toga-ai 1.0.654 → 1.0.656

package/knowledge/2.0/apps/_underscore/features/acl-permission-chain.md

@@ -65,6 +65,13 @@ writable). Without it the field is rejected on write **and** is unreadable:
   VISIBILITY too.** Concrete symptom (TRUE-79191): `Measures.measureType` was registered but ungranted,
   so it came back absent and the frontend unit dropdowns were empty. When a field renders blank with no
   error, check for a missing `AclFieldPermissions` grant before suspecting the selector or the data.
+- **⚠ Sibling columns of the SAME table routinely carry DIFFERENT role sets, so verify per field
+  before you add one to a `fields=` list — and verify as the LEAST-privileged role.** Concrete case
+  (`Client_Quad.Currencies`, 2026-08-26): `code` (1424) and `symbol` (1425) are granted to roles
+  1/7/8/9, but `position` (1997) only to 7/8/9. Adding `currency.position` to an existing read would
+  have 403'd the **whole** request for every user holding only role 1 — while working perfectly for a
+  developer whose own account also carries role 7. **A dev/admin account hides this class of bug
+  completely**; a "just one more field" addition is a permission change, not a display change.
 - **`AclFieldPermissions` is `UNIQUE (recordFieldId, roleId)`** (Client blank DDL) — guard inserts
   with `NOT EXISTS`. For a **read-only, server-written** field (one populated by a `postPost`
   interceptor rather than the API caller), grant `isWritable = 0`.
@@ -403,6 +410,12 @@ hardcoded `Core.RecordFields` id literals instead of a subselect.
       and every repo is on the **same branch** so the generated model matches the DB.
 
 ## Change history
+- 2026-08-26 - Added the **verify-per-sibling-field, verify-as-the-least-privileged-role** rule:
+  columns of the same table often carry different role sets, so adding one more field to a `fields=`
+  list is a permission change. `Client_Quad.Currencies` grants `code` (1424) and `symbol` (1425) to
+  roles 1/7/8/9 but `position` (1997) only to 7/8/9, so requesting `currency.position` would have
+  403'd the whole read for role-1-only users while looking fine to a developer who also holds role 7 -
+  a dev/admin account hides this class of bug entirely. (bala)
 - 2026-08-26 - Added the **action-flag gate** (`Core.AclActions` + `Client_*.AclActionPermissions`),
   a third gate alongside record CRUD and record scripts: `Page.php` (~L1285-1302) defaults every
   action flag to `false` and only a matching `AclActionPermissions` row flips it true, so a missing

package/knowledge/2.0/apps/_underscore/features/apirequest-json-content-type.md

@@ -6,8 +6,8 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-07-28
-owners: ["jcardinal"]
+updated: 2026-08-26
+owners: ["jcardinal", "ajean"]
 files:
   - _underscore/ApiRequest.php
 related:
@@ -74,7 +74,33 @@ case-insensitive scan of already-set headers, so a caller-supplied `Content-Type
   save) lives **inside `execute()`** and would affect every framework caller, so it is deferred
   pending architecture review. Do **not** work around it per-caller.
 
+- **Hand-rolled `Logs.Api` inserts must set `isAuthRequest`, `instanceId` and `hostname` — they are
+  NOT NULL with no defaults.** `_ApiRequest`'s own logging sets all three (`ApiRequest.php:260-264`),
+  so a helper that writes its own log row while only setting `direction`/`source`/`method`/`route`
+  throws `Column 'X' cannot be null` on **every** insert. Because such helpers are usually a
+  *wrapper* around the real call, the throw propagates out of the wrapped call and, under a
+  `catch(Throwable)`, turns the whole feature into a **silent no-op that still reports success**.
+  Two worker2 handlers shipped with exactly this bug and one went unnoticed for months — see
+  [netsuite-opportunity-sync](../../worker2/features/netsuite-opportunity-sync.md#gotchas--known-issues).
+  Prefer letting `_ApiRequest` log rather than writing `Logs.Api` by hand.
+- **⚠ Auto-logging persists the `Authorization` header in PLAINTEXT.** `ApiRequest.php:267` writes
+  the full request headers to `Logs.Api.requestHeaders`, so any component that sends a bearer
+  token/API key and does not `setLogging(false)` is depositing that credential into the logs DB on
+  every call. Known live instance: `_underscore/Component/Api/Clickup/Clickup.php` (which also
+  **hardcodes** its token in committed source — flagged for a rotate-and-move-to-config ticket; 11
+  worker2 files use it). When adding a new component, decide deliberately: log and accept the header
+  exposure, strip/redact the auth header before the call is logged, or `setLogging(false)`.
+- **`Logs.Api` is 1.4M+ rows and `source` is NOT indexed.** Any diagnostic query must be bounded by
+  `dtStamp` (indexed) or it times out — `WHERE source = '…'` alone will not return.
+
 ## Change history
+- 2026-08-26 — Documented the **manual-insert column contract** (`isAuthRequest`, `instanceId`,
+  `hostname` are NOT NULL with no defaults, and `_ApiRequest` sets them at `ApiRequest.php:260-264`),
+  after a hand-rolled `logged()` helper in two worker2 handlers threw on every insert and silently
+  no-op'd an entire feature behind a `catch(Throwable)`. Also recorded that auto-logging persists the
+  **`Authorization` header in plaintext** into `Logs.Api.requestHeaders` (`ApiRequest.php:267`) — the
+  reason `_Component_Api_Clickup`'s hardcoded token needs rotation — and that `Logs.Api.source` is
+  unindexed at 1.4M+ rows, so queries must be bounded by `dtStamp`. (ajean)
 - 2026-08-05 — Documented (no code change) that the `direction = 'OUT'` api-log row is
   **committed immediately** inside `execute()` (`transactionCommit(DB_CLIENT_LOGS)`), so it
   survives a later rollback and `Logs_<Client>.Api` is definitive evidence of whether an outbound

