Build Seth's changes C1 to C11 (Gitea issues 1, 8, 18, 23, 24, 25, 27, 31, 32, 33, 36)

- C1 (issue 1): over target follows VISUAL ticket hours, not the timer.
- C2 (issue 24): a Q.C. reject always needs a reason; accept needs an NCR number after a reject without one.
- C3 (issue 25): an incomplete unit ITP blocks filing.
- C4 (issue 27): prints open the print dialog on the page, no new tab.
- C5 (issue 31): filing is blocked while VISUAL shows a work order open; the feed sets vclosed on VISUAL packets.
- C6 (issue 8): the data book leaves out the history pages.
- C7 (issue 18): the supervisor approves each received short; accept and filing wait for it.
- C8 (issue 23): per-department checklists, edited by the department supervisor or Admin, frozen at START.
- C9 (issue 32): Q.C. and Clerical may run the stamp check.
- C10 (issue 33): the PM screen and reports are for PS-ProjectMgmt and Admin only.
- C11 (issue 36): the Stall screen lists the packets assigned to the welder, at the supervisor's stall.

Migration 0011. Docs: PLAN (also issue 9 confirmed, issue 4 asked), POLICY, SECURITY, SCHEMA, FEED, README, CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CHANGELOG.md

@@ -6,11 +6,14 @@ All notable changes to this project are recorded here. The format follows [Keep
 
 ### Decided
 
+- Gitea issue 9: SethD kept the drawing-origin change order for a same-rev re-release on an in-shop packet (2026-10-29), so the shop confirms the new pages. A byte-identical file is still ignored. Nothing changes in the build.
+- Gitea issue 4: SethD wants the order a packet shows to follow the shop schedule, which is Presley's Production Planner (2026-10-29). Asked on the issue on 2026-10-30: what it is, where it lives, what a row holds and how often it changes. Packet Station would only read it. The order rule stays as built until then.
+- Gitea issue 31: two follow-up questions asked on 2026-10-30. A work order deleted from VISUAL while open blocks filing for good: count a leg gone for 2 runs as closed, or let an Admin close it with a reason? And should Shipping packets also wait for the VISUAL close? Both stay as built until answered.
 - Gitea issues 10, 14, 15, 16, 22, 26, 28 and 29: SethD kept the built rules (cancelled work orders flagged only, data book date for Clerical and Q.C., signature undo rules, the server release gate, no "copy marks" button, block signature removal, the data book built at filing, every role may read the PDFs). Nothing changes in the build.
 - Gitea issue 6: every policy tightening stays, filing for packets routed to Shipping included.
-- Gitea issues 8, 18, 23, 32, 33 and 36: SethD changed six more defaults, to build in phase 10 (PLAN.md changes C6 to C11): the data book leaves out the history pages; a supervisor approves each received short and a packet cannot complete until every short is approved; checklists are per department, edited by its supervisor, and changes reach new packets only; Q.C. and Clerical may run the stamp check; the PM screen is for PS-ProjectMgmt and Admin; the Stall screen follows the supervisor's assignment.
+- Gitea issues 8, 18, 23, 32, 33 and 36: SethD changed six more defaults (PLAN.md changes C6 to C11, built 2026-10-30; see Added and Changed): the data book leaves out the history pages; a supervisor approves each received short and a packet cannot complete until every short is approved; checklists are per department, edited by its supervisor, and changes reach new packets only; Q.C. and Clerical may run the stamp check; the PM screen is for PS-ProjectMgmt and Admin; the Stall screen follows the supervisor's assignment.
 - Gitea issues 7, 11, 13, 17, 30, 34 and 35: kept as built, or settled as planned (the archive gets the data book, the documents and a manifest at filing; nothing is purged).
-- Gitea issues 1, 24, 25, 27 and 31: SethD changed five defaults, to build in phase 10 (PLAN.md changes C1 to C5): over target follows VISUAL ticket hours; a Q.C. reject always needs a reason and acceptance needs an NCR number; an incomplete ITP blocks filing; prints go to the print dialog from the page; filing waits until VISUAL shows the work order closed.
+- Gitea issues 1, 24, 25, 27 and 31: SethD changed five defaults (PLAN.md changes C1 to C5, built 2026-10-30; see Added and Changed): over target follows VISUAL ticket hours; a Q.C. reject always needs a reason and acceptance needs an NCR number; an incomplete ITP blocks filing; prints go to the print dialog from the page; filing waits until VISUAL shows the work order closed.
 - Gitea issue 21: carried marks stay computed; the next department adds its welds to the same weld map.
 - Gitea issue 37: production and test each run natively on their own Linux VM, not in Docker. docker-1 keeps CI only. Built in phase 10; the docker-1 test stack runs until the test VM is ready.
 - Gitea issue 7: project files are also archived to an NFS share on the QNAP. Phase 10 adds an Admin setting for the archive folder that checks read and write. Nothing is deleted from Packet Station.
@@ -28,6 +31,15 @@ All notable changes to this project are recorded here. The format follows [Keep
 
