toga-ai 1.0.447 → 1.0.449

package/knowledge/2.0/apps/_underscore/INDEX.md

@@ -12,6 +12,7 @@
 | [Carrier Shipping Labels (UPS/FedEx) & NetSuite Item Fulfillment](features/carrier-shipping-labels.md) | Backend mechanics behind TOGa Supply's Fulfill & Ship: buying a carrier label (UPS/FedEx), persisting it, and creating the NetSuite Item Fulfillment with tracki | _underscore/Model/Client/ItemFulfillment.php, _underscore/Model/Client/TrackingNumber.php, _underscore/Model/Client/ItemFulfillments/TrackingNumber.php, _underscore/Component/Library/LabelPdf/LabelPdf.php, _underscore/Component/Library/Carriers/ShipmentRequest/ShipmentRequest.php, _underscore/Component/Library/Carriers/Ups/Ups.php, _underscore/Component/Library/Carriers/Fedex/Fedex.php, _underscore/Trait/Netsuite/ItemFulfillment.php, _underscore/Trait/Netsuite/SalesOrder.php, _underscore/Component/Library/NetSuite/NetSuite.php, _underscore/Model/Client/TrackingNumber.php, _underscore/Model/Client/ShippingMethod.php, _underscore/Model.php, _underscore/Cloud.php |
 | [_Cloud S3 helpers (copy / get / delete / list)](features/cloud-s3-helpers.md) | `_Cloud` centralizes AWS SDK S3 usage for the 2.0 stack so the `S3Client` never leaks into workers or app code. | _underscore/Cloud.php |
 | [_Component_*/_Model_* project-namespace registration (autoloader) & backslash-qualify traps](features/component-model-namespace-registration.md) | Every **project-local** `_Component_*` and `_Model_*` class in a 2.0 app **must declare the project namespace** at the top of the file: ```php namespace <NAMESP | _underscore/Loader.php, worker2/_.php, api2/_.php, worker2/Component/Forecast/Db/Db.php, worker2/Component/Forecast/SaleImport/SaleImport.php, api2/Component/Api/Netsuite/Netsuite.php |
+| [Re-pointing a DB alias mid-request (_Database::register park/restore)](features/database-alias-repointing.md) | `_Database` keys **all live per-database runtime state by the connection ALIAS** (`Client` / `_underscore::DB_CLIENT`, `ClientLogs`, `Archive`), **not** by the | _underscore/Database.php, _underscore/Query.php, api2/Component/Api/V2/V2.php, api2/Component/Api/CrossClient/CrossClient.php |
 | [Client Email Template Sending](features/email-template-sending.md) | `_Model_Client_EmailTemplate` sends a stored, client-defined email template by UUID. | _underscore/Model/Client/EmailTemplate.php, _underscore/Model/Client/EmailTemplateOutgoingEmailAddress.php, _underscore/Email.php |
 | [Error Reporting — Issue/Event Aggregation (agreed POST-to-receiver design)](features/error-reporting-issue-event.md) | Platform-wide error-reporting infrastructure for TOGA 2.0, built around a two-table **Issue / Event** aggregation model in the shared **Core Logs DB**. | _underscore/Error.php, _underscore/Model/Core/Logs/Issue.php, _underscore/Model/Core/Logs/Event.php, dbchanges2/Logs/2026-07-06 - Issue and Event tables.sql |
 | [Record-Changed Event Publishing (_Event::publish to SQS)](features/event-publish-sqs.md) | `_Event::publish()` (in `_underscore/Event.php`) is the PHP side of the real-time event pipeline. | _underscore/Event.php |

