Build docket: cupsfactory.om

The multi-storefront engine is built and reviewed, 22 commits after a final adversarial pass found three Criticals that were fixed. It is what lets cupsbyaa and cupsfactory share one set of books while staying separately trackable, which is exactly what “cupsfactory sits under cupsbyaa financially” requires. Not re-listed as tasks.

Done. A Paper & Pen tenant with its own database and its own general ledger, serving two storefronts. BHD's ERP is not touched. The monthly BHD↔CupsByAA intercompany settlement continues unchanged, because the two stay separate entities.

1. 01

   ✓Provision the cupsbyaa P&P tenant

   erp-tenancy Tenant provisioned on production. DB pnp_tenant_cupsbyaa. The Oman profile seeded a 5% VAT default onto a business with no VAT certificate; the script disabled it.

2. 02

   ✓Decide and register the ERP host

   erp.cupsbyaa.com is LIVE: DNS, certificate, nginx vhost, tenant map and a verified customdomains row. Isolation proven: X-Storefront cupsfactory returns 200 there, bhdoman returns 400 because that brand lives in BHD’s tenant.

3. 03

   ✓Seed the storefront registry for this tenant

   Script shipped and proven: the bhd set is seeded on staging AND production. The cupsbyaa set runs once the tenant exists.

4. 04

   ✓Chart of accounts for CupsByAA

   erp-finance Its own COA. Do not copy BHD's seed endpoint, which is gated to the bhd tenant for exactly this reason.

5. 05

   !Opening balances and cutover date

   needs Ali Real figures from the accountant. I will not derive these.

6. 06

   ✓Company identity: CR, VATIN, address, bank

   Verbatim from CR 1393567: Cups for Trade, South Al Hayl Al Seeb, reg 1393567, tax 1742971, VAT number deliberately EMPTY.

7. 07

   ✓Tenant branding: logo, colours, PDF letterhead

   Tenant branding and email templates seeded with the brand orange.

8. 08

   ✓Module entitlements

   growth plan. Manufacturing stays with BHD: Cups orders already mirror there as ManufacturingOrders.

9. 09

   Migrate the cup product catalogue

   erp-sales Sizes, variants, lids, sleeves, the BOM. Yield derived from the fitted dieline, never retyped.

10. 10

    Migrate the pricing ladders

    Published tiers with lineTotal preserved exactly. A tier's total is authoritative; do not re-derive it from a unit rate.

11. 11

    Create the CupsFactory wholesale price list

    A real PriceList of type wholesale, attached to the cupsfactory storefront. Until it exists, cupsfactory prices at retail by design.

12. 12

    Migrate customers and open balances from the Laravel app

    Dedupe on phone and email. Exclude the abandoned-cart rows, which are not real orders.

13. 13

    Migrate order history

    Reconcile the dual orders / woocommerce_orders split, 776 twin rows, before importing. One row per real order.

14. 14

    Staff accounts and OTP login

    Provision the CupsByAA team on the new tenant. Roles mirrored from the Laravel admin.

The Cloudflare zone is active with zero DNS records. Everything here is greenfield.

1. 15

   ✓DNS: A and www, proxied

   cloudflare-api-call Point at the group VPS. Proxied orange-cloud.

2. 16

   ✓Cloudflare Origin CA certificate

   cf-origin-ca-cert Cloudflare Origin CA, apex + wildcard, valid to 2041. LE retired.

3. 17

   ✓nginx vhost on the VPS

   PHP-FPM 8.3 runs as www behind a www-data nginx. http2 on; is unknown to this nginx build.

4. 18

   Laravel app skeleton at the web root

   Correct ownership from the start. A Mac UID on the web root breaks checkout and every page still returns 200.

5. 19

   ✓Mail: DKIM, SPF, DMARC for cupsfactory.om

   bhd-mail MX, SPF, DMARC and a 2048-bit DKIM key are live. opendkim-testkey returns "key OK". DMARC rua points at a sink, never a person.

