toga-ai 1.0.935 → 1.0.937

package/knowledge/1.0/apps/library/features/transfer-order-purchase-order-link-reconcile.md

@@ -6,13 +6,14 @@ project: Library
 client: shared
 type: feature
 status: active
-updated: 2026-09-24
+updated: 2026-10-02
 owners: [jcardinal]
 files:
   - library/app/api/toga2.php
   - library/app/api/netsuite/rest.php
   - dbchanges2/_modules/netsuite/2026-09-24a - TransferOrderDownstreamPoBridgeAcl.sql
   - worker/crons/toga2/netsuite/process_netsuite_order.php
+  - test/@jeff/netsuite/test_match_transfer_order_purchase_order_lines.php
 related:
   - ../../../2.0/apps/_underscore/features/sales-order-purchase-order-bridge-direction.md
   - ../../worker/features/netsuite-togasupply-per-client-sync.md
@@ -39,14 +40,15 @@ Callers:
 - `linkTransferOrderPurchaseOrders()` — kept as a thin public wrapper (old callers).
 
 Expected sets, from NetSuite only:
-- **Upstream:** `otherRefNum` split on `' + '` → `findCustomerPurchaseOrderByNumber` under `$cfg['importCustomerPurchaseOrdersOnVendor']`. Missing customer PO → **created** (header + lines). TO line with no matching PO line → a new PO line is created (on NYCHH this adds stock-in — expected).
+- **Upstream:** `otherRefNum` split on `' + '` → `findCustomerPurchaseOrderByNumber` under `$cfg['importCustomerPurchaseOrdersOnVendor']`. Missing customer PO → **created** (header + lines). A new PO line is created only when the TO item is on NO line of that PO. A new PO line adds NO stock-in (stock-in = linked stocking SO's received adjustments; see [NYCHH quantities](../../../clients/nychh/features/transfer-order-inventory-quantities.md)).
 - **Downstream:** `App_Api_Netsuite_Rest::listPurchaseOrderIdsCreatedFromOrder($orderId)` (SuiteQL on `transactionline.createdfrom`). A vendor PO not yet in Toga is skipped here; the PO sync imports it later and reconciles again.
 
-Line matching (per direction):
-1. Same item `uuid`, then `partNumber`.
-2. Keep an existing link if still valid (Supply-created TO lines keep the PO line the user picked).
-3. Prefer equal quantity; each PO line used once.
-4. A TO line with NetSuite `createdPo` pairs only inside that PO.
+Line matching — `matchTransferOrderItemsToPurchaseOrderItems()` (public static, options array; helpers `chooseReusablePurchaseOrderLine`, `chooseUnclaimedPurchaseOrderLine`, `getStockedPurchaseOrderItemUuids`):
+1. Candidates = same item `uuid`, then `partNumber` (exact — no normalization; `210-BFZY-A` ≠ `210-BFZY`).
+2. A TO line with NetSuite `createdPo` pairs only inside that PO.
+3. **Upstream (customer PO, 325/329)** — rank: existing link (unless it is unstocked while a stocked line exists) > stocked line (has a `PurchaseOrderItems_SalesOrderItems` row) > not yet used by this TO > equal qty > lowest line. A PO line MAY be reused by several TO lines (soft claim). A moved link logs `RELINK` to error_log.
+4. **Downstream (vendor PO, 326/330)** — unchanged: keep valid existing link, prefer equal qty, each PO line used once.
+5. Empty/orphan PO lines are never auto-deleted.
 
 Deletes are logged: grep `reconcileTransferOrderPurchaseOrderLinks` in the worker log.
 
@@ -57,7 +59,9 @@ Deletes are logged: grep `reconcileTransferOrderPurchaseOrderLinks` in the worke
 - **ACL first.** 326/330 had no API-role ACL anywhere → 403 `EZ-1`. `_modules/netsuite/2026-09-24a - TransferOrderDownstreamPoBridgeAcl.sql` seeds the 4-layer chain + field grants 2214-2216 (326) and 2230-2232 (330), roles by NAME (`API` = id 3 in all 37 prod client DBs). Must run **before** the library deploy.
 - **Repair model = re-process, not SQL.** Fix the code so a re-run heals, then reset cursors / replay ([per-client sync](../../worker/features/netsuite-togasupply-per-client-sync.md)) or run [process_netsuite_order.php](../../worker/workflows/reprocessing-one-netsuite-order.md) for one order. No data-repair SQL.
 - **Pre-2026-09-24 upstream rows were polluted.** The old `linkPurchaseOrderToTransferOrder` path (PO `createdFrom` a TO) and old `retireStale` wrote vendor POs into 325/329. `Client_Nychh` before fix: ~533/1,593 rows in 325 and 3,981/5,893 in 329 were vendor POs; GroWrk/Elite a few. Example: NYCHH TO id 11 (NS SO 71759 / internal 1582638) had vendor POs 49338 + 49324 upstream and its real customer PO EIT0005971 was never imported. After re-process: EIT0005971 created (PO id 1005, 20 lines, customer 28908) upstream; 49324 lines 1-15 + 49338 lines 1-5 downstream; 0 vendor rows upstream.
+- **Old upstream matcher picked wrong lines (fixed 2026-10-02, `1bc4de52`).** It took the first same-item line (often an unstocked line created from a TO) and its "each PO line once" rule made new empty PO lines when a TO had the same item twice. Fix = upstream ranking above; downstream kept strict. Heal by re-processing the TO. Tests: `test/@jeff/netsuite/test_match_transfer_order_purchase_order_lines.php`.
 - Stale test: `test/@Bala/tests/netsuite_transferorder_payload_tests.php` "PO number from the column" case fails since the `TransferOrders.purchaseOrderId` drop ([transfer-orders page](../../../2.0/apps/toga25-supply/features/transfer-orders-page.md)).
 
 ## Change history
+- 2026-10-02 — Upstream line matching: stocked-line ranking + reuse; new PO line only when item absent; RELINK log; downstream unchanged. CTO alternative (soft claim, upstream only) adopted. (jcardinal)
 - 2026-09-24 — Created: two-direction reconcile replaces the upstream-only linker; fixed vendor POs written upstream; 326/330 now live + ACL'd. Prod-verified. (jcardinal)

