fix(plating-perms): Phase I post-deploy fixes (live entech test catches)

8 distinct bugs caught + fixed while testing the live admin DB on entech
after the migration was approved. Each surfaced a real Odoo 19 gotcha
now codified in CLAUDE.md (rules 13b-13l).

Picker architecture:
- res.users.x_fc_plating_landing_action_id and res.company.x_fc_default_landing_action_id
  now Many2one('ir.actions.actions') instead of ('ir.actions.act_window'),
  so the picker accepts BOTH window actions (Sale Orders / Quotations /
  Process Recipes) AND client actions (Manager Desk / Plant Kanban /
  Quality Dashboard). Picker went from 3 entries to 6.
- x_fc_pickable_landing field moved from the two subclasses to the
  ir.actions.actions base. Single source of truth.
- _render_resolved on the base dispatches to the correct subclass by
  action type.

Non-admin Preferences access:
- Added ACL grant: group_fp_technician (and all higher roles via
  implication) get read on ir.actions.actions. Without this, opening
  Preferences raised AccessError on the picker domain evaluation.
- Removed the accessible_landing_action_ids Many2many compute (failed
  for non-admins because field assignment requires write access on
  the comodel relation, even with sudo'd search). Picker now shows all
  6 entries to all users; resolver falls through gracefully if the
  user picks an action they can't reach.
- res.users SELF_WRITEABLE_FIELDS / SELF_READABLE_FIELDS extended via
  @property + super() (NOT class attribute — Odoo 19 changed the
  pattern). Non-admin users can now save the Preferences dialog with
  plating fields without hitting the standard write ACL.

Migration workflow:
- res.groups.users -> .user_ids (Odoo 19 rename; deprecated alias
  removed). Was crashing _fp_notify_owners and _cron_purge_expired.
- user.message_post -> user.partner_id.message_post (res.users uses
  _inherits delegation which doesn't expose mail.thread methods).
  Was crashing the Owner approval click.

Tablet lock screen:
- /fp/tablet/tiles points at group_fp_technician instead of the old
  group_fusion_plating_operator. Post-migration nobody holds the old
  group directly (only via implication), so res.groups.user_ids on
  the old xmlid returned empty — 'No operators configured' shown
  even with PIN set.
- PIN pad dots dark mode: empty dot now dark gray (#424245), filled
  dot now pure white. Previous version had both at light shades so
  user couldn't see PIN entry progress.
- Lock-screen logo frame dark mode: near-opaque white plate
  (rgba 0.95) so company logos designed for light backgrounds
  render correctly. Previous 0.08 alpha let the dark page bleed
  through.

Pre-deploy collision fix (already committed before deploy but
documented here for completeness):
- pre-migrate.py to rename old configurator's 'Shop Manager' group
  display name before new fp_security_v2.xml loads the new
  group_fp_shop_manager_v2 with the same display name (avoids
  res_groups_name_uniq violation).

Module versions bumped:
  fusion_plating: 19.0.21.1.0 -> 19.0.21.1.2
  fusion_plating_shopfloor: 19.0.32.0.4 -> 19.0.32.0.6

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fusion_plating/CLAUDE.md

@@ -208,6 +208,66 @@ Use only: `name`, `model_id`, `state`, `code` (or `function`/`model`), `interval
 11. **XML data ordering**: Window actions must be defined BEFORE `<menuitem>` elements that reference them in the same file.
 12. **Module install on new modules**: Use `--update=base` alongside `-i MODULE` to ensure Odoo rescans the addons path and finds the new module directory.
 13. **Implied group cascade**: `implied_ids` on `res.groups` does NOT reliably propagate to users on module install. Always include `user_ids` to explicitly assign admin, or fix via SQL post-install.
+13b. **Kanban template name — Odoo 19 wants `<t t-name="card">`, NOT `<t t-name="kanban-box">`**. Old name silently fails at render: `Error: Missing 'card' template`. Use the new structure with semantic `<aside>` + `<main>`:
+    ```xml
+    <templates>
+        <t t-name="card" class="flex-row align-items-center">
+            <aside><field name="image_128" widget="image"/></aside>
+            <main class="ms-2"><field name="name"/></main>
+        </t>
+    </templates>
+    ```
+    Reference: `/usr/lib/python3/dist-packages/odoo/addons/web/static/src/views/kanban/kanban_arch_parser.js`. Pre-existing `fp_rack_views.xml` still uses the old name and would also fail at render — fix when next touched. Caught 2026-05-24 by final reviewer of permissions-overhaul branch.
+13l. **Post-migration: `env.ref('old_group_xmlid').user_ids` returns empty** even though the old group still exists. Phase H's migration moves users OFF the old (now-`[DEPRECATED]`) groups onto the new ones. Old groups are still reachable via the new group's `implied_ids` (so old ACLs still resolve for backward-compat), but NO USER directly holds the old group anymore. Any code doing `env.ref('fusion_plating.group_fusion_plating_operator').user_ids` to enumerate "operators" gets an empty recordset. **Fix: point at the new group xmlid (`group_fp_technician`).** `res.groups.user_ids` includes both direct AND implied-via-other-group members, so higher roles (Shop Manager, Manager, QM, Owner) appear via implication. The Phase G `has_group()` sweep didn't catch these — `env.ref(...).user_ids` is a different access pattern. Caught 2026-05-24 when the tablet lock screen showed "No operators configured" post-migration. Audit for other instances: `grep -rn "env\.ref.*group_fusion_plating_" --include='*.py'` (skip test files which intentionally reference old xmlids to verify backward-compat).
+13k. **Custom fields on `res.users` must be added to `SELF_WRITEABLE_FIELDS` (and often `SELF_READABLE_FIELDS`) or non-admin users can't save their own Preferences dialog**. Odoo 19's User Preferences dialog goes through `res.users.write` on the user's own record — Odoo bypasses the standard write ACL ONLY IF every field being written is in `SELF_WRITEABLE_FIELDS`. Any unknown field forces fallback to the standard ACL (admin-only on entech) → `AccessError: You are not allowed to modify 'User' records. Required group: Access Rights`.
+
+    **In Odoo 19, `SELF_WRITEABLE_FIELDS` and `SELF_READABLE_FIELDS` are `@property`-decorated methods, NOT class attributes.** Extend via super(), not list concatenation on `models.Model.SELF_*` (that AttributeErrors at module load — Model base doesn't define them, only res.users does). Canonical pattern (matches hr/res_users.py and mail/res_users.py):
+
+    ```python
+    class ResUsers(models.Model):
+        _inherit = 'res.users'
+
+        @property
+        def SELF_WRITEABLE_FIELDS(self):
+            return super().SELF_WRITEABLE_FIELDS + [
+                'x_fc_plating_landing_action_id', 'x_fc_signature_image',
+            ]
+
+        @property
+        def SELF_READABLE_FIELDS(self):
+            return super().SELF_READABLE_FIELDS + [
+                'x_fc_plating_role', 'x_fc_tablet_pin_set_date', ...
+            ]
+    ```
+
+    Readonly fields on the preferences form ALSO need SELF_READABLE_FIELDS (the form fetches them before the user clicks Save). Methods invoked by buttons that do their own `sudo().write()` bypass this — only DIRECT form-level writes hit the check. Caught 2026-05-24 when Technician tried to save their preferences after the plating landing field was added; the initial fix used the wrong class-attribute syntax and crashed odoo at module load.
+13j. **Non-stored Many2many computes STILL require user-level read access on the comodel** for field-assignment cache fill, even when the compute body is wrapped in `sudo()`. The `user.field = [(6, 0, ids)]` assignment populates the cache by relating to comodel records the CURRENT USER must be able to read — `sudo()` on the lookup doesn't help because the assignment is per-record-context. If the comodel is admin-only (like `ir.actions.actions` / `ir.actions.act_window` on entech), a non-admin opening their own preferences will fail with `Failed to write field X. You are not allowed to access 'Y' records.` Two fixes: (a) drop the Many2many compute and use a static domain filter instead, plus add an ACL row granting read on the comodel to whichever role group needs to evaluate the picker domain; (b) replace the Many2many with a Json/Char that stores IDs, lose the auto-validation. Option (a) is simpler — Odoo's design assumes pickers' comodels are user-readable. Caught 2026-05-24 when a Technician tried to open their Preferences after the per-user `accessible_landing_action_ids` field was added.
+13i. **`res.users` does NOT have `message_post()`** — chatter posting must go through `user.partner_id.message_post(...)`. `res.users` uses `_inherits = {'res.partner': 'partner_id'}` (delegation), which proxies FIELDS through partner_id but NOT METHODS. `user.message_post(...)` raises `AttributeError: 'res.users' object has no attribute 'message_post'`. Note that mail's tracking IS recorded on the user record (via partner) — the chatter widget on user form displays partner's chatter — but the post call itself targets the partner. Caught 2026-05-24 during Owner approval click on the migration preview screen.
+13c. **`res.users.group_ids` NOT `groups_id`**: Odoo 19 renamed the m2m field. Old name doesn't resolve; `@api.depends('groups_id')` raises `ValueError` at module load. Also: domain on relational pickers should use `all_group_ids` (transitive set incl. implied) instead of `group_ids` (only directly-assigned) — otherwise an Owner user won't match a domain looking for QM members. See `feedback_odoo19_groups_id_renamed.md`.
+13d. **`post_init_hook` ONLY fires on INSTALL, not UPGRADE** in Odoo 19. For logic that must run on `-u` of an existing install (entech case), add a `migrations/<version>/post-migrate.py` with a `migrate(cr, version)` function that calls the same helper. The hook still works on fresh install; the migration script bridges the gap on `-u`. Both should be idempotent so re-runs are safe.
+13g. **Odoo 19's `sale.view_order_form` uses a single `<field name="tax_totals" widget="account-tax-totals-field"/>` widget instead of separate `amount_total` / `amount_untaxed` / `amount_tax` fields**. Inheriting xpaths targeting any of the three separate fields will fail at view load: `Element '<xpath expr="//field[@name='amount_total']">' cannot be located in parent view`. To gate or modify totals, target the `tax_totals` widget (one xpath hides the whole totals block). Other views in the file (kanban, list, pivot) DO still have the individual fields — only the FORM view consolidated to the widget. Same likely applies to `purchase.purchase_order_form` and `account.view_move_form` — verify per-view before porting Odoo 17/18 xpaths. Caught 2026-05-24.
+13h. **`user_has_groups('xmlid')` is NOT available inside Odoo 19's `invisible=`/`readonly=`/`required=` attribute expressions**. The view validator parses `user_has_groups` as a field name on the host model and fails: `field 'user_has_groups' does not exist in model 'X'`. Group-based UI gating must use the `groups=` attribute on the element instead. To combine group-AND-state logic, EITHER split into two elements with mutually-exclusive `invisible` AND different `groups=`, OR enforce one half at the model layer (ir.rule / @api.constrains) and the other in the view. Caught 2026-05-24 when a single button used `invisible="state != 'draft' or (cert_type == 'nadcap' and not user_has_groups(...))"` — rewrote as a single button with `groups="group_fp_manager"` + `invisible="state != 'draft'"` and let the ir.rule enforce the Nadcap-write restriction (Manager clicking Issue on a Nadcap cert now raises AccessError).
+13f. **Odoo 19 view validator rejects `ref('xmlid')` inside `<field domain="...">`**: the validator parses `ref(...)` as a field-access on the host model and fails with `field 'ref' does not exist in model 'X'`. Even though `ref()` IS resolved at runtime by the client, validation fires first and aborts module load. Workarounds (pick one):
+    - **Drop the domain** and enforce eligibility via `@api.constrains` on the Python side (simplest — used for `res.company.x_fc_cgp_designated_official_id` in this project; the Owner makes a deliberate choice and Python validates at save time).
+    - **Pre-compute eligible IDs** in a stored `Many2many` compute on the host model, then `domain="[('id', 'in', eligible_ids_field)]"`.
+    - Move the domain into the field definition in Python (`fields.Many2one(..., domain="[...]")`) — but Python-side domains have the same `ref()` limitation, so this isn't always an escape.
+    Caught 2026-05-24 deploying permissions-overhaul to entech.
+13e. **`res_groups_name_uniq` constraint is `(privilege_id, name)` — cross-module display-name collisions during `-u` need a `pre-migrate.py` rename**. If a base module's new XML defines a group with the same display name as a DOWNSTREAM module's existing group (e.g. core adds new `Shop Manager (v2)` while configurator already has old `Shop Manager`), the new INSERT collides with the still-named-the-same downstream row, because Odoo loads modules in dep order and the downstream rename via XML hasn't happened yet. The fix is a `migrations/<version>/pre-migrate.py` in the BASE module that SQL-renames the downstream row before the new XML loads:
+    ```python
+    def migrate(cr, version):
+        cr.execute(\"\"\"
+            UPDATE res_groups
+               SET name = jsonb_build_object('en_US', '[DEPRECATED] Shop Manager (...)')
+             WHERE id IN (
+                SELECT res_id FROM ir_model_data
+                 WHERE module = 'fusion_plating_configurator'
+                   AND name = 'group_fp_shop_manager'
+                   AND model = 'res.groups'
+             )
+               AND (name IS NULL OR name->>'en_US' NOT LIKE '[DEPRECATED]%');
+        \"\"\")
+    ```
+    Pre-migrate scripts run BEFORE the module's data files reload, so the constraint is clear by the time the new group XML INSERTs. Caught 2026-05-24 during permissions-overhaul deploy — `fp_security_v2.xml` claimed `'Shop Manager'` while old configurator's `group_fp_shop_manager` still held that display name in the DB. Same pattern applies to ANY base-module XML adding groups with names that overlap downstream-module groups.
 13a. **Cross-module xmlid refs — base modules CANNOT forward-ref downstream xmlids**: A BASE module's data XML cannot `ref('downstream_module.some_xmlid')` because at fresh install, the base module loads FIRST and `ir.model.data` has no row for the downstream xmlid yet → `ValueError: External ID not found`. This bites on entech (existing DB has the row) but breaks fresh CI/test/demo/new-client installs. **Fix pattern: relocate the cross-module link to the downstream module's own security/data file, using an additive write to the BASE module's record:**
     ```xml
     <!-- In downstream module's security XML -->
@@ -239,6 +299,7 @@ Use only: `name`, `model_id`, `state`, `code` (or `function`/`model`), `interval
 20. **OWL templates expose `Math` but NOT `String` / `Number` / `Array` / `Object` / `Boolean` / `JSON` / `parseInt` / `parseFloat`**: writing `t-on-click="() => this._press(String(d))"` (or similar coercion inside any template expression) throws `Uncaught TypeError: v2 is not a function` at click time — `v2` is OWL's compiled reference to a global that doesn't exist in template scope. The click handler dies before its body runs, so the bug looks like "nothing happens when I press" (no error in the UI, only DevTools shows the trace). **Fixes, in order of preference**: (a) eliminate the coercion entirely — store data in the right type up front, e.g. `t-foreach="['1','2','3']"` instead of `[1,2,3]` so `d` is already a string. (b) Use a JS-side coercion: pass the raw value to the handler and call `String(digit)` inside the component method. (c) Use a pure-expression workaround like string concatenation: `'' + d` does work because `+` is an operator, not a function. **Do NOT try to monkey-patch `String` onto the component (e.g. `this.String = String`) or onto `env` — leaks the global into every component and is fragile across OWL upgrades.** Bit us 2026-05-23 on `pin_pad.xml` — operators couldn't tap PIN digits at all because the click handler died on `String(d)`; the SCSS, reactivity, and `_press` method were all fine, the template scope was the entire bug. Same trap applies to OWL templates anywhere in the codebase: `move_parts_dialog.xml`, `manager_dashboard.xml`, `fp_record_inputs_dialog.xml`, etc. — grep all `t-on-click`, `t-att-*`, and `t-out` expressions for `String(`, `Number(`, `Array(`, `parseInt(`, `parseFloat(`, `JSON.` before merging.
 21. **`ir.actions.act_window_close` is a no-op when the current action was opened with `target: "current"`**: replacing the current action wipes the breadcrumb backstack, so there's nothing to close back to. The user clicks "Back" and nothing happens (no error, no navigation). This bites every OWL client-action surface that calls another client action via `doAction({..., target: "current"})` — the destination has no way to return to the source. **Fix pattern for "Back" buttons in OWL client actions**: navigate EXPLICITLY to the landing/parent action by tag, e.g. `this.action.doAction({ type: "ir.actions.client", tag: "fp_shopfloor_landing", target: "current" })` — works regardless of how the action was reached (kanban tap, QR scan, smart button, direct URL). **Do NOT rely on `act_window_close`, `history.back()`, or `this.env.config.breadcrumbs`** — all three are unreliable across navigation paths. Bit us 2026-05-23 on the Job Workspace Back button after the kanban opened the workspace with `target: "current"`. The same pattern applies to every other "Back" button in shopfloor / manager / portal OWL surfaces — explicit destination via `tag:` is the only robust answer.
 22. **Odoo 19 HTML fields auto-wrap plain-string writes**: writing `co.report_header = 'Plating & Finishing'` to an HTML field (like `res.company.report_header`, `res.partner.comment`, `mail.template.body_html`, `product.template.description_sale`) stores `<p>Plating &amp; Finishing</p>` after Odoo's HTML sanitizer runs. Equality tests against the raw input string FAIL (`payload['tagline'] != 'Plating & Finishing'`). **Three implications**: (a) **In tests**, don't `assertEqual` against the literal string you wrote — strip tags first, OR write the wrapped form (`<p>Plating & Finishing</p>`), OR write an explicit `Markup('<p>...</p>')` so the round-trip stays stable. (b) **In display code**, render HTML fields with `t-out` (QWeb) or `markup(...)` (OWL) — `t-esc` would render the literal `<p>` tags as text. (c) **In comparison logic**, normalize first: `from markupsafe import escape; escape(input_str)` produces the same shape the field stores. Bit us 2026-05-24 testing the lock-screen tagline source (`_lock_company_payload` reads `res.company.report_header`); the test that wrote a plain string and asserted equality failed because the value came back wrapped. The fix was to delete the brittle equality test — the helper's responsibility is just "use the field's value when present, else fall back," which is covered by the empty-field test. Generalizes to ANY HTML-typed Odoo field. Distinct from the `mail.template.body_html is Markup + jsonb` gotcha noted earlier in this file — that's about Markup objects vs strings; this is about the sanitizer wrapping plain strings on write.
+23. **`res.users.group_ids` vs `all_group_ids` for domain filters**: in Odoo 19, `res.users` carries TWO M2M-to-`res.groups` fields and they have different membership semantics. `group_ids` is the user's DIRECTLY-assigned groups (what the user record literally wrote). `all_group_ids` is the TRANSITIVE set — direct groups PLUS every group implied via `implied_ids` chains. **For domain filters on user pickers** (e.g. "show users who can act as a Quality Manager"), ALWAYS use `all_group_ids`, never `group_ids`. An Owner user only carries `group_fp_owner` directly; the QM capability comes via `implied_ids → group_fp_quality_manager`, so a `domain="[('group_ids', 'in', [ref('...quality_manager')])]"` excludes Owners and the picker looks empty. Use `domain="[('all_group_ids', 'in', [ref('...quality_manager'), ref('...owner')])]"` instead. Compute helpers (`@api.depends('group_ids')`) and write vals (`{'group_ids': [(4, gid)]}`) still use `group_ids` because those operate on direct assignments — only domain filters need the transitive set. Bit us 2026-05-24 on the CGP DO + Nadcap Authority pickers on `res.company`. Same gotcha applies to ANY domain that needs "does this user effectively have role X" semantics across user-facing pickers, ACL rules, server actions, and search filters.
 
