Initial commit: JDE Scoping Tool migration project

Set up repository with legacy .NET Framework 4.8 source (OLD/), new .NET 10 Blazor solution (NEW/), OpenSpec specifications, documentation, and project configuration.
2026-01-02 07:43:29 -05:00
commit 26ff8d9b4f
1761 changed files with 596509 additions and 0 deletions
@@ -0,0 +1,119 @@
+# OpenSpec Agent Guidelines
+
+## Conventions
+
+### Change IDs
+- Use verb-led identifiers (e.g., `add-user-auth`, `migrate-signalr`, `refactor-search`)
+- Keep IDs short but descriptive
+
+### Proposal Structure
+```
+changes/<change-id>/
+  proposal.md    # Summary, scope, acceptance criteria
+  tasks.md       # Ordered work items with checkboxes
+  design.md      # (optional) Architecture decisions
+  specs/         # Spec deltas organized by capability
+```
+
+### Spec Structure
+```
+specs/
+├── domain-models/      # Entity definitions
+├── database-schema/    # SQL Server tables for DbUp
+├── data-access/        # JDE/CMS/SQL repositories
+├── data-sync/          # Cache refresh scheduling
+├── search-processing/  # Criteria and query building
+├── excel-export/       # Result formatting
+└── web-api-auth/       # API endpoints and authentication
+```
+
+### Spec Template
+
+Each spec follows this structure:
+
+```markdown
+# <Functional Area> Specification
+
+## Overview
+Brief description of this area's purpose and scope.
+
+## Source Reference
+| Legacy Files | Purpose |
+|--------------|---------|
+| OLD/path/to/file.cs | What this file does |
+
+## Requirements
+
+### Requirement: <Name>
+<Behavior description - what it does, not how>
+
+#### Inputs
+- Parameter/data inputs
+
+#### Outputs
+- What is returned/produced
+
+#### Business Rules
+- Validation rules
+- Edge cases
+- Error conditions
+
+#### Scenarios
+**Scenario: <Happy path>**
+Given <context>
+When <action>
+Then <expected result>
+
+**Scenario: <Edge case>**
+Given <context>
+When <action>
+Then <expected result>
+
+## Migration Notes
+| Legacy Pattern | New Pattern | Rationale |
+|----------------|-------------|-----------|
+| Example legacy pattern | Example new pattern | Why the change |
+
+## Open Questions
+- Any ambiguities found during analysis
+```
+
+### Task Format
+```markdown
+- [ ] Task description
+  - Validation: How to verify completion
+  - Dependencies: What must be done first (if any)
+```
+
+## Session Workflow
+
+When writing specs, follow this workflow:
+
+1. **SCOPE** - Identify legacy files to analyze
+2. **ANALYZE** - Read files, extract behaviors and business rules
+3. **DRAFT** - Write spec.md following the template
+4. **REVIEW** - Use Codex MCP to validate accuracy and completeness
+5. **COMMIT** - Save to SPECS/specs/<area>/spec.md
+
+### Codex MCP Review
+
+After drafting each spec, use `mcp__codex__codex` to:
+- Cross-reference spec requirements against legacy source files
+- Identify any missed behaviors or edge cases
+- Verify business rules are accurately captured
+- Flag any ambiguities or gaps
+
+## Principles
+
+1. **Behavior-focused** - Document WHAT, reference OLD files for HOW
+2. **Scenario-driven** - Concrete examples using Given/When/Then
+3. **Migration-aware** - Inline notes for architecture changes
+4. **Traceable** - Every requirement links back to source files
+5. **Minimal scope** - Only what's needed for the change
+6. **Verifiable tasks** - Each task has clear completion criteria
+7. **Incremental progress** - Break large changes into smaller, shippable pieces
+8. **Design before code** - proposal.md and design.md before implementation
+
+## Execution Plan
+
+See `PLANS/legacy-spec-capture-plan.md` for the full execution plan with 7 session checklists.
@@ -0,0 +1,693 @@
+# Blazor UI Design
+
+## Overview
+
+This document describes the architecture and implementation approach for the Blazor WebAssembly user interface, including the component structure, state management, SignalR integration, and service layer design.
+
+## Architecture
+
+### High-Level Component Diagram
+
+```
+------------------------------------------------------------------+
+|                        App.razor                                   |
+|  - Router                                                         |
+|  - CascadingAuthenticationState                                   |
+------------------------------------------------------------------+
+                               |
+                               v
+------------------------------------------------------------------+
+|                      MainLayout.razor                              |
+|  - RadzenLayout (Header, Body, Footer)                            |
+|  - AuthorizeView for user display                                 |
+|  - Navigation links                                               |
+------------------------------------------------------------------+
+                               |
+        +----------------------+----------------------+
+        |                      |                      |
+        v                      v                      v
+----------------+    +------------------+    +------------------+
+| Login.razor    |    | Searches.razor   |    | RefreshStatus    |
+| (anonymous)    |    | SearchEdit.razor |    | .razor           |
+|                |    | SearchQueue.razor|    |                  |
+----------------+    +------------------+    +------------------+
+                               |
+                    +----------+-----------+
+                    |                      |
+                    v                      v
+          +------------------+    +------------------+
+          | Filter Panels    |    | Services         |
+          | (components)     |    | (DI injected)    |
+          +------------------+    +------------------+
+```
+
+### Project Structure
+
+```
+NEW/src/JdeScoping.Client/
+├── wwwroot/
+│   ├── index.html
+│   ├── css/
+│   │   └── app.css
+│   └── js/
+│       └── interop.js              # File download helper
+├── Layout/
+│   └── MainLayout.razor
+├── Pages/
+│   ├── Login.razor
+│   ├── NotAuthorized.razor
+│   ├── Searches.razor              # Home/Search list
+│   ├── SearchEdit.razor            # Create/Edit search
+│   ├── SearchQueue.razor
+│   └── RefreshStatus.razor
+├── Components/
+│   ├── FilterPanels/
+│   │   ├── TimeSpanFilterPanel.razor
+│   │   ├── WorkOrderFilterPanel.razor
+│   │   ├── ItemNumberFilterPanel.razor
+│   │   ├── ProfitCenterFilterPanel.razor
+│   │   ├── WorkCenterFilterPanel.razor
+│   │   ├── ComponentLotFilterPanel.razor
+│   │   ├── OperatorFilterPanel.razor
+│   │   └── PartOperationFilterPanel.razor
+│   └── Shared/
+│       └── LoadingIndicator.razor
+├── Services/
+│   ├── IAuthService.cs
+│   ├── AuthService.cs
+│   ├── ISearchService.cs
+│   ├── SearchService.cs
+│   ├── ILookupService.cs
+│   ├── LookupService.cs
+│   ├── IFileService.cs
+│   ├── FileService.cs
+│   ├── IRefreshStatusService.cs
+│   ├── RefreshStatusService.cs
+│   ├── IHubConnectionService.cs
+│   └── HubConnectionService.cs
+├── Auth/
+│   ├── AuthStateProvider.cs
+│   └── TokenStorageService.cs
+├── Models/
+│   ├── ValidCombination.cs
+│   ├── LoginModel.cs
+│   ├── SearchViewModel.cs
+│   ├── SearchCriteriaViewModel.cs
+│   ├── ItemViewModel.cs
+│   ├── ProfitCenterViewModel.cs
+│   ├── WorkCenterViewModel.cs
+│   ├── OperatorViewModel.cs
+│   ├── WorkOrderViewModel.cs
+│   ├── ComponentLotViewModel.cs
+│   ├── PartOperationViewModel.cs
+│   ├── DataUpdateViewModel.cs
+│   ├── SearchUpdate.cs
+│   └── StatusUpdate.cs
+├── _Imports.razor
+├── App.razor
+└── Program.cs
+```
+
+## Blazor WebAssembly Configuration
+
+### Program.cs Service Registration
+
+```csharp
+var builder = WebAssemblyHostBuilder.CreateDefault(args);
+builder.RootComponents.Add<App>("#app");
+builder.RootComponents.Add<HeadOutlet>("head::after");
+
+// Configure HttpClient for API calls
+builder.Services.AddScoped(sp => new HttpClient
+{
+    BaseAddress = new Uri(builder.HostEnvironment.BaseAddress)
+});
+
+// Radzen services
+builder.Services.AddRadzenComponents();
+builder.Services.AddScoped<DialogService>();
+builder.Services.AddScoped<NotificationService>();
+
+// Authentication
+builder.Services.AddAuthorizationCore();
+builder.Services.AddScoped<AuthenticationStateProvider, AuthStateProvider>();
+builder.Services.AddScoped<AuthStateProvider>();
+builder.Services.AddScoped<ITokenStorageService, TokenStorageService>();
+
+// Application services
+builder.Services.AddScoped<IAuthService, AuthService>();
+builder.Services.AddScoped<ISearchService, SearchService>();
+builder.Services.AddScoped<ILookupService, LookupService>();
+builder.Services.AddScoped<IFileService, FileService>();
+builder.Services.AddScoped<IRefreshStatusService, RefreshStatusService>();
+builder.Services.AddScoped<IHubConnectionService, HubConnectionService>();
+
+// Logging
+builder.Logging.SetMinimumLevel(LogLevel.Information);
+
+await builder.Build().RunAsync();
+```
+
+### App.razor Router Configuration
+
+```razor
+<CascadingAuthenticationState>
+    <Router AppAssembly="@typeof(App).Assembly">
+        <Found Context="routeData">
+            <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)">
+                <NotAuthorized>
+                    <RedirectToLogin />
+                </NotAuthorized>
+            </AuthorizeRouteView>
+            <FocusOnNavigate RouteData="@routeData" Selector="h1" />
+        </Found>
+        <NotFound>
+            <PageTitle>Not found</PageTitle>
+            <LayoutView Layout="@typeof(MainLayout)">
+                <p role="alert">Sorry, there's nothing at this address.</p>
+            </LayoutView>
+        </NotFound>
+    </Router>
+</CascadingAuthenticationState>
+```
+
+## State Management
+
+### AuthStateProvider
+
+Custom authentication state provider for JWT token-based auth:
+
+```csharp
+public class AuthStateProvider : AuthenticationStateProvider
+{
+    private readonly ITokenStorageService _tokenStorage;
+    private readonly HttpClient _httpClient;
+
+    public AuthStateProvider(ITokenStorageService tokenStorage, HttpClient httpClient)
+    {
+        _tokenStorage = tokenStorage;
+        _httpClient = httpClient;
+    }
+
+    public override async Task<AuthenticationState> GetAuthenticationStateAsync()
+    {
+        var token = await _tokenStorage.GetTokenAsync();
+        if (string.IsNullOrEmpty(token))
+        {
+            return new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity()));
+        }
+
+        _httpClient.DefaultRequestHeaders.Authorization =
+            new AuthenticationHeaderValue("Bearer", token);
+
+        var claims = ParseClaimsFromJwt(token);
+        var identity = new ClaimsIdentity(claims, "jwt");
+        return new AuthenticationState(new ClaimsPrincipal(identity));
+    }
+
+    public async Task NotifyAuthenticationStateChangedAsync()
+    {
+        NotifyAuthenticationStateChanged(GetAuthenticationStateAsync());
+    }
+
+    public async Task LogoutAsync()
+    {
+        await _tokenStorage.RemoveTokenAsync();
+        _httpClient.DefaultRequestHeaders.Authorization = null;
+        NotifyAuthenticationStateChanged(Task.FromResult(
+            new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity()))));
+    }
+
+    private IEnumerable<Claim> ParseClaimsFromJwt(string jwt)
+    {
+        var payload = jwt.Split('.')[1];
+        var jsonBytes = ParseBase64WithoutPadding(payload);
+        var keyValuePairs = JsonSerializer.Deserialize<Dictionary<string, object>>(jsonBytes);
+
+        return keyValuePairs!.Select(kvp => new Claim(kvp.Key, kvp.Value.ToString()!));
+    }
+
+    private byte[] ParseBase64WithoutPadding(string base64)
+    {
+        switch (base64.Length % 4)
+        {
+            case 2: base64 += "=="; break;
+            case 3: base64 += "="; break;
+        }
+        return Convert.FromBase64String(base64);
+    }
+}
+```
+
+### Token Storage Service
+
+Uses browser localStorage via JS interop:
+
+```csharp
+public interface ITokenStorageService
+{
+    Task<string?> GetTokenAsync();
+    Task SetTokenAsync(string token);
+    Task RemoveTokenAsync();
+}
+
+public class TokenStorageService : ITokenStorageService
+{
+    private readonly IJSRuntime _jsRuntime;
+    private const string TokenKey = "authToken";
+
+    public TokenStorageService(IJSRuntime jsRuntime)
+    {
+        _jsRuntime = jsRuntime;
+    }
+
+    public async Task<string?> GetTokenAsync()
+    {
+        return await _jsRuntime.InvokeAsync<string?>("localStorage.getItem", TokenKey);
+    }
+
+    public async Task SetTokenAsync(string token)
+    {
+        await _jsRuntime.InvokeVoidAsync("localStorage.setItem", TokenKey, token);
+    }
+
+    public async Task RemoveTokenAsync()
+    {
+        await _jsRuntime.InvokeVoidAsync("localStorage.removeItem", TokenKey);
+    }
+}
+```
+
+## SignalR Client Integration
+
+### IHubConnectionService
+
+```csharp
+public interface IHubConnectionService
+{
+    HubConnectionState State { get; }
+    event Action<SearchUpdate>? OnSearchUpdate;
+    event Action<StatusUpdate>? OnStatusUpdate;
+
+    Task StartAsync(CancellationToken ct = default);
+    Task StopAsync(CancellationToken ct = default);
+    Task<StatusUpdate?> GetCachedStatusAsync(CancellationToken ct = default);
+}
+```
+
+### HubConnectionService Implementation
+
+```csharp
+public class HubConnectionService : IHubConnectionService, IAsyncDisposable
+{
+    private readonly HubConnection _hubConnection;
+    private readonly ILogger<HubConnectionService> _logger;
+
+    public HubConnectionState State => _hubConnection.State;
+    public event Action<SearchUpdate>? OnSearchUpdate;
+    public event Action<StatusUpdate>? OnStatusUpdate;
+
+    public HubConnectionService(
+        NavigationManager navigation,
+        ILogger<HubConnectionService> logger)
+    {
+        _logger = logger;
+        _hubConnection = new HubConnectionBuilder()
+            .WithUrl(navigation.ToAbsoluteUri("/hubs/status"))
+            .WithAutomaticReconnect(new[]
+            {
+                TimeSpan.Zero,
+                TimeSpan.FromSeconds(2),
+                TimeSpan.FromSeconds(5),
+                TimeSpan.FromSeconds(10),
+                TimeSpan.FromSeconds(30)
+            })
+            .ConfigureLogging(logging =>
+            {
+                logging.SetMinimumLevel(LogLevel.Information);
+            })
+            .Build();
+
+        // Register message handlers
+        _hubConnection.On<SearchUpdate>("searchUpdate", update =>
+        {
+            _logger.LogDebug("Received searchUpdate: {SearchId} - {Status}",
+                update.ID, update.Status);
+            OnSearchUpdate?.Invoke(update);
+        });
+
+        _hubConnection.On<StatusUpdate>("statusUpdate", update =>
+        {
+            _logger.LogDebug("Received statusUpdate: {Message}", update.Message);
+            OnStatusUpdate?.Invoke(update);
+        });
+
+        // Handle reconnection events
+        _hubConnection.Reconnected += connectionId =>
+        {
+            _logger.LogInformation("SignalR reconnected: {ConnectionId}", connectionId);
+            return Task.CompletedTask;
+        };
+
+        _hubConnection.Reconnecting += error =>
+        {
+            _logger.LogWarning(error, "SignalR reconnecting...");
+            return Task.CompletedTask;
+        };
+
+        _hubConnection.Closed += error =>
+        {
+            _logger.LogWarning(error, "SignalR connection closed");
+            return Task.CompletedTask;
+        };
+    }
+
+    public async Task StartAsync(CancellationToken ct = default)
+    {
+        if (_hubConnection.State == HubConnectionState.Disconnected)
+        {
+            _logger.LogInformation("Starting SignalR connection...");
+            await _hubConnection.StartAsync(ct);
+            _logger.LogInformation("SignalR connected");
+        }
+    }
+
+    public async Task StopAsync(CancellationToken ct = default)
+    {
+        if (_hubConnection.State == HubConnectionState.Connected)
+        {
+            await _hubConnection.StopAsync(ct);
+            _logger.LogInformation("SignalR disconnected");
+        }
+    }
+
+    public async Task<StatusUpdate?> GetCachedStatusAsync(CancellationToken ct = default)
+    {
+        if (_hubConnection.State == HubConnectionState.Connected)
+        {
+            return await _hubConnection.InvokeAsync<StatusUpdate?>("GetCachedStatus", ct);
+        }
+        return null;
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        await _hubConnection.DisposeAsync();
+    }
+}
+```
+
+### SignalR Message Types
+
+```csharp
+public record SearchUpdate(
+    int ID,
+    string Name,
+    string UserName,
+    SearchStatus Status,
+    DateTime? SubmitDT,
+    DateTime? StartDT,
+    DateTime? EndDT);
+
+public record StatusUpdate(
+    string Message,
+    DateTime Timestamp);
+```
+
+## API Client Services
+
+### ISearchService
+
+```csharp
+public interface ISearchService
+{
+    Task<List<SearchViewModel>> GetUserSearchesAsync(CancellationToken ct = default);
+    Task<SearchViewModel> GetSearchAsync(int id, CancellationToken ct = default);
+    Task<SearchViewModel> CopySearchAsync(int id, CancellationToken ct = default);
+    Task<int> SaveSearchAsync(SearchViewModel search, CancellationToken ct = default);
+    Task<List<SearchViewModel>> GetQueueAsync(CancellationToken ct = default);
+    Task DownloadResultsAsync(int searchId, CancellationToken ct = default);
+}
+```
+
+### ILookupService
+
+```csharp
+public interface ILookupService
+{
+    Task<IEnumerable<ItemViewModel>> FindItemsAsync(string query, CancellationToken ct = default);
+    Task<IEnumerable<ProfitCenterViewModel>> FindProfitCentersAsync(string query, CancellationToken ct = default);
+    Task<IEnumerable<WorkCenterViewModel>> FindWorkCentersAsync(string query, CancellationToken ct = default);
+    Task<IEnumerable<OperatorViewModel>> FindOperatorsAsync(string query, CancellationToken ct = default);
+}
+```
+
+### IFileService
+
+```csharp
+public interface IFileService
+{
+    Task DownloadTemplateAsync(string templateType, CancellationToken ct = default);
+    Task<FileUploadResult<T>> UploadAsync<T>(IBrowserFile file, string endpoint, CancellationToken ct = default);
+}
+
+public record FileUploadResult<T>(
+    bool WasSuccessful,
+    string? ErrorMessage,
+    List<T>? Data);
+```
+
+## File Download via JS Interop
+
+### wwwroot/js/interop.js
+
+```javascript
+window.downloadFileFromStream = async (fileName, streamRef) => {
+    const arrayBuffer = await streamRef.arrayBuffer();
+    const blob = new Blob([arrayBuffer]);
+    const url = URL.createObjectURL(blob);
+    const anchor = document.createElement('a');
+    anchor.href = url;
+    anchor.download = fileName ?? '';
+    anchor.click();
+    anchor.remove();
+    URL.revokeObjectURL(url);
+};
+
+window.downloadFileFromUrl = (url, fileName) => {
+    const anchor = document.createElement('a');
+    anchor.href = url;
+    anchor.download = fileName ?? '';
+    anchor.click();
+    anchor.remove();
+};
+```
+
+### FileService Download Implementation
+
+```csharp
+public async Task DownloadResultsAsync(int searchId, CancellationToken ct)
+{
+    var response = await _httpClient.GetAsync($"/api/search/{searchId}/results", ct);
+    response.EnsureSuccessStatusCode();
+
+    var fileName = $"Search_{searchId}_Results.xlsx";
+    var content = await response.Content.ReadAsStreamAsync(ct);
+
+    using var streamRef = new DotNetStreamReference(content);
+    await _jsRuntime.InvokeVoidAsync("downloadFileFromStream", fileName, streamRef);
+}
+```
+
+## Filter Panel Component Pattern
+
+### Base Structure
+
+All filter panels follow a consistent pattern with:
+- Card container with title
+- Optional toolbar (Download Template, Upload Data, Clear Data)
+- Input controls (autocomplete, date picker, etc.)
+- Data grid of selected items
+- Count display
+
+### Two-Way Binding Pattern
+
+```razor
+@* ItemNumberFilterPanel.razor - simplified *@
+<RadzenCard>
+    <RadzenStack Gap="1rem">
+        <RadzenText TextStyle="TextStyle.H6" Text="Filter by item number" />
+
+        @if (!IsReadOnly)
+        {
+            <RadzenRow Gap="1rem" AlignItems="AlignItems.End">
+                <RadzenColumn Size="8">
+                    <RadzenAutoComplete @bind-Value="@selectedItemText"
+                                        Data="@itemSuggestions"
+                                        LoadData="@LoadItemSuggestions"
+                                        MinLength="3" />
+                </RadzenColumn>
+                <RadzenColumn Size="4">
+                    <RadzenButton Text="Add to filter" Click="@HandleAddItem" />
+                </RadzenColumn>
+            </RadzenRow>
+        }
+
+        <RadzenDataGrid Data="@Items" TItem="ItemViewModel">
+            <Columns>
+                <RadzenDataGridColumn Property="ItemNumber" Title="Item Number" />
+                <RadzenDataGridColumn Property="Description" Title="Description" />
+                @if (!IsReadOnly)
+                {
+                    <RadzenDataGridColumn Title="Actions" Width="100px">
+                        <Template Context="item">
+                            <RadzenButton Icon="delete" Click="@(() => HandleDeleteItem(item))" />
+                        </Template>
+                    </RadzenDataGridColumn>
+                }
+            </Columns>
+        </RadzenDataGrid>
+
+        <RadzenText Text="@($"# of item numbers: {Items.Count}")" />
+    </RadzenStack>
+</RadzenCard>
+
+@code {
+    [Parameter] public List<ItemViewModel> Items { get; set; } = new();
+    [Parameter] public EventCallback<List<ItemViewModel>> ItemsChanged { get; set; }
+    [Parameter] public bool IsReadOnly { get; set; }
+
+    private async Task HandleAddItem()
+    {
+        // Add item and notify parent
+        Items.Add(new ItemViewModel { ... });
+        await ItemsChanged.InvokeAsync(Items);
+    }
+
+    private async Task HandleDeleteItem(ItemViewModel item)
+    {
+        Items.Remove(item);
+        await ItemsChanged.InvokeAsync(Items);
+    }
+}
+```
+
+## Error Handling
+
+### Global Error Boundary
+
+```razor
+@* In MainLayout.razor *@
+<ErrorBoundary @ref="errorBoundary">
+    <ChildContent>
+        @Body
+    </ChildContent>
+    <ErrorContent Context="exception">
+        <RadzenAlert AlertStyle="AlertStyle.Danger" ShowIcon="true">
+            An error occurred. Please try again or contact support.
+            @if (Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT") == "Development")
+            {
+                <pre>@exception.Message</pre>
+            }
+        </RadzenAlert>
+    </ErrorContent>
+</ErrorBoundary>
+
+@code {
+    private ErrorBoundary? errorBoundary;
+
+    protected override void OnParametersSet()
+    {
+        errorBoundary?.Recover();
+    }
+}
+```
+
+### Service-Level Error Handling
+
+```csharp
+public class SearchService : ISearchService
+{
+    private readonly HttpClient _httpClient;
+    private readonly NotificationService _notificationService;
+    private readonly ILogger<SearchService> _logger;
+
+    public async Task<List<SearchViewModel>> GetUserSearchesAsync(CancellationToken ct)
+    {
+        try
+        {
+            return await _httpClient.GetFromJsonAsync<List<SearchViewModel>>(
+                "/api/search", ct) ?? new();
+        }
+        catch (HttpRequestException ex)
+        {
+            _logger.LogError(ex, "Failed to fetch user searches");
+            _notificationService.Notify(NotificationSeverity.Error,
+                "Error", "Failed to load searches. Please try again.");
+            return new();
+        }
+    }
+}
+```
+
+## Loading States
+
+### Component-Level Loading
+
+```razor
+@if (isLoading)
+{
+    <RadzenStack AlignItems="AlignItems.Center" JustifyContent="JustifyContent.Center"
+                 Style="min-height: 200px;">
+        <RadzenProgressBarCircular Mode="ProgressBarMode.Indeterminate" Size="60" />
+        <RadzenText Text="Loading..." />
+    </RadzenStack>
+}
+else
+{
+    @* Content *@
+}
+```
+
+### Grid-Level Loading
+
+```razor
+<RadzenDataGrid TItem="SearchViewModel" Data="@searches"
+                IsLoading="@isLoading" Style="min-height: 450px;">
+```
+
+## Radzen Component Reference
+
+| UI Element | Component | Key Properties |
+|------------|-----------|----------------|
+| Layout container | RadzenLayout | RadzenHeader, RadzenBody, RadzenFooter |
+| Navigation | RadzenLink, NavigationManager | Path, NavigateTo |
+| Data grid | RadzenDataGrid<T> | AllowPaging, AllowSorting, IsLoading |
+| Dropdown | RadzenDropDown<T> | Data, TextProperty, ValueProperty |
+| Autocomplete | RadzenAutoComplete | LoadData, MinLength |
+| Date picker | RadzenDatePicker | DateFormat, Min, Max |
+| Text input | RadzenTextBox | Placeholder, Disabled |
+| Password | RadzenPassword | Placeholder |
+| Button | RadzenButton | Text, Icon, ButtonStyle, IsBusy |
+| Card | RadzenCard | - |
+| Alert | RadzenAlert | AlertStyle, ShowIcon |
+| Badge | RadzenBadge | BadgeStyle, Text |
+| Progress | RadzenProgressBarCircular | Mode="Indeterminate" |
+| Dialog | DialogService | Confirm, Alert |
+| Notification | NotificationService | Notify |
+| File upload | RadzenUpload | Url, Accept, Complete |
+| Checkbox | RadzenCheckBox | @bind-Value |
+| Validation | EditForm + DataAnnotationsValidator | OnValidSubmit |
+
+## NuGet Dependencies
+
+The JdeScoping.Client project already includes required packages:
+
+```xml
+<ItemGroup>
+  <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="10.*" />
+  <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="10.*" />
+  <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" Version="10.*" />
+  <PackageReference Include="Radzen.Blazor" Version="8.*" />
+</ItemGroup>
+```
@@ -0,0 +1,111 @@
+# Implement Blazor UI
+
+## Summary
+
+Implement the Blazor WebAssembly user interface for the JDE Scoping Tool, migrating the legacy ASP.NET MVC 5 / Kendo UI implementation to modern Radzen Blazor components. This phase creates all pages (Login, Search List, Search Create/Edit, Search Queue, Refresh Status) and integrates SignalR for real-time status updates.
