Phase 4: Warehouse screen, pull table, shorts, MTRs and the upload pipeline

The Warehouse home with the numbers, the Open shorts table, the find bar and the five-column task board
(waiting, being pulled, on hold, pulled, released in the last 3 days) with buttons, hold reasons and drag.
Every role sees the warehouse stage on a packet as the WH pill and the line under it. The pull table on the
Materials tab: Pulled with auto-start, issued, location, heat with Enter to the next line, shorts with
receipts, N/A, MTR per line with a viewer. Send back to Clerical with a reason. Release to supervisor stays
blocked until every line is pulled or short and every pulled line has a heat.

Server: the heats_recorded precondition on WH_RELEASE, receive by custody, server-validated hold and short
reasons, the old packet history texts, GET /api/warehouse/board, cards with the warehouse stage and pull
counts. Uploads typed by content per kind (drawing, mtr, document, bom with XLSX and CSV), limits per kind,
optional ClamAV behind the clamav compose profile, a storage quota alert on the new notification_events
table (migration 0005) shown on the Admin Storage tab.

Tests: every warehouse action as every role, the release gate, the short-receive exception, the heat
pattern, upload sniffing and limits, the ClamAV path with a fake scanner, the quota alert; frontend board
and pull table tests; Playwright scenarios for the board and the pull flow. Verified on docker-1 in the CI
stack: 3557 server tests, 106 frontend tests, 17 Playwright scenarios. Docs updated; D5 closed.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

server/packetstation/domain/packets.py

@@ -288,6 +288,23 @@ def load_children(conn: Any, row: Mapping[str, Any], *, full: bool = True) -> Ch
     return ch
 
 
+def is_sub(line: Mapping[str, Any]) -> bool:
+    """A sub-assembly line: made on its own packet, so its heats are recorded there."""
+    return str(line.get("sub") or "").strip().upper() == "Y"
+
+
+def needs_heat(line: Mapping[str, Any]) -> bool:
+    """The old needsHeat for a pulled line: not N/A, not a sub-assembly, pieces issued and no heat."""
+    if line.get("na") or is_sub(line) or not line.get("pulled"):
+        return False
+    if str(line.get("heat") or "").strip():
+        return False
+    try:
+        return float(line.get("issued") or 0) > 0
+    except (TypeError, ValueError):
+        return False
+
+
 def state_from(row: Mapping[str, Any], ch: Children) -> policy.PacketState:
     weld = bool(ch.dept.get("weld"))
     live_bom = [b for b in ch.bom if not b["na"]]
@@ -311,6 +328,7 @@ def state_from(row: Mapping[str, Any], ch: Children) -> policy.PacketState:
         heat_map=row["heat_map"],
         bom_total=len(live_bom),
         bom_ready=sum(1 for b in live_bom if b["pulled"] or b["id"] in ch.shorts),
+        bom_missing_heat=sum(1 for b in live_bom if needs_heat(b)),
         welds=len(ch.welds),
         checklist_complete=stage is not None and checklists.checklist_complete(stage["checklist"], weld),
         filler_set=stage is not None and bool((stage["filler"] or "").strip()),
@@ -661,6 +679,9 @@ def build(
     if seal:
         for k in SEAL_EXCLUDE:
             out.pop(k, None)
+        # `sub` joined the BOM lines in phase 4; seals made before that do not cover it.
+        for b in out.get("bom") or []:
+            b.pop("sub", None)
     return out
 
