toga-ai 1.0.951 → 1.0.952

package/knowledge/2.0/apps/toga-blox/architecture.md

@@ -6,8 +6,8 @@ project: TOGa Blox
 client: shared
 type: architecture
 status: active
-updated: 2026-09-16
-owners: [apeterson]
+updated: 2026-10-05
+owners: [apeterson, tcox]
 files:
   - toga-blox/package.json
   - toga-blox/src/components/index.ts
@@ -29,7 +29,7 @@ Shared React+TS component/template/API library (`@agilant/toga-blox`) reused by
 
 `toga-blox` (npm package **`@agilant/toga-blox`**) is the shared React + TypeScript component / template / utility library reused across the 2.0 frontends: `toga2-view`, `toga2-supply`, `toga25-supply`, `toga2-commerce`, `toga2-hub`. Not a PHP framework repo — no `_underscore` backend. Filed under `2.0/` because every consumer is a 2.0 app, but structurally a standalone front-end package (`dependsOn: []`).
 
-**New-platform apps (toga25-desk, toga25-iq, toga2-template, future apps) do not use this repo — they use [toga25-blox](../toga25-blox/architecture.md), a source-shared (git, not npm) replacement.**
+**Legacy — fixes only.** No new components and no Storybook work here. [toga25-blox](../toga25-blox/architecture.md) (`@toga/blox`, source-shared) replaces this library for **all** apps, eventually: new platform apps first, then these consumers. When an app moves, rewrite onto toga25-blox pieces — do not port this code wholesale. New shared UI goes to toga25-blox.
 
 Ships: presentational + data-aware **components** (`src/components/`), **templates** wiring components into ready screens (`src/templates/`, e.g. `PrimaryTable`, `Login`, `AddNotes`), a thin **API client** over axios + React Query (`src/api/`, `src/reactQuery/`), and **utilities** (`src/utils/`). Builds with `tsc` to `dist/` (not bundled), develops via Storybook, tests with Vitest.
 

package/knowledge/2.0/apps/toga-blox/features/blox-authoring-defects.md

@@ -6,7 +6,7 @@ project: TOGa Blox
 client: shared
 type: feature
 status: active
-updated: 2026-09-16
+updated: 2026-10-05
 owners: [apeterson, tcox]
 files:
   - toga-blox/src/components/BaseButton
@@ -74,6 +74,21 @@ Defect 4 is about swapping variants; this is the shape of the same problem for a
 - **Consumer symptom.** One page toolbar renders its buttons at three different heights, and the developer cannot fix it from `themeConfig.json` — the number they need is not exposed. Nothing in the theme layer hints geometry is off-limits, so time is lost hunting the app's own CSS.
 - **Fix direction.** Same as defect 5: convert both to `var(--baseButton-height, <existing literal>)` (and give `.primaryBtn` the same base height), non-breaking because the fallback preserves today's look. Until then a consumer must own the chrome: `toga25-supply` built its own `ToolbarButton` rather than retheme tokens shared by ~all buttons in the app — see [toolbar button chrome](../../toga25-supply/features/toolbar-button-chrome.md).
 
+### Tooling defects (found 2026-09-28, Storybook/Docker audit)
+
+**7. Storybook addons in `dependencies` — they install into every consumer**
+- **Mechanism.** `@storybook/addon-docs`, `@storybook/addon-viewport`, `storybook-addon-react-router-v6` sit in `dependencies`, not `devDependencies`.
+- **Consumer symptom.** Every app installing `@agilant/toga-blox` pulls Storybook packages it never uses (install weight, peer noise).
+- **Fix direction.** Move them to `devDependencies`. Non-breaking.
+
+**8. Storybook (7.6.24) is local-only and renders unstyled**
+- Never deployed. Defines no host tokens (frontend §13e), so components render unstyled. Many exported components and all 3 templates have no story. `addon-onboarding` is configured but not installed.
+- **Fix direction.** None planned — Storybook investment goes to [toga25-blox](../../toga25-blox/architecture.md), not here. To verify a CSS change, see the Storybook gotcha in [table](table.md).
+
+**9. Docker files call scripts that do not exist**
+- `docker-compose` runs `npm run storybook` (the script is `npm run blox`); the `Dockerfile` `CMD` runs `npm run start` (no such script). Neither container works as written.
+- **Fix direction.** Point them at real scripts, or delete them.
+
 ### Already-known authoring items (carried over from §22)
 