package/knowledge/2.0/apps/toga-blox/INDEX.md

@@ -7,8 +7,9 @@
 | [AdvancedSelect (virtualized single/multi select)](features/advanced-select.md) | `AdvancedSelect<T>` is a **fully controlled, virtualized** single/multi select built from scratch (not react-select) on **`@tanstack/react-virtual`**, for large | toga-blox/src/components/AdvancedSelect/AdvancedSelect.tsx, toga-blox/src/components/AdvancedSelect/AdvancedSelect.types.ts, toga-blox/src/components/AdvancedSelect/AdvancedSelect.module.css |
 | [API client (axios wrapper, auth, table-data fetchers)](features/api-client.md) | `src/api/` is a thin **axios** wrapper that standardizes the **2.0 API envelope**, manages auth (Bearer + refresh), serializes complex query options, and provid | toga-blox/src/reactQuery/queryHelpers.ts, toga-blox/src/api/index.ts, toga-blox/src/api/axiosInstance.ts, toga-blox/src/api/apiFunctions.ts, toga-blox/src/api/auth.ts, toga-blox/src/api/genericApi.ts, toga-blox/src/api/types.ts, toga-blox/src/api/tableData |
 | [BaseInput (react-hook-form field factory)](features/base-input.md) | `BaseInput` is a **form-field factory** driven by react-hook-form. | toga-blox/src/components/BaseInput/BaseInput.tsx, toga-blox/src/components/BaseInput/BaseInput.types.ts, toga-blox/src/components/BaseInput/BaseInput.module.css, toga-blox/src/components/BaseInput/components |
-| [Primary Table templates (server/client, sizing, virtualization)](features/primary-table-templates.md) | `src/templates/PrimaryTable/` is the **production, wired-up table** built on the [Table component](table.md). | toga-blox/src/templates/PrimaryTable/PrimaryTable.tsx, toga-blox/src/templates/PrimaryTable/PrimaryTableServerTemplate.tsx, toga-blox/src/templates/PrimaryTable/PrimaryTableClientTemplate.tsx, toga-blox/src/templates/PrimaryTable/PrimaryTableHeaderCell.tsx, toga-blox/src/templates/PrimaryTable/PrimaryTableBodyCell.tsx, toga-blox/src/templates/PrimaryTable/PrimaryTableRow.tsx, toga-blox/src/templates/PrimaryTable/PrimaryTableExpandableRow.tsx, toga-blox/src/templates/PrimaryTable/types.ts |
+| [Primary Table templates (server/client, sizing, virtualization)](features/primary-table-templates.md) | `src/templates/PrimaryTable/` is the **production, wired-up table** built on the [Table component](table.md). | toga-blox/src/components/Table/themeConfig/toga.module.css, toga-blox/src/templates/PrimaryTable/PrimaryTable.tsx, toga-blox/src/templates/PrimaryTable/PrimaryTableServerTemplate.tsx, toga-blox/src/templates/PrimaryTable/PrimaryTableClientTemplate.tsx, toga-blox/src/templates/PrimaryTable/PrimaryTableHeaderCell.tsx, toga-blox/src/templates/PrimaryTable/PrimaryTableBodyCell.tsx, toga-blox/src/templates/PrimaryTable/PrimaryTableRow.tsx, toga-blox/src/templates/PrimaryTable/PrimaryTableExpandableRow.tsx, toga-blox/src/templates/PrimaryTable/types.ts |
 | [TableRecordModal (record-detail modal shell)](features/table-record-modal.md) | `TableRecordModal` is a **generic, presentational modal shell** for showing a single table record (row) in detail — typically opened from a table row click. | toga-blox/src/components/TableRecordModal/TableRecordModal.tsx, toga-blox/src/components/TableRecordModal/index.ts, toga-blox/src/components/TableRecordModal/tableRecordModal.module.css |
 | [Table component (cells, action cells, filters & sorts, hooks, theming)](features/table.md) | The `Table` component (`src/components/Table/`) is the **TanStack Table v8** building block behind the [Primary Table templates](primary-table-templates.md). | toga-blox/src/components/Table/hooks/useFetchTablePageMeta.ts, toga-blox/src/api/types.ts, toga-blox/src/components/Table/index.ts, toga-blox/src/components/Table/types.ts, toga-blox/src/components/Table/utils/buildTanstackColumns.tsx, toga-blox/src/components/Table/utils/resolveCellType.tsx, toga-blox/src/components/Table/components/cellTypes, toga-blox/src/components/Table/components/actionCells, toga-blox/src/components/Table/components/columnFiltersAndSorts, toga-blox/src/components/Table/hooks, toga-blox/src/components/Table/themeConfig |
 | [Talos AI-Assistant Component (launcher + slide-out chat panel)](features/talos-assistant.md) | `Talos` is a **shared, pure-UI** AI-assistant component in `@agilant/toga-blox`: a header launcher button (`TalosLauncher`) plus a slide-out chat panel (`TalosP | toga-blox/src/components/Talos/TalosLauncher.tsx, toga-blox/src/components/Talos/TalosPanel.tsx, toga-blox/src/components/Talos/TalosMessage.tsx, toga-blox/src/components/Talos/types.ts, toga-blox/src/components/Talos/theme.ts, toga-blox/src/components/Talos/helpers.tsx, toga-blox/src/components/Talos/stub.ts, toga-blox/src/components/Talos/Talos.module.css, toga-blox/src/components/Talos/index.ts, toga-blox/src/components/index.ts |
+| [Toaster — host-token styling contract](features/toaster.md) | The blox `Toaster` is a CSS-Module component whose every visual property reads a `--toaster-*` custom property supplied by the **host app**. | toga-blox/src/components/Toaster/Toaster.module.css, toga-blox/src/components/Toaster/Toaster.tsx, toga-blox/src/components/Toaster/ToasterContext.tsx, toga2-commerce/src/styles/index.css, toga2-commerce/src/components/Toasters/ToasterList.tsx |
 | [Dynamic npm Publish Pipeline (branch → channel)](workflows/dynamic-publish-pipeline.md) | How `@agilant/toga-blox` (checkout folder `toga-blox-npm`, registry repo key `toga-blox`) publishes a per-environment npm **channel** (dist-tag) from a `_<mode> | toga-blox/.github/workflows/publish.yml, toga-blox/package.json, toga-blox/src/utils/getFontAwesomeIcon.tsx |

package/knowledge/2.0/apps/toga-blox/features/primary-table-templates.md

@@ -6,9 +6,10 @@ project: TOGa Blox
 client: shared
 type: feature
 status: active
-updated: 2026-08-17
+updated: 2026-08-26
 owners: [apeterson]
 files:
+  - toga-blox/src/components/Table/themeConfig/toga.module.css
   - toga-blox/src/templates/PrimaryTable/PrimaryTable.tsx
   - toga-blox/src/templates/PrimaryTable/PrimaryTableServerTemplate.tsx
   - toga-blox/src/templates/PrimaryTable/PrimaryTableClientTemplate.tsx
@@ -82,8 +83,29 @@ spacer rows computed from the virtualizer item `.start`/`.end` minus `scrollMarg
 `supply-modal-table` skin **disables virtualization** (renders all rows, min-height 300px).
 Sticky columns use a `--sticky-offset` CSS variable summed from neighboring column widths.
 
