toga-ai 1.0.667 → 1.0.668

package/knowledge/2.0/apps/_underscore/features/surface-resolver.md

@@ -6,7 +6,7 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-08-26
+updated: 2026-08-27
 owners: [jcardinal, apeterson]
 files:
   - _underscore/Model/Client/Language.php
@@ -216,6 +216,18 @@ cluster-isolation rule.
 | `Core.Surfaces` | 41–43 |
 | `Core.SurfaceElements` | 125–146 |
 
+> **The reserved blocks are NOT an inventory of all surface ids.** They record the
+> 2026-08-21 decision-surface reseed only. Surfaces seeded *before* that decision sit
+> outside them and took AUTO_INCREMENT ids — notably the **`navigation`** TAB_STRIP,
+> whose elements are `Core.SurfaceElements` **109–114** (sales-orders, inventory, items,
+> vendor-items, bundles, service-requests). Verified 2026-08-27. Two consequences: (1) do
+> not assume an id outside 125–146 is unseeded or invalid; (2) a *new* Core seed must
+> still claim an unused reserved block, but must check the pre-reseed ids too before
+> assuming a range is free. Nav elements also carry `aclActionId = NULL` with Core base
+> `isVisible = 0`, so the `aclActionId` gate described above is a no-op for navigation —
+> visibility is purely role-scoped `SurfaceOverrides`. See
+> [Compass navigation access](../../../../clients/compass-usa/workflows/granting-navigation-access.md).
+
 **Authoring rules that follow from this:**
 - A new Core surface seed **must** pick an unused reserved block and write explicit ids. Never let
   a surface/element/message row take an `AUTO_INCREMENT` id — that re-opens the drift problem.
@@ -612,6 +624,12 @@ Core record grants + their logic-group expressions all evaluate `all`/`"1"`. The
   match Compass, a follow-up migration aligning both `meta` and `meta-group` to roles 1,3,4 is needed.
 
 ## Change history
+- 2026-08-27 — Corrected the reserved-id framing: the blocks record the 2026-08-21 reseed only and are
+  **not** an inventory of all surface ids. Pre-reseed surfaces kept AUTO_INCREMENT ids — the
+  `navigation` TAB_STRIP is `SurfaceElements` **109–114** — so an id outside 125–146 is not evidence it
+  is unseeded, and a new seed must check pre-reseed rows before calling a range free. Also recorded
+  that nav elements carry `aclActionId = NULL` with Core base `isVisible = 0`, making the `aclActionId`
+  gate a **no-op for navigation** (visibility is purely role-scoped `SurfaceOverrides`). (apeterson)
 - 2026-08-26 — Recorded that the Core/Client model split is a **cluster** boundary: `SurfaceOverrides`
   is a CLIENT-DB model, so override counts across clients must be a two-step (Core ids → per-client
   count with literal ids), never a join. Matters when deciding whether to fork or share a surface,

package/knowledge/2.0/apps/dbchanges2/features/surface-layer-schema.md

@@ -6,7 +6,7 @@ project: Database Changes
 client: shared
 type: feature
 status: active
-updated: 2026-08-26
+updated: 2026-08-27
 owners: [jcardinal, apeterson]
 files:
   - dbchanges2/Core/2026-08-24b - SalesOrderStatusFilterSurfaceSeed.sql
@@ -489,6 +489,16 @@ Blocks assigned by `Core/2026-08-24b - SalesOrderStatusFilterSurfaceSeed.sql`: *
 sales-order status; no `Core.Messages` rows — labels come from the `sales-order-status` vocabulary).
 See [sales-order-status-filter-surface](../../_underscore/features/sales-order-status-filter-surface.md).
 
+**⚠ The reserved blocks are not an inventory of every surface id — pre-2026-08-21 surfaces sit
+outside them.** The reserved-id discipline begins at the reseed, so surfaces seeded before it took
+plain `AUTO_INCREMENT` ids: the **`navigation`** TAB_STRIP is `Core.SurfaceElements` **109–114**
+(sales-orders, inventory, items, vendor-items, bundles, service-requests), verified 2026-08-27. So an
+id below a reserved block is **not** evidence that it is unseeded, and "next free" must be checked
+against the pre-reseed rows as well as the blocks above. Those nav elements also carry
+`aclActionId = NULL` with Core base `isVisible = 0`, which makes the ACL-action gate a **no-op for
+navigation** — visibility comes solely from role-scoped `SurfaceOverrides`. See
+[Compass navigation access](../../../../clients/compass-usa/workflows/granting-navigation-access.md).
+
 ### 🚨 VERIFY the block is free, and never seed literal ids with `INSERT IGNORE`
 
 **Incident, 2026-08-24 — a reserved block was quoted as "highest used" and read as "next free", and
@@ -779,6 +789,12 @@ Using literals is still correct: a collision then fails loudly on the primary ke
 mis-wiring (which is what `INSERT IGNORE` did in the 2026-08-24 incident above).
 
 ## Change history
+- 2026-08-27 — Added the counterpart to the pre-reserved-block `Core.Messages` drift note: the reserved
+  blocks are **not** an inventory of every surface id. Pre-2026-08-21 surfaces took plain
+  `AUTO_INCREMENT` ids — the `navigation` TAB_STRIP is `Core.SurfaceElements` **109–114** — so an id
+  below a block is not evidence it is unseeded, and "next free" must be verified against pre-reseed
+  rows too. Also recorded that those nav elements have `aclActionId = NULL` and Core base
+  `isVisible = 0`, so the ACL-action gate is a **no-op for navigation**. (apeterson)
 - 2026-08-26 — Seeded the **Service Request** record surfaces as a **fork** of the sales-order ones:
   `Core/2026-08-26a` (Surfaces **45** / elements **161–165**, recordId 35) and `Core/2026-08-26b`
   (Surfaces **46** / elements **166–169**). Recorded three durable rules: forking a surface **drops

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.667",
+  "version": "1.0.668",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",