 Long-standing, previously recorded only as consumer-side advice:
@@ -89,6 +104,9 @@ Long-standing, previously recorded only as consumer-side advice:
 - **Do not "fix" these in an app.** Working around them in a consumer is §22's job and is legitimate; changing app code to *imitate* the defect is not.
 - **A fix here is a fleet-wide change.** blox is unbundled and consumed by ~40 call sites; anything touching auth or `localStorage` keys changes live session behavior on the next channel head a consumer picks up — and `toga2-commerce` picks up the channel head **automatically at build time**, with no PR. Sequence auth fixes deliberately.
 
+## Change history
+- 2026-10-05 — added tooling defects 7–9 (Storybook addons in `dependencies`, unstyled local-only Storybook, broken Docker scripts) (tcox)
+
 ## Related
 
 - [frontend standard §22](../../../standards/frontend.md) — the app-side workarounds this backlog is the counterpart to.

package/knowledge/2.0/apps/toga-blox/features/environment-badge.md

@@ -6,8 +6,8 @@ project: TOGa Blox
 client: shared
 type: feature
 status: active
-updated: 2026-09-23
-owners: [apeterson]
+updated: 2026-10-05
+owners: [apeterson, tcox]
 files:
   - toga-blox/src/components/EnvironmentBadge/EnvironmentBadge.tsx
   - toga-blox/src/components/EnvironmentBadge/EnvironmentBadge.css
@@ -64,7 +64,9 @@ Classifies `VITE_API` into `production` | `local` | `unknown` (plus the existing
 - **A CSS class typo silently unstyles the badge.** `.env-localost` (missing `h`) shipped for a long time; the localhost badge rendered as plain text and nobody noticed. Class names must match the endpoint strings the classifier returns — add both together.
 - **Testing `import.meta.env`:** use `vi.stubEnv("MODE", …)` / `vi.stubEnv("VITE_API", …)`. To set the hostname without navigating jsdom, redefine `window.location` with `Object.defineProperty`.
 - **Consumers import it in ways that matter.** A barrel `import { EnvironmentBadge } from "@agilant/toga-blox"` drags in unrelated peers at build time; older published versions exported it as **default only**. See [toga2-commerce Amplify build & deploy](../../toga2-commerce/workflows/amplify-build-and-deploy.md).
+- **toga2-supply does NOT use this badge.** It mounts its own copy (`toga2-supply/src/components/layout/Header/EnvironmentBadge.tsx` + `src/utils/getEndpointFromEnvironment.ts`), written because older blox mis-labelled unknown API hosts. A change to the hide rule or classifier here does not reach toga2-supply — change both, or move toga2-supply back to blox's badge.
 - Do not remove the badge from an app to "clean up" — it is a deliberate QA tool.
 
 ## Change history
+- 2026-10-05 — noted toga2-supply's app-local copy of the badge + classifier (tcox)
 - 2026-09-23 — Hostname now overrides the hide rule (`isNonProductionHost`); endpoint classifier matches `production` explicitly and adds `local`/`unknown`; fixed `.env-localost` typo, added `.env-local`/`.env-unknown`; 24 tests added (apeterson)