+## The "Show more" hover affordance is CSS-driven, not JS-driven
+
+A truncated body cell reveals its "Show more" toggle **on hover via CSS only**:
+`.bodyCell:hover .showMoreWrapper:not(.expandedWrapper) button` in
+`themeConfig/toga.module.css` (plus a `:focus-visible` rule so keyboard users can reach it).
+`Cellstyles.module.css` already shipped `.toggle { opacity: 0 }` + a hover rule — the CSS
+hover-reveal was the original design. `PrimaryTableBodyCell` must **not** inline-set the collapsed
+`opacity`; inline styles beat the cascade and hand visibility back to React state. Layout props
+(flex/sizing) stay inline; visibility does not. The React `isTruncated` state is now for
+**capability detection only** (does this cell need a toggle at all), and `clearTruncationHint`
+runs unconditionally — it no longer no-ops while `isExpanded`.
+
 ## Gotchas
 
+- **Never gate a hover affordance on a JS `mouseleave` inside a virtualized table.** `mouseleave`
+  is not guaranteed to fire: a virtualized row can translate out from under a stationary cursor on
+  wheel-scroll, and any early-return in the clear handler strands the "hovered" flag set. The toggle
+  then stays visible on cells the mouse is nowhere near. Drive visibility from CSS `:hover`, which
+  **cannot** get stuck, and keep JS state for capability detection.
+- **Residual (accepted):** a stale `isTruncated` still keeps the flex wrapper mounted, so that one
+  cell's text ellipsizes marginally earlier until the next `mouseleave`. Cosmetically invisible;
+  clearing it properly would need a per-cell scroll listener.
+
 - Frozen widths measure only **mounted** rows; virtualized tables size from the first paint set.
 - **Header labels must never abbreviate or overlap.** The full header width is a hard floor
   (above `maxColumnWidth`, `minColumnWidth`, and pinned `columnWidths`). Measure header width
@@ -98,6 +120,15 @@ Sticky columns use a `--sticky-offset` CSS variable summed from neighboring colu
   not the column set.
 
 ## Change history
+- 2026-08-26 — Fixed: the "Show more" toggle got stuck visible on cells the mouse was not hovering.
+  `.toggle` already had `opacity: 0` + a CSS hover rule, but `PrimaryTableBodyCell` inline-set
+  `opacity: 1` unconditionally (inline beats the cascade), so visibility depended entirely on the
+  `isTruncated` state set on `mouseenter`/cleared on `mouseleave` — and `mouseleave` is not
+  guaranteed to fire (virtualized row translating out from under a stationary cursor on wheel-scroll;
+  `clearTruncationHint` no-opping while `isExpanded`). Visibility is now CSS `:hover`-driven
+  (`.bodyCell:hover .showMoreWrapper:not(.expandedWrapper) button` + `:focus-visible`), the collapsed
+  inline `opacity` was removed, and the `isExpanded` guard dropped from `clearTruncationHint`.
+  Shipped in `1.0.334-sandbox-client.136`. (apeterson)
 - 2026-08-17 — Fixed clipped/abbreviated headers: full header width is now a hard floor for every
   column (not capped by max-width, not overridden by `minColumnWidth`, applied even to pinned
   `columnWidths` — the old `return def.size` bypass left pinned columns clipped). Added a

package/knowledge/2.0/apps/toga-blox/features/table.md

@@ -6,7 +6,7 @@ project: TOGa Blox
 client: shared
 type: feature
 status: active
-updated: 2026-08-25
+updated: 2026-08-26
 owners: [apeterson]
 files:
   - toga-blox/src/components/Table/hooks/useFetchTablePageMeta.ts
@@ -60,6 +60,15 @@ alignment (CVA `cellWrapperVariants`), expandable, and copyable behavior. Empty/
 render `EmptyCell`. If `imageUrlField` is set, the URL is resolved separately and passed to
 `ImageCell`.
 
+**The expandable wrap is destructive, and is now denied for status types.** When the table-meta
+flag `isExpandableCell` is set on a field, the expandable branch does **not** wrap the
+already-rendered `content` — it discards it and re-renders the **raw `value`** inside
+`<ExpandableCell maxLength={40} expandable>`. Any rich cell type loses its component that way
+(a status column rendered as truncated text with a "Show more" toggle instead of a badge).
+`NEVER_EXPANDABLE_TYPES` (`STATUS`, `STATUS_BADGE`) now gates that branch, so status columns keep
+their badge regardless of the meta flag. Fixing it in the renderer covers every client and
+environment instead of chasing per-client `isExpandableCell` data rows.
+
 ## Cell types (`components/cellTypes/`)
 
 | Component | Type | Renders |
@@ -153,6 +162,16 @@ layer and emits it — see
 
 ## Gotchas
 
+- **`isExpandableCell` still clobbers every other rich cell type.** Only `STATUS`/`STATUS_BADGE`
+  are protected today. `URGENCY`, `BOOLEAN`, `CURRENCY`, `DATE`, `AVATAR` and `CLIENT` carry the
+  **same latent defect** — set the flag on one of those fields and the cell degrades to raw
+  truncated text. The fuller fix is inverting the deny-list into an **allowlist** (expandable only
+  for free-text/default cells); deliberately not done yet.
+- **A cell-rendering difference between local and a deployed environment is usually DB data, not
+  code.** `isExpandableCell` is a per-field flag in the **server's table meta**, so the same blox
+  build renders differently against two databases. Diff the branches over the cell-rendering files
+  **first** (`git diff <feature> origin/_sandbox-client -- src/components/Table/...`); if that comes
+  back empty, stop reading code and go look at the table-meta rows.
 - `MIN_COLUMN_WIDTH = 120` is the shrink floor only for columns with **no** explicit width.
 - **Never truncate header labels.** `truncateCells` (`.truncateCells .headerCellLabel` in
   `toga.module.css`) is for **body** values only; it must apply only `white-space: nowrap` to
@@ -198,6 +217,15 @@ layer and emits it — see
   requires `npm run build` before it takes effect at runtime.
 
 ## Change history
+- 2026-08-26 — Fixed: status columns rendered as truncated text with a "Show more" toggle instead of
+  a badge. Root cause was in `resolveCellType` — the `isExpandableCell` branch **discards** the
+  rendered `content` and re-renders the raw `value` in `ExpandableCell`. Added
+  `NEVER_EXPANDABLE_TYPES` (`STATUS`, `STATUS_BADGE`) to gate it. Recorded that the same defect is
+  latent for `URGENCY`/`BOOLEAN`/`CURRENCY`/`DATE`/`AVATAR`/`CLIENT` (an allowlist is the fuller
+  fix, not done). Also recorded the debugging lesson: the "works locally, broken on deployed
+  `_sandbox-client`" symptom was **not** a code difference — the branch diff over the cell-rendering
+  files was empty; `isExpandableCell` was set in the sandbox-client DB and unset locally. Shipped in
+  `1.0.334-sandbox-client.136`. (apeterson)
 - 2026-08-25 — `useFetchTablePageMeta` now prefers **server-supplied `filterOptions`** and skips the
   `recordRoute` fetch for those fields (query list + index lookup share one `needsFetchedOptions`
   predicate so they can't skew); `filterOptions[].uuid` made optional and `surfaceSlug` declared on

