toga-ai 1.0.222 → 1.0.223

package/knowledge/2.0/apps/_underscore/INDEX.md

@@ -12,6 +12,6 @@
 | [NetSuite REST Client (_Component_Api_Netsuite) — record writes & SuiteQL](features/netsuite-rest-client.md) | `_Component_Api_Netsuite` is the **2.0 `_underscore` NetSuite REST client** — the shared primitive every worker2/api2 NetSuite caller uses for record GETs, Suit | _underscore/Component/Api/Netsuite/Netsuite.php |
 | [Per-Client Database Connections & the Local Logs Trap](features/per-client-database-connections.md) | When `_underscore` serves a request for a client it opens **three distinct per-client database connections**, not one. | _underscore/Database.php, _underscore/ApiRequest.php, _underscore/Model/Client/Logs/Api.php |
 | [Recursive Item Fulfillments (upstream mirroring)](features/recursive-item-fulfillments.md) | In a multi-tier supply chain a sales order (SO) spawns a purchase order (PO) that becomes another SO downstream, and so on. | _underscore/Model/Client/ItemFulfillment.php, _underscore/Model/Client/ItemFulfillmentItem.php, _underscore/Model/Client/ItemFulfillmentItemUnit.php, _underscore/Model/Client/ItemFulfillmentPackage.php, _underscore/Model/Compass/AdvanceShippingNotice.php, dbchanges2/Core/2026-02-13 - 75601 - RecursiveItemFulfillmentCreation.sql, dbchanges2/Core/2026-06-04 - RecursiveItemFulfillmentPut.sql |
-| [Surface Resolver (_Model_Core_Surface::resolve — replaces Page::meta)](features/surface-resolver.md) | The runtime for the platform-wide **Surface** UI presentation layer: 9 `_underscore` models plus a cached resolver, `_Model_Core_Surface::resolve(&$api, string | _underscore/Model/Core/Surface.php, _underscore/Model/Core/SurfaceElement.php, _underscore/Model/Core/Action.php, _underscore/Model/Core/Vocabulary.php, _underscore/Model/Core/VocabularyTerm.php, _underscore/Model/Core/Message.php, _underscore/Model/Client/SurfaceOverride.php, _underscore/Model/Client/MessageTranslation.php, _underscore/Model/Client/ThemeToken.php, _underscore/Model/Core/Page.php |
+| [Surface Resolver (_Model_Core_Surface::resolve — replaces Page::meta)](features/surface-resolver.md) | The runtime for the platform-wide **Surface** UI presentation layer: 9 `_underscore` models plus a cached resolver, `_Model_Core_Surface::resolve(&$api, string | _underscore/Model/Core/Surface.php, dbchanges2/Core/2026-06-29b - SurfaceMetaPublicReadAcl.sql, _underscore/Model/Core/SurfaceElement.php, _underscore/Model/Core/Action.php, _underscore/Model/Core/Vocabulary.php, _underscore/Model/Core/VocabularyTerm.php, _underscore/Model/Core/Message.php, _underscore/Model/Client/SurfaceOverride.php, _underscore/Model/Client/MessageTranslation.php, _underscore/Model/Client/ThemeToken.php, _underscore/Model/Core/Page.php |
 | [Tracking-Number Bridge Migration (ASN / Item Fulfillment / Item Receipt)](features/tracking-number-bridges.md) | Shipment tracking numbers used to live as **scalar FK columns** (`trackingNumberId`, `returnTrackingNumberId`) directly on the lowest-level "unit"/"item" tables | api2/Component/Api/V2/V2.php, _underscore/Model/Client/AdvanceShippingNoticeItemUnit.php, _underscore/Model/Client/AdvanceShippingNoticeItemUnits/TrackingNumber.php, _underscore/Model/Client/ItemFulfillmentItemUnits/TrackingNumber.php, _underscore/Model/Client/ItemFulfillment.php, _underscore/Model/Prudential/AdvanceShippingNotice.php, _underscore/Model/Compass/AdvanceShippingNotice.php, _underscore/Trait/Netsuite/ItemFulfillment.php, api2/Component/Api/Cxml/Cxml.php, dbchanges2/Client/2026-06-10 - TrackingNumberBridges.sql, dbchanges2/Core/2026-06-10 - TrackingNumberBridges.sql, dbchanges2/Client_Prudential/2026-06-15 - ItemFulfillmentTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Quad/2026-06-18a - ItemFulfillmentItemReceiptTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Nychh/2026-06-19b - ItemFulfillmentItemReceiptTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Nychh/2026-06-19a - FixItemFulfillmentTableViewTrackingAndRoot.sql, dbchanges2/Client_Quad/2026-06-19a - FixItemFulfillmentTableViewTrackingAndRoot.sql |
 | [Units for Items for Purchase Orders — Data Structure](features/units-for-items-for-purchase-orders.md) | Describes how unit (serialized inventory) data is linked to sales-order and purchase-order line items behind the `units-for-items-for-purchase-orders` TableView |  |