package/knowledge/2.0/apps/toga-blox/features/table.md

@@ -6,7 +6,7 @@ project: TOGa Blox
 client: shared
 type: feature
 status: active
-updated: 2026-09-28
+updated: 2026-10-05
 owners: [apeterson, tcox, bala]
 files:
   - toga-blox/src/components/Table/hooks/useFetchTablePageMeta.ts
@@ -121,7 +121,7 @@ This exists because an unscoped `GET /{recordRoute}` returns *every* row of a lo
 - **A filter popover's "Clear" must call `onClear()` — resetting local state only leaves the table filtered.** `HeaderFilterMultiselect.handleClear` did just `setSelectedOptions([])`, so the URL param (owned by the consuming app) and the applied filter survived: the popover showed nothing selected while the table stayed filtered. Fixed 2026-09-28 — it now calls `onClear()` and closes, **guarded by `if (filterValue)`**. The guard matters: `onClear` routes through `PrimaryTableHeaderCell` → `table.options.onColumnFiltersChange` → toga25-supply `useServerTableUrlState`, which resets to **page 1 on any filter change** — so an unguarded Clear with nothing applied would bounce the user off their page.
 - **⚠ OPEN — `HeaderFilterRange.handleClear` has the same bug** (~line 162): it resets `singleValue`/`minValue`/`maxValue` but never calls `onClear()` and never closes the popover. Same fix shape as the multi-select. Not fixed as of 2026-09-28.
 - **⚠ OPEN — `SortIcon` has no `aria-*` at all.** Sort direction and position are conveyed by shape only — no `aria-label`, no `aria-sort`. Pre-existing; needs its own ticket.
-- **A unit test cannot prove a CSS change — verify in blox's own Storybook.** JSDOM applies no real layout, so a Vitest test can only assert the modifier class is present; it can never show the triangle actually flipped or that the digit stayed upright. Add a co-located `*.stories.tsx` rendering the states side by side, run `npm run blox` (port 6006), and look at it.
+- **A unit test cannot prove a CSS change — verify in blox's own Storybook.** JSDOM applies no real layout, so a Vitest test can only assert the modifier class is present; it can never show the triangle actually flipped or that the digit stayed upright. Add a co-located `*.stories.tsx` rendering the states side by side, run `npm run blox` (port 6006), and look at it. **⚠ blox's Storybook defines no host tokens** (frontend §13e), so components render unstyled there — set the `--*` tokens the component reads in the story/decorator, or check the change in a consuming app.
 - **⚠ OPEN — the multi-select filter matches by SUBSTRING, not exactly.** `HeaderFilterMultiselect` comma-joins the picked slugs and `src/api/tableData/getDataTableData.ts` turns that into `where: { or: [ { field: { contains: value } }, … ] }`. Picking "Jon Smith" also matches "Jon Smithson" — it over-includes rows.
 - **⚠ OPEN — an option value containing a comma silently returns zero rows.** It splits into two bogus filter terms, with no error. Both bugs are pre-existing and affect **every** multi-select column including Order Status; both fix in one place — send a list / exact-equals operator instead of a comma-joined `contains`. Not fixed as of 2026-09-15.
 - **⚠ `useTableData` APPENDS `.uuid` to `additionalData.slug` — unless the slug is on a hardcoded allow-list.** The list is exactly `catalogId`, `customerId`, `Items.catalogId`, `SalesOrderItems.uuid`, `SalesOrders.uuid` (verified in `@agilant/toga-blox` **1.1.2-production.144**, the version toga25-supply pins). Consequences for anyone writing a filter slug into config or a `TableLevel` callback:
@@ -144,6 +144,7 @@ This exists because an unscoped `GET /{recordRoute}` returns *every* row of a lo
 - **Table/surface meta is cached with `Infinity` staleTime/gcTime** (`useFetchTablePageMeta`), so after a DB metadata change (`TableViewFields`, `Core.RecordFields`) a **hard reload** is required to see it. And the app consumes toga-blox's built **`dist/`**, not `src/` — editing blox source requires `npm run build` before it takes effect at runtime.
 
 ## Change history
+- 2026-10-05 — Storybook verify gotcha: blox's Storybook has no host tokens, components render unstyled (tcox)
 - 2026-09-28 — multi-select filter "Clear" now actually clears (calls `onClear`, page-1 guard); sort badge now points down for `desc` via CSS rotation (apeterson)
 
 ## Related

package/knowledge/2.0/apps/toga25-blox/INDEX.md

@@ -2,4 +2,4 @@
 
 | Doc | Summary |
 |-----|---------|
-| [TOGa Blox 2.5 — Architecture](architecture.md) | Shared React+TS SOURCE library for the new platform apps (toga25-desk, toga25-iq, toga2-template, future apps); read the ADR for full detail, not this stub. |
+| [TOGa Blox 2.5 — Architecture](architecture.md) | Shared React+TS SOURCE library for the new platform apps (new platform apps first; replaces toga-blox for all apps over time); read the ADR for full detail, not |

package/knowledge/2.0/apps/toga25-blox/architecture.md

@@ -6,27 +6,23 @@ project: TOGa Blox 2.5
 client: shared
 type: architecture
 status: active
-updated: 2026-09-26
-owners: [jcardinal]
+updated: 2026-10-05
+owners: [jcardinal, tcox]
 files:
   - toga25-blox/src
-related: []
+related:
+  - ../toga-blox/architecture.md
 ---
-Shared React+TS SOURCE library for the new platform apps (toga25-desk, toga25-iq, toga2-template, future apps); read the ADR for full detail, not this stub.
+Shared React+TS SOURCE library for the new platform apps (new platform apps first; replaces toga-blox for all apps over time); read the ADR for full detail, not this stub.
 