package/knowledge/2.0/apps/toga-blox/features/toaster.md

@@ -0,0 +1,104 @@
+---
+title: Toaster — host-token styling contract
+framework: "2.0"
+repo: toga-blox
+project: TOGa Blox
+client: shared
+type: feature
+status: active
+updated: 2026-08-26
+owners: [apeterson]
+files:
+  - toga-blox/src/components/Toaster/Toaster.module.css
+  - toga-blox/src/components/Toaster/Toaster.tsx
+  - toga-blox/src/components/Toaster/ToasterContext.tsx
+  - toga2-commerce/src/styles/index.css
+  - toga2-commerce/src/components/Toasters/ToasterList.tsx
+related:
+  - ../architecture.md
+  - ../../../standards/frontend.md
+  - ../../toga2-commerce/architecture.md
+---
+
+## Summary
+
+The blox `Toaster` is a CSS-Module component whose every visual property reads a
+`--toaster-*` custom property supplied by the **host app**. It is the clearest working example of
+the blox styling contract described in `frontend.md` §13(e) — and of that contract's failure mode:
+a host that defines **zero** tokens gets a component that renders **unstyled**, because every
+declaration is invalid-at-computed-value-time and dropped.
+
+As of 2026-08-26 the component ships **default values via `var(--token, fallback)`**, so it renders
+fully styled with no host configuration, while any host-defined `--toaster-*` token still wins.
+The blox-side changes are **merged and published** as of 2026-08-26 in
+`@agilant/toga-blox@1.0.334-sandbox-client.136` (dist-tag `sandbox-client`). The commerce-side
+rewiring (`TRUE-80707`) is still a separate branch — verify that half against the installed app.
+
+## How it works
+
+### Token layer with fallbacks (the pattern to copy)
+
+Every declaration in `Toaster.module.css` is written `var(--toaster-x, <literal default>)`. This was
+chosen over adding a `:root` token block inside blox because:
+
+- blox ships **no** `:root` token block anywhere (§13e), and
+- `dist/main.css` is **uncompiled** and must not be imported by consumers (§13f),
+
+so a `:root` block would need a stylesheet import that no consumer makes. Fallbacks need nothing
+imported. **This is the generalisable rule for any blox component that reads host tokens: ship
+`var(--token, fallback)`, never a bare `var(--token)`.**
+
+### Do NOT declare a property on an element that also receives a host override class
+
+`.prefixIcon` and `.closeBtn` deliberately declare **no `color`**. The host's `iconColor` /
+`closeIconColor` classes land on those same elements at **equal specificity**, so a `color`
+declared in the module would be resolved by **stylesheet source order** and could silently beat the
+host's class (supply's mint/crimson icons losing to a grey default). They inherit from `.base`
+instead, which any host class reliably overrides. In-code comments record this so it is not
+"helpfully" re-added.
+
+### Host wiring — the variant-remap mechanism
+
+The supported way for a host to express toast variants is to define the `--toaster-*` layer once,
+then have each variant class **remap only the `--toaster-default-*` tokens** that blox's `.base`
+already reads. Do **not** style toasts with utility classes on a wrapper — Tailwind utilities and
+blox's `.base` land at equal specificity and compete unpredictably.
+
+```css
+:root { --toaster-padding: 1.25rem; /* … full token set … */ }
+.commerceToaster--error { --toaster-default-bg: …; --toaster-default-text: …; }
+```
+
+`toga25-supply` defines the full set (~33 tokens) in `src/themeConfig.json`; `toga2-commerce` now
+defines it in `src/styles/index.css` with `.commerceToaster--{success,error,restricted,default}`
+variant classes consumed by `ToasterList.tsx`. Commerce's result was verified by `tsc -b` / `vite
+build` and by inspecting the emitted CSS for the tokens and all four variant classes — **not
+visually in a browser**.
+
+## Gotchas
+
+- **A missing `var()` wrapper fails silently.** Two declarations read `min-width: (--toaster-min-width)`
+  / `max-width: (--toaster-max-width)` — no `var()`, so the parser dropped both. `toga25-supply`
+  masked this by re-declaring `min-width` on `.supplyToaster`; commerce had nothing to mask it, which
+  is how it surfaced. A host override can hide a blox CSS bug indefinitely.
+- **`border-width` + `border-color` with no `border-style` renders no border at all.** `.base`
+  previously set the first two only; `border-style` (plus `border-radius`, `font-family`,
+  `font-size`, `margin-block`) has been added.
+- **Order placement in commerce does not raise a success toast** — do not use it to test toast
+  styling. See `../../toga2-commerce/features/order-submit-sync-sequencing.md`.
+- Commerce's `restricted` (orange) variant is commerce-only; supply has no equivalent. Commerce's
+  palette has no `crimson-600`, so supply's error icon color maps to `crimson-500`.
+
+## Change history
+
+- 2026-08-26 — The blox-side fallback work above was committed, merged to `_sandbox-client` and
+  **published** as `1.0.334-sandbox-client.136`; superseded the earlier "working-tree, not yet
+  merged or published" caveat. (apeterson)
+- 2026-08-26 — Toaster now ships **default styling** via `var(--token, fallback)` on every custom
+  property (renders styled with zero host config; host tokens still win) and gained the missing
+  `border-style`/`border-radius`/`font-family`/`font-size`/`margin-block` on `.base`. Fixed two
+  declarations missing their `var()` wrapper (`min-width`/`max-width`), which supply had been
+  masking. Recorded the deliberate **no `color` on `.prefixIcon`/`.closeBtn`** decision (equal
+  specificity with the host's `iconColor`/`closeIconColor` classes). `toga2-commerce` rewired to
+  supply's variant-remap mechanism and given the full `--toaster-*` token layer, replacing the
+  competing Tailwind-utility styling. (apeterson)