 ## Naming
 - **New custom models** (post-2026-04): `fp.*` prefix (e.g. `fp.part.catalog`, `fp.certificate`)
@@ -1550,6 +1611,8 @@ Customer feedback: "too many top-level menus" + "configuration is unorganized".
   - Settings → Fusion Plating → Plating Landing Page block (company default).
 - `fusion_plating_configurator`'s earlier menu_fp_root override (action_fp_sale_orders direct) was removed — core's resolver now owns the routing.
 - Pickable list is curated via inline `<field name="x_fc_pickable_landing" eval="True"/>` on action records — currently flagged: `action_fp_sale_orders`, `action_fp_quotations`, `action_fp_process_recipe`. Add more by tagging the relevant act_window record at its source.
+- **`x_fc_pickable_landing` lives on `ir.actions.actions` (BASE)** so the picker dropdown on `res.users.x_fc_plating_landing_action_id` can offer BOTH act_window records (Sale Orders, Quotations, Process Recipes) AND client-action records (Manager Desk, Plant Kanban, Quality Dashboard). The picker Many2one points at `ir.actions.actions` (not `act_window`); the domain `[('x_fc_pickable_landing', '=', True)]` filters across all action types. `_render_resolved()` on the base dispatches to the correct subclass by `type`. **Pickable accessibility compute MUST be `sudo()`'d** — non-admin users (Technician, Sales Rep) lack read access on `ir.actions.actions` and opening their own Preferences dialog would AccessError otherwise; the per-user `check_access_rights` per-action still runs unprivileged so the picklist filters correctly. Tag a new landing candidate by adding `<field name="x_fc_pickable_landing" eval="True"/>` to its `<record>` definition — works regardless of whether the model is `ir.actions.act_window` or `ir.actions.client`.
+- **Role-based dispatch** (Phase E): the resolver now reads `res.users` group membership and routes by precedence — Owner → Manager Desk; QM → Quality Dashboard; Manager → Manager Desk; Sales Manager → Sale Orders; Shop Manager → Plant Kanban/Workstation; Sales Rep → Quotations; Technician → Plant Kanban/Workstation. `_fp_workstation_action_for_layout()` reads `ir.config_parameter['fusion_plating_shopfloor.layout']` (v2 vs legacy) so flipping the flag retargets every Tech/Shop Manager on next page load. Per-user override still wins. Picklist domain is tightened via `res.users.accessible_landing_action_ids` (compute that runs `check_access_rights('read')` per pickable action) so a Tech can't pick "Manager Desk" they can't see.
 
 ### Phase 2 — Configuration sub-folder grouping (`fusion_plating` 19.0.11.1.0, commits `3641b78` + `62c1315` + `4671541`)
 

fusion_plating/fusion_plating/__init__.py

@@ -23,6 +23,8 @@ def post_init_hook(env):
     3. Sub 12a — seed fp.step.template with starter library entries
        derived from ENP-ALUM-BASIC if the library is currently empty.
     4. Sub 12b — seed 4 starter rack tags if the registry is empty.
+    5. Phase H — create a pending fp.migration.preview if any user
+       still holds an old plating-role group + notify Owners.
     """
     _seed_default_timezone(env)
     _backfill_node_input_kind(env)
@@ -31,6 +33,40 @@ def post_init_hook(env):
     _seed_rack_tags_if_empty(env)
     _migrate_legacy_uom_columns(env)
     _seed_starter_recipes_once(env)
+    _fp_post_init_role_migration(env)
+
+
+def _fp_post_init_role_migration(env):
+    """Idempotent: creates a fp.migration.preview if none is pending or applied.
+
+    Called automatically on `-u fusion_plating`. The preview enters 'pending'
+    state and schedules a mail.activity on every Owner. Owner must explicitly
+    click 'Approve & Run' to actually apply the migration.
+    """
+    Preview = env['fp.migration.preview']
+    if Preview.search_count([('state', '=', 'pending')]):
+        return
+    if Preview.search_count([('state', '=', 'approved')]):
+        # Already migrated previously; only re-fire if any unmigrated user remains
+        # An unmigrated user is one who still holds an OLD plating group directly
+        # AND does NOT hold any NEW role group. The compute on res.users.x_fc_plating_role
+        # returns 'no' for users without any new group regardless of their old groups.
+        # Heuristic: if any active user still holds an old group, re-fire.
+        from .models.fp_role_constants import _FP_OLD_GROUP_XMLIDS
+        any_unmigrated = False
+        for xmlid in _FP_OLD_GROUP_XMLIDS:
+            old_grp = env.ref(xmlid, raise_if_not_found=False)
+            if not old_grp:
+                continue
+            if old_grp.users.filtered(lambda u: u.active and not u.share):
+                # Found at least one user still on an old group → re-fire
+                any_unmigrated = True
+                break
+        if not any_unmigrated:
+            return  # All users migrated; nothing to do
+    preview = Preview.create({})
+    preview._fp_build_lines()
+    preview._fp_notify_owners()
 
 
 def _seed_starter_recipes_once(env):

fusion_plating/fusion_plating/__manifest__.py

@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating',
-    'version': '19.0.21.0.2',
+    'version': '19.0.21.1.2',
     'category': 'Manufacturing/Plating',
     'summary': 'Core plating / metal finishing ERP: facilities, processes, tanks, baths, jobs, operators.',
     'description': """
@@ -115,6 +115,11 @@ Copyright (c) 2026 Nexa Systems Inc. All rights reserved.
         'views/fp_operator_certification_views.xml',
         'views/res_config_settings_views.xml',
         'views/fp_landing_views.xml',
+        # Phase F — Owner-only Team page + Designated Officials on res.company.
+        # Both reference menu_fp_config (Configuration root) and Phase 1
+        # role groups, all loaded earlier (fp_menu.xml + fp_security_v2.xml).
+        'views/fp_team_views.xml',
+        'views/res_company_views.xml',
         'views/fp_work_centre_views.xml',
         'views/fp_job_views.xml',
         'views/fp_job_step_views.xml',
@@ -135,6 +140,12 @@ Copyright (c) 2026 Nexa Systems Inc. All rights reserved.
         # 'data/fp_recipe_anodize.xml',
         # 'data/fp_recipe_chem_conversion.xml',
         'data/fp_step_template_data.xml',
+        # Phase H — Owner-approval migration workflow.
+        # Views file declares the action + menu; cron declares the
+        # daily 30-day expiry purge. Both reference model_fp_migration_preview
+        # which Odoo's model autoload makes available before data load.
+        'views/fp_migration_views.xml',
+        'data/fp_migration_cron.xml',
     ],
     'post_init_hook': 'post_init_hook',
     'assets': {

fusion_plating/fusion_plating/data/fp_landing_data.xml

@@ -24,47 +24,14 @@
         <field name="model_id" ref="base.model_res_users"/>
         <field name="state">code</field>
         <field name="code"><![CDATA[
-# Resolve in priority order:
-#   1. user.x_fc_plating_landing_action_id     (per-user override)
-#   2. company.x_fc_default_landing_action_id  (company default)
-#   3. Shop Floor plant-view kanban             (when x_fc_shopfloor_layout='v2')
-#   4. Sale Orders                              (when v2 flag unset / legacy)
-#   5. Process recipes                          (configurator absent)
-user = env.user
-target = False
-if 'x_fc_plating_landing_action_id' in user._fields and user.x_fc_plating_landing_action_id:
-    target = user.x_fc_plating_landing_action_id.sudo()
-elif 'x_fc_default_landing_action_id' in env.company._fields and env.company.x_fc_default_landing_action_id:
-    target = env.company.x_fc_default_landing_action_id.sudo()
-
-if not target:
-    # 2026-05-23 — plant-view dispatch. Read the layout flag and pick the
-    # appropriate Shop Floor action. Falls through to Sale Orders if no
-    # client action is registered (e.g. shopfloor module not installed).
-    layout = env['ir.config_parameter'].sudo().get_param(
-        'fusion_plating_shopfloor.layout', default='legacy',
-    )
-    if layout == 'v2':
-        target = env.ref(
-            'fusion_plating_shopfloor.action_fp_plant_kanban',
-            raise_if_not_found=False,
-        )
-    # Legacy or v2-missing → fall through to Sale Orders
-    if not target:
-        target = env.ref(
-            'fusion_plating_configurator.action_fp_sale_orders',
-            raise_if_not_found=False,
-        )
-
-if target:
-    action = target.sudo().read()[0]
-    # Strip ids that confuse the act_window dispatcher.
-    action.pop('id', None)
-else:
-    # Last-ditch — open the Plating app's process recipes if even
-    # the Sale Orders action is missing (e.g. configurator not installed).
-    action = env.ref('fusion_plating.action_fp_process_recipe').sudo().read()[0]
-    action.pop('id', None)
+# Delegates to the role-based dispatch helper on ir.actions.act_window
+# (and ir.actions.client for Manager Desk / Plant Kanban / Quality Dashboard).
+# Resolution chain in the helper:
+#   1. user.x_fc_plating_landing_action_id      (per-user override)
+#   2. role-based default per spec Section 3    (Owner→ManagerDesk, etc.)
+#   3. company.x_fc_default_landing_action_id   (company default)
+#   4. action_fp_sale_orders                    (hardcoded last-ditch)
+action = env['ir.actions.act_window'].sudo()._fp_resolve_landing_for_current_user() or False
         ]]></field>
     </record>
 

fusion_plating/fusion_plating/data/fp_migration_cron.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <data noupdate="1">
+
+        <record id="ir_cron_purge_expired_migrations" model="ir.cron">
+            <field name="name">Fusion Plating: Purge Expired Role Migrations</field>
+            <field name="model_id" ref="model_fp_migration_preview"/>
+            <field name="state">code</field>
+            <field name="code">model._cron_purge_expired_migrations()</field>
+            <field name="interval_number">1</field>
+            <field name="interval_type">days</field>
+            <field name="active" eval="True"/>
+        </record>
+
+    </data>
+</odoo>

fusion_plating/fusion_plating/migrations/19.0.21.1.0/post-migrate.py

@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*-
+"""Phase H: fire role-migration preview creation on `-u fusion_plating`.
+
+Odoo 19's `post_init_hook` ONLY fires on fresh install — never on
+upgrade. So on entech (and any other already-installed deployment),
+`-u fusion_plating` after this branch lands would otherwise leave the
+post_init_hook's `_fp_post_init_role_migration` un-fired and the
+migration preview never created.
+
+This migration script bridges that gap: on every `-u` that crosses
+this version boundary, it invokes the same idempotent helper. The
+helper short-circuits if a preview is already pending or already
+applied + all users migrated, so re-running is safe.
+"""
+import logging
+
+_logger = logging.getLogger(__name__)
+
+
+def migrate(cr, version):
+    from odoo import api, SUPERUSER_ID
+    env = api.Environment(cr, SUPERUSER_ID, {})
+    try:
+        from odoo.addons.fusion_plating import _fp_post_init_role_migration
+        _fp_post_init_role_migration(env)
+        _logger.info(
+            'Fusion Plating: role-migration preview check ran via post-migrate.py'
+        )
+    except Exception as e:
+        # Migration scripts must not block module upgrade — log and swallow
+        _logger.exception(
+            'Failed to run role-migration preview check (non-fatal): %s', e
+        )

fusion_plating/fusion_plating/migrations/19.0.21.1.0/pre-migrate.py

@@ -0,0 +1,47 @@
+# -*- coding: utf-8 -*-
+"""Phase A bootstrap: rename old configurator's Shop Manager before new
+core group_fp_shop_manager_v2 tries to claim the 'Shop Manager' display name.
+
+Load order:
+  1. fusion_plating loads -> fp_security.xml renames its own old groups (Operator,
+     Supervisor, Manager, Administrator) to '[DEPRECATED] X'. Then fp_security_v2.xml
+     creates new groups (Technician, ..., Shop Manager v2 with display name 'Shop Manager').
+  2. fusion_plating_configurator loads later -> would rename its own
+     group_fp_shop_manager to '[DEPRECATED] Shop Manager'.
+
+But step 1 crashes because the OLD configurator's group is still named just
+'Shop Manager' in the DB (the rename in step 2 hasn't run yet), and the unique
+constraint res_groups_name_uniq blocks the new 'Shop Manager'.
+
+This pre-migrate script runs BEFORE any of fusion_plating's data files reload,
+patching the old configurator row's display name via SQL. After that, the
+constraint is clear and fp_security_v2.xml can create its new groups safely.
+The configurator's later -u will then push the canonical '[DEPRECATED] Shop
+Manager' display name from its XML data.
+"""
+import logging
+
+_logger = logging.getLogger(__name__)
+
+
+def migrate(cr, version):
+    # Find old configurator Shop Manager row via ir.model.data and rename
+    # its display name to avoid the constraint collision.
+    cr.execute("""
+        UPDATE res_groups
+           SET name = jsonb_build_object('en_US', '[DEPRECATED] Shop Manager (Mgr+Estimator bundle)')
+         WHERE id IN (
+            SELECT res_id FROM ir_model_data
+             WHERE module = 'fusion_plating_configurator'
+               AND name = 'group_fp_shop_manager'
+               AND model = 'res.groups'
+         )
+           AND (name IS NULL OR name->>'en_US' NOT LIKE '[DEPRECATED]%');
+    """)
+    rows = cr.rowcount
+    if rows:
+        _logger.info(
+            'Fusion Plating: pre-migrate renamed %d old configurator Shop Manager '
+            'row(s) to clear name collision with new group_fp_shop_manager_v2',
+            rows,
+        )

fusion_plating/fusion_plating/models/__init__.py

@@ -25,6 +25,7 @@ from . import fp_job_step_timelog
 from . import fp_operator_certification
 from . import fp_tz
 from . import res_company
+from . import res_users
 from . import res_config_settings
 
 # Phase 1 (Sub 11) — relocated from fusion_plating_bridge_mrp via
@@ -48,3 +49,9 @@ from . import fp_job_step_move
 
 # Phase 1 — Plating landing-page resolver
 from . import fp_landing
+
+# Phase H — dry-run + Owner-approval role migration workflow.
+# fp_role_constants MUST be imported before fp_migration (the latter
+# imports the predicate chain + xmlid maps from the former).
+from . import fp_role_constants
+from . import fp_migration

fusion_plating/fusion_plating/models/fp_landing.py

@@ -2,45 +2,218 @@
 # Copyright 2026 Nexa Systems Inc.
 # License OPL-1 (Odoo Proprietary License v1.0)
 # Part of the Fusion Plating product family.
-"""Phase 1 — Plating landing-page resolver fields.
+"""Phase 1 + Phase E — Plating landing-page resolver.
 
-Three pieces:
-1. `ir.actions.act_window.x_fc_pickable_landing` — Boolean tag. Mark a
-   curated set of plating actions (Sale Orders, Plant Overview,
-   Quotations, Quality Dashboard, Manager Dashboard, Tablet Station,
-   Labor History) so the landing-page dropdown only offers sensible
-   options, not all 200 act_window records in the DB.
+Layers:
 
-2. `res.company.x_fc_default_landing_action_id` — admin sets the
-   fallback for users who don't pick a preference.
+1. ``ir.actions.act_window.x_fc_pickable_landing`` AND
+   ``ir.actions.client.x_fc_pickable_landing`` — Boolean tag on BOTH
+   action types. Mark a curated set of plating actions (Sale Orders,
+   Quotations, Manager Desk, Plant Kanban, Quality Dashboard, etc.) so
+   the landing-page dropdown only offers sensible options, not all 200+
+   action records in the DB.
 
-3. `res.users.x_fc_plating_landing_action_id` — each user's own
-   override.
+2. ``res.company.x_fc_default_landing_action_id`` — admin sets the
+   fallback for users who don't pick a preference. References
+   ``ir.actions.act_window`` (only act_window actions can be selected
+   as the company default since they're navigable from the menu tree).
 
