toga-ai 1.0.204 → 1.0.206

package/knowledge/2.0/apps/_underscore/INDEX.md

@@ -11,5 +11,6 @@
 | [NetSuite REST Client (_Component_Api_Netsuite) — record writes & SuiteQL](features/netsuite-rest-client.md) | `_Component_Api_Netsuite` is the **2.0 `_underscore` NetSuite REST client** — the shared primitive every worker2/api2 NetSuite caller uses for record GETs, Suit | _underscore/Component/Api/Netsuite/Netsuite.php |
 | [Per-Client Database Connections & the Local Logs Trap](features/per-client-database-connections.md) | When `_underscore` serves a request for a client it opens **three distinct per-client database connections**, not one. | _underscore/Database.php, _underscore/ApiRequest.php, _underscore/Model/Client/Logs/Api.php |
 | [Recursive Item Fulfillments (upstream mirroring)](features/recursive-item-fulfillments.md) | In a multi-tier supply chain a sales order (SO) spawns a purchase order (PO) that becomes another SO downstream, and so on. | _underscore/Model/Client/ItemFulfillment.php, _underscore/Model/Client/ItemFulfillmentItem.php, _underscore/Model/Client/ItemFulfillmentItemUnit.php, _underscore/Model/Client/ItemFulfillmentPackage.php, _underscore/Model/Compass/AdvanceShippingNotice.php, dbchanges2/Core/2026-02-13 - 75601 - RecursiveItemFulfillmentCreation.sql, dbchanges2/Core/2026-06-04 - RecursiveItemFulfillmentPut.sql |
+| [Surface Resolver (_Model_Core_Surface::resolve — replaces Page::meta)](features/surface-resolver.md) | The runtime for the platform-wide **Surface** UI presentation layer: 9 `_underscore` models plus a cached resolver, `_Model_Core_Surface::resolve(&$api, string | _underscore/Model/Core/Surface.php, _underscore/Model/Core/SurfaceElement.php, _underscore/Model/Core/Action.php, _underscore/Model/Core/Vocabulary.php, _underscore/Model/Core/VocabularyTerm.php, _underscore/Model/Core/Message.php, _underscore/Model/Client/SurfaceOverride.php, _underscore/Model/Client/MessageTranslation.php, _underscore/Model/Client/ThemeToken.php, _underscore/Model/Core/Page.php |
 | [Tracking-Number Bridge Migration (ASN / Item Fulfillment / Item Receipt)](features/tracking-number-bridges.md) | Shipment tracking numbers used to live as **scalar FK columns** (`trackingNumberId`, `returnTrackingNumberId`) directly on the lowest-level "unit"/"item" tables | api2/Component/Api/V2/V2.php, _underscore/Model/Client/AdvanceShippingNoticeItemUnit.php, _underscore/Model/Client/AdvanceShippingNoticeItemUnits/TrackingNumber.php, _underscore/Model/Client/ItemFulfillmentItemUnits/TrackingNumber.php, _underscore/Model/Client/ItemFulfillment.php, _underscore/Model/Prudential/AdvanceShippingNotice.php, _underscore/Model/Compass/AdvanceShippingNotice.php, _underscore/Trait/Netsuite/ItemFulfillment.php, api2/Component/Api/Cxml/Cxml.php, dbchanges2/Client/2026-06-10 - TrackingNumberBridges.sql, dbchanges2/Core/2026-06-10 - TrackingNumberBridges.sql, dbchanges2/Client_Prudential/2026-06-15 - ItemFulfillmentTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Quad/2026-06-18a - ItemFulfillmentItemReceiptTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Nychh/2026-06-19b - ItemFulfillmentItemReceiptTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Nychh/2026-06-19a - FixItemFulfillmentTableViewTrackingAndRoot.sql, dbchanges2/Client_Quad/2026-06-19a - FixItemFulfillmentTableViewTrackingAndRoot.sql |
 | [Units for Items for Purchase Orders — Data Structure](features/units-for-items-for-purchase-orders.md) | Describes how unit (serialized inventory) data is linked to sales-order and purchase-order line items behind the `units-for-items-for-purchase-orders` TableView |  |

package/knowledge/2.0/apps/_underscore/architecture.md

@@ -6,7 +6,7 @@ project: _Underscore
 client: shared
 type: architecture
 status: active
-updated: 2026-06-11
+updated: 2026-06-25
 owners: ["jcardinal", "rgirish"]
 files:
   - _underscore/_underscore.php
@@ -32,6 +32,9 @@ Minimum PHP 8.1 (enforced in `_underscore.php`). The current architecture is
 `_Worker_*`). Always use parameterized queries / the `_Db` layer — never interpolate input into SQL.
 Beware the **lazy-transaction gotcha**: writes issued outside an explicitly committed transaction
 can be silently dropped — confirm commit semantics before relying on a write.
+The Surface presentation layer replaces `Page::meta()` but `meta()` must NOT be deleted until
+every page is cut over (per-surface, with a parity diff); config describes, PHP decides —
+business logic never moves into Surface config.
 
 ## Entry point & boot sequence
 
@@ -44,6 +47,41 @@ Every 2.0 project's `index.php` is just `<?php require '_underscore.php';`.
    (parses INI) → `_Time::initialize()` → **`_underscore::initialize()`** (project hook,
    required) → `_Session::initialize()` → `_Route::initialize()` (web only).
 