+
+## Scope
+
+### In Scope
+
+- Blazor WebAssembly project setup and configuration (already exists as JdeScoping.Client)
+- Radzen Blazor component library integration (already referenced)
+- Main layout with navigation header and footer
+- Authentication pages:
+  - Login page with LDAP authentication form
+  - Not Authorized page
+- Search pages:
+  - Search List page (user's searches with status badges)
+  - Search Create/Edit page with filter panels
+  - Search Queue page (all queued searches)
+- Refresh Status page (data sync dashboard)
+- Filter panel components:
+  - TimeSpan Filter Panel
+  - Work Order Filter Panel
+  - Item Number Filter Panel
+  - Profit Center Filter Panel
+  - Work Center Filter Panel
+  - Component Lot Filter Panel
+  - Operator Filter Panel
+  - Part/Operation/MIS Filter Panel
+- SignalR client service for real-time updates
+- API client services:
+  - IAuthService
+  - ISearchService
+  - ILookupService
+  - IFileService
+  - IRefreshStatusService
+- ValidCombination model (search type definitions)
+- State management via AuthStateProvider
+
+### Out of Scope
+
+- Backend API implementation (Phase 8: web-api-auth)
+- SignalR hub implementation (Phase 8: web-api-auth)
+- Unit tests for Blazor components (bUnit testing deferred)
+- Mobile-responsive design optimizations
+- Offline/PWA functionality
+- Dark mode theming
+
+## Motivation
+
+The legacy ASP.NET MVC 5 / Kendo UI implementation has several limitations:
+
+- **License cost**: Kendo UI requires commercial license
+- **Framework obsolescence**: ASP.NET MVC 5 is not actively developed
+- **JavaScript complexity**: Heavy jQuery-based scripting
+- **Page reload model**: Full page reloads for navigation
+
+Blazor WebAssembly with Radzen provides:
+
+- **Free tier**: Radzen Blazor community edition is open source
+- **Modern framework**: .NET 10 with full C# component model
+- **Type safety**: C# throughout, no JavaScript required for core functionality
+- **SPA experience**: No page reloads, smooth navigation
+- **SignalR integration**: Native .NET SignalR client
+
+## Acceptance Criteria
+
+1. All pages render correctly in modern browsers (Chrome, Firefox, Edge, Safari)
+2. Login page authenticates via backend API (mocked initially)
+3. Search List page displays user's searches with real-time status updates
+4. Search Create/Edit page:
+   - Search type dropdown controls filter panel visibility
+   - All 8 filter panel types functional
+   - Form validation prevents submission without required filters
+   - Read-only mode for submitted searches with Copy button
+5. Search Queue page displays all queued searches with processor status
+6. Refresh Status page displays data sync history with date filtering
+7. SignalR connection:
+   - Connects on page load
+   - Receives searchUpdate and statusUpdate events
+   - Reconnects automatically on disconnect
+8. All file upload/download flows functional (templates, data upload, results download)
+9. Navigation is same-window (no popups or new tabs)
+10. `openspec validate implement-blazor-ui --strict` passes
+
+## Dependencies
+
+- **Phase 8**: implement-web-api-auth - Backend API endpoints for authentication, search operations, file handling
+- **JdeScoping.Client project**: Already created with Blazor WASM and Radzen packages
+- **NuGet packages**:
+  - `Radzen.Blazor` Version="8.*" (already referenced)
+  - `Microsoft.AspNetCore.SignalR.Client` Version="10.*" (already referenced)
+  - `Microsoft.AspNetCore.Components.WebAssembly` Version="10.*" (already referenced)
+
+## Risks
+
+| Risk | Mitigation |
+|------|------------|
+| API not ready | Mock services return static/test data until Phase 8 complete |
+| SignalR connection issues | Implement robust reconnection with exponential backoff |
+| File download in WASM | Use JS interop for browser download trigger |
+| Large filter lists | Implement virtualization for autocomplete dropdowns |
+| Component complexity | Extract reusable filter panel base component |
+| Radzen version changes | Pin to specific minor version, test upgrades |
+
+## Related Specs
+
+- `web-ui` - Base specification for UI components and pages
+- `web-api-auth` - API endpoints that UI will consume
+- `domain-models` - ViewModels used in UI components
@@ -0,0 +1,328 @@
+# Web UI Specification Delta
+
+## Purpose
+
+This document captures ADDED and MODIFIED requirements for the Blazor WebAssembly user interface specific to the .NET 10 migration. It supplements the base specification at `openspec/specs/web-ui/spec.md`.
+
+## ADDED Requirements
+
+### Requirement: Blazor WebAssembly Hosting Model
+
+The system SHALL use Blazor WebAssembly (WASM) as the client-side hosting model.
+
+#### Business Rules
+
+- The client application SHALL run entirely in the browser via WebAssembly
+- The application SHALL communicate with the server exclusively via HTTP APIs and SignalR
+- The application SHALL NOT use server-side Blazor (SignalR for DOM updates)
+- Initial load SHALL include the .NET runtime and application assemblies
+- Subsequent navigation SHALL NOT require page reloads
+
+#### Scenario: Initial application load
+
+- **WHEN** a user navigates to the application URL
+- **THEN** the browser downloads the .NET WASM runtime
+- **AND** the Blazor application initializes in the browser
+- **AND** subsequent interactions do not trigger server-side rendering
+
+---
+
+### Requirement: JWT Token Authentication
+
+The system SHALL use JWT tokens for API authentication stored in browser localStorage.
+
+#### Inputs
+
+- Login credentials (username, password)
+- LDAP authentication endpoint
+
+#### Outputs
+
+- JWT token stored in localStorage
+- Claims extracted for AuthenticationState
+
+#### Business Rules
+
+- Tokens SHALL be stored in browser localStorage via JS interop
+- Tokens SHALL be automatically attached to outgoing HTTP requests
+- Token expiration SHALL trigger re-authentication prompt
+- Logout SHALL remove token from localStorage and clear auth state
+
+#### Scenario: Login stores JWT token
+
+- **WHEN** user submits valid credentials
+- **THEN** the API returns a JWT token
+- **AND** the token is stored in localStorage under key "authToken"
+- **AND** AuthStateProvider parses claims from the token
+- **AND** subsequent API requests include Authorization header
+
+#### Scenario: Token expiration
+
+- **WHEN** a stored token has expired
+- **AND** the user attempts an API call
+- **THEN** the API returns 401 Unauthorized
+- **AND** the user is redirected to the login page
+
+---
+
+### Requirement: Custom AuthenticationStateProvider
+
+The system SHALL implement a custom AuthenticationStateProvider for JWT-based authentication state.
+
+#### Business Rules
+
+- AuthStateProvider SHALL parse JWT claims without server round-trip
+- Claims SHALL include username, roles, and expiration
+- State changes SHALL notify Blazor components via NotifyAuthenticationStateChanged
+- Invalid/expired tokens SHALL result in anonymous state
+
+#### Scenario: Parse claims from JWT
+
+- **WHEN** AuthStateProvider initializes with a stored token
+- **THEN** it parses the token payload (base64-decoded JSON)
+- **AND** extracts claims into ClaimsPrincipal
+- **AND** sets authentication type to "jwt"
+
+---
+
+### Requirement: SignalR Auto-Reconnect
+
+The system SHALL implement automatic reconnection for SignalR connections with exponential backoff.
+
+#### Reconnection Schedule
+
+| Attempt | Delay |
+|---------|-------|
+| 1 | 0 seconds |
+| 2 | 2 seconds |
+| 3 | 5 seconds |
+| 4 | 10 seconds |
+| 5 | 30 seconds |
+
+#### Business Rules
+
+- SignalR client SHALL use WithAutomaticReconnect configuration
+- Reconnection attempts SHALL follow exponential backoff schedule
+- UI SHALL indicate connection state during reconnection
+- Events received during reconnection SHALL be delivered after reconnect
+
+#### Scenario: Network interruption recovery
+
+- **WHEN** the SignalR connection is lost
+- **THEN** the client attempts reconnection per the backoff schedule
+- **AND** logs reconnection attempts to console
+- **AND** upon successful reconnection, resumes receiving events
+
+---
+
+### Requirement: File Download via JS Interop
+
+The system SHALL use JavaScript interop for triggering browser file downloads.
+
+#### Business Rules
+
+- Excel result files SHALL be downloaded via JS interop function
+- Template files SHALL be downloaded via direct URL navigation
+- Downloaded files SHALL prompt browser save dialog
+- File names SHALL be specified by the server response headers
+
+#### JavaScript Functions
+
+| Function | Purpose |
+|----------|---------|
+| `downloadFileFromStream` | Download file from DotNetStreamReference |
+| `downloadFileFromUrl` | Download file from URL with filename |
+
+#### Scenario: Download search results
+
+- **WHEN** user clicks Download Results button
+- **THEN** API request fetches file as stream
+- **AND** JS interop triggers browser download dialog
+- **AND** file is saved with name "Search_{id}_Results.xlsx"
+
+---
+
+### Requirement: Radzen Component Library Integration
+
+The system SHALL use Radzen Blazor (free tier) for UI components.
+
+#### Service Registration
+
+- DialogService SHALL be registered for confirmation dialogs
+- NotificationService SHALL be registered for toast notifications
+- RadzenComponents SHALL be registered via AddRadzenComponents()
+
+#### CSS and JavaScript
+
+- Radzen CSS SHALL be included in index.html
+- No additional Radzen JavaScript required for core components
+
+#### Scenario: Register Radzen services
+
+- **WHEN** the application starts
+- **THEN** DialogService is available for injection
+- **AND** NotificationService is available for injection
+- **AND** Radzen component styles are applied
+
+---
+
+### Requirement: Async-First Service Design
+
+The system SHALL use async methods for all service operations.
+
+#### Business Rules
+
+- All HTTP client calls SHALL use async methods (GetFromJsonAsync, PostAsJsonAsync)
+- All service interfaces SHALL return Task or Task<T>
+- Cancellation tokens SHALL be accepted on all service methods
+- UI SHALL remain responsive during API calls
+
+#### Scenario: Async API call with loading state
+
+- **WHEN** user triggers a data load operation
+- **THEN** loading indicator displays immediately
+- **AND** API call executes asynchronously
+- **AND** UI updates when data arrives
+- **AND** loading indicator hides
+
+---
+
+### Requirement: ILogger Client-Side Logging
+
+The system SHALL use Microsoft.Extensions.Logging for client-side logging.
+
+#### Business Rules
+
+- All services SHALL accept ILogger<T> via constructor injection
+- Log levels SHALL be configurable in Program.cs
+- Logs SHALL output to browser console in development
+- Error logs SHALL include exception details
+
+#### Log Levels by Category
+
+| Category | Minimum Level |
+|----------|---------------|
+| Default | Information |
+| Microsoft.AspNetCore | Warning |
+| SignalR | Debug (dev) / Information (prod) |
+
+---
+
+### Requirement: Same-Window Navigation
+
+The system SHALL use same-window navigation for all internal links (no popups or new tabs).
+
+#### Business Rules
+
+- All internal navigation SHALL use NavigationManager.NavigateTo
+- Search detail links SHALL NOT open new windows
+- Queue links SHALL NOT open new tabs
+- Only external links MAY open new tabs (if any exist)
+
+#### Scenario: Navigate to search detail
+
+- **WHEN** user clicks View button on search grid row
+- **THEN** NavigationManager.NavigateTo("/search/{id}") is called
+- **AND** current window navigates to search detail
+- **AND** no new window or tab opens
+
+---
+
+## MODIFIED Requirements
+
+### Requirement: Clear Data Confirmation
+
+The system SHALL display confirmation dialogs before clearing filter data.
+
+#### Inputs
+
+- User clicks Clear Data button on any filter panel
+
+#### Outputs
+
+- Confirmation dialog with OK/Cancel buttons
+- Data cleared only if user confirms
+
+#### Business Rules
+
+- DialogService.Confirm SHALL be used for confirmation dialogs
+- Dialog title SHALL be "Confirm Clear"
+- Dialog message SHALL be "Are you sure you want to clear all items?"
+- Cancel SHALL leave data unchanged
+
+#### Scenario: Clear filter with confirmation
+
+- **WHEN** user clicks Clear Data button
+- **THEN** confirmation dialog appears
+- **AND** if user clicks OK, filter list is cleared
+- **AND** if user clicks Cancel, filter list is unchanged
+
+---
+
+### Requirement: Operator Filter Display
+
+The system SHALL display Operator filter entries with AddressNumber, UserID, and FullName properties.
+
+#### Display Format
+
+| Column | Property | Width |
+|--------|----------|-------|
+| Address Number | AddressNumber | 120px |
+| User ID | UserID | 100px |
+| Full Name | FullName | Auto |
+
+#### Business Rules
+
+- Autocomplete dropdown SHALL display all three properties
+- Format: "{AddressNumber} - {UserID} - {FullName}"
+- Grid SHALL display all three properties in separate columns
+
+#### Scenario: Select operator from autocomplete
+
+- **WHEN** user types in operator autocomplete
+- **THEN** dropdown shows results with format "12345 - JSMITH - John Smith"
+- **AND** selecting adds entry with all three properties to grid
+
+---
+
+### Requirement: Error Handling Without Custom Error Pages
+
+The system SHALL use Blazor's built-in error handling instead of custom error pages.
+
+#### Business Rules
+
+- ErrorBoundary component SHALL wrap page content in MainLayout
+- Unhandled exceptions SHALL display inline error message
+- Error recovery SHALL be automatic on next navigation
+- Development mode SHALL show exception details
+- Production mode SHALL show generic error message
+
+#### Scenario: Unhandled exception in component
+
+- **WHEN** an unhandled exception occurs in a Blazor component
+- **THEN** ErrorBoundary catches the exception
+- **AND** error content displays instead of the faulted component
+- **AND** other components remain functional
+- **AND** navigating away recovers the error boundary
+
+---
+
+## Migration Notes
+
+| Legacy Pattern | New Pattern | Status |
+|----------------|-------------|--------|
+| Kendo UI Grid | RadzenDataGrid | ADDED |
+| Kendo DatePicker | RadzenDatePicker | ADDED |
+| Kendo ComboBox | RadzenAutoComplete | ADDED |
+| jQuery AJAX | HttpClient | ADDED |
+| Forms Authentication | JWT with localStorage | MODIFIED |
+| SignalR (jQuery) | SignalR (.NET client) | ADDED |
+| New window navigation | Same-window navigation | MODIFIED |
+| Custom error pages | ErrorBoundary | MODIFIED |
+| Clear without confirm | Clear with DialogService.Confirm | MODIFIED |
+
+---
+
+## Open Questions
+
+None - all design decisions resolved per best practice recommendations.
@@ -0,0 +1,307 @@
+# Tasks: Implement Blazor UI
+
+## Phase 1: Project Configuration
+
+- [x] 001: Verify JdeScoping.Client project configuration
+  - Location: `NEW/src/JdeScoping.Client/JdeScoping.Client.csproj`
+  - Verify: Radzen.Blazor, SignalR.Client packages referenced
+  - Validation: `dotnet build` succeeds
+
+- [x] 002: Configure _Imports.razor
+  - Location: `NEW/src/JdeScoping.Client/_Imports.razor`
+  - Add: Radzen, SignalR, Models, Services namespaces
+  - Validation: Namespace imports resolve
+
+- [x] 003: Update App.razor with routing
+  - Location: `NEW/src/JdeScoping.Client/App.razor`
+  - Add: CascadingAuthenticationState, AuthorizeRouteView
+  - Validation: Router configuration compiles
+
+- [x] 004: Configure Program.cs service registration
+  - Location: `NEW/src/JdeScoping.Client/Program.cs`
+  - Add: Radzen services, Auth services, Application services
+  - Validation: Application starts without DI errors
+
+- [x] 005: Add JS interop file for file downloads
+  - Location: `NEW/src/JdeScoping.Client/wwwroot/js/interop.js`
+  - Add: downloadFileFromStream, downloadFileFromUrl functions
+  - Validation: JS file loads in browser
+
+## Phase 2: Models
+
+- [x] 006: Create ValidCombination model
+  - Location: `NEW/src/JdeScoping.Client/Models/ValidCombination.cs`
+  - Source: `OLD/WebInterface/Scripts/model/models.js` (ValidCombination definitions)
+  - Include: All 16 search type combinations with filter flags
+  - Validation: GetAll() returns 16 items
+
+- [x] 007: Create LoginModel
+  - Location: `NEW/src/JdeScoping.Client/Models/LoginModel.cs`
+  - Properties: Username (required), Password (required)
+  - Include: DataAnnotations validation attributes
+  - Validation: Validation fails for empty fields
+
+- [x] 008: Create SearchViewModel
+  - Location: `NEW/src/JdeScoping.Client/Models/SearchViewModel.cs`
+  - Properties: ID, Name, UserName, Status, SubmitDT, StartDT, EndDT, Criteria
+  - Validation: Model compiles with all properties
+
+- [x] 009: Create SearchCriteriaViewModel
+  - Location: `NEW/src/JdeScoping.Client/Models/SearchCriteriaViewModel.cs`
+  - Properties: MinimumDT, MaximumDT, all filter collections, ExtractMisData
+  - Validation: Model compiles with all properties
+
+- [x] 010: Create filter item ViewModels
+  - Location: `NEW/src/JdeScoping.Client/Models/`
+  - Files: ItemViewModel, ProfitCenterViewModel, WorkCenterViewModel, OperatorViewModel, WorkOrderViewModel, ComponentLotViewModel, PartOperationViewModel
+  - Validation: All models compile
+
+- [x] 011: Create SignalR message models
+  - Location: `NEW/src/JdeScoping.Client/Models/`
+  - Files: SearchUpdate.cs, StatusUpdate.cs
+  - Validation: Records compile
+
+- [x] 012: Create DataUpdateViewModel
+  - Location: `NEW/src/JdeScoping.Client/Models/DataUpdateViewModel.cs`
+  - Properties: StartDT, EndDT, record counts for each table, WasSuccessful
+  - Validation: Model compiles
+
+## Phase 3: Authentication Services
+
+- [x] 013: Create ITokenStorageService interface
+  - Location: `NEW/src/JdeScoping.Client/Auth/ITokenStorageService.cs`
+  - Methods: GetTokenAsync, SetTokenAsync, RemoveTokenAsync
+  - Validation: Interface compiles
+
+- [x] 014: Create TokenStorageService
+  - Location: `NEW/src/JdeScoping.Client/Auth/TokenStorageService.cs`
+  - Implementation: localStorage via IJSRuntime
+  - Validation: Can store/retrieve/remove token
+
+- [x] 015: Create AuthStateProvider
+  - Location: `NEW/src/JdeScoping.Client/Auth/AuthStateProvider.cs`
+  - Implementation: Parse JWT claims, manage auth state
+  - Methods: GetAuthenticationStateAsync, NotifyAuthenticationStateChangedAsync, LogoutAsync
+  - Validation: Auth state changes propagate to components
+
+- [x] 016: Create IAuthService interface
+  - Location: `NEW/src/JdeScoping.Client/Services/IAuthService.cs`
+  - Methods: LoginAsync, LogoutAsync
+  - Validation: Interface compiles
+
+- [x] 017: Create AuthService
+  - Location: `NEW/src/JdeScoping.Client/Services/AuthService.cs`
+  - Implementation: Call /api/auth/login, store token
+  - Returns: AuthResult with Success, ErrorMessage, Token
+  - Validation: Login flow works with mock endpoint
+
+## Phase 4: SignalR Service
+
+- [x] 018: Create IHubConnectionService interface
+  - Location: `NEW/src/JdeScoping.Client/Services/IHubConnectionService.cs`
+  - Methods: StartAsync, StopAsync, GetCachedStatusAsync
+  - Events: OnSearchUpdate, OnStatusUpdate
+  - Validation: Interface compiles
+
+- [x] 019: Create HubConnectionService
+  - Location: `NEW/src/JdeScoping.Client/Services/HubConnectionService.cs`
+  - Implementation: HubConnectionBuilder with auto-reconnect
+  - Subscribe: searchUpdate, statusUpdate events
+  - Validation: Connects to /hubs/status, receives events
+
+## Phase 5: API Client Services
+
+- [x] 020: Create ISearchService interface
+  - Location: `NEW/src/JdeScoping.Client/Services/ISearchService.cs`
+  - Methods: GetUserSearchesAsync, GetSearchAsync, CopySearchAsync, SaveSearchAsync, GetQueueAsync, DownloadResultsAsync
+  - Validation: Interface compiles
+
+- [x] 021: Create SearchService
+  - Location: `NEW/src/JdeScoping.Client/Services/SearchService.cs`
+  - Implementation: HttpClient calls to /api/search endpoints
+  - Include: Error handling, logging
+  - Validation: Service compiles, handles errors gracefully
+
+- [x] 022: Create ILookupService interface
+  - Location: `NEW/src/JdeScoping.Client/Services/ILookupService.cs`
+  - Methods: FindItemsAsync, FindProfitCentersAsync, FindWorkCentersAsync, FindOperatorsAsync
+  - Validation: Interface compiles
+
+- [x] 023: Create LookupService
+  - Location: `NEW/src/JdeScoping.Client/Services/LookupService.cs`
+  - Implementation: HttpClient calls to /api/lookup endpoints
+  - Validation: Service compiles
+
+- [x] 024: Create IFileService interface
+  - Location: `NEW/src/JdeScoping.Client/Services/IFileService.cs`
+  - Methods: DownloadTemplateAsync, DownloadPartNumberTemplateAsync, UploadAsync
+  - Validation: Interface compiles
+
+- [x] 025: Create FileService
+  - Location: `NEW/src/JdeScoping.Client/Services/FileService.cs`
+  - Implementation: File download via JS interop, upload via RadzenUpload
+  - Validation: Download triggers browser save dialog
+
+- [x] 026: Create IRefreshStatusService interface
+  - Location: `NEW/src/JdeScoping.Client/Services/IRefreshStatusService.cs`
+  - Methods: GetRefreshStatusAsync(minDT, maxDT)
+  - Validation: Interface compiles
+
+- [x] 027: Create RefreshStatusService
+  - Location: `NEW/src/JdeScoping.Client/Services/RefreshStatusService.cs`
+  - Implementation: HttpClient calls to /api/refresh-status
+  - Validation: Service compiles
+
+## Phase 6: Layout Components
+
+- [x] 028: Create MainLayout.razor
+  - Location: `NEW/src/JdeScoping.Client/Layout/MainLayout.razor`
+  - Structure: RadzenLayout with Header, Body, Footer
+  - Include: AuthorizeView for user display, logout button
+  - Validation: Layout renders header, content, footer
+
+- [x] 029: Create LoadingIndicator component
+  - Location: `NEW/src/JdeScoping.Client/Components/Shared/LoadingIndicator.razor`
+  - Structure: RadzenProgressBarCircular with optional message
+  - Validation: Component renders centered spinner
+
+## Phase 7: Authentication Pages
+
+- [x] 030: Create Login.razor
+  - Location: `NEW/src/JdeScoping.Client/Pages/Login.razor`
+  - Route: /login
+  - Structure: RadzenCard with EditForm, username/password fields
+  - Features: Validation, error display, loading state, redirect on success
+  - Validation: Login form submits and redirects
+
+- [x] 031: Create NotAuthorized.razor
+  - Location: `NEW/src/JdeScoping.Client/Pages/NotAuthorized.razor`
+  - Route: /not-authorized
+  - Structure: RadzenAlert with error message, navigation buttons
+  - Validation: Page displays resource URL from query string
+
+- [x] 032: Create RedirectToLogin component
+  - Location: `NEW/src/JdeScoping.Client/Components/Shared/RedirectToLogin.razor`
+  - Implementation: NavigateTo /login with returnUrl
+  - Validation: Unauthorized access redirects to login
+
+## Phase 8: Search List Page
+
+- [x] 033: Create Searches.razor (Search List)
+  - Location: `NEW/src/JdeScoping.Client/Pages/Searches.razor`
+  - Routes: / and /searches
+  - Structure: RadzenDataGrid with Name, Submitted, Status columns
+  - Features: New Search button, Queue button, status badges
+  - SignalR: Subscribe to searchUpdate, update grid in real-time
+  - Validation: Grid displays user's searches, updates on SignalR events
+
+## Phase 9: Search Create/Edit Page
+
+- [x] 034: Create SearchEdit.razor (main page)
+  - Location: `NEW/src/JdeScoping.Client/Pages/SearchEdit.razor`
+  - Routes: /search/create, /search/{Id:int}
+  - Structure: Search details panel, conditional filter panels
+  - Features: Search type dropdown, read-only mode, Copy button, Submit button
+  - SignalR: Subscribe to searchUpdate for current search
+  - Validation: Form loads, validates, submits correctly
+
+## Phase 10: Filter Panel Components
+
+- [x] 035: Create TimeSpanFilterPanel.razor
+  - Location: `NEW/src/JdeScoping.Client/Components/FilterPanels/TimeSpanFilterPanel.razor`
+  - Structure: Min/Max date pickers
+  - Business rules: Min >= 2002-11-01, Max <= today, Max >= Min
+  - Validation: Date constraints enforced
+
+- [x] 036: Create WorkOrderFilterPanel.razor
+  - Location: `NEW/src/JdeScoping.Client/Components/FilterPanels/WorkOrderFilterPanel.razor`
+  - Structure: Upload/Download/Clear buttons, data grid
+  - Features: Excel upload parsing, template download
+  - Validation: Upload populates grid, Clear empties grid
+
+- [x] 037: Create ItemNumberFilterPanel.razor
+  - Location: `NEW/src/JdeScoping.Client/Components/FilterPanels/ItemNumberFilterPanel.razor`
+  - Structure: Autocomplete with Add button, data grid
+  - Features: Search with 3+ chars, prevent duplicates
+  - Validation: Autocomplete returns results, Add works
+
+- [x] 038: Create ProfitCenterFilterPanel.razor
+  - Location: `NEW/src/JdeScoping.Client/Components/FilterPanels/ProfitCenterFilterPanel.razor`
+  - Structure: Autocomplete with Add button, data grid
+  - Validation: Same pattern as ItemNumber panel
+
+- [x] 039: Create WorkCenterFilterPanel.razor
+  - Location: `NEW/src/JdeScoping.Client/Components/FilterPanels/WorkCenterFilterPanel.razor`
+  - Structure: Autocomplete with Add button, data grid
+  - Validation: Same pattern as ItemNumber panel
+
+- [x] 040: Create OperatorFilterPanel.razor
+  - Location: `NEW/src/JdeScoping.Client/Components/FilterPanels/OperatorFilterPanel.razor`
+  - Structure: Autocomplete with Add button, data grid
+  - Properties: AddressNumber, UserID, FullName
+  - Validation: Displays all three properties in dropdown
+
+- [x] 041: Create ComponentLotFilterPanel.razor
+  - Location: `NEW/src/JdeScoping.Client/Components/FilterPanels/ComponentLotFilterPanel.razor`
+  - Structure: Upload/Download/Clear buttons, data grid
+  - Properties: LotNumber, ItemNumber
+  - Validation: Two-column display in grid
+
+- [x] 042: Create PartOperationFilterPanel.razor
+  - Location: `NEW/src/JdeScoping.Client/Components/FilterPanels/PartOperationFilterPanel.razor`
+  - Structure: Upload/Download/Clear buttons, data grid
+  - Properties: ItemNumber, OperationNumber, MisNumber, MisRevision
+  - Validation: Four-column display in grid
+
+## Phase 11: Search Queue Page
+
+- [x] 043: Create SearchQueue.razor
+  - Location: `NEW/src/JdeScoping.Client/Pages/SearchQueue.razor`
+  - Route: /search/queue
+  - Structure: Processor status panel, data grid of all queued searches
+  - SignalR: Subscribe to statusUpdate, searchUpdate
+  - Features: Remove completed searches from grid
+  - Validation: Grid shows all users' searches, status panel updates
+
+## Phase 12: Refresh Status Page
+
+- [x] 044: Create RefreshStatus.razor
+  - Location: `NEW/src/JdeScoping.Client/Pages/RefreshStatus.razor`
+  - Route: /refresh-status
+  - Structure: Date filter panel, data grid with record counts
+  - Features: Default to last 7 days, Filter button, WasSuccessful badges
+  - Validation: Grid displays sync history, filtering works
+
+## Phase 13: Styling and Polish
+
+- [x] 045: Update wwwroot/css/app.css
+  - Location: `NEW/src/JdeScoping.Client/wwwroot/css/app.css`
+  - Add: Custom styles for badges, cards, loading states
+  - Validation: Styles applied consistently
+
+- [x] 046: Update index.html
+  - Location: `NEW/src/JdeScoping.Client/wwwroot/index.html`
+  - Add: Radzen CSS reference, JS interop script reference
+  - Validation: Radzen styles load correctly
+
+## Phase 14: Verification
+
+- [x] 047: Verify all pages render
+  - Navigate to each route, verify content loads
+  - Validation: No console errors, all pages accessible
+
+- [x] 048: Verify form validation
+  - Test Login form, Search Create form with invalid data
+  - Validation: Validation messages display correctly
+
+- [x] 049: Verify SignalR connection
+  - Check browser console for connection logs
+  - Validation: Connection established, reconnects on disconnect
+
+- [x] 050: Run solution build
+  - Command: `dotnet build NEW/JdeScoping.sln`
+  - Validation: No errors or warnings
+
+- [x] 051: Run OpenSpec validation
+  - Command: `openspec validate implement-blazor-ui --strict`
+  - Validation: No validation errors
@@ -0,0 +1,376 @@
+# Data Access Design
+
+## Overview
+
+This document describes the architecture and implementation approach for the data access layer, including repository interfaces, connection factory, exception handling, and service registration.