 ## Summary
 
-`toga25-blox` is a fresh, **source-shared** (git, not npm) React+TS library that replaces
-`toga-blox` for **new-platform apps only** (toga25-desk, toga25-iq, toga2-template, future
-apps). Apps import blox **source** from a sibling clone — `@toga/blox/<entry>` resolves via
-Vite alias to `../toga25-blox/src/<entry>/index.ts`. No build, no publish, no npm version.
-Deploy clones `toga25-blox` on the app's own branch at build time. Old npm `toga-blox` stays
-on `toga25-supply` / `toga2-commerce` / `toga2-view` / `toga2-hub` — do not port those apps to
-this repo. Full decision + rejected alternatives + consequences: `docs/decisions/0001-platform-frontend-architecture.md` in the toga25-blox repo — read that for anything beyond these rules.
+`toga25-blox` is a fresh, **source-shared** (git, not npm) React+TS library that replaces `toga-blox` for **all apps, eventually** (decided 2026-09-30). New platform apps (toga25-desk, toga25-iq, toga2-template, future apps) come first. Old apps (toga25-supply, toga2-supply, toga2-commerce, toga2-view, toga2-hub, BDR, talos, togatech) move over later. Apps import blox **source** from a sibling clone — `@toga/blox/<entry>` resolves via Vite alias to `../toga25-blox/src/<entry>/index.ts`. No build, no publish, no npm version. Deploy clones `toga25-blox` on the app's own branch at build time. Old `@agilant/toga-blox` is fixes-only until each app moves. Full decision + rejected alternatives + consequences: `docs/decisions/0001-platform-frontend-architecture.md` in the toga25-blox repo — read that for anything beyond these rules.
 
 **Critical rules:**
 - **Reuse order:** an existing `toga25-blox` piece → a piece already built in another
   new-platform app (promote it to blox) → only then build new. Never duplicate.
+- **Moving an old app: rewrite onto toga25-blox pieces — never port old blox code wholesale.** Old blox has 3 table engines and 3 select stacks; copying them carries that over.
 - **Import boundary:** apps may import only `@toga/blox/<entry>` (the public entry barrel) —
   lint blocks deeper paths. Blox never imports app code.
 - **Layer order (nothing imports upward):** `lib` < `core` < `tenancy` < `theme` < `surface`
@@ -44,4 +40,5 @@ this repo. Full decision + rejected alternatives + consequences: `docs/decisions
 ## Related
 
 - ADR: `docs/decisions/0001-platform-frontend-architecture.md` (toga25-blox repo).
+- Component viewer: Storybook (`npm run storybook`, port 6006). Setup and open questions are in `docs/storybook.md` in the toga25-blox repo (prototype on branch TRUE-82044, awaiting Jeff's review).
 - Old npm lib for legacy 2.0 apps: [toga-blox architecture](../toga-blox/architecture.md).

package/knowledge/2.0/standards/frontend.md

@@ -5,8 +5,8 @@ project: _Underscore
 client: shared
 type: standard
 status: active
-updated: 2026-10-01
-owners: [jcardinal, apeterson]
+updated: 2026-10-05
+owners: [jcardinal, apeterson, tcox]
 files: []
 related:
   - ../apps/toga25-supply/architecture.md
@@ -479,6 +479,8 @@ so restoration cannot resurrect a cleared cache.
 `@agilant/toga-blox` is the front-end shared core — the React analog of `_underscore` / `library`
 on the back end. A consuming app **MUST** meet every requirement below.
 