+## Surface — platform UI presentation/configuration layer
+
+A DB-driven UI presentation layer (2026-06-25, CTO-reviewed: AGREE-WITH-ADJUSTMENTS) that
+serves UI config (labels, theme tokens, visibility/enable, icons, tooltips, button bars,
+table quick-actions, status badges, modals) to React frontends so UI changes need no
+front-end deploy and are editable by a future admin app over plain CRUD. Platform-wide
+across all 2.0 apps — not client-specific. Replaces `_Model_Core_Page::meta()`.
+
+**Model:** `Surfaces` (a configurable UI region) + `SurfaceElements` (ordered items: ~15
+typed attribute columns + one JSON `config` long-tail) — typed columns, NOT EAV. Behavior
+via an `Actions` catalog (string key + JSON payload; FE registry maps key→handler). i18n via
+`Messages` + per-client `MessageTranslations` (ICU). Theming via semantic `ThemeTokens` (no
+raw CSS in config). `Vocabularies`/`VocabularyTerms` for value→token/label sets. The entire
+cascade lives in ONE sparse `SurfaceOverrides` table (precedence base < client < persona <
+role, language overlay) replacing the ~40-table EAV settings cascade.
+
+**Decisions:** typed-columns-not-EAV; `TableViews` kept as the table query/data engine and
+only REFERENCED (Surface type=TABLE → `tableViewSlug`); ACL kept as-is and COMPOSED
+(`aclActionId`), never absorbed; no versioning/draft/publish; server-side cached resolver
+(`_Model_Core_Surface::resolve`, parameterized, zero-write-on-read). Two-tier gating —
+Tier-1 trivial declarative rules (frozen `all/any/none + {field,op,value}` grammar) evaluated
+client-side; Tier-2 business logic computed in PHP returning booleans (lives in
+`_Model_<Client>_*` overrides + interceptors). Config/logic boundary: **config describes,
+PHP decides.** M2M-safe delivery via opt-in `surface=<slug>` request option → response
+`meta.surface`, never `data`. Generic FE machinery destined for `@agilant/toga-blox`.
+
+**Rejected alternatives:** a generic EAV settings cascade (the old `*Settings` tables —
+proven near-empty in prod); raw-CSS-in-config (the old "Dummy Fields" anti-pattern).
+
+**CTO-mandated guardrails (CI-enforced, not intentions):** rule grammar is a frozen
+allowlist that throws on unknown ops, with a CI test asserting the op-set; defensive
+resolver with logged fallbacks; debug-bundle endpoint ships WITH the resolver; `c_longValue`
+on overrides with strict per-attribute casting; per-surface meta() cutover with a parity
+diff (do NOT delete meta() until every page is migrated); `BLANK_CLIENT_DATABASE` as a CI gate.
+
 ## Naming convention & autoloader
 
 Class names map **directly** to file paths: replace each `_` with `/`; the last segment
@@ -285,3 +323,4 @@ multi-file UI components (`.php`/`.html`/`.css`/`.js`) invoked as `<_ComponentNa
 
 ## Change history
 - 2026-06-11 — Documented lazy transaction gotcha in `_Database::register()` (rgirish)
+- 2026-06-25 — Added the Surface platform UI presentation/configuration layer (DB-driven UI config replacing `Page::meta()`, CTO-reviewed AGREE-WITH-ADJUSTMENTS) (jcardinal)