6. 20

   ✓Mailboxes: info@ and sales@

   info@ and sales@ created on the BHD mail stack, postfix resolves them, passwords stored gitignored.

7. 21

   ✓Deploy script with a fail-closed preflight

   deploy-project scripts/deploy.sh, fail-closed. It refuses openrsync (which rejects --chmod), sets 755/644 explicitly, then proves every file at ORIGIN before checking the edge, because a query string cannot reveal a stale edge. It caught the openrsync trap on first run.

8. 22

   ✓Staging host before production

   staging.cupsfactory.om is live on the same wildcard origin cert, so it needed no second certificate. noindex is enforced by an X-Robots-Tag header at the SERVER, not a meta tag, because a staging copy outranking production is a real way to lose a launch.

9. 23

   ✓ERP bridge credentials

   64-hex key set as a Setting on pnp_tenant_cupsbyaa, compared timing-safe, rotatable without a redeploy. Stored gitignored, never in git.

10. 24

    ✓Paymob merchant decision

    decided Same bank account, so CupsFactory runs on CupsByAA’s existing Paymob merchant. Settlement stays one reconciliation, not two.

Two inks and a bilingual lowercase wordmark is a tight brief, which is a gift. The whole identity has to come from type, spacing and paper, not from a colour palette. Arabic is set at parity with English in the logo, so it must be at parity on the site too.

1. 25

   ✓Extract logo masters from Final Logo.ai

   5 SVG variants and 9 PNGs from Final Logo.svg, with a usage spec. Full lockup dies below 90px, so a favicon needs its own mark (job 34).

2. 26

   ✓Identify the wordmark typeface

   5 SVGs and 9 PNGs shipped; no font name is embedded in the .ai, .pdf or .svg, so the face is characterised not identified. Single-storey geometric a rules out Montserrat, Nunito, DM Sans and Poppins.

3. 27

   ✓Host the type on fonts.bhd.om

   brand rule Figtree (variable 100-900) and Almarai both already hosted on fonts.bhd.om and now serving this page. No Google, no gstatic.

4. 28

   ✓Arabic face paired to the Latin

   Almarai, paired to Figtree and loaded from fonts.bhd.om. Set on :lang(ar) and [dir=rtl] in the token layer, so Arabic is chosen, not left to the browser.

5. 29

   ✓Build the token layer on design.bhd.om

   bhd-design themes/cupsfactory.css: brand inks, a measured 10-step orange ramp, semantic tokens, light and dark.

6. 30

   ✓Tailwind config bound to the tokens

   tailwind.tokens.js bound to the CSS variables, with the runtime-class purge trap safelisted.

7. 31

   ✓Wire FontAwesome Pro 7.2 from design.bhd.om/fa

   bhd-design Pinned to /fa/v7.2.0/, not /latest/, so a silent major bump cannot change glyphs under a live site. Verified 200.

8. 32

   ✓OMR rendering via BHDCurrency

   The official Central Bank Rial sign. Never the string “OMR”, never ‏ر.ع, never the generic ligature. Three decimals throughout.

9. 33

   ✓Accessible contrast pass on the two inks

   Measured. Orange on white is 3.00:1 and FAILS AA. Split the role: #dd7d00 for identity, #9f5a00 (5.33:1) for text and buttons.

10. 34

    ✓Favicon, app icons, maskable icon

    A mark drawn on a 64 grid, legible at 16px, in 8 sizes. Not a shrunken logo, because the lockup dies below 90px.

11. 35

    ✓Open Graph share card, 1200×630

    og-share-card Bilingual 1200x630 built from the real logo master, product drawn in the two inks so it needs no photography.

12. 36

    ✓Brand sheet for the team

    One A4 page, live at /brand-sheet.pdf. Carries the measured contrast numbers, so "do not put orange on white" is a fact on the page rather than an opinion.