package/knowledge/2.0/apps/_underscore/features/database-alias-repointing.md

@@ -0,0 +1,120 @@
+---
+title: Re-pointing a DB alias mid-request (_Database::register park/restore)
+framework: "2.0"
+repo: _underscore
+project: _Underscore
+client: shared
+type: feature
+status: active
+updated: 2026-07-27
+owners: ["jcardinal"]
+files:
+  - _underscore/Database.php
+  - _underscore/Query.php
+  - api2/Component/Api/V2/V2.php
+  - api2/Component/Api/CrossClient/CrossClient.php
+related:
+  - ./per-client-database-connections.md
+  - ../../api2/features/cross-client-data-retrieval.md
+  - ../architecture.md
+---
+
+## Summary
+
+`_Database` keys **all live per-database runtime state by the connection ALIAS**
+(`Client` / `_underscore::DB_CLIENT`, `ClientLogs`, `Archive`), **not** by the physical schema
+name. Four statics are alias-keyed: `$_connections`, `$_queryCache`, `$_transactionStarts`,
+`$_modelCache`.
+
+Historically `_Database::register()` only rewrote `$_registers[$alias]`. It never touched
+`$_connections`, and `getConnection()` returns an already-cached link if one exists under that
+key. So **re-registering an alias changed the credentials but not the open mysqli link** — every
+query after a mid-request client switch silently ran against the *previous* client's database.
+`register()` now **parks and restores** the alias-keyed live state when an alias is re-pointed at a
+different physical database, which makes mid-request client switching actually work.
+
+## Key files / entry points
+
+- **`_underscore/Database.php`** — `register()` (park/restore), `registerClientDatabases()`
+  (per-client alias registration + Core host lookup), `getConnection()`,
+  `transactionCommit()` / `transactionRollback()` / `resolveParkedTransactions()`.
+- **`api2/Component/Api/V2/V2.php`** — a call site that switches the `Client` alias mid-request.
+- **`api2/Component/Api/CrossClient/CrossClient.php`** (~lines 193, 201, 207) — the cross-client
+  fan-out uses the same `registerClientDatabases()` + `_underscore::DB_CLIENT` pattern.
+
+## How it works
+
+Two new statics on `_Database`:
+
+- `public static $_aliases` — alias => the physical database name currently behind it.
+- `private static $_parked` — physical database name => that database's parked live state
+  (connection, queryCache, transactionStart, modelCache).
+
+On `register()`:
+
+1. If the alias is being pointed at the **same** physical database, this is a **no-op** for live
+   state. (This also fixes a latent bug where a redundant `register()` reset an already-begun
+   transaction flag from `true` back to `false`.)
+2. If it is being pointed at a **different** database, the **outgoing** database's connection,
+   queryCache, transactionStart and modelCache are parked under its own physical name, and the
+   alias slots are cleared.
+3. The **incoming** database's previously-parked state is restored if present — so an open
+   transaction on that database continues uninterrupted. If nothing is parked for it,
+   `transactionStart()` is armed as before.
+
+`registerClientDatabases()` caches only the **Core host-lookup row** per clientId
+(`static $cachedLookups`), and always runs the three `register()` calls. It **throws** when the
+Core host lookup returns no row.
+
+**Request boundary.** `transactionCommit(null)` / `transactionRollback(null)` iterate
+`$_connections`, which is alias-keyed, so a parked database would be skipped and left with an open
+transaction on a pooled connection. The null-branch of both now calls private
+`resolveParkedTransactions(bool $isCommit)`, which sweeps `$_parked` for any entry with
+`transactionStart === true`, commits or rolls it back, and marks it resolved so a later
+switch-back cannot double-commit.
+
+## Key rules
+
+- **Re-registering an alias does not, by itself, reconnect.** Any code that changes credentials
+  under an existing alias must go through `register()`'s park/restore path.
+- **Any change that hides a connection from `$_connections` must also resolve its transaction at
+  the request boundary** — otherwise the transaction leaks onto a pooled connection.
+- **Client-DB config that cannot be resolved must throw, not fall through.** Falling through leaves
+  the aliases pointed at the previous client, which reads as "wrong data," not "an error."
+
+## Design tradeoff (deliberate)
+
+Park/restore was chosen over re-keying all four caches by **physical database name**, which would
+have touched `Database.php`, `Query.php` and `Model.php`. Park/restore is contained to one function
+and keeps every existing call site working unchanged. It is correct **only while every access to
+those four caches goes through the alias** — nothing accesses them by physical name today. If that
+ever changes, the re-keying approach becomes the right fix.
+
+## Gotchas / known issues
+
+- **The original symptom is silent, not an error.** A cross-client user lookup aimed at
+  `Client_Compass` returned **0 rows** because it actually ran against `Client_True` (the home
+  client). Wrong-database bugs here look like missing data.
+- **The old `static $cached` guard in `registerClientDatabases()` made switch-back a no-op.** It was
+  keyed on clientId (commented as an "efficiency patch so we don't re-register and break
+  connections") and skipped the entire registration block for any client already seen in the
+  request — so the common "switch to B, then switch back to A" pattern never re-registered A.
+  Replaced by `$cachedLookups`, which caches only the Core lookup.
+- **`CrossClient.php` had the same latent bug** and needed no edit — the `Database.php` fix corrects
+  its cross-client reads in place.
+- **Not yet runtime-tested** as of this capture: `php -l` passes and php-reviewer cleared the diff,
+  but no live cross-client run has confirmed it.
+
+## Change history
+
+- 2026-07-27 — Initial capture. Root-caused a cross-client API bug to alias-keyed live state in
+  `_Database`: re-registering an alias never swapped the open mysqli link, so post-switch queries
+  hit the previous client's DB. Added `$_aliases`/`$_parked` park/restore in `register()`,
+  `resolveParkedTransactions()` on the null-branch of commit/rollback (parked transactions were
+  invisible to the request boundary), a throw when the Core host lookup returns no row, and
+  replaced the `static $cached` no-op guard with `$cachedLookups`. (jcardinal)
+
+## Related docs
+
+- [Per-Client Database Connections & the Local Logs Trap](./per-client-database-connections.md)
+- [Multi-Client (Cross-Client) Data Retrieval](../../api2/features/cross-client-data-retrieval.md)