 ### Changed
 
+- Gitea issue 1 (change C1): over target follows the VISUAL ticket hours, not the station timer. A packet is over when its ticket hours are above its work-order target; a packet with no ticket hours is not over. The PM hours tables, the "Packets over target" table, the KPI, the summary line, the CSV and the report PDF follow. The columns read "Timer h", "Ticket h", "Target h", "Ticket variance h", "Ticket h / target" and "Over target (tickets)", and the over table ends with "Over by (tickets)". The timer is still shown.
+- Gitea issue 24 (change C2): a Q.C. reject always needs a reason of at least 8 characters; an NCR number may go with it but no longer stands in for it. A packet rejected without an NCR number cannot be accepted, to complete or to another department, until Q.C. enters the NCR number (422 `ncr_required` "Enter the NCR number of the reject first."). The number is stored on the accepting inspection and in the log. The Q.C. bar shows the NCR field as required (`ncr_required` on the packet read). An NCR document added to the packet goes into section 5 of the data book.
+- Gitea issue 25 (change C3): a packet cannot be filed while its unit's ITP is not complete (precondition `itp_complete`, "Complete the unit's ITP first. Q.C. signs it off on the ITP page."). A unit with no ITP does not block. The close panel shows the reason under File.
+- Gitea issue 27 (change C4): prints go straight to the browser's print dialog from the page, with no new tab. Every print in the app, the ITP print included, goes through `frontend/src/lib/printPdf.ts`. A print that fails says "The print could not be made. Try again." Viewing a PDF still opens a tab. The stamped pages and the print log are unchanged.
+- Gitea issue 31 (change C5): filing is blocked, not warned, while VISUAL shows a work order open, on both routes. The feed now marks a VISUAL packet closed in VISUAL when it sees every work order closed or cancelled, and clears it when one shows open again ("Open again in VISUAL (observed)"); the packet moves from "Ready to close" to "Ready for data book" by itself. Clerical confirms only hand packets; "Job closed in VISUAL" is refused on a VISUAL packet. Precondition `closed_in_visual` replaces `vclosed_if_databook`. The second confirmation (`confirm_open_wos`, 409 `open_work_orders`) is gone.
+- Gitea issue 8 (change C6): the data book leaves out the packet history. Section 7 "Record history" is gone, so the book has six sections. The change-order table moved to a "Change order record" page at the end of section 1, only when the packet has change orders. The history stays on the packet page.
+- Gitea issue 33 (change C10): the Project Management screen and every `/api/pm/*` endpoint, the CSV and PDF exports included, are for PS-ProjectMgmt and Admin only. Anyone else gets 403 "Project Management only." and sees no PM entry; typing `/pm` says the screen is not for their role.
+- Gitea issue 36 (change C11): the Stall screen lists the packets assigned to the signed-in person, each at the station the supervisor picked, across stations (`GET /api/stall/mine`). Nobody picks a station there any more. Moving a welder is a re-assign by the supervisor. The stall's Mine no longer needs a station. With nothing assigned it says "Your supervisor assigns packets to you."
+- Deploying C1 to C11: short receipts recorded before the deploy have no approval, so a supervisor approves them before the next Q.C. accept to complete, or before filing a packet already complete. A Q.C. reject since the last accept that has no NCR number needs one at the next accept. Migration 0011 freezes the open stage of each packet in progress, in review or at Q.C. to the default list for its kind, so a department edit does not reach it; if the `checklist_templates` row is missing, such a stage reads its department's live list until it closes. Nothing else is backfilled.
 - Security fixes in the pinned dependencies, found by the new CI scan: `pypdf` 6.21.0 to 6.21.2 (GHSA-5hx5-vpf9-5wcv, a crafted PDF could reach the image parsers; 6.21.2 for GHSA-6c7f-9265-g8fw, GHSA-jr96-gvgh-j3r4 and GHSA-gmh7-3g9r-mjh5) and `certifi` 2026.7.22 to 2026.10.19 (PYSEC-2026-4320, a distrusted root removed). The image must be rebuilt for both to reach the stacks.
 - `POST /api/admin/ad/refresh` no longer runs the AD refresh in the request. It asks the worker for an `ad-reconcile` run and answers 202 `{requested, pending, job}`; `GET /api/admin/ad/reconcile` gives the latest report.
 - The storage quota alert is now mailed through the Notifications rules (to PS-Admins by default), with a "Cleared" message when usage drops back.
@@ -39,6 +51,9 @@ All notable changes to this project are recorded here. The format follows [Keep
 