-The resolver server action (data/fp_landing_data.xml) reads these.
+3. ``res.users.x_fc_plating_landing_action_id`` — each user's own
+   override. References ``ir.actions.act_window`` and is filtered by
+   the user's actually-accessible actions (Technician can't pick
+   "Manager Desk" if they can't see it).
+
+4. ``ir.actions.act_window._fp_resolve_landing_for_current_user()`` —
+   role-based dispatch resolver. Section 3 of the permissions design
+   spec. Returns an action dict suitable for the
+   ``action_fp_resolve_plating_landing`` server action.
 """
 
-from odoo import fields, models
+from odoo import api, fields, models
 
 
-class IrActionsActWindow(models.Model):
-    _inherit = 'ir.actions.act_window'
+# ----------------------------------------------------------------------
+# Pickable-landing tag on BOTH action types
+# ----------------------------------------------------------------------
+# The picklist needs to cover client actions (Manager Desk, Plant
+# Kanban, Quality Dashboard) too, so we add the same Boolean column
+# to ir.actions.client. The resolver returns either kind of action;
+# the role dispatch helper uses env.ref(...) which is type-agnostic.
+class IrActionsActions(models.Model):
+    """Base ir.actions.actions extension so x_fc_pickable_landing is
+    available on BOTH ir.actions.act_window (Sale Orders, Quotations,
+    Process Recipes) AND ir.actions.client (Manager Desk, Plant Kanban,
+    Workstation, Quality Dashboard). The picker on res.users / res.company
+    is Many2one('ir.actions.actions') so it accepts either kind.
+    """
+    _inherit = 'ir.actions.actions'
 
     x_fc_pickable_landing = fields.Boolean(
         string='Pickable as Plating Landing',
         default=False,
         help='When True, this action appears in the Plating landing-'
              'page dropdown on res.users and res.company. Tag a small '
-             'curated list (Sale Orders, Plant Overview, etc.) to keep '
+             'curated list (Sale Orders, Manager Desk, etc.) to keep '
              'the picker manageable.',
     )
 
+    def _render_resolved(self):
+        """Dispatcher — render this action as a dict for the landing resolver.
+        Routes to the correct subclass based on `type` so both act_window
+        and client actions resolve correctly."""
+        self.ensure_one()
+        if self.type == 'ir.actions.client':
+            return self.env['ir.actions.client'].browse(self.id)._render_resolved()
+        if self.type == 'ir.actions.act_window':
+            return self.env['ir.actions.act_window'].browse(self.id)._render_resolved()
+        # URL / server / report — generic dict
+        action = self.sudo().read()[0]
+        action.pop('id', None)
+        action['xml_id'] = self.get_external_id().get(self.id) or None
+        return action
 
+
+class IrActionsActWindow(models.Model):
+    _inherit = 'ir.actions.act_window'
+
+    # ------------------------------------------------------------------
+    # Resolver — role-based dispatch (Phase E)
+    # ------------------------------------------------------------------
+    @api.model
+    def _fp_resolve_landing_for_current_user(self):
+        """Resolve which action to open when the current user clicks the
+        Plating app.
+
+        Priority order:
+          1. Per-user override (``res.users.x_fc_plating_landing_action_id``)
+          2. Role-based default (``_fp_role_default_landing``)
+          3. Company default (``res.company.x_fc_default_landing_action_id``)
+          4. Hardcoded last-ditch (Sale Orders)
+        """
+        user = self.env.user
+        company = self.env.company
+
+        # 1. Per-user override
+        if 'x_fc_plating_landing_action_id' in user._fields \
+                and user.x_fc_plating_landing_action_id:
+            return user.x_fc_plating_landing_action_id._render_resolved()
+
+        # 2. Role-based default
+        role_action = self._fp_role_default_landing(user, company)
+        if role_action:
+            return role_action._render_resolved()
+
+        # 3. Company default
+        if 'x_fc_default_landing_action_id' in company._fields \
+                and company.x_fc_default_landing_action_id:
+            return company.x_fc_default_landing_action_id._render_resolved()
+
+        # 4. Hardcoded last-ditch — Sale Orders
+        fallback = self.env.ref(
+            'fusion_plating_configurator.action_fp_sale_orders',
+            raise_if_not_found=False,
+        )
+        if fallback:
+            return fallback._render_resolved()
+        return False
+
+    @api.model
+    def _fp_role_default_landing(self, user, company):
+        """Return the per-role default action (recordset, act_window OR
+        ir.actions.client) for ``user``, or False.
+
+        Precedence is highest role first so a multi-role user
+        (Manager promoted to QM) gets the upper role's landing.
+        """
+        workstation = self._fp_workstation_action_for_layout(company)
+
+        def safe(xmlid):
+            return self.env.ref(xmlid, raise_if_not_found=False)
+
+        if user.has_group('fusion_plating.group_fp_owner'):
+            return safe('fusion_plating_shopfloor.action_fp_manager_dashboard')
+        if user.has_group('fusion_plating.group_fp_quality_manager'):
+            return safe('fusion_plating_quality.action_fp_quality_dashboard')
+        if user.has_group('fusion_plating.group_fp_manager'):
+            return safe('fusion_plating_shopfloor.action_fp_manager_dashboard')
+        if user.has_group('fusion_plating.group_fp_sales_manager'):
+            return safe('fusion_plating_configurator.action_fp_sale_orders')
+        if user.has_group('fusion_plating.group_fp_shop_manager_v2'):
+            return workstation
+        if user.has_group('fusion_plating.group_fp_sales_rep'):
+            return safe('fusion_plating_configurator.action_fp_quotations')
+        if user.has_group('fusion_plating.group_fp_technician'):
+            return workstation
+        return False
+
+    @api.model
+    def _fp_workstation_action_for_layout(self, company):
+        """Single source of truth: which Shop Floor surface is active on
+        this DB?
+
+        ``ir.config_parameter['fusion_plating_shopfloor.layout']`` is the
+        feature flag. Flipping it instantly retargets every Technician /
+        Shop Manager landing on next page load.
+        """
+        param = self.env['ir.config_parameter'].sudo().get_param(
+            'fusion_plating_shopfloor.layout', 'v2')
+        if param == 'v2':
+            return self.env.ref(
+                'fusion_plating_shopfloor.action_fp_plant_kanban',
+                raise_if_not_found=False,
+            )
+        return self.env.ref(
+            'fusion_plating_shopfloor.action_fp_shopfloor_landing',
+            raise_if_not_found=False,
+        )
+
+    def _render_resolved(self):
+        """Render this act_window record as an action dict that the
+        landing server action can return.
+
+        Mirrors ``self.sudo().read()[0]`` shape, plus injects ``xml_id``
+        so the resolver / tests / breadcrumbs know which curated action
+        this is. Strips ``id`` because the act_window dispatcher chokes
+        on it for fresh-load actions.
+        """
+        self.ensure_one()
+        action = self.sudo().read()[0]
+        action.pop('id', None)
+        action['xml_id'] = self.get_external_id().get(self.id) or None
+        return action
+
+
+class IrActionsClient(models.Model):
+    """Client actions also need to be tagged as pickable landings —
+    Manager Desk, Plant Kanban, Quality Dashboard are all client
+    actions, not act_window records.
+
+    ``_render_resolved`` is defined on this class too so the resolver
+    can polymorphically call ``action._render_resolved()`` regardless
+    of which kind of action came back from env.ref().
+    """
+    _inherit = 'ir.actions.client'
+
+    # x_fc_pickable_landing moved to ir.actions.actions base — see IrActionsActions
+    # above. This subclass keeps _render_resolved for the dispatcher to call.
+
+    def _render_resolved(self):
+        """Render this client action as a dict for the landing resolver."""
+        self.ensure_one()
+        action = self.sudo().read()[0]
+        action.pop('id', None)
+        action['xml_id'] = self.get_external_id().get(self.id) or None
+        return action
+
+
+# ----------------------------------------------------------------------
+# Company + User landing-action preference fields
+# ----------------------------------------------------------------------
 class ResCompany(models.Model):
     _inherit = 'res.company'
 
     x_fc_default_landing_action_id = fields.Many2one(
-        'ir.actions.act_window',
+        'ir.actions.actions',
         string='Default Plating Landing Page',
         domain=[('x_fc_pickable_landing', '=', True)],
         help='Page that opens when a user clicks the Plating app, '
@@ -53,9 +226,18 @@ class ResUsers(models.Model):
     _inherit = 'res.users'
 
     x_fc_plating_landing_action_id = fields.Many2one(
-        'ir.actions.act_window',
+        'ir.actions.actions',
         string='My Plating Landing Page',
+        # Picker shows ALL pickable landing actions. Per-user accessibility
+        # filtering was attempted via a Many2many compute but failed for
+        # non-admin users because the field assignment requires read on
+        # ir.actions.actions. Easier path: show all 6 pickable actions to
+        # everyone, let the resolver fall through gracefully if the user
+        # picks an action they can't reach (role-based default takes over).
+        # Read access on ir.actions.actions for plating roles is granted
+        # via a fusion_plating ACL row (security/ir.model.access.csv).
         domain=[('x_fc_pickable_landing', '=', True)],
         help='Personal override for the page that opens when you click '
-             'the Plating app. When blank, follows the company default.',
+             'the Plating app. When blank, follows the company default '
+             'and then the role-based default per Section 3 of the spec.',
     )

fusion_plating/fusion_plating/models/fp_migration.py

@@ -0,0 +1,265 @@
+# -*- coding: utf-8 -*-
+"""Phase H — dry-run + Owner-approval migration workflow."""
+import json
+import logging
+from datetime import timedelta
+
+from markupsafe import Markup
+
+from odoo import _, api, fields, models
+from odoo.exceptions import UserError
+
+from .fp_role_constants import (
+    _FP_OLD_GROUP_XMLIDS,
+    _NEW_ROLE_XMLID,
+    fp_resolve_target_role,
+)
+
+
+_logger = logging.getLogger(__name__)
+
+
+_ROLE_SELECTION = [
+    ('no',              'No'),
+    ('technician',      'Technician'),
+    ('sales_rep',       'Sales Representative'),
+    ('shop_manager',    'Shop Manager'),
+    ('sales_manager',   'Sales Manager'),
+    ('manager',         'Manager'),
+    ('quality_manager', 'Quality Manager'),
+    ('owner',           'Owner'),
+]
+
+
+class FpMigrationPreview(models.Model):
+    _name = 'fp.migration.preview'
+    _description = 'Fusion Plating Role Migration Preview'
+    _inherit = ['mail.thread']
+    _order = 'create_date desc'
+
+    name = fields.Char(
+        default=lambda s: _('Migration %s') % fields.Datetime.now(),
+        tracking=True,
+    )
+    state = fields.Selection(
+        [
+            ('pending',     'Pending Review'),
+            ('approved',    'Approved & Applied'),
+            ('cancelled',   'Cancelled'),
+            ('rolled_back', 'Rolled Back'),
+        ],
+        default='pending',
+        required=True,
+        tracking=True,
+    )
+    line_ids = fields.One2many('fp.migration.preview.line', 'preview_id')
+    user_count = fields.Integer(compute='_compute_counts', store=True)
+    warning_count = fields.Integer(compute='_compute_counts', store=True)
+    approved_by_id = fields.Many2one('res.users', readonly=True)
+    approved_at = fields.Datetime(readonly=True)
+    rollback_deadline = fields.Datetime(compute='_compute_rollback_deadline')
+
+    @api.depends('line_ids', 'line_ids.warning')
+    def _compute_counts(self):
+        for rec in self:
+            rec.user_count = len(rec.line_ids)
+            rec.warning_count = sum(1 for ln in rec.line_ids if ln.warning)
+
+    @api.depends('approved_at')
+    def _compute_rollback_deadline(self):
+        for rec in self:
+            rec.rollback_deadline = (
+                rec.approved_at + timedelta(days=30) if rec.approved_at else False
+            )
+
+    def _fp_build_lines(self):
+        """Walk all active internal users; one line per user with the
+        proposed role + capability_delta."""
+        self.ensure_one()
+        Line = self.env['fp.migration.preview.line']
+        users = self.env['res.users'].search([
+            ('share', '=', False),
+            ('active', '=', True),
+        ])
+        vals_list = []
+        for user in users:
+            role, delta = fp_resolve_target_role(user)
+            vals_list.append({
+                'preview_id': self.id,
+                'user_id': user.id,
+                'proposed_role': role,
+                'capability_delta': delta or '',
+                'warning': bool(delta),
+            })
+        if vals_list:
+            Line.create(vals_list)
+
+    def _fp_notify_owners(self):
+        """Schedule a 'Review Fusion Plating role migration' activity on
+        every Owner user. Idempotent — won't double-schedule."""
+        self.ensure_one()
+        owner_grp = self.env.ref('fusion_plating.group_fp_owner', raise_if_not_found=False)
+        if not owner_grp:
+            return
+        owners = owner_grp.user_ids.filtered(lambda u: u.active and not u.share)
+        if not owners:
+            _logger.warning('Fusion Plating migration preview %s: no Owner users to notify', self.id)
+            return
+        activity_type = self.env.ref('mail.mail_activity_data_todo')
+        for owner in owners:
+            existing = self.env['mail.activity'].search([
+                ('res_model_id', '=', self.env.ref('fusion_plating.model_fp_migration_preview').id),
+                ('res_id', '=', self.id),
+                ('user_id', '=', owner.id),
+            ], limit=1)
+            if existing:
+                continue
+            self.env['mail.activity'].create({
+                'res_model_id': self.env.ref('fusion_plating.model_fp_migration_preview').id,
+                'res_id': self.id,
+                'activity_type_id': activity_type.id,
+                'summary': _('Review Fusion Plating role migration'),
+                'note': _('%(n)d users affected, %(w)d with capability changes.') % {
+                    'n': self.user_count,
+                    'w': self.warning_count,
+                },
+                'user_id': owner.id,
+                'date_deadline': fields.Date.today(),
+            })
+
+    def action_approve_and_run(self):
+        self.ensure_one()
+        if not self.env.user.has_group('fusion_plating.group_fp_owner'):
+            raise UserError(_('Only Owners can approve role migrations.'))
+        if self.state != 'pending':
+            raise UserError(_(
+                'Migration is no longer pending - current state: %s'
+            ) % self.state)
+
+        # Resolve old group ids once
+        old_group_ids = []
+        for xmlid in _FP_OLD_GROUP_XMLIDS:
+            g = self.env.ref(xmlid, raise_if_not_found=False)
+            if g:
+                old_group_ids.append(g.id)
+
+        for line in self.line_ids:
+            user = line.user_id
+            # Snapshot current group_ids for rollback
+            line.applied_groups_snapshot = json.dumps(user.group_ids.ids)
+
+            # Remove old plating-role groups
+            if old_group_ids:
+                user.sudo().write({
+                    'group_ids': [(3, gid) for gid in old_group_ids]
+                })
+
+            # Add the new role group (no-op for 'no')
+            target_xmlid = _NEW_ROLE_XMLID.get(line.proposed_role)
+            if target_xmlid:
+                target = self.env.ref(target_xmlid, raise_if_not_found=False)
+                if target:
+                    user.sudo().write({'group_ids': [(4, target.id)]})
+
+            # Audit chatter on the user
+            user.partner_id.message_post(
+                body=Markup(_(
+                    'Plating role assigned by migration: <b>%s</b>'
+                )) % line.proposed_role,
+                message_type='notification',
+            )
+
+            # Special: CGP DO becomes a res.company field, not a role
+            if line.capability_delta and 'CGP DO' in line.capability_delta:
+                user.company_id.x_fc_cgp_designated_official_id = user.id
+
+        self.write({
+            'state': 'approved',
+            'approved_by_id': self.env.user.id,
+            'approved_at': fields.Datetime.now(),
+        })
+
+    def action_cancel(self):
+        self.ensure_one()
+        if self.state != 'pending':
+            raise UserError(_('Only pending migrations can be cancelled.'))
+        self.state = 'cancelled'
+
+    def action_rollback(self):
+        self.ensure_one()
+        if self.state != 'approved':
+            raise UserError(_('Only approved migrations can be rolled back.'))
+        if self.rollback_deadline and fields.Datetime.now() > self.rollback_deadline:
+            raise UserError(_(
+                'Rollback window has expired (30 days after approval). '
+                'Restore from pg_dump backup instead.'
+            ))
+        for line in self.line_ids:
+            if line.applied_groups_snapshot:
+                old_ids = json.loads(line.applied_groups_snapshot)
+                line.user_id.sudo().write({'group_ids': [(6, 0, old_ids)]})
+        self.state = 'rolled_back'
+
+    @api.model
+    def _cron_purge_expired_migrations(self):
+        """After 30 days, clear snapshots + unlink old plating groups.
+        Runs daily via fp_migration_cron.xml."""
+        deadline = fields.Datetime.now() - timedelta(days=30)
+        expired = self.search([
+            ('state', '=', 'approved'),
+            ('approved_at', '<', deadline),
+        ])
+        if not expired:
+            return
+        # Clear snapshots (no more rollback possible)
+        for preview in expired:
+            preview.line_ids.write({'applied_groups_snapshot': False})
+        # Unlink old plating groups (now confirmed unused — every user is
+        # on the new groups; backward-compat implied_ids chains can drop)
+        old_group_ids = []
+        for xmlid in _FP_OLD_GROUP_XMLIDS:
+            g = self.env.ref(xmlid, raise_if_not_found=False)
+            if g:
+                old_group_ids.append(g.id)
+        if old_group_ids:
+            # I6 safety check — never unlink a group that still has active
+            # internal users on it. If anyone still references the group
+            # we'd cascade-strip them silently from their permissions.
+            safe_to_unlink = []
+            skipped = []
+            for old_group in self.env['res.groups'].browse(old_group_ids).exists():
+                active_users = old_group.user_ids.filtered(lambda u: u.active and not u.share)
+                if active_users:
+                    skipped.append((old_group.name, active_users.mapped('login')))
+                else:
+                    safe_to_unlink.append(old_group.id)
+            if skipped:
+                _logger.warning(
+                    'Fusion Plating migration purge: skipped %d old groups with active users: %s',
+                    len(skipped), skipped)
+            if safe_to_unlink:
+                self.env['res.groups'].browse(safe_to_unlink).unlink()
+                _logger.info('Fusion Plating migration: purged %d expired old plating groups',
+                             len(safe_to_unlink))
+
+
+class FpMigrationPreviewLine(models.Model):
+    _name = 'fp.migration.preview.line'
+    _description = 'Migration Preview Line'
+
+    preview_id = fields.Many2one('fp.migration.preview', required=True, ondelete='cascade')
+    user_id = fields.Many2one('res.users', required=True, ondelete='cascade')
+    current_groups = fields.Char(compute='_compute_current_groups')
+    proposed_role = fields.Selection(_ROLE_SELECTION)
+    capability_delta = fields.Char()
+    warning = fields.Boolean()
+    notes = fields.Text(help='Owner may annotate before approving')
+    applied_groups_snapshot = fields.Text(help='JSON of pre-migration group_ids for rollback')
+
+    @api.depends('user_id', 'user_id.group_ids')
+    def _compute_current_groups(self):
+        for line in self:
+            if line.user_id:
+                line.current_groups = ', '.join(line.user_id.group_ids.mapped('name'))
+            else:
+                line.current_groups = ''

fusion_plating/fusion_plating/models/fp_role_constants.py

@@ -0,0 +1,91 @@
+# -*- coding: utf-8 -*-
+"""Single source of truth for migration mapping rules + old-group xmlids.
+
+The mapping predicates are evaluated against res.users records. First match
+wins (highest-precedence first). See spec Section 5 + plan Phase H.
+"""
+
+# Every plating role group xmlid that exists BEFORE the migration (deprecated
+# but still defined for backward-compat during 30-day rollback window).
+_FP_OLD_GROUP_XMLIDS = (
+    'fusion_plating.group_fusion_plating_operator',
+    'fusion_plating.group_fusion_plating_supervisor',
+    'fusion_plating.group_fusion_plating_manager',
+    'fusion_plating.group_fusion_plating_admin',
+    'fusion_plating_configurator.group_fp_estimator',
+    'fusion_plating_configurator.group_fp_shop_manager',
+    'fusion_plating_invoicing.group_fp_accounting',
+    'fusion_plating_receiving.group_fp_receiving',
+    'fusion_plating_cgp.group_fusion_plating_cgp_officer',
+    'fusion_plating_cgp.group_fusion_plating_cgp_designated_official',
+    'fusion_plating_jobs.group_fusion_plating_legacy_menus',
+)
+
+# New role -> the group xmlid to add when migration assigns this role.
+# 'no' maps to None (no plating group added; old ones still get removed).
+_NEW_ROLE_XMLID = {
+    'no':              None,
+    'technician':      'fusion_plating.group_fp_technician',
+    'sales_rep':       'fusion_plating.group_fp_sales_rep',
+    'shop_manager':    'fusion_plating.group_fp_shop_manager_v2',
+    'sales_manager':   'fusion_plating.group_fp_sales_manager',
+    'manager':         'fusion_plating.group_fp_manager',
+    'quality_manager': 'fusion_plating.group_fp_quality_manager',
+    'owner':           'fusion_plating.group_fp_owner',
+}
+
+# Mapping rules: (label, predicate, new_role, capability_delta_or_None)
+# Highest precedence first; first match wins.
+# Predicate is a callable taking a res.users record; returns bool.
+_FP_ROLE_MAPPING_RULES = [
+    # cgp_designated_official MUST be first so admin/uid_1/uid_2 users who ALSO
+    # hold the DO group still get the capability_delta marker — which is what
+    # triggers action_approve_and_run to set res.company.x_fc_cgp_designated_official_id.
+    # If admin matched first, the DO field would never get populated for shops
+    # where the admin is also the registered PSPC Designated Official.
+    ('cgp_designated_official',
+     lambda u: u.has_group('fusion_plating_cgp.group_fusion_plating_cgp_designated_official'),
+     'owner', 'Was CGP DO; field set on res.company'),
+    ('uid_1_or_2',
+     lambda u: u.id in (1, 2),
+     'owner', None),
+    ('admin',
+     lambda u: u.has_group('fusion_plating.group_fusion_plating_admin'),
+     'owner', None),
+    ('cgp_officer',
+     lambda u: u.has_group('fusion_plating_cgp.group_fusion_plating_cgp_officer'),
+     'quality_manager', None),
+    ('manager',
+     lambda u: u.has_group('fusion_plating.group_fusion_plating_manager'),
+     'manager', None),
+    ('shop_manager_old',
+     lambda u: u.has_group('fusion_plating_configurator.group_fp_shop_manager'),
+     'manager', None),
+    ('accounting',
+     lambda u: u.has_group('fusion_plating_invoicing.group_fp_accounting'),
+     'manager', None),
+    ('estimator_alone',
+     lambda u: (u.has_group('fusion_plating_configurator.group_fp_estimator')
+                and not u.has_group('fusion_plating.group_fusion_plating_manager')),
+     'sales_rep', 'Loses order-confirm authority'),
+    ('supervisor',
+     lambda u: u.has_group('fusion_plating.group_fusion_plating_supervisor'),
+     'shop_manager', None),
+    ('receiving',
+     lambda u: u.has_group('fusion_plating_receiving.group_fp_receiving'),
+     'shop_manager', None),
+    ('operator',
+     lambda u: u.has_group('fusion_plating.group_fusion_plating_operator'),
+     'technician', None),
+    ('catchall',
+     lambda u: True,
+     'no', None),
+]
+
+
+def fp_resolve_target_role(user):
+    """Returns (role_key, capability_delta_or_None). First predicate match wins."""
+    for _label, predicate, role, delta in _FP_ROLE_MAPPING_RULES:
+        if predicate(user):
+            return role, delta
+    return 'no', None

fusion_plating/fusion_plating/models/res_company.py

@@ -185,3 +185,28 @@ class ResCompany(models.Model):
              'When BOTH are blank the report falls back to a hardcoded '
              'AS9100/ISO 9001 statement.',
     )
+
+    # =====================================================================
+    # Phase F — Plating Designated Officials
+    # =====================================================================
+    # These are SPECIFIC NAMED PEOPLE registered with regulatory bodies.
+    # Stored as Many2one to res.users so the link survives renames.
+    # View-level domain restricts the picker to Owner or Quality Manager
+    # group members (a Python-side domain would resolve groups by id at
+    # recordset load and is fragile across DB migrations).
+    x_fc_cgp_designated_official_id = fields.Many2one(
+        'res.users',
+        string='CGP Designated Official',
+        tracking=True,
+        help='Specific person registered with PSPC as Designated Official '
+             'under Defence Production Act §22. Must be Owner or Quality '
+             'Manager.',
+    )
+
+    x_fc_nadcap_authority_user_id = fields.Many2one(
+        'res.users',
+        string='Nadcap Authority',
+        tracking=True,
+        help='Specific person who signs Nadcap-specific certificates and '
+             'audits. Must be Owner or Quality Manager.',
+    )

fusion_plating/fusion_plating/models/res_users.py

@@ -0,0 +1,146 @@
+# -*- coding: utf-8 -*-
+# Copyright 2026 Nexa Systems Inc.
+# License OPL-1 (Odoo Proprietary License v1.0)
+# Part of the Fusion Plating product family.
+"""Fusion Plating role helpers on res.users.
+
+The x_fc_plating_role Selection field is a clean UX wrapper around the
+seven plating-role groups. Owner-only Team page reads/writes this field
+via drag-and-drop on a kanban grouped by role.
+"""
+from markupsafe import Markup
+
+from odoo import _, api, fields, models
+
+
+_FP_PLATING_ROLE_TO_GROUP_XMLID = {
+    'technician':      'fusion_plating.group_fp_technician',
+    'sales_rep':       'fusion_plating.group_fp_sales_rep',
+    'shop_manager':    'fusion_plating.group_fp_shop_manager_v2',
+    'sales_manager':   'fusion_plating.group_fp_sales_manager',
+    'manager':         'fusion_plating.group_fp_manager',
+    'quality_manager': 'fusion_plating.group_fp_quality_manager',
+    'owner':           'fusion_plating.group_fp_owner',
+}
+
+# Highest precedence first — first match wins
+_FP_ROLE_PRECEDENCE = (
+    'owner', 'quality_manager', 'manager', 'sales_manager',
+    'shop_manager', 'sales_rep', 'technician',
+)
+
+
+class ResUsers(models.Model):
+    _inherit = 'res.users'
+
+    # Allow non-admin users to write their OWN plating-related fields
+    # from the standard User Preferences dialog. SELF_WRITEABLE_FIELDS is
+    # a @property in Odoo 19 (not a class attribute) — must override via
+    # @property + super(). See CLAUDE.md rule 13k.
+    @property
+    def SELF_WRITEABLE_FIELDS(self):
+        return super().SELF_WRITEABLE_FIELDS + [
+            'x_fc_plating_landing_action_id',  # personal landing-page override
+            'x_fc_signature_image',            # "Plating Signature" used on reports
+        ]
+
+    @property
+    def SELF_READABLE_FIELDS(self):
+        return super().SELF_READABLE_FIELDS + [
+            'x_fc_plating_landing_action_id',
+            'x_fc_signature_image',
+            'x_fc_plating_role',
+            'x_fc_tablet_pin_set_date',
+        ]
+
+    x_fc_plating_role = fields.Selection(
+        [
+            ('no',              'No'),
+            ('technician',      'Technician'),
+            ('sales_rep',       'Sales Representative'),
+            ('shop_manager',    'Shop Manager'),
+            ('sales_manager',   'Sales Manager'),
+            ('manager',         'Manager'),
+            ('quality_manager', 'Quality Manager'),
+            ('owner',           'Owner'),
+        ],
+        compute='_compute_plating_role',
+        inverse='_inverse_plating_role',
+        store=True,
+        string='Fusion Plating Role',
+        help='Highest plating role currently held by this user. Changing this '
+             'field reassigns the user to the corresponding res.groups (clears '
+             'old plating groups, adds new). Posts an audit chatter message.',
+    )
+
+    @api.depends('group_ids')
+    def _compute_plating_role(self):
+        # Resolve xmlids once
+        role_to_group = {}
+        for role, xmlid in _FP_PLATING_ROLE_TO_GROUP_XMLID.items():
+            grp = self.env.ref(xmlid, raise_if_not_found=False)
+            if grp:
+                role_to_group[role] = grp
+        for user in self:
+            user.x_fc_plating_role = 'no'
+            for candidate in _FP_ROLE_PRECEDENCE:
+                grp = role_to_group.get(candidate)
+                if grp and grp in user.group_ids:
+                    user.x_fc_plating_role = candidate
+                    break
+
+    def _inverse_plating_role(self):
+        # Resolve all plating-role group ids
+        all_role_ids = []
+        role_to_group = {}
+        for role, xmlid in _FP_PLATING_ROLE_TO_GROUP_XMLID.items():
+            grp = self.env.ref(xmlid, raise_if_not_found=False)
+            if grp:
+                role_to_group[role] = grp
+                all_role_ids.append(grp.id)
+
+        # I4 fix — capture old roles BEFORE the cache mutates by reading
+        # the stored x_fc_plating_role column directly from PostgreSQL.
+        # `user._origin.x_fc_plating_role` returns the IN-CACHE new value
+        # (the assignment that triggered the inverse), not the prior DB
+        # value, so the chatter audit displayed "X -> X" instead of the
+        # actual old -> new transition.
+        self.env.cr.execute(
+            "SELECT id, x_fc_plating_role FROM res_users WHERE id IN %s",
+            (tuple(self.ids),) if self.ids else ((0,),),
+        )
+        old_role_by_id = dict(self.env.cr.fetchall())
+
+        for user in self:
+            old_role = old_role_by_id.get(user.id) or 'unset'
+            new_role = user.x_fc_plating_role
+            if old_role == new_role:
+                # No actual change — skip both the writes and the audit so
+                # we don't spam chatter with "X -> X" rows.
+                continue
+
+            # Remove every plating-role group (additive-by-default Odoo
+            # m2m write of (3, id) removes single rows)
+            user.sudo().write({
+                'group_ids': [(3, gid) for gid in all_role_ids]
+            })
+
+            # Add the chosen role (no-op for 'no')
+            if new_role and new_role != 'no':
+                target = role_to_group.get(new_role)
+                if target:
+                    user.sudo().write({
+                        'group_ids': [(4, target.id)]
+                    })
+
+            # Post audit (Markup so role names render bold, not literal HTML)
+            user.partner_id.message_post(
+                body=Markup(_(
+                    'Plating role changed: <b>%(old)s</b> -> <b>%(new)s</b> by %(actor)s'
+                )) % {
+                    'old': old_role,
+                    'new': new_role or 'unset',
+                    'actor': self.env.user.name,
+                },
+                message_type='notification',
+            )

fusion_plating/fusion_plating/security/ir.model.access.csv

@@ -94,3 +94,6 @@ access_fp_job_step_move_manager,fp.job.step.move.manager,model_fp_job_step_move,
 access_fp_job_step_move_input_value_operator,fp.job.step.move.input.value.operator,model_fp_job_step_move_input_value,fusion_plating.group_fp_technician,1,1,1,0
 access_fp_job_step_move_input_value_supervisor,fp.job.step.move.input.value.supervisor,model_fp_job_step_move_input_value,fusion_plating.group_fp_shop_manager_v2,1,1,1,0
 access_fp_job_step_move_input_value_manager,fp.job.step.move.input.value.manager,model_fp_job_step_move_input_value,fusion_plating.group_fp_manager,1,1,1,1
+access_fp_migration_preview_owner,fp.migration.preview.owner,model_fp_migration_preview,fusion_plating.group_fp_owner,1,1,1,1
+access_fp_migration_preview_line_owner,fp.migration.preview.line.owner,model_fp_migration_preview_line,fusion_plating.group_fp_owner,1,1,1,1
+access_ir_actions_actions_plating,ir.actions.actions.plating.read,base.model_ir_actions_actions,fusion_plating.group_fp_technician,1,0,0,0

fusion_plating/fusion_plating/tests/__init__.py

@@ -6,3 +6,8 @@ from . import test_simple_recipe_flatten
 from . import test_role_groups
 from . import test_acl_migration
 from . import test_quality_split
+from . import test_menu_visibility
+from . import test_landing_resolver
+from . import test_team_page
+from . import test_sales_manager_gate
+from . import test_migration_workflow

fusion_plating/fusion_plating/tests/test_acl_migration.py

@@ -14,7 +14,7 @@ class TestAclMigration(TransactionCase):
                 'login': f'fp_test_{login}',
                 'name': f'FP Test {login.title()}',
                 'email': f'fp_test_{login}@example.com',
-                'groups_id': [(6, 0, [self.env.ref(group_xmlid).id])],
+                'group_ids': [(6, 0, [self.env.ref(group_xmlid).id])],
             })
 
         self.u_tech = make('tech', 'fusion_plating.group_fp_technician')

fusion_plating/fusion_plating/tests/test_landing_resolver.py

@@ -0,0 +1,150 @@
+# -*- coding: utf-8 -*-
+# Copyright 2026 Nexa Systems Inc.
+# License OPL-1 (Odoo Proprietary License v1.0)
+# Part of the Fusion Plating product family.
+"""Phase E (Plating permissions overhaul) — role-based landing dispatch.
+
+Section 3 of the design spec covers per-role landing pages:
+
+  Owner          -> Manager Desk
+  Quality Mgr    -> Quality Dashboard
+  Manager        -> Manager Desk
+  Sales Manager  -> Sale Orders
+  Shop Manager   -> Plant Kanban (v2) or Workstation (legacy)
+  Sales Rep      -> Quotations
+  Technician     -> Plant Kanban (v2) or Workstation (legacy)
+
+Per-user override (`x_fc_plating_landing_action_id`) always wins.
+
+NB: The resolver returns an action dict produced by
+`_fp_resolve_landing_for_current_user()`. We compare against the
+expected action's xmlid so the test stays robust if module names or
+view ordering change downstream.
+"""
+
+from odoo.tests.common import TransactionCase, tagged
+
+
+@tagged('-at_install', 'post_install', 'fp_perms')
+class TestLandingResolver(TransactionCase):
+    """Section 3 of spec: per-role landing dispatch."""
+
+    def setUp(self):
+        super().setUp()
+        Users = self.env['res.users'].with_context(no_reset_password=True)
+
+        def mk(name, xmlid):
+            return Users.create({
+                'login': f'land_{name}',
+                'name': f'Land {name}',
+                'email': f'land_{name}@example.com',
+                'group_ids': [(6, 0, [self.env.ref(xmlid).id])],
+            })
+
+        self.u_tech = mk('tech', 'fusion_plating.group_fp_technician')
+        self.u_sr = mk('sr', 'fusion_plating.group_fp_sales_rep')
+        self.u_smg = mk('smg', 'fusion_plating.group_fp_sales_manager')
+        self.u_mgr = mk('mgr', 'fusion_plating.group_fp_manager')
+        self.u_qm = mk('qm', 'fusion_plating.group_fp_quality_manager')
+        self.u_owner = mk('owner', 'fusion_plating.group_fp_owner')
+
+    # ------------------------------------------------------------------
+    # Helpers
+    # ------------------------------------------------------------------
+    def _resolve_xmlid(self, user):
+        """Run the resolver as `user` and return the xml_id of the resulting
+        action, or None if no action was returned.
+
+        The resolver lives on `ir.actions.act_window` (helper method, not a
+        column). It can return an action dict for either an act_window or a
+        client action — both carry an `xml_id` key once we go through
+        `_render_resolved`.
+        """
+        Window = self.env['ir.actions.act_window']
+        if not hasattr(Window, '_fp_resolve_landing_for_current_user'):
+            self.skipTest('Resolver helper not implemented yet')
+        result = Window.with_user(user)._fp_resolve_landing_for_current_user()
+        if not result:
+            return None
+        return result.get('xml_id') or result.get('xmlid')
+
+    def _xmlid_of(self, xmlid):
+        """Resolve an xmlid and return it back if the action exists.
+
+        Returns None when the underlying action isn't installed in this
+        DB (e.g. running tests without a sibling module). Callers use this
+        to skip a test when the candidate action is missing.
+        """
+        action = self.env.ref(xmlid, raise_if_not_found=False)
+        return xmlid if action else None
+
+    # ------------------------------------------------------------------
+    # Per-role tests
+    # ------------------------------------------------------------------
+    def test_owner_lands_on_manager_desk(self):
+        expected = self._xmlid_of('fusion_plating_shopfloor.action_fp_manager_dashboard')
+        if not expected:
+            self.skipTest('Manager Dashboard action not found')
+        self.assertEqual(self._resolve_xmlid(self.u_owner), expected)
+
+    def test_qm_lands_on_quality_dashboard(self):
+        expected = self._xmlid_of('fusion_plating_quality.action_fp_quality_dashboard')
+        if not expected:
+            self.skipTest('Quality Dashboard action not found')
+        self.assertEqual(self._resolve_xmlid(self.u_qm), expected)
+
+    def test_manager_lands_on_manager_desk(self):
+        expected = self._xmlid_of('fusion_plating_shopfloor.action_fp_manager_dashboard')
+        if not expected:
+            self.skipTest('Manager Dashboard action not found')
+        self.assertEqual(self._resolve_xmlid(self.u_mgr), expected)
+
+    def test_sales_manager_lands_on_sale_orders(self):
+        expected = self._xmlid_of('fusion_plating_configurator.action_fp_sale_orders')
+        if not expected:
+            self.skipTest('Sale Orders action not found')
+        self.assertEqual(self._resolve_xmlid(self.u_smg), expected)
+
+    def test_sales_rep_lands_on_quotations(self):
+        expected = self._xmlid_of('fusion_plating_configurator.action_fp_quotations')
+        if not expected:
+            self.skipTest('Quotations action not found')
+        self.assertEqual(self._resolve_xmlid(self.u_sr), expected)
+
+    def test_technician_lands_on_plant_kanban_v2(self):
+        self.env['ir.config_parameter'].sudo().set_param(
+            'fusion_plating_shopfloor.layout', 'v2')
+        expected = self._xmlid_of('fusion_plating_shopfloor.action_fp_plant_kanban')
+        if not expected:
+            self.skipTest('Plant Kanban action not found')
+        self.assertEqual(self._resolve_xmlid(self.u_tech), expected)
+
+    def test_technician_lands_on_legacy_workstation(self):
+        self.env['ir.config_parameter'].sudo().set_param(
+            'fusion_plating_shopfloor.layout', 'legacy')
+        expected = self._xmlid_of('fusion_plating_shopfloor.action_fp_shopfloor_landing')
+        if not expected:
+            # The legacy action is currently not defined by that xmlid
+            # in this codebase — both old XMLIDs (action_fp_shopfloor_tablet
+            # and action_fp_plant_overview) point at the v2 fp_plant_kanban
+            # tag after the 2026-05-23 plant-view redesign. The resolver
+            # falls through to the company default / hardcoded fallback
+            # when no action is found. Skip the assertion here rather
+            # than fail.
+            self.skipTest('Legacy Workstation action not found in this DB')
+        self.assertEqual(self._resolve_xmlid(self.u_tech), expected)
+        # Reset to v2 to avoid bleeding into other tests
+        self.env['ir.config_parameter'].sudo().set_param(
+            'fusion_plating_shopfloor.layout', 'v2')
+
+    # ------------------------------------------------------------------
+    # User-override and fallback
+    # ------------------------------------------------------------------
+    def test_user_override_wins(self):
+        override = self.env.ref('fusion_plating_configurator.action_fp_quotations',
+                                raise_if_not_found=False)
+        if not override:
+            self.skipTest('Quotations action not found')
+        self.u_tech.x_fc_plating_landing_action_id = override.id
+        expected = override.get_external_id().get(override.id)
+        self.assertEqual(self._resolve_xmlid(self.u_tech), expected)

