toga-ai 1.0.205 → 1.0.206

package/knowledge/2.0/apps/_underscore/INDEX.md

@@ -11,5 +11,6 @@
 | [NetSuite REST Client (_Component_Api_Netsuite) — record writes & SuiteQL](features/netsuite-rest-client.md) | `_Component_Api_Netsuite` is the **2.0 `_underscore` NetSuite REST client** — the shared primitive every worker2/api2 NetSuite caller uses for record GETs, Suit | _underscore/Component/Api/Netsuite/Netsuite.php |
 | [Per-Client Database Connections & the Local Logs Trap](features/per-client-database-connections.md) | When `_underscore` serves a request for a client it opens **three distinct per-client database connections**, not one. | _underscore/Database.php, _underscore/ApiRequest.php, _underscore/Model/Client/Logs/Api.php |
 | [Recursive Item Fulfillments (upstream mirroring)](features/recursive-item-fulfillments.md) | In a multi-tier supply chain a sales order (SO) spawns a purchase order (PO) that becomes another SO downstream, and so on. | _underscore/Model/Client/ItemFulfillment.php, _underscore/Model/Client/ItemFulfillmentItem.php, _underscore/Model/Client/ItemFulfillmentItemUnit.php, _underscore/Model/Client/ItemFulfillmentPackage.php, _underscore/Model/Compass/AdvanceShippingNotice.php, dbchanges2/Core/2026-02-13 - 75601 - RecursiveItemFulfillmentCreation.sql, dbchanges2/Core/2026-06-04 - RecursiveItemFulfillmentPut.sql |
+| [Surface Resolver (_Model_Core_Surface::resolve — replaces Page::meta)](features/surface-resolver.md) | The runtime for the platform-wide **Surface** UI presentation layer: 9 `_underscore` models plus a cached resolver, `_Model_Core_Surface::resolve(&$api, string | _underscore/Model/Core/Surface.php, _underscore/Model/Core/SurfaceElement.php, _underscore/Model/Core/Action.php, _underscore/Model/Core/Vocabulary.php, _underscore/Model/Core/VocabularyTerm.php, _underscore/Model/Core/Message.php, _underscore/Model/Client/SurfaceOverride.php, _underscore/Model/Client/MessageTranslation.php, _underscore/Model/Client/ThemeToken.php, _underscore/Model/Core/Page.php |
 | [Tracking-Number Bridge Migration (ASN / Item Fulfillment / Item Receipt)](features/tracking-number-bridges.md) | Shipment tracking numbers used to live as **scalar FK columns** (`trackingNumberId`, `returnTrackingNumberId`) directly on the lowest-level "unit"/"item" tables | api2/Component/Api/V2/V2.php, _underscore/Model/Client/AdvanceShippingNoticeItemUnit.php, _underscore/Model/Client/AdvanceShippingNoticeItemUnits/TrackingNumber.php, _underscore/Model/Client/ItemFulfillmentItemUnits/TrackingNumber.php, _underscore/Model/Client/ItemFulfillment.php, _underscore/Model/Prudential/AdvanceShippingNotice.php, _underscore/Model/Compass/AdvanceShippingNotice.php, _underscore/Trait/Netsuite/ItemFulfillment.php, api2/Component/Api/Cxml/Cxml.php, dbchanges2/Client/2026-06-10 - TrackingNumberBridges.sql, dbchanges2/Core/2026-06-10 - TrackingNumberBridges.sql, dbchanges2/Client_Prudential/2026-06-15 - ItemFulfillmentTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Quad/2026-06-18a - ItemFulfillmentItemReceiptTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Nychh/2026-06-19b - ItemFulfillmentItemReceiptTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Nychh/2026-06-19a - FixItemFulfillmentTableViewTrackingAndRoot.sql, dbchanges2/Client_Quad/2026-06-19a - FixItemFulfillmentTableViewTrackingAndRoot.sql |
 | [Units for Items for Purchase Orders — Data Structure](features/units-for-items-for-purchase-orders.md) | Describes how unit (serialized inventory) data is linked to sales-order and purchase-order line items behind the `units-for-items-for-purchase-orders` TableView |  |

package/knowledge/2.0/apps/_underscore/architecture.md

@@ -6,7 +6,7 @@ project: _Underscore
 client: shared
 type: architecture
 status: active
-updated: 2026-06-11
+updated: 2026-06-25
 owners: ["jcardinal", "rgirish"]
 files:
   - _underscore/_underscore.php
@@ -32,6 +32,9 @@ Minimum PHP 8.1 (enforced in `_underscore.php`). The current architecture is
 `_Worker_*`). Always use parameterized queries / the `_Db` layer — never interpolate input into SQL.
 Beware the **lazy-transaction gotcha**: writes issued outside an explicitly committed transaction
 can be silently dropped — confirm commit semantics before relying on a write.
+The Surface presentation layer replaces `Page::meta()` but `meta()` must NOT be deleted until
+every page is cut over (per-surface, with a parity diff); config describes, PHP decides —
+business logic never moves into Surface config.
 