package/knowledge/2.0/apps/toga-blox/workflows/dynamic-publish-pipeline.md

@@ -6,7 +6,7 @@ project: TOGa Blox
 client: shared
 type: workflow
 status: active
-updated: 2026-08-04
+updated: 2026-08-26
 owners: [jcardinal, apeterson]
 files:
   - toga-blox/.github/workflows/publish.yml
@@ -93,6 +93,52 @@ environment needs its own maintained `_<mode>` branch in `toga-blox-npm`.
   copy on the pushed branch, a new `_<mode>` channel will **not** publish unless the branch you push
   carries the wildcard-trigger version. When standing up a new channel, merge from a branch that has
   the dynamic `publish.yml` (or update it first).
+- **Do NOT judge a blox branch's staleness by its behind-count.** `feature-new-table` reports
+  **"0 ahead / 47 behind"** `_sandbox-client` and `git merge-base --is-ancestor` says it is fully
+  contained — which reads as "stale, already merged, wrong base". **It is not.** Those 47 commits are
+  almost entirely `Merge branch 'feature-new-table' into _sandbox-client` and
+  `chore: bump version to 1.0.3xx` — **release plumbing generated ON `_sandbox-client` by the publish
+  flow and never merged back**. The actual source difference is **2 files** (`src/global.css`,
+  `src/index.ts`); the rest of the 334-file diff is `.claude/knowledge/` docs and `publish.yml`.
+  `feature-new-table` is the **active development branch** (tip 2026-08-24, `feat: prefer
+  server-supplied filter options in table meta`) and is the correct base. Verified 2026-08-26.
+  Corollary: the `publish.yml` divergence noted above is a **non-issue for publishing**, because
+  Actions runs the workflow on the **pushed** branch (`_sandbox-client`), which carries the dynamic
+  `_*` trigger.
+- **A declared peer can be phantom — check before working around it.** Verified 2026-08-26:
+  `react-router-dom` appeared in blox's `peerDependencies` but only three files referenced it, two of
+  them tests; the single production reference was a **dead `import { Link }`** on line 1 of
+  `src/components/old/BaseButton/BaseButton.tsx` (the component renders an injected `linkComponent`
+  prop instead). The peer declaration and the dead import were removed and are **published** as of
+  2026-08-26 in `1.0.334-sandbox-client.136`; `react-router-dom` stays a
+  **devDependency** (`^6.30.1`) for the tests' `MemoryRouter`. Verified clean build, zero
+  `react-router-dom` references in `dist/`, and vitest identical to baseline. This peer was the
+  stated reason consumers pass `--legacy-peer-deps` against a router-7 app.
+- **A feature branch that never touches the version line merges without a version conflict —
+  and that is why the bump has to happen afterwards.** Observed 2026-08-26: `feature-new-table` sat
+  at base `1.0.322` while `_sandbox-client` was at `1.0.332`. The merge auto-resolved the `version`
+  line to `1.0.332` with **no conflict**, because only `_sandbox-client` had ever edited it (the
+  "47 behind" commits are that same release plumbing — see the gotcha above). The bump to `1.0.333`
+  was then made **on `_sandbox-client`**, at the developer's explicit direction. That **deviates
+  from the `deploy-sandbox-client` skill's "never commit the bump directly to `_sandbox-client`"
+  rule.** It was safe *only* because the feature branch does not carry the version line, so nothing
+  could be clobbered — **record this as a one-off, not a new default.** CI then published base+1 →
+  `1.0.334-sandbox-client.136`.
+- **`gh` is not installed on every dev machine.** The skill's `gh run watch` monitoring step simply
+  does not work there. Fall back to polling the registry:
+  `npm view @agilant/toga-blox@sandbox-client version` (or `npm dist-tag ls @agilant/toga-blox`)
+  until the new version appears — the registry is the authoritative confirmation anyway.
+- **Consuming apps pin exactly, so a publish is only half the deploy.** After
+  `1.0.334-sandbox-client.136` shipped, `toga25-supply` on `_sandbox-client` was still pinned to
+  `1.0.333-sandbox-client.134` and needed a pin bump + reinstall. Likewise the feature branch stays
+  at its old base version after the bump lands on `_sandbox-client` — expect the two to be out of
+  step and don't read it as a problem.
+- **⚠ Credentials have been found in the local git remote URL.** Verified 2026-08-26: the `origin`
+  remote for the `toga-blox-npm` checkout had a **GitHub PAT embedded in plaintext in the URL**
+  (visible to anything that runs `git remote get-url origin`, and to any tool that reads
+  `.git/config`). Check for this and re-point the remote at SSH or a credential helper; treat any
+  token found this way as compromised and rotate it. This is the local-config sibling of the
+  committed-`.npmrc` violation already recorded in `../../../standards/frontend.md`.
 - **FontAwesome v7 `style`-prop TS2322** (fixed 2026-07-21 in `getFontAwesomeIcon.tsx`, and a
   reusable pattern for any consumer). FA v7 types the `FontAwesomeIcon` `style` prop as
   `CSSProperties & CSSVariables`, where `CSSVariables` requires a `--fa-*` custom-property index
@@ -122,6 +168,22 @@ environment needs its own maintained `_<mode>` branch in `toga-blox-npm`.
   the pattern the consuming apps should follow (see the commerce workflow's secret-hygiene note).
 
 ## Change history
+- 2026-08-26 — Deployed `1.0.334-sandbox-client.136` (`feature-new-table` → `_sandbox-client`, 6
+  files, no conflicts) and recorded three workflow gotchas from it: (1) a feature branch that never
+  touches the `version` line merges without a version conflict, which is why the bump lands on
+  `_sandbox-client` afterwards — a documented **deviation** from the `deploy-sandbox-client` skill's
+  "never bump on `_sandbox-client`" rule, safe here only because of that, not a new default;
+  (2) `gh` is not installed on every machine, so verify the publish by polling
+  `npm view @agilant/toga-blox@sandbox-client version` instead of `gh run watch`; (3) consuming apps
+  pin exactly and need a separate pin bump + reinstall. Also flagged that a **GitHub PAT was found
+  in plaintext in the local `origin` remote URL** (rotate + re-point at SSH/credential helper), and
+  marked the phantom `react-router-dom` peer removal as merged and published. (apeterson)
+- 2026-08-26 — Corrected the branch-topology misreading: `feature-new-table`'s "0 ahead / 47 behind"
+  is release plumbing generated on `_sandbox-client`, not staleness — it remains the active dev
+  branch and correct base (real source delta: 2 files). Noted the `publish.yml` divergence is a
+  non-issue because Actions runs the pushed branch's copy. Removed the **phantom
+  `react-router-dom` peer** (its only production reference was a dead `Link` import in
+  `old/BaseButton`); it is now a devDependency for tests only. Working-tree, uncommitted. (apeterson)
 - 2026-08-04 — Recorded the prod/beta `.scss`-only build gotcha: the `_production`/`_beta`
   `build` copies only `src/**/*.scss`, so a component shipped with a plain `.css` + matching
   `import "./X.css"` publishes JS referencing a stylesheet absent from the tarball, breaking