package/knowledge/1.0/apps/togadesk/INDEX.md

@@ -2,7 +2,7 @@
 
 | Doc | Summary |
 |-----|---------|
-| [TOGa Desk Architecture](architecture.md) | Staff-facing 1.0 (App_) support desk + field-service platform (analysts at `/desk/`); open for the request pipeline, domain-class layer, MSP data model, crons/i |
+| [TOGa Desk Architecture](architecture.md) | 1.0 (App_) support desk + field-service platform — staff at `/desk/`, public/client portal at `/`; open for the request pipeline, domain-class layer, MSP data m |
 | [Email-to-Ticket Intake (crons/tickets.php)](features/email-to-ticket-intake.md) | TOGa Desk email→ticket intake via IMAP poller (`crons/tickets.php`) + postfix pipe (`crons/pipe.php`), both into `Ticket::emailToTicket()`; open for routing/thr |
 | [Field-Service Dispatch (central / repair orders)](features/field-service-dispatch.md) | TOGa Desk field-service dispatch (the **central** domain): repair-order lifecycle, technician scheduling, onsite/depot, parts, and UPS shipment tracking; open f |
 | [Managed Service Order Create Flow (New MSO modal → tickets/add)](features/managed-service-order-create.md) | TOGa Desk Managed Service Order (MSO) create flow: New MSO modal → `tickets/add` builds a `ManagedServiceOrder` + assets + a `RepairOrder` per asset; open for t |
@@ -11,6 +11,7 @@
 | [REST API (RPC-over-POST) & API-Key Auth](features/rest-api.md) | TOGa Desk programmatic API at `desk/api/` — an RPC-over-POST dispatcher (not verb/URL REST) with API-key auth; open for the request shape, status codes, auth fl |
 | [SMB Contract Editing & the clientMspId Corruption Trap](features/smb-contract-editing.md) | TOGa Desk SMB contracts modal (`/desk/?route=toga/smbcontracts`) and the `clientMspId` corruption trap that made MSP portal users see "You have no assigned clie |
 | [Staff Login Authentication (signIn) — AD vs. local password](features/staff-login-authentication.md) | TOGa Desk staff login via `signIn()` — AD branch (live) vs. |
+| [Staff SSO Login (Sso class via saml.togahub.com)](features/staff-sso-login.md) | TOGa Desk staff "Sign in with SSO" via saml.togahub.com (TRUE-78064, `Sso` class, Tools pattern); open before touching SSO login, the `?saml=` return, the `[sam |
 | [Ticket "Assign To" Lists (who can be assigned a ticket)](features/ticket-assign-to-lists.md) | How the ticket "Assign To" pickers are built (new/edit/merge modals, ticket page) and the hardcoded client exclusion list (`ASSIGN_TO_EXCLUDED_CLIENTS`, IM Hous |
 | [Ticket Lifecycle (class.ticket.php)](features/ticket-lifecycle.md) | TOGa Desk ticket creation + reply handling via `Ticket` (class.ticket.php): the four creation/reply doors, `deriveCustomerId()`, and the `addReply()` status swi |
 | [Reverting a TOGa Desk _production Deploy (revert-forward)](workflows/production-revert-forward.md) | How to cleanly roll back one ticket's changes from the togadesk `_production` branch via `git revert -m 1` of its two-parent merge, verified with `git patch-id` |

package/knowledge/1.0/apps/togadesk/architecture.md

@@ -6,9 +6,11 @@ project: TOGa Desk
 client: shared
 type: architecture
 status: active
-updated: 2026-09-25
+updated: 2026-10-02
 owners: ["mhammontree", "jcardinal"]
 files:
+  - index.php
+  - includes/loader.php
   - desk/index.php
   - desk/includes/loader.php
   - desk/config.php
@@ -33,17 +35,20 @@ related:
   - 1.0/apps/togadesk/features/email-to-ticket-intake.md
   - 1.0/apps/togadesk/features/notifications.md
   - 1.0/apps/togadesk/workflows/standalone-test-scripts.md
+  - 1.0/apps/togadesk/features/staff-sso-login.md
 ---
 
-Staff-facing 1.0 (App_) support desk + field-service platform (analysts at `/desk/`); open for the request pipeline, domain-class layer, MSP data model, crons/integrations, or system topology.
+1.0 (App_) support desk + field-service platform — staff at `/desk/`, public/client portal at `/`; open for the request pipeline, domain-class layer, MSP data model, crons/integrations, or system topology.
 
 ## Summary
 TOGa Desk is the staff-facing support desk **and field-service platform** (analysts work at `/desk/`). Framework 1.0 (`App_`) app bootstrapped from the `library` core (`_.php`). Beyond ticketing it covers asset/license/inventory management, repair-order dispatch (depot + onsite technicians), a knowledge base, host/service monitoring, RBAC, a REST-ish API, and IMAP email intake. Primary database `db_togadesk` (schema `TOGaDeskSupport`); also `db_common` and per-client databases.
 
-**Critical rules:** the live application root is **`desk/`** — the root-level legacy top-level code is dead and must never be extended (e.g. live ticket class is `desk/includes/classes/class.ticket.php`; the root `includes/classes/class.ticket.php` is an ancient variant with random ticket numbers/stale schema). Per-client host restriction (`getRestrictedClient()`) is an **entry/UI gate only** — record-level tenancy comes from the session `clientid`, not the host. TOGa Desk **shares the `TOGaDeskSupport` database with TOGa View** — a change to ticket data semantics affects both apps. `ENVIRONMENT` defaults to `worker` when unset → CLI scripts read the wrong config file.
+**Critical rules:** there are **two live trees** — `desk/` (staff app) and the repo root (`index.php` → `includes/loader.php`, the public/client portal served at `/`; docroot = repo root). Do not assume root code is dead; but root `includes/classes/` holds stale variants (e.g. root `class.ticket.php`) — live domain classes are in `desk/includes/classes/`. Per-client host restriction (`getRestrictedClient()`) is an **entry/UI gate only** — record-level tenancy comes from the session `clientid`, not the host. TOGa Desk **shares the `TOGaDeskSupport` database with TOGa View** — a change to ticket data semantics affects both apps. `ENVIRONMENT` defaults to `worker` when unset → CLI scripts read the wrong config file.
 