The base is custom-v2.blade.php plus the OrderFormV2 Livewire component: pick a quantity, then compare what every cup costs at that quantity, then check out. The audit (job 37) established that v2 is a VIEW on a shared engine, so this phase rebuilds the view against that engine. Refactoring the engine is real work but it is shared with the live cupsbyaa.com surface, so it is deliberately NOT bundled in here.

1. 37

   ✓Audit v2 honestly before copying it

   Done, and it changes the plan: v2 is a VIEW, not an engine. OrderFormV2 is 46 lines subclassing a 2,291-line OrderForm, and 241 of the page’s 374 lines are inline CSS hardcoding CupsByAA pink ~30 times. So jobs 43-48 rebuild a view against the existing engine. Full audit in docs/v2-audit.md.

2. 38

   ✓Three creative directions, not one

   Three concepts that would each produce a different site: The Line (the factory is the product), Quantity First (the price board is the home page), Proof of Work (show the last thousand cups). Each names what it answers badly and what it needs that we do not have.

3. 39

   ✓Run the jury and pick a direction

   Quantity First wins 31 of 35, on a rubric weighting the trade question and buildability double. Its 3 on distinctiveness is recorded as a real finding, not softened: the build grafts Proof of Work’s palette discipline and The Line’s number treatment, neither of which adds a dependency it does not already have.

4. 40

   ✓Page architecture and routes

   Ten routes, each answering one trade question. /order is deliberately NOT noindex: on CupsByAA that flow sits behind noindex canonicalised onto /custom because it was an experiment, and copying that across would hide this site’s most important page. See docs/site-architecture.md.

5. 41

   ✓RTL as a first-class layout

   Logical properties throughout, ONE view per page serving both locales so the pair cannot drift (CupsByAA’s Arabic twins 404’d for months), numbers kept LTR inside RTL with bdi, and the phone chip stays LEFT in both directions.

6. 42

   ✓Hero: the factory thesis

   The quantity field IS the hero, with the cursor in it, plus the two grafts the jury required. Accepts what people actually type, including Arabic-Indic digits and the Arabic thousands separator. axe clean in both directions and both themes, and a token defect it exposed is fixed: every contrast figure in the palette had been measured against white while the page ground is --stock, so --ink-faint passed its own documentation at 4.52 and failed at 4.19 on the real ground.

7. 43

   ✓Quantity ladder, rebuilt

   Wrapping chip grid via auto-fill, never a scroller. 46px tap targets, tabular numerals, and the selected state uses the DARKER orange because white on #dd7d00 is 3.00:1 and fails AA.

8. 44

   ✓Trade-scale tiers

   Ladder runs to pallet quantities. CupsByAA starts at 20 because it serves a retail box buyer; a cafe chain orders by the pallet.

9. 45

   ✓Price board, rebuilt

   Two cards per row on the narrowest phone (140px minimum fits twice in a 324px column). Comparing side by side IS the page.

10. 46

    ✓Unavailable tiers stay readable

    A cup that cannot be made at the chosen quantity is dimmed but still states its real minimum, because that number is the answer the buyer needs.

11. 47

    ✓Best-value marker that is actually true

    markBestValue computes the lowest unit price from the engine’s own rows. A tie marks NOBODY, because an arbitrary winner is a lie.

12. 48

    ✓Live unit price and line total

    The component renders what the engine returned and computes nothing. At a published tier the total is authoritative and the unit price is derived from it; re-multiplying a rounded rate is what gets a draft rejected.

13. 49

    ✓To-scale size guide

    to-scale-size-guide Built and verified in a browser. Only ONE size is drawn, because only the 8oz has a physically measured die (derived: top 75.88, base 59.62, height 86.46 mm). The other five are listed as awaiting measurement rather than drawn from invented millimetres, since a buyer orders a pallet off this picture.

14. 50

    Product photography set

    Transparent-background cutouts, consistent lighting, one per SKU. Composited on the site's own ground.