+
+## Architecture
+
+### Repository Pattern
+
+```
+┌─────────────────────────────────────────────────────────────────────┐
+│                        Service Layer                                 │
+│  (SearchProcessor, DataSyncService, etc.)                           │
+└─────────────────────────────────────────────────────────────────────┘
+                                  │
+                    ┌─────────────┼─────────────┐
+                    ▼             ▼             ▼
+         ┌──────────────┐ ┌──────────────┐ ┌──────────────┐
+         │ILotFinder    │ │IJde          │ │ICms          │
+         │Repository    │ │Repository    │ │Repository    │
+         └──────┬───────┘ └──────┬───────┘ └──────┬───────┘
+                │                │                │
+         ┌──────▼───────┐ ┌──────▼───────┐ ┌──────▼───────┐
+         │LotFinder     │ │Jde           │ │Cms           │
+         │Repository    │ │Repository    │ │Repository    │
+         └──────┬───────┘ └──────┬───────┘ └──────┬───────┘
+                │                │                │
+                └────────────────┼────────────────┘
+                                 ▼
+                    ┌─────────────────────────┐
+                    │   IDbConnectionFactory   │
+                    └─────────────┬───────────┘
+                                  │
+            ┌─────────────────────┼─────────────────────┐
+            ▼                     ▼                     ▼
+    ┌───────────────┐    ┌───────────────┐    ┌───────────────┐
+    │ SqlConnection │    │OracleConnection│   │OracleConnection│
+    │ (LotFinderDB) │    │   (JDE/Stage) │   │    (CMS)       │
+    └───────────────┘    └───────────────┘    └───────────────┘
+```
+
+### Project Structure
+
+```
+NEW/src/JdeScoping.DataAccess/
+├── Exceptions/
+│   ├── DataAccessException.cs
+│   ├── ConnectionException.cs
+│   ├── QueryException.cs
+│   └── DataAccessTimeoutException.cs
+├── Interfaces/
+│   ├── IDbConnectionFactory.cs
+│   ├── ILotFinderRepository.cs
+│   ├── IJdeRepository.cs
+│   └── ICmsRepository.cs
+├── Repositories/
+│   ├── LotFinderRepository.cs
+│   ├── JdeRepository.cs
+│   └── CmsRepository.cs
+├── Queries/
+│   ├── LotFinderQueries.cs     (const string SQL statements)
+│   ├── JdeQueries.cs           (const string SQL statements)
+│   └── CmsQueries.cs           (const string SQL statements)
+├── Configuration/
+│   └── DataAccessOptions.cs
+├── DbConnectionFactory.cs
+├── ServiceCollectionExtensions.cs
+└── JdeScoping.DataAccess.csproj
+```
+
+## Connection Factory
+
+### IDbConnectionFactory Interface
+
+```csharp
+public interface IDbConnectionFactory
+{
+    Task<SqlConnection> CreateLotFinderConnectionAsync(CancellationToken ct = default);
+    Task<OracleConnection> CreateJdeConnectionAsync(CancellationToken ct = default);
+    Task<OracleConnection> CreateJdeStageConnectionAsync(CancellationToken ct = default);
+    Task<OracleConnection> CreateCmsConnectionAsync(CancellationToken ct = default);
+}
+```
+
+### Implementation Details
+
+- Registered as **singleton** (stateless, creates new connections)
+- Connection strings read from `IConfiguration["ConnectionStrings:*"]`
+- Secrets retrieved from .NET Secret Manager (local) or Azure Key Vault (production)
+- Connections opened asynchronously before returning
+- Caller responsible for disposing returned connections
+
+### Connection String Keys
+
+| Key | Database | Driver |
+|-----|----------|--------|
+| `ConnectionStrings:LotFinderDB` | SQL Server cache | Microsoft.Data.SqlClient |
+| `ConnectionStrings:JDE` | JDE Oracle (PRODDTA) | Oracle.ManagedDataAccess.Core |
+| `ConnectionStrings:JDEStage` | JDE Oracle (JDESTAGE) | Oracle.ManagedDataAccess.Core |
+| `ConnectionStrings:CMS` | CMS Oracle (INFODBA) | Oracle.ManagedDataAccess.Core |
+
+## Repository Interfaces
+
+### Registration Lifetimes
+
+| Interface | Lifetime | Rationale |
+|-----------|----------|-----------|
+| `IDbConnectionFactory` | Singleton | Stateless, creates new connections |
+| `ILotFinderRepository` | Scoped | Per-request, uses scoped DbContext pattern |
+| `IJdeRepository` | Scoped | Per-request, creates connections as needed |
+| `ICmsRepository` | Scoped | Per-request, creates connections as needed |
+
+### Constructor Dependencies
+
+All repository implementations receive:
+- `IDbConnectionFactory` - For database connections
+- `ILogger<T>` - For structured logging
+- `IOptions<DataAccessOptions>` - For configurable timeouts and schemas
+
+## Async Streaming Pattern
+
+### IAsyncEnumerable for Large Datasets
+
+JDE and CMS repositories return `IAsyncEnumerable<T>` for all collection queries:
+
+```csharp
+public async IAsyncEnumerable<WorkOrder> GetWorkOrdersAsync(
+    DateTime? lastUpdateDT = null,
+    [EnumeratorCancellation] CancellationToken ct = default)
+{
+    await using var connection = await _connectionFactory.CreateJdeConnectionAsync(ct);
+
+    var sql = lastUpdateDT.HasValue
+        ? JdeQueries.SQL_GET_WORKORDERS_FILTERED
+        : JdeQueries.SQL_GET_WORKORDERS;
+
+    var parameters = BuildWorkOrderParameters(lastUpdateDT);
+
+    await foreach (var workOrder in connection.QueryUnbufferedAsync<WorkOrder>(
+        sql, parameters, commandTimeout: _options.Value.DefaultTimeoutSeconds)
+        .WithCancellation(ct))
+    {
+        yield return workOrder;
+    }
+}
+```
+
+### Benefits
+
+- Memory efficient: rows streamed one at a time
+- Cancellation support: stops iteration on cancellation
+- Backpressure: consumer controls iteration speed
+- Compatible with `await foreach` syntax
+
+## Query Management
+
+### SQL Query Storage
+
+SQL queries stored as compile-time constants in static classes:
+
+```csharp
+public static class JdeQueries
+{
+    public const string SQL_GET_WORKORDERS = @"
+        SELECT wo.WADOCO AS WorkOrderNumber,
+               TRIM(wo.WAMMCU) AS BranchCode,
+               -- ... rest of query
+          FROM {ProductionSchema}.F4801 wo";
+
+    public const string SQL_GET_WORKORDERS_FILTERED = SQL_GET_WORKORDERS + @"
+        WHERE (wo.WAUPMJ > :dateUpdated OR
+               (wo.WAUPMJ = :dateUpdated AND wo.WATDAY >= :timeUpdated))";
+}
+```
+
+### Schema Placeholder Replacement
+
+Schema names replaced at runtime from `DataAccessOptions`:
+
+```csharp
+private string ApplySchemaPlaceholders(string sql)
+{
+    return sql
+        .Replace("{ProductionSchema}", _options.Value.ProductionSchema)
+        .Replace("{ArchiveSchema}", _options.Value.ArchiveSchema)
+        .Replace("{StageSchema}", _options.Value.StageSchema);
+}
+```
+
+## Exception Handling
+
+### Exception Hierarchy
+
+```
+Exception
+└── DataAccessException (base for all data access errors)
+    ├── ConnectionException (connection failures)
+    ├── QueryException (query execution failures)
+    └── DataAccessTimeoutException (timeout errors)
+```
+
+### Exception Properties
+
+```csharp
+public class DataAccessException : Exception
+{
+    public string? Operation { get; }      // Method name (e.g., "GetWorkOrdersAsync")
+    public string? Repository { get; }     // Repository name (e.g., "JdeRepository")
+}
+
+public class ConnectionException : DataAccessException
+{
+    public string? DataSource { get; }     // Database identifier (e.g., "JDE", "CMS")
+}
+
+public class QueryException : DataAccessException
+{
+    public string? QueryName { get; }      // Query identifier (e.g., "SQL_GET_WORKORDERS")
+}
+
+public class DataAccessTimeoutException : DataAccessException
+{
+    public int TimeoutSeconds { get; }     // Configured timeout value
+}
+```
+
+### Logging Pattern
+
+All exceptions logged at throw site with scope context:
+
+```csharp
+try
+{
+    // Execute query
+}
+catch (OracleException ex) when (ex.Number == 1017) // Invalid credentials
+{
+    using (_logger.BeginScope(new Dictionary<string, object>
+    {
+        ["DataSource"] = "JDE",
+        ["Operation"] = "GetWorkOrdersAsync"
+    }))
+    {
+        _logger.LogError(ex, "Failed to connect to JDE Oracle database");
+    }
+    throw new ConnectionException("JDE: Failed to connect to database", "JDE", ex);
+}
+```
+
+## Configuration Options
+
+### DataAccessOptions Class
+
+```csharp
+public class DataAccessOptions
+{
+    public const string SectionName = "DataAccess";
+
+    public int DefaultTimeoutSeconds { get; set; } = 600;
+    public int LotUsageTimeoutSeconds { get; set; } = 999999;
+    public int MisDataTimeoutSeconds { get; set; } = 60000;
+    public int RebuildIndexTimeoutSeconds { get; set; } = 600;
+    public string ProductionSchema { get; set; } = "PRODDTA";
+    public string ArchiveSchema { get; set; } = "ARCDTAPD";
+    public string StageSchema { get; set; } = "JDESTAGE";
+}
+```
+
+### Configuration Binding
+
+```json
+{
+  "DataAccess": {
+    "DefaultTimeoutSeconds": 600,
+    "LotUsageTimeoutSeconds": 999999,
+    "MisDataTimeoutSeconds": 60000,
+    "RebuildIndexTimeoutSeconds": 600,
+    "ProductionSchema": "PRODDTA",
+    "ArchiveSchema": "ARCDTAPD",
+    "StageSchema": "JDESTAGE"
+  }
+}
+```
+
+## Service Registration
+
+### AddDataAccess Extension Method
+
+```csharp
+public static class ServiceCollectionExtensions
+{
+    public static IServiceCollection AddDataAccess(
+        this IServiceCollection services,
+        IConfiguration configuration)
+    {
+        // Bind options
+        services.Configure<DataAccessOptions>(
+            configuration.GetSection(DataAccessOptions.SectionName));
+
+        // Register connection factory (singleton)
+        services.AddSingleton<IDbConnectionFactory, DbConnectionFactory>();
+
+        // Register repositories (scoped)
+        services.AddScoped<ILotFinderRepository, LotFinderRepository>();
+        services.AddScoped<IJdeRepository, JdeRepository>();
+        services.AddScoped<ICmsRepository, CmsRepository>();
+
+        return services;
+    }
+}
+```
+
+## SQL Injection Prevention
+
+### RebuildIndicesAsync Whitelist
+
+Table names validated against explicit whitelist:
+
+```csharp
+private static readonly HashSet<string> ValidTableNames = new(StringComparer.OrdinalIgnoreCase)
+{
+    "Branch", "DataUpdate", "FunctionCode", "Item", "JdeUser",
+    "Lot", "LotLocation", "LotUsage_Curr", "LotUsage_Hist",
+    "MisData", "OrgHierarchy", "ProfitCenter", "RouteMaster",
+    "Search", "StatusCode", "WorkCenter",
+    "WorkOrder_Curr", "WorkOrder_Hist",
+    "WorkOrderComponent_Curr", "WorkOrderComponent_Hist",
+    "WorkOrderRouting",
+    "WorkOrderStep_Curr", "WorkOrderStep_Hist",
+    "WorkOrderTime_Curr", "WorkOrderTime_Hist"
+};
+
+public async Task RebuildIndicesAsync(string tableName, CancellationToken ct = default)
+{
+    if (!ValidTableNames.Contains(tableName))
+    {
+        throw new ArgumentException($"Invalid table name: {tableName}", nameof(tableName));
+    }
+
+    await using var connection = await _connectionFactory.CreateLotFinderConnectionAsync(ct);
+    var sql = $"ALTER INDEX ALL ON [{tableName}] REBUILD WITH (FILLFACTOR = 95)";
+    await connection.ExecuteAsync(sql, commandTimeout: _options.Value.RebuildIndexTimeoutSeconds);
+}
+```
+
+## NuGet Dependencies
+
+### Required Packages
+
+```xml
+<ItemGroup>
+  <PackageReference Include="Microsoft.Data.SqlClient" Version="5.2.*" />
+  <PackageReference Include="Oracle.ManagedDataAccess.Core" Version="23.4.*" />
+  <PackageReference Include="Dapper" Version="2.1.*" />
+  <PackageReference Include="Microsoft.Extensions.Options" Version="9.0.*" />
+  <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="9.0.*" />
+  <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="9.0.*" />
+</ItemGroup>
+```
+
+## Testing Strategy
+
+### Unit Tests
+
+- Mock `IDbConnectionFactory` to return mock connections
+- Use in-memory test data for query result mapping
+- Verify exception handling scenarios
+- Test cancellation token propagation
+
+### Integration Tests
+
+- Use Docker containers for SQL Server and Oracle
+- Test actual query execution
+- Verify streaming behavior for large datasets
+- Test connection pooling under load
@@ -0,0 +1,69 @@
+# Implement Data Access
+
+## Summary
+
+Implement the data access layer with repository interfaces and implementations for accessing SQL Server (LotFinderDB), JDE Oracle, and CMS Oracle databases. This provides the foundation for all data operations in the migrated application.
+
+## Scope
+
+### In Scope
+
+- `IDbConnectionFactory` interface and `DbConnectionFactory` implementation
+- `ILotFinderRepository` interface with all SQL Server cache methods
+- `IJdeRepository` interface with all JDE Oracle query methods
+- `ICmsRepository` interface with CMS MIS data methods
+- `LotFinderRepository`, `JdeRepository`, `CmsRepository` implementations
+- `DataAccessOptions` configuration class
+- Custom exception hierarchy (`DataAccessException`, `ConnectionException`, `QueryException`, `DataAccessTimeoutException`)
+- `AddDataAccess` service registration extension method
+- SQL queries as embedded resources or compile-time constants
+- Unit tests for repository methods
+
+### Out of Scope
+
+- Database schema changes (handled by migrate-database-schema)
+- Data sync scheduling (Phase 5: data-sync)
+- Search processing logic (Phase 6: search-processing)
+- Azure Key Vault integration (will use .NET Secret Manager for local dev)
+
+## Motivation
+
+The legacy data access layer uses static partial classes which are difficult to test and tightly coupled. The new design provides:
+- Interface-based repositories for dependency injection and testability
+- Connection factory abstraction for consistent connection management
+- Async-first design with `IAsyncEnumerable<T>` for memory-efficient streaming
+- Typed exceptions for consistent error handling
+- Configurable timeouts via options pattern
+
+## Acceptance Criteria
+
+1. All three repository interfaces defined with methods matching the spec
+2. `IDbConnectionFactory` provides connections for all four database connections (LotFinderDB, JDE, JDE Stage, CMS)
+3. All repository implementations use Dapper for query execution
+4. JDE/CMS streaming queries use `IAsyncEnumerable<T>` with `QueryUnbufferedAsync`
+5. All methods accept `CancellationToken` parameter
+6. Custom exceptions thrown on errors (never return null/empty on error)
+7. `AddDataAccess` extension method registers all services with appropriate lifetimes
+8. SQL injection prevented via whitelist validation in `RebuildIndicesAsync`
+9. Unit tests pass with mocked dependencies
+10. `openspec validate implement-data-access --strict` passes
+
+## Dependencies
+
+- `migrate-database-schema` - Database schema must exist for repository queries
+- NuGet packages: `Microsoft.Data.SqlClient`, `Oracle.ManagedDataAccess.Core`, `Dapper`
+
+## Risks
+
+| Risk | Mitigation |
+|------|------------|
+| Oracle driver compatibility | Test early with Oracle.ManagedDataAccess.Core against target databases |
+| Query translation errors | Copy SQL exactly from legacy, validate with Codex MCP review |
+| Streaming memory issues | Use `QueryUnbufferedAsync` for all large result sets |
+| Connection pooling misconfiguration | Use default ADO.NET pooling, document connection string settings |
+
+## Related Specs
+
+- `data-access` - All repository interface and method definitions
+- `domain-models` - Entity types returned by repositories
+- `database-schema` - SQL Server tables accessed by LotFinderRepository
@@ -0,0 +1,324 @@
+# Data Access - Implementation Patterns
+
+## ADDED Requirements
+
+### Requirement: Connection factory pattern
+
+The system SHALL implement `IDbConnectionFactory` to provide database connections via dependency injection.
+
+#### Implementation Pattern
+
+```csharp
+public class DbConnectionFactory : IDbConnectionFactory
+{
+    private readonly IConfiguration _configuration;
+    private readonly ILogger<DbConnectionFactory> _logger;
+
+    public DbConnectionFactory(IConfiguration configuration, ILogger<DbConnectionFactory> logger)
+    {
+        _configuration = configuration;
+        _logger = logger;
+    }
+
+    public async Task<SqlConnection> CreateLotFinderConnectionAsync(CancellationToken ct = default)
+    {
+        var connectionString = _configuration.GetConnectionString("LotFinderDB")
+            ?? throw new ConnectionException("LotFinderDB connection string not configured", "LotFinderDB");
+
+        var connection = new SqlConnection(connectionString);
+        try
+        {
+            await connection.OpenAsync(ct);
+            return connection;
+        }
+        catch (SqlException ex)
+        {
+            _logger.LogError(ex, "Failed to connect to LotFinderDB");
+            await connection.DisposeAsync();
+            throw new ConnectionException("LotFinderDB: failed to open connection to database.", "LotFinderDB", ex);
+        }
+    }
+}
+```
+
+#### Business Rules
+
+- Connection factory SHALL be registered as singleton
+- Connections SHALL be opened asynchronously before returning
+- Callers SHALL dispose returned connections when finished
+- `ConnectionException` SHALL be thrown on connection failure with inner exception preserved
+
+#### Scenario: Successful connection creation
+
+- **WHEN** valid connection string exists in configuration
+- **AND** `CreateLotFinderConnectionAsync()` is called
+- **THEN** a new `SqlConnection` is created, opened, and returned
+- **AND** the caller is responsible for disposal
+
+#### Scenario: Connection failure handling
+
+- **WHEN** database is unreachable
+- **AND** `CreateLotFinderConnectionAsync()` is called
+- **THEN** error is logged with exception details
+- **AND** `ConnectionException` is thrown with descriptive message
+- **AND** inner exception is preserved for debugging
+
+---
+
+### Requirement: Async streaming pattern
+
+The system SHALL use `IAsyncEnumerable<T>` with Dapper's `QueryUnbufferedAsync` for streaming large result sets.