package/knowledge/2.0/apps/_underscore/architecture.md

@@ -6,7 +6,7 @@ project: _Underscore
 client: shared
 type: architecture
 status: active
-updated: 2026-06-25
+updated: 2026-06-29
 owners: ["jcardinal", "rgirish"]
 files:
   - _underscore/_underscore.php
@@ -71,7 +71,7 @@ Tier-1 trivial declarative rules (frozen `all/any/none + {field,op,value}` gramm
 client-side; Tier-2 business logic computed in PHP returning booleans (lives in
 `_Model_<Client>_*` overrides + interceptors). Config/logic boundary: **config describes,
 PHP decides.** M2M-safe delivery via opt-in `surface=<slug>` request option → response
-`meta.surface`, never `data`. Generic FE machinery destined for `@agilant/toga-blox`.
+`meta.surface`, never `data`. Generic FE machinery destined for `@agilant/toga-blox`. **Surface is the enforced presentation path — no feature flag.** The `SURFACE_ENABLED`/`VITE_SURFACE_ENABLED` flag and all legacy pre-Surface fallback branches were removed; legacy per-screen FIELDS config is deleted as each screen migrates (no dual-path fallback). The meta endpoint is query-string form: `GET /v2/surfaces/meta?slug=<slug>`.
 
 **Rejected alternatives:** a generic EAV settings cascade (the old `*Settings` tables —
 proven near-empty in prod); raw-CSS-in-config (the old "Dummy Fields" anti-pattern).
@@ -80,7 +80,7 @@ proven near-empty in prod); raw-CSS-in-config (the old "Dummy Fields" anti-patte
 allowlist that throws on unknown ops, with a CI test asserting the op-set; defensive
 resolver with logged fallbacks; debug-bundle endpoint ships WITH the resolver; `c_longValue`
 on overrides with strict per-attribute casting; per-surface meta() cutover with a parity
-diff (do NOT delete meta() until every page is migrated); `BLANK_CLIENT_DATABASE` as a CI gate.
+diff (do NOT delete meta() until every page is migrated); `BLANK_CLIENT_DATABASE` as a CI gate. Reserved Core id blocks: `Records` 333–341, `RecordFields` 2246–2433 (renumbered 2026-06-29, seed files only — a known file-vs-DB id drift in already-provisioned envs, to reconcile by re-provisioning). Anything spanning both id schemes must be id-agnostic (match by `route=`, not id).
 
 ## Naming convention & autoloader
 
@@ -324,3 +324,4 @@ multi-file UI components (`.php`/`.html`/`.css`/`.js`) invoked as `<_ComponentNa
 ## Change history
 - 2026-06-11 — Documented lazy transaction gotcha in `_Database::register()` (rgirish)
 - 2026-06-25 — Added the Surface platform UI presentation/configuration layer (DB-driven UI config replacing `Page::meta()`, CTO-reviewed AGREE-WITH-ADJUSTMENTS) (jcardinal)
+- 2026-06-29 — Surface made the enforced (un-flagged) presentation path; reserved id blocks renumbered to Records 333–341 / RecordFields 2246–2433 (known seed-vs-provisioned drift). (jcardinal)