15. 51

    ✓Artwork upload with real validation

    Checks a file against the real measured 8oz die: physical size vs blank+bleed, effective DPI at print size, live text not outlined, missing bleed. An unmeasured size returns no_die and refuses to check rather than guessing.

16. 52

    ✓Live cup preview from uploaded artwork

    Rendered SERVER side by the ERP, so the wrap is cone-accurate, the die geometry never reaches a browser, and a phone and a desktop show the same picture. The component renders what the engine returned and computes nothing.

17. 53

    ✓Dieline download per size

    Emits the fan blank as an SVG at true size, cut path on its own CutContour layer. Geometry is the fitted die, not an idealised sector. First render had bleed on the two arcs and none on the radial edges, which is exactly where the seam is.

18. 54

    ✓Digital proof and approval step

    Wired to the live proof chain: draft, render, approve. Approval is not optional, because checkout refuses any design without it, so a cart carrying only a draft token would fail at the till. Low resolution and an unverified die are both said BEFORE the customer commits.

19. 55

    ✓Phone field with country selector

    intl-phone-input ResizeObserver measures the chip when it becomes VISIBLE, replacing CupsByAA’s three guessed setTimeouts at 60/300/900ms. Chip stays LEFT in both directions; the input is forced LTR so the number does not reverse.

20. 56

    ✓Trade account application

    Built around a split the ERP already makes: legal details (CR, VATIN, address) go through ClientUpdateRequest for staff review, and credit is a request a human answers. creditLimit and paymentTerms are deliberately not on the ERP’s editable allowlist, and credit approval is per QUOTE because KYC and the signed agreement attach to a specific piece of business. VATIN is optional: requiring it would refuse every business under the 38,500 threshold.

21. 57

    ✓Logged-in trade pricing on the storefront

    The session token goes on every price call, not just at checkout. calculate-price takes optionalPortalAuth, so sending it IS the mechanism: with it the buyer’s price list resolves while browsing, without it they see retail right up until they pay, which reads as a bait and switch.

22. 58

    ✓Reorder from a past order

    A reorder is not a copy. Every line is re-priced through the engine, because carrying yesterday’s price forward is a promise that breaks at checkout, and a line whose design is gone comes back flagged rather than silently reordered as a blank cup.

23. 59

    ✓Order tracking page

    New ERP endpoint. An order is as far along as its LEAST advanced line, because it ships when the last line is done. And the customer never sees a step backwards: a QC reject correctly returns a job to printing internally, and a buyer who saw Ready become Printing reads it as us losing their order. No invented dates.

24. 60

    ✓Customer portal: quotes, invoices, statements

    Quotes, invoices, payments and the statement, all from ERP portal endpoints that already existed. The statement is fetched and handed over as a blob, never a plain link: a sandbox blocks a download a page starts itself, and a button that does nothing is worse than no button.

25. 61

    ✓Capability page: machines, capacity, lead times

    Structure written; the NUMBERS are blocked. Capacity and lead times need real figures from the floor, and a factory site that prints a round number nobody measured is one a buyer plans around. Honest framing included: 2.5oz is hand-pasted single wall, 4/6.5/8oz run in house, everything else is outsourced.

26. 62

    ✓Quality and food-safety page

    Standards researched and verified: there is NO cup-specific Gulf standard, so a cup is a generic food package under GSO 2231:2012, 839:2021 and 1863:2021, adopted by Oman dual-numbered. G-Mark does not cover cups. ISO 9001 is not a food safety scheme. Still blocked on the supplier spec sheet and a BRCGS or FSSC 22000 certificate belonging to Cups for Trade.

27. 63

    ✓Sample request flow

    Files a quote request, never a SampleOrder. SampleOrder carries totalCost, glPosted and a journal entry and spawns manufacturing orders, so a stranger must not be able to create one. No account and no OTP: someone asking for three cups to look at should not have to prove who they are first. No country-code allowlist either, so the first Jordanian customer works.

