Phase 2: core domain, policy engine, packet API, Clerical screen

Migration 0003: projects, aliases, renumbers, units, packets and every child table,
change orders, assets, documents, ITPs, station limits, department weld flag.
Policy package: Principal, PacketState, Action rules, custody, preconditions,
CO hold, order of checks, can/blocked/holder on reads. docs/POLICY.md with the
tightenings table for Seth. Write pipeline: FOR UPDATE, CAS on status and dept,
If-Match row versions, server-assigned numbers, field CAS, version bump, packet
log, audit, NOTIFY, signatures, IT reasons, filed lock and HMAC seal.
API: /api/packets (header, transitions, work orders, pages, docs, move, remove,
BOM, shorts, welds, heat tags, heat table, stage, checklist, clock, warehouse
stage, Q.C., change orders, log, seal), /api/projects, /api/units, /api/assets,
/_blob. Frontend: Clerical home, projects and units, packet page with pdf.js
and QR codes, hand draft, heat map, send to warehouse, department or Q.C.
Tests: policy matrix, API, concurrency, schema, projects; Playwright Clerical
draft scenario. Verified on docker-1 with the CI stack and the Samba DC.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

tests/server/test_app.py

@@ -76,7 +76,8 @@ def test_placeholder_when_static_missing(client: TestClient) -> None:
 
 def test_api_and_blob_never_fall_back(client: TestClient) -> None:
     assert client.get("/api/nope").status_code == 404
-    assert client.get("/_blob/abc").status_code == 404
+    # /_blob needs a session first (phase 2), so an anonymous call is refused, never the SPA page
+    assert client.get("/_blob/abc").status_code in (401, 404)
 
 
 def test_static_and_spa_fallback(tmp_path: Path, dev_visual: None) -> None: