Phase 4: Warehouse screen, pull table, shorts, MTRs and the upload pipeline

The Warehouse home with the numbers, the Open shorts table, the find bar and the five-column task board
(waiting, being pulled, on hold, pulled, released in the last 3 days) with buttons, hold reasons and drag.
Every role sees the warehouse stage on a packet as the WH pill and the line under it. The pull table on the
Materials tab: Pulled with auto-start, issued, location, heat with Enter to the next line, shorts with
receipts, N/A, MTR per line with a viewer. Send back to Clerical with a reason. Release to supervisor stays
blocked until every line is pulled or short and every pulled line has a heat.

Server: the heats_recorded precondition on WH_RELEASE, receive by custody, server-validated hold and short
reasons, the old packet history texts, GET /api/warehouse/board, cards with the warehouse stage and pull
counts. Uploads typed by content per kind (drawing, mtr, document, bom with XLSX and CSV), limits per kind,
optional ClamAV behind the clamav compose profile, a storage quota alert on the new notification_events
table (migration 0005) shown on the Admin Storage tab.

Tests: every warehouse action as every role, the release gate, the short-receive exception, the heat
pattern, upload sniffing and limits, the ClamAV path with a fake scanner, the quota alert; frontend board
and pull table tests; Playwright scenarios for the board and the pull flow. Verified on docker-1 in the CI
stack: 3557 server tests, 106 frontend tests, 17 Playwright scenarios. Docs updated; D5 closed.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

server/packetstation/doctor.py

@@ -23,7 +23,7 @@ from . import __version__
 from .settings import SecretFileError, Settings
 
 PASS, WARN, FAIL, SKIP = "PASS", "WARN", "FAIL", "SKIP"
-SKIPPABLE = ("visual", "mfiles", "ldap", "smtp", "db", "volume")
+SKIPPABLE = ("visual", "mfiles", "ldap", "smtp", "db", "volume", "clamav")
 FREE_WARN_BYTES = 2 * 1024**3
 EXPECTED_PS_GROUPS = 50
 IN_CHAIN = "1.2.840.113556.1.4.1941"
@@ -261,6 +261,28 @@ def check_volume(s: Settings) -> list[Check]:
     return out
 
 
+# ---------------------------------------------------------------- clamav
+
+
+def check_clamav(s: Settings) -> list[Check]:
+    from .domain import scan
+
+    scanner = scan.scanner_for(s)
+    if scanner is None:
+        return [Check("clamav", SKIP, "CLAMAV_HOST not set: uploads are not virus scanned")]
+    where = f"{scanner.host}:{scanner.port}"
+    if scanner.ping(timeout=min(scanner.timeout, 5.0)):
+        return [Check("clamav", PASS, f"clamd at {where} answers PING")]
+    return [
+        Check(
+            "clamav",
+            FAIL,
+            f"clamd at {where} does not answer; uploads are refused until it does",
+            "start the stack with --profile clamav, or clear CLAMAV_HOST",
+        )
+    ]
+
+
 # ---------------------------------------------------------------- ldap
 
 
@@ -416,6 +438,7 @@ def run(
         ("mfiles", check_mfiles),
         ("db", check_db),
         ("volume", check_volume),
+        ("clamav", check_clamav),
         ("ldap", check_ldap),
         ("smtp", lambda st: check_smtp(st, send_test)),
     ]