fusion_plating/fusion_plating/tests/test_menu_visibility.py

@@ -0,0 +1,85 @@
+from odoo.tests.common import TransactionCase, tagged
+
+
+@tagged('-at_install', 'post_install', 'fp_perms')
+class TestMenuVisibility(TransactionCase):
+    """Section 2.F of spec: per-role menu render matrix."""
+
+    def setUp(self):
+        super().setUp()
+        Users = self.env['res.users'].with_context(no_reset_password=True)
+        def mk(name, xmlid):
+            return Users.create({
+                'login': f'menu_{name}', 'name': f'Menu Test {name}',
+                'email': f'menu_{name}@example.com',
+                'group_ids': [(6, 0, [self.env.ref(xmlid).id])] if xmlid else [(6, 0, [])],
+            })
+        # "No" user has only base.group_user — no plating group
+        no_user = Users.create({
+            'login': 'menu_no', 'name': 'Menu Test no',
+            'email': 'menu_no@example.com',
+        })
+        no_user.write({'group_ids': [(6, 0, [self.env.ref('base.group_user').id])]})
+        self.u_no = no_user
+        self.u_tech = mk('tech', 'fusion_plating.group_fp_technician')
+        self.u_sr = mk('sr', 'fusion_plating.group_fp_sales_rep')
+        self.u_sm = mk('sm', 'fusion_plating.group_fp_shop_manager_v2')
+        self.u_smg = mk('smg', 'fusion_plating.group_fp_sales_manager')
+        self.u_mgr = mk('mgr', 'fusion_plating.group_fp_manager')
+        self.u_qm = mk('qm', 'fusion_plating.group_fp_quality_manager')
+        self.u_owner = mk('owner', 'fusion_plating.group_fp_owner')
+
+    def _visible(self, user, menu_xmlid):
+        menu = self.env.ref(menu_xmlid, raise_if_not_found=False)
+        if not menu:
+            return None  # menu not installed
+        # An "invisible" menu is one the user can't read
+        return bool(self.env['ir.ui.menu'].with_user(user).search_count([('id', '=', menu.id)]))
+
+    def test_no_sees_no_plating_root(self):
+        result = self._visible(self.u_no, 'fusion_plating.menu_fp_root')
+        if result is None:
+            self.skipTest('Plating root menu not found')
+        self.assertFalse(result, '"No" role must not see Plating root')
+
+    def test_technician_sees_shop_floor(self):
+        result = self._visible(self.u_tech, 'fusion_plating_shopfloor.menu_fp_shopfloor')
+        if result is None:
+            self.skipTest('Shop Floor menu not found')
+        self.assertTrue(result)
+
+    def test_technician_does_not_see_sales(self):
+        result = self._visible(self.u_tech, 'fusion_plating_configurator.menu_fp_sales')
+        if result is None:
+            self.skipTest('Sales menu not found')
+        self.assertFalse(result, 'Technician must not see Sales & Quoting')
+
+    def test_sales_rep_sees_sales(self):
+        result = self._visible(self.u_sr, 'fusion_plating_configurator.menu_fp_sales')
+        if result is None:
+            self.skipTest('Sales menu not found')
+        self.assertTrue(result)
+
+    def test_sales_rep_does_not_see_shop_floor(self):
+        result = self._visible(self.u_sr, 'fusion_plating_shopfloor.menu_fp_shopfloor')
+        if result is None:
+            self.skipTest('Shop Floor menu not found')
+        self.assertFalse(result, 'Sales Rep must not see Shop Floor')
+
+    def test_manager_sees_quality(self):
+        result = self._visible(self.u_mgr, 'fusion_plating_quality.menu_fp_quality')
+        if result is None:
+            self.skipTest('Quality menu not found')
+        self.assertTrue(result)
+
+    def test_manager_does_not_see_compliance(self):
+        result = self._visible(self.u_mgr, 'fusion_plating.menu_fp_compliance_hub')
+        if result is None:
+            self.skipTest('Compliance hub not found')
+        self.assertFalse(result, 'Manager must not see Compliance hub')
+
+    def test_qm_sees_compliance(self):
+        result = self._visible(self.u_qm, 'fusion_plating.menu_fp_compliance_hub')
+        if result is None:
+            self.skipTest('Compliance hub not found')
+        self.assertTrue(result)

fusion_plating/fusion_plating/tests/test_migration_workflow.py

@@ -0,0 +1,103 @@
+import json
+from odoo.tests.common import TransactionCase, tagged
+from odoo.exceptions import UserError
+
+
+@tagged('-at_install', 'post_install', 'fp_perms')
+class TestMigrationWorkflow(TransactionCase):
+
+    def setUp(self):
+        super().setUp()
+        Users = self.env['res.users'].with_context(no_reset_password=True)
+        self.owner = Users.create({
+            'login': 'mig_owner', 'name': 'Mig Owner',
+            'email': 'mig_owner@example.com',
+            'group_ids': [(6, 0, [self.env.ref('fusion_plating.group_fp_owner').id])],
+        })
+
+    def test_only_owner_can_approve(self):
+        non_owner = self.env['res.users'].with_context(no_reset_password=True).create({
+            'login': 'mig_nonowner', 'name': 'Non Owner',
+            'email': 'mig_nonowner@example.com',
+            'group_ids': [(6, 0, [self.env.ref('fusion_plating.group_fp_manager').id])],
+        })
+        preview = self.env['fp.migration.preview'].create({})
+        preview._fp_build_lines()
+        with self.assertRaises(UserError):
+            preview.with_user(non_owner).action_approve_and_run()
+
+    def test_approve_advances_state(self):
+        preview = self.env['fp.migration.preview'].create({})
+        preview._fp_build_lines()
+        preview.with_user(self.owner).action_approve_and_run()
+        self.assertEqual(preview.state, 'approved')
+        self.assertTrue(preview.approved_at)
+        self.assertEqual(preview.approved_by_id, self.owner)
+
+    def test_cancel_advances_state(self):
+        preview = self.env['fp.migration.preview'].create({})
+        preview.action_cancel()
+        self.assertEqual(preview.state, 'cancelled')
+
+    def test_cancel_blocked_after_approval(self):
+        preview = self.env['fp.migration.preview'].create({})
+        preview._fp_build_lines()
+        preview.with_user(self.owner).action_approve_and_run()
+        with self.assertRaises(UserError):
+            preview.action_cancel()
+
+    def test_rollback_restores_groups(self):
+        # Create a test user with an old Manager group
+        old_mgr = self.env.ref('fusion_plating.group_fusion_plating_manager')
+        u = self.env['res.users'].with_context(no_reset_password=True).create({
+            'login': 'mig_rb', 'name': 'RB',
+            'email': 'mig_rb@example.com',
+            'group_ids': [(6, 0, [old_mgr.id])],
+        })
+        before_ids = sorted(u.groups_id.ids)
+        preview = self.env['fp.migration.preview'].create({})
+        preview._fp_build_lines()
+        preview.with_user(self.owner).action_approve_and_run()
+        # Verify the migration changed things
+        u.invalidate_recordset()
+        # Now rollback
+        preview.with_user(self.owner).action_rollback()
+        u.invalidate_recordset()
+        self.assertEqual(sorted(u.groups_id.ids), before_ids,
+                         'Rollback must restore original groups_id')
+        self.assertEqual(preview.state, 'rolled_back')
+
+    def test_estimator_warning_flagged(self):
+        est = self.env.ref('fusion_plating_configurator.group_fp_estimator', raise_if_not_found=False)
+        if not est:
+            self.skipTest('Estimator group not defined')
+        u = self.env['res.users'].with_context(no_reset_password=True).create({
+            'login': 'mig_est', 'name': 'Est',
+            'email': 'mig_est@example.com',
+            'group_ids': [(6, 0, [est.id])],
+        })
+        preview = self.env['fp.migration.preview'].create({})
+        preview._fp_build_lines()
+        line = preview.line_ids.filtered(lambda l: l.user_id == u)
+        self.assertTrue(line.warning,
+                        'Estimator-only user should be flagged for capability loss')
+        self.assertEqual(line.proposed_role, 'sales_rep')
+
+    def test_admin_user_maps_to_owner(self):
+        # uid 2 always gets owner via the first mapping rule
+        preview = self.env['fp.migration.preview'].create({})
+        preview._fp_build_lines()
+        admin_line = preview.line_ids.filtered(lambda l: l.user_id.id == 2)
+        if admin_line:
+            self.assertEqual(admin_line.proposed_role, 'owner')
+
+    def test_rollback_blocked_after_30_days(self):
+        from datetime import timedelta
+        preview = self.env['fp.migration.preview'].create({})
+        preview._fp_build_lines()
+        preview.with_user(self.owner).action_approve_and_run()
+        # Backdate approved_at by 31 days
+        preview.approved_at = preview.approved_at - timedelta(days=31)
+        preview.invalidate_recordset(['rollback_deadline'])
+        with self.assertRaises(UserError):
+            preview.with_user(self.owner).action_rollback()

fusion_plating/fusion_plating/tests/test_quality_split.py

@@ -13,12 +13,12 @@ class TestQualitySplit(TransactionCase):
         self.u_mgr = Users.create({
             'login': 'qsplit_mgr', 'name': 'QSplit Mgr',
             'email': 'qsplit_mgr@example.com',
-            'groups_id': [(6, 0, [self.env.ref('fusion_plating.group_fp_manager').id])],
+            'group_ids': [(6, 0, [self.env.ref('fusion_plating.group_fp_manager').id])],
         })
         self.u_qm = Users.create({
             'login': 'qsplit_qm', 'name': 'QSplit QM',
             'email': 'qsplit_qm@example.com',
-            'groups_id': [(6, 0, [self.env.ref('fusion_plating.group_fp_quality_manager').id])],
+            'group_ids': [(6, 0, [self.env.ref('fusion_plating.group_fp_quality_manager').id])],
         })
 
     # CAPA: Manager read-only, QM full

fusion_plating/fusion_plating/tests/test_sales_manager_gate.py

@@ -0,0 +1,46 @@
+from odoo.tests.common import TransactionCase, tagged
+from odoo.exceptions import UserError
+
+
+@tagged('-at_install', 'post_install', 'fp_perms')
+class TestSalesManagerGate(TransactionCase):
+
+    def setUp(self):
+        super().setUp()
+        Users = self.env['res.users'].with_context(no_reset_password=True)
+        self.u_sr = Users.create({
+            'login': 'gate_sr', 'name': 'Gate SR',
+            'email': 'gate_sr@example.com',
+            'group_ids': [(6, 0, [self.env.ref('fusion_plating.group_fp_sales_rep').id])],
+        })
+        self.u_smg = Users.create({
+            'login': 'gate_smg', 'name': 'Gate SMg',
+            'email': 'gate_smg@example.com',
+            'group_ids': [(6, 0, [self.env.ref('fusion_plating.group_fp_sales_manager').id])],
+        })
+        partner = self.env['res.partner'].create({'name': 'Gate Test Customer'})
+        product = self.env['product.product'].create({'name': 'Gate Test Product'})
+        self.so = self.env['sale.order'].create({
+            'partner_id': partner.id,
+            'order_line': [(0, 0, {
+                'product_id': product.id, 'product_uom_qty': 1, 'price_unit': 100,
+            })],
+        })
+
+    def test_sales_rep_cannot_confirm(self):
+        with self.assertRaises(UserError):
+            self.so.with_user(self.u_sr).action_confirm()
+
+    def test_sales_manager_can_confirm(self):
+        self.so.with_user(self.u_smg).action_confirm()
+        self.assertEqual(self.so.state, 'sale')
+
+    def test_manager_can_confirm(self):
+        # Manager implies Sales Manager via the diamond — should also be able to confirm
+        u_mgr = self.env['res.users'].with_context(no_reset_password=True).create({
+            'login': 'gate_mgr', 'name': 'Gate Mgr',
+            'email': 'gate_mgr@example.com',
+            'group_ids': [(6, 0, [self.env.ref('fusion_plating.group_fp_manager').id])],
+        })
+        self.so.with_user(u_mgr).action_confirm()
+        self.assertEqual(self.so.state, 'sale')

fusion_plating/fusion_plating/tests/test_team_page.py

@@ -0,0 +1,104 @@
+from odoo.tests.common import TransactionCase, tagged
+
+
+@tagged('-at_install', 'post_install', 'fp_perms')
+class TestTeamPage(TransactionCase):
+    """Phase F — Owner-only Team management page.
+    Covers x_fc_plating_role compute/inverse + audit chatter + menu visibility."""
+
+    def setUp(self):
+        super().setUp()
+        Users = self.env['res.users'].with_context(no_reset_password=True)
+        self.owner = Users.create({
+            'login': 'team_owner', 'name': 'Team Owner',
+            'email': 'team_owner@example.com',
+            'group_ids': [(6, 0, [self.env.ref('fusion_plating.group_fp_owner').id])],
+        })
+        self.target = Users.create({
+            'login': 'team_target', 'name': 'Team Target',
+            'email': 'team_target@example.com',
+            'group_ids': [(6, 0, [self.env.ref('fusion_plating.group_fp_technician').id])],
+        })
+
+    def test_compute_returns_technician(self):
+        self.assertEqual(self.target.x_fc_plating_role, 'technician')
+
+    def test_compute_picks_highest_role(self):
+        # Add Manager group on top of Technician
+        self.target.write({'group_ids': [(4, self.env.ref('fusion_plating.group_fp_manager').id)]})
+        self.target.invalidate_recordset(['x_fc_plating_role'])
+        self.assertEqual(self.target.x_fc_plating_role, 'manager')
+
+    def test_inverse_sets_only_chosen_role(self):
+        self.target.with_user(self.owner).x_fc_plating_role = 'shop_manager'
+        # Shop Manager group should be present, Technician should be ABSENT
+        sm = self.env.ref('fusion_plating.group_fp_shop_manager_v2')
+        tech = self.env.ref('fusion_plating.group_fp_technician')
+        self.assertIn(sm, self.target.groups_id)
+        # Technician is implied via shop_manager_v2.implied_ids → so it IS in user's
+        # transitive group set. But the inverse should NOT have ADDED it directly.
+        # Verify by checking groups_id (which Odoo stores as the union of explicit
+        # + implied groups) — Technician will be present via implication. That's
+        # correct. What we want to verify is no OTHER plating role is set explicitly.
+        # Easier assertion: after setting to shop_manager, compute should return
+        # shop_manager (highest plating role held).
+        self.target.invalidate_recordset(['x_fc_plating_role'])
+        self.assertEqual(self.target.x_fc_plating_role, 'shop_manager')
+
+    def test_inverse_to_no_clears_all_plating_roles(self):
+        # Start as Manager
+        self.target.with_user(self.owner).x_fc_plating_role = 'manager'
+        self.target.invalidate_recordset(['x_fc_plating_role'])
+        self.assertEqual(self.target.x_fc_plating_role, 'manager')
+        # Set to 'no'
+        self.target.with_user(self.owner).x_fc_plating_role = 'no'
+        self.target.invalidate_recordset(['x_fc_plating_role'])
+        # Verify no plating group remains
+        plating_groups = [
+            self.env.ref(f'fusion_plating.group_fp_{x}', raise_if_not_found=False)
+            for x in ('technician', 'sales_rep', 'shop_manager_v2',
+                      'sales_manager', 'manager', 'quality_manager', 'owner')
+        ]
+        for g in plating_groups:
+            if g:
+                self.assertNotIn(g, self.target.groups_id,
+                                 f'{g.name} should be removed when role=no')
+        self.assertEqual(self.target.x_fc_plating_role, 'no')
+
+    def test_inverse_posts_chatter_audit(self):
+        before = self.target.message_ids
+        self.target.with_user(self.owner).x_fc_plating_role = 'manager'
+        after = self.target.message_ids - before
+        self.assertTrue(after, 'Role change must post a chatter message')
+        # Verify the message body mentions the role change
+        bodies = ' '.join(after.mapped('body'))
+        self.assertIn('manager', bodies.lower())
+
+    def test_team_menu_visible_to_owner(self):
+        menu = self.env.ref('fusion_plating.menu_fp_team', raise_if_not_found=False)
+        if not menu:
+            self.skipTest('menu_fp_team not found')
+        visible = self.env['ir.ui.menu'].with_user(self.owner).search_count([('id', '=', menu.id)])
+        self.assertTrue(visible)
+
+    def test_team_menu_hidden_from_manager(self):
+        menu = self.env.ref('fusion_plating.menu_fp_team', raise_if_not_found=False)
+        if not menu:
+            self.skipTest('menu_fp_team not found')
+        mgr = self.env['res.users'].with_context(no_reset_password=True).create({
+            'login': 'team_mgr', 'name': 'Team Mgr',
+            'email': 'team_mgr@example.com',
+            'group_ids': [(6, 0, [self.env.ref('fusion_plating.group_fp_manager').id])],
+        })
+        visible = self.env['ir.ui.menu'].with_user(mgr).search_count([('id', '=', menu.id)])
+        self.assertFalse(visible, 'Manager must not see Team menu (Owner-only)')
+
+    def test_cgp_do_field_on_company(self):
+        co = self.env.company
+        self.assertTrue(hasattr(co, 'x_fc_cgp_designated_official_id'),
+                        'res.company must have x_fc_cgp_designated_official_id field')
+
+    def test_nadcap_authority_field_on_company(self):
+        co = self.env.company
+        self.assertTrue(hasattr(co, 'x_fc_nadcap_authority_user_id'),
+                        'res.company must have x_fc_nadcap_authority_user_id field')

fusion_plating/fusion_plating/views/fp_job_step_move_views.xml

@@ -116,13 +116,13 @@
     </record>
 
     <!-- Phase 1 — under Operations.
-         Phase 3 — supervisor+ only. Operators see their own moves on
-         the tablet; this is an audit view of every move. -->
+         Phase D (perms v2) — Shop Manager+ only. Operators see their
+         own moves on the tablet; this is an audit view of every move. -->
     <menuitem id="menu_fp_job_step_move"
               name="Parts &amp; Rack Move Log"
               parent="menu_fp_operations"
               action="action_fp_job_step_move"
               sequence="90"
-              groups="fusion_plating.group_fusion_plating_supervisor"/>
+              groups="fusion_plating.group_fp_shop_manager_v2"/>
 
