Phase 9: Admin completion, reconcile, notifications, integrity, backups

Admin: Departments (name and stations; add shows the three groups IT must
create), Profiles (welder stamp, station limits, active) with a CSV import
that previews and applies only when clean, Checklists (weld and plain),
Security (session, lockout and rate-limit settings with bounds, alerts for
the last 24 hours, the integrity result), Access log with filters and a
guarded CSV, Who is in, Stamp check, Notifications, and the employeeID
flags. Every Admin change is audited.

Worker: ad-reconcile (nightly and on "refresh from AD now"), session-refresh
(15 minutes), integrity (seals, asset hashes, missing and orphan files, the
audit chain), backup-check, notify-send and notify-digest. Notifications
route per event type to AD groups, users, mailboxes or the department
Supervisor group, immediately or in a daily digest, over STARTTLS verified
against the PESCO CA, with dry run on the test stack.

Backups: scripts/backup/ps-backup.sh and ps-restore.sh with a systemd timer
at 02:00 America/Denver. Restore rehearsed on the test stack 2026-10-21.
CI: pip-audit and npm audit. pypdf 6.21.1 and certifi 2026.10.19.

Migration 0010. Closes the app part of I6, M3, O1, O2 and S3.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

server/packetstation/domain/qc.py

@@ -10,6 +10,7 @@ from collections.abc import Mapping
 from typing import Any
 
 from .. import policy
+from ..notify import raise_event
 from ..text import LIMITS
 from . import itp, packets, qcdocs, search
 
@@ -65,6 +66,23 @@ def inspector_text(insp: Mapping[str, Any] | None) -> str:
     return f"{who} [{stamp}]" if stamp else who
 
 
+def _notify_reject(w: Any, why: str) -> None:
+    """qc_reject for the packet's department, in the write's transaction (notify-send mails it)."""
+    pkt = w.packet
+    dept = str(w.from_dept or pkt.get("dept_code") or "") or None
+    what = str(pkt.get("title") or pkt.get("drawing") or "")
+    who = (w.principal.user or {}).get("display_name") or ""
+    raise_event(
+        w.conn,
+        "qc_reject",
+        subject=f"packet:{w.id}",
+        title=f"Q.C. rejected packet {w.id}" + (f" ({what})" if what else "") + (f", dept {dept}" if dept else ""),
+        body="\n".join(x for x in (f"Rejected by {who}." if who else "", why) if x),
+        detail={"packet_id": w.id, "dept_code": dept, "by": str(w.user_id)},
+        dept_code=dept,
+    )
+
+
 def qc_texts(w: Any, a: policy.Action, to_dept: str) -> None:
     """The packet_log label and note of a Q.C. accept or reject. Called before the side effects close the inspection.
 
@@ -79,6 +97,7 @@ def qc_texts(w: Any, a: policy.Action, to_dept: str) -> None:
         if welds:
             parts.append("welds " + ", ".join(welds))
         w.log("Q.C. rejected → supervisor", " · ".join(x for x in parts if x) or None)
+        _notify_reject(w, " · ".join(x for x in parts if x))
         return
     if a is A.QC_ACCEPT_AND_ROUTE:
         labels = getattr(w.children, "dept_labels", None) or packets.dept_labels(w.conn)