+
+#### Implementation Pattern
+
+```csharp
+public async IAsyncEnumerable<WorkOrder> GetWorkOrdersAsync(
+    DateTime? lastUpdateDT = null,
+    [EnumeratorCancellation] CancellationToken ct = default)
+{
+    await using var connection = await _connectionFactory.CreateJdeConnectionAsync(ct);
+
+    var sql = ApplySchemaPlaceholders(
+        lastUpdateDT.HasValue
+            ? JdeQueries.SQL_GET_WORKORDERS_FILTERED
+            : JdeQueries.SQL_GET_WORKORDERS);
+
+    var command = new CommandDefinition(
+        sql,
+        parameters: lastUpdateDT.HasValue
+            ? new { dateUpdated = ToJdeDate(lastUpdateDT.Value), timeUpdated = ToJdeTime(lastUpdateDT.Value) }
+            : null,
+        commandTimeout: _options.Value.DefaultTimeoutSeconds,
+        cancellationToken: ct);
+
+    await foreach (var workOrder in connection.QueryUnbufferedAsync<WorkOrder>(command).WithCancellation(ct))
+    {
+        yield return workOrder;
+    }
+}
+```
+
+#### Business Rules
+
+- All JDE/CMS collection queries SHALL return `IAsyncEnumerable<T>`
+- Queries SHALL use `QueryUnbufferedAsync` to stream results
+- Methods SHALL accept `CancellationToken` with `[EnumeratorCancellation]` attribute
+- Cancellation SHALL be checked between row iterations via `WithCancellation(ct)`
+
+#### Scenario: Stream large work order dataset
+
+- **WHEN** `GetWorkOrdersAsync()` is called for 1 million work orders
+- **THEN** results are streamed via `IAsyncEnumerable<WorkOrder>` one at a time
+- **AND** memory usage remains constant regardless of result set size
+- **AND** consumer can use `await foreach` syntax
+
+#### Scenario: Cancel streaming operation
+
+- **WHEN** cancellation is requested during `GetWorkOrdersAsync()` iteration
+- **THEN** iteration stops after current row completes
+- **AND** `OperationCanceledException` is thrown to consumer
+- **AND** database connection is properly disposed
+
+---
+
+### Requirement: Schema placeholder replacement
+
+The system SHALL replace schema placeholders in SQL queries from `DataAccessOptions`.
+
+#### Implementation Pattern
+
+```csharp
+private string ApplySchemaPlaceholders(string sql)
+{
+    return sql
+        .Replace("{ProductionSchema}", _options.Value.ProductionSchema)
+        .Replace("{ArchiveSchema}", _options.Value.ArchiveSchema)
+        .Replace("{StageSchema}", _options.Value.StageSchema);
+}
+```
+
+#### Business Rules
+
+- Schema names SHALL be configurable for environment-specific deployments
+- Default values: PRODDTA (production), ARCDTAPD (archive), JDESTAGE (stage)
+- Replacement SHALL occur at query execution time
+
+#### Scenario: Query uses production schema
+
+- **WHEN** SQL query contains `{ProductionSchema}.F4801`
+- **AND** `DataAccessOptions.ProductionSchema` is "PRODDTA"
+- **THEN** query is executed with `PRODDTA.F4801`
+
+---
+
+### Requirement: Table name whitelist validation
+
+The system SHALL validate table names against an explicit whitelist to prevent SQL injection in `RebuildIndicesAsync`.
+
+#### Implementation Pattern
+
+```csharp
+private static readonly HashSet<string> ValidTableNames = new(StringComparer.OrdinalIgnoreCase)
+{
+    "Branch", "DataUpdate", "FunctionCode", "Item", "JdeUser",
+    "Lot", "LotLocation", "LotUsage_Curr", "LotUsage_Hist",
+    "MisData", "OrgHierarchy", "ProfitCenter", "RouteMaster",
+    "Search", "StatusCode", "WorkCenter",
+    "WorkOrder_Curr", "WorkOrder_Hist",
+    "WorkOrderComponent_Curr", "WorkOrderComponent_Hist",
+    "WorkOrderRouting",
+    "WorkOrderStep_Curr", "WorkOrderStep_Hist",
+    "WorkOrderTime_Curr", "WorkOrderTime_Hist"
+};
+
+public async Task RebuildIndicesAsync(string tableName, CancellationToken ct = default)
+{
+    if (!ValidTableNames.Contains(tableName))
+    {
+        throw new ArgumentException($"Invalid table name: {tableName}", nameof(tableName));
+    }
+
+    await using var connection = await _connectionFactory.CreateLotFinderConnectionAsync(ct);
+    var sql = $"ALTER INDEX ALL ON [{tableName}] REBUILD WITH (FILLFACTOR = 95)";
+    await connection.ExecuteAsync(sql, commandTimeout: _options.Value.RebuildIndexTimeoutSeconds);
+}
+```
+
+#### Business Rules
+
+- Table name MUST be validated against explicit whitelist before execution
+- `ArgumentException` SHALL be thrown for invalid table names
+- Comparison SHALL be case-insensitive
+
+#### Scenario: Valid table name accepted
+
+- **WHEN** `RebuildIndicesAsync("WorkOrder_Curr")` is called
+- **THEN** table name passes whitelist validation
+- **AND** index rebuild executes successfully
+
+#### Scenario: SQL injection attempt blocked
+
+- **WHEN** `RebuildIndicesAsync("WorkOrder]; DROP TABLE Search;--")` is called
+- **THEN** table name fails whitelist validation
+- **AND** `ArgumentException` is thrown with message "Invalid table name"
+- **AND** no SQL is executed
+
+---
+
+### Requirement: Exception logging with scope context
+
+The system SHALL log exceptions with structured scope context before throwing.
+
+#### Implementation Pattern
+
+```csharp
+catch (OracleException ex)
+{
+    using (_logger.BeginScope(new Dictionary<string, object>
+    {
+        ["DataSource"] = "JDE",
+        ["Operation"] = nameof(GetWorkOrdersAsync),
+        ["QueryName"] = "SQL_GET_WORKORDERS"
+    }))
+    {
+        _logger.LogError(ex, "Query execution failed");
+    }
+    throw new QueryException("Failed to execute work order query", "SQL_GET_WORKORDERS", ex);
+}
+```
+
+#### Business Rules
+
+- All exceptions SHALL be logged at throw site
+- Log context SHALL include: DataSource, Operation, and QueryName where applicable
+- Inner exceptions SHALL be preserved in thrown exceptions
+- Structured logging SHALL enable log aggregation and analysis
+
+#### Scenario: Query exception with full context
+
+- **WHEN** JDE Oracle query fails with OracleException
+- **THEN** error is logged with BeginScope containing DataSource, Operation, QueryName
+- **AND** `QueryException` is thrown with descriptive message and inner exception
+
+---
+
+### Requirement: Table-valued parameter support
+
+The system SHALL use DataTable for SQL Server table-valued parameters in lookup methods.
+
+#### Implementation Pattern
+
+```csharp
+public async Task<List<Item>> LookupItemsAsync(List<string> itemNumbers, CancellationToken ct = default)
+{
+    await using var connection = await _connectionFactory.CreateLotFinderConnectionAsync(ct);
+
+    var table = new DataTable();
+    table.Columns.Add("ItemNumber", typeof(string));
+    foreach (var itemNumber in itemNumbers)
+    {
+        table.Rows.Add(itemNumber);
+    }
+
+    var parameters = new DynamicParameters();
+    parameters.Add("@itemNumbers", table.AsTableValuedParameter("dbo.ItemNumberFilterParameter"));
+
+    return (await connection.QueryAsync<Item>(
+        LotFinderQueries.SQL_LOOKUP_ITEMS,
+        parameters,
+        commandTimeout: _options.Value.DefaultTimeoutSeconds))
+        .AsList();
+}
+```
+
+#### Business Rules
+
+- TVPs SHALL use `AsTableValuedParameter` extension with correct type name
+- DataTable column names SHALL match TVP type column names
+- TVPs enable efficient batch lookups with single database round-trip
+
+#### Scenario: Batch lookup with TVP
+
+- **WHEN** `LookupItemsAsync(["ITEM001", "ITEM002", "ITEM003"])` is called
+- **THEN** DataTable is created with ItemNumber column
+- **AND** single query executes with TVP parameter
+- **AND** matching items are returned
+
+---
+
+### Requirement: Service registration extension method
+
+The system SHALL provide `AddDataAccess` extension method for DI registration.
+
+#### Implementation Pattern
+
+```csharp
+public static IServiceCollection AddDataAccess(
+    this IServiceCollection services,
+    IConfiguration configuration)
+{
+    services.Configure<DataAccessOptions>(
+        configuration.GetSection(DataAccessOptions.SectionName));
+
+    services.AddSingleton<IDbConnectionFactory, DbConnectionFactory>();
+    services.AddScoped<ILotFinderRepository, LotFinderRepository>();
+    services.AddScoped<IJdeRepository, JdeRepository>();
+    services.AddScoped<ICmsRepository, CmsRepository>();
+
+    return services;
+}
+```
+
+#### Business Rules
+
+- Extension method SHALL bind `DataAccessOptions` from "DataAccess" configuration section
+- Connection factory SHALL be registered as singleton
+- Repositories SHALL be registered as scoped services
+- Method SHALL return `IServiceCollection` for chaining
+
+#### Scenario: Register all data access services
+
+- **WHEN** `services.AddDataAccess(configuration)` is called during startup
+- **THEN** `DataAccessOptions` is bound from configuration
+- **AND** `IDbConnectionFactory` is registered as singleton
+- **AND** all repository interfaces are registered as scoped
@@ -0,0 +1,208 @@
+# Tasks: Implement Data Access
+
+## Phase 1: Project Setup
+
+- [x] Create JdeScoping.DataAccess project
+  - Location: `NEW/src/JdeScoping.DataAccess/JdeScoping.DataAccess.csproj`
+  - Target: net10.0
+  - Validation: Project builds successfully
+  - Dependencies: None
+
+- [x] Add NuGet package references
+  - Packages: Microsoft.Data.SqlClient, Oracle.ManagedDataAccess.Core, Dapper, Microsoft.Extensions.Options, Microsoft.Extensions.Logging.Abstractions, Microsoft.Extensions.Configuration.Abstractions
+  - Validation: `dotnet restore` succeeds
+
+- [x] Create folder structure
+  - Folders: Exceptions/, Interfaces/, Repositories/, Queries/, Configuration/
+  - Validation: Directories exist
+
+## Phase 2: Exception Types
+
+- [x] Create DataAccessException base class
+  - Location: `Exceptions/DataAccessException.cs`
+  - Properties: Operation, Repository, Message, InnerException
+  - Validation: Class compiles
+
+- [x] Create ConnectionException class
+  - Location: `Exceptions/ConnectionException.cs`
+  - Properties: DataSource (inherits from DataAccessException)
+  - Validation: Class compiles
+
+- [x] Create QueryException class
+  - Location: `Exceptions/QueryException.cs`
+  - Properties: QueryName (inherits from DataAccessException)
+  - Validation: Class compiles
+
+- [x] Create DataAccessTimeoutException class
+  - Location: `Exceptions/DataAccessTimeoutException.cs`
+  - Properties: TimeoutSeconds (inherits from DataAccessException)
+  - Validation: Class compiles
+
+## Phase 3: Configuration
+
+- [x] Create DataAccessOptions class
+  - Location: `Configuration/DataAccessOptions.cs`
+  - Properties: DefaultTimeoutSeconds, LotUsageTimeoutSeconds, MisDataTimeoutSeconds, RebuildIndexTimeoutSeconds, ProductionSchema, ArchiveSchema, StageSchema
+  - Validation: Class compiles with default values
+
+## Phase 4: Connection Factory
+
+- [x] Create IDbConnectionFactory interface
+  - Location: `Interfaces/IDbConnectionFactory.cs`
+  - Methods: CreateLotFinderConnectionAsync, CreateJdeConnectionAsync, CreateJdeStageConnectionAsync, CreateCmsConnectionAsync
+  - Validation: Interface compiles
+
+- [x] Create DbConnectionFactory implementation
+  - Location: `DbConnectionFactory.cs`
+  - Dependencies: IConfiguration, ILogger<DbConnectionFactory>
+  - Validation: Compiles, logs connection attempts
+
+## Phase 5: SQL Query Constants
+
+- [x] Create LotFinderQueries static class
+  - Location: `Queries/LotFinderQueries.cs`
+  - Contains: All SQL Server queries from spec (GetUserSearches, GetQueuedSearches, GetSearch, etc.)
+  - Validation: All queries compile as const strings
+
+- [x] Create JdeQueries static class
+  - Location: `Queries/JdeQueries.cs`
+  - Contains: All JDE Oracle queries from spec (GetWorkOrders, GetWorkOrderSteps, GetLots, etc.)
+  - Note: Include both full and filtered variants
+  - Validation: All queries compile as const strings
+
+- [x] Create CmsQueries static class
+  - Location: `Queries/CmsQueries.cs`
+  - Contains: SQL_GET_MIS_DATA query from spec
+  - Validation: Query compiles as const string
+
+## Phase 6: Repository Interfaces
+
+- [x] Create ILotFinderRepository interface
+  - Location: `Interfaces/ILotFinderRepository.cs`
+  - Methods: All 17 methods from spec (GetUserSearchesAsync, GetQueuedSearchesAsync, GetSearchAsync, GetSearchResultsAsync, SubmitSearchAsync, UpdateSearchStatusAsync, UpdateSearchResultsAsync, SearchItemsAsync, LookupItemsAsync, LookupWorkordersAsync, SearchWorkCentersAsync, LookupWorkCentersAsync, SearchProfitCentersAsync, LookupProfitCentersAsync, SearchUsersAsync, LookupUsersAsync, LookupLotsAsync, GetLastDataUpdatesAsync, GetTableSpecAsync, RebuildIndicesAsync, PostProcessMisDataAsync, BulkInsertAsync, TruncateTableAsync)
+  - Validation: Interface compiles
+
+- [x] Create IJdeRepository interface
+  - Location: `Interfaces/IJdeRepository.cs`
+  - Methods: All 18 methods from spec (GetWorkOrdersAsync, GetWorkOrdersArchiveAsync, GetWorkOrderStepsAsync, GetWorkOrderStepsArchiveAsync, GetWorkOrderTimesAsync, GetWorkOrderTimesArchiveAsync, GetWorkOrderRoutingsAsync, GetWorkOrderComponentsAsync, GetWorkOrderComponentsArchiveAsync, GetLotsAsync, GetLotUsagesAsync, GetLotUsagesArchiveAsync, GetLotLocationsAsync, GetItemsAsync, GetUsersAsync, GetBranchesAsync, GetProfitCentersAsync, GetWorkCentersAsync, GetStatusCodesAsync, GetFunctionCodesAsync, GetOrgHierarchyAsync, GetRouteMastersAsync)
+  - Return types: IAsyncEnumerable<T> for streaming
+  - Validation: Interface compiles
+
+- [x] Create ICmsRepository interface
+  - Location: `Interfaces/ICmsRepository.cs`
+  - Methods: GetMisDataAsync
+  - Return type: IAsyncEnumerable<MisData>
+  - Validation: Interface compiles
+
+## Phase 7: LotFinderRepository Implementation
+
+- [x] Create LotFinderRepository class
+  - Location: `Repositories/LotFinderRepository.cs`
+  - Dependencies: IDbConnectionFactory, ILogger<LotFinderRepository>, IOptions<DataAccessOptions>
+  - Validation: Class compiles
+
+- [x] Implement Search Management methods
+  - Methods: GetUserSearchesAsync, GetQueuedSearchesAsync, GetSearchAsync, GetSearchResultsAsync, SubmitSearchAsync, UpdateSearchStatusAsync, UpdateSearchResultsAsync
+  - Validation: Methods compile, use Dapper QueryAsync/ExecuteAsync
+
+- [x] Implement Reference Data Lookup methods
+  - Methods: SearchItemsAsync, LookupItemsAsync, LookupWorkordersAsync, SearchWorkCentersAsync, LookupWorkCentersAsync, SearchProfitCentersAsync, LookupProfitCentersAsync, SearchUsersAsync, LookupUsersAsync, LookupLotsAsync
+  - Note: Use DataTable for table-valued parameters
+  - Validation: Methods compile
+
+- [x] Implement Data Sync methods
+  - Methods: GetLastDataUpdatesAsync, GetTableSpecAsync, RebuildIndicesAsync, PostProcessMisDataAsync, BulkInsertAsync, TruncateTableAsync
+  - Note: RebuildIndicesAsync includes table name whitelist validation
+  - Validation: Methods compile
+
+## Phase 8: JdeRepository Implementation
+
+- [x] Create JdeRepository class
+  - Location: `Repositories/JdeRepository.cs`
+  - Dependencies: IDbConnectionFactory, ILogger<JdeRepository>, IOptions<DataAccessOptions>
+  - Validation: Class compiles
+
+- [x] Implement Work Order methods
+  - Methods: GetWorkOrdersAsync, GetWorkOrdersArchiveAsync, GetWorkOrderStepsAsync, GetWorkOrderStepsArchiveAsync, GetWorkOrderTimesAsync, GetWorkOrderTimesArchiveAsync, GetWorkOrderRoutingsAsync, GetWorkOrderComponentsAsync, GetWorkOrderComponentsArchiveAsync
+  - Pattern: IAsyncEnumerable<T> with Query (buffered: false) for streaming
+  - Validation: Methods compile
+
+- [x] Implement Lot methods
+  - Methods: GetLotsAsync, GetLotUsagesAsync, GetLotUsagesArchiveAsync, GetLotLocationsAsync
+  - Note: GetLotLocationsAsync uses JDE Stage connection
+  - Validation: Methods compile
+
+- [x] Implement Reference Data methods
+  - Methods: GetItemsAsync, GetUsersAsync, GetBranchesAsync, GetProfitCentersAsync, GetWorkCentersAsync, GetStatusCodesAsync, GetFunctionCodesAsync, GetOrgHierarchyAsync, GetRouteMastersAsync
+  - Note: GetStatusCodesAsync uses JDE Stage connection
+  - Validation: Methods compile
+
+- [x] Implement schema placeholder replacement
+  - Method: Private ApplySchemaReplacements method
+  - Replaces: {ProductionSchema}, {ArchiveSchema}, {StageSchema}
+  - Validation: Placeholders replaced correctly
+
+## Phase 9: CmsRepository Implementation
+
+- [x] Create CmsRepository class
+  - Location: `Repositories/CmsRepository.cs`
+  - Dependencies: IDbConnectionFactory, ILogger<CmsRepository>, IOptions<DataAccessOptions>
+  - Validation: Class compiles
+
+- [x] Implement GetMisDataAsync method
+  - Pattern: IAsyncEnumerable<MisData> with Query (buffered: false) for streaming
+  - Timeout: Uses MisDataTimeoutSeconds from options
+  - Validation: Method compiles
+
+## Phase 10: Service Registration
+
+- [x] Create ServiceCollectionExtensions class
+  - Location: `Extensions/ServiceCollectionExtensions.cs`
+  - Method: AddDataAccess(this IServiceCollection services, IConfiguration configuration)
+  - Registers: DataAccessOptions, IDbConnectionFactory (singleton), all repositories (scoped)
+  - Validation: Extension method compiles
+
+## Phase 11: Unit Tests
+
+- [x] Create test project
+  - Location: `NEW/tests/JdeScoping.DataAccess.Tests/JdeScoping.DataAccess.Tests.csproj`
+  - Dependencies: xUnit, NSubstitute, Shouldly
+  - Validation: Project builds
+
+- [x] Create DbConnectionFactory tests
+  - Tests: Connection creation, error handling, logging
+  - Validation: Tests pass
+
+- [x] Create LotFinderRepository tests
+  - Tests: Search methods, lookup methods, exception handling
+  - Mock: IDbConnectionFactory
+  - Validation: Tests pass
+
+- [x] Create JdeRepository tests
+  - Tests: Streaming methods, cancellation, schema replacement
+  - Mock: IDbConnectionFactory
+  - Validation: Tests pass
+
+- [x] Create CmsRepository tests
+  - Tests: GetMisDataAsync, timeout configuration
+  - Mock: IDbConnectionFactory
+  - Validation: Tests pass
+
+## Phase 12: Verification
+
+- [x] Build complete solution
+  - Command: `dotnet build NEW/JdeScoping.slnx`
+  - Validation: No build errors
+
+- [x] Run all unit tests
+  - Command: `dotnet test NEW/tests/JdeScoping.DataAccess.Tests/`
+  - Validation: All 124 tests pass
+
+- [x] Validate OpenSpec change
+  - Command: `openspec validate implement-data-access --strict`
+  - Validation: No validation errors
+
+- [x] Codex MCP review
+  - Review: Repository implementations against spec
+  - Verify: All methods match spec signatures
+  - Verify: Query SQL matches legacy exactly
@@ -0,0 +1,581 @@
+# Data Sync Service Design
+
+## Overview
+
+This document describes the architecture and implementation patterns for the data synchronization background service.
+
+## Component Architecture
+
+```
+JdeScoping.DataSync/
+├── DataSyncService.cs              # BackgroundService implementation
+├── IDataFetcher.cs                 # Generic fetcher interface
+├── IPostProcessor.cs               # Post-processing interface
+├── DataSyncOptions.cs              # Configuration options
+├── DataSourceConfig.cs             # Per-table configuration
+├── ScheduleChecker.cs              # Schedule evaluation logic
+├── SyncOrchestrator.cs             # Coordinates parallel sync operations
+├── TableSyncOperation.cs           # Single table sync execution
+├── StagingTableManager.cs          # Temp table creation and MERGE
+├── DataSyncHealthCheck.cs          # IHealthCheck implementation
+├── DataSyncMetrics.cs              # Metrics and telemetry
+├── ServiceCollectionExtensions.cs  # AddDataSync registration
+└── Fetchers/                       # IDataFetcher<T> implementations
+    ├── JdeWorkOrderFetcher.cs
+    ├── JdeLotUsageFetcher.cs
+    ├── JdeItemFetcher.cs
+    └── ...
+```
+
+## BackgroundService Pattern
+
+### ExecuteAsync Implementation
+
+```csharp
+public class DataSyncService : BackgroundService
+{
+    private readonly IServiceScopeFactory _scopeFactory;
+    private readonly IOptions<DataSyncOptions> _options;
+    private readonly ILogger<DataSyncService> _logger;
+    private readonly DataSyncMetrics _metrics;
+
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        // Startup: close any interrupted syncs from prior runs
+        await CloseOpenUpdateEntriesAsync(stoppingToken);
+
+        while (!stoppingToken.IsCancellationRequested)
+        {
+            try
+            {
+                // Create scope for this sync cycle
+                await using var scope = _scopeFactory.CreateAsyncScope();
+
+                var orchestrator = scope.ServiceProvider
+                    .GetRequiredService<ISyncOrchestrator>();
+
+                // Check schedules and execute pending syncs
+                await orchestrator.ExecutePendingSyncsAsync(stoppingToken);
+
+                // Periodic purge of old DataUpdate records
+                await PurgeUpdateEntriesAsync(scope, stoppingToken);
+            }
+            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
+            {
+                // Graceful shutdown
+                break;
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Error in sync cycle");
+            }
+
+            // Wait before next check
+            await Task.Delay(_options.Value.CheckInterval, stoppingToken);
+        }
+    }
+}
+```
+
+### Graceful Shutdown
+
+- `CancellationToken` propagates to all child operations
+- `Parallel.ForEachAsync` respects cancellation token
+- In-progress operations complete current batch or cancel gracefully
+- Incomplete syncs marked as failed with `WasSuccessful = false`
+
+## IDataFetcher<T> Interface
+
+### Interface Definition
+
+```csharp
+public interface IDataFetcher<TEntity> where TEntity : class
+{
+    /// <summary>
+    /// Fetches entities from source system as an async stream.
+    /// </summary>
+    /// <param name="minimumDT">For incremental fetches, only return records modified after this time. Null for full fetch.</param>
+    /// <param name="cancellationToken">Cancellation token for graceful shutdown.</param>
+    /// <returns>Async enumerable of entities, streamed from source.</returns>
+    IAsyncEnumerable<TEntity> FetchAsync(
+        DateTime? minimumDT,
+        CancellationToken cancellationToken = default);
+}
+```
+
+### Fetcher Resolution
+
+Fetchers are registered in DI by convention:
+
+```csharp
+services.AddScoped<IDataFetcher<WorkOrder>, JdeWorkOrderFetcher>();
+services.AddScoped<IDataFetcher<LotUsage>, JdeLotUsageFetcher>();
+services.AddScoped<IDataFetcher<Item>, JdeItemFetcher>();
+// ... etc
+```
+
+Configuration references fetcher type name:
+
+```json
+{
+  "DataSync": {
+    "DataSources": [
+      {
+        "TableName": "WorkOrder_Curr",
+        "SourceSystem": "JDE",
+        "FetcherTypeName": "JdeWorkOrderFetcher",
+        "IsEnabled": true,
+        "MassConfig": { "Enabled": true, "IntervalMinutes": 10080, "PrepurgeData": true },
+        "DailyConfig": { "Enabled": true, "IntervalMinutes": 1440 },
+        "HourlyConfig": { "Enabled": true, "IntervalMinutes": 60 }
+      }
+    ]
+  }
+}
+```
+
+At startup, `FetcherTypeName` is validated and resolved to a registered `IDataFetcher<T>`.