package/knowledge/2.0/apps/_underscore/features/surface-resolver.md

@@ -6,10 +6,11 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-06-25
+updated: 2026-06-29
 owners: [jcardinal]
 files:
   - _underscore/Model/Core/Surface.php
+  - dbchanges2/Core/2026-06-29b - SurfaceMetaPublicReadAcl.sql
   - _underscore/Model/Core/SurfaceElement.php
   - _underscore/Model/Core/Action.php
   - _underscore/Model/Core/Vocabulary.php
@@ -30,8 +31,9 @@ related:
 The runtime for the platform-wide **Surface** UI presentation layer: 9 `_underscore` models plus a
 cached resolver, `_Model_Core_Surface::resolve(&$api, string $slug)`, that merges base config +
 cascade overrides + ACL + messages + theme tokens into one flat, serializable bundle. It is the
-**replacement for `_Model_Core_Page::meta()`** and is shipped as a scripted-API method behind
-`GET /v2/surfaces/{slug}/meta`. Platform/shared — not client-specific. Schema:
+**replacement for `_Model_Core_Page::meta()`** and is shipped as a scripted-API method called as
+`GET /v2/surfaces/meta?slug=<slug>` (RecordScript args come from the **query string**, not the
+path — see gotchas). Platform/shared — not client-specific. Schema:
 [surface-layer-schema](../../dbchanges2/features/surface-layer-schema.md).
 
 ## The 9 models
@@ -62,8 +64,8 @@ Inputs come from `$api` (the same accessor `_Model_Client_TableView::meta` uses)
    table pipeline (referenced, never duplicated).
 7. Assemble the flat bundle. **Zero INSERTs.**
 
-A `debug()` inspector returns the resolved bundle plus the raw cascade layers (shipped with the
-resolver, not "later").
+A `metaDebug()` inspector returns the resolved bundle plus the raw cascade layers (shipped with the
+resolver, not "later"). It is **not** named `debug()` — see gotchas.
 
 ## Caching & invalidation
 
@@ -97,8 +99,29 @@ resolver, not "later").
   falls back to sane defaults and never crashes a page. Strict per-`attribute` casting with logged
   fallback on bad `SurfaceOverrides` data.
 - **Cross-DB reads are batched** (DB_CORE vs DB_CLIENT) and FKs are soft — tolerate dangling refs.
+- **A scripted-API method MUST NOT collide with a non-static `_Model` base method.** Naming the
+  inspector `debug()` caused a fatal *"Cannot make non static method _Model::debug() static"* — the
+  framework base `_Model` defines a NON-static `debug()` (Model.php:167) and the scripted-API
+  dispatch calls the method statically. Renamed to `metaDebug` and remapped the RecordScript
+  (`route 'debug' → phpMethod 'metaDebug'`). Vet any new scripted-API method name against the
+  `_Model` base (e.g. `debug`, and check others) before mapping it.
+- **The endpoint is `GET /v2/surfaces/meta?slug=<slug>`, not `/v2/surfaces/<slug>/meta`.** TOGA
+  RecordScripts read their args from the **query string**; the path form makes the engine parse the
+  slug as a record uuid and return 404 EV-6. Pattern for any RecordScript:
+  `/<route>/<scriptRoute>?<arg>=...`.
+- **Core metadata records exposed to the app must grant CORE role Public (id 1) READ.** The meta
+  RecordScript is ACL-gated on the `surfaces` Core record, and authenticated app users carry CORE
+  role Public(1); a seed that grants only Super User(3)/Base(4) returns 403 EZ-1. Grant Public(1)
+  `allowRead` on the `surfaces` record (full AclRecordPermissions → AclLogicGroups →
+  AclLogicGroupExpressions → AclRecordExpressions 'all' chain), mirroring how `apps`/`records`/
+  `record-fields` already expose Public READ. Only the `surfaces` record gets Public read — the
+  admin-CRUD sibling records stay Super-User-only (the resolver reads their tables server-side).
 
 ## Change history
-- 2026-06-25 — Built the 9 models + `resolve()`/`debug()` as the cached, parameterized,
+- 2026-06-29 — Deploy fixes: renamed the scripted inspector `debug()`→`metaDebug()` (name collided
+  with non-static `_Model::debug()`, fatal); corrected the endpoint to query-string form
+  `GET /v2/surfaces/meta?slug=` (path form 404'd EV-6); granted CORE Public(1) READ on the `surfaces`
+  record so app users stop getting 403 EZ-1 on meta (id-agnostic migration matches by `route='surfaces'`). (jcardinal)
+- 2026-06-25 — Built the 9 models + `resolve()`/`metaDebug()` as the cached, parameterized,
   zero-write-on-read replacement for `_Model_Core_Page::meta()`; cache-bust interceptors on all 9
   models (outside the transaction). meta() retained until per-page cutover with parity diff. (jcardinal)

package/knowledge/2.0/apps/api2/features/surface-meta-option.md

@@ -6,7 +6,7 @@ project: API
 client: shared
 type: feature
 status: active
-updated: 2026-06-25
+updated: 2026-06-29
 owners: [jcardinal]
 files:
   - api2/Component/Api/V2/V2.php
@@ -42,6 +42,17 @@ traffic), behavior is **byte-for-byte unchanged** — pure data, zero extra work
   the logic.
 - **One call, no extra round-trip** — the state pass rides the existing data fetch.
 