package/knowledge/2.0/apps/toga2-commerce/INDEX.md

@@ -16,6 +16,6 @@
 | [Multi-Tenant Resolution & Theming](features/multi-tenant-theming.md) | `toga2-commerce` serves multiple clients from one codebase. | src/themeConfig/themes.json, src/themeConfig/ThemeContext.tsx, src/themeConfig/types.ts, src/components/ThemeSwitcher/ThemeSwitcher.tsx, src/components/AuthLayout/AuthLayout.tsx, src/api/axiosInstance.ts, src/contexts/AuthContext.tsx, tailwind.config.js |
 | [Order-submit sync sequencing (useSubmitOrder) — why these calls must not run in parallel](features/order-submit-sync-sequencing.md) | Submitting an order from the cart fires **two independent sync routines** — one for the sales-order header (`syncSalesOrderData`) and one for the line items (`s | toga2-commerce/src/pages/OrderDetails/hooks/useSubmitOrder.ts, toga2-commerce/src/api/syncSalesOrdersDataFromLocalStorageCartToApi.ts, toga2-commerce/src/api/syncSalesOrderItemsFromLocalStorageCartToApi.ts |
 | [Config-Driven Shipping Cost Waiver (Standard Ground free for computer kits)](features/shipping-cost-waiver-gating.md) | On the toga2-commerce **Cart** page, a shipping option's **cost** can be waived by config using the same `PrimaryItemShippingRule` vocabulary that drives expedi | toga2-commerce/src/pages/Cart/helpers/shippingOptionGates.ts, toga2-commerce/src/pages/Cart/viewModel/FIELDS/shared/shippingOptionGates.ts, toga2-commerce/src/pages/Cart/CartPage.tsx |
-| [AWS Amplify Build & Deploy (non-prod environments)](workflows/amplify-build-and-deploy.md) | How `toga2-commerce` (React + Vite, "commerce2-react") builds and deploys on **AWS Amplify**. | toga2-commerce/amplify.yml, toga2-commerce/.gitattributes, toga2-commerce/package.json, toga2-commerce/.github/workflows/sync-stage-environments.yml |
+| [AWS Amplify Build & Deploy (non-prod environments)](workflows/amplify-build-and-deploy.md) | How `toga2-commerce` (React + Vite, "commerce2-react") builds and deploys on **AWS Amplify**. | toga2-commerce/amplify.yml, toga2-commerce/.gitattributes, toga2-commerce/package.json, toga2-commerce/.npmrc, toga2-commerce/vite.config.ts, toga2-commerce/.github/workflows/sync-stage-environments.yml |
 | [Cart e2e — Cypress conventions & harness (toga2-commerce)](workflows/cypress-testing.md) | The Cypress **e2e** convention set for `toga2-commerce`, and the first **active** e2e coverage for the **Cart** page (`cartV2.cy.ts`, slice 1 — 12 tests, verifi | toga2-commerce/cypress/e2e/cartPage/cartV2.cy.ts, toga2-commerce/cypress/fixtures/cart/fetchSingleUserAdmin.json, toga2-commerce/cypress/fixtures/cart/fetchLocations.json, toga2-commerce/cypress/fixtures/cart/fetchUserShippingMethods.json, toga2-commerce/cypress/support/commands.ts, toga2-commerce/cypress/support/e2e.ts, toga2-commerce/src/pages/Cart/CartPage.tsx, toga2-commerce/src/pages/Cart/view/cartForm/CartForm.tsx, toga2-commerce/src/pages/Cart/view/cartForm/CartFormSection.tsx, toga2-commerce/src/pages/Cart/view/cartTable/CartContentsTable.tsx, toga2-commerce/src/pages/Cart/view/cartTable/CartTableItem.tsx, toga2-commerce/src/components/Inputs/AdvancedInput.tsx, toga2-commerce/src/components/BaseButton/BaseButton.tsx |
 | [Diagnosing ERR_HTTP2_PROTOCOL_ERROR (one client fails, everyone else is fine)](workflows/http2-protocol-error-diagnosis.md) | When a Chromium browser (Chrome / Edge) shows **`ERR_HTTP2_PROTOCOL_ERROR`** loading a `*.togacommerce.com` tenant for **one client/network but works for the TO |  |

package/knowledge/2.0/apps/toga2-commerce/features/order-submit-sync-sequencing.md

@@ -6,8 +6,8 @@ project: TOGa Commerce
 client: shared
 type: feature
 status: active
-updated: 2026-08-14
-owners: ["bala"]
+updated: 2026-08-26
+owners: ["bala", "apeterson"]
 files:
   - toga2-commerce/src/pages/OrderDetails/hooks/useSubmitOrder.ts
   - toga2-commerce/src/api/syncSalesOrdersDataFromLocalStorageCartToApi.ts
@@ -134,9 +134,22 @@ Three changes, in `toga2-commerce`:
 - **⚠ Omitting a line from the rebuilt cart DELETES it from a placed order.** `processItems` with
   `getDeleteItems = true` derives the delete set by difference, so "don't re-add this one" and
   "destroy this one" are the same instruction on this path.
+- **There is NO success toaster on order placement — by design, not a bug.** `useSubmitOrder` calls
+  `addToaster` **only in its `catch` block** (`status: 'error'`). Both success paths navigate away
+  before anything could render: cart → `createNewSalesOrderSubmit()` →
+  `navigate("/order-details?uuid=…&type=orderPlaced")` (no `addToaster` anywhere in it); edit-order →
+  `window.location.href = getSupplyRedirectLink(orderUuid)`. **Consequence for debugging: placing an
+  order is not a valid way to test toaster styling.** Use a path that stays mounted — add/edit
+  shipping address (Cart or Account), Account → My Settings, or Cart → add new user; for the error
+  variant, force a submit failure to hit the catch block. See
+  [blox Toaster](../../toga-blox/features/toaster.md).
 
 ## Change history
 
+- 2026-08-26 — Recorded that order placement raises **no success toaster by design** (`addToaster`
+  is only in the `catch`; both success paths navigate away), and listed the mounted-path
+  alternatives for testing toaster styling. (apeterson)
+
 - 2026-08-14 — Recorded **how order lines are actually written**, learned while adding a
   server-side order guard: the header sync `delete`s `salesOrderItems` from the edit `PUT` (line
   20), and lines are written **one request at a time** — new lines via the nested

package/knowledge/2.0/apps/toga2-commerce/workflows/amplify-build-and-deploy.md

@@ -6,16 +6,19 @@ project: TOGa Commerce
 client: shared
 type: workflow
 status: active
-updated: 2026-07-21
-owners: ["jcardinal"]
+updated: 2026-08-26
+owners: ["jcardinal", "apeterson"]
 files:
   - toga2-commerce/amplify.yml
   - toga2-commerce/.gitattributes
   - toga2-commerce/package.json
+  - toga2-commerce/.npmrc
+  - toga2-commerce/vite.config.ts
   - toga2-commerce/.github/workflows/sync-stage-environments.yml
 related:
   - ../../toga2-supply/workflows/amplify-build-and-deploy.md
   - ../../toga-blox/workflows/dynamic-publish-pipeline.md
+  - ../../../standards/frontend.md
 ---
 
