Adds the workshop-side counterpart to Stage 11B's intake form: a tracking workspace filtered by fulfillment stage, an auditable timeline of stage changes, and inventory deduction on completion. Closes audit finding P2.2; Stage 11 is complete.
Domain: FulfillmentEvent (append-only transition record with operator notes and a malformed-line-tolerant wire format), MaterialUsage, MaterialConsumptionPort + MaterialDeductionResult. Order gains fulfillmentHistory, materialUsage, derived stage accessors, and withFulfillmentEvent(). All existing fields, defaults, and copyWith semantics preserved.
Data: advanceFulfillmentStatus() records an event with an optional note and injectable clock; recordMaterialUsage() added. WooCommerce round-trips both through _kc_ meta keys, skipping malformed lines and never blanking remote values.
Application/presentation: AdvanceFulfillment, CompleteCustomOrder, CustomOrderTrackingController, CustomOrderTrackingPage, FulfillmentTimeline, showAdvanceStageDialog. Illegal transitions surface the domain rejection reason verbatim.
Architecture: inventory deduction crosses the feature boundary through an outbound port, not a package dependency. feature_orders still has no dependency on feature_inventory; each app supplies InventoryMaterialConsumptionAdapter. Completion advances first and deducts second, so a rejected transition can never decrement stock, and a deduction failure warns rather than failing the commission.
Tests: 329 new (293 feature_orders, 22 kell_mobile, 14 kell_web). 1085/1085 feature_orders, 109/109 kell_mobile, 81/81 kell_web. dart analyze --fatal-infos clean.
Adds the operator-facing intake flow for made-to-order commissions on top of
the Stage 11A domain and data layers. The form, validation, and confirmation
receipt all live in feature_orders, so web and mobile host the same widget
rather than forking business logic per platform.
Stage 11C still covers the tracking page, the status-change timeline, and
inventory deduction on completion.
Application:
- CreateCustomOrder and RecordDeposit use cases wrapping the repository
methods added in Stage 11A, so presentation never assembles a custom order
aggregate by hand. RecordDeposit deliberately accepts no payment identifier.
- CustomOrderFormController with field-keyed validation, so each input renders
its own error rather than a single form-level message. Clock and ID
generator are injected, which keeps created-at stamps and order IDs
deterministic under test.
- All money is typed as text and converted to integer cents by
parseMoneyToCents before it reaches DepositInfo, consistent with
PaymentResult.amountCents. Thousands separators, currency symbols, excess
precision, and negatives are rejected or normalised at the boundary. The
only double is the derived OrderItem.unitPrice, computed once from cents.
- Derived balance clamps at zero rather than reporting a credit when a deposit
exceeds the quoted total, matching DepositInfo.balanceDueCents.
Presentation:
- CustomOrderFormPage — sectioned intake (customer, specification, pricing and
deposit, reference images) over the shared design-system widgets.
- CustomOrderConfirmationPage — order summary, spec rendering, and a deposit
receipt showing amount, method, date, and balance only.
- FulfillmentStatusChip over the design-system KcStatusChip, covering all
seven pipeline values.
- showReferenceImageDialog() plus ReferenceImageDialogResult with URL
validation and de-duplication.
- OrdersPage gains an optional onCreateCustomOrder callback. When null the
"New Custom Order" action is not rendered, so the page stays usable in hosts
that have no intake route.
Hosts:
- kell_web: new /orders/custom route rendering CustomOrderFormPage inside
AppShell, with ordersToCustomOrder() and customOrderToOrders() handoffs on
AppNavigation. Confirmation returns to Orders pre-selecting the new order.
- kell_mobile: new MobileCustomOrderPage, a full-screen SafeArea host for the
shared form, reached from an extended FAB on the orders list. Market intake
is the primary custom-order use case, so mobile gets a dedicated route
rather than an inline panel. The list reloads on return.
Privacy:
- The deposit receipt renders amount, method, date, and balance only. The
transaction ID stays on PaymentResult and is asserted absent from the
rendered confirmation by test. The controller holds no payment identifier at
any point.
Deferred to Stage 11C, recorded in the Stage 11B section:
- Product-base selection from the catalogue; the form captures a free-text
specification instead.
- Platform camera and file-picker capture for reference images; the dialog
accepts validated URLs only.