 ## Entry points & request pipeline
-- **Web:** `desk/index.php` → `desk/includes/loader.php`. The repo-root `index.php` / `ajax.php` are thin wrappers around the `desk/` versions.
+- **Web, staff:** `desk/index.php` → `desk/includes/loader.php`.
+- **Web, public/client portal:** repo-root `index.php` → root `includes/loader.php`, served at `/` (docroot = repo root). Clients (incl. custom-URL hosts) and staff sign in here; staff are then redirected to `/desk/`. The root loader requires `desk/includes/functions.php`, so `signIn()` etc. are the desk versions. Root page templates live in `template/pages/` (e.g. the login card in `template/pages/dashboard.php`).
+- **Staff SSO** (TRUE-78064, prod only): `?route=signin&sso=1` and the gateway's `?saml=` return route through `general.php` → `Sso`. See [staff SSO login](features/staff-sso-login.md).
 - **Bootstrap order** (`loader.php`): local `functions.php` → `config.php` → register the two custom autoloaders `vendorClassAutoload` (`desk/vendor/classes/`) and `appClassAutoload` (`desk/includes/classes/`) → Composer autoload → `require _.php` + `App_Framework_TOGaDesk::initialize()` (starts session with `HttpOnly`/`Secure`, inits Sentry, XSS-protects `$_REQUEST`/`$_GET`/`$_POST`) → `App_Page::validateCrossSiteRequestForgery()` → Medoo `$database` instantiated from config → resolve logged-in user `$liu` via `people.sessionid` → unserialize the user's role `perms`.
 - **`$route`** comes from `$_GET['route']` (defaults to `dashboard`) and is sanitized against path traversal.
 - **Sequential controller pipeline**, each stage gated on a query param:
@@ -136,12 +141,15 @@ Invariants:
 - `ENVIRONMENT` defaults to `worker` when unset → CLI scripts read the wrong config file.
 - Heavy **hardcoded client-ID branching** in `central` dispatch and `tickets/add` (Walmart, WJE, Compass/ODP, AIG, RUMCSI) — verify the client arm before changing shared logic.
 - **Two `class.ticket.php` files** — only `desk/includes/classes/` is live; the root variant is dead (random ticket numbers, stale schema).
+- **Autoloader path differs local vs prod.** `appClassAutoload()` (`desk/includes/functions.php` ~L418) appends `/desk` only when `$scriptpath` does NOT end in `desk`. A local checkout at `.../togadesk` ends in `desk`, so the root tree loads **root** `includes/classes` locally but `desk/includes/classes` in prod (`/var/app/current`). Root pages needing a desk class should `require_once` it explicitly (see `template/pages/dashboard.php` for `Sso`). Not fixed.
+- **⚠ `config.*.ini` may be web-readable.** Docroot is the repo root and there is no `FilesMatch` deny for `*.ini`; `config.prod.ini` is committed with plaintext DB/SMTP creds (and, with SSO, Core + Client_True creds). Use read-only DB users / EB env vars. Not fixed — see [staff SSO login](features/staff-sso-login.md).
 - The API has **no pagination** — `get` returns full result sets; Medoo `filters` pass straight to the WHERE clause.
 - The prod O365 OAuth secret used by `crons/tickets_prod.php` has a **hard expiry (~2026-12-20)**.
 - **Cross-tenant login hole in the per-client host restriction (pre-existing, NOT fixed).** The password-login access condition in `desk/includes/functions.php` (~L627-631) is a chain of ORs; two clauses grant access regardless of which client's subdomain is in use, letting an IM Houston or Fordham user sign in on another client's branded host. Post-login filtering keys off the session `clientid` so it is not an immediate record leak, but it defeats the restriction and contradicts the comment directly above it. Deserves its own ticket.
 - **Sessions are host-scoped, so a domain change logs everyone out.** `ebs/setup_phpini.php` sets `session.save_handler=rediscluster` but no `session.cookie_domain`, and there is no `session_set_cookie_params()` anywhere. Combined with `people.sessionid` being a **single column**, logging in on a second domain invalidates the session on the first.
 
 ## Related
+- [Staff SSO login](features/staff-sso-login.md)
 - [TOGa View architecture](../togaview/architecture.md)
 - [Ticket lifecycle](features/ticket-lifecycle.md)
 - [REST API](features/rest-api.md)

package/knowledge/1.0/apps/togadesk/features/staff-login-authentication.md

@@ -6,13 +6,14 @@ project: TOGa Desk
 client: shared
 type: feature
 status: active
-updated: 2026-09-16
+updated: 2026-10-02
 owners: ["mhammontree"]
 files:
   - desk/includes/functions.php
   - desk/includes/controllers/general.php
   - desk/includes/controllers/actions/user/loginAsAnother.php
 related:
+  - 1.0/apps/togadesk/features/staff-sso-login.md
   - 1.0/apps/togadesk/features/per-client-host-restriction.md
   - 1.0/apps/togaview/features/login-flows.md
   - 1.0/apps/togadesk/architecture.md
@@ -24,6 +25,8 @@ TOGa Desk staff login via `signIn()` — AD branch (live) vs. the armed email-on
 
 TOGa Desk staff login runs through `signIn()` in `desk/includes/functions.php` (~L458), reached from `desk/includes/controllers/general.php:8`. It has **two mutually exclusive branches** selected by the feature flag `App_Feature::ACTIVE_DIRECTORY_LOGIN`. The AD branch is the live production path; the non-AD `else` branch is an **armed landmine** whose password check is commented out (see Gotchas).
 
+Staff **SSO** (TRUE-78064, prod only) is a separate path that does not go through `signIn()` — see [staff SSO login](staff-sso-login.md). The password form below stays for clients, staff fallback, and the dev bypass.
+
 `signIn()` is also the **only** place `people.lastlogin` is written — which makes that column useless for measuring TOGa View portal usage.
 
 ## How it works
@@ -32,7 +35,8 @@ TOGa Desk staff login runs through `signIn()` in `desk/includes/functions.php` (
 2. `signIn()` branches on `App_Feature::ACTIVE_DIRECTORY_LOGIN`. **Verified in production (2026-08-21):** `Vision.FeatureFlags` id 7, `framework = 'App_Framework_TOGaDesk'`, `isActive = 1`, created 2020-08-10 — so the AD branch has been the live path for five years.
 3. **AD branch.** Attempts an Active Directory check against Agilant's directory (`db_common`). Emails outside Agilant's AD — every client user — fail that check and fall through to the **local credential check** at ~L611-620: `people.email LIKE … AND people.password LIKE sha1($password) AND people.adPeopleId IS NULL`.
 4. **Client-restriction gate (~L631).** After a successful local check, access is gated by an OR-chain keyed on `getRestrictedClient()`. Client constants live in the same file (~L1488-1531), e.g. `CLIENT_RUMCSI = 146`, `CLIENT_DEPARTMENT_RUMCSI = 231`. The per-client branded host is resolved by `getRestrictedClient()` (~L1558) — see [per-client hostname restriction](per-client-host-restriction.md).
-5. On success `signIn()` writes `people.lastlogin` (`desk/includes/functions.php:588, 635, 672, 689`). `desk/includes/controllers/actions/user/loginAsAnother.php:17-18` is the only other writer.
+5. On success `signIn()` writes `people.lastlogin` (`desk/includes/functions.php:588, 635, 672, 689`). `desk/includes/controllers/actions/user/loginAsAnother.php:17-18` and `Sso::consume()` are the only other writers.
+6. **Dev bypass.** `devLoginBypassAllowed()` (~L468) skips the AD password check (~L550, ~L685) when in dev **or** test mode.
 