+## Gotchas
+
+- **Meta endpoint 403 EZ-1 for normal app users → grant CORE Public(1) READ on the `surfaces`
+  record.** Authenticated app users carry CORE role Public (id 1); the meta RecordScript is
+  ACL-gated on the `surfaces` Core record, and a seed granting only Super User(3)/Base(4) rejects
+  them. Grant Public(1) `allowRead` on `surfaces` only (the admin-CRUD sibling records stay
+  Super-User-only — the resolver reads their tables server-side). See
+  [surface-resolver](../../_underscore/features/surface-resolver.md) gotchas for the full chain.
+
 ## Change history
+- 2026-06-29 — Documented the meta-endpoint ACL: normal app users (CORE Public role 1) need
+  `allowRead` on the `surfaces` record or meta returns 403 EZ-1. (jcardinal)
 - 2026-06-25 — Added the `surface=<slug>` opt-in option to the V2 engine; attaches per-record action
   state under `meta.surface` (M2M-safe, defensive, absent = unchanged). (jcardinal)

package/knowledge/2.0/apps/dbchanges2/INDEX.md

@@ -3,5 +3,5 @@
 | Doc | Summary | Files |
 |-----|---------|-------|
 | [Database Changes (dbchanges2) Repository Architecture](architecture.md) | `dbchanges2` is the **schema-migration / SQL change-set repository** for the entire 2.0 platform. | Core/, Client/, Client_<Tenant>/, Logs/, Logs_Client/, _modules/ |
-| [Surface Layer Schema (UI presentation/config tables)](features/surface-layer-schema.md) | The persistent schema for the platform-wide **Surface** UI presentation/configuration layer (see the `_underscore` [surface-resolver](../../_underscore/features | dbchanges2/Core/2026-06-25a - SurfaceCoreTables.sql, dbchanges2/Core/2026-06-25b - SurfaceRecordsAndFields.sql, dbchanges2/Core/2026-06-25c - SalesOrderLoginSurfaceSeed.sql, dbchanges2/Client/2026-06-25a - SurfaceClientTables.sql, dbchanges2/Client/2026-06-25b - SurfaceClientSeed.sql, dbchanges2/Client/2026-06-25c - SurfaceClientAcl.sql, dbchanges2/Client/2026-06-03- BLANK_CLIENT_DATABASE.sql |
+| [Surface Layer Schema (UI presentation/config tables)](features/surface-layer-schema.md) | The persistent schema for the platform-wide **Surface** UI presentation/configuration layer (see the `_underscore` [surface-resolver](../../_underscore/features | dbchanges2/Core/2026-06-25a - SurfaceCoreTables.sql, dbchanges2/Core/2026-06-25b - SurfaceRecordsAndFields.sql, dbchanges2/Core/2026-06-25c - SalesOrderLoginSurfaceSeed.sql, dbchanges2/Core/2026-06-29a - ItemsSurfaceSeed.sql, dbchanges2/Core/2026-06-29b - SurfaceMetaPublicReadAcl.sql, dbchanges2/Client/2026-06-25a - SurfaceClientTables.sql, dbchanges2/Client/2026-06-25b - SurfaceClientSeed.sql, dbchanges2/Client/2026-06-25c - SurfaceClientAcl.sql, dbchanges2/Client/2026-06-03- BLANK_CLIENT_DATABASE.sql |
 | [2.0 New-Client Onboarding (manual process)](workflows/client-onboarding.md) | How to manually stand up a new 2.0 client (tenant). | Client/, Client_<Tenant>/, Core/, Logs_Client/ |

package/knowledge/2.0/apps/dbchanges2/features/surface-layer-schema.md

@@ -6,12 +6,14 @@ project: Database Changes
 client: shared
 type: feature
 status: active
-updated: 2026-06-25
+updated: 2026-06-29
 owners: [jcardinal]
 files:
   - dbchanges2/Core/2026-06-25a - SurfaceCoreTables.sql
   - dbchanges2/Core/2026-06-25b - SurfaceRecordsAndFields.sql
   - dbchanges2/Core/2026-06-25c - SalesOrderLoginSurfaceSeed.sql
+  - dbchanges2/Core/2026-06-29a - ItemsSurfaceSeed.sql
+  - dbchanges2/Core/2026-06-29b - SurfaceMetaPublicReadAcl.sql
   - dbchanges2/Client/2026-06-25a - SurfaceClientTables.sql
   - dbchanges2/Client/2026-06-25b - SurfaceClientSeed.sql
   - dbchanges2/Client/2026-06-25c - SurfaceClientAcl.sql
@@ -60,11 +62,13 @@ SurfaceElements`). Core migrations run first; Client after. The session built/se
 **SalesOrders + login** vertical (not Tickets) as the review proof:
 
