toga-ai 1.0.593 → 1.0.595

package/knowledge/2.0/apps/toga-blox/features/table.md

@@ -96,7 +96,10 @@ Per-column header controls, each a popover trigger with `data-active` / `data-op
   is hidden while the input is focused; both the trigger button and the icon span carry
   `data-active`. The clear button must not widen the input row (fixed-width menu).
 - **`HeaderFilterRange`** — numeric, modes exactly/moreThan/lessThan + a range toggle
-  (min/max); emits `{ key, value }[]` (`eq`/`min`/`max`/`between`).
+  (min/max); emits `{ key, value }[]` (`eq`/`min`/`max`/`between`). Reads its persisted
+  operator/values back from a `filterParams` prop (not `filterValue`, which collapses to the
+  literal `"active"` when a range filter is set); `PrimaryTableHeaderCell` must pass
+  `filterParams` through.
 - **`HeaderFilterMultiselect`** — checkbox list with "Select All"; emits comma-joined slugs.
 - **`HeaderFilterDate`** — calendar picker, modes exactly/before/after + range; converts
   `MM/DD/YYYY` ↔ URL `YYYY-MM-DD`; calendar + mode dropdown both portalled.
@@ -148,12 +151,31 @@ Per-column header controls, each a popover trigger with `data-active` / `data-op
   never for data fetching. A visible column can still *look* missing when `shrinkColumns` freezes
   it to a tiny width because its measured header+body content is minimal (see
   [primary-table-templates](primary-table-templates.md)).
+- **Filter presentational components must seed their internal mode/value state from props.**
+  The filter mode/operator survives the URL round-trip — it is persisted as a URL key suffix
+  (`_starts`/`_ends`/`_eq`/`_excludes` for text; `_min`/`_max`/`_eq`/`_between` for range),
+  rehydrated into TanStack `columnFilters` by toga25-supply `useServerTableUrlState`, and
+  carried through `PrimaryTableHeaderCell`. But `HeaderFilterSearch`/`HeaderFilterRange` are
+  remounted fresh each time a filter popover opens, so if they don't seed local state from
+  their props (`filterMode` / `filterParams`) they hard-default (`includes` for text,
+  `exactly` for range) and reopening a filter *shows the wrong mode* even though the applied
+  filter is correct. Fixed via a `useEffect` seeding `filterMode` from `filterModeProp` in
+  `HeaderFilterSearch`, and a rehydration effect keyed on `JSON.stringify(filterParams)` in
+  `HeaderFilterRange` that reconstructs mode + value(s) from the operator keys
+  (`eq`→Exactly, `min`→MoreThan, `max`→LessThan, `between`→range min/max).
 - **Table/surface meta is cached with `Infinity` staleTime/gcTime** (`useFetchTablePageMeta`), so
   after a DB metadata change (`TableViewFields`, `Core.RecordFields`) a **hard reload** is required
   to see it. And the app consumes toga-blox's built **`dist/`**, not `src/` — editing blox source
   requires `npm run build` before it takes effect at runtime.
 
 ## Change history
+- 2026-08-17 — Fixed: column filter **mode** was not restored when a filter popover was reopened
+  (text reverted to `includes`, range to `exactly`). Root cause: the URL round-trip and
+  `PrimaryTableHeaderCell` preserved the mode, but `HeaderFilterSearch` (destructured
+  `filterMode` as `filterModeProp` and never used it) and `HeaderFilterRange` (received no
+  operator info) never seeded internal state from props. Seeded both from props; added a
+  `filterParams` prop to `HeaderFilterRange` and passed it through `PrimaryTableHeaderCell`.
+  (apeterson)
 - 2026-08-17 — Added gotchas on meta→column mapping: field `type`/`precision` come from
   `Core.RecordFields` (not per-view) while `isCopyable`/`isVisible`/`isSortable`/`isFilterable` are
   per-view; `isVisible` is the only column gate; `accessorFn` dot-walks and needs the join;