package/knowledge/2.0/apps/_underscore/features/per-client-database-connections.md

@@ -6,7 +6,7 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-07-23
+updated: 2026-07-27
 owners: ["dfranks", "jcardinal", "mhammontree", "apeterson", "kyalamarthi"]
 files:
   - _underscore/Database.php
@@ -16,6 +16,7 @@ files:
 related:
   - ../architecture.md
   - ../workflows/local-db-refresh-from-beta.md
+  - ./database-alias-repointing.md
 ---
 
 ## Summary
@@ -118,12 +119,20 @@ here — they live in `Config/*.ini`.)
   A connect failure here threw past `api()` and got masked by `Route.php` as the misleading line-525
   "Failed to determine how to render view" error — see the Route.php swallow→mask gotcha in
   [_underscore architecture](../architecture.md#gotchas--known-issues).
+- **These aliases key ALL live connection state — re-registering one does not reconnect.**
+  `$_connections`, `$_queryCache`, `$_transactionStarts` and `$_modelCache` are keyed by the
+  alias (`Client`, `ClientLogs`, `Archive`), not by the physical schema, so switching a client
+  mid-request needs `_Database::register()`'s park/restore path. See
+  [Re-pointing a DB alias mid-request](./database-alias-repointing.md).
 - Related 1.0 analogue: the legacy `App_` worker has the same hazard writing to `Logs.API`
   (`db_logs`) — the laptop trap there is documented separately in the worker NetSuite bootstrap
   notes.
 
 ## Change history
 
+- 2026-07-27 — Recorded that the three per-client aliases key **all** live connection state, so
+  re-pointing an alias mid-request does not reconnect on its own; split the detail into
+  [Re-pointing a DB alias mid-request](./database-alias-repointing.md). (jcardinal)
 - 2026-07-23 — Documented that the **`Team` schema** (`Tasks`/`Sprints`, `_Model_Team_*`,
   `DB_TEAM`) is not a first-class api2 DB (not in `Records.aclDatabase`, which is CORE/CLIENT
   only) and physically resolves to the **core cluster** (reads → `reader1.core…`, writes →