 ## Entry point & boot sequence
 
@@ -44,6 +47,41 @@ Every 2.0 project's `index.php` is just `<?php require '_underscore.php';`.
    (parses INI) → `_Time::initialize()` → **`_underscore::initialize()`** (project hook,
    required) → `_Session::initialize()` → `_Route::initialize()` (web only).
 
+## Surface — platform UI presentation/configuration layer
+
+A DB-driven UI presentation layer (2026-06-25, CTO-reviewed: AGREE-WITH-ADJUSTMENTS) that
+serves UI config (labels, theme tokens, visibility/enable, icons, tooltips, button bars,
+table quick-actions, status badges, modals) to React frontends so UI changes need no
+front-end deploy and are editable by a future admin app over plain CRUD. Platform-wide
+across all 2.0 apps — not client-specific. Replaces `_Model_Core_Page::meta()`.
+
+**Model:** `Surfaces` (a configurable UI region) + `SurfaceElements` (ordered items: ~15
+typed attribute columns + one JSON `config` long-tail) — typed columns, NOT EAV. Behavior
+via an `Actions` catalog (string key + JSON payload; FE registry maps key→handler). i18n via
+`Messages` + per-client `MessageTranslations` (ICU). Theming via semantic `ThemeTokens` (no
+raw CSS in config). `Vocabularies`/`VocabularyTerms` for value→token/label sets. The entire
+cascade lives in ONE sparse `SurfaceOverrides` table (precedence base < client < persona <
+role, language overlay) replacing the ~40-table EAV settings cascade.
+
+**Decisions:** typed-columns-not-EAV; `TableViews` kept as the table query/data engine and
+only REFERENCED (Surface type=TABLE → `tableViewSlug`); ACL kept as-is and COMPOSED
+(`aclActionId`), never absorbed; no versioning/draft/publish; server-side cached resolver
+(`_Model_Core_Surface::resolve`, parameterized, zero-write-on-read). Two-tier gating —
+Tier-1 trivial declarative rules (frozen `all/any/none + {field,op,value}` grammar) evaluated
+client-side; Tier-2 business logic computed in PHP returning booleans (lives in
+`_Model_<Client>_*` overrides + interceptors). Config/logic boundary: **config describes,
+PHP decides.** M2M-safe delivery via opt-in `surface=<slug>` request option → response
+`meta.surface`, never `data`. Generic FE machinery destined for `@agilant/toga-blox`.
+
+**Rejected alternatives:** a generic EAV settings cascade (the old `*Settings` tables —
+proven near-empty in prod); raw-CSS-in-config (the old "Dummy Fields" anti-pattern).
+
+**CTO-mandated guardrails (CI-enforced, not intentions):** rule grammar is a frozen
+allowlist that throws on unknown ops, with a CI test asserting the op-set; defensive
+resolver with logged fallbacks; debug-bundle endpoint ships WITH the resolver; `c_longValue`
+on overrides with strict per-attribute casting; per-surface meta() cutover with a parity
+diff (do NOT delete meta() until every page is migrated); `BLANK_CLIENT_DATABASE` as a CI gate.
+
 ## Naming convention & autoloader
 
 Class names map **directly** to file paths: replace each `_` with `/`; the last segment
@@ -285,3 +323,4 @@ multi-file UI components (`.php`/`.html`/`.css`/`.js`) invoked as `<_ComponentNa
 
 ## Change history
 - 2026-06-11 — Documented lazy transaction gotcha in `_Database::register()` (rgirish)
+- 2026-06-25 — Added the Surface platform UI presentation/configuration layer (DB-driven UI config replacing `Page::meta()`, CTO-reviewed AGREE-WITH-ADJUSTMENTS) (jcardinal)