package/knowledge/2.0/apps/_underscore/features/surface-resolver.md

@@ -0,0 +1,104 @@
+---
+title: Surface Resolver (_Model_Core_Surface::resolve — replaces Page::meta)
+framework: "2.0"
+repo: _underscore
+project: _Underscore
+client: shared
+type: feature
+status: active
+updated: 2026-06-25
+owners: [jcardinal]
+files:
+  - _underscore/Model/Core/Surface.php
+  - _underscore/Model/Core/SurfaceElement.php
+  - _underscore/Model/Core/Action.php
+  - _underscore/Model/Core/Vocabulary.php
+  - _underscore/Model/Core/VocabularyTerm.php
+  - _underscore/Model/Core/Message.php
+  - _underscore/Model/Client/SurfaceOverride.php
+  - _underscore/Model/Client/MessageTranslation.php
+  - _underscore/Model/Client/ThemeToken.php
+  - _underscore/Model/Core/Page.php
+related:
+  - ../../dbchanges2/features/surface-layer-schema.md
+  - ../../api2/features/surface-meta-option.md
+  - acl-permission-chain.md
+---
+
+## What it is
+
+The runtime for the platform-wide **Surface** UI presentation layer: 9 `_underscore` models plus a
+cached resolver, `_Model_Core_Surface::resolve(&$api, string $slug)`, that merges base config +
+cascade overrides + ACL + messages + theme tokens into one flat, serializable bundle. It is the
+**replacement for `_Model_Core_Page::meta()`** and is shipped as a scripted-API method behind
+`GET /v2/surfaces/{slug}/meta`. Platform/shared — not client-specific. Schema:
+[surface-layer-schema](../../dbchanges2/features/surface-layer-schema.md).
+
+## The 9 models
+
+Core: `_Model_Core_{Surface,SurfaceElement,Action,Vocabulary,VocabularyTerm,Message}`.
+Client: `_Model_Client_{SurfaceOverride,MessageTranslation,ThemeToken}`. Each `extends _Model_True`
+with `const DATABASE`/`TABLE`, typed public-prop fields, and array FKs declaring
+`FIELDOPT_FOREIGNKEY_MODEL` (cross-DB FKs are soft — no SQL constraint). Modeled on
+`RecordField.php`/`TableView.php`.
+
+## How `resolve()` works
+
+Inputs come from `$api` (the same accessor `_Model_Client_TableView::meta` uses):
+`clientIdentifier`, `personaIds`, `roleIds`, `languageId`; `$slug` is the query arg.
+
+1. Load `Surface` by slug via ORM `->load()` — **parameterized** (fixes the old `LIKE '$slug'`
+   injection).
+2. One query: all `SurfaceElements` for `surfaceId`, ordered by `sortOrder`.
+3. One query: matching `SurfaceOverrides`; apply **most-specific-last** in a single in-memory pass
+   (`ORDER BY (roleId IS NULL) DESC, (personaId IS NULL) DESC`; language filtered to active or NULL).
+   Precedence **base < client < persona < role**, language an orthogonal overlay.
+4. **ACL composition, not absorption** — batch-resolve permissions via
+   `_Model_Client_AclActionPermission`; drop elements whose `aclActionId` isn't permitted (ACL stays
+   exactly as-is, see [acl-permission-chain](acl-permission-chain.md)).
+5. Batch-load (one integer-`IN` query each): `Messages`+`MessageTranslations` (referenced keys only),
+   `Vocabularies`+`VocabularyTerms`, `Actions`, client `ThemeTokens`.
+6. `type=TABLE` → emit `{tableViewSlug}` only; the FE keeps calling the existing `TableView::meta`
+   table pipeline (referenced, never duplicated).
+7. Assemble the flat bundle. **Zero INSERTs.**
+
+A `debug()` inspector returns the resolved bundle plus the raw cascade layers (shipped with the
+resolver, not "later").
+
+## Caching & invalidation
+
+- Disk cache keyed `surface:meta:{app}:{slug}:{client}:{sortedPersonaIds}:{sortedRoleIds}:{lang}`.
+- **Bust on write, never TTL-only.** `postPost/postPut/postPatch/postDelete` interceptors on all 9
+  models do a broad client-scoped bust; a write to a **Core** table must bust all clients' bundles
+  (or fold a Core-version stamp into the key).
+- **Keep the bust OUTSIDE the DB transaction** (the lazy-transaction write-drop rule).
+
+## Config vs logic boundary (the hard rule)
+
+**Config describes; PHP decides.** Two-tier gating:
+- **Tier 1** — trivial declarative gates (`{all|any|none:[{field,op,value}]}`, nestable) shipped as
+  JSON on the element and evaluated **client-side** against the loaded record. Grammar is a **frozen
+  allowlist** — a new op is an escalation to Tier 2, not a config change.
+- **Tier 2** — business logic (multi-stage approvals, "reviewer assigned", anything touching
+  `Approvals`) is **computed in PHP** and returned as a resolved boolean. It lives in
+  `_Model_<Client>_*` overrides + `Client_ApiPayloadInterceptor` hooks — the Surface layer does
+  **not** absorb business logic.
+
+## Gotchas
+
+- **`_Model_Core_Page::meta()` (Model/Core/Page.php, ~1300 lines) is the engine being replaced** and
+  is dangerous to extend: it interpolates `LIKE '$slug'` (injection-prone), **runs INSERTs during a
+  read**, is N+1, hand-duplicates the 5-layer cascade 6× via UNION, and is uncached. The empirical
+  basis for the typed-over-EAV design: in `Client_Compass` the whole EAV settings cascade (`Settings`
+  16-key registry + ~40 `*Settings` tables) is almost all 0 rows, while typed `TableViews`/
+  `TableViewFields`/`SectionRecordFields` ARE populated. **Do not delete `meta()`** until every page
+  is migrated — cut over per-surface with a parity diff (old bundle vs new bundle).
+- **The resolver must be defensive** — config writes bypass code review/CI, so missing/invalid config
+  falls back to sane defaults and never crashes a page. Strict per-`attribute` casting with logged
+  fallback on bad `SurfaceOverrides` data.
+- **Cross-DB reads are batched** (DB_CORE vs DB_CLIENT) and FKs are soft — tolerate dangling refs.
+
+## Change history
+- 2026-06-25 — Built the 9 models + `resolve()`/`debug()` as the cached, parameterized,
+  zero-write-on-read replacement for `_Model_Core_Page::meta()`; cache-bust interceptors on all 9
+  models (outside the transaction). meta() retained until per-page cutover with parity diff. (jcardinal)

package/knowledge/2.0/apps/api2/INDEX.md

@@ -5,6 +5,7 @@
 | [API (api2 / TOGa API v2) Architecture](architecture.md) | `api2` is the backend powering the public **TOGa 2.0 API**. | api2/Controller/Index.php, api2/Component/Api/V2/V2.php, api2/Component/Api/Cxml/Cxml.php, api2/Component/Api/V2/Response/Response.php, api2/Config/ |
 | [Language Translation Layer (audience.language + sidecar tables)](features/language-translation-layer.md) | Serves the same TOGa data (Item title/description/longDescription, expanding later) in multiple languages without forking the schema or breaking English consume | api2/Component/Api/V2/V2.php, api2/Component/Api/V2/Response/Response.php, _underscore/Model/Core/Setting.php, _underscore/Model/Core/RecordField.php, _underscore/Model/Core/DefaultGlobalSetting.php, _underscore/Model/Client/ItemTranslation.php, dbchanges2/Client/2026-06-23a - ItemTranslations.sql, dbchanges2/Client/2026-06-23b - ItemTranslationsAcl.sql, dbchanges2/Core/2026-06-23a - RecordFieldsTranslationColumn.sql, dbchanges2/Core/2026-06-23b - ItemTranslationsRecord.sql |
 | [POST + JSON-body args for scripted APIs](features/scripted-api-post-body-args.md) | The V2 engine can run a Record Script (scripted API) for a **POST** request, and a scripted API can receive its arguments from the **JSON request body** instead | api2/Component/Api/V2/V2.php |
+| [Surface action-state via the surface=<slug> request option (M2M-safe)](features/surface-meta-option.md) | An opt-in V2 engine request option, `surface=<slug>`, that attaches per-record UI action state (`isVisible`/`isEnabled`) to a GET response **under `meta.surface | api2/Component/Api/V2/V2.php, _underscore/Model/Core/Surface.php |
 | [Tickets API (/v2/tickets)](features/tickets-api.md) | The generic ticket endpoint of the 2.0 REST API. | Component/Api/V2/V2.php |
 | [AWS CodePipeline Deployment via CodeConnections (GitHub → Elastic Beanstalk)](workflows/codepipeline-codeconnections-deploy.md) | 2.0 apps (`api2`, `_underscore`) are deployed through **AWS CodePipeline**. |  |
 | [New Environment Configuration & Provisioning (api2)](workflows/environment-configuration-and-provisioning.md) | What it takes for a 2.0 API environment (e.g. | api2/Config/<environment>.ini, api2/Controller/Index.php, dbchanges2/Core/2026-06-16a - DatabaseHosts for new QA QC stage demo environments.sql, _underscore/Route.php |