package/knowledge/2.0/apps/api2/features/cross-client-data-retrieval.md

@@ -6,7 +6,7 @@ project: API
 client: shared
 type: feature
 status: draft
-updated: 2026-07-07
+updated: 2026-07-27
 owners: [jcardinal]
 files:
   - api2/Component/Api/CrossClient/CrossClient.php
@@ -21,6 +21,7 @@ related:
   - ./encrypted-user-uuid-auth-handoff.md
   - ../../_underscore/features/per-client-database-connections.md
   - ../../_underscore/features/acl-permission-chain.md
+  - ../../_underscore/features/database-alias-repointing.md
 ---
 
 ## What it is
@@ -111,10 +112,19 @@ for how it sits among the shared/per-client clusters.
   emits `(object)$outRow`.
 - **The X-Cross-Client / X-Cross-User custom-header transport was a dead stub** — the V2 engine
   never reads such headers. The real transport is the two-phase encrypted-UUID auth handshake.
+- **Switching the `Client` DB alias mid-request used to silently not switch.** `CrossClient.php`
+  (~lines 193/201/207) uses `_Database::registerClientDatabases()` + `_underscore::DB_CLIENT`, and
+  `_Database` keys its live connection state by **alias**, not physical schema — so cross-client
+  reads were executing against the *home* client's DB and returning 0 rows. Fixed in
+  `_underscore/Database.php` (no api2 edit needed); see
+  [Re-pointing a DB alias mid-request](../../_underscore/features/database-alias-repointing.md).
 - **`curl_multi` busy-spin guard** — both multi loops `usleep(100)` when
   `curl_multi_select() === -1`.
 
 ## Change history
+- 2026-07-27 — Root-caused cross-client reads hitting the home client's DB: `_Database` keys live
+  connection state by alias, so re-registering `DB_CLIENT` never swapped the open link. Fixed in
+  `_underscore/Database.php`; CrossClient needed no edit. (jcardinal)
 - 2026-07-07 — Initial capture: scatter-gather cross-client retrieval engine (orchestrator, watermark
   k-way merge, keyset pagination Phase 0a/0b, `client`-option delegation, Cache cluster id 145).
   Code-complete + reviewer-hardened, not yet runtime-tested. (jcardinal)

package/knowledge/INDEX.md

@@ -17,7 +17,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 
 ## 2.0 framework
 
-- **_underscore** (_Underscore) _(framework core)_ — 38 doc(s) → [2.0/apps/_underscore/INDEX.md](2.0/apps/_underscore/INDEX.md)
+- **_underscore** (_Underscore) _(framework core)_ — 39 doc(s) → [2.0/apps/_underscore/INDEX.md](2.0/apps/_underscore/INDEX.md)
 - **worker2** (Worker) — 31 doc(s) → [2.0/apps/worker2/INDEX.md](2.0/apps/worker2/INDEX.md)
 - **api2** (API) — 17 doc(s) → [2.0/apps/api2/INDEX.md](2.0/apps/api2/INDEX.md)
 - **dbchanges2** (Database Changes) _(framework core)_ — 3 doc(s) → [2.0/apps/dbchanges2/INDEX.md](2.0/apps/dbchanges2/INDEX.md)

package/knowledge/sessions/2026-07-27-true-79191-fulfill-ship-mhammontree.md

@@ -1,7 +1,7 @@
 ---
 type: session
 slug: true-79191-fulfill-ship
-title: TRUE-79191 Fulfill & Ship — package Units of Measure full-stack (shipped, verified) + local-env fixes
+title: TRUE-79191 Fulfill & Ship — Units of Measure shipped + verified, CodeRabbit review cleared, PRs up
 author: mhammontree
 repos: [dbchanges2, _underscore, api2, toga2-supply]
 framework: "2.0"
@@ -14,61 +14,58 @@ updated: 2026-07-27
 # Session: true-79191-fulfill-ship
 **Date:** 2026-07-27
 **Project/Repo:** toga2-supply (2.0) + _underscore / api2 / dbchanges2
-**Task:** Implement the package Units-of-Measure feature full-stack (dbchanges2 → _underscore models → api2 metadata → toga2-supply UI), verify save/retrieve locally, and prep deployment.
+**Task:** Ship package Units-of-Measure full-stack for Fulfill & Ship, verify save/retrieve, clear the CodeRabbit review, and get PRs up for deploy.
 