 - `Core/2026-06-25a - SurfaceCoreTables.sql` — the 6 Core tables.
-- `Core/2026-06-25b - SurfaceRecordsAndFields.sql` — `Core.Records`+`RecordFields` for all 9 tables (reserved id block **2300–2399**; `recordId` via `model=` subselect).
+- `Core/2026-06-25b - SurfaceRecordsAndFields.sql` — `Core.Records`+`RecordFields` for all 9 tables (`Records` ids **333–341**, `RecordFields` ids **2246–2433**; `recordId` via `model=` subselect). Also maps the meta `RecordScript` `route 'debug' → phpMethod 'metaDebug'` (the inspector cannot be named `debug` — see [surface-resolver](../../_underscore/features/surface-resolver.md)).
 - `Core/2026-06-25c - SalesOrderLoginSurfaceSeed.sql` — Core seed + the `RecordScripts` resolve row.
+- `Core/2026-06-29a - ItemsSurfaceSeed.sql` — the Items LIST screen seed: surfaces `items-list` (TABLE → existing `items` TableView id 9, recordId 21) + `items-list-actions` (BUTTON_BAR: refresh/columns/newItem) + Actions + ~11 Messages. Single DEFAULT bundle, no Client overrides.
+- `Core/2026-06-29b - SurfaceMetaPublicReadAcl.sql` — grants CORE role Public(1) `allowRead` on the `surfaces` record (so app users stop getting 403 EZ-1 on meta). **Id-agnostic**: matches the record by `route='surfaces'`, so it works whether the record id is 333 or the legacy 2300.
 - `Client/2026-06-25a - SurfaceClientTables.sql` — the 3 Client tables + `INSERT IGNORE Languages('en','English')`.
 - `Client/2026-06-25b - SurfaceClientSeed.sql` — `ThemeTokens` + `MessageTranslations(en)`.
-- `Client/2026-06-25c - SurfaceClientAcl.sql` — full ACL chain for the 3 CLIENT-aclDatabase records.
+- `Client/2026-06-25c - SurfaceClientAcl.sql` — full ACL chain for the 3 CLIENT-aclDatabase records (recordId refs updated to the 333-block renumber).
 
 ## Gotchas
 
@@ -79,12 +83,22 @@ SurfaceElements`). Core migrations run first; Client after. The session built/se
 - **`SurfaceOverrides.value` is a stringly-typed escape hatch** — a long `CONFIG`/label override
   would silently truncate at varchar(255); that is why `c_longValue mediumtext` exists, and the
   resolver MUST cast strictly per `attribute` (bool/int/string/json) with a logged fallback.
-- **Reserved id block 2300–2399** for the Surface `Records`/`RecordFields` rows (Core max was 331);
-  use `model=` subselects for `recordId`, never hardcoded ids.
+- **Reserved id blocks (renumbered 2026-06-29):** Surface `Core.Records` ids **333–341** (9 tables),
+  `Core.RecordFields` ids **2246–2433**. (Originally seeded at 2300–2308 / 2400+, renumbered at the
+  team's request.) `RecordScripts.recordId` and the Core+Client ACL `recordId` refs were updated to
+  match. Use `model=` subselects for `recordId`, never hardcoded ids.
+- **Known file-vs-DB id drift.** The renumber changed the **seed files only** — already-provisioned
+  envs still hold the old 2300/2400 ids. This is intentional/known, to be reconciled by
+  re-provisioning later. Anything that must work across both (e.g. the Public-READ ACL grant) must
+  be **id-agnostic** — match the record by `route='surfaces'`, not by id.
 - **CLIENT-aclDatabase records** (`SurfaceOverrides`, `MessageTranslations`, `ThemeTokens`) need the
   full 4-step ACL chain + field permissions in **each** client DB; resolve `roleId` by subselect.
 
