toga-ai 1.0.402 → 1.0.403

package/knowledge/2.0/apps/_underscore/features/surface-resolver.md

@@ -322,21 +322,21 @@ Core record grants + their logic-group expressions all evaluate `all`/`"1"`. The
 
 ## Gotchas
 
-- **Per-client surface message overrides silently never apply unless the JWT carries
-  `id.client.languageId`.** `_Model_Core_Surface::_loadMessages` overlays `Core.Messages.defaultValue`
-  with `Client_<X>.MessageTranslations` rows **only when `languageId > 0`**, and `Surface.php` resolves
-  `languageId` **solely** from the JWT `id.client.languageId` claim. But auth (`api2/V2.php`)
-  historically set only `id.language` (the string code `"en"`) and **never** `id.client.languageId`, so
-  `languageId` was always `0`, the overlay was skipped, and every per-client surface message override
-  (e.g. a client-specific disabled-tooltip) fell back to the Core default with **no error**. (There was
-  an explicit TODO at `V2.php` ~L5738.) **Fix (2026-07-21):** `/auth/login` now embeds
-  `$id->client->languageId = (int)$language->id` in **both** the configured-language and default-`en`
-  branches (English gets a real `languageId` too; the overlay keys on `languageId > 0` and falls back
-  to Core defaults where a client has no `MessageTranslations` row). ⚠ **CAVEAT — only `/auth/login`
-  was fixed.** The refresh (`V2.php` ~L1227), oauth, api, delegator, encrypted, and public token paths
-  still don't embed `id.client.languageId`, so **after an access-token refresh (~3600s) `languageId` is
-  lost** and per-client surface messages revert until those paths are updated too. (This is a **separate
-  claim** from `id.language`, which drives the data-translation sidecar — see
+- **Per-client surface message overrides silently never apply when `languageId` resolves to `0`.**
+  `_Model_Core_Surface::_loadMessages` overlays `Core.Messages.defaultValue` with
+  `Client_<X>.MessageTranslations` rows **only when `languageId > 0`**. The JWT carries the language as
+  the string code `id.language` (`"en"`) but **not** the numeric `id.client.languageId`, so reading
+  `id.client.languageId` alone always yielded `0` — the overlay was skipped and every per-client surface
+  message override (e.g. a client-specific disabled-tooltip) fell back to the Core default with **no
+  error**. **Fix (2026-07-21):** `Surface.php` now resolves `languageId` via a private
+  `_resolveLanguageId($api)` helper (used by both `resolve()` and `metaDebug()`) — it prefers
+  `id.client.languageId`, and when that is `0` **looks up the client `Languages` row by the
+  `id.language` code** (`_Model_Client_Language` load-by-`code`) and uses its id. English resolves to a
+  real `languageId` too; a client with no `MessageTranslations` row still falls back to Core defaults.
+  This lives entirely in the framework resolver — **no auth/JWT change** (an earlier `V2.php`
+  token-embed approach was abandoned in favour of the lookup, so it works across **all** token paths,
+  including refresh, without each auth flow having to embed the id). (This is a **separate** concern from
+  `id.language` driving the data-translation sidecar — see
   [language-translation-layer](../../api2/features/language-translation-layer.md); do not conflate.)
 - **A `SurfaceOverrides` row with `attribute='CONFIG'` carrying a RULE value is silently DEAD —
   encode rules as `VISIBILITY_RULE`/`ENABLED_RULE`, never as `CONFIG`.** `_castOverride` routes the
@@ -427,10 +427,10 @@ Core record grants + their logic-group expressions all evaluate `all`/`"1"`. The
   `{"type":"poNumberEntered"}` (client-wide, both surfaces) + disabled-tooltip `MessageTranslations`
   override, and the **Compass/CC** approvals-gate marker enable (`2026-07-21b`) needed so
   `stepTwoAssigned` doesn't fail open. New gotcha: per-client surface **message** overrides silently
-  never apply unless the JWT carries `id.client.languageId` (`_loadMessages` overlays
-  `MessageTranslations` only when `languageId>0`; `Surface.php` reads it solely from that claim, but
-  auth only set `id.language`) — fixed in `api2/V2.php` `/auth/login` (both language branches), with the
-  caveat that refresh/oauth/api/delegator/encrypted/public paths still lose it after a token refresh.
+  never apply when `languageId` resolves to `0` (`_loadMessages` overlays `MessageTranslations` only
+  when `languageId>0`; the JWT carries `id.language` code but not `id.client.languageId`) — fixed in
+  `Surface.php` via a `_resolveLanguageId()` helper that falls back to looking up the client `Languages`
+  row by the `id.language` code. Framework-only; no auth/JWT change, so it holds across all token paths.
   (apeterson)
 - 2026-07-20 — Clarified the **backend Tier-2 gate reality**: `_resolveTier2State` (Surface.php ~280)
   dispatches by **action slug** to `resolveSurfaceActionState()` (`TIER2_CAPABILITY_METHOD`), **not**