package/knowledge/2.0/apps/toga2-commerce/INDEX.md

@@ -16,3 +16,4 @@
 | [Order-submit sync sequencing (useSubmitOrder) — why these calls must not run in parallel](features/order-submit-sync-sequencing.md) | Submitting an order from the cart fires **two independent sync routines** — one for the sales-order header (`syncSalesOrderData`) and one for the line items (`s | toga2-commerce/src/pages/OrderDetails/hooks/useSubmitOrder.ts, toga2-commerce/src/api/syncSalesOrdersDataFromLocalStorageCartToApi.ts, toga2-commerce/src/api/syncSalesOrderItemsFromLocalStorageCartToApi.ts |
 | [AWS Amplify Build & Deploy (non-prod environments)](workflows/amplify-build-and-deploy.md) | How `toga2-commerce` (React + Vite, "commerce2-react") builds and deploys on **AWS Amplify**. | toga2-commerce/amplify.yml, toga2-commerce/.gitattributes, toga2-commerce/package.json, toga2-commerce/.github/workflows/sync-stage-environments.yml |
 | [Cart e2e — Cypress conventions & harness (toga2-commerce)](workflows/cypress-testing.md) | The Cypress **e2e** convention set for `toga2-commerce`, and the first **active** e2e coverage for the **Cart** page (`cartV2.cy.ts`, slice 1 — 12 tests, verifi | toga2-commerce/cypress/e2e/cartPage/cartV2.cy.ts, toga2-commerce/cypress/fixtures/cart/fetchSingleUserAdmin.json, toga2-commerce/cypress/fixtures/cart/fetchLocations.json, toga2-commerce/cypress/fixtures/cart/fetchUserShippingMethods.json, toga2-commerce/cypress/support/commands.ts, toga2-commerce/cypress/support/e2e.ts, toga2-commerce/src/pages/Cart/CartPage.tsx, toga2-commerce/src/pages/Cart/view/cartForm/CartForm.tsx, toga2-commerce/src/pages/Cart/view/cartForm/CartFormSection.tsx, toga2-commerce/src/pages/Cart/view/cartTable/CartContentsTable.tsx, toga2-commerce/src/pages/Cart/view/cartTable/CartTableItem.tsx, toga2-commerce/src/components/Inputs/AdvancedInput.tsx, toga2-commerce/src/components/BaseButton/BaseButton.tsx |
+| [Diagnosing ERR_HTTP2_PROTOCOL_ERROR (one client fails, everyone else is fine)](workflows/http2-protocol-error-diagnosis.md) | When a Chromium browser (Chrome / Edge) shows **`ERR_HTTP2_PROTOCOL_ERROR`** loading a `*.togacommerce.com` tenant for **one client/network but works for the TO |  |

package/knowledge/2.0/apps/toga2-commerce/workflows/http2-protocol-error-diagnosis.md

@@ -0,0 +1,83 @@
+---
+title: Diagnosing ERR_HTTP2_PROTOCOL_ERROR (one client fails, everyone else is fine)
+framework: "2.0"
+repo: toga2-commerce
+project: TOGa Commerce
+client: shared
+type: workflow
+status: active
+updated: 2026-08-17
+owners: ["jcardinal"]
+files: []
+related:
+  - ../../../clients/prudential/workflows/http2-alb-workaround.md
+  - ../architecture.md
+---
+
+## Summary
+
+When a Chromium browser (Chrome / Edge) shows **`ERR_HTTP2_PROTOCOL_ERROR`** loading a
+`*.togacommerce.com` tenant for **one client/network but works for the TOGA team and everyone
+else**, the cause is almost always the **client's corporate TLS-inspection proxy / secure web
+gateway mangling HTTP/2 framing** — NOT our code and NOT a bad deploy. HTTP/2 is terminated at
+the **Application Load Balancer** (there is **no CloudFront/CDN** in front — tenant subdomains
+are direct aliases to the `true-togacommerce-prod` EB environment's ALB), so the ALB is the
+single negotiation point and the lever. This doc captures the reasoning and the tools so the
+next dev doesn't re-derive it or chase a false code/deploy lead.
+
+## Step 1 — Network-vs-content test (do this first)
+
+Load the same failing URL on a **phone over CELLULAR** (off the corporate Wi-Fi):
+- **Works on cellular** → the failure is **network-dependent = the client's proxy**. Stop
+  suspecting our code. A coincidental deploy on the failure date is **not** the cause.
+- **Also fails on cellular** → the failure is **content-dependent** (our output). Look for a
+  response-corrupting bug — e.g. a stray trailing `?>` plus a newline in a PHP file emitting
+  bytes after the response body, which can break strict HTTP/2. That is a real code cause and a
+  different investigation.
+
+This one test cleanly separates "their proxy" from "our bytes."
+
+## Step 2 — Prove the HTTP/2 state without a browser
+
+Local `curl` often lacks HTTP/2 support (no `nghttp2` build), so `curl --http2` is unreliable.
+Use openssl ALPN instead:
+
+```
+echo | openssl s_client -connect <host>:443 -servername <host> -alpn h2,http/1.1 2>/dev/null | grep -i ALPN
+```
+
+- `ALPN protocol: h2` → HTTP/2 is **ON** (ALB advertises `h2`).
+- `No ALPN negotiated` (when `h2` was offered first) → HTTP/2 is **OFF** (ALB no longer
+  advertises `h2`).
+
+Also: browser DevTools → Network → enable the **Protocol** column → shows `h2` vs `http/1.1`
+per request.
+
+## Step 3 — The lever: ALB `routing.http2.enabled`
+
+- It is an **AWS Application Load Balancer attribute**, all-or-nothing — there is **no
+  per-client / per-tenant option**. With no CDN in front, the ALB is the negotiation point.
+- Setting `routing.http2.enabled=false` makes the ALB negotiate **HTTP/1.1 only for every
+  client** on that environment. The app already speaks HTTP/1.1 to the EC2 instances, so **no
+  application code affects this**.
+- The change is **global** (every `togacommerce.com` tenant on the env, a modest perf trade)
+  and **instantly reversible** (`Value=true`). Disabling it is both the fast, we-control-it
+  workaround and the proof of diagnosis.
+
+Environment reference (for `true-togacommerce-prod`): region `us-west-2`, account
+`502614707982`, ALB `awseb-AWSEB-1N7AC3UGUONUM`. Note ALB **access logs may be disabled**, in
+which case there is no retroactive request evidence — the phone test and openssl check are your
+evidence.
+
+## Step 4 — Preferred permanent fix is on the client side
+
+The clean end-state is the **client's IT** bypassing TLS inspection / allowlisting
+`*.togacommerce.com`, or configuring their gateway to fall back to HTTP/1.1. Once they do, we
+**re-enable HTTP/2** on the ALB. Disabling ALB HTTP/2 is the interim workaround, not the goal.
+
+## Change history
+- 2026-08-17 — Documented from the Prudential `ERR_HTTP2_PROTOCOL_ERROR` incident: phone/cellular
+  network-vs-content test, openssl ALPN check, and the ALB `routing.http2.enabled` lever (no CDN
+  in front of `true-togacommerce-prod`). (jcardinal)
+</content>
+</invoke>