 ## Change history
-- 2026-06-25 — Initial schema for the Surface layer: 6 Core + 3 Client tables, `Records`/`RecordFields`
-  (ids 2300–2399), SalesOrders+login seed, ACL chain, and `BLANK_CLIENT_DATABASE` append. Typed
+- 2026-06-29 — Renumbered the reserved seed id blocks (Records 2300-2308→**333–341**, RecordFields
+  2400+→**2246–2433**) in the seed files only — known file-vs-DB drift in provisioned envs. Added
+  the Items LIST seed (`ItemsSurfaceSeed.sql`) and the id-agnostic CORE Public(1) READ ACL grant on
+  `surfaces` (`SurfaceMetaPublicReadAcl.sql`, matches by `route='surfaces'`). (jcardinal)
+- 2026-06-25 — Initial schema for the Surface layer: 6 Core + 3 Client tables, `Records`/`RecordFields`,
+  SalesOrders+login seed, ACL chain, and `BLANK_CLIENT_DATABASE` append. Typed
   columns chosen over EAV (the old `*Settings` cascade was empirically near-empty in prod). (jcardinal)

package/knowledge/2.0/apps/toga25-supply/INDEX.md

@@ -8,4 +8,4 @@
 | [Column Visibility (URL-driven show/hide columns)](features/column-visibility.md) | A "Columns" header button that opens a modal listing every column from the table meta, lets the user show/hide columns, adjusts the table live, and persists the | toga25-supply/src/components/ColumnVisibilityModal/, toga25-supply/src/pages/SalesOrders/SalesOrders.tsx, toga25-supply/src/pages/SalesOrders/viewModel/useSalesOrdersPageViewModel.tsx, toga25-supply/src/pages/SalesOrders/hooks/useSalesOrdersTableData.tsx |
 | [Meta-Driven Page & Table Setup](features/meta-driven-table-data.md) | A page in this app is **meta-driven end to end**: the page view model fetches *page meta* (labels, sections, ACL) and *table meta* (the columns/fields + table s | toga25-supply/src/pages/SalesOrders/viewModel/useSalesOrdersPageViewModel.tsx, toga25-supply/src/pages/SalesOrders/hooks/useSalesOrdersTableState.ts, toga25-supply/src/hooks/useTablePageMeta.ts, toga-blox-npm/dist/hooks/useFetchPageMeta.d.ts, toga-blox-npm/dist/hooks/useFetchTablePageMeta.d.ts, toga-blox-npm/dist/hooks/useAssignTableFieldLabels.d.ts, toga-blox-npm/dist/components/Table/hooks/useTableData.d.ts |
 | [Record Modals & Nested Tables](features/record-modals-and-nested-tables.md) | The repo's family of modal + nested-table patterns layered over toga-blox `TableRecordModal` and `PrimaryTable*Layout`. | toga25-supply/src/layout/ItemRecordModalLayout/, toga25-supply/src/layout/SalesOrderRecordModalLayout/, toga25-supply/src/layout/SalesOrderItemsTableLayout/, toga25-supply/src/layout/ItemFulfillmentModal/, toga25-supply/src/layout/GenericNestedTables/, toga25-supply/src/hooks/useTableCellInteractions.ts |
-| [Surface Frontend (DB-driven UI consumption, src/surface/)](features/surface-frontend.md) | The frontend consumer of the platform-wide Surface layer — DB-driven UI config fetched from `GET /v2/surfaces/{slug}/meta` instead of statically-imported JSON f | toga25-supply/src/surface/useFetchSurfaceMeta.ts, toga25-supply/src/surface/evaluateSurfaceRule.ts, toga25-supply/src/surface/actionRegistry.ts, toga25-supply/src/surface/SurfaceActionBar.tsx, toga25-supply/src/surface/SurfaceSection.tsx, toga25-supply/src/surface/resolve.ts, toga25-supply/src/surface/types.ts, toga25-supply/src/surface/featureFlag.ts, toga25-supply/src/surface/index.ts, toga25-supply/src/pages/Login/LoginPage.tsx, toga25-supply/src/pages/SalesOrders/SalesOrders.tsx, toga25-supply/src/pages/SalesOrders/view/SalesOrderRecordModalLayout/view/sections/SalesOrderTopBar.tsx |
+| [Surface Frontend (DB-driven UI consumption, src/surface/)](features/surface-frontend.md) | The frontend consumer of the platform-wide Surface layer — DB-driven UI config fetched from `GET /v2/surfaces/meta?slug=<slug>` instead of statically-imported J | toga25-supply/src/surface/useFetchSurfaceMeta.ts, toga25-supply/src/surface/evaluateSurfaceRule.ts, toga25-supply/src/surface/actionRegistry.ts, toga25-supply/src/surface/SurfaceActionBar.tsx, toga25-supply/src/surface/SurfaceSection.tsx, toga25-supply/src/surface/resolve.ts, toga25-supply/src/surface/types.ts, toga25-supply/src/surface/index.ts, toga25-supply/src/pages/Login/LoginPage.tsx, toga25-supply/src/pages/SalesOrders/SalesOrders.tsx, toga25-supply/src/pages/SalesOrders/view/SalesOrderRecordModalLayout/view/sections/SalesOrderTopBar.tsx, toga25-supply/src/pages/Items/ItemsPage.tsx, toga25-supply/src/pages/Items/viewModel/useItemsPageViewModel.tsx, toga25-supply/src/fieldsConfig/index.ts |

