feat(sales): show what each order still owes, and filter the list to unpaid

[mforce]

Why

The Orders list could not answer "which orders has nobody paid yet". Status cannot stand in for it: Confirmed means both "settled" and "owes everything", so a farm had to open orders one at a time. This adds an Outstanding column and an Unpaid only filter beside it.

The figure is one C# expression used for both the displayed value and the filter predicate, so the two cannot drift. It compiles to CASE WHEN "Status" = 'Confirmed' THEN "TotalMinorUnits" - (correlated sum over non-voided payments) END, which yields SQL NULL off Confirmed; NULL > 0 is untrue, so Draft, Cancelled and Voided fall out of the filter structurally rather than through a second status predicate. One query, no migration.

Closes #769

Scope

• ISalesOrderRepository.ListAsync takes SalesOrderListFilter and returns SalesOrderListRow. SettlementScope is Hidden | Visible | UnpaidOnly, which makes "hide the money but filter by it" unrepresentable; Hidden emits SQL that never names Payments.
• SaleEndpoints.ListSalesOrders gains bool? unpaid. SalesOrderResponse gains long? OutstandingMinorUnits. GetSalesOrder carries the same figure, per the existing "detail and list must answer identically" rule.
• SalesPage.tsx renders the column after Total and owns the filter as unpaid=1 in the URL. onRecordPayment and onVoidPayment now wrap in orders.runWrite, because a payment-derived figure on the list made both handlers writers of it.
• GLOSSARY.md, the Help prose and helpGlossary.ts in en/es/tl.

Tradeoffs

The money tier reads AuthPolicies.SalesAccess through IAuthorizationService rather than a new Roles predicate. That policy already gates the three payment routes, so a second encoding would let this column disagree with /customers/balances about who may see money. statusFilter stays local state while customerId and unpaid live in the URL, so a shared link restores two filters of three. Moving status is a separate slice.

Blast Radius

The list route stays SalesFlow, so Workers keep building orders. The money inside the response is gated separately: a Worker's rows carry no figure and unpaid=true from a Worker is a 403, never a quietly different answer.

Verification

Build clean at zero warnings. Domain 491, Application 290, AppHost 10, web 2907, and the five model-only SalesOrderListQueryTests all pass.

The integration suite passes in CI (Build and test, 10m32s), which covers the tier gate, the server-side unpaid predicate, the voided-payment exclusion and the new Cancelled and Voided cases. The Playwright smoke suite passes locally against a stack rebuilt at this head, 41 tests.

Four mutations were run by hand and each went red on the intended guard: running the settlement query under Hidden; dropping the SPA tier gate; deleting the Payments tenant filter; and weakening the unpaid predicate to TotalMinorUnits > 0. The last two were found by adversarial review, which also caught the stale-list defect above and a false "admin-only" claim about /customers/balances.

The E2E failure on the first push was the spec, not the product: the filter's state lives in the URL, React Router v7 commits that navigation inside startTransition, and Playwright's check() verifies the checked state in the same frame. Measured on the running stack, the box settles true at 57ms, keeps it, and its DOM node is never replaced. The spec now clicks and asserts the outcome with a retrying expect.

Before/after screenshots are attached in a comment below.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: c9bf79ed-20a0-4a2a-b0f5-b8075fb3f42f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mforce]

Screenshots (#662)

Captured at 1:1, 1280x720, Sales persona, from stacks rebuilt for each side: origin/main (455e673) for the before, this branch's head for the after.

Before — the Orders list ends at Total. Nothing on the row says whether the money arrived.

After, no filter — an Outstanding column sits after Total, with a glossary link.

After, Unpaid only ticked — the list narrows to orders still owing. SO-07B2E7D3 shows $8.10 outstanding against a $16.20 total with "part of this order is paid" beneath it, which is the partial state; the rest show the full total outstanding.