package/knowledge/2.0/apps/api2/features/surface-meta-option.md

@@ -0,0 +1,47 @@
+---
+title: Surface action-state via the surface=<slug> request option (M2M-safe)
+framework: "2.0"
+repo: api2
+project: API
+client: shared
+type: feature
+status: active
+updated: 2026-06-25
+owners: [jcardinal]
+files:
+  - api2/Component/Api/V2/V2.php
+  - _underscore/Model/Core/Surface.php
+related:
+  - ../../_underscore/features/surface-resolver.md
+---
+
+## What it is
+
+An opt-in V2 engine request option, `surface=<slug>`, that attaches per-record UI action state
+(`isVisible`/`isEnabled`) to a GET response **under `meta.surface`, never `data`**. It is the
+M2M-safe delivery mechanism for the platform-wide Surface layer (see
+[surface-resolver](../../_underscore/features/surface-resolver.md)): the same core data API serves
+both the UI and machine-to-machine integrations, so presentation state must never leak into the
+business data that integrations consume.
+
+## How it works
+
+When `surface=<slug>` is present on a GET, after loading the record(s) the engine calls
+`_Model_Core_Surface::resolveRecordState($api, $slug, $record)` and attaches per-record
+`{isVisible, isEnabled}` action state under `meta.surface` (single-record and list shapes; a list is
+resolved in one batched pass, per row in `meta`). When the option is **absent** (all M2M/integration
+traffic), behavior is **byte-for-byte unchanged** — pure data, zero extra work. The path is
+**defensive**: it catches `Throwable` and omits `meta.surface` on error rather than failing the call.
+
+## Key rules
+
+- **Presentation state lives in `meta.surface`, never `data`.** Integrations get pure business data.
+- **The business rule is enforced at the action endpoint** (the source of truth that also protects
+  M2M — e.g. an integration approving a `fulfilled` order is rejected by the same rule). The surface
+  option merely **previews** that rule for the UI; it is a read-only preview, not a second copy of
+  the logic.
+- **One call, no extra round-trip** — the state pass rides the existing data fetch.
+
+## Change history
+- 2026-06-25 — Added the `surface=<slug>` opt-in option to the V2 engine; attaches per-record action
+  state under `meta.surface` (M2M-safe, defensive, absent = unchanged). (jcardinal)

package/knowledge/2.0/apps/dbchanges2/INDEX.md

@@ -3,4 +3,5 @@
 | Doc | Summary | Files |
 |-----|---------|-------|
 | [Database Changes (dbchanges2) Repository Architecture](architecture.md) | `dbchanges2` is the **schema-migration / SQL change-set repository** for the entire 2.0 platform. | Core/, Client/, Client_<Tenant>/, Logs/, Logs_Client/, _modules/ |
+| [Surface Layer Schema (UI presentation/config tables)](features/surface-layer-schema.md) | The persistent schema for the platform-wide **Surface** UI presentation/configuration layer (see the `_underscore` [surface-resolver](../../_underscore/features | dbchanges2/Core/2026-06-25a - SurfaceCoreTables.sql, dbchanges2/Core/2026-06-25b - SurfaceRecordsAndFields.sql, dbchanges2/Core/2026-06-25c - SalesOrderLoginSurfaceSeed.sql, dbchanges2/Client/2026-06-25a - SurfaceClientTables.sql, dbchanges2/Client/2026-06-25b - SurfaceClientSeed.sql, dbchanges2/Client/2026-06-25c - SurfaceClientAcl.sql, dbchanges2/Client/2026-06-03- BLANK_CLIENT_DATABASE.sql |
 | [2.0 New-Client Onboarding (manual process)](workflows/client-onboarding.md) | How to manually stand up a new 2.0 client (tenant). | Client/, Client_<Tenant>/, Core/, Logs_Client/ |