28. 64

    Motion pass

    One orchestrated moment beats scattered effects. Respect prefers-reduced-motion everywhere.

29. 65

    ✓Empty, loading and error states

    Every state designed. fetchOrError guarantees an error never renders as an empty result, because a money screen that swallows a 403 tells an operator they have no sales. No apologies in any message.

30. 66

    ✓WhatsApp contact and share links

    brand rule whatsappLink builds api.whatsapp.com/send?phone= and strips non-digits. assertNoBareWaMe throws on a wa.me link, so it cannot reach production.

31. 67

    ✓Short links for anything sent to a customer

    bhd-link-shortener shortLink FAILS rather than falling back to the long URL: silently sending the raw link is the exact failure the rule exists to prevent.

32. 68

    ✓Cookie and consent handling

    Decline is the default and both buttons are the same weight. No advertising category, because there are no advertising cookies and listing one to look thorough would misstate our own processing. Analytics fails closed: no decision is not permission, and the undecided visitor is the first-time visitor.

Every job here can lose a real order or misstate a real number, so each one gets a test that fails when it is wrong.

1. 69

   Paymob integration

   bhd-paymob Intentions API, 3DS, OmanNet. Merchant per job 24.

2. 70

   Apple Pay, including non-Safari desktop

   Apple's JS SDK plus the <apple-pay-button> component and a QR handoff.

3. 71

   Inline Pixel card form

   No hosted redirect. The checkout stays on cupsfactory.om.

4. 72

   Webhook with HMAC verification

   Idempotent. A replayed callback must never double-credit an invoice.

5. 73

   Bank transfer and credit-terms checkout

   Trade buyers often will not pay by card. Both paths must reach the same order.

6. 74

   Order pushes into the CupsByAA ERP

   Stamped storefront: cupsfactory, so it is separable in CupsByAA's own books.

7. 75

   Two-way production status sync

   Forward-only stage mapping. A stale webhook must never drag a printing job back to design.

8. 76

   Stale-order notification guard

   Moving an old job must not text a real customer “your order is ready” months later.

9. 77

   ✓VAT handling and the tax invoice

   CupsByAA's own VATIN on the document. Prices inclusive or exclusive, decided once and applied everywhere.

10. 78

    Abandoned-cart definition

    An unpaid unstarted cart is not an order. Exclude it from counts, or every dashboard inflates.

11. 79

    Order confirmation email and WhatsApp

    Deduped. A document header carrying a PNG returns a real message id and is never delivered.

12. 80

    End-to-end money test on staging

    A real card, a real order, a real ledger entry, then reversed. Not a mocked callback.

1. 81

   ✓Bilingual copy pass, written not translated

   Both locales written from the same brief, not machine-translated, and gated: scripts/copy-parity.mjs fails the build on a missing key, a lost {placeholder} or a Latin word left in the Arabic. Tested by injecting all three faults; the first version missed “per cup”, so the heuristic was tightened.

2. 82

   ✓Keyword and intent map

   16 clusters, EN + Omani Arabic. Trade intent is structural, not a filter: it always carries a procurement word, a unit word, a business qualifier or spec depth. So every trade page ends in Request a quote, never Add to cart, and trade does not share URLs with cupsbyaa.com’s retail funnel. No search volumes were available and none were invented.

3. 83

   Landing pages per product and city

   Real content per page. Thin doorway pages get dropped from the index.

4. 84

   ✓Structured data

   Organization, Product, Offer, FAQ and Breadcrumb builders. Deliberately NO aggregateRating and no review markup: we have no reviews, and inventing them is the commonest way a small site earns a penalty.

5. 85

   ✓hreflang for the EN and AR mirror

   Reciprocal en/ar with a correct x-default pointing at English, emitted in both the head tags and the sitemap.

6. 86

   ✓Sitemap and robots

   robots.txt and a 16-URL sitemap, generated not hand-maintained, with per-crawler rules that allow the AI engines deliberately. Both live and the XML parses.

