Phase 4: Warehouse screen, pull table, shorts, MTRs and the upload pipeline

The Warehouse home with the numbers, the Open shorts table, the find bar and the five-column task board
(waiting, being pulled, on hold, pulled, released in the last 3 days) with buttons, hold reasons and drag.
Every role sees the warehouse stage on a packet as the WH pill and the line under it. The pull table on the
Materials tab: Pulled with auto-start, issued, location, heat with Enter to the next line, shorts with
receipts, N/A, MTR per line with a viewer. Send back to Clerical with a reason. Release to supervisor stays
blocked until every line is pulled or short and every pulled line has a heat.

Server: the heats_recorded precondition on WH_RELEASE, receive by custody, server-validated hold and short
reasons, the old packet history texts, GET /api/warehouse/board, cards with the warehouse stage and pull
counts. Uploads typed by content per kind (drawing, mtr, document, bom with XLSX and CSV), limits per kind,
optional ClamAV behind the clamav compose profile, a storage quota alert on the new notification_events
table (migration 0005) shown on the Admin Storage tab.

Tests: every warehouse action as every role, the release gate, the short-receive exception, the heat
pattern, upload sniffing and limits, the ClamAV path with a fake scanner, the quota alert; frontend board
and pull table tests; Playwright scenarios for the board and the pull flow. Verified on docker-1 in the CI
stack: 3557 server tests, 106 frontend tests, 17 Playwright scenarios. Docs updated; D5 closed.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

tests/server/test_packet_children.py

@@ -77,7 +77,9 @@ def pull_all(client: TestClient, pkt: dict[str, Any]) -> dict[str, Any]:
     for b in pkt["bom"]:
         if not b["pulled"] and b["short"] is None:
             r = client.patch(
-                f"/api/packets/{pkt['id']}/bom/{b['item']}", json={"pulled": True}, headers=_im(b["row_version"])
+                f"/api/packets/{pkt['id']}/bom/{b['item']}",
+                json={"pulled": True, "heat": f"HT-{b['item']}"},
+                headers=_im(b["row_version"]),
             )
             assert r.status_code == 200, r.text
             pkt = r.json()
@@ -202,7 +204,14 @@ def test_shorts_and_receipts(pg_client2: TestClient, pg_settings: Settings, unit
     pid = pkt["id"]
     as_user(c, "wh.wade")
     url = f"/api/packets/{pid}/bom/1/short"
-    body = {"qty": 3, "reason": "Not in stock", "ref": "PO-991", "eta": "2026-11-02", "expect_open": False}
+    body = {
+        "qty": 3,
+        "reason": "Not in stock",
+        "ref": "PO-991",
+        "eta": "2026-11-02",
+        "heat": "H0",
+        "expect_open": False,
+    }
     r = c.post(url, json=body)
     assert r.status_code == 200, r.text
     out = r.json()
@@ -222,12 +231,16 @@ def test_shorts_and_receipts(pg_client2: TestClient, pg_settings: Settings, unit
     assert blocked.status_code == 409 and blocked.json()["code"] == "short_open"
 
     # A short on item 2, then cleared: the whole quantity counts as issued.
-    r = c.post(f"/api/packets/{pid}/bom/2/short", json={"qty": 1, "reason": "Damaged", "expect_open": False})
+    r = c.post(f"/api/packets/{pid}/bom/2/short", json={"qty": 1, "reason": "Damaged / rejected", "expect_open": False})
     assert _line(r.json(), 2)["short"] is not None
     r = c.request("DELETE", f"/api/packets/{pid}/bom/2/short", json={"expect_open": True})
     assert r.status_code == 200, r.text
     assert _line(r.json(), 2)["short"] is None and float(_line(r.json(), 2)["issued"]) == 2
     assert c.request("DELETE", f"/api/packets/{pid}/bom/2/short", json={"expect_open": True}).status_code == 409
+    # The release gate needs a heat on every pulled line.
+    rv2 = _line(r.json(), 2)["row_version"]
+    r = c.patch(f"/api/packets/{pid}/bom/2", json={"heat": "H2"}, headers=_im(rv2))
+    assert r.status_code == 200, r.text
 
     pkt = ok_step(c, r.json(), "wh_release")
     assert pkt["status"] == "ready" and pkt["open_shorts"] == 1
@@ -237,7 +250,7 @@ def test_shorts_and_receipts(pg_client2: TestClient, pg_settings: Settings, unit
     line = _line(r.json(), 1)
     assert float(line["short"]["qty_open"]) == 1 and len(line["short"]["receipts"]) == 1
     assert line["short"]["receipts"][0]["by"]["display_name"] == "Wade Warehouse"
-    assert line["heat"] == "H100" and float(line["issued"]) == 3
+    assert line["heat"] == "H0 / H100" and float(line["issued"]) == 3
     assert c.post(f"/api/packets/{pid}/bom/2/short/receipts", json={"qty": 1, "heat": "H1"}).status_code == 404
 
     with app_conn(pg_settings) as conn:
@@ -247,6 +260,8 @@ def test_shorts_and_receipts(pg_client2: TestClient, pg_settings: Settings, unit
     pkt = ok_step(c, r.json(), "assign", station_id=stall, welder_id=andy)
     as_user(c, "weld.andy")
     pkt = ok_step(c, pkt, "start")
+    # Receive by custody: someone who neither is in the warehouse nor holds the packet is refused.
+    as_user(c, "qc.quinn")
     no = c.post(rec, json={"qty": 1, "heat": "H200"})
     assert no.status_code == 403 and no.json()["code"] == "forbidden"
     as_user(c, "wh.wade")
@@ -257,7 +272,7 @@ def test_shorts_and_receipts(pg_client2: TestClient, pg_settings: Settings, unit
     assert r.status_code == 200, r.text
     line = _line(r.json(), 1)
     assert line["short"] is None and r.json()["open_shorts"] == 0 and r.json()["status"] == "in_progress"
-    assert line["heat"] == "H100 / H200" and float(line["issued"]) == 4
+    assert line["heat"] == "H0 / H100 / H200" and float(line["issued"]) == 4
     closed = _one(
         pg_settings,
         "SELECT s.closed_at, s.qty_open FROM bom_shorts s JOIN bom_lines b ON b.id = s.bom_line_id"
@@ -434,7 +449,7 @@ def test_wh_stage_board(pg_client2: TestClient, unit: tuple[int, int]) -> None:
     assert stale.status_code == 409 and stale.json()["code"] == "stale_step"
     assert stale.json()["current"]["stage"] == "pulling"
     r = c.post(url, json={"stage": "hold", "expect_stage": "pulling"})
-    assert r.status_code == 400 and r.json()["code"] == "reason_required"
+    assert r.status_code == 400 and r.json()["code"] == "invalid_reason"
     r = c.post(url, json={"stage": "hold", "reason": "Other", "expect_stage": "pulling"})
     assert r.status_code == 400 and r.json()["code"] == "reason_required"
     hold = {"stage": "hold", "reason": "Drawing / BOM problem", "note": "Asked Leo", "expect_stage": "pulling"}