Validation:
- 146 new tests: 82 on CustomOrderFormController (money parsing, setters,
derived balance and clamping, reference image add/remove/dedupe, the full
validation matrix, buildSpec mapping, submission, quoted vs. collected
deposit, repository failure, duplicate ID, reset), 26 on the form page, 24
on the confirmation page including the no-payment-identifier assertion, 3 on
the OrdersPage entry point, 6 on MobileCustomOrderPage, and 5 on the web
route.
- 2,044/2,044 passing across all 11 packages and apps, up from the 1,898
baseline at 0e3987b, with no regression.
- dart analyze --fatal-infos clean across all packages and apps.
- dart format --line-length 100 clean on every file touched by this slice.
Test-harness note: the intake form is taller than the default 800x600 test
view, so the submit-button tests resize tester.view rather than working around
a layout defect. The page scrolls normally on device.
Toolchain note: kell_web/pubspec.lock picked up SDK-pinned transitive bumps on
flutter pub get (matcher 0.12.19 to 0.12.20, meta 1.18.0 to 1.19.0, test_api
0.7.11 to 0.7.12, vector_math 2.2.0 to 2.4.3). Same accepted class as the
kell_mobile bumps recorded under chore/state-reconciliation-flutter-347;
committed so the lock file matches the toolchain in use.
Closes: P2.2 (intake UI portion)
Reconciles repository state after the local toolchain moved to Flutter 3.47.0
/ Dart 3.13.0. No product code changed - no lib/ or test/ file was modified.
Working tree drift:
1. analysis_options.yaml churn (accepted, 11 files). Flutter 3.47 ships
AnalysisOptionsMigration, which unconditionally writes a fixed
analyzer.exclude block into every analysis_options.yaml. It runs from
ensureReadyForPlatformSpecificTooling, so pub get / analyze / run / build
all restore it, and there is no opt-out (flutter#191160, flutter#191131).
Commit 92d83e0 previously reverted this; the revert did not hold - a full
test sweep regenerated the block in 8 more packages. Accepted and committed
rather than fighting the tool. Verified the risky web/** entry drops
nothing: neither kell_web/web/ nor kell_mobile/web/ contains .dart files.
2. kell_mobile web scaffold (reverted). A stray `flutter create
--platforms=web` had added an untracked web/ directory and rewritten
.metadata so the android platform entry was replaced by web. kell_mobile is
the Android target, so .metadata was restored and the scaffold deleted.
3. kell_mobile/pubspec.lock (accepted). Transitive bumps resolved under the
newer SDK: clock, matcher, meta, stack_trace, test_api, vector_math,
vm_service. All SDK-pinned.
Master document reconciliation:
- PROJECT_STATE_AUDIT.md: removed a duplicated "## 5. Summary Scorecard"
section - the scorecard and readiness table were present twice from a bad
append. Re-baselined the remaining §5 against main, added a test-count
column, and corrected §3.4 counts and §3.5 antipattern status. Stages
10C-10F, 11A, and 16A had landed but were still recorded as missing.
- master_development_brief.md: Appendix A maturity matrix refreshed to the
verified counts; new "Toolchain baseline" section documents the Flutter 3.47
behaviour so a future slice does not try to revert it again.
- build_execution_tracker.md: added the reconciliation slice entry and a
toolchain note.
- Fixed a pre-existing MD040 lint error (unlabelled code fence).
Verification:
- dart analyze --fatal-infos: clean across all 11 packages and apps
- tests: 1,898 / 1,898 passing (core 90, design_system 51, auth 42,
integrations 123, data 63, feature_wordpress 545, feature_inventory 167,
feature_orders 657, feature_policy 17, kell_web 62, kell_mobile 81) -
identical to the Stage 11A total, confirming no behaviour change
- markdownlint-cli2: 0 issues
Adds the custom/made-to-order commission workflow to feature_orders at the
domain and data layers. No UI in this slice — Stage 11B/11C cover the
CustomOrderFormPage, confirmation, and tracking surfaces.
Custom orders extend the existing Order aggregate rather than forming a
parallel system, so they flow through the same repository contract and the
same order management pipeline as standard orders.
Domain:
- OrderType enum (standard, custom) with wireValue/fromWire; fromWire defaults
to standard so an order written by an older client is never mis-classified
as a commission.
- CustomOrderSpec value object — material, color, size, dimensions,
unmodifiable reference image URLs, free-text notes, estimated completion.
Immutable with copyWith, list-aware ==/hashCode, and a toString that reports
the reference image count rather than the URLs.