 ## Summary
@@ -69,6 +72,10 @@ full cross-repo publish-then-build model. **The channel must exist before the ap
 
 ## Edge cases & escalation
 
+> The 2026-08-26 commerce-side fixes below (`.npmrc` flag, added peers, `resolve.dedupe`, the
+> `--toaster-*` token layer, the `ToasterList` rewiring) are **working-tree on branch `TRUE-80707`** —
+> uncommitted, unmerged, and not in any deployed build.
+
 - **All the toga2-supply gotchas apply** (console build spec overriding repo `amplify.yml`;
   CRLF breaking block-scalar parsing; Vite silently falling back to `.env`/beta when a mode's env
   file is missing). See the related doc.
@@ -77,14 +84,44 @@ full cross-repo publish-then-build model. **The channel must exist before the ap
   only triggers on branches listed in `on.push.branches` and only tags branches with an explicit
   `elif` case — creating the branch alone does nothing; the workflow file must be present on that
   branch (GitHub Actions runs the workflow version on the pushed branch).
-- **`--legacy-peer-deps` is required** because blox declares `react-router-dom@^6` as a peer while
+- **`--legacy-peer-deps` is required** because blox declared `react-router-dom@^6` as a peer while
   commerce uses `react-router-dom@7` (npm 7+ `ERESOLVE` otherwise). All non-prod build scripts use it.
+  (That peer was **phantom** and was removed from blox on 2026-08-26 — see the blox publish-pipeline
+  doc — but the flag stays until a build without it is proven.)
+- **When one app installs a shared lib and a sibling app does not, compare `.npmrc` BEFORE touching
+  peer ranges.** A local `npm i` in commerce failed `ERESOLVE` on blox's router peer while
+  `toga25-supply` installed cleanly against the **same** blox version and the **same** router major.
+  The difference was not the peer range: supply carries `legacy-peer-deps=true` in its committed
+  `.npmrc` and commerce did not. Fix was adding `legacy-peer-deps=true` to commerce's `.npmrc` — a
+  tracked file, so it also reaches the Amplify build (the amplify.yml flag alone does not cover a
+  developer's local install).
 - **`--legacy-peer-deps` disables npm's peer auto-install**, so any blox peer that is NOT in
   commerce's own `dependencies` and NOT in blox's `dependencies` must be added explicitly, or Vite/
   Rollup fails with `failed to resolve import "<pkg>"`. Concretely, commerce had to add the table
-  peers: `@tanstack/react-table@^8`, `react-table@^7.8.0`, `react-table-sticky@^1.1.3`. Check
-  `npm view @agilant/toga-blox@<tag> peerDependencies` against commerce deps when a resolve error
-  appears.
+  peers: `@tanstack/react-table@^8`, `react-table@^7.8.0`, `react-table-sticky@^1.1.3`, and on
+  2026-08-26 `@fortawesome/free-solid-svg-icons@^6.7.2` + `react-multi-select-component@^4.3.4`.
+  Check `npm view @agilant/toga-blox@<tag> peerDependencies` against commerce deps when a resolve
+  error appears.
+- **A BARREL import is what drags in peers you never use.** The failure text was
+  `Rollup failed to resolve import "@fortawesome/free-solid-svg-icons" from
+  node_modules/@agilant/toga-blox/dist/components/Input/Input.js`, triggered by
+  `AuthLayout.tsx` doing `import { EnvironmentBadge } from "@agilant/toga-blox"` — the package
+  index pulls `Input` and `MultiSelect` along with it. A deep import would not have surfaced it, so
+  expect the missing-peer set to be blox's **whole** surface, not the components you reference.
+- **`resolve.dedupe` was missing from commerce's `vite.config.ts`** (a `frontend.md` §11 MUST), which
+  made consuming blox via a local symlink hazardous: `toga-blox-npm/node_modules/` contains its own
+  `react@18.3.1`/`react-dom@18.3.1`, and because blox ships **unbundled**, imports resolve against
+  the nearest `node_modules` — under a symlink that is blox's own, giving a second React copy. This
+  is precisely why supply's symlink workflow works (it has always deduped
+  `react`/`react-dom`/`@tanstack/react-table`) and commerce's did not. Commerce now dedupes
+  `react`, `react-dom`, `react-hook-form`, `react-router-dom`, `framer-motion`,
+  `@tanstack/react-query`, `@tanstack/react-table`.
+- **`package.json` pins blox with a CARET** (`"@agilant/toga-blox": "^1.0.322-sandbox-client.117"`),
+  violating `frontend.md` §13(a) — some published versions ship an empty `dist`, and a caret can
+  float you onto one. Pin exact. Related: the `TRUE-80707` branch pin is **11 versions behind** the
+  `_sandbox-client` branch pin (`1.0.333-sandbox-client.134`); reconcile before merging.
+- **Secret hygiene re-confirmed unremediated 2026-08-26** — the live tokens are still in the tracked
+  `.npmrc` in **both** `toga2-commerce` and `toga25-supply`. See the remediation below.
 - **Secret hygiene (open remediation):** `toga2-commerce/.npmrc` is **git-tracked** — it is listed
   in `.gitignore` but was committed before that, so git still tracks it, and it holds a live
   FontAwesome registry token and a live npm auth token in plaintext. Remediation: (1) **rotate both
@@ -95,6 +132,13 @@ full cross-repo publish-then-build model. **The channel must exist before the ap
 
 ## Change history
 
+- 2026-08-26 — Dependency-resolution findings from a local commerce build: root-caused an
+  `ERESOLVE` to the **missing `legacy-peer-deps=true` in commerce's tracked `.npmrc`** (supply had
+  it) rather than blox's peer range; recorded the barrel-import trigger for missing peers (added
+  `@fortawesome/free-solid-svg-icons`, `react-multi-select-component`); added the previously absent
+  `resolve.dedupe` to `vite.config.ts` and explained why supply can symlink blox safely and commerce
+  could not; flagged the caret blox pin and the 11-version pin drift on `TRUE-80707`; re-confirmed
+  the committed `.npmrc` tokens are still unremediated. All working-tree, uncommitted. (apeterson)
 - 2026-07-21 — Reworked `amplify.yml` to a **fully dynamic inline build** (no per-branch `case`, no
   `npm run <script>`): derive mode from `$AWS_BRANCH`, dynamic `npm install
   "@agilant/toga-blox@$MODE"`, `npx tsc -b` (composite), `npx vite build --mode "$MODE"`. Re-export