+`@agilant/toga-blox` is **legacy — fixes only**. Build new shared components in `toga25-blox` (`@toga/blox`), which replaces it for all apps over time. See [toga25-blox architecture](../apps/toga25-blox/architecture.md). These rules apply until an app has moved.
+
 **(a) Pin an exact published version — never a caret.** Some published versions ship an **empty
 `dist`** and break the build; a caret can float you onto one. Both apps pin exact versions. Also
 audit for **pin drift** between branches. A caret on a **prerelease** is inert (npm matches only the
@@ -637,6 +639,7 @@ The payoff: copy and icons change as a **data edit**, with no front-end deploy.
 - **Build a new generic capability app-LOCAL first; promote into blox only after a 2nd consumer
   validates the contract.** Hardening a shared contract from a single call site (n=1) bakes in that
   app's accidents.
+- **Promote into `toga25-blox`, not `@agilant/toga-blox`** (legacy, fixes only). toga25-blox has its own reuse order — see its architecture doc.
 - **Mark intent with a per-module header** so a future reader knows which side a module belongs on:
 
   ```ts

package/knowledge/clients/nychh/features/transfer-order-notification-emails.md

@@ -16,6 +16,7 @@ files:
   - dbchanges2/Client_Nychh/2026-09-30a - TransferOrderPackedAssetTagException.sql
   - dbchanges2/Client_Nychh/2026-09-15b - TransferOrderEmailGoLiveRecipient.sql
   - dbchanges2/Core/2026-09-16a - NychhTransferOrderEmailsCron.sql
+  - dbchanges2/Client_Nychh/2026-10-05a - TransferOrderShippedEmailOnTrackingCutover.sql
 related:
   - ./transfer-order-netsuite-push.md
   - ../../../2.0/apps/_underscore/features/units-for-items-for-purchase-orders.md
@@ -42,7 +43,7 @@ holds the two queued entry points, the backstop cron, every query and the HTML b
 `_underscore` per-client models only declare the `c_` marker fields and queue the job — they build
 nothing. That is deliberate: app-level over core, and a slow send must not sit inside an api2 save.
 
-Three rules carry most of the risk:
+Rules that carry most of the risk:
 
 1. **Submitted fires on `postPut`, not `postPost`** — on the POST the order still holds the
    `TA…` autoincrement placeholder, not the NetSuite number.
@@ -51,6 +52,9 @@ Three rules carry most of the risk:
 3. **A failed send throws — it is never swallowed**, so nothing is ever marked sent that did not go.
 4. **Packed (and shipped) are HELD while a line is short of asset tags** — ops is warned instead, and
    the customer email sends itself once the tags land. See below.
+5. **Shipped fires on the first TRACKING NUMBER, never on the NetSuite shipped stage** (since
+   2026-10-05). The warehouse often marks a fulfillment shipped only after delivery, so the stage is
+   unreliable. No tracking → no Shipped email, even at stage shipped. See below.
 
 Recipient is `DevTeam@togatech.com` while testing. `2026-09-15b` swaps it to
 `EndUserDeviceLifecycle@nychhc.org` — run that file only after sign-off.
@@ -61,7 +65,10 @@ Recipient is `DevTeam@togatech.com` while testing. `2026-09-15b` swaps it to
   - `SendSubmitted(string $transferOrderUuid)` — queued from the TransferOrder `postPut`.
   - `SendFulfillment(string $itemFulfillmentUuid)` — queued from the ItemFulfillment hooks.
   - `SendPending(bool $dryRun = true)` — the `*/5` backstop cron.
-  - `resolveStagesStillToAnnounce()` — which stages are still owed (see the late-shipped case).
+  - `resolveStagesStillToAnnounce(stageName, stageAlreadyEmailed, hasTrackingNumber)` — which
+    stages are still owed (see *Shipped = tracking number*).
+  - `buildHasTrackingNumberSql()` — the one "has tracking" test, shared by
+    `readItemFulfillmentForEmail()` (`hasTrackingNumber` column) and the `SendPending` sweep.
   - `readLinesMissingAssetTags()` / `sendPackedExceptionEmail()` — the asset-tag hold.
   - `initialize()` registers the client DB before any query runs.
   - Builders: `buildItemRowsHtml()`, `buildTrackingSectionHtml()`, `buildAssetTagTableHtml()`,
@@ -122,13 +129,11 @@ they must stay in step: the Submitted guard, the order read, and both `SendPendi
 2. **Packed / Shipped** — the ItemFulfillment `postPost` / `postPut` queue `SendFulfillment` with