 ---
 
 ## What WORKED
-<!-- All verified this session -->
-- **dbchanges2 UoM migrations (4 files, committed d52f811 / 3d18971 / ceeb95d), applied + verified idempotent across all 11 local client DBs + Core_2:**
-  - `Client/2026-07-22a - MeasureUomColumns.sql` — `Measures.measureType ENUM('LENGTH','WEIGHT')` + `conversionFactorToBase DECIMAL(18,9)`; idempotent seed of **Inch** (LENGTH, factor 1) + **Pound** (WEIGHT, factor 1) via fixed v4-literal uuids + `NOT EXISTS` on slug.
-  - `Client/2026-07-22b - TrackingNumberMeasureIds.sql` — `lengthMeasureId` (governs length/width/height) + `weightMeasureId`; backfill existing rows → Inch/Pound (9605 rows on Growrk); then **hard FK constraints** (order: cols → backfill → FK). `ORDER BY id ASC` on backfill subqueries (defensive vs junk `slug='Text'` rows that exist in Compass/CompassCanada).
-  - `Core/2026-07-22a - MeasureUomRecordFields.sql` — RecordFields **2436** lengthMeasureId + **2437** weightMeasureId on tracking-numbers (MATCH/NULL, like shippingMethodId), **2438** measureType on measures (STRING, like signatureType).
-  - `Client/2026-07-22c - TrackingNumberMeasureIdsFieldPermission.sql` — write grants for the 2 FK fields (mirror **shippingMethodId**) + **read** grant for `measures.measureType` (mirror sibling **slug**).
-- **_underscore models (committed 77fae34c), linted + php-reviewer clean:** `Measure.php` (+`measureType` FIELD_CHAR, +`conversionFactorToBase` FIELD_DECIMAL); `TrackingNumber.php` (+`lengthMeasureId`/`weightMeasureId` `[FIELD_FOREIGNKEY, FIELDOPT_FOREIGNKEY_MODEL => '\_Model_Client_Measure']`).
-- **api2 — NO code change needed** (metadata-driven; confirmed zero refs to needsReturnLabel/signatureType). Fields exposed purely via Core RecordFields + Client ACL.
-- **toga2-supply frontend (commit e91f7029d, 10 files, `tsc --noEmit` clean):** two RHF selects fed by `GET /v2/measures` split client-side by `measureType`; FK write as **nested relation `{uuid}`** (`lengthMeasure`/`weightMeasure`, mirrors shippingCarrier — NOT scalar id); read field-selectors request `lengthMeasure`/`weightMeasure`; default Inch/Pound; Pending Shipments dimension unit from length symbol.
-- **End-to-end save/retrieve VERIFIED in DB:** new tracking number **9676** (SO 7221433 / NetSuite, created 2026-07-27 12:06) has `lengthMeasureId=1` (inch) / `weightMeasureId=2` (pound) — populated by the **frontend create payload** (proves real persistence: column defaults NULL, and the 07-22 backfill predates this row).
-- **Local-env fixes** (see failures section for why these were NOT our code): `pcre.jit=0` in php.ini; `Items.isFulfillable` column added to all 11 local client DBs.
-- Deployment doc `C:\WWW\TRUE-79191_deployment_order.md` updated with all 4 UoM migrations + notes.
+- **Package UoM full-stack — DONE, verified end-to-end.** `Measures.measureType` (ENUM LENGTH/WEIGHT) + `conversionFactorToBase`; seeded Inch/Pound (base, factor 1); `TrackingNumbers.lengthMeasureId`/`weightMeasureId` (+ hard FKs); backfill; Core RecordFields 2436-2438; Client ACL grants. `_underscore` Measure/TrackingNumber model fields. api2 = no code (metadata-driven). toga2-supply: two RHF selects fed by `GET /v2/measures` split by `measureType`; FK written as nested relation `{uuid}` (mirrors shippingCarrier).
+- **Verified in DB:** new tracking number 9676 (SO 7221433, created 2026-07-27) persisted `lengthMeasureId=1`/`weightMeasureId=2` from the frontend save (new row, post-backfill, columns default NULL → proves real save). Reopen rehydrates correctly.
+- **Empty-dropdowns bug FIXED:** `GET /v2/measures` omitted `measureType` because the field had no `AclFieldPermissions` grant — the V2 engine builds the GET output field list from AclFieldPermissions, so ungranted = omitted (READ, not just write). Granted `measureType` read by mirroring sibling `slug` per-client (dbchanges2 22c). Applied to all local clients; commit `ceeb95d`.
+- **CodeRabbit review cleared — 3 batches, all committed, tsc clean each time:**
+  - Batch 1 (`d1eba64af`, 10 findings): BasicTable stopPropagation; ShipmentItemsTable pure updater; EditShipmentForm editContext guard + edit-mode validation; updateShipment null-safe derefs + step-identifying failures; ReturnShippingModal spans→buttons; SelectReturnAddressModal radio semantics + radiogroup; dedup field id; stale-comment removals.
+  - Batch 2 (`ba611989a`): `validateFormOnSubmit`/`checkDimensions` now RETURN a fresh boolean; caller branches on it (not the stale RHF `errors` snapshot) so the FIRST submit is blocked on invalid fields.
+  - Batch 3 (`e0942cb4f`): `checkDimensions` now clears errors when all L/W/H present (previously no all-present branch → a flagged dimension never cleared → permanent submit block).
+- **Local env unblocked earlier:** `pcre.jit=0` (JIT/Sentry bootstrap 500-every-route); `Items.isFulfillable` column added to all local client DBs (model pulled ahead of local schema).
+- **Deployment order doc updated** (`C:\WWW\TRUE-79191_deployment_order.md`) with the 4 UoM migrations + notes. **PRs are up.**
 