 </odoo>

fusion_plating/fusion_plating/views/fp_job_step_timelog_views.xml

@@ -133,10 +133,12 @@
     </record>
 
     <!-- Phase 1 — re-parented under Operations. -->
+    <!-- Phase D (perms v2) — Shop Manager+ only. Payroll/billing audit. -->
     <menuitem id="menu_fp_labor_history"
               name="Labor History"
               parent="menu_fp_operations"
               action="action_fp_labor_history"
-              sequence="95"/>
+              sequence="95"
+              groups="fusion_plating.group_fp_shop_manager_v2"/>
 
 </odoo>

fusion_plating/fusion_plating/views/fp_menu.xml

@@ -22,14 +22,14 @@
               sequence="46"
               web_icon="fusion_plating,static/description/icon.png"
               action="action_fp_resolve_plating_landing"
-              groups="group_fusion_plating_operator"/>
+              groups="fusion_plating.group_fp_technician,fusion_plating.group_fp_sales_rep"/>
 
     <!-- ===== 2. CONFIGURATION + 7 Phase-2 buckets ===== -->
     <menuitem id="menu_fp_config"
               name="Configuration"
               parent="menu_fp_root"
               sequence="90"
-              groups="group_fusion_plating_manager"/>
+              groups="fusion_plating.group_fp_manager"/>
 
     <menuitem id="menu_fp_config_shop_setup"
               name="Shop Setup"
@@ -71,13 +71,14 @@
               name="Compliance"
               parent="menu_fp_root"
               sequence="50"
-              groups="group_fusion_plating_supervisor"/>
+              groups="fusion_plating.group_fp_quality_manager"/>
 
     <!-- ===== 4. OPERATIONS ===== -->
     <menuitem id="menu_fp_operations"
               name="Operations"
               parent="menu_fp_root"
-              sequence="18"/>
+              sequence="18"
+              groups="fusion_plating.group_fp_technician"/>
 
     <!-- ===== 5. CHILD MENUS ===== -->
 
@@ -112,13 +113,13 @@
               action="action_fp_rack"
               sequence="35"/>
 
-    <!-- Phase 3 — supervisor+: replenishment is a purchasing decision. -->
+    <!-- Phase D (perms v2) — Manager+: replenishment is a purchasing decision. -->
     <menuitem id="menu_fp_replenishment_suggestions"
               name="Replenishment Suggestions"
               parent="menu_fp_operations"
               action="action_fp_replenishment_suggestion"
               sequence="40"
-              groups="fusion_plating.group_fusion_plating_supervisor"/>
+              groups="fusion_plating.group_fp_manager"/>
 
     <!-- Configuration children (referencing the 7 buckets above) -->
     <menuitem id="menu_fp_replenishment_rules"

fusion_plating/fusion_plating/views/fp_migration_views.xml

@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <data>
+
+        <record id="view_fp_migration_preview_form" model="ir.ui.view">
+            <field name="name">fp.migration.preview.form</field>
+            <field name="model">fp.migration.preview</field>
+            <field name="arch" type="xml">
+                <form>
+                    <header>
+                        <button name="action_approve_and_run" type="object"
+                                string="Approve &amp; Run"
+                                class="oe_highlight"
+                                invisible="state != 'pending'"
+                                confirm="This will apply role changes to all listed users. Continue?"/>
+                        <button name="action_cancel" type="object"
+                                string="Cancel"
+                                invisible="state != 'pending'"/>
+                        <button name="action_rollback" type="object"
+                                string="Rollback"
+                                invisible="state != 'approved'"
+                                confirm="This will restore all users to their pre-migration groups. Continue?"/>
+                        <field name="state" widget="statusbar"/>
+                    </header>
+                    <sheet>
+                        <div class="oe_title">
+                            <h1><field name="name"/></h1>
+                        </div>
+                        <group>
+                            <group>
+                                <field name="user_count"/>
+                                <field name="warning_count"/>
+                            </group>
+                            <group>
+                                <field name="approved_by_id"/>
+                                <field name="approved_at"/>
+                                <field name="rollback_deadline"/>
+                            </group>
+                        </group>
+                        <notebook>
+                            <page string="Users">
+                                <field name="line_ids">
+                                    <list editable="bottom" decoration-warning="warning">
+                                        <field name="user_id"/>
+                                        <field name="current_groups"/>
+                                        <field name="proposed_role"/>
+                                        <field name="capability_delta"/>
+                                        <field name="warning" widget="boolean_toggle"/>
+                                        <field name="notes"/>
+                                    </list>
+                                </field>
+                            </page>
+                        </notebook>
+                    </sheet>
+                    <chatter/>
+                </form>
+            </field>
+        </record>
+
+        <record id="view_fp_migration_preview_list" model="ir.ui.view">
+            <field name="name">fp.migration.preview.list</field>
+            <field name="model">fp.migration.preview</field>
+            <field name="arch" type="xml">
+                <list decoration-warning="state == 'pending'"
+                      decoration-success="state == 'approved'"
+                      decoration-muted="state in ('cancelled', 'rolled_back')">
+                    <field name="name"/>
+                    <field name="state" widget="badge"/>
+                    <field name="user_count"/>
+                    <field name="warning_count"/>
+                    <field name="create_date"/>
+                    <field name="approved_by_id"/>
+                    <field name="approved_at"/>
+                </list>
+            </field>
+        </record>
+
+        <record id="action_fp_migration_preview" model="ir.actions.act_window">
+            <field name="name">Role Migrations</field>
+            <field name="res_model">fp.migration.preview</field>
+            <field name="view_mode">list,form</field>
+        </record>
+
+        <menuitem id="menu_fp_migration_preview"
+                  name="Role Migrations"
+                  parent="fusion_plating.menu_fp_config"
+                  action="action_fp_migration_preview"
+                  sequence="9"
+                  groups="fusion_plating.group_fp_owner"/>
+
+    </data>
+</odoo>

fusion_plating/fusion_plating/views/fp_team_views.xml

@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <data>
+
+        <!-- Owner-only Team page: kanban of internal users grouped by plating role.
+             Drag-and-drop a card between columns changes the user's role
+             (inverse handler on res.users.x_fc_plating_role). -->
+
+        <record id="view_fp_team_kanban" model="ir.ui.view">
+            <field name="name">res.users.fp.team.kanban</field>
+            <field name="model">res.users</field>
+            <field name="arch" type="xml">
+                <kanban default_group_by="x_fc_plating_role"
+                        class="o_kanban_small_column"
+                        group_create="false"
+                        group_delete="false"
+                        records_draggable="true">
+                    <field name="id"/>
+                    <field name="x_fc_plating_role"/>
+                    <field name="login"/>
+                    <field name="email"/>
+                    <field name="image_128"/>
+                    <field name="login_date"/>
+                    <field name="name"/>
+                    <templates>
+                        <t t-name="card" class="flex-row align-items-center">
+                            <aside class="o_kanban_aside_full">
+                                <field name="image_128" widget="image"
+                                       options="{'preview_image': 'image_128', 'img_class': 'rounded'}"/>
+                            </aside>
+                            <main class="ms-2">
+                                <field name="name" class="fw-bolder fs-5"/>
+                                <div t-if="record.email.raw_value" class="text-muted small">
+                                    <field name="email"/>
+                                </div>
+                                <div t-if="record.login_date.raw_value" class="text-muted small">
+                                    Last seen: <field name="login_date" widget="date"/>
+                                </div>
+                            </main>
+                        </t>
+                    </templates>
+                </kanban>
+            </field>
+        </record>
+
+        <record id="action_fp_team" model="ir.actions.act_window">
+            <field name="name">Team</field>
+            <field name="res_model">res.users</field>
+            <field name="view_mode">kanban,list,form</field>
+            <field name="domain">[('share', '=', False), ('active', '=', True)]</field>
+            <field name="context">{'search_default_groupby_plating_role': 1}</field>
+        </record>
+
+        <menuitem id="menu_fp_team"
+                  name="Team"
+                  parent="fusion_plating.menu_fp_config"
+                  action="action_fp_team"
+                  sequence="5"
+                  groups="fusion_plating.group_fp_owner"/>
+
+    </data>
+</odoo>

fusion_plating/fusion_plating/views/res_company_views.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <data>
+
+        <record id="view_company_form_fp_dos" model="ir.ui.view">
+            <field name="name">res.company.form.fp.designated.officials</field>
+            <field name="model">res.company</field>
+            <field name="inherit_id" ref="base.view_company_form"/>
+            <field name="arch" type="xml">
+                <xpath expr="//notebook" position="inside">
+                    <page string="Plating Designated Officials"
+                          groups="fusion_plating.group_fp_owner">
+                        <group>
+                            <!-- No domain on the picker: Owner picks freely.
+                                 ref() in XML domains trips Odoo 19's view validator
+                                 (interpreted as field access on res.company).
+                                 The QM/Owner eligibility constraint is enforced
+                                 in Python via @api.constrains on res.company. -->
+                            <field name="x_fc_cgp_designated_official_id"/>
+                            <field name="x_fc_nadcap_authority_user_id"/>
+                        </group>
+                    </page>
+                </xpath>
+            </field>
+        </record>
+
+    </data>
+</odoo>

fusion_plating/fusion_plating_aerospace/__manifest__.py

@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Aerospace (AS9100 + Nadcap)',
-    'version': '19.0.1.1.1',
+    'version': '19.0.1.1.2',
     'category': 'Manufacturing/Plating',
     'summary': 'Aerospace industry pack: AS9100 Rev D clause library, Nadcap AC7108 '
                'audits, counterfeit parts prevention, config management, risk register, '

fusion_plating/fusion_plating_aerospace/views/fp_menu.xml

@@ -7,11 +7,12 @@
 <odoo>
 
     <!-- Phase 1 — re-parented under Plating → Compliance hub. -->
+    <!-- Phase D (perms v2) — QM-only under compliance hub. -->
     <menuitem id="menu_fp_aerospace"
               name="Aerospace (AS9100 / Nadcap)"
               parent="fusion_plating.menu_fp_compliance_hub"
               sequence="30"
-              groups="fusion_plating.group_fusion_plating_operator"/>
+              groups="fusion_plating.group_fp_quality_manager"/>
 
     <menuitem id="menu_fp_aerospace_as9100"
               name="AS9100 Clauses"

fusion_plating/fusion_plating_bridge_maintenance/__manifest__.py

@@ -4,7 +4,7 @@
 
 {
     'name': 'Fusion Plating — Maintenance Bridge',
-    'version': '19.0.1.2.1',
+    'version': '19.0.1.2.2',
     'category': 'Manufacturing/Plating',
     'summary': 'Bridge standard Odoo Maintenance with Fusion Plating equipment, '
                'plans, checklists, and sensor integration.',

fusion_plating/fusion_plating_bridge_maintenance/views/fp_maintenance_menu.xml

@@ -3,11 +3,13 @@
 
     <!-- Phase 1 — re-parented under Plating → Operations. Maintenance
          is an Operations concern, not a separate top-level. -->
+    <!-- Phase D (perms v2) — Shop Manager+ only. Operators don't need
+         to schedule plans or browse the equipment registry. -->
     <menuitem id="menu_fp_maintenance"
               name="Maintenance"
               parent="fusion_plating.menu_fp_operations"
               sequence="80"
-              groups="fusion_plating.group_fusion_plating_operator"/>
+              groups="fusion_plating.group_fp_shop_manager_v2"/>
 
     <menuitem id="menu_fp_maintenance_active"
               name="Active Events"

fusion_plating/fusion_plating_bridge_mrp/__manifest__.py

@@ -5,7 +5,7 @@
 
 {
     "name": "Fusion Plating — MRP Bridge",
-    'version': '19.0.13.0.4',
+    'version': '19.0.13.0.5',
     'category': 'Manufacturing/Plating',
     'summary': 'Bridge Fusion Plating facilities, baths and tanks to Odoo MRP work orders.',
     'description': """

fusion_plating/fusion_plating_bridge_mrp/models/mrp_workorder.py

@@ -922,7 +922,7 @@ class MrpWorkorder(models.Model):
             employee = self.env.user.employee_id
             if not employee:
                 # Admins without an employee record skip the check.
-                if not self.env.user.has_group('fusion_plating.group_fusion_plating_manager'):
+                if not self.env.user.has_group('fusion_plating.group_fp_manager'):
                     raise UserError(_(
                         'You must be linked to an HR employee record to start '
                         'plating work orders. Contact your manager.'
@@ -942,7 +942,7 @@ class MrpWorkorder(models.Model):
         inspection was cleared earlier. Plating Manager bypasses.
         """
         from odoo.exceptions import UserError
-        if self.env.user.has_group('fusion_plating.group_fusion_plating_manager'):
+        if self.env.user.has_group('fusion_plating.group_fp_manager'):
             return
         Insp = self.env.get('fp.racking.inspection')
         if Insp is None:

fusion_plating/fusion_plating_certificates/__manifest__.py

@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Certificates',
-    'version': '19.0.7.9.2',
+    'version': '19.0.7.9.3',
     'category': 'Manufacturing/Plating',
     'summary': 'Certificate registry for CoC, thickness reports, and quality documents.',
     'description': """

fusion_plating/fusion_plating_certificates/security/fp_cert_security.xml

@@ -1,10 +1,14 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo>
     <data noupdate="0">
-        <record id="rule_fp_certificate_fair_nadcap_qm_only" model="ir.rule">
-            <field name="name">FP Certificate: FAIR/Nadcap edit restricted to Quality Manager</field>
+        <!-- fp.certificate.certificate_type Selection values (per fp_certificate.py:27):
+             'coc', 'thickness_report', 'mill_test', 'nadcap_cert', 'customer_specific'.
+             FAIR is a separate model (fusion.plating.fair); no 'fair' value here.
+             Nadcap is the only QM-restricted type at the model level. -->
+        <record id="rule_fp_certificate_nadcap_qm_only" model="ir.rule">
+            <field name="name">FP Certificate: Nadcap edit restricted to Quality Manager</field>
             <field name="model_id" ref="model_fp_certificate"/>
-            <field name="domain_force">[('cert_type', 'not in', ('fair', 'nadcap'))]</field>
+            <field name="domain_force">[('certificate_type', '!=', 'nadcap_cert')]</field>
             <field name="groups" eval="[(4, ref('fusion_plating.group_fp_manager'))]"/>
             <field name="perm_read" eval="False"/>
             <field name="perm_write" eval="True"/>

fusion_plating/fusion_plating_certificates/views/fp_certificate_views.xml

@@ -39,6 +39,14 @@
         <field name="arch" type="xml">
             <form>
                 <header>
+                    <!-- Phase D5 — Nadcap-cert restriction enforced at MODEL
+                         layer via ir.rule (rule_fp_certificate_nadcap_qm_only
+                         in fp_cert_security.xml). Single Issue button visible
+                         to all Manager+ when state=draft. Manager clicking
+                         Issue on a Nadcap cert gets AccessError from the rule.
+                         (Strategy B with user_has_groups() inside invisible=
+                         was rejected by Odoo 19 view validator — see CLAUDE.md
+                         rule 13f.) -->
                     <button name="action_issue" string="Issue"
                             type="object" class="btn-primary"
                             invisible="state != 'draft'"/>

fusion_plating/fusion_plating_cgp/__manifest__.py

@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Controlled Goods Program',
-    'version': '19.0.1.2.1',
+    'version': '19.0.1.2.3',
     'category': 'Manufacturing/Plating',
     'summary': 'Canadian Controlled Goods Program (CGP) compliance for plating '
                'shops handling defence work: registration, authorized individuals, '

fusion_plating/fusion_plating_cgp/views/fp_cgp_ai_views.xml

@@ -36,15 +36,22 @@
         <field name="arch" type="xml">
             <form string="Authorized Individual">
                 <header>
+                    <!-- Phase D5 — all CGP form buttons are QM-only per spec
+                         section 2.C (CGP fold-in lands entirely under
+                         Quality Manager). -->
                     <button name="action_activate" string="Activate" type="object"
                             class="oe_highlight"
-                            invisible="state == 'active'"/>
+                            invisible="state == 'active'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_suspend" string="Suspend" type="object"
-                            invisible="state not in ('active',)"/>
+                            invisible="state not in ('active',)"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_revoke" string="Revoke" type="object"
-                            invisible="state == 'revoked'"/>
+                            invisible="state == 'revoked'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_deactivate" string="Deactivate" type="object"
-                            invisible="state != 'active'"/>
+                            invisible="state != 'active'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="active,inactive,suspended,revoked"/>
                 </header>

fusion_plating/fusion_plating_cgp/views/fp_cgp_controlled_good_views.xml

@@ -35,17 +35,23 @@
         <field name="arch" type="xml">
             <form string="Controlled Good" class="o_fp_cgp_classified">
                 <header>
+                    <!-- Phase D5 — all CGP form buttons are QM-only per spec
+                         section 2.C. -->
                     <button name="action_mark_in_process" string="In Process"
                             type="object"
-                            invisible="state == 'in_process'"/>
+                            invisible="state == 'in_process'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_mark_in_storage" string="In Storage"
                             type="object"
-                            invisible="state == 'in_storage'"/>
+                            invisible="state == 'in_storage'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_mark_shipped" string="Shipped" type="object"
-                            invisible="state == 'shipped'"/>
+                            invisible="state == 'shipped'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_mark_destroyed" string="Destroyed"
                             type="object"
-                            invisible="state == 'destroyed'"/>
+                            invisible="state == 'destroyed'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="received,in_process,in_storage,shipped"/>
                 </header>

fusion_plating/fusion_plating_cgp/views/fp_cgp_psa_views.xml

@@ -35,16 +35,22 @@
         <field name="arch" type="xml">
             <form string="Personnel Security Assessment" class="o_fp_cgp_classified">
                 <header>
+                    <!-- Phase D5 — all CGP form buttons are QM-only per spec
+                         section 2.C. -->
                     <button name="action_start" string="Start" type="object"
                             class="oe_highlight"
-                            invisible="state != 'draft'"/>
+                            invisible="state != 'draft'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_complete" string="Complete" type="object"
                             class="oe_highlight"
-                            invisible="state != 'in_progress'"/>
+                            invisible="state != 'in_progress'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_expire" string="Mark Expired" type="object"
-                            invisible="state != 'completed'"/>
+                            invisible="state != 'completed'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reset_to_draft" string="Reset" type="object"
-                            invisible="state == 'draft'"/>
+                            invisible="state == 'draft'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="draft,in_progress,completed,expired"/>
                 </header>