package/knowledge/2.0/apps/_underscore/features/surface-resolver.md

@@ -0,0 +1,104 @@
+---
+title: Surface Resolver (_Model_Core_Surface::resolve — replaces Page::meta)
+framework: "2.0"
+repo: _underscore
+project: _Underscore
+client: shared
+type: feature
+status: active
+updated: 2026-06-25
+owners: [jcardinal]
+files:
+  - _underscore/Model/Core/Surface.php
+  - _underscore/Model/Core/SurfaceElement.php
+  - _underscore/Model/Core/Action.php
+  - _underscore/Model/Core/Vocabulary.php
+  - _underscore/Model/Core/VocabularyTerm.php
+  - _underscore/Model/Core/Message.php
+  - _underscore/Model/Client/SurfaceOverride.php
+  - _underscore/Model/Client/MessageTranslation.php
+  - _underscore/Model/Client/ThemeToken.php
+  - _underscore/Model/Core/Page.php
+related:
+  - ../../dbchanges2/features/surface-layer-schema.md
+  - ../../api2/features/surface-meta-option.md
+  - acl-permission-chain.md
+---
+
+## What it is
+
+The runtime for the platform-wide **Surface** UI presentation layer: 9 `_underscore` models plus a
+cached resolver, `_Model_Core_Surface::resolve(&$api, string $slug)`, that merges base config +
+cascade overrides + ACL + messages + theme tokens into one flat, serializable bundle. It is the
+**replacement for `_Model_Core_Page::meta()`** and is shipped as a scripted-API method behind
+`GET /v2/surfaces/{slug}/meta`. Platform/shared — not client-specific. Schema:
+[surface-layer-schema](../../dbchanges2/features/surface-layer-schema.md).
+
+## The 9 models
+
+Core: `_Model_Core_{Surface,SurfaceElement,Action,Vocabulary,VocabularyTerm,Message}`.
+Client: `_Model_Client_{SurfaceOverride,MessageTranslation,ThemeToken}`. Each `extends _Model_True`
+with `const DATABASE`/`TABLE`, typed public-prop fields, and array FKs declaring
+`FIELDOPT_FOREIGNKEY_MODEL` (cross-DB FKs are soft — no SQL constraint). Modeled on
+`RecordField.php`/`TableView.php`.
+
+## How `resolve()` works
+
+Inputs come from `$api` (the same accessor `_Model_Client_TableView::meta` uses):
+`clientIdentifier`, `personaIds`, `roleIds`, `languageId`; `$slug` is the query arg.
+
+1. Load `Surface` by slug via ORM `->load()` — **parameterized** (fixes the old `LIKE '$slug'`
+   injection).
+2. One query: all `SurfaceElements` for `surfaceId`, ordered by `sortOrder`.
+3. One query: matching `SurfaceOverrides`; apply **most-specific-last** in a single in-memory pass
+   (`ORDER BY (roleId IS NULL) DESC, (personaId IS NULL) DESC`; language filtered to active or NULL).
+   Precedence **base < client < persona < role**, language an orthogonal overlay.
+4. **ACL composition, not absorption** — batch-resolve permissions via
+   `_Model_Client_AclActionPermission`; drop elements whose `aclActionId` isn't permitted (ACL stays
+   exactly as-is, see [acl-permission-chain](acl-permission-chain.md)).
+5. Batch-load (one integer-`IN` query each): `Messages`+`MessageTranslations` (referenced keys only),
+   `Vocabularies`+`VocabularyTerms`, `Actions`, client `ThemeTokens`.
+6. `type=TABLE` → emit `{tableViewSlug}` only; the FE keeps calling the existing `TableView::meta`
+   table pipeline (referenced, never duplicated).
+7. Assemble the flat bundle. **Zero INSERTs.**
+
+A `debug()` inspector returns the resolved bundle plus the raw cascade layers (shipped with the
+resolver, not "later").
+
+## Caching & invalidation
+
+- Disk cache keyed `surface:meta:{app}:{slug}:{client}:{sortedPersonaIds}:{sortedRoleIds}:{lang}`.
+- **Bust on write, never TTL-only.** `postPost/postPut/postPatch/postDelete` interceptors on all 9
+  models do a broad client-scoped bust; a write to a **Core** table must bust all clients' bundles
+  (or fold a Core-version stamp into the key).
+- **Keep the bust OUTSIDE the DB transaction** (the lazy-transaction write-drop rule).
+
+## Config vs logic boundary (the hard rule)
+
+**Config describes; PHP decides.** Two-tier gating:
+- **Tier 1** — trivial declarative gates (`{all|any|none:[{field,op,value}]}`, nestable) shipped as
+  JSON on the element and evaluated **client-side** against the loaded record. Grammar is a **frozen
+  allowlist** — a new op is an escalation to Tier 2, not a config change.
+- **Tier 2** — business logic (multi-stage approvals, "reviewer assigned", anything touching
+  `Approvals`) is **computed in PHP** and returned as a resolved boolean. It lives in
+  `_Model_<Client>_*` overrides + `Client_ApiPayloadInterceptor` hooks — the Surface layer does
+  **not** absorb business logic.
+
+## Gotchas
+
+- **`_Model_Core_Page::meta()` (Model/Core/Page.php, ~1300 lines) is the engine being replaced** and
+  is dangerous to extend: it interpolates `LIKE '$slug'` (injection-prone), **runs INSERTs during a
+  read**, is N+1, hand-duplicates the 5-layer cascade 6× via UNION, and is uncached. The empirical
+  basis for the typed-over-EAV design: in `Client_Compass` the whole EAV settings cascade (`Settings`
+  16-key registry + ~40 `*Settings` tables) is almost all 0 rows, while typed `TableViews`/
+  `TableViewFields`/`SectionRecordFields` ARE populated. **Do not delete `meta()`** until every page
+  is migrated — cut over per-surface with a parity diff (old bundle vs new bundle).
+- **The resolver must be defensive** — config writes bypass code review/CI, so missing/invalid config
+  falls back to sane defaults and never crashes a page. Strict per-`attribute` casting with logged
+  fallback on bad `SurfaceOverrides` data.
+- **Cross-DB reads are batched** (DB_CORE vs DB_CLIENT) and FKs are soft — tolerate dangling refs.
+
+## Change history
+- 2026-06-25 — Built the 9 models + `resolve()`/`debug()` as the cached, parameterized,
+  zero-write-on-read replacement for `_Model_Core_Page::meta()`; cache-bust interceptors on all 9
+  models (outside the transaction). meta() retained until per-page cutover with parity diff. (jcardinal)

package/knowledge/2.0/apps/api2/INDEX.md

@@ -5,6 +5,7 @@
 | [API (api2 / TOGa API v2) Architecture](architecture.md) | `api2` is the backend powering the public **TOGa 2.0 API**. | api2/Controller/Index.php, api2/Component/Api/V2/V2.php, api2/Component/Api/Cxml/Cxml.php, api2/Component/Api/V2/Response/Response.php, api2/Config/ |
 | [Language Translation Layer (audience.language + sidecar tables)](features/language-translation-layer.md) | Serves the same TOGa data (Item title/description/longDescription, expanding later) in multiple languages without forking the schema or breaking English consume | api2/Component/Api/V2/V2.php, api2/Component/Api/V2/Response/Response.php, _underscore/Model/Core/Setting.php, _underscore/Model/Core/RecordField.php, _underscore/Model/Core/DefaultGlobalSetting.php, _underscore/Model/Client/ItemTranslation.php, dbchanges2/Client/2026-06-23a - ItemTranslations.sql, dbchanges2/Client/2026-06-23b - ItemTranslationsAcl.sql, dbchanges2/Core/2026-06-23a - RecordFieldsTranslationColumn.sql, dbchanges2/Core/2026-06-23b - ItemTranslationsRecord.sql |
 | [POST + JSON-body args for scripted APIs](features/scripted-api-post-body-args.md) | The V2 engine can run a Record Script (scripted API) for a **POST** request, and a scripted API can receive its arguments from the **JSON request body** instead | api2/Component/Api/V2/V2.php |
+| [Surface action-state via the surface=<slug> request option (M2M-safe)](features/surface-meta-option.md) | An opt-in V2 engine request option, `surface=<slug>`, that attaches per-record UI action state (`isVisible`/`isEnabled`) to a GET response **under `meta.surface | api2/Component/Api/V2/V2.php, _underscore/Model/Core/Surface.php |
 | [Tickets API (/v2/tickets)](features/tickets-api.md) | The generic ticket endpoint of the 2.0 REST API. | Component/Api/V2/V2.php |
 | [AWS CodePipeline Deployment via CodeConnections (GitHub → Elastic Beanstalk)](workflows/codepipeline-codeconnections-deploy.md) | 2.0 apps (`api2`, `_underscore`) are deployed through **AWS CodePipeline**. |  |
 | [New Environment Configuration & Provisioning (api2)](workflows/environment-configuration-and-provisioning.md) | What it takes for a 2.0 API environment (e.g. | api2/Config/<environment>.ini, api2/Controller/Index.php, dbchanges2/Core/2026-06-16a - DatabaseHosts for new QA QC stage demo environments.sql, _underscore/Route.php |