package/knowledge/sessions/2026-07-21-true-79191-fulfill-ship-mhammontree.md

@@ -0,0 +1,62 @@
+---
+type: session
+slug: true-79191-fulfill-ship
+title: TRUE-79191 Fulfill & Ship — review fixes, deployment order, UoM plan
+author: mhammontree
+repos: [toga2-supply, _underscore, api2, dbchanges2]
+framework: "2.0"
+client: shared
+status: active
+created: 2026-07-21
+updated: 2026-07-21
+---
+
+# Session: true-79191-fulfill-ship
+**Date:** 2026-07-21
+**Project/Repo:** toga2-supply (2.0), with _underscore / api2 / dbchanges2 backend
+**Task:** TRUE-79191 Fulfill & Ship — apply David/Jeff review fixes to the Fulfill & Ship UI, produce the deployment order, and design a package units-of-measure change.
+
+---
+
+## What WORKED
+<!-- All UI fixes below were verified by the developer in the browser this session -->
+- Google Maps links fixed and verified. `GoogleMapsLink.tsx` now maps the physical address (`street||line1`, line2, city, `state.name`, zip) and EXCLUDES the addressee; the Edit Return Label modal's "Google Maps" span was wired with an `onClick`. Both open the correct location. (commit 651e9d9d0)
+- Select Items horizontal scrollbar gone. Description truncation cap lowered per-table: Select Items (13 cols) `max-w-[20vw]`, Update Info (8 cols) keeps `max-w-[30vw]`. CSS `truncate` + `title` tooltip preserved. (651e9d9d0)
+- Select Items row-click selects the row. Added `onRowClick` to `BasicTable` (ignores clicks on `input,button,a,select,textarea,label`); ShipmentItemsTable rows carry `uuid`, disabled rows skipped; the quantity input and checkbox still behave normally. (651e9d9d0)
+- Item images display with placeholder fallback (verified: item with image shows it, items without show the placeholder). Uses computed `_underscore` Item fields `item._imageUrl` (Items.imageId→Images.sourceUrl) and `item._thumbnailImageUrl` (ItemImages default), rendered `_imageUrl || _thumbnailImageUrl || placeholder`. (commit dc900ea4e)
+- Earlier this session, all committed + verified on TRUE-79191: SKU/UPC display fix (skuNumber/upcCode field-selectors), mint-green dirty-field border, red Delete Shipment button, reference-field hint text, responsive description truncation, table header/alignment + sticky-border fixes.
+- Local test data seeded in Client_Growrk (SKU/UPC/Dell manufacturer on items 139/276; test image on item 139). DB-only, not in any repo.
+
+## What did NOT work — DO NOT RETRY THESE
+- Saving a shipment returned `EO-1` "There is no field called 'needsReturnLabel' in the '_Model_Client_TrackingNumber' model." Root cause was a **git branch mismatch across repos** (_underscore was on a branch whose generated `Model/Client/TrackingNumber.php` lacked the field). DO NOT chase this as opcache (local php.ini has opcache DISABLED — `;zend_extension=opcache` — so files reload per request, no Apache restart needed) and DO NOT re-apply the migrations (the DB column, Core RecordField, and client AclFieldPermission were all already applied). Fix = put all fulfill/ship repos on the same branch (TRUE-79191).
+- Hard-deleting duplicate item 2742 (merging into primary item 276) failed: `Cannot delete or update a parent row: ItemFulfillmentItemUnits_unitId FK` — item 2742's unit (serial FQ25WL3) is tied to a fulfillment record, and 276 already has its own FQ25WL3 unit. DO NOT DELETE 2742. Resolution used: repoint 2742's 8 SalesOrderItems to 276, NULL 2742's manufacturer to free the (catalog1, Dell, LATITUDE) unique slot, set 276 to Dell; 2742 left as an unreferenced stub (fulfillment history preserved).
+
+## Not tried yet (candidates for next session)
+- Implement the package Units of Measure change (see plan) — NOT started; gated on Jeff's opt-in on the design.