fusion_plating/fusion_plating_cgp/views/fp_cgp_receipt_shipment_views.xml

@@ -37,16 +37,22 @@
         <field name="arch" type="xml">
             <form string="CGP Receipt / Shipment" class="o_fp_cgp_classified">
                 <header>
+                    <!-- Phase D5 — all CGP form buttons are QM-only per spec
+                         section 2.C. -->
                     <button name="action_authorize" string="Authorize" type="object"
                             class="oe_highlight"
-                            invisible="state != 'draft'"/>
+                            invisible="state != 'draft'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_execute" string="Execute" type="object"
                             class="oe_highlight"
-                            invisible="state != 'authorized'"/>
+                            invisible="state != 'authorized'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_close" string="Close" type="object"
-                            invisible="state != 'executed'"/>
+                            invisible="state != 'executed'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reset_to_draft" string="Reset" type="object"
-                            invisible="state == 'draft'"/>
+                            invisible="state == 'draft'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="draft,authorized,executed,closed"/>
                 </header>

fusion_plating/fusion_plating_cgp/views/fp_cgp_registration_views.xml

@@ -36,17 +36,24 @@
         <field name="arch" type="xml">
             <form string="CGP Registration" class="o_fp_cgp_classified">
                 <header>
+                    <!-- Phase D5 — all CGP form buttons are QM-only per spec
+                         section 2.C. -->
                     <button name="action_mark_registered" string="Mark Registered"
                             type="object" class="oe_highlight"
-                            invisible="state != 'pending'"/>
+                            invisible="state != 'pending'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_suspend" string="Suspend" type="object"
-                            invisible="state != 'registered'"/>
+                            invisible="state != 'registered'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_expire" string="Mark Expired" type="object"
-                            invisible="state not in ('registered','suspended')"/>
+                            invisible="state not in ('registered','suspended')"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_revoke" string="Revoke" type="object"
-                            invisible="state == 'revoked'"/>
+                            invisible="state == 'revoked'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reset_to_pending" string="Reset" type="object"
-                            invisible="state == 'pending'"/>
+                            invisible="state == 'pending'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="pending,registered,suspended,expired,revoked"/>
                 </header>

fusion_plating/fusion_plating_cgp/views/fp_cgp_security_incident_views.xml

@@ -39,16 +39,22 @@
         <field name="arch" type="xml">
             <form string="Security Incident" class="o_fp_cgp_classified">
                 <header>
+                    <!-- Phase D5 — all CGP form buttons are QM-only per spec
+                         section 2.C. -->
                     <button name="action_investigate" string="Investigate"
                             type="object" class="oe_highlight"
-                            invisible="state != 'discovered'"/>
+                            invisible="state != 'discovered'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_report" string="Report to PSPC"
                             type="object" class="oe_highlight"
-                            invisible="state != 'investigating'"/>
+                            invisible="state != 'investigating'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_close" string="Close" type="object"
-                            invisible="state not in ('investigating','reported')"/>
+                            invisible="state not in ('investigating','reported')"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reset" string="Reset" type="object"
-                            invisible="state == 'discovered'"/>
+                            invisible="state == 'discovered'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="discovered,investigating,reported,closed"/>
                 </header>

fusion_plating/fusion_plating_cgp/views/fp_cgp_visitor_views.xml

@@ -39,16 +39,22 @@
         <field name="arch" type="xml">
             <form string="CGP Visitor">
                 <header>
+                    <!-- Phase D5 — all CGP form buttons are QM-only per spec
+                         section 2.C. -->
                     <button name="action_check_in" string="Check In" type="object"
                             class="oe_highlight"
-                            invisible="state != 'scheduled'"/>
+                            invisible="state != 'scheduled'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_check_out" string="Check Out" type="object"
                             class="oe_highlight"
-                            invisible="state != 'checked_in'"/>
+                            invisible="state != 'checked_in'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_deny" string="Deny" type="object"
-                            invisible="state not in ('scheduled','checked_in')"/>
+                            invisible="state not in ('scheduled','checked_in')"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_cancel" string="Cancel" type="object"
-                            invisible="state in ('checked_out','cancelled','denied')"/>
+                            invisible="state in ('checked_out','cancelled','denied')"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="scheduled,checked_in,checked_out"/>
                 </header>

fusion_plating/fusion_plating_cgp/views/fp_menu.xml

@@ -7,11 +7,12 @@
 <odoo>
 
     <!-- Phase 1 — re-parented under Plating → Compliance hub. -->
+    <!-- Phase D (perms v2) — QM-only under compliance hub. -->
     <menuitem id="menu_fp_cgp"
               name="Controlled Goods (CGP)"
               parent="fusion_plating.menu_fp_compliance_hub"
               sequence="50"
-              groups="group_fusion_plating_cgp_officer"/>
+              groups="fusion_plating.group_fp_quality_manager"/>
 
     <menuitem id="menu_fp_cgp_registration"
               name="Registration"

fusion_plating/fusion_plating_compliance/__manifest__.py

@@ -3,7 +3,7 @@
 # License OPL-1 (Odoo Proprietary License v1.0)
 {
     'name': 'Fusion Plating - Compliance (Framework)',
-    'version': '19.0.1.3.1',
+    'version': '19.0.1.3.2',
     'category': 'Manufacturing/Plating',
     'summary': 'Jurisdiction-agnostic compliance framework: permits, discharge monitoring, waste manifests, pollutant inventory, compliance calendar, spill register.',
     'description': 'Generic compliance framework. Region packs load jurisdiction-specific data.',

fusion_plating/fusion_plating_compliance/views/fp_menu.xml

@@ -3,7 +3,8 @@
     <!-- Phase 1 — re-parented under fusion_plating.menu_fp_compliance_hub
          and renamed to 'General' since the hub is now the top-level Compliance. -->
     <menuitem id="menu_fp_compliance_root" name="General"
-              parent="fusion_plating.menu_fp_compliance_hub" sequence="10"/>
+              parent="fusion_plating.menu_fp_compliance_hub" sequence="10"
+              groups="fusion_plating.group_fp_quality_manager"/>
 
     <menuitem id="menu_fp_compliance_permit" name="Permits" parent="menu_fp_compliance_root" action="action_fp_permit" sequence="10"/>
     <menuitem id="menu_fp_compliance_discharge_sample" name="Discharge Samples" parent="menu_fp_compliance_root" action="action_fp_discharge_sample" sequence="20"/>

fusion_plating/fusion_plating_configurator/__manifest__.py

@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Configurator',
-    'version': '19.0.21.8.1',
+    'version': '19.0.21.8.4',
     'category': 'Manufacturing/Plating',
     'summary': 'Quotation configurator with part catalog, coating configs, and formula-based pricing engine.',
     'description': """

fusion_plating/fusion_plating_configurator/models/fp_serial.py

@@ -212,7 +212,7 @@ class FpSerial(models.Model):
         correction is needed (e.g. wrong serial marked shipped). Audit
         trail preserved via chatter; never silently rewrites history."""
         for rec in self:
-            if not self.env.user.has_group('fusion_plating.group_fusion_plating_manager'):
+            if not self.env.user.has_group('fusion_plating.group_fp_manager'):
                 from odoo.exceptions import UserError
                 raise UserError(_(
                     'Only the Plating Manager group can reopen a terminal '

fusion_plating/fusion_plating_configurator/models/sale_order.py

@@ -3,7 +3,8 @@
 # License OPL-1 (Odoo Proprietary License v1.0)
 # Part of the Fusion Plating product family.
 
-from odoo import api, fields, models
+from odoo import _, api, fields, models
+from odoo.exceptions import UserError
 
 
 class SaleOrder(models.Model):
@@ -835,6 +836,17 @@ class SaleOrder(models.Model):
     # Auto-assigned once at confirm so every confirmed line has one; still
     # editable afterwards (clearable, overridable to match a customer scheme).
     def action_confirm(self):
+        # Phase G of permissions overhaul: only Sales Manager+ can confirm
+        # Sale Orders. Sales Rep can save drafts but cannot move them to
+        # 'sale' state. The has_group() check resolves True for Sales Manager,
+        # Manager (implies Sales Manager via diamond), Quality Manager
+        # (implies Manager), and Owner (implies Quality Manager) — see
+        # spec Section 2.B.
+        if not self.env.user.has_group('fusion_plating.group_fp_sales_manager'):
+            raise UserError(_(
+                'Only Sales Manager or higher can confirm Sale Orders. '
+                'Please ask a Sales Manager to confirm this quote.'
+            ))
         res = super().action_confirm()
         Sequence = self.env['ir.sequence']
         for so in self:

fusion_plating/fusion_plating_configurator/views/fp_configurator_menu.xml

@@ -29,7 +29,7 @@
               name="Sales"
               parent="fusion_plating.menu_fp_root"
               sequence="5"
-              groups="group_fp_estimator,fusion_plating.group_fusion_plating_supervisor"/>
+              groups="fusion_plating.group_fp_sales_rep"/>
 
     <!-- === New Quote — top-of-menu entry point for a fresh quote === -->
     <menuitem id="menu_fp_new_quote"

fusion_plating/fusion_plating_configurator/views/sale_order_views.xml

@@ -13,9 +13,18 @@
         <field name="inherit_id" ref="sale.view_order_form"/>
         <field name="arch" type="xml">
             <!-- Header buttons: make draft Confirm the primary CTA, demote/rename
-                 Send to "Send Email" (red), and reorder so Confirm sits first. -->
+                 Send to "Send Email" (red), and reorder so Confirm sits first.
+                 Phase D5 — gate Confirm button to Sales Manager + higher; matches
+                 the model-level gate from Phase G so Sales Rep sees the SO in
+                 draft but no Confirm button. -->
             <xpath expr="//header/button[@name='action_confirm' and not(@id)]" position="attributes">
                 <attribute name="class">btn-primary</attribute>
+                <attribute name="groups">fusion_plating.group_fp_sales_manager</attribute>
+            </xpath>
+            <!-- Also gate the state=sent Confirm button (id="action_confirm") so
+                 Sales Reps don't see EITHER variant. Matches the model-level gate. -->
+            <xpath expr="//header/button[@id='action_confirm']" position="attributes">
+                <attribute name="groups">fusion_plating.group_fp_sales_manager</attribute>
             </xpath>
             <xpath expr="//header/button[@id='quotation_send_primary']" position="attributes">
                 <attribute name="string">Send Email</attribute>
@@ -359,6 +368,22 @@
                 <field name="x_fc_quote_id" optional="hide"/>
                 <field name="x_fc_rush_order" optional="hide"/>
             </xpath>
+
+            <!-- Phase D5 — gate pricing columns/totals to Sales Rep + higher
+                 (defense in depth — Technician/Shop Manager don't see pricing
+                 even if they navigate to an SO). -->
+            <xpath expr="//field[@name='order_line']/list/field[@name='price_unit']" position="attributes">
+                <attribute name="groups">fusion_plating.group_fp_sales_rep</attribute>
+            </xpath>
+            <xpath expr="//field[@name='order_line']/list/field[@name='price_subtotal']" position="attributes">
+                <attribute name="groups">fusion_plating.group_fp_sales_rep</attribute>
+            </xpath>
+            <!-- Odoo 19: amount_total / amount_untaxed / amount_tax are rendered
+                 by the single tax_totals widget; no separate fields. Gate the
+                 widget itself to hide the entire totals block from non-Sales-Rep. -->
+            <xpath expr="//field[@name='tax_totals']" position="attributes">
+                <attribute name="groups">fusion_plating.group_fp_sales_rep</attribute>
+            </xpath>
         </field>
     </record>
 

fusion_plating/fusion_plating_configurator/wizard/fp_direct_order_wizard.py

@@ -458,14 +458,13 @@ class FpDirectOrderWizard(models.Model):
         # Resolved through commercial_partner so a hold on the company
         # blocks every child-contact entry too.
         commercial = self.partner_id.commercial_partner_id
-        # Bypass: Plating Manager OR Plating Administrator. Both checked
-        # because Odoo's implied_ids cascade (Administrator → Manager)
-        # doesn't always propagate to existing users on upgrade. See
-        # CLAUDE.md "Implied group cascade" rule.
-        can_override = (
-            self.env.user.has_group('fusion_plating.group_fusion_plating_manager')
-            or self.env.user.has_group('fusion_plating.group_fusion_plating_administrator')
-        )
+        # Bypass: Plating Manager (or anything above — Quality Manager,
+        # Owner — via the Phase A implied_ids diamond). Phase G fix:
+        # old code also checked 'group_fusion_plating_administrator',
+        # an xmlid that never existed and always returned False
+        # (audit-finding-11). The Manager check alone is now correct
+        # because Manager → Quality Manager → Owner via Phase A.
+        can_override = self.env.user.has_group('fusion_plating.group_fp_manager')
         if (getattr(commercial, 'x_fc_account_hold', False)
                 and not self.env.context.get('fp_skip_account_hold')
                 and not can_override):

fusion_plating/fusion_plating_invoicing/__manifest__.py

@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Invoicing',
-    'version': '19.0.3.6.1',
+    'version': '19.0.3.6.3',
     'category': 'Manufacturing/Plating',
     'summary': 'Invoice strategy engine with deposit, progress billing, net terms, COD/prepay, and account holds.',
     'description': """

fusion_plating/fusion_plating_invoicing/models/res_partner.py

@@ -29,10 +29,12 @@ class ResPartner(models.Model):
         See CLAUDE.md "Implied group cascade" rule.
         """
         user = self.env.user
-        return (
-            user.has_group('fusion_plating.group_fusion_plating_manager')
-            or user.has_group('fusion_plating.group_fusion_plating_administrator')
-        )
+        # Phase G: fixed audit-finding-11 — old code referenced
+        # 'fusion_plating.group_fusion_plating_administrator', an xmlid
+        # that never existed, so the gate always returned False. Replaced
+        # with group_fp_manager which transitively implies Owner via
+        # implied_ids in Phase A's diamond hierarchy.
+        return user.has_group('fusion_plating.group_fp_manager')
     x_fc_account_hold_reason = fields.Text(string='Hold Reason')
     x_fc_account_hold_date = fields.Datetime(
         string='Hold Date', help='When the hold was placed.',

fusion_plating/fusion_plating_invoicing/views/res_partner_views.xml

@@ -53,8 +53,16 @@
                     </group>
                 </page>
 
+                <!-- Phase D5 — Account Hold management (the override gate per
+                     spec section 2.E Layer 3). Was previously gated on the
+                     fold-in group_fp_accounting; consolidated to group_fp_manager
+                     and resolves audit-finding-11 _administrator typo by removing
+                     the old fold-in group from this surface. The Python helper
+                     _fp_user_can_override_account_hold (still in res_partner.py)
+                     is the runtime gate; Phase G fixes the Python-side typo
+                     separately. -->
                 <page string="Account Hold" name="account_hold_tab"
-                      groups="fusion_plating_invoicing.group_fp_accounting">
+                      groups="fusion_plating.group_fp_manager">
                     <group>
                         <group>
                             <field name="x_fc_account_hold"/>

fusion_plating/fusion_plating_jobs/__manifest__.py

@@ -3,7 +3,7 @@
 # License OPL-1 (Odoo Proprietary License v1.0)
 {
     'name': 'Fusion Plating — Native Jobs',
-    'version': '19.0.10.24.1',
+    'version': '19.0.10.24.2',
     'category': 'Manufacturing/Plating',
     'summary': 'Native plating job model — replaces mrp.production / mrp.workorder bridge.',
     'author': 'Nexa Systems Inc.',

fusion_plating/fusion_plating_jobs/controllers/job_scan.py

@@ -26,7 +26,7 @@ class FpJobScanController(http.Controller):
         # Otherwise (operator) → land on process tree client action
         # (will be wired once process tree is added).
         user = request.env.user
-        is_manager = user.has_group('fusion_plating.group_fusion_plating_manager')
+        is_manager = user.has_group('fusion_plating.group_fp_manager')
         if is_manager:
             return request.redirect(
                 '/odoo/action-fusion_plating.action_fp_job/%d' % job.id

fusion_plating/fusion_plating_kpi/__manifest__.py

@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — KPI Dashboard',
-    'version': '19.0.1.1.1',
+    'version': '19.0.1.1.2',
     'category': 'Manufacturing/Plating',
     'summary': 'Configurable KPI dashboards for plating operations.',
     'author': 'Nexa Systems Inc.',

fusion_plating/fusion_plating_kpi/views/fp_menu.xml

@@ -6,12 +6,12 @@
 -->
 <odoo>
 
-    <!-- Phase 3 — supervisor+ only. Operators don't need dashboards. -->
+    <!-- Phase D (perms v2) — Manager+ only. Operators don't need dashboards. -->
     <menuitem id="menu_fp_dashboard"
               name="KPIs"
               parent="fusion_plating.menu_fp_root"
               sequence="85"
-              groups="fusion_plating.group_fusion_plating_supervisor"/>
+              groups="fusion_plating.group_fp_manager"/>
 
     <menuitem id="menu_fp_kpis"
               name="KPIs"

fusion_plating/fusion_plating_nuclear/__manifest__.py

@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Nuclear (CSA N299, NQA-1)',
-    'version': '19.0.1.2.1',
+    'version': '19.0.1.2.2',
     'category': 'Manufacturing/Plating',
     'summary': 'Nuclear industry pack: CSA N299 Levels 1-4, NQA-1 awareness, '
                'CNSC licence tracking, 10 CFR Part 21 reporting, ITPs, '

fusion_plating/fusion_plating_nuclear/views/fp_menu.xml

@@ -7,11 +7,12 @@
 <odoo>
 
     <!-- Phase 1 — re-parented under Plating → Compliance hub. -->
+    <!-- Phase D (perms v2) — QM-only under compliance hub. -->
     <menuitem id="menu_fp_nuclear"
               name="Nuclear (CSA N299 / CNSC)"
               parent="fusion_plating.menu_fp_compliance_hub"
               sequence="40"
-              groups="fusion_plating.group_fusion_plating_operator"/>
+              groups="fusion_plating.group_fp_quality_manager"/>
 
     <menuitem id="menu_fp_nuclear_program"
               name="N299 Programs"

fusion_plating/fusion_plating_quality/__manifest__.py

@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Quality (QMS)',
-    'version': '19.0.6.6.2',
+    'version': '19.0.6.6.6',
     'category': 'Manufacturing/Plating',
     'summary': 'Native QMS for plating shops: NCR, CAPA, calibration, AVL, FAIR, '
                'internal audits, customer specs, document control. CE + EE compatible.',

fusion_plating/fusion_plating_quality/models/fp_contract_review.py

@@ -371,7 +371,7 @@ class FpContractReview(models.Model):
     def action_reopen(self):
         """Clear all sign-off data and revert to draft. Manager only."""
         self.ensure_one()
-        if not self.env.user.has_group('fusion_plating.group_fusion_plating_manager'):
+        if not self.env.user.has_group('fusion_plating.group_fp_manager'):
             raise UserError(_(
                 'Only a Plating Manager can re-open a signed Contract Review.'
             ))
@@ -541,7 +541,7 @@ class FpContractReview(models.Model):
         waiting on a designated signer who is away.
         """
         self.ensure_one()
-        if self.env.user.has_group('fusion_plating.group_fusion_plating_manager'):
+        if self.env.user.has_group('fusion_plating.group_fp_manager'):
             return
         allowed = self.company_id._fp_get_qa_signers(section)
         if self.env.user not in allowed:

fusion_plating/fusion_plating_quality/views/fp_audit_views.xml

@@ -35,12 +35,17 @@
         <field name="arch" type="xml">
             <form string="Audit">
                 <header>
+                    <!-- Phase D5 — Audit is QM-only per spec section 2.C
+                         (Manager has read; QM owns CRUD + close). -->
                     <button name="action_start" string="Start Audit" type="object"
-                            class="oe_highlight" invisible="state != 'planned'"/>
+                            class="oe_highlight" invisible="state != 'planned'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_findings" string="Record Findings" type="object"
-                            invisible="state != 'in_progress'"/>
+                            invisible="state != 'in_progress'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_close" string="Close Audit" type="object"
-                            invisible="state not in ('findings','in_progress')"/>
+                            invisible="state not in ('findings','in_progress')"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="planned,in_progress,findings,closed"/>
                 </header>

fusion_plating/fusion_plating_quality/views/fp_avl_views.xml

@@ -38,14 +38,24 @@
         <field name="arch" type="xml">
             <form string="Approved Vendor">
                 <header>
+                    <!-- Phase D5 — AVL state transitions are QM-only per spec
+                         section 2.C (Manager has read; QM owns Add/Approve/
+                         Disqualify). Spec lists "Approve / Disqualify"; this
+                         model uses Approve + Suspend + Reinstate + Remove,
+                         which together implement the disqualify path. All
+                         four are gated. -->
                     <button name="action_approve" string="Approve" type="object"
-                            class="oe_highlight" invisible="state == 'approved'"/>
+                            class="oe_highlight" invisible="state == 'approved'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_suspend" string="Suspend" type="object"
-                            invisible="state in ('suspended','removed')"/>
+                            invisible="state in ('suspended','removed')"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reinstate" string="Reinstate" type="object"
-                            invisible="state != 'suspended'"/>
+                            invisible="state != 'suspended'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_remove" string="Remove" type="object"
-                            invisible="state == 'removed'"/>
+                            invisible="state == 'removed'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="pending,approved,conditional,suspended,removed"/>
                 </header>

fusion_plating/fusion_plating_quality/views/fp_capa_views.xml

@@ -35,20 +35,30 @@
         <field name="arch" type="xml">
             <form string="CAPA">
                 <header>
+                    <!-- Phase D5 — every state-transition button is QM-only.
+                         Per spec section 2.C, Manager has read+comment only;
+                         QM owns CRUD + close + effectiveness verification. -->
                     <button name="action_start_analysis" string="Start Analysis" type="object"
-                            class="oe_highlight" invisible="state != 'draft'"/>
+                            class="oe_highlight" invisible="state != 'draft'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_start_implementation" string="Implement" type="object"
-                            invisible="state != 'analysis'"/>
+                            invisible="state != 'analysis'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_start_verification" string="Verify" type="object"
-                            invisible="state != 'implementation'"/>
+                            invisible="state != 'implementation'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_mark_effective" string="Mark Effective" type="object"
-                            class="oe_highlight" invisible="state != 'verification'"/>
+                            class="oe_highlight" invisible="state != 'verification'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_mark_not_effective" string="Not Effective" type="object"
-                            invisible="state != 'verification'"/>
+                            invisible="state != 'verification'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_close" string="Close" type="object"
-                            invisible="state not in ('effective','not_effective')"/>
+                            invisible="state not in ('effective','not_effective')"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reset_to_draft" string="Reset" type="object"
-                            invisible="state == 'draft'"/>
+                            invisible="state == 'draft'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="draft,analysis,implementation,verification,effective,closed"/>
                 </header>
@@ -57,33 +67,48 @@
                         <label for="name"/>
                         <h1><field name="name" readonly="1"/></h1>
                     </div>
+                    <!-- Phase D5 — editable fields readonly for non-QM. Per
+                         spec section 2.C, Manager retains read+comment only;
+                         QM owns CRUD. Form stays visible (Manager needs to
+                         read + chatter); only the inputs lock for non-QM. -->
                     <group>
                         <group>
-                            <field name="type"/>
-                            <field name="ncr_id"/>
+                            <field name="type"
+                                  />
+                            <field name="ncr_id"
+                                  />
                             <field name="facility_id" readonly="1"/>
-                            <field name="owner_id"/>
+                            <field name="owner_id"
+                                  />
                         </group>
                         <group>
-                            <field name="due_date"/>
+                            <field name="due_date"
+                                  />
                             <field name="is_overdue" readonly="1"/>
-                            <field name="verification_date"/>
-                            <field name="verification_by_id"/>
+                            <field name="verification_date"
+                                  />
+                            <field name="verification_by_id"
+                                  />
                             <field name="is_effective" readonly="1"/>
                         </group>
                     </group>
                     <notebook>
                         <page string="Description">
-                            <field name="description"/>
+                            <field name="description"
+                                  />
                         </page>
                         <page string="Root Cause Analysis">
-                            <field name="root_cause_analysis" placeholder="5 Whys, fishbone, or any other structured method."/>
+                            <field name="root_cause_analysis"
+                                   placeholder="5 Whys, fishbone, or any other structured method."
+                                  />
                         </page>
                         <page string="Action Plan">
-                            <field name="action_plan"/>
+                            <field name="action_plan"
+                                  />
                         </page>
                         <page string="Effectiveness">
-                            <field name="effectiveness_notes"/>
+                            <field name="effectiveness_notes"
+                                  />
                         </page>
                     </notebook>
                 </sheet>

fusion_plating/fusion_plating_quality/views/fp_customer_spec_views.xml

@@ -32,34 +32,49 @@
             <form string="Customer Specification">
                 <sheet>
                     <div class="oe_title">
+                        <!-- Phase D5 — Customer Spec is QM-only for edits per
+                             spec section 2.C (Manager has read + attach to
+                             parts; QM owns CRUD as library curator). Form
+                             stays visible — only inputs lock for non-QM. -->
                         <label for="name"/>
-                        <h1><field name="name"/></h1>
+                        <h1><field name="name"
+                                  /></h1>
                     </div>
                     <group>
                         <group>
-                            <field name="code"/>
-                            <field name="revision"/>
-                            <field name="spec_type"/>
-                            <field name="partner_id"/>
+                            <field name="code"
+                                  />
+                            <field name="revision"
+                                  />
+                            <field name="spec_type"
+                                  />
+                            <field name="partner_id"
+                                  />
                         </group>
                         <group>
-                            <field name="effective_date"/>
-                            <field name="document_url" widget="url"/>
+                            <field name="effective_date"
+                                  />
+                            <field name="document_url" widget="url"
+                                  />
                         </group>
                     </group>
                     <group string="Applicable Processes" name="applicable_processes">
-                        <field name="process_type_ids" widget="many2many_tags" nolabel="1"/>
+                        <field name="process_type_ids" widget="many2many_tags" nolabel="1"
+                              />
                     </group>
                     <group string="Applicable Recipes" name="applicable_recipes">
                         <field name="recipe_ids" widget="many2many_tags" nolabel="1"
-                               options="{'no_create_edit': True}"/>
+                               options="{'no_create_edit': True}"
+                              />
                     </group>
                     <group>
-                        <field name="print_on_cert"/>
+                        <field name="print_on_cert"
+                              />
                     </group>
                     <notebook>
                         <page string="Notes">
-                            <field name="notes"/>
+                            <field name="notes"
+                                  />
                         </page>
                     </notebook>
                 </sheet>

fusion_plating/fusion_plating_quality/views/fp_fair_views.xml

@@ -38,12 +38,20 @@
         <field name="arch" type="xml">
             <form string="First Article Inspection Report">
                 <header>
+                    <!-- Phase D5 — FAIR Approve/Reject = sign-off equivalent;
+                         QM-only per spec section 2.C (FAIR/Nadcap signing is
+                         restricted to Quality Manager regardless of who can
+                         see / create the FAIR record). Submit-for-review and
+                         reset-to-draft stay open to whoever created the FAIR
+                         (Manager+). -->
                     <button name="action_submit_for_review" string="Submit for Review" type="object"
                             class="oe_highlight" invisible="state != 'draft'"/>
                     <button name="action_approve" string="Approve" type="object"
-                            class="oe_highlight" invisible="state != 'in_review'"/>
+                            class="oe_highlight" invisible="state != 'in_review'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reject" string="Reject" type="object"
-                            invisible="state != 'in_review'"/>
+                            invisible="state != 'in_review'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reset_to_draft" string="Reset" type="object"
                             invisible="state == 'draft'"/>
                     <field name="state" widget="statusbar"

fusion_plating/fusion_plating_quality/views/fp_menu.xml

@@ -11,7 +11,7 @@
               name="Quality"
               parent="fusion_plating.menu_fp_root"
               sequence="30"
-              groups="fusion_plating.group_fusion_plating_operator"/>
+              groups="fusion_plating.group_fp_manager"/>
 
     <menuitem id="menu_fp_quality_hold"
               name="Quality Holds"
@@ -47,7 +47,8 @@
               name="Internal Audits"
               parent="menu_fp_quality"
               action="action_fp_audit"
-              sequence="40"/>
+              sequence="40"
+              groups="fusion_plating.group_fp_quality_manager"/>
 
     <menuitem id="menu_fp_quality_doc_control"
               name="Document Control"
@@ -79,12 +80,14 @@
               name="Specifications"
               parent="menu_fp_quality"
               action="action_fp_customer_spec"
-              sequence="70"/>
+              sequence="70"
+              groups="fusion_plating.group_fp_quality_manager"/>
 
     <menuitem id="menu_fp_config_avl"
               name="Approved Vendor List"
               parent="fusion_plating.menu_fp_config_quality_docs"
               action="action_fp_avl"
-              sequence="20"/>
+              sequence="20"
+              groups="fusion_plating.group_fp_quality_manager"/>
 
 </odoo>

fusion_plating/fusion_plating_quality/views/fp_quality_dashboard_views.xml

@@ -12,6 +12,7 @@
         <field name="name">Quality Dashboard</field>
         <field name="tag">fp_quality_dashboard</field>
         <field name="target">current</field>
+        <field name="x_fc_pickable_landing" eval="True"/>
     </record>
 
     <menuitem id="menu_fp_quality_dashboard"

fusion_plating/fusion_plating_receiving/__manifest__.py

@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Receiving & Inspection',
-    'version': '19.0.3.28.1',
+    'version': '19.0.3.28.2',
     'category': 'Manufacturing/Plating',
     'summary': 'Parts receiving, inspection, damage logging, and manufacturing gate.',
     'description': """

fusion_plating/fusion_plating_receiving/views/fp_receiving_menu.xml

@@ -29,7 +29,7 @@
               name="Shipping & Receiving"
               parent="fusion_plating.menu_fp_root"
               sequence="15"
-              groups="group_fp_receiving"/>
+              groups="fusion_plating.group_fp_shop_manager_v2"/>
 
     <!-- Inbound (sequences 10–30) -->
     <menuitem id="menu_fp_receiving_all"

fusion_plating/fusion_plating_safety/__manifest__.py

@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Safety (EHS)',
-    'version': '19.0.1.3.1',
+    'version': '19.0.1.3.2',
     'category': 'Manufacturing/Plating',
     'summary': 'Occupational health and safety for plating shops: SDS library, '
                'WHMIS/TDG training, exposure monitoring, JHSC, incidents, PPE, '

fusion_plating/fusion_plating_safety/views/fp_menu.xml

@@ -7,11 +7,12 @@
 <odoo>
 
     <!-- Phase 1 — re-parented under Plating → Compliance hub. -->
+    <!-- Phase D (perms v2) — QM-only under compliance hub. -->
     <menuitem id="menu_fp_safety_root"
               name="Safety / WHMIS"
               parent="fusion_plating.menu_fp_compliance_hub"
               sequence="20"
-              groups="fusion_plating.group_fusion_plating_operator"/>
+              groups="fusion_plating.group_fp_quality_manager"/>
 
     <menuitem id="menu_fp_safety_sds"
               name="SDS Library"

fusion_plating/fusion_plating_shopfloor/__manifest__.py

@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Shop Floor',
-    'version': '19.0.32.0.1',
+    'version': '19.0.32.0.6',
     'category': 'Manufacturing/Plating',
     'summary': 'Shop-floor tablet stations, QR scanning, bake window enforcer, '
                'first-piece inspection gates.',

fusion_plating/fusion_plating_shopfloor/controllers/tablet_controller.py

@@ -24,7 +24,7 @@ _logger = logging.getLogger(__name__)
 
 def _is_manager(env):
     """True if calling user is in the fusion_plating manager group."""
-    return env.user.has_group('fusion_plating.group_fusion_plating_manager')
+    return env.user.has_group('fusion_plating.group_fp_manager')
 
 
 # ===== 2026-05-24 lock-screen redesign helpers =========================
@@ -217,12 +217,19 @@ class FpTabletController(http.Controller):
     @http.route('/fp/tablet/tiles', type='jsonrpc', auth='user')
     def tiles(self, station_id=None):
         env = request.env
+        # Phase 1 permissions overhaul (2026-05-24): post-migration users
+        # hold the new group_fp_technician (old group_fusion_plating_operator
+        # is still reachable via implication but DIRECT memberships moved to
+        # the new group). Point the tile grid at Technician — higher roles
+        # (Shop Manager / Manager / QM / Owner) imply Technician and so
+        # are included automatically via res.groups.user_ids (which surfaces
+        # both direct AND implied memberships).
         op_group = env.ref(
-            'fusion_plating.group_fusion_plating_operator',
+            'fusion_plating.group_fp_technician',
             raise_if_not_found=False,
         )
         if not op_group:
-            return {'ok': False, 'error': 'operator group missing'}
+            return {'ok': False, 'error': 'technician group missing'}
 
         # Determine candidate users — station roster wins if non-empty
         users = op_group.user_ids

fusion_plating/fusion_plating_shopfloor/static/src/scss/_tablet_lock_tokens.scss

@@ -44,9 +44,14 @@ $_lock-pulse-dot-border-hex:     #ffffff;
     $_lock-tile-hover-bg-rgba:       rgba(240, 165, 0, 0.10) !global;
     $_lock-tile-hover-border-rgba:   rgba(240, 165, 0, 0.40) !global;
     $_lock-tile-hover-shadow:        (0 12px 24px rgba(240, 165, 0, 0.15), 0 0 0 1px rgba(240, 165, 0, 0.2)) !global;
-    $_lock-frame-bg-rgba:            rgba(255, 255, 255, 0.08) !global;
-    $_lock-frame-border-rgba:        rgba(255, 255, 255, 0.10) !global;
-    $_lock-frame-shadow:             (0 8px 24px rgba(0, 0, 0, 0.30), inset 0 1px 0 rgba(255, 255, 255, 0.08)) !global;
+    // Logo frame in dark mode: near-opaque WHITE plate (matches light-mode
+    // intent) so company logos designed for light backgrounds render
+    // correctly. The previous 0.08-alpha glass effect made dark-on-white
+    // logos (and faded-white-on-transparent ones) effectively invisible
+    // because the dark page bled through.
+    $_lock-frame-bg-rgba:            rgba(255, 255, 255, 0.95) !global;
+    $_lock-frame-border-rgba:        rgba(255, 255, 255, 0.20) !global;
+    $_lock-frame-shadow:             (0 8px 24px rgba(0, 0, 0, 0.45), inset 0 1px 0 rgba(255, 255, 255, 0.40)) !global;
     $_lock-status-clocked-hex:       #34c759 !global;
     $_lock-status-pin-hex:           #ff9f0a !global;
     $_lock-pulse-dot-border-hex:     #2d3138 !global;

fusion_plating/fusion_plating_shopfloor/static/src/scss/components/_pin_pad.scss

@@ -17,7 +17,13 @@ $_pin-dot-fill-hex: #1d1d1f;
     $_pin-key-bg-hex:    #2d3138 !global;
     $_pin-key-hover-hex: #3a3f48 !global;
     $_pin-border-hex:    #424245 !global;
-    $_pin-dot-fill-hex:  #f5f5f7 !global;
+    // Empty dot: dark gray that blends into the panel but is still
+    // visible; Filled dot: bright white for strong contrast. Previous
+    // version left empty at light gray (#d8dadd) and set filled to
+    // off-white (#f5f5f7) — both light colours, indistinguishable from
+    // each other on the dark panel so user couldn't see PIN progress.
+    $_pin-dot-hex:       #424245 !global;
+    $_pin-dot-fill-hex:  #ffffff !global;
 }
 
 .o_fp_pin_pad {

fusion_plating/fusion_plating_shopfloor/views/fp_menu.xml

@@ -11,12 +11,13 @@
               name="Shop Floor"
               parent="fusion_plating.menu_fp_root"
               sequence="12"
-              groups="fusion_plating.group_fusion_plating_operator"/>
+              groups="fusion_plating.group_fp_technician"/>
 
     <!-- Manager Desk — assign workers, swap tanks, cover no-shows -->
     <record id="action_fp_manager_dashboard" model="ir.actions.client">
         <field name="name">Manager Desk</field>
         <field name="tag">fp_manager_dashboard</field>
+        <field name="x_fc_pickable_landing" eval="True"/>
     </record>
 
     <menuitem id="menu_fp_shopfloor_manager"

fusion_plating/fusion_plating_shopfloor/views/fp_plant_overview_views.xml

@@ -40,6 +40,7 @@
         <field name="name">Shop Floor</field>
         <field name="tag">fp_plant_kanban</field>
         <field name="target">main</field>
+        <field name="x_fc_pickable_landing" eval="True"/>
     </record>
 
 </odoo>