package/knowledge/2.0/apps/api2/features/surface-meta-option.md

@@ -0,0 +1,47 @@
+---
+title: Surface action-state via the surface=<slug> request option (M2M-safe)
+framework: "2.0"
+repo: api2
+project: API
+client: shared
+type: feature
+status: active
+updated: 2026-06-25
+owners: [jcardinal]
+files:
+  - api2/Component/Api/V2/V2.php
+  - _underscore/Model/Core/Surface.php
+related:
+  - ../../_underscore/features/surface-resolver.md
+---
+
+## What it is
+
+An opt-in V2 engine request option, `surface=<slug>`, that attaches per-record UI action state
+(`isVisible`/`isEnabled`) to a GET response **under `meta.surface`, never `data`**. It is the
+M2M-safe delivery mechanism for the platform-wide Surface layer (see
+[surface-resolver](../../_underscore/features/surface-resolver.md)): the same core data API serves
+both the UI and machine-to-machine integrations, so presentation state must never leak into the
+business data that integrations consume.
+
+## How it works
+
+When `surface=<slug>` is present on a GET, after loading the record(s) the engine calls
+`_Model_Core_Surface::resolveRecordState($api, $slug, $record)` and attaches per-record
+`{isVisible, isEnabled}` action state under `meta.surface` (single-record and list shapes; a list is
+resolved in one batched pass, per row in `meta`). When the option is **absent** (all M2M/integration
+traffic), behavior is **byte-for-byte unchanged** — pure data, zero extra work. The path is
+**defensive**: it catches `Throwable` and omits `meta.surface` on error rather than failing the call.
+
+## Key rules
+
+- **Presentation state lives in `meta.surface`, never `data`.** Integrations get pure business data.
+- **The business rule is enforced at the action endpoint** (the source of truth that also protects
+  M2M — e.g. an integration approving a `fulfilled` order is rejected by the same rule). The surface
+  option merely **previews** that rule for the UI; it is a read-only preview, not a second copy of
+  the logic.
+- **One call, no extra round-trip** — the state pass rides the existing data fetch.
+
+## Change history
+- 2026-06-25 — Added the `surface=<slug>` opt-in option to the V2 engine; attaches per-record action
+  state under `meta.surface` (M2M-safe, defensive, absent = unchanged). (jcardinal)

package/knowledge/2.0/apps/dbchanges2/INDEX.md

@@ -3,4 +3,5 @@
 | Doc | Summary | Files |
 |-----|---------|-------|
 | [Database Changes (dbchanges2) Repository Architecture](architecture.md) | `dbchanges2` is the **schema-migration / SQL change-set repository** for the entire 2.0 platform. | Core/, Client/, Client_<Tenant>/, Logs/, Logs_Client/, _modules/ |
+| [Surface Layer Schema (UI presentation/config tables)](features/surface-layer-schema.md) | The persistent schema for the platform-wide **Surface** UI presentation/configuration layer (see the `_underscore` [surface-resolver](../../_underscore/features | dbchanges2/Core/2026-06-25a - SurfaceCoreTables.sql, dbchanges2/Core/2026-06-25b - SurfaceRecordsAndFields.sql, dbchanges2/Core/2026-06-25c - SalesOrderLoginSurfaceSeed.sql, dbchanges2/Client/2026-06-25a - SurfaceClientTables.sql, dbchanges2/Client/2026-06-25b - SurfaceClientSeed.sql, dbchanges2/Client/2026-06-25c - SurfaceClientAcl.sql, dbchanges2/Client/2026-06-03- BLANK_CLIENT_DATABASE.sql |
 | [2.0 New-Client Onboarding (manual process)](workflows/client-onboarding.md) | How to manually stand up a new 2.0 client (tenant). | Client/, Client_<Tenant>/, Core/, Logs_Client/ |