package/knowledge/2.0/apps/dbchanges2/features/surface-layer-schema.md

@@ -0,0 +1,90 @@
+---
+title: Surface Layer Schema (UI presentation/config tables)
+framework: "2.0"
+repo: dbchanges2
+project: Database Changes
+client: shared
+type: feature
+status: active
+updated: 2026-06-25
+owners: [jcardinal]
+files:
+  - dbchanges2/Core/2026-06-25a - SurfaceCoreTables.sql
+  - dbchanges2/Core/2026-06-25b - SurfaceRecordsAndFields.sql
+  - dbchanges2/Core/2026-06-25c - SalesOrderLoginSurfaceSeed.sql
+  - dbchanges2/Client/2026-06-25a - SurfaceClientTables.sql
+  - dbchanges2/Client/2026-06-25b - SurfaceClientSeed.sql
+  - dbchanges2/Client/2026-06-25c - SurfaceClientAcl.sql
+  - dbchanges2/Client/2026-06-03- BLANK_CLIENT_DATABASE.sql
+related:
+  - ../../_underscore/features/surface-resolver.md
+---
+
+## What it is
+
+The persistent schema for the platform-wide **Surface** UI presentation/configuration layer
+(see the `_underscore` [surface-resolver](../../_underscore/features/surface-resolver.md) feature
+for the runtime). DB-driven UI config (labels, colors via tokens, visibility/enable, icons,
+tooltips, button bars, table quick-actions, status badges, modals) so UI changes need no
+front-end deploy and are editable by a future admin app over plain CRUD. **Platform/shared — not
+client-specific** (Compass is only the first seed/test tenant). It replaces the legacy
+`_Model_Core_Page::meta()` EAV settings cascade (the old ~40 `*Settings` tables — almost all empty
+in prod).
+
+## The 9 tables — Core (structural) vs Client (per-tenant deltas)
+
+Structural definitions live in **Core** (platform-shared, mirrors `Records`/`RecordFields`);
+per-tenant deltas live in **Client** (mirrors `TableViews`/ACL/`ItemTranslations`).
+
+| Table | DB | Purpose |
+|---|---|---|
+| `Surfaces` | Core | A configurable UI region (`type` ENUM TABLE/SECTION/BUTTON_BAR/ROW_ACTIONS/TAB_STRIP/FILTER_SET/MODAL/DRAWER) |
+| `SurfaceElements` | Core | Ordered items: ~15 typed attr columns + one JSON `config` long-tail + `visibilityRule`/`enabledRule` JSON |
+| `Actions` | Core | Behavior action catalog (FE registry keys + JSON payload) |
+| `Vocabularies` | Core | A value-set (status/stage/priority/type/channel) per record |
+| `VocabularyTerms` | Core | value → token/label/order |
+| `Messages` | Core | i18n key catalog + ICU default value |
+| `SurfaceOverrides` | Client | THE single sparse cascade table (+`c_longValue mediumtext`) replacing ~40 EAV tables |
+| `MessageTranslations` | Client | per-language overlay (sidecar pattern) + `c_longValue` |
+| `ThemeTokens` | Client | per-tenant semantic token → value (the only place a hex/icon name lives) |
+
+`SurfaceOverrides` carries the entire cascade in one sparse table: scope columns
+`personaId`/`roleId`/`languageId` (NULL = not scoped on that axis), an `attribute` ENUM, and
+`value varchar(255)` + `c_longValue mediumtext`. Precedence **base < client < persona < role**
+with language as an orthogonal overlay; the resolver applies it most-specific-last in one pass.
+
+## Migration files (typed columns, not EAV)
+
+CREATE order is FK-safe (`Messages → Actions → Vocabularies → VocabularyTerms → Surfaces →
+SurfaceElements`). Core migrations run first; Client after. The session built/seeded the
+**SalesOrders + login** vertical (not Tickets) as the review proof:
+
+- `Core/2026-06-25a - SurfaceCoreTables.sql` — the 6 Core tables.
+- `Core/2026-06-25b - SurfaceRecordsAndFields.sql` — `Core.Records`+`RecordFields` for all 9 tables (reserved id block **2300–2399**; `recordId` via `model=` subselect).
+- `Core/2026-06-25c - SalesOrderLoginSurfaceSeed.sql` — Core seed + the `RecordScripts` resolve row.
+- `Client/2026-06-25a - SurfaceClientTables.sql` — the 3 Client tables + `INSERT IGNORE Languages('en','English')`.
+- `Client/2026-06-25b - SurfaceClientSeed.sql` — `ThemeTokens` + `MessageTranslations(en)`.
+- `Client/2026-06-25c - SurfaceClientAcl.sql` — full ACL chain for the 3 CLIENT-aclDatabase records.
+
+## Gotchas
+
+- **Cross-DB FKs (Core↔Client) are SOFT** — the ORM declares `FIELDOPT_FOREIGNKEY_MODEL` but **no
+  SQL constraint** exists (e.g. `Surfaces.tableViewId`, `SurfaceOverrides.surfaceId`,
+  `MessageTranslations.messageId`). This keeps Core/Client migration ordering safe and lets the
+  resolver tolerate dangling refs. Never add a real cross-DB constraint.
+- **`BLANK_CLIENT_DATABASE.sql` MUST append** the 3 new Client tables + the `Languages` `en` seed,
+  or every newly provisioned client is born broken. This was appended and provisioning-tested.
+  Treat it as a CI gate (provision a throwaway client; assert the surface meta endpoint returns the
+  seed).
+- **`SurfaceOverrides.value` is a stringly-typed escape hatch** — a long `CONFIG`/label override
+  would silently truncate at varchar(255); that is why `c_longValue mediumtext` exists, and the
+  resolver MUST cast strictly per `attribute` (bool/int/string/json) with a logged fallback.
+- **Reserved id block 2300–2399** for the Surface `Records`/`RecordFields` rows (Core max was 331);
+  use `model=` subselects for `recordId`, never hardcoded ids.
+- **CLIENT-aclDatabase records** (`SurfaceOverrides`, `MessageTranslations`, `ThemeTokens`) need the
+  full 4-step ACL chain + field permissions in **each** client DB; resolve `roleId` by subselect.
+
+## Change history
+- 2026-06-25 — Initial schema for the Surface layer: 6 Core + 3 Client tables, `Records`/`RecordFields`
+  (ids 2300–2399), SalesOrders+login seed, ACL chain, and `BLANK_CLIENT_DATABASE` append. Typed
+  columns chosen over EAV (the old `*Settings` cascade was empirically near-empty in prod). (jcardinal)

package/knowledge/2.0/apps/toga25-supply/INDEX.md

@@ -8,3 +8,4 @@
 | [Column Visibility (URL-driven show/hide columns)](features/column-visibility.md) | A "Columns" header button that opens a modal listing every column from the table meta, lets the user show/hide columns, adjusts the table live, and persists the | toga25-supply/src/components/ColumnVisibilityModal/, toga25-supply/src/pages/SalesOrders/SalesOrders.tsx, toga25-supply/src/pages/SalesOrders/viewModel/useSalesOrdersPageViewModel.tsx, toga25-supply/src/pages/SalesOrders/hooks/useSalesOrdersTableData.tsx |
 | [Meta-Driven Page & Table Setup](features/meta-driven-table-data.md) | A page in this app is **meta-driven end to end**: the page view model fetches *page meta* (labels, sections, ACL) and *table meta* (the columns/fields + table s | toga25-supply/src/pages/SalesOrders/viewModel/useSalesOrdersPageViewModel.tsx, toga25-supply/src/pages/SalesOrders/hooks/useSalesOrdersTableState.ts, toga25-supply/src/hooks/useTablePageMeta.ts, toga-blox-npm/dist/hooks/useFetchPageMeta.d.ts, toga-blox-npm/dist/hooks/useFetchTablePageMeta.d.ts, toga-blox-npm/dist/hooks/useAssignTableFieldLabels.d.ts, toga-blox-npm/dist/components/Table/hooks/useTableData.d.ts |
 | [Record Modals & Nested Tables](features/record-modals-and-nested-tables.md) | The repo's family of modal + nested-table patterns layered over toga-blox `TableRecordModal` and `PrimaryTable*Layout`. | toga25-supply/src/layout/ItemRecordModalLayout/, toga25-supply/src/layout/SalesOrderRecordModalLayout/, toga25-supply/src/layout/SalesOrderItemsTableLayout/, toga25-supply/src/layout/ItemFulfillmentModal/, toga25-supply/src/layout/GenericNestedTables/, toga25-supply/src/hooks/useTableCellInteractions.ts |
+| [Surface Frontend (DB-driven UI consumption, src/surface/)](features/surface-frontend.md) | The frontend consumer of the platform-wide Surface layer — DB-driven UI config fetched from `GET /v2/surfaces/{slug}/meta` instead of statically-imported JSON f | toga25-supply/src/surface/useFetchSurfaceMeta.ts, toga25-supply/src/surface/evaluateSurfaceRule.ts, toga25-supply/src/surface/actionRegistry.ts, toga25-supply/src/surface/SurfaceActionBar.tsx, toga25-supply/src/surface/SurfaceSection.tsx, toga25-supply/src/surface/resolve.ts, toga25-supply/src/surface/types.ts, toga25-supply/src/surface/featureFlag.ts, toga25-supply/src/surface/index.ts, toga25-supply/src/pages/Login/LoginPage.tsx, toga25-supply/src/pages/SalesOrders/SalesOrders.tsx, toga25-supply/src/pages/SalesOrders/view/SalesOrderRecordModalLayout/view/sections/SalesOrderTopBar.tsx |

package/knowledge/2.0/apps/toga25-supply/features/surface-frontend.md

@@ -0,0 +1,71 @@
+---
+title: Surface Frontend (DB-driven UI consumption, src/surface/)
+framework: "2.0"
+repo: toga25-supply
+project: TOGa 2.5 Supply
+client: shared
+type: feature
+status: active
+updated: 2026-06-25
+owners: [jcardinal]
+files:
+  - toga25-supply/src/surface/useFetchSurfaceMeta.ts
+  - toga25-supply/src/surface/evaluateSurfaceRule.ts
+  - toga25-supply/src/surface/actionRegistry.ts
+  - toga25-supply/src/surface/SurfaceActionBar.tsx
+  - toga25-supply/src/surface/SurfaceSection.tsx
+  - toga25-supply/src/surface/resolve.ts
+  - toga25-supply/src/surface/types.ts
+  - toga25-supply/src/surface/featureFlag.ts
+  - toga25-supply/src/surface/index.ts
+  - toga25-supply/src/pages/Login/LoginPage.tsx
+  - toga25-supply/src/pages/SalesOrders/SalesOrders.tsx
+  - toga25-supply/src/pages/SalesOrders/view/SalesOrderRecordModalLayout/view/sections/SalesOrderTopBar.tsx
+related:
+  - ../../_underscore/features/surface-resolver.md
+  - meta-driven-table-data.md
+---
+
+## What it is
+
+The frontend consumer of the platform-wide Surface layer — DB-driven UI config fetched from
+`GET /v2/surfaces/{slug}/meta` instead of statically-imported JSON field bundles. Lives in
+`src/surface/` for now with a `TODO(blox)` to extract the generic machinery into `@agilant/toga-blox`
+so all 2.0 apps inherit it. Backend: [surface-resolver](../../_underscore/features/surface-resolver.md).
+
+## How it works
+
+- **`useFetchSurfaceMeta`** — the single fetch-once/React-Query-cached choke point for a surface's
+  meta. Loading a different *record* into the same surface reuses cached meta.
+- **`evaluateSurfaceRule`** — the Tier-1 rule evaluator: a **frozen `all/any/none` + `{field,op,value}`
+  grammar** that **throws on an unknown op** (generalized from the SalesOrders
+  `buildPatchedTenantFields`/`evaluateEnableRule`/`resolveFlag` helpers). Evaluated client-side against
+  the loaded record. A new op is an escalation to a backend Tier-2 capability method, never a grammar
+  change.
+- **`actionRegistry`** — string action key → existing app handler (the proven `MODAL_RENDERERS`
+  pattern). The DB ships keys + payloads; the app supplies the actual handlers.
+- **theme/message resolvers** (`resolve.ts`) — token → CSS and ICU message rendering.
+- **`SurfaceActionBar`/`SurfaceActions` + `SurfaceSection`** — generic renderers.
+
+## What's wired (review proof)
+
+Login + sales-orders list + the sales-order modal, all behind the **`SURFACE_ENABLED`** flag (env
+`VITE_SURFACE_ENABLED`, **default OFF**). The SalesOrder action bar reproduces
+`orderViewFields.json` approve/deny/approvalWorkflow/viewLog/editOrder by delegating to the existing
+`onActionClick`/`onOpenLog` handlers. The table stays on the existing TableView pipeline via
+`tableViewSlug` (see [meta-driven-table-data](meta-driven-table-data.md)) — the Surface layer
+references the TableView, never replaces it.
+
+## Gotchas
+
+- **Default OFF.** Nothing renders through the Surface path unless `VITE_SURFACE_ENABLED` is set —
+  the existing JSON-bundle path remains live until per-surface cutover.
+- **Tier-1 only on the client.** Business-logic gates (Tier-2) arrive as resolved booleans from the
+  backend (`meta.surface`); never re-encode business rules in the FE evaluator.
+- **`tsc` not yet run** this session (the private `@agilant/toga-blox` registry needs npm creds);
+  treat type-checking as pending. Runtime `GET /v2/surfaces/{slug}/meta` also not yet exercised.
+
+## Change history
+- 2026-06-25 — Built `src/surface/` (fetch hook, frozen Tier-1 rule evaluator, action registry, theme/
+  message resolvers, action-bar + section renderers); wired login + SalesOrders list + SO modal behind
+  the OFF-by-default `SURFACE_ENABLED` flag. Generic machinery destined for toga-blox. (jcardinal)

package/knowledge/INDEX.md

@@ -15,10 +15,10 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 
 ## 2.0 framework
 