+
+## Configuration Classes
+
+### DataSyncOptions
+
+```csharp
+public class DataSyncOptions
+{
+    public const string SectionName = "DataSync";
+
+    /// <summary>Time between schedule checks (default: 1 minute)</summary>
+    public TimeSpan CheckInterval { get; set; } = TimeSpan.FromMinutes(1);
+
+    /// <summary>Maximum parallel sync operations (default: 8)</summary>
+    public int MaxDegreeOfParallelism { get; set; } = 8;
+
+    /// <summary>Records per batch for streaming (default: 1,000,000)</summary>
+    public int BatchSize { get; set; } = 1_000_000;
+
+    /// <summary>Rows per bulk copy batch (default: 10,000)</summary>
+    public int BulkCopyBatchSize { get; set; } = 10_000;
+
+    /// <summary>Multiplier for lookback window (default: 3)</summary>
+    public int LookbackMultiplier { get; set; } = 3;
+
+    /// <summary>Days to retain DataUpdate history (default: 30)</summary>
+    public int PurgeRetentionDays { get; set; } = 30;
+
+    /// <summary>Per-table data source configurations</summary>
+    public List<DataSourceConfig> DataSources { get; set; } = new();
+}
+```
+
+### DataSourceConfig
+
+```csharp
+public class DataSourceConfig
+{
+    /// <summary>Target table name in SQL Server cache</summary>
+    public required string TableName { get; set; }
+
+    /// <summary>Source system: "JDE" or "CMS"</summary>
+    public required string SourceSystem { get; set; }
+
+    /// <summary>Name of IDataFetcher<T> implementation type</summary>
+    public required string FetcherTypeName { get; set; }
+
+    /// <summary>Optional IPostProcessor implementation type name</summary>
+    public string? PostProcessorTypeName { get; set; }
+
+    /// <summary>Whether this data source is enabled for sync</summary>
+    public bool IsEnabled { get; set; } = true;
+
+    /// <summary>Mass sync schedule configuration</summary>
+    public ScheduleConfig MassConfig { get; set; } = new();
+
+    /// <summary>Daily incremental sync configuration</summary>
+    public ScheduleConfig DailyConfig { get; set; } = new();
+
+    /// <summary>Hourly incremental sync configuration</summary>
+    public ScheduleConfig HourlyConfig { get; set; } = new();
+}
+
+public class ScheduleConfig
+{
+    public bool Enabled { get; set; } = true;
+    public int IntervalMinutes { get; set; }
+    public bool PrepurgeData { get; set; } = false;
+    public bool ReIndexData { get; set; } = false;
+}
+```
+
+## Parallel Sync Execution
+
+### Parallel.ForEachAsync Pattern
+
+```csharp
+public class SyncOrchestrator : ISyncOrchestrator
+{
+    public async Task ExecutePendingSyncsAsync(CancellationToken cancellationToken)
+    {
+        var pendingTasks = await _scheduleChecker.GetPendingTasksAsync(cancellationToken);
+
+        if (pendingTasks.Count == 0)
+            return;
+
+        var parallelOptions = new ParallelOptions
+        {
+            MaxDegreeOfParallelism = _options.Value.MaxDegreeOfParallelism,
+            CancellationToken = cancellationToken
+        };
+
+        await Parallel.ForEachAsync(pendingTasks, parallelOptions, async (task, ct) =>
+        {
+            // Each task gets its own scope
+            await using var scope = _scopeFactory.CreateAsyncScope();
+
+            var operation = scope.ServiceProvider
+                .GetRequiredService<ITableSyncOperation>();
+
+            await operation.ExecuteAsync(task, ct);
+        });
+    }
+}
+```
+
+### Isolation Requirements
+
+- Each parallel sync operation creates its own `IServiceScope`
+- Each operation uses its own SQL connection from the scoped `DbContext` or connection factory
+- Staging tables use unique suffixes: `#Staging{TableName}_{OperationId}`
+- No shared mutable state between parallel operations
+
+## Staging Table Management
+
+### Naming Convention
+
+```
+#Staging{TableName}_{OperationId}    - Bulk copy destination
+#{TableName}_{OperationId}           - Deduplicated temp table for MERGE
+```
+
+Where `OperationId` is a GUID or sequential ID unique to each sync operation.
+
+### MERGE Operation Flow
+
+1. **Create staging table** matching destination schema with unique suffix
+2. **Bulk copy** source data to staging table (batched at 10,000 rows)
+3. **Deduplicate** into temp table using `ROW_NUMBER() OVER (PARTITION BY PK ORDER BY LastUpdateDT DESC)`
+4. **MERGE** from temp table to destination:
+   - INSERT new records (not matched by primary key)
+   - UPDATE existing records WHERE `source.LastUpdateDT > target.LastUpdateDT`
+5. **Cleanup** staging and temp tables
+
+### Mass Update with Truncation
+
+For mass updates with `PrepurgeData = true`:
+
+1. **Disable non-PK indexes** on destination table
+2. **TRUNCATE** destination table
+3. **Bulk copy** directly to destination (no staging needed)
+4. **Rebuild indexes** if `ReIndexData = true`
+5. **Update statistics**
+
+### Batching Large Datasets
+
+When streaming more than 1,000,000 records:
+
+```csharp
+int batchNumber = 0;
+var batch = new List<T>(_options.BatchSize);
+
+await foreach (var entity in fetcher.FetchAsync(minimumDT, ct))
+{
+    batch.Add(entity);
+
+    if (batch.Count >= _options.BatchSize)
+    {
+        await ProcessBatchAsync(batch, operationId, batchNumber++, ct);
+        batch.Clear();
+    }
+}
+
+// Process remaining records
+if (batch.Count > 0)
+{
+    await ProcessBatchAsync(batch, operationId, batchNumber, ct);
+}
+```
+
+## Update Logging
+
+### DataUpdate Record Lifecycle
+
+```
+Start: NumberRecords = -2 (in-progress marker)
+  |
+  v
+Success: NumberRecords = actual count, WasSuccessful = true, EndDT = now
+  OR
+Failure: NumberRecords = -1, WasSuccessful = false, EndDT = now
+```
+
+### Logging with Scope
+
+```csharp
+public async Task ExecuteAsync(DataUpdateTask task, CancellationToken ct)
+{
+    using var logScope = _logger.BeginScope(new Dictionary<string, object>
+    {
+        ["TableName"] = task.TableName,
+        ["UpdateType"] = task.UpdateType,
+        ["OperationId"] = task.OperationId
+    });
+
+    var updateId = await _repository.StartUpdateAsync(task, ct);
+
+    try
+    {
+        var recordCount = await ExecuteSyncAsync(task, ct);
+        await _repository.CompleteUpdateAsync(updateId, recordCount, success: true, ct);
+        _logger.LogInformation("Sync completed: {RecordCount} records", recordCount);
+    }
+    catch (Exception ex)
+    {
+        await _repository.CompleteUpdateAsync(updateId, -1, success: false, ct);
+        _logger.LogError(ex, "Sync failed");
+        throw;
+    }
+}
+```
+
+### Startup Recovery
+
+At startup, `CloseOpenUpdateEntries()` updates any records with `NumberRecords = -2`:
+
+```sql
+UPDATE DataUpdate
+SET EndDT = GETDATE(),
+    WasSuccessful = 0,
+    NumberRecords = -1
+WHERE NumberRecords = -2
+```
+
+## Health Checks
+
+### IHealthCheck Implementation
+
+```csharp
+public class DataSyncHealthCheck : IHealthCheck
+{
+    public async Task<HealthCheckResult> CheckHealthAsync(
+        HealthCheckContext context,
+        CancellationToken cancellationToken = default)
+    {
+        var statuses = await GetTableStatusesAsync(cancellationToken);
+        var data = new Dictionary<string, object>();
+
+        foreach (var status in statuses)
+        {
+            data[$"{status.TableName}_LastSync"] = status.LastSyncTime?.ToString("O") ?? "Never";
+            data[$"{status.TableName}_Status"] = status.IsOverdue ? "Overdue" : "Current";
+        }
+
+        var overdueCount = statuses.Count(s => s.IsOverdue);
+        var failedCount = statuses.Count(s => s.RecentFailures > 0);
+
+        if (failedCount > 0)
+            return HealthCheckResult.Unhealthy("Multiple recent sync failures", data: data);
+
+        if (overdueCount > 0)
+            return HealthCheckResult.Degraded($"{overdueCount} tables overdue for sync", data: data);
+
+        return HealthCheckResult.Healthy("All syncs current", data: data);
+    }
+}
+```
+
+## Telemetry
+
+### Metrics
+
+```csharp
+public class DataSyncMetrics
+{
+    private readonly Meter _meter;
+    private readonly Counter<long> _operationsStarted;
+    private readonly Counter<long> _operationsCompleted;
+    private readonly Counter<long> _operationsFailed;
+    private readonly Histogram<double> _operationDuration;
+    private readonly Histogram<long> _recordsProcessed;
+
+    public DataSyncMetrics(IMeterFactory meterFactory)
+    {
+        _meter = meterFactory.Create("DataSync");
+        _operationsStarted = _meter.CreateCounter<long>("sync.operations.started");
+        _operationsCompleted = _meter.CreateCounter<long>("sync.operations.completed");
+        _operationsFailed = _meter.CreateCounter<long>("sync.operations.failed");
+        _operationDuration = _meter.CreateHistogram<double>("sync.duration.seconds");
+        _recordsProcessed = _meter.CreateHistogram<long>("sync.records.processed");
+    }
+
+    public void RecordOperationStarted(string tableName, string updateType)
+    {
+        _operationsStarted.Add(1,
+            new KeyValuePair<string, object?>("table", tableName),
+            new KeyValuePair<string, object?>("type", updateType));
+    }
+
+    // ... similar for completed, failed, duration, records
+}
+```
+
+### Activity Tracing
+
+```csharp
+public static class DataSyncActivitySource
+{
+    public static readonly ActivitySource Source = new("DataSync");
+
+    public static Activity? StartSyncOperation(string tableName, string updateType)
+    {
+        return Source.StartActivity("SyncTable", ActivityKind.Internal)?
+            .SetTag("table.name", tableName)
+            .SetTag("update.type", updateType);
+    }
+}
+```
+
+## DI Registration
+
+### AddDataSync Extension
+
+```csharp
+public static class ServiceCollectionExtensions
+{
+    public static IServiceCollection AddDataSync(
+        this IServiceCollection services,
+        IConfiguration configuration)
+    {
+        // Bind configuration
+        services.Configure<DataSyncOptions>(
+            configuration.GetSection(DataSyncOptions.SectionName));
+
+        // Register core services
+        services.AddHostedService<DataSyncService>();
+        services.AddScoped<ISyncOrchestrator, SyncOrchestrator>();
+        services.AddScoped<IScheduleChecker, ScheduleChecker>();
+        services.AddScoped<ITableSyncOperation, TableSyncOperation>();
+        services.AddScoped<IStagingTableManager, StagingTableManager>();
+
+        // Register health check
+        services.AddHealthChecks()
+            .AddCheck<DataSyncHealthCheck>("data-sync");
+
+        // Register metrics
+        services.AddSingleton<DataSyncMetrics>();
+
+        // Register fetchers
+        services.AddScoped<IDataFetcher<WorkOrder>, JdeWorkOrderFetcher>();
+        services.AddScoped<IDataFetcher<LotUsage>, JdeLotUsageFetcher>();
+        // ... etc
+
+        // Validate configuration at startup
+        services.AddOptions<DataSyncOptions>()
+            .ValidateDataAnnotations()
+            .ValidateOnStart();
+
+        return services;
+    }
+}
+```
+
+## Schedule Checking Logic
+
+### Priority: Mass > Daily > Hourly
+
+```csharp
+public async Task<List<DataUpdateTask>> GetPendingTasksAsync(CancellationToken ct)
+{
+    var lastUpdates = await _repository.GetLastDataUpdatesAsync(ct);
+    var tasks = new List<DataUpdateTask>();
+
+    foreach (var config in _options.Value.DataSources.Where(c => c.IsEnabled))
+    {
+        var lastSync = lastUpdates.GetValueOrDefault(config.TableName);
+        var now = DateTime.UtcNow;
+
+        // Check Mass first (highest priority)
+        if (config.MassConfig.Enabled && NeedsMassSync(config, lastSync, now))
+        {
+            tasks.Add(CreateMassTask(config));
+            continue; // Skip daily/hourly checks
+        }
+
+        // Check Daily
+        if (config.DailyConfig.Enabled && NeedsDailySync(config, lastSync, now))
+        {
+            tasks.Add(CreateDailyTask(config, lastSync));
+            continue;
+        }
+
+        // Check Hourly
+        if (config.HourlyConfig.Enabled && NeedsHourlySync(config, lastSync, now))
+        {
+            tasks.Add(CreateHourlyTask(config, lastSync));
+        }
+    }
+
+    return tasks;
+}
+```
+
+### MinimumDT Calculation
+
+For Daily updates:
+```
+MinimumDT = LastDailyUpdateDT - (LookbackMultiplier * DailyInterval)
+```
+
+For Hourly updates (uses Daily timestamp, not Hourly):
+```
+MinimumDT = LastDailyUpdateDT - (LookbackMultiplier * DailyInterval)
+```
+
+## File Structure
+
+```
+NEW/src/
+├── JdeScoping.DataSync/
+│   ├── JdeScoping.DataSync.csproj
+│   ├── DataSyncService.cs
+│   ├── Configuration/
+│   │   ├── DataSyncOptions.cs
+│   │   └── DataSourceConfig.cs
+│   ├── Contracts/
+│   │   ├── IDataFetcher.cs
+│   │   ├── IPostProcessor.cs
+│   │   ├── ISyncOrchestrator.cs
+│   │   ├── IScheduleChecker.cs
+│   │   ├── ITableSyncOperation.cs
+│   │   └── IStagingTableManager.cs
+│   ├── Services/
+│   │   ├── SyncOrchestrator.cs
+│   │   ├── ScheduleChecker.cs
+│   │   ├── TableSyncOperation.cs
+│   │   └── StagingTableManager.cs
+│   ├── Fetchers/
+│   │   ├── Jde/
+│   │   │   ├── JdeWorkOrderFetcher.cs
+│   │   │   ├── JdeLotUsageFetcher.cs
+│   │   │   └── ...
+│   │   └── Cms/
+│   │       └── CmsMisDataFetcher.cs
+│   ├── HealthChecks/
+│   │   └── DataSyncHealthCheck.cs
+│   ├── Telemetry/
+│   │   ├── DataSyncMetrics.cs
+│   │   └── DataSyncActivitySource.cs
+│   └── DependencyInjection/
+│       └── ServiceCollectionExtensions.cs
+└── JdeScoping.Host/
+    └── Program.cs  (add: builder.Services.AddDataSync(configuration))
+```
@@ -0,0 +1,68 @@
+# Implement Data Sync Service
+
+## Summary
+
+Implement the background data synchronization service as a .NET BackgroundService that maintains the local SQL Server cache by fetching data from JDE (Oracle) and CMS (Sybase) source systems on configurable schedules.
+
+## Scope
+
+### In Scope
+
+- `DataSyncService` inheriting from `BackgroundService` with proper lifecycle management
+- `IDataFetcher<T>` interface and fetcher implementations for each table type
+- `DataSyncOptions` and `DataSourceConfig` strongly-typed configuration classes
+- Schedule-based triggering (Mass/Daily/Hourly) with interval checking
+- Staging table management with MERGE operations for upserts
+- `DataUpdate` logging for audit trail and recovery
+- Health checks exposing sync status via ASP.NET Core health check framework
+- Telemetry via `System.Diagnostics.Metrics` and `ActivitySource`
+- `AddDataSync` extension method for DI registration
+
+### Out of Scope
+
+- Admin API for manual archive sync triggering (separate change)
+- Circuit breaker implementation for CMS (can be added later)
+- Periodic index maintenance (separate change)
+- Actual JDE/CMS database connectivity (will use mock fetchers initially)
+
+## Motivation
+
+The legacy `UpdateProcessor` runs as a Topshelf Windows service with reflection-based data fetchers and global temp tables. The new implementation uses modern .NET patterns:
+
+- `BackgroundService` for proper ASP.NET Core hosting integration
+- `IDataFetcher<T>` interfaces for type-safe, testable data retrieval
+- `Parallel.ForEachAsync` for cancellation-aware parallel execution
+- Local temp tables with unique suffixes for parallel isolation
+- `IOptions<T>` pattern for strongly-typed configuration
+
+## Acceptance Criteria
+
+1. `DataSyncService` starts with the host and respects `CancellationToken` for graceful shutdown
+2. Service checks schedules and queues sync tasks based on `LastDataUpdates` timestamps
+3. Sync operations execute in parallel with configurable `MaxDegreeOfParallelism`
+4. Each sync creates staging tables, bulk copies data, and executes MERGE operations
+5. All sync operations are logged to `DataUpdate` table with proper start/end/success tracking
+6. Interrupted syncs are marked as failed at startup via `CloseOpenUpdateEntries()`
+7. Health check reports sync status (Healthy/Degraded/Unhealthy) based on interval compliance
+8. Metrics emitted for operations started/completed/failed and duration histograms
+9. `openspec validate implement-data-sync --strict` passes
+
+## Dependencies
+
+- `migrate-database-schema` - DataUpdate table and related schema must exist
+- `data-access` spec - Repository patterns for database operations
+
+## Risks
+
+| Risk | Mitigation |
+|------|------------|
+| Complex parallel execution | Use `Parallel.ForEachAsync` with proper scoping; local temp tables with unique suffixes |
+| Schedule calculation edge cases | Comprehensive unit tests for schedule checking logic |
+| Memory pressure from large datasets | `IAsyncEnumerable<T>` streaming with batched bulk copy |
+| Staging table conflicts | Unique `_{OperationId}` suffix on all temp tables |
+
+## Related Specs
+
+- `data-sync` - Core specification for sync behavior and schedules
+- `domain-models` - Entity definitions for synced data
+- `database-schema` - Table structures and DataUpdate table
@@ -0,0 +1,156 @@
+# Data Sync Specification - Implementation Additions
+
+## Purpose
+
+This specification extends the base data-sync spec with additional implementation-focused requirements for the BackgroundService pattern and parallel fetch isolation.
+
+## ADDED Requirements
+
+### Requirement: Background service implementation pattern
+
+The system SHALL implement the data synchronization service following .NET BackgroundService best practices for hosted service lifecycle management.
+
+#### Inputs
+
+- `IServiceScopeFactory` for creating scoped service instances
+- `IOptions<DataSyncOptions>` for configuration access
+- `ILogger<DataSyncService>` for structured logging
+- `CancellationToken` from `ExecuteAsync` stoppingToken parameter
+
+#### Outputs
+
+- Continuously running background task that checks schedules and executes syncs
+- Proper cleanup on shutdown with all resources disposed
+- Logging scope context for all operations
+
+#### Business Rules
+
+- The service MUST implement `BackgroundService.ExecuteAsync(CancellationToken)`
+- The main loop MUST use `Task.Delay(checkInterval, stoppingToken)` between cycles
+- Each sync cycle MUST create a new `IServiceScope` via `IServiceScopeFactory.CreateAsyncScope()`
+- All scoped services MUST be resolved from the current scope, not from root provider
+- The scope MUST be disposed using `await using` pattern after each cycle
+- Exception handling MUST catch and log errors without crashing the service
+- `OperationCanceledException` MUST be caught and result in graceful loop exit when `stoppingToken.IsCancellationRequested`
+- The service MUST NOT use static state or shared mutable collections
+
+#### Scenario: Normal sync cycle execution
+
+- **WHEN** the BackgroundService enters ExecuteAsync
+- **THEN** the service SHALL call CloseOpenUpdateEntriesAsync to recover from prior crashes
+- **THEN** the service SHALL enter a while loop checking `!stoppingToken.IsCancellationRequested`
+- **THEN** each iteration SHALL create a new IServiceScope
+- **THEN** the ISyncOrchestrator SHALL be resolved from the scope
+- **THEN** ExecutePendingSyncsAsync SHALL be called with the stoppingToken
+- **THEN** the scope SHALL be disposed after the call completes
+- **THEN** Task.Delay SHALL pause before the next iteration
+
+#### Scenario: Exception during sync cycle
+
+- **WHEN** an exception occurs during sync execution (not OperationCanceledException)
+- **THEN** the exception SHALL be caught and logged with LogError
+- **THEN** the service SHALL continue to the next iteration
+- **THEN** the current scope SHALL still be disposed properly
+- **THEN** the service SHALL NOT crash or stop unexpectedly
+
+#### Scenario: Graceful shutdown request
+
+- **WHEN** the host signals shutdown by canceling the stoppingToken
+- **THEN** any running Task.Delay SHALL throw OperationCanceledException
+- **THEN** the while loop SHALL exit on the IsCancellationRequested check
+- **THEN** the ExecuteAsync method SHALL complete normally
+- **THEN** any in-progress sync operations SHALL receive the cancellation and complete or cancel
+
+### Requirement: Parallel fetch isolation with scoped resources
+
+The system SHALL ensure complete isolation between parallel sync operations using scoped resources and unique identifiers.
+
+#### Inputs
+
+- List of `DataUpdateTask` objects to execute in parallel
+- `MaxDegreeOfParallelism` configuration value
+- `CancellationToken` for coordinated cancellation
+
+#### Outputs
+
+- Concurrent execution of sync operations with no resource conflicts
+- Unique staging tables per operation that do not collide
+- Independent database connections per operation
+
+#### Business Rules
+
+- `Parallel.ForEachAsync` MUST be used with `ParallelOptions.CancellationToken` set
+- Each parallel task MUST create its own `IServiceScope` inside the parallel delegate
+- Database connections MUST NOT be shared across parallel operations
+- Staging table names MUST include a unique `OperationId` suffix (GUID or sequential ID)
+- Format: `#Staging{TableName}_{OperationId}` and `#{TableName}_{OperationId}`
+- Each parallel operation MUST resolve its own instances of all scoped services
+- No `ConcurrentDictionary`, shared counters, or other shared mutable state SHALL exist between operations
+- Total record counts SHALL be accumulated via return values, not shared state
+
+#### Scenario: Parallel sync with isolated scopes
+
+- **WHEN** multiple DataUpdateTasks are executed via Parallel.ForEachAsync
+- **THEN** each task SHALL execute the async delegate independently
+- **THEN** each delegate SHALL create a new IServiceScope using CreateAsyncScope
+- **THEN** ITableSyncOperation SHALL be resolved from each scope independently
+- **THEN** each operation SHALL use its own database connection from the scope
+- **THEN** staging tables SHALL use unique OperationId suffixes preventing name collisions
+- **THEN** completion of one operation SHALL NOT affect the execution of others
+
+#### Scenario: Parallel cancellation propagation
+
+- **WHEN** cancellation is requested during Parallel.ForEachAsync execution
+- **THEN** the CancellationToken SHALL propagate to all running parallel operations
+- **THEN** Parallel.ForEachAsync SHALL stop starting new operations
+- **THEN** running operations SHALL receive the token in their async methods
+- **THEN** each operation SHALL check the token and exit gracefully
+- **THEN** incomplete operations SHALL mark their DataUpdate records as failed
+
+#### Scenario: Staging table uniqueness verification
+
+- **WHEN** two sync operations for the same table run in parallel
+- **THEN** each operation SHALL generate a unique OperationId as GUID
+- **THEN** operation A SHALL create staging table with GuidA suffix
+- **THEN** operation B SHALL create staging table with GuidB suffix
+- **THEN** no SQL errors SHALL occur from table name conflicts
+- **THEN** each operation cleanup SHALL only drop its own staging tables
+
+### Requirement: Structured logging context
+
+The system SHALL use ILogger.BeginScope to attach contextual information to all log entries during sync operations.