package/knowledge/2.0/apps/dbchanges2/features/surface-layer-schema.md

@@ -0,0 +1,90 @@
+---
+title: Surface Layer Schema (UI presentation/config tables)
+framework: "2.0"
+repo: dbchanges2
+project: Database Changes
+client: shared
+type: feature
+status: active
+updated: 2026-06-25
+owners: [jcardinal]
+files:
+  - dbchanges2/Core/2026-06-25a - SurfaceCoreTables.sql
+  - dbchanges2/Core/2026-06-25b - SurfaceRecordsAndFields.sql
+  - dbchanges2/Core/2026-06-25c - SalesOrderLoginSurfaceSeed.sql
+  - dbchanges2/Client/2026-06-25a - SurfaceClientTables.sql
+  - dbchanges2/Client/2026-06-25b - SurfaceClientSeed.sql
+  - dbchanges2/Client/2026-06-25c - SurfaceClientAcl.sql
+  - dbchanges2/Client/2026-06-03- BLANK_CLIENT_DATABASE.sql
+related:
+  - ../../_underscore/features/surface-resolver.md
+---
+
+## What it is
+
+The persistent schema for the platform-wide **Surface** UI presentation/configuration layer
+(see the `_underscore` [surface-resolver](../../_underscore/features/surface-resolver.md) feature
+for the runtime). DB-driven UI config (labels, colors via tokens, visibility/enable, icons,
+tooltips, button bars, table quick-actions, status badges, modals) so UI changes need no
+front-end deploy and are editable by a future admin app over plain CRUD. **Platform/shared — not
+client-specific** (Compass is only the first seed/test tenant). It replaces the legacy
+`_Model_Core_Page::meta()` EAV settings cascade (the old ~40 `*Settings` tables — almost all empty
+in prod).
+
+## The 9 tables — Core (structural) vs Client (per-tenant deltas)
+
+Structural definitions live in **Core** (platform-shared, mirrors `Records`/`RecordFields`);
+per-tenant deltas live in **Client** (mirrors `TableViews`/ACL/`ItemTranslations`).
+
+| Table | DB | Purpose |
+|---|---|---|
+| `Surfaces` | Core | A configurable UI region (`type` ENUM TABLE/SECTION/BUTTON_BAR/ROW_ACTIONS/TAB_STRIP/FILTER_SET/MODAL/DRAWER) |
+| `SurfaceElements` | Core | Ordered items: ~15 typed attr columns + one JSON `config` long-tail + `visibilityRule`/`enabledRule` JSON |
+| `Actions` | Core | Behavior action catalog (FE registry keys + JSON payload) |
+| `Vocabularies` | Core | A value-set (status/stage/priority/type/channel) per record |
+| `VocabularyTerms` | Core | value → token/label/order |
+| `Messages` | Core | i18n key catalog + ICU default value |
+| `SurfaceOverrides` | Client | THE single sparse cascade table (+`c_longValue mediumtext`) replacing ~40 EAV tables |
+| `MessageTranslations` | Client | per-language overlay (sidecar pattern) + `c_longValue` |
+| `ThemeTokens` | Client | per-tenant semantic token → value (the only place a hex/icon name lives) |
+
+`SurfaceOverrides` carries the entire cascade in one sparse table: scope columns
+`personaId`/`roleId`/`languageId` (NULL = not scoped on that axis), an `attribute` ENUM, and
+`value varchar(255)` + `c_longValue mediumtext`. Precedence **base < client < persona < role**
+with language as an orthogonal overlay; the resolver applies it most-specific-last in one pass.
+
+## Migration files (typed columns, not EAV)
+
+CREATE order is FK-safe (`Messages → Actions → Vocabularies → VocabularyTerms → Surfaces →
+SurfaceElements`). Core migrations run first; Client after. The session built/seeded the
+**SalesOrders + login** vertical (not Tickets) as the review proof:
+
+- `Core/2026-06-25a - SurfaceCoreTables.sql` — the 6 Core tables.
+- `Core/2026-06-25b - SurfaceRecordsAndFields.sql` — `Core.Records`+`RecordFields` for all 9 tables (reserved id block **2300–2399**; `recordId` via `model=` subselect).
+- `Core/2026-06-25c - SalesOrderLoginSurfaceSeed.sql` — Core seed + the `RecordScripts` resolve row.
+- `Client/2026-06-25a - SurfaceClientTables.sql` — the 3 Client tables + `INSERT IGNORE Languages('en','English')`.
+- `Client/2026-06-25b - SurfaceClientSeed.sql` — `ThemeTokens` + `MessageTranslations(en)`.
+- `Client/2026-06-25c - SurfaceClientAcl.sql` — full ACL chain for the 3 CLIENT-aclDatabase records.
+
+## Gotchas
+
+- **Cross-DB FKs (Core↔Client) are SOFT** — the ORM declares `FIELDOPT_FOREIGNKEY_MODEL` but **no
+  SQL constraint** exists (e.g. `Surfaces.tableViewId`, `SurfaceOverrides.surfaceId`,
+  `MessageTranslations.messageId`). This keeps Core/Client migration ordering safe and lets the
+  resolver tolerate dangling refs. Never add a real cross-DB constraint.
+- **`BLANK_CLIENT_DATABASE.sql` MUST append** the 3 new Client tables + the `Languages` `en` seed,
+  or every newly provisioned client is born broken. This was appended and provisioning-tested.
+  Treat it as a CI gate (provision a throwaway client; assert the surface meta endpoint returns the
+  seed).
+- **`SurfaceOverrides.value` is a stringly-typed escape hatch** — a long `CONFIG`/label override
+  would silently truncate at varchar(255); that is why `c_longValue mediumtext` exists, and the
+  resolver MUST cast strictly per `attribute` (bool/int/string/json) with a logged fallback.
+- **Reserved id block 2300–2399** for the Surface `Records`/`RecordFields` rows (Core max was 331);
+  use `model=` subselects for `recordId`, never hardcoded ids.
+- **CLIENT-aclDatabase records** (`SurfaceOverrides`, `MessageTranslations`, `ThemeTokens`) need the
+  full 4-step ACL chain + field permissions in **each** client DB; resolve `roleId` by subselect.
+
+## Change history
+- 2026-06-25 — Initial schema for the Surface layer: 6 Core + 3 Client tables, `Records`/`RecordFields`
+  (ids 2300–2399), SalesOrders+login seed, ACL chain, and `BLANK_CLIENT_DATABASE` append. Typed
+  columns chosen over EAV (the old `*Settings` cascade was empirically near-empty in prod). (jcardinal)