-- **_underscore** (_Underscore) _(framework core)_ — 15 doc(s) → [2.0/apps/_underscore/INDEX.md](2.0/apps/_underscore/INDEX.md)
+- **_underscore** (_Underscore) _(framework core)_ — 16 doc(s) → [2.0/apps/_underscore/INDEX.md](2.0/apps/_underscore/INDEX.md)
 - **worker2** (Worker) — 15 doc(s) → [2.0/apps/worker2/INDEX.md](2.0/apps/worker2/INDEX.md)
-- **api2** (API) — 6 doc(s) → [2.0/apps/api2/INDEX.md](2.0/apps/api2/INDEX.md)
-- **dbchanges2** (Database Changes) _(framework core)_ — 2 doc(s) → [2.0/apps/dbchanges2/INDEX.md](2.0/apps/dbchanges2/INDEX.md)
+- **api2** (API) — 7 doc(s) → [2.0/apps/api2/INDEX.md](2.0/apps/api2/INDEX.md)
+- **dbchanges2** (Database Changes) _(framework core)_ — 3 doc(s) → [2.0/apps/dbchanges2/INDEX.md](2.0/apps/dbchanges2/INDEX.md)
 - **toga2-supply** (TOGa Supply) — 3 doc(s) → [2.0/apps/toga2-supply/INDEX.md](2.0/apps/toga2-supply/INDEX.md)
 - **saml** (SAML SSO Gateway) — 3 doc(s) → [2.0/apps/saml/INDEX.md](2.0/apps/saml/INDEX.md)
 - **toga2-view** (TOGa View Frontend) — 4 doc(s) → [2.0/apps/toga2-view/INDEX.md](2.0/apps/toga2-view/INDEX.md)

package/knowledge/clients/tow-foundation/features/receipt-processing.md

@@ -5,7 +5,7 @@ project: Worker
 client: tow-foundation
 type: client-feature
 status: active
-updated: 2026-06-23
+updated: 2026-06-25
 owners: ["rgirish"]
 files:
   - worker2/Worker/Client/TowFoundation.php
@@ -57,8 +57,11 @@ Credit Card Receipts/
 5. **Pass 1 — Extract** — for each receipt:
    - Enforce type + size limit: unsupported mime types (`application/octet-stream`) throw immediately; 4 MB cap for images, 10 MB for documents
    - Download file bytes from SharePoint
-   - POST to Talos AI `/api/ai/generate` → structured `{vendor_name, invoice_date, total, payment_memo, category, ...}`
+   - **`.docx` files bypass Talos** and route to `extractDocxData()` (Talos returns HTTP 500 on a `.docx` MIME type — it only accepts PDF/image). That method opens the docx as a ZIP, extracts `word/document.xml`, strips tags, and regex-parses `MM/DD/YY: description` lines into `line_items[]`
+   - All other types POST to Talos AI `/api/ai/generate` → structured `{vendor_name, invoice_date, total, payment_memo, category, ...}`
+   - **Year guard on AI dates** — if Talos returns an `invoice_date` whose year is more than 1 year from the current year (AI hallucination on two-digit year inputs, e.g. `5/13/76` → 1976, `5/28/28` → 2028), the year is clamped to the current year while month/day are preserved
    - Cross-verify amount ± $0.01 against parsed statement; if matched, override `payment_memo` with statement description
+   - **Zero-total fallback** — if the extracted/docx total is 0, `lookupStatementTotalByVendor()` derives the amount from the billing statement (see *Statement structure* below)
    - Build base filename (no suffix yet) and store in `$pendingRenames`
    - On extract failure → move to `Archive/exception/` immediately
 6. **Deduplication** — after Pass 1, receipts sharing identical `(personName, invoice_date, vendor_name, total)` are deduplicated; only the first is kept, the rest are logged as `DUPLICATE skipped` and dropped. This catches the same receipt uploaded twice to SharePoint.
@@ -66,6 +69,7 @@ Credit Card Receipts/
 8. **Pass 2 — Move** — for each pending rename:
    - If base name appears more than once, assign `_a`, `_b`, `_c`... suffix to **all** colliding files (including the first)
    - PATCH SharePoint to rename + move to `Archive/` (flat — no person subfolder)
+   - **Multi-entry docx expansion** — a `.docx` whose `extractDocxData()` produced multiple `line_items[]` (e.g. a subway-rides document with 14 dated trip entries) is expanded into one Excel row per entry
 8. **Excel generation** — one `.xlsx` per person (PhpSpreadsheet); columns: Row #, Account Name, QB Vendor, Payment Amount, Date, Payment Method, Payment Memo, QB Description, Class, Category, Payment Account, Ref No.
 9. **SharePoint upload** — each Excel uploaded to root-level `Credit Card Receipts/3. QB Excel/` via Graph API PUT (shared folder for all persons)
 10. **Summary email** — sent with Excel files attached; To: Jheanelle, CC: Magdalena, BCC: devteam@togatech.com
@@ -83,6 +87,28 @@ Amex billing cycle runs 3rd-to-3rd. `computeRefNo()` returns the cycle-end date
 - Charge on or before the 3rd → cycle ends on the 3rd of the same month
 - Charge after the 3rd → cycle ends on the 3rd of the next month
 