+- Promote the Growrk-only bridge-ACL migration (`Client_Growrk/2026-07-13a - ItemFulfillmentItemReceiptTrackingNumberAclLogicGroups.sql`) to a generic `Client/` fan-out migration so ALL clients get the tracking-number bridge AclLogicGroups (records 317-322) — needed for a multi-client rollout (otherwise 403 EZ-1 per client). Documented in the deployment order.
+
+## Current file state
+| File | Status | Notes |
+|------|--------|-------|
+| toga2-supply (branch TRUE-79191) | committed & (merged to production earlier) | 5 session commits: 80724c1c2, 853b82e09, f041cfe57, dc900ea4e, 651e9d9d0 |
+| toga2-supply/.env, .env.development, package-lock.json | modified, intentionally UNSTAGED | pre-existing local changes — never commit (.env is secrets/local) |
+| _underscore, api2, dbchanges2 (branch TRUE-79191) | committed/pushed (partly merged to _production) | TRUE-79191 backend + DB migrations; unchanged this session (referenced only) |
+| c:\WWW\TRUE-79191_deployment_order.md | created (external, not a repo) | Deploy order (DB→backend→frontend) + all-clients section; share to ClickUp |
+| c:\WWW\package_units_of_measure_plan.md | created (external) | UoM design for Jeff; updated to enum-for-types (zero new tables recommended) |
+| Client_Growrk DB (local) | test data only | items 139/276 SKU/UPC/Dell + item 139 test image; revert SQL was provided in chat |
+
+## Decisions made
+- **Item image source:** render `item._imageUrl || item._thumbnailImageUrl || placeholder` — covers `Items.imageId` (single primary image) OR `ItemImages` (default thumbnail), else placeholder. Rejected: hardcoding placeholder (the pre-existing bug) or a single source.
+- **Responsive truncation:** CSS `truncate` + a per-table viewport-relative `max-w-[NNvw]` cap (tuned by column count) + native `title` tooltip. Rejected: fixed char-count truncation (ExpandableCellContent) — not width-responsive and truncates early.
+- **Google Maps query:** map the address only, never the addressee. Rejected: including the recipient name (caused Google to surface the person).
+- **BasicTable row selection:** an `onRowClick` prop that ignores interactive descendants, rather than per-cell handlers. Reusable across tables.
+- **Units of Measure (design, per Jeff):** measurement *types* are an ENUM (`measureType` LENGTH/VOLUME/WEIGHT/COUNT) — NO separate types table. Recommended to REUSE the existing client `Measures` table (already used by `Items.defaultMeasureId`) + add `conversionFactorToBase`, and add `dimensionMeasureId`/`volumeMeasureId` FKs on `TrackingNumbers` → **zero new tables**. Alternative (two dedicated new UoM tables) documented for opt-in. Carriers accept only IN/CM (dimensions) and LB/KG (weight), so the chosen measure must map/convert to the carrier enum (hence the conversion factor); volume is not sent to carriers.
+
+## Blockers
+- none blocking code. The UoM implementation is gated on Jeff opting in to the design (which table strategy; is volume stored or derived; include weight unit too; core vs client seeding).
+
+## Exact next step
+> Get Jeff's decision on `c:\WWW\package_units_of_measure_plan.md` (reuse `Measures` + `measureType` enum vs two new tables; volume stored vs derived; include weight UoM; core vs client), and whether the UoM work rides TRUE-79191 or becomes a new ticket. Then implement following the `needsReturnLabel` full-stack pattern (dbchanges2 migrations → `_underscore` Measure/TrackingNumber models → api2 field-selectors → toga2-supply UnitSelect wiring + Pending Shipments display). Separately, the deployment team runs `c:\WWW\TRUE-79191_deployment_order.md` — flag the FedEx production-endpoint config (beta.ini used sandbox) + api2 FPDF `composer install`, and the Client/ fan-out of the bridge-ACL migration for all clients.
+
+---
+_Saved by /session-save on 2026-07-21_

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.402",
+  "version": "1.0.403",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",