 ## What did NOT work — DO NOT RETRY THESE
-- **First `22c` mirrored `needsReturnLabel` for the measure-field WRITE grants** → on `Client_True` it granted **nothing** (needsReturnLabel's own grants never propagated to every client). Writing lengthMeasureId/weightMeasureId there would return **EV-9**. FIX: mirror **`shippingMethodId`** (stable, universal, MATCH FK, same form) — it correctly copies each client's own writer roles (Growrk=1, Compass=1,3,4).
-- **Skipped granting `measures.measureType`** (assumed read-only fields need no ACL) → **WRONG.** The V2 engine builds each GET's **output** field list from `AclFieldPermissions` (`getAclFieldPermissions` + `foreach ($aclFieldPermissions as $field)` output loops in `V2.php`), so a field with no grant row for the caller's role is **silently omitted**. `GET /v2/measures` returned rows without `measureType` → the frontend LENGTH/WEIGHT split matched nothing → **both unit dropdowns rendered empty**. FIX: grant `measureType` read by mirroring sibling `slug` per-client (in `22c`).
-- **`sales-orders` 500 was NOT our UoM code** — two stacked local-env issues: (a) `preg_split(): Allocation of JIT memory failed` at `Sentry\init()` bootstrap (PCRE JIT can't allocate executable memory on this Win Enterprise machine); the framework escalates the warning to a fatal, 500-ing **every** request → FIX `pcre.jit=0` + restart Apache. Then (b) DB error **1054 Unknown column 'isFulfillable'** — the prod sync brought the updated `_Model_Client_Item` but not the `2026-07-17` migration → FIX add the column locally.
-- **Do NOT re-run `Client/2026-07-22b` after go-live** — the backfill is one-time; a re-run coerces later legitimately-NULL rows to Inch/Pound (column + FK adds are guarded, the backfill is not re-run-safe).
-- `FIELD_LIST` for measureType — rejected; `FIELD_CHAR` is correct (FIELD_LIST is reserved for fields with explicit class constants; signatureType precedent).
+- **Assuming read-only fields need no ACL grant** — WRONG. V2 builds GET output from `AclFieldPermissions`; a field with no grant row for the caller's role is silently omitted from the response (not just blocked on write). measureType needed a read grant. See `_underscore/features/acl-permission-chain.md`.
+- **Mirroring `needsReturnLabel` for measure-field write grants** — its grants aren't present in every client (Client_True had none) → measure fields ungranted there → EV-9. Mirror **`shippingMethodId`** (stable/universal).
+- **Branching on the RHF `errors` snapshot right after `setError`** — it lags one render, so the first submit slips through. Validation helpers must RETURN a fresh result and the caller must branch on that. Also the helper must `clearErrors` on the valid path or stale errors block submit forever.
+- **Chasing the sales-orders 500 as feature code** — it was `pcre.jit` (bootstrap) then `Items.isFulfillable` missing column (local DB behind on migrations). Not our code.
+- **Re-running `Client/2026-07-22b` after go-live** — one-time backfill; a re-run coerces later NULL rows to Inch/Pound.
 