package/knowledge/2.0/apps/toga25-supply/features/surface-frontend.md

@@ -6,7 +6,7 @@ project: TOGa 2.5 Supply
 client: shared
 type: feature
 status: active
-updated: 2026-06-25
+updated: 2026-06-29
 owners: [jcardinal]
 files:
   - toga25-supply/src/surface/useFetchSurfaceMeta.ts
@@ -16,11 +16,13 @@ files:
   - toga25-supply/src/surface/SurfaceSection.tsx
   - toga25-supply/src/surface/resolve.ts
   - toga25-supply/src/surface/types.ts
-  - toga25-supply/src/surface/featureFlag.ts
   - toga25-supply/src/surface/index.ts
   - toga25-supply/src/pages/Login/LoginPage.tsx
   - toga25-supply/src/pages/SalesOrders/SalesOrders.tsx
   - toga25-supply/src/pages/SalesOrders/view/SalesOrderRecordModalLayout/view/sections/SalesOrderTopBar.tsx
+  - toga25-supply/src/pages/Items/ItemsPage.tsx
+  - toga25-supply/src/pages/Items/viewModel/useItemsPageViewModel.tsx
+  - toga25-supply/src/fieldsConfig/index.ts
 related:
   - ../../_underscore/features/surface-resolver.md
   - meta-driven-table-data.md
@@ -29,14 +31,17 @@ related:
 ## What it is
 
 The frontend consumer of the platform-wide Surface layer — DB-driven UI config fetched from
-`GET /v2/surfaces/{slug}/meta` instead of statically-imported JSON field bundles. Lives in
+`GET /v2/surfaces/meta?slug=<slug>` instead of statically-imported JSON field bundles. Lives in
 `src/surface/` for now with a `TODO(blox)` to extract the generic machinery into `@agilant/toga-blox`
-so all 2.0 apps inherit it. Backend: [surface-resolver](../../_underscore/features/surface-resolver.md).
+so all 2.0 apps inherit it. Surface is now the **enforced, unconditional presentation path** (no
+feature flag — see below). Backend: [surface-resolver](../../_underscore/features/surface-resolver.md).
 
 ## How it works
 
 - **`useFetchSurfaceMeta`** — the single fetch-once/React-Query-cached choke point for a surface's
-  meta. Loading a different *record* into the same surface reuses cached meta.
+  meta. Loading a different *record* into the same surface reuses cached meta. Builds the URL as
+  `/surfaces/meta?slug=...` (query string), **not** `/surfaces/<slug>/meta` (the path form makes the
+  engine parse the slug as a record uuid → 404 EV-6).
 - **`evaluateSurfaceRule`** — the Tier-1 rule evaluator: a **frozen `all/any/none` + `{field,op,value}`
   grammar** that **throws on an unknown op** (generalized from the SalesOrders
   `buildPatchedTenantFields`/`evaluateEnableRule`/`resolveFlag` helpers). Evaluated client-side against
@@ -47,25 +52,53 @@ so all 2.0 apps inherit it. Backend: [surface-resolver](../../_underscore/featur
 - **theme/message resolvers** (`resolve.ts`) — token → CSS and ICU message rendering.
 - **`SurfaceActionBar`/`SurfaceActions` + `SurfaceSection`** — generic renderers.
 