+
+#### Inputs
+
+- `ILogger<T>` injected into sync operation classes
+- TableName, UpdateType, OperationId values from current operation
+
+#### Outputs
+
+- All log entries within the scope contain the contextual properties
+- Log aggregation systems can filter and group by table, type, or operation
+
+#### Business Rules
+
+- Each sync operation MUST call `_logger.BeginScope(...)` at the start
+- The scope MUST include at minimum: TableName, UpdateType, OperationId
+- The scope MUST be disposed using `using` statement when operation completes
+- Nested scopes for batches SHALL preserve parent scope properties
+- LogInformation, LogWarning, LogError calls within the scope SHALL include the context automatically
+
+#### Scenario: Log scope creation and usage
+
+- **WHEN** a TableSyncOperation begins execution
+- **THEN** the operation SHALL create a logging scope with TableName, UpdateType, OperationId
+- **THEN** all log calls within ExecuteAsync SHALL include these properties
+- **THEN** when the operation completes the scope SHALL be disposed
+- **THEN** subsequent operations SHALL have their own independent scopes
+
+## Migration Notes
+
+| Legacy Pattern | New Pattern | Rationale |
+|----------------|-------------|-----------|
+| Static `UpdateProcessor` methods | Scoped services resolved per operation | Proper DI lifecycle, testability |
+| Shared instance state | Return values and scoped state only | Thread safety in parallel scenarios |
+| `Console.WriteLine` logging | `ILogger<T>` with `BeginScope` | Structured logging, context propagation |
+| Global temp tables `##table` | Local temp tables `#table_{id}` | Session-scoped isolation for parallelism |
@@ -0,0 +1,227 @@
+# Tasks: Implement Data Sync Service
+
+## Phase 1: Configuration and Interfaces
+
+- [x] Create JdeScoping.DataSync project
+  - Create `NEW/src/JdeScoping.DataSync/JdeScoping.DataSync.csproj`
+  - Add references to JdeScoping.Domain and JdeScoping.Database
+  - Validation: Project compiles and is referenced by JdeScoping.Host
+
+- [x] Create DataSyncOptions configuration class
+  - File: `Configuration/DataSyncOptions.cs`
+  - Properties: CheckInterval, MaxDegreeOfParallelism, BatchSize, BulkCopyBatchSize, LookbackMultiplier, PurgeRetentionDays, DataSources
+  - Validation: Options bind from appsettings.json DataSync section
+
+- [x] Create DataSourceConfig configuration class
+  - File: `Configuration/DataSourceConfig.cs`
+  - Properties: TableName, SourceSystem, FetcherTypeName, PostProcessorTypeName, IsEnabled, MassConfig, DailyConfig, HourlyConfig
+  - Include ScheduleConfig nested class
+  - Validation: Configuration parses correctly from JSON
+
+- [x] Create IDataFetcher<T> interface
+  - File: `Contracts/IDataFetcher.cs`
+  - Method: `IAsyncEnumerable<T> FetchAsync(DateTime? minimumDT, CancellationToken cancellationToken)`
+  - Validation: Interface compiles with correct signature
+
+- [x] Create IPostProcessor interface
+  - File: `Contracts/IPostProcessor.cs`
+  - Method: `Task ProcessAsync(string tableName, CancellationToken cancellationToken)`
+  - Validation: Interface compiles with correct signature
+
+- [x] Create supporting interfaces
+  - Files: `Contracts/ISyncOrchestrator.cs`, `IScheduleChecker.cs`, `ITableSyncOperation.cs`, `IStagingTableManager.cs`
+  - Validation: All interfaces compile
+
+## Phase 2: Core Service Implementation
+
+- [x] Create DataSyncService (BackgroundService)
+  - File: `DataSyncService.cs`
+  - Implement ExecuteAsync with main sync loop
+  - Inject IServiceScopeFactory, IOptions<DataSyncOptions>, ILogger
+  - Call CloseOpenUpdateEntriesAsync at startup
+  - Call PurgeUpdateEntriesAsync periodically
+  - Respect CancellationToken throughout
+  - Validation: Service starts with host and stops gracefully
+
+- [x] Create ScheduleChecker service
+  - File: `Services/ScheduleChecker.cs`
+  - Implement GetPendingTasksAsync to check Mass/Daily/Hourly schedules
+  - Priority order: Mass > Daily > Hourly
+  - Check both IsEnabled and specific schedule Enabled flags
+  - Calculate MinimumDT with lookback multiplier (Daily timestamp for Hourly)
+  - Validation: Unit tests for schedule checking logic pass
+
+- [x] Create SyncOrchestrator service
+  - File: `Services/SyncOrchestrator.cs`
+  - Implement ExecutePendingSyncsAsync using Parallel.ForEachAsync
+  - Create IServiceScope per parallel operation
+  - Pass CancellationToken to all operations
+  - Validation: Multiple syncs run in parallel up to MaxDegreeOfParallelism
+
+- [x] Create DataUpdateTask model
+  - File: `Models/DataUpdateTask.cs`
+  - Properties: TableName, UpdateType, SourceSystem, MinimumDT, OperationId, Config
+  - Validation: Model used by ScheduleChecker and SyncOrchestrator
+
+## Phase 3: Table Sync Operations
+
+- [x] Create TableSyncOperation service
+  - File: `Services/TableSyncOperation.cs`
+  - Implement ExecuteAsync for single table sync
+  - Create DataUpdate record at start (NumberRecords = -2)
+  - Resolve IDataFetcher<T> and execute FetchAsync
+  - Batch records and delegate to StagingTableManager
+  - Update DataUpdate record on success/failure
+  - Use ILogger.BeginScope for structured logging
+  - Validation: Single table sync executes end-to-end
+
+- [x] Create StagingTableManager service
+  - File: `Services/StagingTableManager.cs`
+  - Create staging tables with unique suffix: `#Staging{Table}_{OperationId}`
+  - Implement bulk copy with BulkCopyBatchSize
+  - Implement deduplication to temp table with ROW_NUMBER
+  - Generate and execute MERGE statement
+  - Handle tables with/without LastUpdateDT column
+  - Clean up staging and temp tables
+  - Validation: MERGE correctly inserts new and updates existing records
+
+- [x] Implement mass update with truncation
+  - In StagingTableManager or separate method
+  - Disable non-PK indexes before truncate
+  - TRUNCATE destination table when PrepurgeData = true
+  - Bulk copy directly to destination
+  - Rebuild indexes if ReIndexData = true
+  - Validation: Mass update truncates and reloads table
+
+- [x] Implement batching for large datasets
+  - In TableSyncOperation
+  - Process records in batches of BatchSize (1,000,000)
+  - Each batch creates fresh staging/temp tables with unique suffix
+  - Accumulate total record count across batches
+  - Validation: Large dataset processes in multiple batches
+
+## Phase 4: Data Fetcher Implementations
+
+- [x] Create mock/test fetcher base class
+  - File: `Fetchers/MockDataFetcher.cs`
+  - Returns sample data for testing without JDE/CMS connectivity
+  - Validation: Tests can run without external databases
+
+- [x] Create JDE fetcher implementations (stubs)
+  - Files: `Fetchers/Jde/JdeWorkOrderFetcher.cs`, `JdeLotUsageFetcher.cs`, `JdeItemFetcher.cs`, etc.
+  - Implement IDataFetcher<T> interface
+  - Initially delegate to mock or throw NotImplementedException
+  - Validation: All fetchers register in DI and resolve correctly
+
+- [x] Create CMS fetcher implementation (stub)
+  - File: `Fetchers/Cms/CmsMisDataFetcher.cs`
+  - Implement IDataFetcher<MisData>
+  - Initially delegate to mock or throw NotImplementedException
+  - Validation: CMS fetcher registers in DI and resolves correctly
+
+## Phase 5: Update Logging and Recovery
+
+- [x] Implement update logging repository methods
+  - In existing repository or new DataUpdateRepository
+  - StartUpdateAsync: Insert DataUpdate with NumberRecords = -2
+  - CompleteUpdateAsync: Update EndDT, WasSuccessful, NumberRecords
+  - GetLastDataUpdatesAsync: Query LastDataUpdates view
+  - Validation: DataUpdate records created and updated correctly
+
+- [x] Implement CloseOpenUpdateEntries
+  - Method in DataSyncService or repository
+  - Update all records where NumberRecords = -2 to failed state
+  - Called at service startup
+  - Validation: Interrupted syncs marked as failed on restart
+
+- [x] Implement PurgeUpdateEntries
+  - Method in DataSyncService or repository
+  - Delete DataUpdate records older than PurgeRetentionDays
+  - Called periodically (e.g., daily)
+  - Validation: Old records purged correctly
+
+## Phase 6: Health Checks and Telemetry
+
+- [x] Create DataSyncHealthCheck
+  - File: `HealthChecks/DataSyncHealthCheck.cs`
+  - Implement IHealthCheck interface
+  - Return Healthy when all tables synced within interval
+  - Return Degraded when tables overdue but syncs progressing
+  - Return Unhealthy when repeated failures
+  - Include per-table status in response data
+  - Validation: Health endpoint returns correct status
+
+- [x] Create DataSyncMetrics
+  - File: `Telemetry/DataSyncMetrics.cs`
+  - Create Meter named "DataSync"
+  - Counters: sync.operations.started, completed, failed
+  - Histograms: sync.duration.seconds, sync.records.processed
+  - Include table name and update type as tags
+  - Validation: Metrics emitted during sync operations
+
+- [x] Create DataSyncActivitySource
+  - File: `Telemetry/DataSyncActivitySource.cs`
+  - Create ActivitySource named "DataSync"
+  - Start activity for each sync operation with table/type tags
+  - Complete activity with record count on success
+  - Set error status on failure
+  - Validation: Activities visible in distributed tracing
+
+## Phase 7: DI Registration
+
+- [x] Create AddDataSync extension method
+  - File: `DependencyInjection/ServiceCollectionExtensions.cs`
+  - Configure DataSyncOptions from configuration
+  - Register DataSyncService as hosted service
+  - Register all scoped services (orchestrator, checker, operation, staging)
+  - Register health check
+  - Register metrics singleton
+  - Register all fetcher implementations
+  - Add options validation
+  - Validation: All services resolve correctly at startup
+
+- [x] Update JdeScoping.Host Program.cs
+  - Add `builder.Services.AddDataSync(builder.Configuration)`
+  - Validation: Host starts with data sync service running
+
+- [x] Add DataSync configuration to appsettings.json
+  - Add DataSync section with options and data sources
+  - Include all table configurations from spec
+  - Validation: Configuration loads correctly
+
+## Phase 8: Testing
+
+- [x] Write unit tests for ScheduleChecker
+  - Test Mass/Daily/Hourly priority
+  - Test MinimumDT calculation with lookback
+  - Test disabled table handling
+  - Test first sync (no prior updates) scenario
+  - Validation: All schedule logic tests pass
+
+- [x] Write unit tests for StagingTableManager
+  - Test staging table creation with unique suffix
+  - Test MERGE with/without LastUpdateDT column
+  - Test mass update truncation path
+  - Validation: All staging/merge logic tests pass
+
+- [x] Write integration tests for DataSyncService
+  - Test service startup and shutdown
+  - Test CloseOpenUpdateEntries at startup
+  - Test parallel sync execution
+  - Test cancellation handling
+  - Validation: Integration tests pass with test database
+
+## Phase 9: Validation
+
+- [x] Run openspec validate
+  - Command: `openspec validate implement-data-sync --strict`
+  - Fix any validation errors
+  - Validation: Validation passes
+
+- [x] Verify all acceptance criteria met
+  - DataSyncService starts and stops gracefully
+  - Schedules checked and tasks queued correctly
+  - Parallel execution works with proper isolation
+  - DataUpdate logging complete
+  - Health check reports correct status
+  - Metrics emitted correctly
@@ -0,0 +1,277 @@
+# Domain Models Design
+
+## Overview
+
+This document describes the design approach for implementing domain model entities in the JDE Scoping Tool .NET 10 migration.
+
+## Project Organization
+
+All domain models reside in the `JdeScoping.Core` project:
+
+```
+JdeScoping.Core/
+├── Models/
+│   ├── Enums/
+│   │   ├── SearchStatus.cs         # Search processing states
+│   │   └── UpdateTypes.cs          # Data sync frequency types
+│   │
+│   ├── Search.cs                   # User search request entity
+│   ├── SearchCriteria.cs           # Filter parameters for queries
+│   ├── SearchUpdate.cs             # SignalR status update DTO
+│   │
+│   ├── WorkOrder.cs                # JDE work order entity
+│   ├── WorkOrderStep.cs            # Work order operation step
+│   ├── WorkOrderTime.cs            # F31122 time transaction
+│   ├── WorkOrderComponent.cs       # Component usage
+│   ├── WorkOrderRouting.cs         # Step transaction
+│   │
+│   ├── Lot.cs                      # JDE lot entity
+│   ├── LotUsage.cs                 # Cardex consumption record
+│   ├── LotLocation.cs              # Lot location tracking
+│   │
+│   ├── Item.cs                     # JDE item master
+│   ├── WorkCenter.cs               # JDE work center (IBusinessUnit)
+│   ├── ProfitCenter.cs             # JDE profit center (IBusinessUnit)
+│   ├── Branch.cs                   # JDE branch entity
+│   ├── JdeUser.cs                  # JDE operator entity
+│   ├── StatusCode.cs               # Work order status lookup
+│   ├── FunctionCode.cs             # Function code lookup
+│   │
+│   ├── DataUpdate.cs               # Cache refresh tracking
+│   ├── OrgHierarchy.cs             # Profit center to work center mapping
+│   ├── RouteMaster.cs              # Item router master
+│   ├── StatusUpdate.cs             # Generic process status message
+│   │
+│   ├── MisData.cs                  # CMS MIS data entity
+│   │
+│   ├── UserInfo.cs                 # Authenticated user info
+│   │
+│   ├── POReceiver.cs               # PO receiver record
+│   ├── POInspect.cs                # PO inspection record
+│   ├── DcsLot.cs                   # DCS lot record
+│   ├── CamstarMO.cs                # Camstar manufacturing order
+│   │
+│   ├── QueryTypes.cs               # Query type definitions
+│   ├── TableSpec.cs                # Dynamic SQL table spec
+│   └── ColumnSpec.cs               # Column specification
+│
+├── Interfaces/
+│   └── IBusinessUnit.cs            # WorkCenter/ProfitCenter interface
+│
+├── ViewModels/
+│   ├── WorkOrderViewModel.cs       # WorkOrder projection
+│   ├── LotViewModel.cs             # Lot projection
+│   ├── ItemViewModel.cs            # Item projection
+│   ├── WorkCenterViewModel.cs      # WorkCenter projection
+│   ├── ProfitCenterViewModel.cs    # ProfitCenter projection
+│   ├── JdeUserViewModel.cs         # JdeUser projection
+│   └── PartOperationViewModel.cs   # Item/operation/MIS combination
+│
+├── Extensions/
+│   ├── WorkOrderExtensions.cs      # WorkOrder.ToViewModel()
+│   ├── LotExtensions.cs            # Lot.ToViewModel()
+│   ├── ItemExtensions.cs           # Item.ToViewModel()
+│   ├── WorkCenterExtensions.cs     # WorkCenter.ToViewModel()
+│   ├── ProfitCenterExtensions.cs   # ProfitCenter.ToViewModel()
+│   └── JdeUserExtensions.cs        # JdeUser.ToViewModel()
+│
+└── Helpers/
+    └── JdeDateConverter.cs         # JDE date/time conversion
+```
+
+## Design Patterns
+
+### Nullable Reference Types
+
+The project has `<Nullable>enable</Nullable>` in the .csproj. All properties follow these patterns:
+
+| Pattern | Example | Usage |
+|---------|---------|-------|
+| Required property | `public string Name { get; set; } = string.Empty;` | Non-null, initialized |
+| Optional property | `public string? Description { get; set; }` | Explicitly nullable |
+| Collection property | `public List<string> Items { get; set; } = [];` | Never null, empty default |
+| Nullable byte array | `public byte[]? Results { get; set; }` | Null until populated |
+
+### System.Text.Json Serialization
+
+All enums that may be serialized use the string converter:
+
+```csharp
+using System.Text.Json.Serialization;
+
+[JsonConverter(typeof(JsonStringEnumConverter))]
+public enum SearchStatus
+{
+    New = 0,
+    Submitted = 1,
+    Started = 2,
+    Ended = 3,
+    Error = 4
+}
+```
+
+This ensures JSON output is `"Status": "Ended"` instead of `"Status": 3`.
+
+### JDE Date Conversion Pattern
+
+JDE stores dates as integers in CYYDDD format (century + year + day of year) and times as HHMMSS:
+
+```csharp
+public static class JdeDateConverter
+{
+    /// <summary>
+    /// Converts JDE date (CYYDDD) and time (HHMMSS) to DateTime.
+    /// Returns null for zero or invalid values (changed from legacy 1900-01-01).
+    /// </summary>
+    public static DateTime? ToDateTime(int jdeDate, int jdeTime = 0)
+    {
+        if (jdeDate <= 0)
+            return null;
+
+        try
+        {
+            // CYYDDD format: C = century (0=1900s, 1=2000s), YY = year, DDD = day of year
+            int century = jdeDate / 100000;
+            int yearInCentury = (jdeDate / 1000) % 100;
+            int dayOfYear = jdeDate % 1000;
+
+            int year = 1900 + (century * 100) + yearInCentury;
+
+            if (dayOfYear < 1 || dayOfYear > 366)
+                return null;
+
+            var date = new DateTime(year, 1, 1).AddDays(dayOfYear - 1);
+
+            // Add time component if provided
+            if (jdeTime > 0)
+            {
+                int hours = jdeTime / 10000;
+                int minutes = (jdeTime / 100) % 100;
+                int seconds = jdeTime % 100;
+
+                if (hours >= 0 && hours < 24 && minutes >= 0 && minutes < 60 && seconds >= 0 && seconds < 60)
+                {
+                    date = date.AddHours(hours).AddMinutes(minutes).AddSeconds(seconds);
+                }
+            }
+
+            return date;
+        }
+        catch
+        {
+            return null;
+        }
+    }
+}
+```
+
+### Entity Computed Properties
+
+Entities with JDE date fields use private backing fields and computed public properties:
+
+```csharp
+public class WorkOrder
+{
+    // Private backing fields (mapped from database via Dapper)
+    private int LastUpdateDate { get; set; }
+    private int LastUpdateTime { get; set; }
+
+    // Public computed property
+    public DateTime? LastUpdateDT => JdeDateConverter.ToDateTime(LastUpdateDate, LastUpdateTime);
+
+    // Other properties...
+    public long WorkOrderNumber { get; set; }
+    public string ItemNumber { get; set; } = string.Empty;
+}
+```
+
+### ToViewModel Extension Methods
+
+Projections are implemented as extension methods for separation of concerns:
+
+```csharp
+public static class WorkOrderExtensions
+{
+    public static WorkOrderViewModel ToViewModel(this WorkOrder workOrder)
+    {
+        return new WorkOrderViewModel
+        {
+            WorkOrderNumber = workOrder.WorkOrderNumber,
+            ItemNumber = workOrder.ItemNumber
+        };
+    }
+}
+```
+
+### IBusinessUnit Interface
+
+WorkCenter and ProfitCenter share a common interface:
+
+```csharp
+public interface IBusinessUnit
+{
+    string Code { get; }
+    string Description { get; }
+    DateTime? LastUpdateDT { get; }
+}
+
+public class WorkCenter : IBusinessUnit
+{
+    public string Code { get; set; } = string.Empty;
+    public string Description { get; set; } = string.Empty;
+
+    private int LastUpdateDate { get; set; }
+    private int LastUpdateTime { get; set; }
+    public DateTime? LastUpdateDT => JdeDateConverter.ToDateTime(LastUpdateDate, LastUpdateTime);
+}
+```
+
+## Classes vs Records
+
+| Type | Pattern | Rationale |
+|------|---------|-----------|
+| Database entities | `class` | Mutable for Dapper mapping, private setters for computed fields |
+| ViewModels | `record` or `class` | Immutable DTOs, but class is fine for simple projections |
+| SearchUpdate | `class` with init | Constructor sets Timestamp to UtcNow |
+| Enums | `enum` | Standard enumeration with JsonStringEnumConverter |
+
+## Existing Code Reconciliation
+
+The existing `JdeScoping.Core/Models/` contains placeholder implementations that differ from the spec:
+
+| Existing File | Action | Notes |
+|---------------|--------|-------|
+| Search.cs | Replace | Different property names, missing CriteriaJSON/Criteria pattern |
+| WorkOrder.cs | Replace | Simplified placeholder, missing JDE-specific fields |
+| Item.cs | Replace | Missing ShortItemNumber, nullable annotations |
+| Lot.cs | Replace | Placeholder implementation |
+| LotUsage.cs | Replace | Placeholder implementation |
+| WorkCenter.cs | Replace | Missing IBusinessUnit interface |
+| JdeUser.cs | Replace | Placeholder implementation |
+
+## Migration from Legacy
+
+| Legacy Pattern | New Pattern | Rationale |
+|----------------|-------------|-----------|
+| `DataModel.Models` namespace | `JdeScoping.Core.Models` | .NET naming conventions |
+| Newtonsoft.Json attributes | System.Text.Json attributes | Built-in .NET serialization |
+| `[JsonConverter(typeof(StringEnumConverter))]` | `[JsonConverter(typeof(JsonStringEnumConverter))]` | System.Text.Json |
+| `LDAPEntry` class | `UserInfo` class | Modern auth pattern naming |
+| Invalid JDE dates -> 1900-01-01 | Invalid JDE dates -> null | Explicit null handling |
+| ToViewModel() on entity | Extension method | Separation of concerns |
+
+## File Structure Summary
+
+After implementation, the Models folder structure:
+
+```
+JdeScoping.Core/Models/
+├── Enums/                  (2 files)
+├── [Entity classes]        (27 files)
+├── Interfaces/             (1 file - moved from Models)
+├── ViewModels/             (7 files)
+├── Extensions/             (6 files)
+└── Helpers/                (1 file)
+```
+
+Total: ~44 new/modified files in JdeScoping.Core
@@ -0,0 +1,68 @@
+# Implement Domain Models
+
+## Summary
+
+Implement all domain model entities for the JDE Scoping Tool as defined in the domain-models specification. This establishes the core business entity layer for the .NET 10 migration, providing strongly-typed classes for JDE/CMS data representation, search criteria, and data transfer.
+
+## Scope
+
+### In Scope
+
+- **Core entities** (4): Search, SearchCriteria, SearchStatus, SearchUpdate
+- **Work order entities** (5): WorkOrder, WorkOrderStep, WorkOrderTime, WorkOrderComponent, WorkOrderRouting
+- **Lot entities** (3): Lot, LotUsage, LotLocation
+- **Reference entities** (8): Item, WorkCenter, ProfitCenter, Branch, JdeUser, StatusCode, FunctionCode, IBusinessUnit
+- **Config entities** (3): DataUpdate, OrgHierarchy, RouteMaster
+- **CMS entities** (1): MisData
+- **Auth entities** (1): UserInfo
+- **Support entities** (5): QueryTypes, TableSpec, ColumnSpec, UpdateTypes, StatusUpdate
+- **Additional types** (4): POReceiver, POInspect, DcsLot, CamstarMO
+- **ViewModels** for projections
+- **Extension methods** for ToViewModel() conversions
+- **JdeDateConverter** static helper for JDE date/time conversion
+
+### Out of Scope
+
+- Database repository implementations (covered by data-access spec)
+- Service layer validation logic
+- SignalR hub implementations (web-api-auth spec)
+- Database schema (separate migrate-database-schema change)
+
+## Motivation
+
+The domain models are foundational to all other migration work. They provide:
+- Type-safe representation of JDE/CMS manufacturing data
+- Nullable reference type annotations for improved null safety
+- System.Text.Json serialization compatibility for modern API communication
+- Extension method projections for clean DTO separation
+
+## Acceptance Criteria
+
+1. All 52 requirements from `domain-models/spec.md` are implemented
+2. Solution builds successfully with `dotnet build`
+3. Nullable reference types enabled and all annotations applied per spec
+4. All enums use `[JsonConverter(typeof(JsonStringEnumConverter))]`
+5. JdeDateConverter handles edge cases (zero/invalid dates return null)
+6. ToViewModel() extension methods exist for entities that require them
+7. IBusinessUnit interface implemented by WorkCenter and ProfitCenter
+8. `openspec validate implement-domain-models --strict` passes
+
+## Dependencies
+
+- Phase 1 (Solution Structure) - completed
+- Phase 2 (Database Schema) - in progress, but domain models are independent
+
+## Risks
+
+| Risk | Mitigation |
+|------|------------|
+| Property name mismatch with legacy | Cross-reference spec against OLD/DataModel/Models/*.cs |
+| Missing nullable annotations | Use spec's explicit nullable annotation list |
+| JDE date conversion errors | Unit tests for edge cases (zero dates, invalid formats) |
+| Serialization incompatibility | Test JSON round-trip for all entities |
+
+## Related Specs
+
+- `domain-models` - Primary specification for this change
+- `database-schema` - Table definitions that entities map to
+- `data-access` - Repositories that consume these entities
@@ -0,0 +1,270 @@
+# Domain Models Specification - Change Delta
+
+This document captures modifications to the base `domain-models` specification for the `implement-domain-models` change.
+
+## Base Specification
+
+Reference: `openspec/specs/domain-models/spec.md`
+
+## ADDED Requirements
+
+### Requirement: JdeDateConverter helper class
+The system SHALL provide a static helper class for converting JDE date/time formats to .NET DateTime.
+
+#### Methods
+
+| Method | Signature | Description |
+|--------|-----------|-------------|
+| ToDateTime | `DateTime? ToDateTime(int jdeDate, int jdeTime = 0)` | Converts JDE CYYDDD date and HHMMSS time to DateTime |
+
+#### Business Rules
+
+- Returns `null` for zero or invalid date values (not `1900-01-01`)
+- CYYDDD format: C = century (0=1900s, 1=2000s), YY = year, DDD = day of year
+- HHMMSS format: HH = hours (0-23), MM = minutes (0-59), SS = seconds (0-59)
+- Invalid time values are ignored (date portion still returned)
+- Parse errors return `null` rather than throwing exceptions
+
+#### Scenario: Convert valid JDE date
+- **WHEN** JdeDateConverter.ToDateTime(124365, 143052) is called
+- **THEN** returns DateTime 2024-12-30 14:30:52
+
+#### Scenario: Handle zero date
+- **WHEN** JdeDateConverter.ToDateTime(0, 0) is called
+- **THEN** returns null
+
+#### Scenario: Handle invalid day of year
+- **WHEN** JdeDateConverter.ToDateTime(124400, 0) is called (day 400 is invalid)
+- **THEN** returns null
+
+---
+
+### Requirement: Extension method file organization
+The system SHALL organize ToViewModel extension methods in separate files by entity type.
+
+#### File Structure
+
+| File | Extension Methods |
+|------|-------------------|
+| WorkOrderExtensions.cs | WorkOrder.ToViewModel() |
+| LotExtensions.cs | Lot.ToViewModel() |
+| ItemExtensions.cs | Item.ToViewModel() |
+| WorkCenterExtensions.cs | WorkCenter.ToViewModel() |
+| ProfitCenterExtensions.cs | ProfitCenter.ToViewModel() |
+| JdeUserExtensions.cs | JdeUser.ToViewModel() |
+
+#### Business Rules
+
+- Extension methods in `JdeScoping.Core.Extensions` namespace
+- Each file contains a single static class with extension methods for one entity type
+- Extension methods are the only way entities project to ViewModels (no methods on entities)
+
+#### Scenario: Use extension method for projection
+- **WHEN** a WorkOrder entity calls ToViewModel() extension method
+- **THEN** a WorkOrderViewModel is returned with WorkOrderNumber and ItemNumber
+
+---
+
+### Requirement: ViewModel file organization
+The system SHALL organize ViewModel classes in a dedicated ViewModels folder.