7. 87

   ✓Canonicals

   /order canonicalises to ITSELF. On CupsByAA the same flow sits behind noindex canonicalised onto /custom, and copying that across would hide this site’s most important page from search.

8. 88

   ✓llms.txt, llms-full.txt, ai.txt

   bhd-aieo llms.txt and ai.txt live. llms.txt carries a “what we do not claim” section, so an answer engine has our own words for the limits rather than reconstructing them from third-party listings.

9. 89

   Entity and sameAs graph

   Ties cupsfactory.om to the group estate without leaking internal structure.

10. 90

    ✓IndexNow wired to deploy

    Fires from the deploy, after every file is proven at origin, so a crawl never lands on stale bytes. Refuses to submit an empty set, an off-host URL, or anything at all when the key file does not serve the key: IndexNow answers 202 and drops it silently, so a 202 is not evidence.

11. 91

    Google Search Console verification

    seo Token read from its own verify URL. No OAuth over DNS.

12. 92

    Bing verification, by API

    Same estate pattern already proven across 25 zones.

13. 93

    ✓Analytics and conversion events

    Seven funnel steps with a hard ALLOWLIST, so phone and email are dropped rather than sent. Steps dedupe per session, because a buyer who changes size three times is one buyer.

14. 94

    ✓Truth pass on every public claim

    verify-cited-claims Written FIRST, not last. Eight verified claims with their sources, and eight that must not appear until evidenced, including capacity, lead times, any certification and dimensions for the five unmeasured sizes.

Deterministic checks, not opinions. Each produces evidence that can be re-run.

1. 95

   ✓Responsive and overflow audit

   scripts/audit.mjs, four viewports from 320px. It NAMES the widest offending element and its overflow in px, not just “it scrolls”. Live site passes all four.

2. 96

   ✓Accessibility audit

   design-stack scripts/a11y.mjs runs axe at BOTH colour schemes plus a real keyboard Tab and a reduced-motion check. It found a h1→h3 skip on this page and 163 contrast violations. Both fixed. Now zero violations in both themes.

3. 97

   ✓Contrast audit against the two inks

   Measured, not eyeballed. Six pairs failed and every one is now fixed with headroom past 4.5:1. The worst was 1.83:1: the docket bar inverts in dark mode and its muted colour was a literal chosen for a dark bar.

4. 98

   Lighthouse to 100 on mobile

   Gate heavy effects on viewport width BEFORE any capability probe, or mobile pays for a desktop flourish.

5. 99

   Core Web Vitals on real hardware

   Watch CLS: a JS-driven nav with no cloak paints fully open until it boots.

6. 100

   ✓Link and asset audit

   Per-link status codes and a response listener that fails on any 4xx/5xx asset. Live site: no failing asset requests.

7. 101

   Playwright end-to-end suite

   add-e2e-tests Quantity, size, artwork, checkout, tracking. Both languages.

8. 102

   Cross-browser and real-device pass

   Safari iOS especially: Apple Pay and RTL both bite there first.

9. 103

   Security review

   Upload handling, rate limits, enumerable ids, secrets. Uploads are the exposed surface here.

10. 104

    Independent design jury before launch

    Scored against the chosen direction. Generic is a fail, not a note.

1. 105

   Staging sign-off

   Full suite, real payment, real ERP order, then reversed.

2. 106

   !Seed the registry on production

   manual step DATABASE=... npm run seed:storefronts -- cupsbyaa, in the same window as the deploy.

3. 107

   Cut over DNS and watch

   Origin, then edge with a real cache-buster. A stale edge can serve the old bytes while origin is correct.

4. 108

   Post-launch monitoring

   Uptime, checkout errors, webhook failures, mail deliverability. Alerts to a sink, not a person's inbox.

5. 109

   Log the launch and hand over

   What shipped, what is deferred, what needs watching in week one.