 ### Added
 
+- Gitea issue 18 (change C7): the department supervisor approves every received short, one receipt at a time, with a signature ("Approve a received short"), after checking the part and its heat number against what the warehouse issued. A lead is not enough. The Materials tab lists each receipt with who received it and who approved it, and an Approve button for the supervisor. A packet cannot be accepted as complete, or filed, until every short is received and approved ("Every short must be received and approved by the supervisor first."). Accept and route to another department does not wait. `POST /api/packets/{id}/shorts/receipts/{receipt_id}/approve`; the packet read gains `shorts` and `shorts_unapproved`. Migration 0011 adds the append-only `short_approvals` table.
+- Gitea issue 23 (change C8): checklists per department. The Checklists screen (`/checklists`) lets a department supervisor edit their own department's checklist, and Admin any department's; a lead and Q.C. cannot. A department without its own list uses the default for its kind (weld or plain). A save needs a password session and the version it started from, and is audited (`checklists.dept_updated`). A stage keeps the list it had when work started (`packet_stages.checklist_template`, migration 0011), so a change reaches only stages not yet started. The Admin Checklists tab now edits department lists too. `GET /api/checklists`, `GET` and `PUT /api/checklists/{dept}`. The Q.C. check items are unchanged.
+- Gitea issue 32 (change C9): the Stamp check screen (`/stamp-check`) for Admin, Q.C. and Clerical, in a password session. `POST /api/stamp-verify` and `POST /api/stamp-verify/pdf`; the `/api/admin` paths stay as aliases with the same rule.
 - Phase 9: Admin completion, AD reconcile, integrity, notifications, backups. The Admin page gains eight tabs: Departments, Profiles, Checklists, Security, Access log, Who is in, Stamp check and Notifications. The tab list wraps into rows on a narrow screen.
 - Departments tab: every department with its AD groups (and whether each is in the OU) and its stations. Edit a department's name, turn it on or off, rename, reorder, add or hide stations. Stations are never deleted, since station limits and packets point at them. The code and the short name cannot change. "New department" adds a shop department with its stations and shows the three AD groups IT must create (`PS-<code>-<short name>-Worker`, `-Lead`, `-Supervisor`) before it is saved. Only shop departments can be added; the support departments are fixed.
 - Profiles tab: a person's welder stamp (1 to 12 letters, numbers or dashes, unique), whether their profile is active, and their station limits per department. An inactive profile drops out of the welder picker and the worker filter; it changes nothing the person may do. A CSV import by employee ID (columns `employee_id`, `welder_stamp`, `active`, `stations`; an empty cell leaves a value, `-` clears it; the `stations` cell is the person's whole list) shows a preview with every change and every error, and applies only when the preview has no errors, in one go. The Directory flags panel lists active users with no employee ID and employee IDs shared by more than one account.