Phase 2: core domain, policy engine, packet API, Clerical screen

Migration 0003: projects, aliases, renumbers, units, packets and every child table,
change orders, assets, documents, ITPs, station limits, department weld flag.
Policy package: Principal, PacketState, Action rules, custody, preconditions,
CO hold, order of checks, can/blocked/holder on reads. docs/POLICY.md with the
tightenings table for Seth. Write pipeline: FOR UPDATE, CAS on status and dept,
If-Match row versions, server-assigned numbers, field CAS, version bump, packet
log, audit, NOTIFY, signatures, IT reasons, filed lock and HMAC seal.
API: /api/packets (header, transitions, work orders, pages, docs, move, remove,
BOM, shorts, welds, heat tags, heat table, stage, checklist, clock, warehouse
stage, Q.C., change orders, log, seal), /api/projects, /api/units, /api/assets,
/_blob. Frontend: Clerical home, projects and units, packet page with pdf.js
and QR codes, hand draft, heat map, send to warehouse, department or Q.C.
Tests: policy matrix, API, concurrency, schema, projects; Playwright Clerical
draft scenario. Verified on docker-1 with the CI stack and the Samba DC.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

frontend/src/auth/AuthProvider.tsx

@@ -1,5 +1,6 @@
 import { useCallback, useEffect, useMemo, useRef, useState, type ReactNode } from "react";
 import { ApiError, errorCode, onApiError } from "../api/client";
+import { emitChanged } from "../lib/changes";
 import { authApi, departmentsApi } from "./api";
 import { AuthCtx, type AuthState, type AuthStatus } from "./context";
 import { roleLabel as labelFor } from "./roles";
@@ -203,6 +204,7 @@ export function AuthProvider({ children, idleLockMs = IDLE_LOCK_MS, idleCheckMs
   const sessionId = status === "ready" || status === "locked" ? (me?.session.id ?? null) : null;
   const presence = useEvents(sessionId, {
     onRevoked: () => endSession("This session was signed out from another place."),
+    onChanged: emitChanged,
   });
 
   const roleLabel = useCallback((role: string) => labelFor(role, departments), [departments]);

frontend/src/auth/types.ts

@@ -173,8 +173,8 @@ export interface SigninAttempt {
   reason: string | null;
 }
 
-/** Stations may come as names or as rows. */
-export type StationEntry = string | { name: string; active?: boolean };
+/** Stations come as rows with their ids (ASSIGN needs the id). Older answers were plain names. */
+export type StationEntry = string | { id?: number; name: string; active?: boolean };
 
 /** One row of GET /api/departments. */
 export interface Department {
@@ -182,6 +182,7 @@ export interface Department {
   slug: string;
   name: string;
   kind: "support" | "shop";
+  weld?: boolean;
   stations: StationEntry[];
 }