-## What's wired (review proof)
+## Enforced, not flagged
 
-Login + sales-orders list + the sales-order modal, all behind the **`SURFACE_ENABLED`** flag (env
-`VITE_SURFACE_ENABLED`, **default OFF**). The SalesOrder action bar reproduces
-`orderViewFields.json` approve/deny/approvalWorkflow/viewLog/editOrder by delegating to the existing
-`onActionClick`/`onOpenLog` handlers. The table stays on the existing TableView pipeline via
-`tableViewSlug` (see [meta-driven-table-data](meta-driven-table-data.md)) — the Surface layer
-references the TableView, never replaces it.
+Surface is the **unconditional** presentation path. The `VITE_SURFACE_ENABLED` / `SURFACE_ENABLED`
+feature flag was **removed entirely** (`featureFlag.ts` deleted, all gating conditionals and the
+legacy pre-Surface fallback branches at the wired screens removed). Legacy per-screen `FIELDS` config
++ rendering are deleted as each screen migrates — there is no dual-path fallback.
+
+## What's wired
+
+Login + sales-orders list + the sales-order modal + the **Items LIST** screen. The SalesOrder action
+bar reproduces `orderViewFields.json` approve/deny/approvalWorkflow/viewLog/editOrder by delegating
+to the existing `onActionClick`/`onOpenLog` handlers. TABLE-type surfaces stay on the existing
+TableView pipeline via `tableViewSlug` (see [meta-driven-table-data](meta-driven-table-data.md)) —
+the Surface layer references the TableView, never replaces it.
+
+## Per-screen migration recipe (proven on SalesOrders + Items)
+
+The screen-by-screen full-app refactor follows one recipe:
+1. Seed the screen's surface(s) in a `Core/*SurfaceSeed.sql` — a TABLE surface that references the
+   screen's existing `TableView` id via `tableViewSlug`, plus a BUTTON_BAR/actions surface + its
+   Actions + Messages (e.g. Items: `items-list` TABLE → TableView id 9 / recordId 21, and
+   `items-list-actions` refresh/columns/newItem).
+2. Rewire the page + its view-model to consume the surface bundle (`ItemsPage.tsx` /
+   `useItemsPageViewModel.tsx`).
+3. **Delete** the legacy `FIELDS` config: the page's `*Fields.json` and its `fieldsConfig/index.ts`
+   entries.
+Keep TABLE rendering on the existing TableView pipeline; only the chrome (actions/labels/visibility)
+moves to Surface. A screen with no client/role/lang variance ships a single DEFAULT bundle (no
+Client overrides), as Items did.
 
 ## Gotchas
 
-- **Default OFF.** Nothing renders through the Surface path unless `VITE_SURFACE_ENABLED` is set —
-  the existing JSON-bundle path remains live until per-surface cutover.
+- **No feature flag, no fallback.** Surface is the enforced path; a missing/broken surface bundle
+  does not silently fall back to legacy JSON — that path is deleted per screen as it migrates.
+- **Endpoint is query-string form** — `GET /v2/surfaces/meta?slug=...`, not `/surfaces/<slug>/meta`
+  (the path form 404s EV-6).
 - **Tier-1 only on the client.** Business-logic gates (Tier-2) arrive as resolved booleans from the
   backend (`meta.surface`); never re-encode business rules in the FE evaluator.
 - **`tsc` not yet run** this session (the private `@agilant/toga-blox` registry needs npm creds);
   treat type-checking as pending. Runtime `GET /v2/surfaces/{slug}/meta` also not yet exercised.
 
 ## Change history
+- 2026-06-29 — DECISION: Surface is now enforced, not flagged — removed `VITE_SURFACE_ENABLED`/
+  `SURFACE_ENABLED` (deleted `featureFlag.ts` + all gating/legacy-fallback branches). Fixed
+  `useFetchSurfaceMeta` to the query-string endpoint `/surfaces/meta?slug=` (path form 404'd EV-6).
+  Migrated the Items LIST screen (second proof of the per-screen recipe; deleted `itemsPageFields.json`
+  + its fieldsConfig entries). (jcardinal)
 - 2026-06-25 — Built `src/surface/` (fetch hook, frozen Tier-1 rule evaluator, action registry, theme/
   message resolvers, action-bar + section renderers); wired login + SalesOrders list + SO modal behind
   the OFF-by-default `SURFACE_ENABLED` flag. Generic machinery destined for toga-blox. (jcardinal)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.222",
+  "version": "1.0.223",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",