- DepositInfo value object — all money as integer cents, consistent with
PaymentResult.amountCents, so repeated deposit/balance/settlement arithmetic
cannot drift. Derived balanceDueCents clamps at zero rather than reporting a
credit when a deposit exceeds the total.
- FulfillmentStatus pipeline: quoted -> depositReceived -> inProduction ->
qualityCheck -> readyForPickup -> completed, plus cancelled from any
non-terminal stage. FulfillmentTransition enforces legality in the domain —
illegal jumps, same-stage advances, and any move out of a terminal stage are
rejected with an explanatory reason rather than silently applied.
qualityCheck -> inProduction is permitted: failed inspection sending a piece
back to the bench is a real workshop operation.
- Order extended with orderType (defaults to standard), nullable
customOrderSpec, depositInfo, and fulfillmentStatus, plus isCustom,
hasDeposit, and balanceDueCents. Every existing field, default, and copyWith
semantic is preserved.
- OrdersRepository extended with createCustomOrder, updateCustomOrderSpec,
recordDeposit, and advanceFulfillmentStatus.
Data:
- FakeOrdersRepository implements all four methods and seeds five custom
orders (KC-C2001..KC-C2005) covering every non-terminal pipeline stage. The
six standard orders are unchanged.
- WooCommerceOrdersRepository implements all four methods. Custom order state
round-trips through 13 _kc_-prefixed order meta keys; the full mapping table
is documented on WooCommerceOrderMapper. Spec edits and stage advances PUT
only meta, so they can never mutate a price, a line item, or a customer
record. balanceDueCents is derived on read, never persisted, to avoid a
second source of truth.
- WooCommerceApiClient.updateOrder added in feature_wordpress — only
updateOrderStatus existed, which cannot carry meta.
Observability (Stage 16A layer):
- KcLogger injected into both repositories, defaulting to KcLogger.silent().
Domain rejections log at warning; API failures log at error with the status
code and originating exception.
- No silent catch (_) {} blocks — every swallowed error produces both a log
record and a failure result.
- Log context is limited to identifiers, operation names, and status names.
Customer identity, addresses, money amounts, and payment identifiers are
never logged, and all context additionally passes through KcRedactor.
- The deposit transaction ID is deliberately absent from both DepositInfo and
the WooCommerce meta mapping — it lives on PaymentResult alone, because
order meta is readable by any store administrator. Asserted by tests on both
the object and the outgoing request body.
Also closes P3.8: adds .metadata, CHANGELOG.md, LICENSE, and README.md to
feature_orders so it matches every other package (.gitignore already existed).
The README documents the pipeline, the meta mapping, and the privacy rules.
Deviations from the brief, recorded in the Stage 11A section:
- estimatedCompletionDate lives on CustomOrderSpec rather than Order, and
there is no separate updateEstimatedCompletion — a date revision goes
through updateCustomOrderSpec. Deferred for review in Stage 11C.
- internalNotes not added; Order.notes already serves that purpose.
Validation:
- 423 new tests in feature_orders (234 -> 657), including an exhaustive 7x7
legal/illegal transition matrix and coverage of every new repository method
on both implementations.
- 1,898/1,898 passing across all packages; no regression from the 1,475
baseline at 666abd2.
- dart analyze --fatal-infos clean across all 11 packages and apps.
- dart format --line-length 100 clean on every file touched by this slice.
Closes: P2.2 (domain + data portion), P3.8
Closes the two findings the release committee review identified as absolute
gaps: the platform had no structured logging and no crash reporting, so runtime
errors were invisible in every environment and operators had no way to report a
defect with evidence attached.
Addresses PROJECT_STATE_AUDIT.md findings P3.4 (structured logging infrastructure)
and P3.5 (crash reporting integration), plus the "No logging infrastructure" and
"No crash reporting" architectural risks in section 3.4.
core — new observability layer (packages/core/lib/src/observability/):
- KcLogLevel: five ordered severities (debug/info/warning/error/fatal) with
numeric severity, label, isAtLeast() threshold comparison, and fromString().
- KcLogRecord: immutable structured record (level, source, message, timestamp,
unmodifiable context, error, stackTrace) with format(), toJson(), isFailure.
- KcRedactor: credential redaction over 14 sensitive key fragments, recursing
through nested maps and lists. Applied to every logged context map and every
bug report diagnostics map.
- KcLogSink contract plus three implementations: KcConsoleLogSink (silent in
release by default), KcInMemoryLogSink (bounded ring buffer supplying bug
report evidence), KcMultiLogSink (fan-out that tolerates a failing sink).