 ### Data model
 `TOGaDeskSupport.people` — `email` (UNIQUE), `password` (bare SHA-1), `adPeopleId`, `ldap_user`, `clientid`, `roleid`, `type`, `approved`, `isActive`, `lastlogin`. `Vision.FeatureFlags` — the `ACTIVE_DIRECTORY_LOGIN` row (id 7).
@@ -47,12 +51,22 @@ It is **not reachable in production** — `ACTIVE_DIRECTORY_LOGIN` has been on s
 ### `people.lastlogin` is written by togadesk ONLY — never by togaview
 TOGa View's `?hash=` handoff block and `mvc/login/post.php` populate the session and never touch `lastlogin`. So:
 - A NULL / stale `lastlogin` does **not** mean the account is unused — a portal user may log in daily and never move the column.
-- `lastlogin` measures **TOGa Desk staff** activity, full stop. Any query that uses it to size portal adoption is wrong. (This invalidated a mid-session conclusion during TRUE-81051; an easy analysis trap to fall into twice.)
+- `lastlogin` measures **TOGa Desk staff** activity (password or SSO), full stop. Any query that uses it to size portal adoption is wrong. (This invalidated a mid-session conclusion during TRUE-81051; an easy analysis trap to fall into twice.)
 
 ### Client-user logins are local-password logins even with AD on
 The AD branch's name suggests client users authenticate against a directory. They do not — they land on the local SHA-1 check. The AD path serves Agilant staff (`clientId = 2`) only.
 
+### Dev login bypass is on in every `test_mode=1` environment
+`devLoginBypassAllowed()` = dev OR test mode, so alpha/beta/stage/demo/hotfix all accept a staff login without the AD password. Pre-existing. Confirm those hosts are not public.
+
+### Password login still bypasses Entra MFA
+With SSO live, staff can still sign in with AD/local password on the main host and skip MFA. Possible later step: reject password login for AD-linked staff in prod. Not done.
+
 ## Related
+- [Staff SSO login](staff-sso-login.md)
 - [Per-client hostname restriction](per-client-host-restriction.md)
 - [TOGa View login flows](../../togaview/features/login-flows.md)
 - [TOGa Desk architecture](../architecture.md)
+
+## Change history
+- 2026-10-02 — Linked the new staff SSO path (TRUE-78064); recorded dev-bypass-in-test-mode and MFA-bypass gotchas (mhammontree)

package/knowledge/1.0/apps/togadesk/features/staff-sso-login.md

@@ -0,0 +1,72 @@
+---
+title: Staff SSO Login (Sso class via saml.togahub.com)
+framework: "1.0"
+repo: togadesk
+project: TOGa Desk
+client: shared
+type: feature
+status: draft
+updated: 2026-10-02
+owners: ["mhammontree"]
+files:
+  - desk/includes/classes/class.sso.php
+  - desk/includes/loader.php
+  - desk/includes/controllers/general.php
+  - desk/template/signin.php
+  - template/pages/dashboard.php
+  - config.prod.ini
+  - dbchanges2/Core/2026-10-02a - TogaDeskSsoDomain.sql
+related:
+  - ./staff-login-authentication.md
+  - ../architecture.md
+  - ../../tools/features/saml-sso-auth.md
+  - ../../library/features/app-sso-initiation.md
+  - ../../../2.0/apps/saml/features/downstream-integration-contract.md
+  - ../../../2.0/apps/saml/features/acs-assertion-trust-gaps.md
+  - ../../../clients/true/profile.md
+---
+
+TOGa Desk staff "Sign in with SSO" via saml.togahub.com (TRUE-78064, `Sso` class, Tools pattern); open before touching SSO login, the `?saml=` return, the `[saml]` config, or the TogaDesk Core.Domains row.
+
+## Summary
+TRUE-78064 replaces Active Directory for **TOGA staff** with SSO through `saml.togahub.com`, copying the Tools `App_Sso` pattern. Status 2026-10-02: written + locally tested, **not committed or deployed**; the return leg can only be fully tested in prod (needs the prod Core.Domains row + prod key).
+
+Decisions (Mark + Brandon/call center, 2026-10-02):
+- Staff only. Matched to an existing `TOGaDeskSupport.people` row by email. SSO **never creates** people rows — no row = cannot log in.
+- **Prod only.** Only `config.prod.ini` has `[saml]`; beta/stage/dev have no SSO.
+- No SSO-only page and no auto-redirect: a **"Sign in with SSO" button** on the normal login. TogaDesk cannot detect a Microsoft session itself; staff already signed in to Microsoft pass straight through after one click (same as Tools).
+- Clients have **no** SSO — only custom-URL (host-based) portals. Their login does not change. Password form stays for clients, staff fallback, and the dev bypass.
+- Prod host: `togadesk.togatech.com`.
+
+## How it works
+1. **Start:** button → `/desk/?route=signin&sso=1` → `general.php` → `Sso::initiate()`: stores `{nonce,time}` in `$_SESSION`, calls `App_Sso::initiate()` with `[saml]` config + the current `API_SECRET_ACCESS_TOKEN` read from 2.0 `Core.Parameters` over `db_toga2core`; nonce goes in `urlParameters`.
+2. **Return:** gateway redirects to `<Core.Domains.domain>?saml=<payload>&urlParameters=<nonce>`. `loader.php` sets `$route = "sso"` when `?saml=` is present, `route` is empty, and `Sso::isAvailable()`; route `sso` skips `isSignedIn()` and the `$liu` lookup.
+3. **Consume** (`Sso::consume()`):
+   - nonce check: `hash_equals`, single use, 300 s max age (= gateway TTL); payload length cap 8192; `is_string` guards.
+   - base64 decode (a `+` arrives as a space → `strtr` back).
+   - decrypt client + user with current → previous key. Check IV length first: `App_String::decryptWithKey` warns on short input, and a 1.0 warning ends the request.
+   - client uuid must equal `[saml] true_client_uuid`; load `Client_True.Users` email by uuid, `isActive=1` (`db_true`).
+   - email must match **exactly one** `db_common` AD People row (`EmailAddresses`) — the same staff test the AD login uses.
+   - find `TOGaDeskSupport.people` by any AD alias OR `adPeopleId`, `isActive=1`, `clientid` NULL or not Office Depot; prefer `@togatech.com`, then lowest id. Set `adPeopleId` only if no other row holds it.
+   - `session_regenerate_id` (fail if it cannot), write `people.sessionid` / `lastlogin` by id, set `userLabel`, `logSystem`, `Referrer-Policy: no-referrer`, redirect `?route=dashboard`.
+   - Any failure: `logSystem` the reason (never the payload), `setStatus(1200)`, redirect `?route=signin`, `exit`.
+4. **Safe to send headers:** unlike Tools, `App_FrameworkIndex_TOGaDesk::render()` emits nothing, so `general.php` runs before any output. No `headers_sent()` workaround needed.
+5. **`Sso::isAvailable()`** = every `[saml]` key set (`idp_single_sign_on_service_url`, `idp_entity_identifier`, `assertion_consumer_service_url`, `domain_uuid`, `true_client_uuid`, `return_url`), `[database_true]` + `[database_toga2core]` hostnames set, and `HTTP_HOST` == host of `[saml] return_url`. It does **not** call `getRestrictedClient()` (the root portal also calls it). So client custom-URL hosts never show the button.
+6. **Buttons** on both the root portal login card (`template/pages/dashboard.php` — the page staff land on at `/`) and `/desk/?route=signin` (where failures return).
+
+### Core.Domains row (`dbchanges2/Core/2026-10-02a - TogaDeskSsoDomain.sql`)
+`uuid d1e526b9-e2fb-4462-935f-ed449e8f5986` (= `[saml] domain_uuid`), `clientId 1` (True), `appId 18` (togadesk-1, from a historic seed — **confirm in prod before running**), `environmentId 1`, `domain https://togadesk.togatech.com/desk/`. Unqualified `Domains`, guarded `WHERE NOT EXISTS` on uuid OR (clientId, appId, environmentId). Domain must have **no query string** — see the [gateway contract](../../../2.0/apps/saml/features/downstream-integration-contract.md).
+
+### Kill switch
+Set `[saml] domain_uuid = ""` in `config.prod.ini` and deploy → button hidden, SSO off, password login unaffected.
+
+## Gotchas
+- **Root-tree class loading differs local vs prod.** The root portal page needs `Sso`, but the autoloader quirk (see [architecture](../architecture.md)) loads root `includes/classes` locally. `template/pages/dashboard.php` does `if (!class_exists('Sso')) require_once __DIR__ . '/../../desk/includes/classes/class.sso.php';` — keep it.
+- **⚠ SSO inherits the gateway's forged-login hole.** `/acs` does not verify the IdP signature, so anyone can forge a login for any staff email. Same exposure as Tools. See [acs trust gaps](../../../2.0/apps/saml/features/acs-assertion-trust-gaps.md). Not fixed; Mark to raise with Jeff/Rohan.
+- **Handoff replay.** The payload has no issue time or single-use id. The nonce blocks login CSRF, but a leaked `?saml=` URL can be replayed by someone who starts their own SSO inside the window. App fix: a used-payload table; gateway fix: nonce + iat + MAC inside the payload. Not fixed.
+- **⚠ `config.prod.ini` may be web-readable.** Docroot is the repo root and there is no `FilesMatch` deny for `*.ini`. The committed file holds plaintext DB/SMTP creds and now also `[database_true]` and `[database_toga2core]` — the latter can read the master SSO key for every app. Use read-only DB users / EB env vars. Not fixed.
+- **SSO does not force MFA.** Staff can still use AD/local password on the main host and skip Entra MFA. Possible later step: reject password login for AD-linked staff in prod.
+- **Local testing ends at the gateway.** Gateway "Invalid SAMLResponse (Code = 2)" locally = local `Core_2.Parameters` key differs from prod. Expected; not a code bug.
+
+## Change history
+- 2026-10-02 — Created: staff SSO button + `Sso` class, prod-only, staff matched by email, no auto-create (TRUE-78064, not yet deployed) (mhammontree)