+
+#### File Structure
+
+| File | ViewModel Class |
+|------|-----------------|
+| WorkOrderViewModel.cs | WorkOrderViewModel record |
+| LotViewModel.cs | LotViewModel record |
+| ItemViewModel.cs | ItemViewModel record |
+| WorkCenterViewModel.cs | WorkCenterViewModel record |
+| ProfitCenterViewModel.cs | ProfitCenterViewModel record |
+| JdeUserViewModel.cs | JdeUserViewModel record |
+| PartOperationViewModel.cs | PartOperationViewModel record |
+
+#### Business Rules
+
+- ViewModels in `JdeScoping.Core.ViewModels` namespace
+- ViewModels are immutable DTOs (prefer `record` type)
+- ViewModels contain only serializable properties (no computed properties)
+
+#### Scenario: ViewModel serialization
+- **WHEN** a WorkOrderViewModel is serialized to JSON
+- **THEN** all properties are included in the output
+
+---
+
+### Requirement: Enum file organization
+The system SHALL organize enum types in a dedicated Enums folder.
+
+#### File Structure
+
+| File | Enum Type |
+|------|-----------|
+| SearchStatus.cs | SearchStatus enum |
+| UpdateTypes.cs | UpdateTypes enum |
+
+#### Business Rules
+
+- Enums in `JdeScoping.Core.Models.Enums` namespace
+- All enums that may be serialized MUST have `[JsonConverter(typeof(JsonStringEnumConverter))]`
+
+#### Scenario: Enum JSON serialization
+- **WHEN** SearchStatus.Ended is serialized to JSON
+- **THEN** the output is "Ended" (string), not 3 (integer)
+
+---
+
+## MODIFIED Requirements
+
+### Requirement: Search entity
+The system SHALL store user search requests containing filter criteria and resulting Excel output, with lazy deserialization of criteria from JSON.
+
+#### Properties
+
+| Property | Type | Description |
+|----------|------|-------------|
+| ID | int | Primary key identifier |
+| UserName | string | Username of user who created search |
+| Name | string | User-friendly name for the search |
+| Status | SearchStatus | Current search status (enum) |
+| SubmitDT | DateTime? | Timestamp when search was submitted |
+| StartDT | DateTime? | Timestamp when search processing started |
+| EndDT | DateTime? | Timestamp when search completed |
+| CriteriaJSON | string | JSON-serialized search criteria |
+| Criteria | SearchCriteria | Deserialized search criteria object |
+| Results | byte[]? | Excel file output (VARBINARY), nullable when not yet generated |
+
+#### Business Rules
+
+- Status MUST be serialized as string using `[JsonConverter(typeof(JsonStringEnumConverter))]`
+- Criteria is stored as JSON in `CriteriaJSON` for database persistence
+- `Criteria` property getter deserializes from `CriteriaJSON` using System.Text.Json
+- Setter serializes to `CriteriaJSON`
+- If `CriteriaJSON` is null or empty, `Criteria` returns a new empty `SearchCriteria`
+- Deserialization errors return empty `SearchCriteria` (fail gracefully)
+- Results contains binary Excel file data only when Status = Ended
+- Results property MUST be annotated as `byte[]?` since it is null until processing completes
+
+#### Scenario: Lazy deserialization of Criteria
+- **WHEN** Search.CriteriaJSON = '{"MinimumDT":"2024-01-01"}' and Criteria is accessed
+- **THEN** Criteria.MinimumDT = 2024-01-01
+
+#### Scenario: Handle empty CriteriaJSON
+- **WHEN** Search.CriteriaJSON = null and Criteria is accessed
+- **THEN** Criteria returns new SearchCriteria() with all empty lists
+
+---
+
+### Requirement: SearchUpdate entity
+The system SHALL provide a real-time status update message for ASP.NET Core SignalR broadcast with factory method construction.
+
+#### Properties
+
+| Property | Type | Description |
+|----------|------|-------------|
+| ID | int | Search primary key |
+| UserName | string | Username of search submitter |
+| Name | string | Search name |
+| Status | SearchStatus | Current status |
+| SubmitDT | DateTime? | Submit timestamp |
+| StartDT | DateTime? | Start timestamp |
+| EndDT | DateTime? | End timestamp |
+| Timestamp | DateTime | When update was generated |
+| HasResults | bool | Indicates if search has Results |
+
+#### Business Rules
+
+- Primary constructor: `SearchUpdate(Search search)` copies all fields and sets Timestamp
+- Timestamp MUST be set to `DateTime.UtcNow` when update is created
+- Status MUST be serialized as string for JSON via `[JsonConverter(typeof(JsonStringEnumConverter))]`
+- `HasResults` is computed: `Status == SearchStatus.Ended && search.Results != null`
+
+#### Scenario: Create SearchUpdate from Search
+- **WHEN** SearchUpdate is created from a Search with ID=1, Status=Ended
+- **THEN** SearchUpdate.ID = 1, SearchUpdate.Status = Ended, SearchUpdate.Timestamp = current UTC time
+
+#### Scenario: HasResults computation
+- **WHEN** SearchUpdate is created from Search with Status=Ended and Results is not null
+- **THEN** HasResults = true
+
+---
+
+### Requirement: UserInfo entity
+The system SHALL provide authenticated user information with computed display name for ASP.NET Core Identity integration.
+
+#### Properties
+
+| Property | Type | Description |
+|----------|------|-------------|
+| Username | string | User's login identifier |
+| FirstName | string? | User's first name (nullable) |
+| LastName | string? | User's last name (nullable) |
+| DisplayName | string | Computed display name |
+| Title | string? | Organization title (nullable) |
+| EmailAddress | string? | Email address (nullable) |
+
+#### Business Rules
+
+- DisplayName computation:
+  1. If FirstName and LastName both have values: `$"{FirstName} {LastName}".Trim()`
+  2. If only FirstName has value: `FirstName.Trim()`
+  3. If only LastName has value: `LastName.Trim()`
+  4. Otherwise: `Username`
+- "Has value" means not null and not whitespace-only
+- Used for authentication context, populated from ASP.NET Core Identity claims or LDAP provider
+- DN (Distinguished Name) property removed; use ClaimsPrincipal for identity information
+
+#### Scenario: Compute display name from both names
+- **WHEN** UserInfo has FirstName = "John", LastName = "Doe" and DisplayName is accessed
+- **THEN** DisplayName = "John Doe"
+
+#### Scenario: Compute display name from first name only
+- **WHEN** UserInfo has FirstName = "John", LastName = null and DisplayName is accessed
+- **THEN** DisplayName = "John"
+
+#### Scenario: Fallback to username when names empty
+- **WHEN** UserInfo has FirstName = null, LastName = null, Username = "jdoe" and DisplayName is accessed
+- **THEN** DisplayName = "jdoe"
+
+---
+
+## CLARIFICATIONS
+
+### Private JDE Date Fields
+
+Entities with JDE date fields use this pattern:
+
+```csharp
+public class SomeEntity
+{
+    // These are mapped by Dapper from database columns
+    // but not exposed publicly
+    private int LastUpdateDate { get; set; }
+    private int LastUpdateTime { get; set; }
+
+    // Public computed property
+    public DateTime? LastUpdateDT => JdeDateConverter.ToDateTime(LastUpdateDate, LastUpdateTime);
+}
+```
+
+The private setters allow Dapper to populate the values during query mapping, while the computed property provides the converted DateTime.
+
+### Collection Initialization
+
+All collection properties use C# 12 collection expression syntax:
+
+```csharp
+public List<string> Items { get; set; } = [];
+```
+
+This ensures collections are never null and always initialized to empty.
+
+### Namespace Organization
+
+| Folder | Namespace |
+|--------|-----------|
+| Models/ | JdeScoping.Core.Models |
+| Models/Enums/ | JdeScoping.Core.Models.Enums |
+| ViewModels/ | JdeScoping.Core.ViewModels |
+| Extensions/ | JdeScoping.Core.Extensions |
+| Interfaces/ | JdeScoping.Core.Interfaces |
+| Helpers/ | JdeScoping.Core.Helpers |
@@ -0,0 +1,282 @@
+# Tasks: Implement Domain Models
+
+## Phase 1: Foundation (Enums, Interfaces, Helpers)
+
+- [x] Create JdeDateConverter helper class
+  - Location: `JdeScoping.Core/Helpers/JdeDateConverter.cs`
+  - Implements: CYYDDD date format conversion, HHMMSS time conversion
+  - Validation: Unit tests for valid dates, zero dates, invalid formats all pass
+
+- [x] Create SearchStatus enum
+  - Location: `JdeScoping.Core/Models/Enums/SearchStatus.cs`
+  - Values: New (0), Submitted (1), Started (2), Ended (3), Error (4)
+  - Validation: Has `[JsonConverter(typeof(JsonStringEnumConverter))]` attribute
+
+- [x] Create UpdateTypes enum
+  - Location: `JdeScoping.Core/Models/Enums/UpdateTypes.cs`
+  - Values: Hourly (1), Daily (2), Mass (3)
+  - Validation: Has `[JsonConverter(typeof(JsonStringEnumConverter))]` attribute
+
+- [x] Create IBusinessUnit interface
+  - Location: `JdeScoping.Core/Interfaces/IBusinessUnit.cs`
+  - Properties: Code, Description, LastUpdateDT
+  - Validation: Compiles, used by WorkCenter and ProfitCenter
+
+## Phase 2: Search-Related Entities
+
+- [x] Replace Search entity
+  - Location: `JdeScoping.Core/Models/Search.cs`
+  - Properties: ID, UserName, Name, Status, SubmitDT, StartDT, EndDT, CriteriaJSON, Criteria, Results
+  - Validation: Matches spec requirement, Results is `byte[]?`
+
+- [x] Create SearchCriteria entity
+  - Location: `JdeScoping.Core/Models/SearchCriteria.cs`
+  - Properties: MinimumDT, MaximumDT, WorkOrderNumbers, ItemNumbers, ProfitCenters, WorkCenters, OperatorIDs, ComponentLotNumbers, ExtractMisData, PartOperations
+  - Validation: All list properties initialized to empty lists
+
+- [x] Create SearchUpdate entity
+  - Location: `JdeScoping.Core/Models/SearchUpdate.cs`
+  - Properties: ID, UserName, Name, Status, SubmitDT, StartDT, EndDT, Timestamp
+  - Validation: Constructor accepts Search, sets Timestamp to DateTime.UtcNow
+
+- [x] Create StatusUpdate entity
+  - Location: `JdeScoping.Core/Models/StatusUpdate.cs`
+  - Properties: Message, Timestamp
+  - Validation: Compiles, simple message DTO
+
+## Phase 3: Work Order Entities
+
+- [x] Replace WorkOrder entity
+  - Location: `JdeScoping.Core/Models/WorkOrder.cs`
+  - Properties: WorkOrderNumber, BranchCode, LotNumber?, ItemNumber, ShortItemNumber, ParentWorkOrderNumber?, OrderQuantity, HeldQuantity, ShippedQuantity, StatusCode, StatusCodeUpdateDT, IssueDate, StartDate, RoutingType, LastUpdateDT
+  - Validation: Private JDE date fields, computed LastUpdateDT, nullable annotations
+
+- [x] Create WorkOrderStep entity
+  - Location: `JdeScoping.Core/Models/WorkOrderStep.cs`
+  - Properties: WorkOrderNumber, BranchCode, WorkCenterCode, StepNumber, StepDescription?, FunctionOperationDescription?, StepTypeCode, StartDT, EndDT, FunctionCode, ScrappedQuantity, LastUpdateDT
+  - Validation: Nullable annotations on optional fields
+
+- [x] Create WorkOrderTime entity
+  - Location: `JdeScoping.Core/Models/WorkOrderTime.cs`
+  - Properties: UniqueID, WorkOrderNumber, BranchCode, WorkCenterCode, StepNumber, AddressNumber, GlDate, LastUpdateDT
+  - Validation: Matches F31122 table structure
+
+- [x] Create WorkOrderComponent entity
+  - Location: `JdeScoping.Core/Models/WorkOrderComponent.cs`
+  - Properties: UniqueID, WorkOrderNumber, LotNumber?, BranchCode, ShortItemNumber?, Quantity, LastUpdateDT
+  - Validation: ShortItemNumber and LotNumber are nullable
+
+- [x] Create WorkOrderRouting entity
+  - Location: `JdeScoping.Core/Models/WorkOrderRouting.cs`
+  - Properties: UserID, BatchNumber, TransactionNumber, LineNumber, StepNumber, WorkCenterCode, WorkOrderNumber, RoutingType, BranchCode, StepDescription?, FunctionCode, TransactionDate, LastUpdateDT
+  - Validation: Compiles, nullable StepDescription
+
+## Phase 4: Lot Entities
+
+- [x] Replace Lot entity
+  - Location: `JdeScoping.Core/Models/Lot.cs`
+  - Properties: LotNumber, BranchCode, ShortItemNumber, ItemNumber, SupplierCode, StatusCode (char), Memo1?, Memo2?, Memo3?, LastUpdateDT
+  - Validation: StatusCode is char type, nullable memo fields
+
+- [x] Replace LotUsage entity
+  - Location: `JdeScoping.Core/Models/LotUsage.cs`
+  - Properties: UniqueID, WorkOrderNumber, LotNumber, BranchCode, ShortItemNumber, Quantity, LastUpdateDT
+  - Validation: Cardex entry structure matches spec
+
+- [x] Create LotLocation entity
+  - Location: `JdeScoping.Core/Models/LotLocation.cs`
+  - Properties: LotNumber, ShortItemNumber, BranchCode, Location, LastUpdateDT
+  - Validation: Compiles with all properties
+
+## Phase 5: Reference Entities
+
+- [x] Replace Item entity
+  - Location: `JdeScoping.Core/Models/Item.cs`
+  - Properties: ShortItemNumber, ItemNumber, Description, PlanningFamily?, StockingType?, LastUpdateDT
+  - Validation: Dual identifier pattern (ShortItemNumber + ItemNumber)
+
+- [x] Replace WorkCenter entity
+  - Location: `JdeScoping.Core/Models/WorkCenter.cs`
+  - Properties: Code, Description, LastUpdateDT
+  - Validation: Implements IBusinessUnit interface
+
+- [x] Create ProfitCenter entity
+  - Location: `JdeScoping.Core/Models/ProfitCenter.cs`
+  - Properties: Code, Description, LastUpdateDT
+  - Validation: Implements IBusinessUnit interface
+
+- [x] Create Branch entity
+  - Location: `JdeScoping.Core/Models/Branch.cs`
+  - Properties: Code, Description, LastUpdateDT
+  - Validation: Compiles, matches spec
+
+- [x] Replace JdeUser entity
+  - Location: `JdeScoping.Core/Models/JdeUser.cs`
+  - Properties: AddressNumber, UserID, FullName, LastUpdateDT
+  - Validation: AddressNumber is long, matches spec
+
+- [x] Create StatusCode entity
+  - Location: `JdeScoping.Core/Models/StatusCode.cs`
+  - Properties: Code, Description, LastUpdateDT
+  - Validation: JDE work order status lookup
+
+- [x] Create FunctionCode entity
+  - Location: `JdeScoping.Core/Models/FunctionCode.cs`
+  - Properties: Code, Description, LastUpdateDT
+  - Validation: JDE function code lookup
+
+## Phase 6: Config and Mapping Entities
+
+- [x] Create DataUpdate entity
+  - Location: `JdeScoping.Core/Models/DataUpdate.cs`
+  - Properties: ID, SourceSystem, SourceData, TableName, StartDT, EndDT, UpdateType, WasSuccessful, NumberRecords
+  - Validation: UpdateType uses UpdateTypes enum
+
+- [x] Create OrgHierarchy entity
+  - Location: `JdeScoping.Core/Models/OrgHierarchy.cs`
+  - Properties: WorkCenterCode, BranchCode, ProfitCenterCode, LastUpdateDT
+  - Validation: Profit center to work center mapping
+
+- [x] Create RouteMaster entity
+  - Location: `JdeScoping.Core/Models/RouteMaster.cs`
+  - Properties: BranchCode, ItemNumber, RoutingType, SequenceNumber, FunctionCode, WorkCenterCode, StartDate, EndDate?, LastUpdateDT
+  - Validation: EndDate is nullable
+
+## Phase 7: CMS and External Entities
+
+- [x] Create MisData entity
+  - Location: `JdeScoping.Core/Models/MisData.cs`
+  - Properties: ItemNumber, BranchCode, SequenceNumber, MisNumber, RevID?, CharNumber, TestDescription?, SamplingType?, SamplingValue?, ToolsGauges?, WorkInstructions?, Status, ReleaseDate?
+  - Validation: Many nullable string fields per spec
+
+- [x] Create POReceiver entity
+  - Location: `JdeScoping.Core/Models/POReceiver.cs`
+  - Properties: OrderNumber, OrderCompany, OrderSuffix, LineNumber, NumberOfLines, InvoiceNumber, BranchCode, LotNumber?, ShortItemNumber (string!), DateReceived, Subledger?, QtyReceived, LastUpdateDT
+  - Validation: ShortItemNumber is string (intentional legacy quirk)
+
+- [x] Create POInspect entity
+  - Location: `JdeScoping.Core/Models/POInspect.cs`
+  - Properties: UniqueID, OrderNumber, OrderCompany, LineNumber, InvoiceNumber, LotNumber?, ShortItemNumber, LastUpdateDT
+  - Validation: Compiles with nullable LotNumber
+
+- [x] Create DcsLot entity
+  - Location: `JdeScoping.Core/Models/DcsLot.cs`
+  - Properties: ItemNumber, LotNumber, LotSuffix?, LastUpdateDT
+  - Validation: Simple DCS lot record
+
+- [x] Create CamstarMO entity
+  - Location: `JdeScoping.Core/Models/CamstarMO.cs`
+  - Properties: MONumber, LastUpdateDT
+  - Validation: Simple Camstar manufacturing order
+
+## Phase 8: Auth and User Entities
+
+- [x] Create UserInfo entity
+  - Location: `JdeScoping.Core/Models/UserInfo.cs`
+  - Properties: Username, FirstName?, LastName?, DisplayName (computed), Title?, EmailAddress?
+  - Validation: DisplayName computed property works (fallback to Username)
+
+## Phase 9: Query Support Entities
+
+- [x] Create QueryTypes entity
+  - Location: `JdeScoping.Core/Models/QueryTypes.cs`
+  - Properties: Code, Name, OrderIndex, filter flags (TimeSpanFilter, WorkOrderFilter, etc.)
+  - Validation: Static dictionary pattern, Identify() method stub
+
+- [x] Create TableSpec entity
+  - Location: `JdeScoping.Core/Models/TableSpec.cs`
+  - Properties: Name, TempTableName (computed), Columns, PrimaryKey
+  - Validation: Constructor initializes lists, stub methods exist
+
+- [x] Create ColumnSpec entity
+  - Location: `JdeScoping.Core/Models/ColumnSpec.cs`
+  - Properties: Name, Definition
+  - Validation: Simple column specification
+
+## Phase 10: ViewModels
+
+- [x] Create WorkOrderViewModel
+  - Location: `JdeScoping.Core/ViewModels/WorkOrderViewModel.cs`
+  - Properties: WorkOrderNumber, ItemNumber
+  - Validation: Minimal projection DTO
+
+- [x] Create LotViewModel
+  - Location: `JdeScoping.Core/ViewModels/LotViewModel.cs`
+  - Properties: LotNumber, ItemNumber
+  - Validation: Used by SearchCriteria.ComponentLotNumbers
+
+- [x] Create ItemViewModel
+  - Location: `JdeScoping.Core/ViewModels/ItemViewModel.cs`
+  - Properties: ItemNumber, Description
+  - Validation: Minimal projection DTO
+
+- [x] Create WorkCenterViewModel
+  - Location: `JdeScoping.Core/ViewModels/WorkCenterViewModel.cs`
+  - Properties: Code, Description
+  - Validation: Minimal projection DTO
+
+- [x] Create ProfitCenterViewModel
+  - Location: `JdeScoping.Core/ViewModels/ProfitCenterViewModel.cs`
+  - Properties: Code, Description
+  - Validation: Minimal projection DTO
+
+- [x] Create JdeUserViewModel
+  - Location: `JdeScoping.Core/ViewModels/JdeUserViewModel.cs`
+  - Properties: AddressNumber, UserID, FullName
+  - Validation: Minimal projection DTO
+
+- [x] Create PartOperationViewModel
+  - Location: `JdeScoping.Core/ViewModels/PartOperationViewModel.cs`
+  - Properties: ItemNumber, OperationNumber, MisNumber, Revision
+  - Validation: Used by SearchCriteria.PartOperations
+
+## Phase 11: Extension Methods
+
+- [x] Create WorkOrderExtensions
+  - Location: `JdeScoping.Core/Extensions/WorkOrderExtensions.cs`
+  - Method: ToViewModel() -> WorkOrderViewModel
+  - Validation: Extension method on WorkOrder compiles and works
+
+- [x] Create LotExtensions
+  - Location: `JdeScoping.Core/Extensions/LotExtensions.cs`
+  - Method: ToViewModel() -> LotViewModel
+  - Validation: Extension method on Lot compiles and works
+
+- [x] Create ItemExtensions
+  - Location: `JdeScoping.Core/Extensions/ItemExtensions.cs`
+  - Method: ToViewModel() -> ItemViewModel
+  - Validation: Extension method on Item compiles and works
+
+- [x] Create WorkCenterExtensions
+  - Location: `JdeScoping.Core/Extensions/WorkCenterExtensions.cs`
+  - Method: ToViewModel() -> WorkCenterViewModel
+  - Validation: Extension method on WorkCenter compiles and works
+
+- [x] Create ProfitCenterExtensions
+  - Location: `JdeScoping.Core/Extensions/ProfitCenterExtensions.cs`
+  - Method: ToViewModel() -> ProfitCenterViewModel
+  - Validation: Extension method on ProfitCenter compiles and works
+
+- [x] Create JdeUserExtensions
+  - Location: `JdeScoping.Core/Extensions/JdeUserExtensions.cs`
+  - Method: ToViewModel() -> JdeUserViewModel
+  - Validation: Extension method on JdeUser compiles and works
+
+## Phase 12: Verification
+
+- [x] Verify solution builds
+  - Command: `dotnet build NEW/src/JdeScoping.Core/JdeScoping.Core.csproj`
+  - Validation: Build succeeds with no errors
+
+- [x] Verify nullable reference types
+  - Validation: All nullable properties use `?` annotation, no compiler warnings
+
+- [x] Verify JSON serialization
+  - Validation: SearchStatus and UpdateTypes serialize as strings, not integers
+
+- [x] Run OpenSpec validation
+  - Command: `openspec validate implement-domain-models --strict`
+  - Validation: All requirements marked as covered
+
+- [x] Cross-reference with spec
+  - Validation: All 52 requirements from domain-models/spec.md implemented
@@ -0,0 +1,687 @@
+# Excel Export Design
+
+## Overview
+
+This document describes the architecture and implementation approach for the Excel export subsystem, including workbook generation, sheet generators, formatting patterns, and memory management.