+### Billing statement structure (Amex xlsx)
+
+The Amex statement Emily submits is a **multi-sheet** xlsx — one sheet per weekly billing
+period (e.g. `"05.04.2026 - 05.11.2026"`, `"05.11.2026 - 05.18.2026"`, …). `loadStatementExcel()`
+must iterate **`getAllSheets()`** and accumulate rows from every sheet — using `getActiveSheet()`
+reads only sheet 0 and silently drops charges that live on later sheets.
+
+Each sheet's columns: `Date | Receipt | Notes | Description | Amount | Extended Details |
+Appears On Your Statement As | Address | City/State | Zip Code | Country | Reference | Category`.
+
+- The **`Receipt` column (col B)** is a human-readable label Emily fills in to group charges
+  (e.g. `"1"`, `"2"`, `"Subway Rides"`). All transit charges (`NYCT PAYGO`) get the label
+  `"Subway Rides"` across all sheets. `loadStatementExcel()` must detect and capture this column.
+- `lookupStatementTotalByVendor()` resolves a statement total for a vendor in two passes:
+  1. **Receipt-label sum (first)** — sum the `Amount` of **all** rows whose `Receipt` label
+     contains the vendor keyword. Transit is one `$3.00` row per ride (e.g. 14 rows tagged
+     `"Subway Rides"`), so the total is the **sum** ($42.00), not a single row.
+  2. **Description-keyword match (fallback)** — for non-transit vendors, match the keyword
+     against the `Description` column. (The description for subway is `"AplPay NYCT PAYGO
+     NEW YORK"`, which contains no `"subway"` — so the receipt-label pass is what makes
+     transit resolve at all.)
+
 ### QB vendor matching
 `TowFoundationVendors.php` holds 2,994 vendor names exported verbatim from Tow Foundation's
 QuickBooks vendor list (June 2026). `matchQbVendor()` runs three passes against this list:
@@ -180,8 +206,9 @@ Fatal errors send only to `NOTIFY_EMAIL_DEV` (no CC/BCC).
   exists at the root of `Credit Card Receipts/` alongside the person folders.
 
 - **Person folder name normalization** — SharePoint folders are named `"Brent Peterkin CC receipts"` but `CLASS_MAP` / `PAYMENT_ACCOUNT_MAP` keys are just `"Brent Peterkin"`. The ` CC receipts` suffix is stripped via regex in `walkReceiptsFolder()`. Without this, Class and Payment Account columns are blank for those persons.
+- **Archive paths must use the actual SharePoint folder name, not the normalized name** — the normalized person name (` CC receipts` stripped, spaces replaced) is for **map lookups only**. When building the SharePoint archive path, use the *actual* folder name (e.g. `"Emily Tow CC receipts"`), not the normalized `"Emily Tow"` — otherwise the PATCH move 404s because the path segment does not exist. Keep the normalized name and the real folder name as separate values.
 - **`billingCycle` filter is suffix-match, not exact** — always pass just the date portion (`"06-03-2026"`), not the full folder name. Passing the full name (`"Amex ending in 06-03-2026"`) also works but would miss Mastercard folders.
-- **Ole Mole not in QB vendor list** — as of June 2026 this vendor is not in Tow Foundation's QuickBooks, so `qb_vendor` will be blank for Ole Mole charges until they add it to QB and the vendor list is refreshed.
+- **Vendors not in QB vendor list** — as of June 2026 these vendors are not in Tow Foundation's QuickBooks, so `qb_vendor` is blank for their charges until the client adds them to QB and the vendor list is refreshed: **Ole Mole**, **AMORE PIZZA CAFE**, **Green & Tonic (New Canaan)**, **NCFP (National Center for Philanthropy)**, **Rippling**, **Langan's**. This is a client action, not a code fix.
 - **Duplicate detection is within-run only** — if the same receipt was processed in a prior run and archived, it won't be caught. The dedup only covers receipts present in the current run's `$pendingRenames`.
 - **Unmapped AI categories pass through** — if the AI returns a category string not in `TowFoundationCategories.php`, `mapCategory()` logs a warning and writes the raw AI string to the Excel. Check error logs after a run if the Category column looks odd; add the new value to the map file to fix it.
 - **Short vendor acronyms (< 4 chars) require whole-word match** — the substring pass uses a word-boundary regex for needles under 4 chars to avoid false positives (e.g. `"UPS"` inside `"USPS"`). If a short vendor name is not matching, check that the QB vendor list entry starts or ends with the acronym as a whole word.
@@ -189,6 +216,7 @@ Fatal errors send only to `NOTIFY_EMAIL_DEV` (no CC/BCC).
 
 ## Change history
 
+- 2026-06-25 — Statement parsing hardened for Emily Tow's May 2026 Amex xlsx: `loadStatementExcel()` now iterates `getAllSheets()` (4 weekly-period sheets) instead of `getActiveSheet()` and captures the `Receipt` column; `lookupStatementTotalByVendor()` now **sums** all receipt-label-matched rows (14 × $3.00 "Subway Rides" = $42.00) before falling back to description-keyword match — fixes subway totals reading $0/$9.00. Added `extractDocxData()` so `.docx` receipts bypass Talos (Talos 500s on docx), parsing `MM/DD/YY: description` line items into per-entry Excel rows. Added a year guard clamping AI-hallucinated `invoice_date` years (e.g. 1976, 2028) to the current year. Fixed archive-path bug: SharePoint move now uses the actual folder name (`"Emily Tow CC receipts"`) not the normalized name, fixing 404 on archive moves. 5 more vendors found missing from the QB vendor list (client action). (rgirish)
 - 2026-06-23 — `TowFoundationCategories.php` added: AI category values now mapped to exact QB account strings via `mapCategory()`; `"Transportation"` → `"6610 Travel expense"` etc. (19 mappings). QB vendor substring match minimum lowered from 4 to 3 chars with whole-word boundary guard for short needles — fixes `"CVS"` → `"CVS Pharmacy"`, `"MTA"` → `"MTA Metro card"`, prevents `"UPS"` → `"USPS"` false positive. (rgirish)
 - 2026-06-18 — QB vendor matching via local fuzzy match against `TowFoundationVendors.php` (2,994 vendors); AI category prompt updated to return specific types (Dining, Travel, etc.); duplicate receipt detection added (person+date+vendor+amount dedup); `billingCycle` filter parameter added (suffix-match — card-type agnostic); person folder ` CC receipts` suffix stripped so CLASS_MAP/PAYMENT_ACCOUNT_MAP resolve correctly (rgirish)
 - 2026-06-12 — QB Excel upload moved to root-level `3. QB Excel/`; Archive/exception folders flattened (no person subfolder); unsupported mime types (`application/octet-stream`) now throw ReceiptProcessingException instead of being silently skipped (rgirish)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.204",
+  "version": "1.0.206",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",