package/knowledge/1.0/apps/tools/features/saml-sso-auth.md

@@ -6,8 +6,8 @@ project: Tools
 client: shared
 type: feature
 status: active
-updated: 2026-09-16
-owners: [jcardinal, ajean]
+updated: 2026-10-02
+owners: [jcardinal, ajean, mhammontree]
 files:
   - tools/_/app/auth.php
   - tools/mvc/sso/initiate/get.php
@@ -24,6 +24,7 @@ related:
   - ../../library/features/app-sso-initiation.md
   - ../../../2.0/apps/saml/features/downstream-integration-contract.md
   - ../../../clients/true/features/users-personas-data-model.md
+  - ../../togadesk/features/staff-sso-login.md
 ---
 
 Tools `App_Auth`: consumes the 2.0 SAML gateway `?saml=` handoff, establishes its own session, and gates pages by Client_True persona; open for the SSO legs, the `Core.Parameters` runtime key sourcing, or the headers-already-sent/persona-snapshot gotchas.
@@ -67,7 +68,7 @@ The shared secret is **rotated regularly**, so any static `config.*.ini [saml]`
 `mvc/login/post.php` permits **email-only** login **only** when config `[internal] dev_mode` is truthy **and** `App_Registry::inDevMode()` — both must hold. When used it writes a `SECURITY` line to `error_log`.
 
 ### One-step sign-in
-Home route `/` (`mvc/get.php`), when not logged in, does `App_MVC::routeTo('/login'); return;` so the SSO button is the only click — the previous welcome-card "Sign in" → `/login` intermediate step was removed.
+Home route `/` (`mvc/get.php`), when not logged in, does `App_MVC::routeTo('/login'); return;`. `/login` (`mvc/login/get.php`) renders only a **"Sign in with SSO" button** (+ the dev bypass form in dev). Tools does **not** auto-detect an existing Microsoft session — the user clicks once; if already signed in to Microsoft they pass straight through. Verified on `origin/_production` 2026-10-02. TOGa Desk copies this model — see [TOGa Desk staff SSO](../../togadesk/features/staff-sso-login.md).
 
 ### Crypto format (`App_String::encryptWithKey` / `decryptWithKey`)
 `library/app/string.php:1075-1094`, AES-256-CBC: `encryptWithKey` returns `base64( iv . openssl_encrypt(..., flag 0) )` — i.e. a base64 envelope whose body is the raw IV followed by openssl's own base64 ciphertext; `decryptWithKey` reverses it. **Interoperable byte-for-byte with the 2.0 `_String::decryptWithKey()`** that the SAML gateway uses to produce the handoff token. The 2026-06-30 login failure decoded to the exact expected iv+base64 shape, proving the issue was a stale **key**, not a cipher/format mismatch.
@@ -95,3 +96,7 @@ The platform's rotating key/value parameter store, on the **2.0 PROD Core DB** (
 - [App_Sso initiation (library)](../../library/features/app-sso-initiation.md)
 - [SAML downstream integration contract (2.0)](../../../2.0/apps/saml/features/downstream-integration-contract.md)
 - [True users/personas data model](../../../clients/true/features/users-personas-data-model.md)
+- [TOGa Desk staff SSO (same pattern)](../../togadesk/features/staff-sso-login.md)
+
+## Change history
+- 2026-10-02 — Clarified sign-in is one click on an SSO button; no auto-detect of a Microsoft session (mhammontree)