    the fulfillment uuid. The stage reached is recorded on `c_transferOrderEmailStageSent`, with
    `c_dtTransferOrderEmailSent` as the timestamp, so a fulfillment cannot re-announce a stage.
-   `resolveStagesStillToAnnounce()` decides what is owed: normally the one stage reached, but when a
-   fulfillment **arrives already shipped** and packed was never announced it returns
-   **`[packed, shipped]`** and both send in that order in one run. Before this the packed stage was
-   skipped outright — and **the asset-tag check lives on packed**, so a late shipped fulfillment
-   bypassed it completely. Real case: transfer order **291773** got Submitted and Shipped, never
-   Packed. The NYCHH NetSuite sync is a **daily** cron, so a fulfillment landing fully shipped is
-   normal, not an edge case — see
+   `resolveStagesStillToAnnounce()` decides what is owed (table in *Shipped = tracking number*).
+   When packed was never announced and shipped is now owed it returns **`[packed, shipped]`**, both
+   sent in that order in one run — the **asset-tag check lives on packed**, so packed must never be
+   skipped (transfer order **291773** once got Submitted + Shipped, no Packed). The NYCHH NetSuite
+   sync is a **daily** cron, so a fulfillment landing fully shipped/tracked is normal — see
    [the per-client sync](../../../1.0/apps/worker/features/netsuite-togasupply-per-client-sync.md).
 3. The **backstop cron** sweeps anything the hooks missed (below).
 4. All three paths share the same markers, so nothing sends twice.
@@ -152,6 +157,48 @@ PUT follows.** Fulfillment **2704** in production: header row at 20:33:09, lines
   seconds ago with no lines yet is left for the next run instead of being mailed empty.
 - It also picks up any send that threw (the marker was never written).
 - Caps at **25 of each kind per run** (`MAXIMUM_EMAILS_PER_RUN`).
+- **It is the real sender of Shipped** — see below.
+
+## ⚠ Shipped = tracking number, not the NetSuite stage (2026-10-05)
+
+"Has tracking" = `ItemFulfillments_TrackingNumbers` **INNER JOIN** `TrackingNumbers` on
+`trackingNumberId` with `TRIM(number) <> ''` — a bridge row can hold only a
+`returnTrackingNumberId`. Built once in `buildHasTrackingNumberSql()`; never re-type it.
+
+`resolveStagesStillToAnnounce()`, first match wins:
+
+| Marker (`c_transferOrderEmailStageSent`) | Tracking | Stage | Owed |
+|---|---|---|---|
+| `shipped` | any | any | nothing |
+| `packed` | yes | any | `[shipped]` |
+| empty | yes | any (incl. picked — tracking means boxed) | `[packed, shipped]` |
+| empty | no | packed / shipped | `[packed]` |
+| else | | | nothing |
+
+The asset-tag hold runs whenever packed is owed and blocks both.
+
+- **⚠ `SendPending` WHERE must match that table:** marker NULL or `<> 'shipped'` AND (has tracking OR
+  (stage IN packed/shipped AND `COALESCE(marker,'') = ''`)). Drift → rows picked then skipped, eating
+  `LIMIT 25`.
+- **Why the cron, not the hook, sends Shipped:** library `syncItemFulfillmentFromNetsuite`
+  (`library/app/api/toga2.php`) PUTs the stage first (~L7270), then units/asset tags, and writes
+  package tracking **last** (~L8046). The ItemFulfillment `postPut` job runs before tracking exists.
+  (Also removes the old race where Shipped read stale tracking/tags.) Tracking imports at picked,
+  packed or shipped alike.
+- **Once per fulfillment.** Business rule = 1 tracking number per fulfillment; prod has violations
+  (IF 329047 has 2; IFs 329944/330013 share 1). Still sends once — the marker gates it.
+- **Lag:** adding tracking in NetSuite bumps the IF `lastmodifieddate`, so the sync re-reads it, but
+  only on the NYCHH sync interval (daily). E.g. IF 330377 (NS 7566823) still Packed (status B) in
+  NetSuite, tracking imported 2026-10-05 11:56.
+- **Only NYCHH emails off the NetSuite shipped stage** (checked 2026-10-05): Compass in-transit emails
+  are per tracking number from ASN data; Prudential "order shipped" is a transmission; Elite moves to
+  shipped when tracking lands.
+- **Cutover:** `Client_Nychh/2026-10-05a` stamps `c_transferOrderEmailStageSent='shipped'` on supply