package/knowledge/2.0/apps/toga25-supply/INDEX.md

@@ -8,3 +8,4 @@
 | [Column Visibility (URL-driven show/hide columns)](features/column-visibility.md) | A "Columns" header button that opens a modal listing every column from the table meta, lets the user show/hide columns, adjusts the table live, and persists the | toga25-supply/src/components/ColumnVisibilityModal/, toga25-supply/src/pages/SalesOrders/SalesOrders.tsx, toga25-supply/src/pages/SalesOrders/viewModel/useSalesOrdersPageViewModel.tsx, toga25-supply/src/pages/SalesOrders/hooks/useSalesOrdersTableData.tsx |
 | [Meta-Driven Page & Table Setup](features/meta-driven-table-data.md) | A page in this app is **meta-driven end to end**: the page view model fetches *page meta* (labels, sections, ACL) and *table meta* (the columns/fields + table s | toga25-supply/src/pages/SalesOrders/viewModel/useSalesOrdersPageViewModel.tsx, toga25-supply/src/pages/SalesOrders/hooks/useSalesOrdersTableState.ts, toga25-supply/src/hooks/useTablePageMeta.ts, toga-blox-npm/dist/hooks/useFetchPageMeta.d.ts, toga-blox-npm/dist/hooks/useFetchTablePageMeta.d.ts, toga-blox-npm/dist/hooks/useAssignTableFieldLabels.d.ts, toga-blox-npm/dist/components/Table/hooks/useTableData.d.ts |
 | [Record Modals & Nested Tables](features/record-modals-and-nested-tables.md) | The repo's family of modal + nested-table patterns layered over toga-blox `TableRecordModal` and `PrimaryTable*Layout`. | toga25-supply/src/layout/ItemRecordModalLayout/, toga25-supply/src/layout/SalesOrderRecordModalLayout/, toga25-supply/src/layout/SalesOrderItemsTableLayout/, toga25-supply/src/layout/ItemFulfillmentModal/, toga25-supply/src/layout/GenericNestedTables/, toga25-supply/src/hooks/useTableCellInteractions.ts |
+| [Surface Frontend (DB-driven UI consumption, src/surface/)](features/surface-frontend.md) | The frontend consumer of the platform-wide Surface layer — DB-driven UI config fetched from `GET /v2/surfaces/{slug}/meta` instead of statically-imported JSON f | toga25-supply/src/surface/useFetchSurfaceMeta.ts, toga25-supply/src/surface/evaluateSurfaceRule.ts, toga25-supply/src/surface/actionRegistry.ts, toga25-supply/src/surface/SurfaceActionBar.tsx, toga25-supply/src/surface/SurfaceSection.tsx, toga25-supply/src/surface/resolve.ts, toga25-supply/src/surface/types.ts, toga25-supply/src/surface/featureFlag.ts, toga25-supply/src/surface/index.ts, toga25-supply/src/pages/Login/LoginPage.tsx, toga25-supply/src/pages/SalesOrders/SalesOrders.tsx, toga25-supply/src/pages/SalesOrders/view/SalesOrderRecordModalLayout/view/sections/SalesOrderTopBar.tsx |