package/knowledge/1.0/apps/worker/INDEX.md

@@ -21,6 +21,7 @@
 | [Walmart Daily Sales Report (send_toga_walmart_report.php)](features/walmart-daily-sales-report.md) | The two Walmart sales workbooks (summary + details) built from `TOGA_Walmart` (in-store) and `TOGA_WalmartEComm` (.COM); open for the pseudo-store 1472 channel |
 | [Diagnosing frozen 1.0 worker cron check-ins (Sentry "missed" flood)](workflows/diagnosing-frozen-cron-checkins.md) | Ordered path to diagnose frozen 1.0 worker cron timestamps + a Sentry `worker1` "missed" flood; open when check-ins stall and you suspect a wedged lock. |
 | [isFulfillable Multi-Client Backfill (all togasupply clients)](workflows/isfulfillable-multi-client-backfill.md) | One-time backfill catching up `Items.isFulfillable` on existing items across all 17 togasupply clients; open when running/re-running it or deciding whether rema |
+| [Mapping NetSuite customer address-book entries to Toga Locations (process_netsuite_addressbook_mapping.php)](workflows/netsuite-addressbook-location-mapping.md) | Operator CLI that maps a client customer's NetSuite address-book entry ids to Toga Locations (`Locations_Addresses.c_netsuiteInternalAddressbookId`), so TO impo |
 | [Deduplicating NetSuite duplicate Items across client DBs (recursive MERGE)](workflows/netsuite-duplicate-items-dedup.md) | Per-client cleanup collapsing duplicate `Items` rows (same `partNumber`) to one canonical via recursive MERGE; open before running it — and read the catalog-bli |
 | [Onboarding a Client to the NetSuite TOGa Supply Sync](workflows/onboarding-client-to-netsuite-togasupply-sync.md) | How to add a new TOGa 2 client to the per-client NetSuite → TOGa Supply importer; open when onboarding a client, and read the vendor-seed / ACL / Parameters-see |
 | [Re-processing NetSuite orders, fulfillments, receipts and inventory adjustments (process_netsuite_*.php)](workflows/reprocessing-one-netsuite-order.md) | Run the real sync for given NetSuite ids on ONE client, without touching cursors: one order (+ its vendor POs), or a list of fulfillments/receipts/inventory adj |

package/knowledge/1.0/apps/worker/workflows/netsuite-addressbook-location-mapping.md

@@ -0,0 +1,51 @@
+---
+title: "Mapping NetSuite customer address-book entries to Toga Locations (process_netsuite_addressbook_mapping.php)"
+framework: "1.0"
+repo: worker
+project: Worker
+client: shared
+type: workflow
+status: active
+updated: 2026-10-02
+owners: [jcardinal]
+files:
+  - worker/crons/toga2/netsuite/process_netsuite_addressbook_mapping.php
+  - library/app/api/netsuite/rest.php
+  - _underscore/Trait/Netsuite/Locations/Address.php
+  - dbchanges2/_modules/netsuite/2026-10-01a - LocationsAddressesNetsuiteAddressbookId.sql
+  - dbchanges2/_modules/netsuite/2026-10-01b - LocationsAddressesAddressbookIdCustomField.sql
+related:
+  - ../../../../clients/nychh/features/netsuite-transfer-order-import.md
+  - ../../../../clients/nychh/features/location-shipping-addresses.md
+  - ./reprocessing-one-netsuite-order.md
+---
+
+Operator CLI that maps a client customer's NetSuite address-book entry ids to Toga Locations (`Locations_Addresses.c_netsuiteInternalAddressbookId`), so TO import resolves the destination by entry id; open to propose/apply or extend the mapping.
+
+## Summary
+- Manual CLI, never scheduled. The sync only READS the mapping; it never writes it (no self-learning — CTO AGREE).
+- Two passes: `--propose` writes a CSV for review; `--apply` writes the reviewed CSV.
+- Column `Locations_Addresses.c_netsuiteInternalAddressbookId` (INT UNSIGNED, unique) is all-NetSuite-client (`_modules/netsuite/`); declared via `_Trait_Netsuite_Locations_Address` on every NetSuite client's `Model/<Client>/Locations/Address.php` (22 clients; Compass USA = `Model/Compass/Usa/Locations/Address.php`). Undeclared → /v2 EV-8.
+
+## How it works
+From `worker/`:
+```
+php crons/toga2/netsuite/process_netsuite_addressbook_mapping.php <client> --propose=<csv> [--id=<entry id>]
+php crons/toga2/netsuite/process_netsuite_addressbook_mapping.php <client> --apply=<csv> [--id=<entry id>]
+```
+Entries come from `App_Api_Netsuite_Rest::listCustomerAddressbookEntries()`. Each entry gets a reason (NetSuite decides; Toga only as fallback):
+1. `BILLING` — skipped: entry is any site's default billing.
+2. `AGILANT` — skipped (Agilant's own address).
+3. `ADDRESSEE` — addressee names exactly one site.
+4. `NETSUITE` — exactly one site's own NetSuite address book has the same street + zip.
+5. `NETSUITE_DEFAULT_SHIPPING` — tie broken by which site has it as default shipping.
+6. `TOGA` — fallback by Toga location address (for stale customer ids).
+Anything else stays unmapped → import falls back to text match.
+
+## Gotchas
+- NYCHH 2026-10-02: 61 entries → 18 sites. Unmapped by design: shared buildings and the shared 462 1st Ave dock — list on [NYCHH location addresses](../../../../clients/nychh/features/location-shipping-addresses.md).
+- Stale customer ids (NYCHH Bellevue 29275, Jacobi 31917 do not exist in NetSuite) only map via `TOGA`.
+- After apply, re-process affected TOs (`process_netsuite_order.php <client> --tranid=a,b`) to move their destination.
+
+## Change history
+- 2026-10-02 — Created; applied for NYCHH. (jcardinal)

package/knowledge/1.0/apps/worker/workflows/reprocessing-one-netsuite-order.md

@@ -6,7 +6,7 @@ project: Worker
 client: shared
 type: workflow
 status: active
-updated: 2026-09-30
+updated: 2026-10-02
 owners: ["jcardinal", "rgirish"]
 files:
   - worker/crons/toga2/netsuite/process_netsuite_order.php
@@ -37,7 +37,7 @@ From the `worker/` directory:
 php crons/toga2/netsuite/process_netsuite_order.php <client> --tranid=<NS order #>
 php crons/toga2/netsuite/process_netsuite_order.php <client> --id=<NS internal id>
 ```
-`<client>` = the wrapper suffix of `sync_togasupply_<client>.php` (e.g. `hh`, `growrk`, `elite`). Pass exactly one of `--tranid` / `--id`.
+`<client>` = the wrapper suffix of `sync_togasupply_<client>.php` (e.g. `hh`, `growrk`, `elite`). Pass exactly one of `--tranid` / `--id`. Both accept a comma list (`--id=a,b`, `--tranid=a,b`): runs in order, stops on the first error.
 
 Steps the script runs:
 1. Refuses if `sync_togasupply_<client>.php` is running (`ps -ef`) — two writers can duplicate links.
@@ -73,6 +73,7 @@ php crons/toga2/netsuite/process_netsuite_inventory_adjustment.php <client> --id
 - Needs `IS_ENABLED_INTEGRATION_TRANSFER_ORDERS` true in the wrapper for TO routing; otherwise the order syncs as a sales order.
 
 ## Change history
+- 2026-10-02 — `process_netsuite_order.php` accepts comma lists for `--id` / `--tranid` (`a72f17f5`). (jcardinal)
 - 2026-09-30 — Added `process_netsuite_item_fulfillment.php` + `process_netsuite_inventory_adjustment.php`. (jcardinal)
 - 2026-09-30 — Added `process_netsuite_records.php` (fulfillments/receipts by id); Closed routing follows the closed-order rule (v3: line-level). (rgirish)
 - 2026-09-24 — Created; prod-verified on NYCHH TO 11. (jcardinal)

package/knowledge/2.0/apps/saml/features/acs-assertion-trust-gaps.md

@@ -6,8 +6,8 @@ project: SAML SSO Gateway
 client: shared
 type: feature
 status: active
-updated: 2026-09-25
-owners: ["rgirish"]
+updated: 2026-10-02
+owners: ["rgirish", "mhammontree"]
 files:
   - saml/Controller/Index.php
   - _underscore/String.php
@@ -49,6 +49,11 @@ Git history: the block arrived in commit `4bcee38` "Final changes for Compass SA
 **email only**, with no issuer check. So any IdP the gateway already trusts (Compass, Prudential,
 Office Depot) can assert a `@togatech.com` email and be handed the internal user.
 
+**Affected consumers:** every app that trusts a True login from the gateway — Tools and TOGa Desk
+staff SSO ([Tools](../../../1.0/apps/tools/features/saml-sso-auth.md),
+[TOGa Desk](../../../1.0/apps/togadesk/features/staff-sso-login.md)). A forged assertion for any
+staff email signs that person in to both.
+
 The per-client IdP verification certs already exist in source as base64 blobs (Compass, Office
 Depot, Prudential, RUMCSI, Agilant) — they are what a re-enabled verifier would load. Verification
 is per-client; each IdP's signing cert must match its own client.
@@ -63,7 +68,14 @@ stop replay on its own. There is also **no nonce and no single-use marking** —
 presented any number of times.
 
 **Fix direction:** AES-256-GCM, or an HMAC verified with `hash_equals()` **before** decrypting,
-plus a server-side single-use nonce. Changing `encryptWithKey()` affects every caller — it is also
+plus a server-side single-use nonce.
+
+### Gap 3 — the `?saml=` handoff is replayable
+
+The handoff payload carries no issue time and no single-use id. TOGa Desk's session nonce blocks
+login CSRF, but a leaked `?saml=` URL can be replayed by someone who starts their own SSO inside
+the window. App-side fix: a used-payload table. Gateway-side fix: nonce + iat + MAC inside the
+payload. Changing `encryptWithKey()` affects every caller — it is also
 the `?saml=` handoff and the api2 encrypted-user-uuid auth, so this is not a local change.
 
 ## Gotchas
@@ -77,4 +89,5 @@ the `?saml=` handoff and the api2 encrypted-user-uuid auth, so this is not a loc
   citing this doc as sign-off.
 
 ## Change history
+- 2026-10-02 — Added Tools + TOGa Desk as affected consumers; recorded handoff replay (Gap 3) (mhammontree)
 - 2026-09-25 — Created; recorded that `/acs` verifies no IdP signature and no Audience/Destination/InResponseTo/NotBefore/NotOnOrAfter, and that RelayState uses unauthenticated AES-256-CBC with an attacker-supplied IV (rgirish)

package/knowledge/2.0/apps/saml/features/downstream-integration-contract.md

@@ -6,8 +6,8 @@ project: SAML SSO Gateway
 client: shared
 type: feature
 status: active
-updated: 2026-09-16
-owners: [jcardinal]
+updated: 2026-10-02
+owners: [jcardinal, mhammontree]
 files:
   - saml/Controller/Index.php
   - _underscore/Model/Core/ClientAuthentication.php
@@ -16,6 +16,9 @@ related:
   - ../architecture.md
   - ../../_underscore/architecture.md
   - ../../../clients/rate/features/saml-sso.md
+  - ./acs-assertion-trust-gaps.md
+  - ../../../1.0/apps/tools/features/saml-sso-auth.md
+  - ../../../1.0/apps/togadesk/features/staff-sso-login.md
 ---
 
 Integration recipe for a downstream TOGa app to authenticate users via the SAML gateway (`saml.togahub.com`); open when wiring a new SSO-consuming app.
@@ -45,7 +48,14 @@ where the JSON is:
   "payload": { "client": "encryptWithKey(client.uuid)", "user": "encryptWithKey(user.uuid)" }
 }
 ```
-all encrypted under the Core `API_SECRET_ACCESS_TOKEN`. An optional `?urlParameters` is forwarded through.
+all encrypted under the Core `API_SECRET_ACCESS_TOKEN`. `urlParameters` from RelayState is forwarded back.
+
+Exact build (`saml/Controller/Index.php` ~L459): `$domain->domain . '?saml=' . $authPayload . '&urlParameters=' . …`. So:
+- The `Core.Domains.domain` value **must have no query string** — the gateway appends `?saml=` blindly.
+- The payload is base64 but **not urlencoded** — a `+` arrives as a space; the consumer must `strtr(' ', '+')` before decoding.
+- `Core.Domains` has UNIQUE(clientId, appId, environmentId) and a unique `domain`, so an app gets **one return URL per client + app + environment**.
+
+Known 1.0 consumers (all True staff): [Tools](../../../1.0/apps/tools/features/saml-sso-auth.md), [TOGa Desk](../../../1.0/apps/togadesk/features/staff-sso-login.md).
 
 The downstream app then base64-decodes the `saml` param, JSON-parses it, decrypts the client and user UUIDs with `_String::decryptWithKey()`, loads the user, and **establishes its own session**. The gateway holds no session — session ownership is entirely the downstream app's.
 
@@ -59,9 +69,14 @@ The downstream app then base64-decodes the `saml` param, JSON-parses it, decrypt
 
 - **Lazy-transaction write-drop.** `_Database::register()` auto-starts a lazy transaction (since Apr 2026). Any `/acs` write path (e.g. user auto-creation) must call `_Database::transactionCommit()` before exit or the writes are silently rolled back.
 - **Gateway holds no session** — every downstream app must build and own its own session from the decrypted handoff.
+- **"Invalid SAMLResponse (Code = 2)"** from the gateway = RelayState could not be decrypted with Core `API_SECRET_ACCESS_TOKEN` / `_PREVIOUS`. Seen when testing from local: local `Core_2.Parameters` key ≠ prod key. A full return-leg test needs the prod `Core.Domains` row + a deploy.
+- **The handoff is not replay-safe** — no issue time or single-use id. See [acs trust gaps](./acs-assertion-trust-gaps.md).
 