+  fulfillments that already had tracking (`c_dtTransferOrderEmailSent` untouched — no email sent), so
+  old fulfillments got no late Shipped. Re-runnable; matched 2 on prod (IF 330377/TO 291765, IF
+  330400/TO 291965). **⚠ Deploy order:** the old code re-sends Packed for a row stamped `shipped`
+  whose stage is packed, so: pause `Core.CronJobs` id 78 (`isActive=0`) → run SQL → deploy worker2 →
+  re-enable id 78.
 
 ## ⚠ Missing asset tags HOLD the packed email (and warn ops instead)
 
@@ -257,7 +304,8 @@ Cost of the split, stated so nobody is surprised later:
   **1,203** have one number and **292** have two or more, **up to 25**.
 - **Many shipped fulfillments have no tracking at all** — 1,484 of 2,479 measured 2026-09-17, and
   322 of the rest have no carrier on the number. `buildTrackingSectionHtml()` drops the whole block
-  when there is no number and drops the button when there is no URL. Placeholders are
+  when there is no number and drops the button when there is no URL (since 2026-10-05 Shipped needs a
+  number, so this now matters only for the Packed email). Placeholders are
   **`{trackingIntroSuffix}`** and **`{trackingSection}`**.
 - **Gmail clips a message past about 102,400 bytes.** `MAXIMUM_EMAIL_BODY_BYTES = 80000` budgets the
   **item block only**; the remainder is summarised as *"and N more"*. 80,000 (not the earlier
@@ -348,6 +396,11 @@ loaded out of the dbchanges2 file so an unresolved `{placeholder}` fails a test.
 unescaped values and both detail-box defects were all found there, not in production.
 
 ## Change history
+- 2026-10-05 — **Shipped now fires on the first tracking number, not the NetSuite shipped stage**
+  (warehouse marks shipped after delivery). Shared `buildHasTrackingNumberSql()`, new
+  `resolveStagesStillToAnnounce()` table, matching `SendPending` WHERE; removed dead
+  `resolveFulfillmentEmailTemplateUuid()`. Cutover SQL `2026-10-05a` (2 prod rows). Deployed + verified
+  on prod. (jcardinal)
 - 2026-10-05 — **The asset-tag hold now only counts missing units on `SERIALIZED` items**
   (TRUE-82111). `readLinesMissingAssetTags()` treated "fewer linked units than quantity" as missing
   tags for every item, so accessories were reported short: first prod exception was `AC785544`, a

package/knowledge/clients/nychh/profile.md

@@ -66,6 +66,7 @@ TOGA 2.0 client on `_underscore`, prod schema `Client_Nychh`. Supply-chain / ful
 - **Worker tiers:** `worker2` (2.0) runs the NYCHH asset-tag backfill; `worker`/`library` (1.0) run the NetSuite→TOGa Supply sync and the asset-tag verification/backfill diagnostics.
 
 ## Key features (this client)
+- **Transfer-order "Order Shipped" email fires on the first tracking number, not the NetSuite shipped stage (2026-10-05, prod).** Warehouse marks shipped after delivery. NYCHH is the only client emailing off the NS shipped stage. See [TO notification emails](./features/transfer-order-notification-emails.md).
 - **Prod NetSuite feeds (2026-10-02):** only ITEM_FULFILLMENTS + INVENTORY_ADJUSTMENTS run (worker `511a7fd9`, 2026-09-30), cursors rewound to 2022/2023.
 - **TO destination + own ship-to (2026-10-02, library `8f974d93`, _underscore `6839dd3e`).** NetSuite-entered TOs landed on catch-all Location 2 (text match failed on Queens hyphens + multi-address sites). Destination now = mapped NetSuite address-book entry → text match → Location 2; TOs own `shipToAddressId`; Location auto-create uses default shipping. Mapping: 61 entries → 18 sites. See [TO import](./features/netsuite-transfer-order-import.md), [address-book mapping](../../1.0/apps/worker/workflows/netsuite-addressbook-location-mapping.md).
 - **TO↔customer-PO line matching fixed (2026-10-02, `1bc4de52`).** Old matcher picked unstocked duplicate PO lines and created empty PO lines; now ranks stocked lines and allows reuse. 161 TOs re-processed; 86 bad links over 62 TOs remained at last measure (re-process result pending). See [reconcile](../../1.0/apps/library/features/transfer-order-purchase-order-link-reconcile.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.951",
+  "version": "1.0.952",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",