 
@@ -681,6 +702,7 @@ def _bom(b: Mapping[str, Any], ch: Children, people: People) -> dict[str, Any]:
         "loc",
         "pulled",
         "src",
+        "sub",
         "row_version",
     )
     out = {k: b[k] for k in keys}
@@ -788,7 +810,9 @@ SELECT p.id, p.version, p.unit_id, u.lot, pr.number || u.lot AS unit_number, pr.
        p.visual_closed_at, p.visual_cancelled_at, p.wo_gone_at,
        EXISTS (SELECT 1 FROM change_orders c WHERE c.packet_id = p.id AND c.review = 'pending'
                AND c.origin IN ('visual', 'drawing')) AS co_pending,
-       (SELECT w.stage::text FROM packet_wh w WHERE w.packet_id = p.id AND w.closed_at IS NULL) AS wh_stage,
+       pw.stage::text AS wh_stage, pw.by AS wh_by, whu.display_name AS wh_by_name, pw.at AS wh_at,
+       pw.reason AS wh_reason, pw.note AS wh_note, pw.auto AS wh_auto, p.wh_sent_at, p.visual_rel,
+       bc.bom_total, bc.bom_pulled, bc.bom_missing_heat,
        (SELECT count(*) FROM bom_shorts s WHERE s.packet_id = p.id AND s.closed_at IS NULL) AS open_shorts,
        (SELECT count(*) FROM packet_work_orders wo WHERE wo.packet_id = p.id) AS wo_count,
        (SELECT coalesce(json_agg(json_build_object('co_no', c.co_no, 'review', c.review,
@@ -801,6 +825,16 @@ JOIN departments d ON d.code = p.dept_code
 LEFT JOIN stations st ON st.id = p.station_id
 LEFT JOIN users wu ON wu.id = p.welder_id
 LEFT JOIN users vu ON vu.id = p.vclosed_by
+LEFT JOIN packet_wh pw ON pw.packet_id = p.id AND pw.closed_at IS NULL
+LEFT JOIN users whu ON whu.id = pw.by
+LEFT JOIN LATERAL (
+    SELECT count(*) FILTER (WHERE NOT b.na) AS bom_total,
+           count(*) FILTER (WHERE NOT b.na AND (b.pulled OR EXISTS (SELECT 1 FROM bom_shorts s
+                            WHERE s.bom_line_id = b.id AND s.closed_at IS NULL))) AS bom_pulled,
+           count(*) FILTER (WHERE NOT b.na AND upper(btrim(coalesce(b.sub, ''))) <> 'Y' AND b.pulled
+                            AND coalesce(b.issued, 0) > 0 AND btrim(coalesce(b.heat, '')) = '') AS bom_missing_heat
+    FROM bom_lines b WHERE b.packet_id = p.id
+) bc ON true
 """
 
 FLAG_ON = ("1", "true", "yes", "any", "flagged")
@@ -842,11 +876,27 @@ def card_state(r: Mapping[str, Any], names: Mapping[str, str]) -> policy.PacketS
     )
 
 
-def list_cards(conn: Any, policy_principal: policy.Principal, filters: Mapping[str, Any]) -> list[dict[str, Any]]:
-    """The board cards. Filters: status (comma list), dept, unit_id, project_id, q, flag (1|0|hand|hand_upload|
-    <kind>), co (pending), limit, removed."""
+def wh_card(r: Mapping[str, Any]) -> dict[str, Any] | None:
+    """The current warehouse stage row of a card, in the read model's `wh` shape."""
+    if r["wh_stage"] is None:
+        return None
+    return {
+        "stage": r["wh_stage"],
+        "by": None if r["wh_by"] is None else {"id": str(r["wh_by"]), "display_name": r["wh_by_name"]},
+        "at": r["wh_at"],
+        "reason": r["wh_reason"],
+        "note": r["wh_note"],
+        "auto": bool(r["wh_auto"]),
+    }
+
+
+def card_where(filters: Mapping[str, Any]) -> tuple[list[str], list[Any]]:
+    """The WHERE terms and parameters of the card filters, over CARD_SQL's aliases (p, u, pr)."""
     where: list[str] = []
     params: list[Any] = []
+    if filters.get("ids") is not None:
+        where.append("p.id = ANY(%s)")
+        params.append([int(i) for i in filters["ids"]])
     if not filters.get("removed"):
         where.append("p.removed_at IS NULL")
     status = [s.strip() for s in str(filters.get("status") or "").split(",") if s.strip()]
@@ -895,6 +945,13 @@ def list_cards(conn: Any, policy_principal: policy.Principal, filters: Mapping[s
             " AND wo.wo_base ILIKE %s))"
         )
         params += [pat] * 10
+    return where, params
+
+
+def list_cards(conn: Any, policy_principal: policy.Principal, filters: Mapping[str, Any]) -> list[dict[str, Any]]:
+    """The board cards. Filters: status (comma list), dept, unit_id, project_id, q, flag (1|0|hand|hand_upload|
+    <kind>), co (pending), ids (packet ids), limit, removed."""
+    where, params = card_where(filters)
     sql = CARD_SQL + (" WHERE " + " AND ".join(where) if where else "")
     sql += " ORDER BY p.updated_at DESC, p.id DESC LIMIT %s"
     params.append(int(filters.get("limit") or 500))
@@ -943,6 +1000,12 @@ def list_cards(conn: Any, policy_principal: policy.Principal, filters: Mapping[s
                 "open_cos": [c["co_no"] for c in r["open_co_rows"] or []],
                 "open_shorts": int(r["open_shorts"] or 0),
                 "wh_stage": r["wh_stage"],
+                "wh": wh_card(r),
+                "wh_sent_at": r["wh_sent_at"],
+                "visual_rel": r["visual_rel"],
+                "bom_total": int(r["bom_total"] or 0),
+                "bom_pulled": int(r["bom_pulled"] or 0),
+                "bom_missing_heat": int(r["bom_missing_heat"] or 0),
                 "due_effective": r["due_effective"],
                 "updated_at": r["updated_at"],
                 "holder": policy.holder_name(state, r["dept_name"], r["station_name"]),