package/knowledge/2.0/apps/toga25-supply/features/surface-frontend.md

@@ -0,0 +1,71 @@
+---
+title: Surface Frontend (DB-driven UI consumption, src/surface/)
+framework: "2.0"
+repo: toga25-supply
+project: TOGa 2.5 Supply
+client: shared
+type: feature
+status: active
+updated: 2026-06-25
+owners: [jcardinal]
+files:
+  - toga25-supply/src/surface/useFetchSurfaceMeta.ts
+  - toga25-supply/src/surface/evaluateSurfaceRule.ts
+  - toga25-supply/src/surface/actionRegistry.ts
+  - toga25-supply/src/surface/SurfaceActionBar.tsx
+  - toga25-supply/src/surface/SurfaceSection.tsx
+  - toga25-supply/src/surface/resolve.ts
+  - toga25-supply/src/surface/types.ts
+  - toga25-supply/src/surface/featureFlag.ts
+  - toga25-supply/src/surface/index.ts
+  - toga25-supply/src/pages/Login/LoginPage.tsx
+  - toga25-supply/src/pages/SalesOrders/SalesOrders.tsx
+  - toga25-supply/src/pages/SalesOrders/view/SalesOrderRecordModalLayout/view/sections/SalesOrderTopBar.tsx
+related:
+  - ../../_underscore/features/surface-resolver.md
+  - meta-driven-table-data.md
+---
+
+## What it is
+
+The frontend consumer of the platform-wide Surface layer — DB-driven UI config fetched from
+`GET /v2/surfaces/{slug}/meta` instead of statically-imported JSON field bundles. Lives in
+`src/surface/` for now with a `TODO(blox)` to extract the generic machinery into `@agilant/toga-blox`
+so all 2.0 apps inherit it. Backend: [surface-resolver](../../_underscore/features/surface-resolver.md).
+
+## How it works
+
+- **`useFetchSurfaceMeta`** — the single fetch-once/React-Query-cached choke point for a surface's
+  meta. Loading a different *record* into the same surface reuses cached meta.
+- **`evaluateSurfaceRule`** — the Tier-1 rule evaluator: a **frozen `all/any/none` + `{field,op,value}`
+  grammar** that **throws on an unknown op** (generalized from the SalesOrders
+  `buildPatchedTenantFields`/`evaluateEnableRule`/`resolveFlag` helpers). Evaluated client-side against
+  the loaded record. A new op is an escalation to a backend Tier-2 capability method, never a grammar
+  change.
+- **`actionRegistry`** — string action key → existing app handler (the proven `MODAL_RENDERERS`
+  pattern). The DB ships keys + payloads; the app supplies the actual handlers.
+- **theme/message resolvers** (`resolve.ts`) — token → CSS and ICU message rendering.
+- **`SurfaceActionBar`/`SurfaceActions` + `SurfaceSection`** — generic renderers.
+
+## What's wired (review proof)
+
+Login + sales-orders list + the sales-order modal, all behind the **`SURFACE_ENABLED`** flag (env
+`VITE_SURFACE_ENABLED`, **default OFF**). The SalesOrder action bar reproduces
+`orderViewFields.json` approve/deny/approvalWorkflow/viewLog/editOrder by delegating to the existing
+`onActionClick`/`onOpenLog` handlers. The table stays on the existing TableView pipeline via
+`tableViewSlug` (see [meta-driven-table-data](meta-driven-table-data.md)) — the Surface layer
+references the TableView, never replaces it.
+
+## Gotchas
+
+- **Default OFF.** Nothing renders through the Surface path unless `VITE_SURFACE_ENABLED` is set —
+  the existing JSON-bundle path remains live until per-surface cutover.
+- **Tier-1 only on the client.** Business-logic gates (Tier-2) arrive as resolved booleans from the
+  backend (`meta.surface`); never re-encode business rules in the FE evaluator.
+- **`tsc` not yet run** this session (the private `@agilant/toga-blox` registry needs npm creds);
+  treat type-checking as pending. Runtime `GET /v2/surfaces/{slug}/meta` also not yet exercised.
+
+## Change history
+- 2026-06-25 — Built `src/surface/` (fetch hook, frozen Tier-1 rule evaluator, action registry, theme/
+  message resolvers, action-bar + section renderers); wired login + SalesOrders list + SO modal behind
+  the OFF-by-default `SURFACE_ENABLED` flag. Generic machinery destined for toga-blox. (jcardinal)

package/knowledge/INDEX.md

@@ -15,10 +15,10 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 
 ## 2.0 framework
 
-- **_underscore** (_Underscore) _(framework core)_ — 15 doc(s) → [2.0/apps/_underscore/INDEX.md](2.0/apps/_underscore/INDEX.md)
+- **_underscore** (_Underscore) _(framework core)_ — 16 doc(s) → [2.0/apps/_underscore/INDEX.md](2.0/apps/_underscore/INDEX.md)
 - **worker2** (Worker) — 15 doc(s) → [2.0/apps/worker2/INDEX.md](2.0/apps/worker2/INDEX.md)
-- **api2** (API) — 6 doc(s) → [2.0/apps/api2/INDEX.md](2.0/apps/api2/INDEX.md)
-- **dbchanges2** (Database Changes) _(framework core)_ — 2 doc(s) → [2.0/apps/dbchanges2/INDEX.md](2.0/apps/dbchanges2/INDEX.md)
+- **api2** (API) — 7 doc(s) → [2.0/apps/api2/INDEX.md](2.0/apps/api2/INDEX.md)
+- **dbchanges2** (Database Changes) _(framework core)_ — 3 doc(s) → [2.0/apps/dbchanges2/INDEX.md](2.0/apps/dbchanges2/INDEX.md)
 - **toga2-supply** (TOGa Supply) — 3 doc(s) → [2.0/apps/toga2-supply/INDEX.md](2.0/apps/toga2-supply/INDEX.md)
 - **saml** (SAML SSO Gateway) — 3 doc(s) → [2.0/apps/saml/INDEX.md](2.0/apps/saml/INDEX.md)
 - **toga2-view** (TOGa View Frontend) — 4 doc(s) → [2.0/apps/toga2-view/INDEX.md](2.0/apps/toga2-view/INDEX.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.205",
+  "version": "1.0.206",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",