' } };
+    return { invoiceId: push.invoiceId, version: push.version, outcome: 'ambiguous', error: { code: 'xero_outcome_unknown', short: SHORT.xero_outcome_unknown, message: 'Xero answered without an invoice id. Send again to settle it.' } };
   }
   return verify(db, client, push, draft, document, created, 'created');
 }
@@ -671,11 +685,11 @@ async function resume(db, runtime, client, push, document) {
         && differences(inv, draft, document).filter((d) => d !== 'date').length === 0);
   } catch (error) {
     if (error.code === 'xero_rate_limited' || isCallsStopped(error)) throw error;
-    return { invoiceId: push.invoiceId, version: push.version, outcome: 'ambiguous', error: { code: 'xero_outcome_unknown', message: 'Flow could not look in Xero to settle an earlier attempt. Send again later.' } };
+    return { invoiceId: push.invoiceId, version: push.version, outcome: 'ambiguous', error: { code: 'xero_outcome_unknown', short: SHORT.xero_outcome_unknown, message: 'Flow could not look in Xero to settle an earlier attempt. Send again later.' } };
   }
   if (candidates.length === 1) return verify(db, client, push, draft, document, candidates[0], 'reconciled');
   if (candidates.length > 1) {
-    return { invoiceId: push.invoiceId, version: push.version, outcome: 'ambiguous', error: { code: 'xero_outcome_unknown', message: `Xero holds ${candidates.length} drafts that match this invoice. Delete the extra ones in Xero, then send again.` } };
+    return { invoiceId: push.invoiceId, version: push.version, outcome: 'ambiguous', error: { code: 'xero_outcome_unknown', short: 'Extra Xero drafts', message: `Xero holds ${candidates.length} drafts that match this invoice. Delete the extra ones in Xero, then send again.` } };
   }
   const attempt = push.attempts + 1;
   const key = idempotencyKey(push.organisationId, push.invoiceId, push.version, attempt, push.bodyHash);

package/server/ui/app-page.js

@@ -51,7 +51,7 @@ const BODY = `<div class="fx-app">
   <div id="toasts" class="fx-toasts" aria-live="polite"></div>
 </div>`;
 
-export const APP_PATHS = ['/sign-in', '/jobs', '/invoices', '/invoices/:id', '/contacts', '/contacts/:id', '/reconcile', '/reconcile/:id', '/xero-import', '/people', '/integrations', '/integrations/:id', '/account', '/appearance', '/invoicing-settings', '/invoicing-settings/:id', '/automations', '/price-list', '/price-list/:id', '/custom-fields'];
+export const APP_PATHS = ['/sign-in', '/jobs', '/captures', '/invoices', '/invoices/:id', '/contacts', '/contacts/:id', '/reconcile', '/reconcile/:id', '/xero-import', '/people', '/integrations', '/integrations/:id', '/account', '/appearance', '/invoicing-settings', '/invoicing-settings/:id', '/automations', '/price-list', '/price-list/:id', '/custom-fields'];
 
 export function appPage({ defaultFamily }) {
   return renderPage({