 ## Related
 
 - [saml Architecture](../architecture.md)
 - [_underscore Architecture](../../_underscore/architecture.md)
 - [Rate SAML SSO](../../../clients/rate/features/saml-sso.md)
+
+## Change history
+- 2026-10-02 — Documented exact return-URL build (no query string in domain, unencoded base64), one domain per client+app+env, Code 2 meaning, TOGa Desk as consumer (mhammontree)

package/knowledge/2.0/apps/worker2/features/netsuite-transferorder-outbound-push.md

@@ -6,7 +6,7 @@ project: Worker
 client: shared
 type: feature
 status: active
-updated: 2026-09-25
+updated: 2026-10-02
 owners: ["bala", "jcardinal"]
 files:
   - worker2/Worker/Netsuite/SalesOrder.php
@@ -78,7 +78,7 @@ Nothing beyond this list. A transfer order has no shipping cost, ship method, te
 | `tranDate` | `dateOrder`, date only; **omitted** when null |
 | `otherRefNum` | the PO number (developer's explicit requirement) |
 | `memo` | `TransferOrders.description` — the NYCHH custom form renders it as **"ORDER DESCRIPTION"** |
-| `shippingAddress` | the **destination** Location's `primaryLocationAddress.address` (added 2026-09-09, live 2026-09-14). Key **omitted** when the destination has no address — and **omitting it is a bug, not a safe default**: NetSuite then ships to the customer's default site. |
+| `shippingAddress` | the TO's own `shipToAddress` (`TransferOrders.shipToAddressId`, 2026-10-02) when set; else the **destination** Location's `primaryLocationAddress.address` (added 2026-09-09, live 2026-09-14). Key **omitted** when the destination has no address — and **omitting it is a bug, not a safe default**: NetSuite then ships to the customer's default site. |
 | `shippingAddress.attention` | the TOGA delivery contact (`transferOrder.contact`): `firstName + ' ' + lastName` (empty parts dropped), fallback `contact._name`. Set only when both an address and a name exist; no contact → attention untouched. Name only, no phone (developer decision). `resolveTransferOrderContactName()`; the address is **cloned** first so the Location's address object is not mutated. Live in prod 2026-09-25. |
 | `externalId` | `toga-to-<transfer order uuid>` |
 | line `item` / `quantity` | each transfer-order item |
@@ -260,6 +260,7 @@ When the payload omits the ship-to address the create **succeeds**, so it looks
 - **`git diff --stat` after any programmatic full-file write to `_underscore`.** A full-file write with an editor default flipped CRLF → LF on `_underscore/Model/Nychh/TransferOrder.php` — content identical, git reported it modified with no content hunks. Restored with `git checkout --`. Standing rule: [2.0 backend PHP standards](../../standards/backend-php.md).
 
 ## Change history
+- 2026-10-02 — Push sends the TO's own `shipToAddress` when set (new `TransferOrders.shipToAddressId`, RecordField 2682); destination Location address is the fallback. (jcardinal)
 - 2026-09-24 — `resolvePurchaseOrderNumber()` bridge-only (column 2143 dropped); multiple POs joined with `' + '`. (jcardinal)
 - 2026-09-25 — delivery contact name sent as `shippingAddress.attention`. (jcardinal)
 

package/knowledge/2.0/apps/worker2/features/service-request-sales-order-generation.md

@@ -72,7 +72,7 @@ An item with no active vendor is absent from the result and produces no PO line.
 
 `c_netsuiteInternalVendorId` is present in **22 of 35 tenant databases — 13 do not have it**. Referencing it blind fails with MySQL *"Unknown column"* for those 13. So the worker runs a runtime `information_schema.COLUMNS` probe (`TABLE_SCHEMA` = client DB, `TABLE_NAME = 'Vendors'`) and only splices the ranking clause into `ORDER BY` when the column exists.
 
-Generalizes: `c_` columns are framework-dynamic and **per-tenant schema**, so any shared multi-tenant query touching one must probe for it or be scoped to tenants known to have it. See the `c_`-column convention in `2.0/standards/framework-rules.md`.
+Generalizes: `c_` columns are **per-tenant schema**, so any shared multi-tenant query touching one must probe for it or be scoped to tenants known to have it. See the `c_`-column convention in `2.0/standards/framework-rules.md`.
 
 ### Verifying the whole chain — `test_elite_chain_toga2.php`
 

package/knowledge/2.0/apps/worker2/features/talos-transcript-ingestion.md

@@ -6,7 +6,7 @@ project: Worker
 client: shared
 type: feature
 status: active
-updated: 2026-09-25
+updated: 2026-10-02
 owners: [jcardinal, ajean]
 files:
   - worker2/Worker/Team/Transcripts.php
@@ -419,13 +419,7 @@ here by section/account, never by value.
   `_ApiRequest::execute()`** (reconnect/re-register before the post-call save) and affects every
   framework caller, so it is deferred pending architecture review. Do **not** work around it in
   `Transcripts.php`.
-- **`c_`-prefixed columns are FRAMEWORK-DYNAMIC in 2.0 — no model-class change needed.** The new
-  `c_transcriptAiModelId` / `c_s3*` / `c_trueAiModelId` columns are read off raw `_Query` rows and
-  written/filtered as `_Model` array keys **without** being declared in the model class and with **no**
-  `Core.RecordFields` / ACL entries (matches the existing `c_clickupUserIdentifier` precedent).
-  Consequence: the `_underscore`/model layer required **zero** changes for these columns (Phase 2
-  verified NO-OP). See the framework standard
-  [`c_`-prefixed custom columns](../../standards/framework-rules.md).
+- **The `c_` columns here never go through /v2 — that is why they needed no model change.** `c_transcriptAiModelId` / `c_s3*` (worker2 `Worker/Team/Transcripts.php`), `c_trueAiModelId` (`tools/mvc/talos/vocabulary/post.php`) and the older `c_clickupUserIdentifier` (worker2 `Worker/Netsuite/Opportunity.php`) are read/written only by hand-written SQL / raw `_Query` rows, which return any column. Through /v2 or a `_Model` instance a `c_` column must be declared — see [`c_`-prefixed custom columns](../../standards/framework-rules.md).
 - **Cross-ACCOUNT S3.** `togaiq` (us-east-1) approved/archive writes use the `[talos]` key;
   `CopyObject` across accounts is impossible, so archive is get(in-memory)+put. (The old toga-private
   cross-account read is no longer in the loop.)
@@ -445,6 +439,7 @@ here by section/account, never by value.
   read will clean every transcript with the merged/global set instead of the routed model's copy.
 
 ## Change history
+- 2026-10-02 — Corrected the `c_` column note: these columns are raw-SQL only, not proof that /v2 is dynamic. (jcardinal)
 - 2026-09-25 — renamed product references from "TOGa IQ" to "TOGa Talos" (rebrand; TOGa IQ is now the separate `toga25-iq` app) (jcardinal)
 
 ## Related