Rebuild all 46 delivery PDFs from the sdlc/ sources so the package
matches the V1.0 audit evidence alignment in 02e1483. Work Schedule
and Software Project Plan pick up the V1.1 -> V1.0 rename; the
remaining files differ only by render metadata.
Verification: content coverage 46/46, all A4 portrait/landscape.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Nine layout defects were fixed in the generator so the delivery package is
reproducible from `scripts/build-sdlc-delivery.sh`.
CSS (scripts/sdlc-delivery/assets/sdlc-delivery.css):
- table-layout: fixed -> auto, so columns fit their content instead of each
taking an equal share of the page width
- overflow-wrap: anywhere -> break-word, removing mid-word breaks such as
"Representativ|es" and "communicati|on"
- break-inside: avoid on cells; text-align: left on th so headers match body
- new .a-right/.a-center/.tight column classes; ul/ol/li and code rules
- trimmed padding: @page bottom 28->20mm, h2 9->6mm, h3 6->4mm, cells
2->1.6mm, .approval-fields; .document-control th shrinks to its label
Renderer (scripts/sdlc-delivery/render-sdlc.mjs):
- ordered lists emit <ol> instead of collapsing into a run-on paragraph
- column alignment read from the Markdown separator row (:---, ---:, :---:)
- columns whose longest cell is <= 12 chars marked "tight" to shrink to content
- underscore runs become styled signature rules
- each signatory's heading and fields wrapped so they cannot split across pages
- backslash escapes such as \* are unescaped
Regenerated sdlc-delivery/ with the fixed pipeline: 46 PDFs, 163 pages, both
content-coverage and A4-format verification passing. Work Schedule 14 -> 9
pages, Correction Register 11 -> 10, Acceptance Report 7 -> 6. The four
Meeting Records are included for the first time, and PDFs for renamed sources
follow their new paths.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Single-command deploy: docker compose up -d --build brings up the LEMP
stack plus the Node realtime/scheduler service. app/config.php and DB
secrets are generated from .env at container start, never baked into
the image or committed.
If session_token is set and session_last_seen is within the last hour,
the incoming login is rejected with a clear message. Stale sessions
(idle > 1 h) and explicit logouts (token = NULL via back.php) still allow
re-login normally.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Rename rack_log.php → bin_log.php and rack_occupancy.php → bin_occupancy.php
(occupy_rack.php was already calling bin_*.php, causing 404 on every load)
- Fix occupy_rack.php: page title, stat card label (add id="stat_label_bins"),
section headings, and <th> column headers still read "Rack/Racks"
- Fix ReportManager: constructor wrote to $this->companyId (dynamic property)
instead of the declared $this->company_id, causing all queries to filter on
company_id = 0 under strict PHP 8.2+ property semantics
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds emit_notification_user() to 7 endpoints so the acting user and
all admins/owners receive a real-time toast on key document actions:
confirm/cancel order, issue/void invoice, confirm return, confirm PO,
receive PO goods. Other staff and viewers are not notified.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Spec (docs/reviewing/master-data.md):
- M1: Remove margin from stored product fields (it's a derived frontend value)
- M2: Clarify posting window only restricts transaction dates, not master data
- M5: Document AccountFormulaManager::delete() as archive, not physical delete
Code:
- C1: Fix CompanySettingManager property typo (company_id → companyId) —
prevented PHP 8.4 dynamic property fatal on all posting window operations
- C2: Fix WarehouseManager::deleteWarehouse() guard — was comparing
warehouse_name (string) against warehouse id column (no-op); now correctly
blocks on storage rows and active stock rows
- M3: Remove hard-delete of td_rack_log in deleteStorage() — retain rack
history consistent with soft-delete philosophy elsewhere
- M4: Add reference guards to ChartOfAccounts::delete() (blocks on GL items,
formula items, product account mappings) and DepartmentManager::delete()
(blocks on GL items)
- M6: Fix CompanySettingManager::handle() partial update — only upsert keys
present in the request, not all allowed keys defaulted
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Spec (docs/reviewed/document-lifecycle.md):
- C1: Correct GlManager::delete() description — reversal entry, not hard delete
- C3: Clarify PO status 2/3 are derived (receipt_status), never stored
- C4: Add invoice status=2 (Paid/Settled) to status table
- C5: Add full Receipt/Payment Billing Note lifecycle section
- C6: Add Quotation status table and transition rules
- C7: Document soft-delete tombstone mechanism (company_id negation)
Code (InvoiceManager.php):
- C2: voidInvoice() now blocks on active credit notes, posted receipt
billing notes, and posted payment billing notes in addition to the
existing receipt/payment checks
- M9: softDelete() skips assertPostingWindow for draft invoices (status=0)
since drafts have no GL entry and no accounting impact
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- C1: verify.php now filters license='owner' — invite tokens no longer accepted
- C1: onboarding API rejects non-owner sessions
- C2: Existing-user invite requires explicit acceptance via accept_invite.php
- C2: New accept_invite.php page and API engine added
- C2: inviteUser() generates token + expiry for existing users; resendInvite() handles active users
- C3: session_regenerate_id(true) before writing invite session keys on both invite pages
- C4: invited_onboarding API wraps activation in transaction with SELECT FOR UPDATE; rowCount check added; SQLSTATE 23000 caught cleanly
- C5: inviteUser() and resendInvite() two-table writes wrapped in transactions
- M2: removeUser() wrapped in transaction with FOR UPDATE; clears default_company on active user removal
- M4: Logged-in user guard added to invited_onboarding.php and accept_invite.php
- M5: manage_users.php uses $server_url instead of HTTP_HOST for invite URLs
- M6: Username regex enforces 3-32 chars; reserved name blocklist added
- N5: searchUsers() changed from LIKE fuzzy search to exact email match only
- N7: resendInvite() rate-limited to once per 60s via invite_resent_at column
- Schema: company_map_user gains invite_expires_at and invite_resent_at columns
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Upgraded all plain `require` to `require_once` across 172 api/engine
and api/engine_report files to prevent class-redeclaration errors
- Added issue button, issue_invoice() with GL toastr, and delete_invoice()
to expense/manage_purchase_invoice.php, bringing it in line with
po/manage_purchase_invoice.php
- Added can_delete role guard (admin/owner only) to trash icons on
revenue/invoice.php and expense/purchase_invoice.php, matching the
existing pattern in finance/receipt.php and finance/payment.php
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Thanakorn