 ## Not tried yet (candidates for next session)
-- **Deploy** TRUE-79191 (deployment order doc is ready) — the actual go-live.
-- Seed **cm/kg** into a client (metric, per-client opt-in) to exercise multi-option dropdown — offered, not done (Growrk currently US-only, so saved value == default value visually).
-- **Full local DB migration catch-up / reset from beta** — drift scan found **16 genuine missing columns** in unrelated tables (TransferOrders, Cases, Questions, TicketSlas, Persona/Language/User RecordFieldSettings, Integrations, Bills, SectionRecordFields) — none in the fulfill/ship path. (5 more "missing" were FIELD_STORAGE false positives: labelPdfFile, imageFile, invoicePdfFile, Files.data, fileData.)
-- Make the **weight symbol on Pending Shipments cards dynamic** (currently static `"lbs."`; TODO in ShipmentsCardTableForm; weightMeasure.symbol already fetched).
-- Register `isFulfillable` RecordField/interceptors locally (skipped — id-2434 collision).
+- **Deploy** TRUE-79191 (DB → backend → frontend per the deployment doc). Before prod DB step: verify `MAX(Core.RecordFields.id)=2435` (else bump the 2436-2438 ids in `Core/2026-07-22a`); `composer install` api2 (FPDF) + prod carrier config; flag the unrelated `isFulfillable` migration `id=2434` collision to its owner.
+- Monitor CodeRabbit for further findings on the updated diff.
+- Seed cm/kg into a client (metric, per-client) to exercise the multi-option dropdown.
+- Full local DB migration catch-up / reset from beta (drift scan: 16 genuine missing columns in unrelated tables; none block fulfill/ship).
+- Weight symbol on Pending Shipments cards is static `"lbs."` (TODO — dynamic from weightMeasure.symbol).
+- The submit caller still keeps `|| actualErrors.length > 0` (RHF snapshot) as a secondary guard covering create-mode serial errors from `formatShipmentData` (which doesn't return a hasErrors signal). If CodeRabbit flags it, give `formatShipmentData` a return value and drop the snapshot OR.
 