package/knowledge/INDEX.md

@@ -29,7 +29,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **talos** (TOGa IQ) — 7 doc(s) → [2.0/apps/talos/INDEX.md](2.0/apps/talos/INDEX.md)
 - **voice-to-voice** (TOGa Voice) — 4 doc(s) → [2.0/apps/voice-to-voice/INDEX.md](2.0/apps/voice-to-voice/INDEX.md)
 - **ai-bdr** (AI-BDR) — 9 doc(s) → [2.0/apps/ai-bdr/INDEX.md](2.0/apps/ai-bdr/INDEX.md)
-- **toga2-commerce** (TOGa Commerce) — 15 doc(s) → [2.0/apps/toga2-commerce/INDEX.md](2.0/apps/toga2-commerce/INDEX.md)
+- **toga2-commerce** (TOGa Commerce) — 17 doc(s) → [2.0/apps/toga2-commerce/INDEX.md](2.0/apps/toga2-commerce/INDEX.md)
 - **toga25-supply** (TOGa 2.5 Supply) — 11 doc(s) → [2.0/apps/toga25-supply/INDEX.md](2.0/apps/toga25-supply/INDEX.md)
 - **toga-blox** (TOGa Blox) — 9 doc(s) → [2.0/apps/toga-blox/INDEX.md](2.0/apps/toga-blox/INDEX.md)
 - **bdr** (BDR) — 0 doc(s) → [2.0/apps/bdr/INDEX.md](2.0/apps/bdr/INDEX.md)

package/knowledge/clients/prudential/INDEX.md

@@ -10,3 +10,4 @@
 | [Prudential Order Shipped Email — transmit_ordershipped_updates_prudential.php](features/transmit-ordershipped-email.md) | 1.0 | Cron script that transmits "Order Shipped" updates to ServiceNow (RITM) and sends a shipped notification email to the end user. | worker/crons/toga2/prudential/transmit_ordershipped_updates_prudential.php, worker/crons/toga2/prudential/transmit_closecomplete_updates_prudential.php, worker/crons/toga2/prudential/transmit_rejected_cancelled_updates_prudential.php, worker/crons/toga2/prudential/generate_sales_and_purchase_orders_from_service_requests.php, worker/crons/toga2/prudential_beta/generate_sales_and_purchase_orders_from_service_requests.php, worker/crons/notifications/reports/prudential_exception_report.php |
 | [Prudential Financial](profile.md) | 2.0 | Prudential is a TOGA client whose device-fulfillment flow is driven by **Dell** via the Dell API (`Client_Prudential.Apis.id = 2`). |  |
 | [Prudential: Dell ASN failed POST backfill replay](workflows/dell-asn-backfill-replay.md) | 2.0 | When Dell ASN POSTs fail in bulk (e.g. |  |
+| [Prudential — HTTP/2 disabled on the Commerce ALB (proxy workaround) + open re-enable action](workflows/http2-alb-workaround.md) | 2.0 | Prudential users hit **`ERR_HTTP2_PROTOCOL_ERROR`** in Chrome and Edge (both Chromium) loading `https://prudential.togacommerce.com`, while the site worked fine |  |

package/knowledge/clients/prudential/profile.md

@@ -9,11 +9,12 @@ apps:
   - worker
   - worker2
   - library
+  - toga2-commerce
 project: _Underscore
 client: prudential
 type: profile
 status: active
-updated: 2026-07-28
+updated: 2026-08-17
 owners: ["jcardinal", "rgirish", "bala"]
 files: []
 related:
@@ -22,6 +23,7 @@ related:
   - features/service-request-rejection-alert-email.md
   - features/dell-lch-iop-transmissions.md
   - features/device-information-import-and-contact-linking.md
+  - workflows/http2-alb-workaround.md
 ---
 