package/knowledge/2.0/apps/toga2-supply/INDEX.md

@@ -3,7 +3,7 @@
 | Doc | Summary | Files |
 |-----|---------|-------|
 | [TOGa Supply (toga2-supply) Architecture](architecture.md) | `toga2-supply` is the **React + Vite frontend** for TOGa Supply — warehouse fulfillment tooling (shipment selection, fulfill & ship against carrier APIs, NetSui | toga2-supply/src/api/toga.ts, toga2-supply/src/pages/ShipmentItems/view/ShipmentItemsPage.tsx, toga2-supply/src/pages/EditShipment/view/EditShipmentPage.tsx, toga2-supply/src/pages/EditShipment/api/UpdateShipmentApi.ts, toga2-supply/src/pages/Shipments/view/components/ShipmentsCardTableForm/ShipmentsCardTableForm.tsx |
-| [Per-currency amount lines (CurrencyAmountLines / CurrencyAmountList) and child-row diffing](features/currency-amount-lines-editor.md) | The shared UI for "one amount per currency" on a parent record — an item's prices, a vendor item's costs. | toga2-supply/src/components/ui/CurrencyAmountLines.tsx, toga2-supply/src/pages/Items/api/itemsApi.ts, toga2-supply/src/pages/VendorItems/api/vendorItemsApi.ts |
+| [Per-currency amount lines (CurrencyAmountLines / CurrencyAmountList) and child-row diffing](features/currency-amount-lines-editor.md) | The shared UI for "one amount per currency" on a parent record — an item's prices, a vendor item's costs. | toga2-supply/src/components/ui/CurrencyAmountLines.tsx, toga2-supply/src/pages/Items/api/itemsApi.ts, toga2-supply/src/pages/VendorItems/api/vendorItemsApi.ts, toga2-supply/src/pages/Items/view/modals/viewEdit/ItemsModalContentTemplate.tsx, toga2-supply/src/pages/VendorItems/view/modals/edit/VendorItemsModalContentTemplate.tsx, toga2-supply/src/utils/formatCurrency.tsx |
 | [Fulfill & Ship](features/fulfill-and-ship.md) | Fulfill & Ship lets a warehouse user select sales-order line items, enter serials, pick a carrier/method, and in one action: create the Item Fulfillment records | _underscore/Trait/Netsuite/SalesOrder.php, dbchanges2/Client_Growrk/2026-08-10e - GrowrkUpsServiceMethodCodes.sql, toga2-supply/src/pages/EditShipment/view/EditShipmentPage.tsx, _underscore/Model/Client/Measure.php, _underscore/Model/Client/TrackingNumber.php, toga2-supply/src/pages/EditShipment/helpers/ShipmentDetailsForm/getEditShipmentFormOptions.ts, toga2-supply/src/pages/EditShipment/helpers/ShipmentDetailsForm/validateFormOnSubmit.ts, toga2-supply/src/pages/EditShipment/helpers/ShipmentDetailsForm/checkDimensions.ts, toga2-supply/src/components/ui/Tables/BasicTable/BasicTable.tsx, toga2-supply/src/components/ui/Tables/types.ts, toga2-supply/src/components/ui/GoogleMapsLink.tsx, toga2-supply/src/pages/ShipmentItems/view/forms/ShipmentItemsTable.tsx, toga2-supply/src/pages/ShipmentItems/api/ShipmentItemsApi.ts, toga2-supply/src/pages/ShipmentItems/types.ts, toga2-supply/src/pages/EditShipment/viewModel/FIELDS/RETURNLABELFIELDS.json, toga2-supply/src/pages/EditShipment/view/components/forms/EditShipmentForm.tsx, toga2-supply/src/components/ui/BaseInput/UnitSelect.tsx, toga2-supply/src/pages/EditShipment/view/modals/SerialNumbersModal.tsx, toga2-supply/src/pages/ShipmentItems/view/ShipmentItemsPage.tsx, toga2-supply/src/pages/EditShipment/view/EditShipmentPage.tsx, toga2-supply/src/pages/EditShipment/view/components/forms/EditShipmentForm.tsx, toga2-supply/src/pages/EditShipment/view/components/SelectedShipmentItemsTable.tsx, toga2-supply/src/pages/EditShipment/view/helpers/ShipmentDetailsForm/renderEditShipmentFormInput.tsx, toga2-supply/src/pages/EditShipment/viewModel/FIELDS/DUMMYUPDATESHIPMENTFIELDS.json, toga2-supply/src/pages/EditShipment/helpers/ShipmentDetailsForm/renderEditShipmentFormInput.tsx, toga2-supply/tailwind.config.cjs, toga2-supply/src/pages/EditShipment/view/modals/ReturnShippingModal.tsx, toga2-supply/src/styles/index.scss, toga2-supply/src/components/ui/BaseInput/BaseInput.tsx, toga2-supply/src/pages/EditShipment/api/UpdateShipmentApi.ts, toga2-supply/src/pages/EditShipment/viewModel/signatureTypes.ts, toga2-supply/src/pages/EditShipment/view/modals/SelectReturnAddressModal.tsx, toga2-supply/src/pages/EditShipment/helpers/ShipmentDetailsForm/formatShipmentData.ts, toga2-supply/src/pages/EditShipment/types.ts, toga2-supply/src/pages/Shipments/view/ShipmentsPage.tsx, toga2-supply/src/pages/Shipments/view/components/ShipmentsCardTableForm/ShipmentsCardTableForm.tsx, toga2-supply/src/pages/Shipments/api/ShipmentsApi.ts, toga2-supply/src/pages/Shipments/types.ts, toga2-supply/src/pages/FulfilledShipments/view/FulfilledShipmentsPage.tsx, toga2-supply/src/components/ui/CardTable/CardTable.tsx, toga2-supply/src/components/ui/CardTable/types.ts, toga2-supply/src/assets/pen-line.svg, _underscore/Model/Client/ItemFulfillment.php, _underscore/Trait/Netsuite/ItemFulfillment.php, _underscore/Component/Library/Carriers/Ups/Ups.php |
 | [Order-details field config (valueKey resolution) & the hardcoded Customer name](features/order-detail-field-config-and-customer-name.md) | The supply order-details modal is **config-driven**: each host has a JSON field list under `src/pages/Orders/view/OrderView/viewModel/FIELDS/<HOST>/`, and every | toga2-supply/src/utils/formatCustomerName.tsx, toga2-supply/src/pages/Orders/view/OrderView/components/invoices/OrderContentSection.tsx, toga2-supply/src/pages/Orders/view/OrderView/viewModel/FIELDS/, toga2-supply/src/pages/Orders/view/OrderView/viewModel/useOrderDetailsViewModel.ts, toga2-supply/src/api/toga.ts |
 | [Table-data request filters (`additionalData` → `getDataTableData`)](features/table-data-additional-filters.md) | A listing page adds its own row filters to a table-view data request by passing an **`additionalData`** prop down to the shared `useFetchData` hook, which forwa | toga2-supply/src/components/ui/Tables/hooks/useFetchData.tsx, toga2-supply/src/api/toga.ts, toga2-supply/src/pages/VendorItems/VendorItemsPage.tsx |