- KcLogger: the logging facade. Drops sub-threshold records, redacts context,
and swallows sink exceptions so observability can never break a business
operation. Provides forSource() for subsystem-scoped child loggers.
- KcErrorReporter: installs FlutterError.onError and
PlatformDispatcher.instance.onError, and provides runGuarded() to wrap runApp.
restore() resets global state so tests stay isolated.
- KcBugSeverity and KcBugReport: the report model with redacted diagnostics,
hasFailureEvidence, toJson() for transmission, and toMarkdown() for export.
- KcBugReportSink contract plus KcInMemoryBugReportSink.
- KcBugReportService: validates input, attaches the recent log tail as evidence,
logs the submission outcome, and returns a failure result rather than throwing
when the tracker is unreachable.
- KcObservability: assembles logger, evidence buffer, and bug report service
together. Building them independently is the most likely way to produce empty
bug reports, so this bundle guarantees they share one buffer.
design_system:
- KcBugReportDialog and KcBugReportDraft: the shared operator reporting form
with inline validation, severity selection, optional reporter identity, and an
explicit statement that logs are attached and credentials are never included.
Kept free of a core dependency so design_system stays dependency-free.
Application wiring (kell_web and kell_mobile):
- AppServices and MobileAppServices hold a KcObservability; all four factories
(fake/wordpress/square/multi) stamp their environment label so reports are
attributable to the mode that produced them.
- Both main.dart entry points install the global error handlers before the first
frame and wrap runApp in a guarded zone, then emit a startup record capturing
the effective environment and whether a fake-mode credential fallback occurred.
- "Report a problem" action added to the AppShell and MobileShell app bars,
capturing the active screen (and tab index on mobile).
Documentation:
- docs/operations/release-checklist.md (new): per-environment release gates for
Development, Test/QA, Staging, and Production. Each environment inherits the
prior one's gates and adds its own, with build commands, functional and
observability verification, a sign-off record, rollback triggers, and the open
blocker register.
- master_development_brief.md: Stage 16A manifest, corrected baseline, Stage 16C
defined for the deferred scope (retry/rate limiting, remote sink, health
dashboard, analytics). Marked the square()/multi() factory and ID conflation
debt items resolved (fixed in Stage 10E but still listed as open).
- build_execution_tracker.md: Stage 16A slice entry.
- PRD.md: milestone table brought current; observability added to infrastructure
requirements. Added a scoped markdownlint-disable for MD011 because the PRD's
"(text)[cite: n]" citation markers are indistinguishable from reversed links
and were silently corrupted by markdownlint --fix during this review.
- mkdocs.yml and operations/index.md: register the release checklist.
Corrections made during review:
- The documented test total of 1,458 omitted feature_policy's 17 tests. The true
grand total is 1,475; both figures are now documented with the reason.
Validation:
- 85 new tests: 56 core, 10 design_system, 10 kell_web, 9 kell_mobile.
- 1,475/1,475 passing across all 11 packages and apps.
- dart analyze --fatal-infos clean across all 11 packages and apps.
- markdownlint clean on all five modified/created documents.
Known limitations (tracked as Stage 16C):
- Logs and bug reports are held in-process only. There is no remote sink, so
diagnostics are lost on restart and are unavailable off-device.
- Usage analytics and the per-channel integration health dashboard are not
implemented; IntegrationHealthCheck remains a contract with no implementation.
- Migrate to Flutter built-in Kotlin: set builtInKotlin=true and
newDsl=true in gradle.properties; remove id(kotlin-android) from
app/build.gradle.kts. Eliminates the Kotlin Gradle Plugin WARNING
that caused 8 stderr lines in the VS Code Debug console.
- Fix DashboardController lifecycle in MobileShell: move controller
creation from _buildBody() (called on every rebuild) to
didChangeDependencies() so it is initialised once and reused.
Prevents repeated data loads on every tab switch and resolves the
203 skipped frames Choreographer warning.
- Fix KcSummaryCard RenderFlex overflow (8 cards, 19px each): reduce
icon size 28->22px, switch spacing to xs, wrap value Text in
FittedBox(scaleDown) with fontSize 28, use bodySmall + maxLines for
label. Cards now fit within the GridView childAspectRatio:1.6
constraint on all phone screen sizes.
All tests pass: 27 kell_mobile + 41 design_system.
Mike Kell