 ## Summary
@@ -61,6 +63,10 @@ order-status transmissions.
 `ServiceRequests.serviceRequestTypeId`: **1 = New Hire, 2 = Breakfix, 3 = Refresh, 5 = Reclaim**.
 
 ## Gotchas
+- **Commerce (`prudential.togacommerce.com`):** Prudential's corporate TLS-inspection proxy
+  breaks HTTP/2, causing `ERR_HTTP2_PROTOCOL_ERROR` in Chrome/Edge. HTTP/2 is currently disabled
+  globally on the `true-togacommerce-prod` ALB as a workaround — **open action to re-enable once
+  their IT fixes the proxy.** See workflows/http2-alb-workaround.md.
 - Dell will not change their payload shape — see the Dell ASN units interceptor feature doc for the
   PRE/POST translation that keeps their feed working after the tracking-number bridge migration.
 - Service request region is resolved from `Customers.name` string (`'USA'`/`'India'`/`'Ireland'`).

package/knowledge/clients/prudential/workflows/http2-alb-workaround.md

@@ -0,0 +1,55 @@
+---
+title: Prudential — HTTP/2 disabled on the Commerce ALB (proxy workaround) + open re-enable action
+framework: "2.0"
+repo: toga2-commerce
+project: TOGa Commerce
+client: prudential
+type: workflow
+status: active
+updated: 2026-08-17
+owners: ["jcardinal"]
+files: []
+related:
+  - ../../../2.0/apps/toga2-commerce/workflows/http2-protocol-error-diagnosis.md
+  - ../profile.md
+---
+
+## Summary
+
+Prudential users hit **`ERR_HTTP2_PROTOCOL_ERROR`** in Chrome and Edge (both Chromium) loading
+`https://prudential.togacommerce.com`, while the site worked fine for the TOGA team. Root cause:
+**Prudential's corporate network runs a TLS-inspection proxy / secure web gateway that mangles
+HTTP/2 framing.** Proven by loading the same URL on the user's phone over **cellular** (off
+corporate Wi-Fi) — it worked, so the failure is network-dependent, ruling out a code/content
+cause and a coincidental same-day deploy.
+
+## Current state (as of 2026-08-17)
+
+- **HTTP/2 is turned OFF globally** on the `true-togacommerce-prod` Application Load Balancer
+  (`routing.http2.enabled=false`), so the ALB negotiates **HTTP/1.1 only for all clients** on
+  that environment. This immediately fixed Prudential and was **confirmed fixed by the client**.
+- This is a **global** setting (all `togacommerce.com` tenants on the env, a modest perf trade)
+  and **instantly reversible** — there is no per-client option because the ALB is the single
+  HTTP/2 negotiation point (no CDN in front).
+
+## ⚠ OPEN ACTION — re-enable HTTP/2
+
+The intended end-state is for **Prudential's IT to fix their proxy** (allowlist / bypass TLS
+inspection for `*.togacommerce.com`, or configure the gateway to fall back to HTTP/1.1), and
+then **re-enable HTTP/2 on the ALB** (`routing.http2.enabled=true`). Until that happens, HTTP/2
+stays OFF for every togacommerce tenant on `true-togacommerce-prod`. Do not forget this — it is
+a live workaround, not the final state.
+
+## Reference
+
+- Env `true-togacommerce-prod`, region `us-west-2`, account `502614707982`, ALB
+  `awseb-AWSEB-1N7AC3UGUONUM`. ALB access logs were disabled during the incident (no retroactive
+  request evidence).
+- Full diagnostic reasoning (phone/cellular test, openssl ALPN check, the ALB lever) is the
+  reusable Commerce workflow: `2.0/apps/toga2-commerce/workflows/http2-protocol-error-diagnosis.md`.
+
+## Change history
+- 2026-08-17 — Disabled HTTP/2 on the `true-togacommerce-prod` ALB to work around Prudential's
+  corporate TLS-inspection proxy breaking HTTP/2; client confirmed fixed. Open action: re-enable
+  once Prudential's IT fixes their proxy. (jcardinal)
+</content>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.593",
+  "version": "1.0.595",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",