 ## Current file state
 | File | Status | Notes |
 |------|--------|-------|
-| dbchanges2 Client 2026-07-22a/b/c, Core 2026-07-22a | committed (d52f811/3d18971/ceeb95d), applied to all 11 local clients + Core_2 | UoM schema + seed + backfill + FK + RecordFields + ACL |
-| _underscore Model/Client/Measure.php, TrackingNumber.php | committed (77fae34c) | UoM model fields; survived prod merges |
-| toga2-supply (10 src files) | committed (e91f7029d) | UoM UI; .env/.env.development/package-lock intentionally uncommitted |
-| api2 | no changes | metadata-driven; only untracked local Config/dev-*.ini |
-| C:\WWW\TRUE-79191_deployment_order.md | updated (external) | UoM migrations + notes added |
-| Local: php.ini pcre.jit=0; all client Items.isFulfillable column | applied (local env only) | NOT repo changes; beta/prod unaffected |
+| toga2-supply | committed + PR up | commits: e91f7029d (UoM UI), d1eba64af (CR batch 1), ba611989a (CR batch 2), e0942cb4f (CR batch 3). .env/.env.development/package-lock intentionally uncommitted |
+| dbchanges2 | committed + PR up | UoM 4 files incl. 22c measureType read grant (ceeb95d) |
+| _underscore | committed + PR up | Measure/TrackingNumber UoM model fields (77fae34c) |
+| api2 | no changes | metadata-driven |
+| C:\WWW\TRUE-79191_deployment_order.md | updated (external) | UoM migrations + notes |
+| Local DBs | migrated (local only) | all clients: UoM + isFulfillable; Core_2 RecordFields 2436-2438 + measureType; php.ini pcre.jit=0 |
 
 ## Decisions made
-- **Columns `lengthMeasureId` + `weightMeasureId`** (not dimension/volume); **volume dropped entirely** (Jeff). One length unit governs length/width/height.
-- **Reuse Measures + `measureType` enum, zero new tables**; base units Inch/Pound; `conversionFactorToBase` convention `value_in_base = value × factor`. (Two-table alternative rejected by Jeff.)
-- **Hard FK constraints** (Jeff "+ FKs"; values fully controlled via seed+backfill; matches `UnitTypes.sql` precedent) — rejected logical-only (returnAddressId precedent).
-- **Mirror `shippingMethodId`** for write grants (universal/stable), **mirror `slug`** for measureType read grant — rejected needsReturnLabel (incomplete propagation).
-- **`pcre.jit=0` is a local-only env fix**, not code — beta/prod PHP permits JIT, so nothing to ship.
-- **isFulfillable: add column only locally**, skip RecordField (its migration hardcodes `id=2434`, colliding with returnAddressId `2026-07-10a` also 2434 — flag to that feature's owner).
+- Columns `lengthMeasureId`/`weightMeasureId` (volume dropped); reuse Measures + `measureType` enum, zero new tables; base Inch/Pound; hard FK constraints.
+- Mirror `shippingMethodId` for write grants, `slug` for measureType read grant (per-client role adaptation).
+- FIELD_CHAR for measureType (matches signatureType).
+- RHF validation: helpers RETURN a fresh boolean; caller branches on it; helpers clear on the valid path.
+- pcre.jit=0 and isFulfillable column are LOCAL env fixes only (not shipped).
 
 ## Blockers
-None blocking. Ready to deploy. **Before running `Core/2026-07-22a` in production, verify `SELECT MAX(id) FROM Core.RecordFields = 2435`** — the migration hardcodes ids 2436-2438; if the sequence advanced, bump them.
+None. Ready to deploy. Verify prod `MAX(Core.RecordFields.id)=2435` before running `Core/2026-07-22a`.
 
 ## Exact next step
-> Deploy TRUE-79191 per `C:\WWW\TRUE-79191_deployment_order.md` (order: DB → backend → frontend). First confirm prod `MAX(Core.RecordFields.id) = 2435` (else bump the 2436-2438 ids in `Core/2026-07-22a`), run `composer install` on api2 (FPDF) + apply production carrier config, and separately flag the unrelated `isFulfillable` migration's `id=2434` collision to its owner.
+> Deploy TRUE-79191 per `C:\WWW\TRUE-79191_deployment_order.md` (DB → backend → frontend), after confirming prod `MAX(Core.RecordFields.id)=2435`, running api2 `composer install`, and applying prod carrier config. Keep monitoring CodeRabbit on the PRs and address any new findings the same way (verify → minimal fix → tsc → commit).
 
 ---
 _Saved by /session-save on 2026-07-27_

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.447",
+  "version": "1.0.449",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",