+
+## Architecture
+
+### Component Diagram
+
+```
+┌─────────────────────────────────────────────────────────────────────┐
+│                        Search Processing                             │
+│  (SearchProcessor produces SearchModel with populated results)       │
+└─────────────────────────────────────────────────────────────────────┘
+                                  │
+                                  ▼
+┌─────────────────────────────────────────────────────────────────────┐
+│                     IExcelExportService                              │
+│  Task<byte[]> GenerateAsync(SearchModel, CancellationToken)          │
+└─────────────────────────────────────────────────────────────────────┘
+                                  │
+                                  ▼
+┌─────────────────────────────────────────────────────────────────────┐
+│                      ExcelExportService                              │
+├─────────────────────────────────────────────────────────────────────┤
+│  - ILogger<ExcelExportService>                                       │
+│  - IOptions<ExcelExportOptions>                                      │
+├─────────────────────────────────────────────────────────────────────┤
+│  Uses:                                                               │
+│  - CriteriaSheetGenerator                                            │
+│  - AttributeTableWriter                                              │
+│  - WorksheetProtector                                                │
+│  - HeaderFormatter                                                   │
+└─────────────────────────────────────────────────────────────────────┘
+                                  │
+                                  ▼
+┌─────────────────────────────────────────────────────────────────────┐
+│                         ClosedXML                                    │
+│  XLWorkbook → IXLWorksheet → IXLCell/IXLRange                        │
+└─────────────────────────────────────────────────────────────────────┘
+                                  │
+                                  ▼
+                            byte[] output
+```
+
+### Project Structure
+
+```
+NEW/src/JdeScoping.ExcelExport/
+├── Attributes/
+│   ├── OutputColumnAttribute.cs
+│   └── OutputTableAttribute.cs
+├── Configuration/
+│   └── ExcelExportOptions.cs
+├── Generators/
+│   ├── CriteriaSheetGenerator.cs      # Search Criteria tab
+│   ├── AttributeTableWriter.cs         # Generic attribute-driven table writer
+│   └── DataEntryTemplateGenerator.cs   # Bulk upload templates
+├── Formatting/
+│   ├── HeaderFormatter.cs              # Header cell formatting
+│   ├── ColumnFormatter.cs              # Column width and number format
+│   └── WorksheetProtector.cs           # Password protection
+├── Helpers/
+│   └── OutputColumnCache.cs            # Cached reflection for column metadata
+├── Models/
+│   └── OutputColumn.cs                 # Column metadata model
+├── Interfaces/
+│   └── IExcelExportService.cs
+├── ExcelExportService.cs
+├── ServiceCollectionExtensions.cs
+└── JdeScoping.ExcelExport.csproj
+```
+
+## ClosedXML Workbook Generation
+
+### Library Selection: ClosedXML
+
+**Why ClosedXML over EPPlus:**
+
+| Aspect | EPPlus v7+ | ClosedXML |
+|--------|------------|-----------|
+| License | Commercial (Polyform NC) | MIT (fully free) |
+| API Similarity | N/A (legacy v4 was LGPL) | Very similar to EPPlus v4 |
+| Maintenance | Active (commercial) | Active (community) |
+| .NET 10 Support | Yes | Yes |
+| NuGet Downloads | High | High |
+
+**NuGet Package:** `ClosedXML` (version 0.104.* or later)
+
+### API Migration Guide: EPPlus to ClosedXML
+
+| EPPlus (Legacy) | ClosedXML (New) |
+|-----------------|-----------------|
+| `ExcelPackage` | `XLWorkbook` |
+| `ExcelWorkbook` | `XLWorkbook` (same object) |
+| `ExcelWorksheet` | `IXLWorksheet` |
+| `ExcelRange` | `IXLRange` or `IXLCell` |
+| `ExcelTable` | `IXLTable` |
+| `worksheet.Cells[row, col]` | `worksheet.Cell(row, col)` |
+| `worksheet.Tables.Add(range, name)` | `worksheet.Range(...).CreateTable(name)` or `AsTable()` |
+| `TableStyles.Light18` | `XLTableTheme.TableStyleLight18` |
+| `Color.Gainsboro` | `XLColor.Gainsboro` |
+| `range.Style.Fill.BackgroundColor.SetColor(...)` | `range.Style.Fill.BackgroundColor = XLColor.X` |
+| `worksheet.Column(col).AutoFit()` | `worksheet.Column(col).AdjustToContents()` |
+| `worksheet.Protection.SetPassword(pwd)` | `worksheet.Protect(pwd)` |
+| `worksheet.ProtectedRanges.Add(...)` | Not needed (use cell unlock instead) |
+
+### Workbook Generation Flow
+
+```csharp
+public async Task<byte[]> GenerateAsync(
+    SearchModel search,
+    CancellationToken cancellationToken = default)
+{
+    using var scope = _logger.BeginScope(new Dictionary<string, object>
+    {
+        ["SearchId"] = search.Id,
+        ["SearchName"] = search.Name
+    });
+
+    _logger.LogInformation("Starting Excel export generation");
+
+    // ClosedXML operations are synchronous, wrap in Task.Run for non-blocking
+    return await Task.Run(() =>
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+
+        using var workbook = new XLWorkbook();
+
+        // 1. Always generate Search Criteria sheet (first tab)
+        GenerateCriteriaSheet(workbook, search);
+
+        // 2. Always generate Search Results sheet (second tab)
+        GenerateResultsSheet(workbook, search.Results);
+
+        // 3. Conditionally generate MIS Info sheet
+        if (search.ExtractMisData && search.MisResults != null)
+        {
+            GenerateMisInfoSheet(workbook, search.MisResults);
+        }
+
+        // 4. Conditionally generate Investigation sheet
+        if (search.ExtractMisData && search.MisNonMatchResults != null)
+        {
+            GenerateInvestigationSheet(workbook, search.MisNonMatchResults);
+        }
+
+        cancellationToken.ThrowIfCancellationRequested();
+
+        // Save to byte array
+        using var stream = new MemoryStream();
+        workbook.SaveAs(stream);
+        return stream.ToArray();
+
+    }, cancellationToken);
+}
+```
+
+## Sheet Generators
+
+### Criteria Sheet Generator
+
+The Search Criteria sheet documents all search parameters and execution metadata.
+
+**Structure:**
+
+```
+Row 1:  [Search Name]     [value]
+Row 2:  [User Name]       [value]
+Row 3:  (blank)
+Row 4:  [Submit timestamp] [MMM dd, yyyy hh:mm:ss tt EST]
+Row 5:  [Start timestamp]  [MMM dd, yyyy hh:mm:ss tt EST]
+Row 6:  [Completed timestamp] [MMM dd, yyyy hh:mm:ss tt EST]
+Row 7:  (blank)
+Row 8+: [Timespan Filter Table]
+        (2 blank rows)
+        [Work Order Filter Table]
+        (2 blank rows)
+        [Item Number Filter Table]
+        ...
+        [Extract MIS data?] [YES/NO]
+```
+
+**Filter Table Order:**
+1. Timespan Filter
+2. Work Order Filter
+3. Item Number Filter
+4. Profit Center Filter
+5. Work Center Filter
+6. Component Lot Filter
+7. Operator Filter
+8. Item/Operation/MIS Filter
+
+**Implementation Pattern:**
+
+```csharp
+private void GenerateCriteriaSheet(XLWorkbook workbook, SearchModel search)
+{
+    var worksheet = workbook.Worksheets.Add("Search Criteria");
+    var row = 1;
+
+    // Header rows
+    ApplyHeaderFormat(worksheet.Cell(row, 1), "Search Name");
+    worksheet.Cell(row, 2).Value = search.Name;
+
+    ApplyHeaderFormat(worksheet.Cell(++row, 1), "User Name");
+    worksheet.Cell(row, 2).Value = search.UserName;
+
+    row++; // blank
+
+    // Timestamps
+    ApplyHeaderFormat(worksheet.Cell(++row, 1), "Submit timestamp");
+    worksheet.Cell(row, 2).Value = $"{search.SubmitDT:MMM dd, yyyy hh:mm:ss tt} EST";
+
+    // ... more timestamps ...
+
+    // Filter tables
+    row = WriteFilterTable(worksheet, ++row, CreateTimespanFilter(search));
+    row = WriteFilterTable(worksheet, row + 3, search.WorkOrderFilter);
+    row = WriteFilterTable(worksheet, row + 3, search.ItemNumberFilter);
+    // ... more filter tables ...
+
+    // Extract MIS data indicator
+    var headerRange = worksheet.Range(row, 1, row, 2);
+    ApplyHeaderFormat(headerRange, "Extract MIS data?", merge: true);
+    worksheet.Cell(++row, 1).Value = search.ExtractMisData ? "YES" : "NO";
+
+    // Auto-fit with 15% padding
+    for (int col = 1; col <= 4; col++)
+    {
+        worksheet.Column(col).AdjustToContents();
+        worksheet.Column(col).Width *= 1.15;
+    }
+
+    // Protection
+    worksheet.Protect(_options.Value.CriteriaSheetPassword);
+}
+```
+
+### Attribute-Driven Table Writer
+
+The `AttributeTableWriter` generates Excel tables from model collections using reflection on `OutputColumnAttribute` and `OutputTableAttribute`.
+
+**Column Ordering:**
+1. Sort by `OutputColumnAttribute.Order` (ascending)
+2. Break ties alphabetically by property name
+
+**Implementation Pattern:**
+
+```csharp
+public class AttributeTableWriter
+{
+    private readonly OutputColumnCache _cache;
+
+    public IXLTable WriteTable<T>(
+        IXLWorksheet worksheet,
+        int startRow,
+        int startCol,
+        IEnumerable<T> data,
+        string? tableNameOverride = null)
+    {
+        var tableAttr = typeof(T).GetCustomAttribute<OutputTableAttribute>();
+        var columns = _cache.GetColumns<T>();
+        var tableName = tableNameOverride ?? tableAttr?.TableName ?? typeof(T).Name;
+
+        // Write header row
+        var col = startCol;
+        foreach (var column in columns)
+        {
+            var cell = worksheet.Cell(startRow, col);
+            cell.Value = column.Attribute.HeaderText;
+            ApplyHeaderFormat(cell);
+            col++;
+        }
+
+        // Write data rows
+        var dataList = data.ToList();
+        var row = startRow + 1;
+        foreach (var item in dataList)
+        {
+            col = startCol;
+            foreach (var column in columns)
+            {
+                var value = column.Property.GetValue(item);
+                worksheet.Cell(row, col).Value = XLCellValue.FromObject(value);
+                col++;
+            }
+            row++;
+        }
+
+        // Create table
+        var dataRange = worksheet.Range(
+            startRow, startCol,
+            startRow + dataList.Count, startCol + columns.Count - 1);
+        var table = dataRange.CreateTable(tableName);
+        table.Theme = XLTableTheme.TableStyleLight18;
+        table.ShowTotalsRow = false;
+
+        // Apply column formatting
+        col = startCol;
+        foreach (var column in columns)
+        {
+            ApplyColumnFormat(worksheet.Column(col), column.Attribute);
+            col++;
+        }
+
+        return table;
+    }
+}
+```
+
+### Data Sheet Generators (Results, MIS Info, Investigation)
+
+These sheets use the `AttributeTableWriter` with model-specific configuration.
+
+**Search Results Sheet:**
+- 19 columns per SearchResult model
+- Auto-fit with 30% padding
+- No protection (legacy behavior via attribute-driven path)
+- Light18 table style
+
+**MIS Info Sheet:**
+- 19 columns per MisSearchResult model
+- Three columns with wrapped text (fixed 65-char width):
+  - Test Description
+  - Tools & Gauges
+  - Work Instructions
+- Other columns: auto-fit with 30% padding
+
+**Investigation Sheet:**
+- 12 columns per MisNonMatchSearchResult model
+- Date columns use `[$-409]MM/dd/yyyy;@` format
+- Auto-fit with 30% padding
+
+## Column Formatting Patterns
+
+### Format Constants
+
+```csharp
+public static class ExcelFormats
+{
+    public const string STD_FORMAT = "@";  // Text
+    public const string DATE_FORMAT = "[$-409]MM/dd/yyyy;@";
+    public const string TIMESTAMP_FORMAT = "[$-409]m/d/yy h:mm AM/PM;@";
+    public const double WRAPPED_COLUMN_WIDTH = 65;
+    public const double CRITERIA_PADDING_FACTOR = 1.15;
+    public const double DATA_PADDING_FACTOR = 1.30;
+}
+```
+
+### Auto-Fit with Padding
+
+```csharp
+private void ApplyColumnFormat(IXLColumn column, OutputColumnAttribute attr)
+{
+    // Set number format
+    column.Style.NumberFormat.Format = attr.Format;
+
+    if (attr.WrapText)
+    {
+        column.Style.Alignment.WrapText = true;
+    }
+
+    if (attr.AutoWidth)
+    {
+        column.AdjustToContents();
+        column.Width *= ExcelFormats.DATA_PADDING_FACTOR;
+    }
+    else
+    {
+        column.Width = attr.Width;
+    }
+}
+```
+
+### Wrapped Text Columns
+
+Columns marked with `WrapText = true` and `AutoWidth = false` skip auto-fit:
+
+```csharp
+if (attr.WrapText && !attr.AutoWidth)
+{
+    column.Width = attr.Width; // Usually 65
+    column.Style.Alignment.WrapText = true;
+    // Do NOT call AdjustToContents()
+}
+```
+
+## Worksheet Protection
+
+### Protection Configuration
+
+```csharp
+public class ExcelExportOptions
+{
+    public const string SectionName = "ExcelExport";
+
+    public string CriteriaSheetPassword { get; set; } = "JDE_SCOPING_TOOL_PASS";
+    public string DataSheetPassword { get; set; } = "JDESCOPINGTOOL";
+}
+```
+
+### Allowed Operations
+
+Protected worksheets allow specific operations:
+
+```csharp
+private void ApplyProtection(IXLWorksheet worksheet, string password)
+{
+    var protection = worksheet.Protect(password);
+
+    // Allow these operations
+    protection.AllowElement(XLSheetProtectionElements.DeleteColumns);
+    protection.AllowElement(XLSheetProtectionElements.AutoFilter);
+    protection.AllowElement(XLSheetProtectionElements.FormatCells);
+    protection.AllowElement(XLSheetProtectionElements.FormatColumns);
+    protection.AllowElement(XLSheetProtectionElements.FormatRows);
+    protection.AllowElement(XLSheetProtectionElements.SelectLockedCells);
+    protection.AllowElement(XLSheetProtectionElements.SelectUnlockedCells);
+    protection.AllowElement(XLSheetProtectionElements.EditObjects);
+    protection.AllowElement(XLSheetProtectionElements.Sort);
+
+    // DeleteRows is NOT allowed (not in AllowElement call)
+}
+```
+
+### Editable Extension Area
+
+Legacy code unlocked an area beyond the data for user additions. In ClosedXML:
+
+```csharp
+// Unlock cells beyond data range for user editing
+var lastDataRow = table.RangeAddress.LastAddress.RowNumber;
+var lastDataCol = table.RangeAddress.LastAddress.ColumnNumber;
+
+// Unlock 1000 rows and columns beyond data
+var extensionRange = worksheet.Range(
+    1, lastDataCol + 1,
+    lastDataRow + 1000, lastDataCol + 1000);
+extensionRange.Style.Protection.Locked = false;
+```
+
+**Note:** The legacy code applies protection to data sheets (Search Results, MIS Info, Investigation) via the `ApplySecurity` method. The criteria sheet uses a different password.
+
+## Memory Management for Large Exports
+
+### Current Approach: In-Memory
+
+The current implementation loads all data into memory and generates the workbook synchronously:
+
+```csharp
+// All results loaded
+var results = search.Results; // List<SearchResult>
+
+// Workbook built in memory
+using var workbook = new XLWorkbook();
+// ... add sheets ...
+
+// Serialize to byte[]
+using var stream = new MemoryStream();
+workbook.SaveAs(stream);
+return stream.ToArray();
+```
+
+### Memory Considerations
+
+| Export Size | Rows | Estimated Memory | Approach |
+|-------------|------|------------------|----------|
+| Small | <10K | <50 MB | In-memory (current) |
+| Medium | 10K-100K | 50-500 MB | In-memory (current) |
+| Large | >100K | >500 MB | Consider streaming (future) |
+
+### Future Optimization: Streaming
+
+For very large exports, ClosedXML supports SAX-based streaming via `XLWorkbook.SaveAsAsync()`. This would require:
+
+1. Writing sheets incrementally
+2. Using `IAsyncEnumerable<T>` for data sources
+3. Streaming directly to response or file
+
+This is deferred to a future phase if memory pressure becomes an issue.
+
+## Temp File Handling
+
+### No Temp Files Required
+
+The current implementation writes directly to `MemoryStream` and returns `byte[]`. The result is stored in the `Search.Results` column (VARBINARY) in the database.
+
+If debugging is enabled (legacy behavior), a copy may be written to disk:
+
+```csharp
+if (_options.Value.DebugWriteToFile)
+{
+    var debugPath = Path.Combine(
+        _options.Value.DebugOutputDirectory,
+        $"Search_{search.Id}_{DateTime.Now:yyyyMMdd_HHmmss}.xlsx");
+    await File.WriteAllBytesAsync(debugPath, result, cancellationToken);
+}
+```
+
+This is optional and controlled by configuration.
+
+## Header Formatting
+
+### Standard Header Style
+
+```csharp
+private void ApplyHeaderFormat(IXLCell cell, string? text = null)
+{
+    cell.Style.Alignment.Horizontal = XLAlignmentHorizontalValues.Center;
+    cell.Style.Font.Bold = true;
+    cell.Style.Fill.BackgroundColor = XLColor.Gainsboro;
+
+    if (!string.IsNullOrEmpty(text))
+    {
+        cell.Value = text;
+    }
+}
+
+private void ApplyHeaderFormat(IXLRange range, string? text = null, bool merge = false)
+{
+    range.Style.Alignment.Horizontal = XLAlignmentHorizontalValues.Center;
+    range.Style.Font.Bold = true;
+    range.Style.Fill.BackgroundColor = XLColor.Gainsboro;
+
+    if (merge)
+    {
+        range.Merge();
+    }
+
+    if (!string.IsNullOrEmpty(text))
+    {
+        range.FirstCell().Value = text;
+    }
+}
+```
+
+## Data Entry Template Generator
+
+For bulk data entry via the UI:
+
+```csharp
+public class DataEntryTemplateGenerator
+{
+    public byte[] Generate<T>(IEnumerable<T>? sourceData, string headerText)
+    {
+        using var workbook = new XLWorkbook();
+        var worksheet = workbook.Worksheets.Add("Data Entry Template");
+
+        // Header
+        var headerCell = worksheet.Cell(1, 1);
+        ApplyHeaderFormat(headerCell, headerText);
+        worksheet.Column(1).Width = 45;
+
+        // Data (if provided)
+        if (sourceData != null)
+        {
+            var row = 2;
+            foreach (var item in sourceData)
+            {
+                worksheet.Cell(row++, 1).Value = XLCellValue.FromObject(item);
+            }
+        }
+
+        // All cells as text
+        worksheet.Column(1).Style.NumberFormat.Format = "@";
+
+        using var stream = new MemoryStream();
+        workbook.SaveAs(stream);
+        return stream.ToArray();
+    }
+
+    public byte[] Generate(object[][]? sourceData, string[] headers)
+    {
+        using var workbook = new XLWorkbook();
+        var worksheet = workbook.Worksheets.Add("Data Entry Template");
+
+        // Headers
+        for (int col = 0; col < headers.Length; col++)
+        {
+            ApplyHeaderFormat(worksheet.Cell(1, col + 1), headers[col]);
+            worksheet.Column(col + 1).Width = 65;
+            worksheet.Column(col + 1).Style.NumberFormat.Format = "@";
+        }
+
+        // Data
+        if (sourceData != null)
+        {
+            for (int row = 0; row < sourceData.Length; row++)
+            {
+                for (int col = 0; col < sourceData[row].Length; col++)
+                {
+                    worksheet.Cell(row + 2, col + 1).Value =
+                        XLCellValue.FromObject(sourceData[row][col]);
+                }
+            }
+        }
+
+        using var stream = new MemoryStream();
+        workbook.SaveAs(stream);
+        return stream.ToArray();
+    }
+}
+```
+
+## Service Registration
+
+```csharp
+public static class ServiceCollectionExtensions
+{
+    public static IServiceCollection AddExcelExport(
+        this IServiceCollection services,
+        IConfiguration configuration)
+    {
+        // Bind options
+        services.Configure<ExcelExportOptions>(
+            configuration.GetSection(ExcelExportOptions.SectionName));
+
+        // Register main service (scoped - per request)
+        services.AddScoped<IExcelExportService, ExcelExportService>();
+
+        // Register helpers (singleton - stateless)
+        services.AddSingleton<OutputColumnCache>();
+        services.AddSingleton<AttributeTableWriter>();
+        services.AddSingleton<DataEntryTemplateGenerator>();
+
+        return services;
+    }
+}
+```
+
+## NuGet Dependencies
+
+```xml
+<ItemGroup>
+  <PackageReference Include="ClosedXML" Version="0.104.*" />
+  <PackageReference Include="Microsoft.Extensions.Options" Version="9.0.*" />
+  <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="9.0.*" />
+  <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="9.0.*" />
+</ItemGroup>
+```
+
+## Testing Strategy
+
+### Unit Tests
+
+- Mock search models with various filter combinations
+- Verify sheet generation logic without file I/O
+- Test column ordering and formatting
+- Test inclusion reason calculation
+- Test null handling for optional sheets
+
+### Integration Tests
+
+- Generate actual .xlsx files
+- Open with ClosedXML to verify structure
+- Compare against legacy output samples
+- Test protection passwords
+- Verify table styles applied correctly
+
+### Test Data
+
+```csharp
+public static class ExcelExportTestData
+{
+    public static SearchModel CreateMinimalSearch() => new()
+    {
+        Id = 1,
+        Name = "Test Search",
+        UserName = "testuser",
+        SubmitDT = DateTime.Now.AddHours(-1),
+        StartDT = DateTime.Now.AddMinutes(-30),
+        EndDT = DateTime.Now,
+        ExtractMisData = false,
+        Results = new List<SearchResult>
+        {
+            CreateSearchResult(12345, "ITEM-001")
+        }
+    };
+
+    public static SearchModel CreateFullSearch() => new()
+    {
+        // ... includes MisResults and MisNonMatchResults
+    };
+}
+```
@@ -0,0 +1,84 @@
+# Implement Excel Export
+
+## Summary
+
+Implement the Excel export subsystem that generates multi-sheet Excel workbooks (.xlsx) containing search results and criteria documentation using the ClosedXML library on .NET 10. This phase provides an injectable `IExcelExportService` that transforms search data into formatted, protected spreadsheets with conditional sheet generation based on search options (MIS data extraction).
+
+## Scope
+
+### In Scope
+
+- `IExcelExportService` interface and `ExcelExportService` implementation
+- `ExcelExportOptions` configuration class with protection passwords
+- Search Criteria sheet generator with filter tables
+- Search Results sheet generator with attribute-driven columns
+- MIS Info sheet generator (conditional on ExtractMisData)
+- Investigation sheet generator (conditional on ExtractMisData)
+- Worksheet protection with configurable passwords
+- Attribute-driven column configuration (`OutputColumnAttribute`, `OutputTableAttribute`)
+- Data entry template generator for bulk upload
+- Header cell formatting utilities
+- Service registration extension method (`AddExcelExport`)
+- Unit tests with xUnit, Shouldly, and NSubstitute
+
+### Out of Scope
+
+- API endpoints for Excel download (Phase 8: web-api-auth)
+- Search result storage/retrieval (Phase 6: search-processing)
+- SignalR progress updates (Phase 8: web-api-auth)
+- File system storage of exports (results stored as byte[] in database)
+- Streaming exports for very large files (deferred to future optimization)
+
+## Motivation
+
+The Excel export subsystem is a core deliverable of the JDE Scoping Tool. Users depend on well-formatted Excel reports containing:
+
+- Complete search criteria documentation for audit trails
+- Work order results with status, quantities, and inclusion reasons
+- MIS (Manufacturing Information System) data for quality analysis
+- Investigation data for router mismatch analysis
+
+Migrating from EPPlus (which requires commercial license in v7+) to ClosedXML (MIT license) eliminates licensing concerns while maintaining comparable functionality.
+
+## Acceptance Criteria
+
+1. `IExcelExportService.GenerateAsync()` produces valid .xlsx files
+2. Workbooks contain correct sheets based on `ExtractMisData` flag:
+   - Standard export: 2 sheets (Search Criteria, Search Results)
+   - Full export: 4 sheets (+ MIS Info, Investigation)
+3. All column definitions match legacy output exactly:
+   - Search Results: 19 columns with correct headers and formats
+   - MIS Info: 19 columns with wrapped text columns
+   - Investigation: 12 columns with date formatting
+4. Worksheet protection applied with correct passwords from configuration
+5. Filter tables use Light18 table style with Gainsboro headers
+6. Auto-fit columns with correct padding (15% for criteria, 30% for data)
+7. Wrapped text columns (Test Description, Tools & Gauges, Work Instructions) use fixed 65-character width
+8. Inclusion reason computed correctly from boolean flags
+9. Service registered correctly via `AddExcelExport()` extension method
+10. Unit tests achieve >90% code coverage
+11. `openspec validate implement-excel-export --strict` passes
+
+## Dependencies
+
+| Phase | Dependency | Type |
+|-------|------------|------|
+| Phase 3: implement-domain-models | `SearchModel`, `SearchResult`, `MisSearchResult`, `MisNonMatchSearchResult` | Required |
+| Phase 6: implement-search-processing | Populated search results for testing | Soft dependency (can mock) |
+
+**Note:** This phase can proceed in parallel with Phase 6 by mocking search results in tests. The `SearchModel` and result types must be defined first.
+
+## Risks
+
+| Risk | Likelihood | Impact | Mitigation |
+|------|------------|--------|------------|
+| ClosedXML API differences from EPPlus | Medium | Medium | Cross-reference ClosedXML documentation; create API mapping guide in design.md |
+| Memory pressure with large exports | Low | High | Monitor memory usage; document streaming approach for future optimization |
+| Protection password exposure | Low | Medium | Store passwords in configuration, document in security notes |
+| Column order/format mismatch | Medium | High | Generate comparison spreadsheets; verify against legacy output |
+
+## Related Specs
+
+- `excel-export/spec.md` - Base specification for Excel export subsystem
+- `domain-models/spec.md` - Domain models including SearchModel and result types
+- `search-processing/spec.md` - Search processing that produces results for export
@@ -0,0 +1,353 @@
+# Excel Export Specification Delta
+
+This document describes ADDED and MODIFIED requirements for the Excel export subsystem migration from .NET Framework 4.8 to .NET 10.
+
+## ADDED Requirements
+
+### Requirement: ClosedXML Library Usage
+
+The system SHALL use ClosedXML library for all Excel generation operations.
+
+#### Business Rules
+
+- The implementation MUST use `XLWorkbook` class from ClosedXML (not EPPlus)
+- Colors MUST use `XLColor` type (e.g., `XLColor.Gainsboro`)
+- Table styles MUST use `XLTableTheme` enumeration
+- Worksheet protection MUST use `IXLWorksheet.Protect()` method
+- Cell access MUST use `worksheet.Cell(row, col)` syntax
+- Table creation MUST use `range.CreateTable()` or `range.AsTable()` methods
+
+#### Rationale
+
+EPPlus v7+ requires a commercial license (Polyform Noncommercial). ClosedXML is MIT-licensed and provides comparable functionality for .NET 10.
+
+#### Scenario: Create workbook with ClosedXML
+
+- **WHEN** generating an Excel export
+- **THEN** the system uses `new XLWorkbook()` for workbook creation
+- **AND** uses `worksheet.Cell(row, col)` for cell access
+- **AND** uses `XLColor.Gainsboro` for header backgrounds
+
+---
+
+### Requirement: Async Generation Pattern
+
+The system SHALL provide async-first API for Excel generation.
+
+#### Interface Definition
+
+```csharp
+public interface IExcelExportService
+{
+    Task<byte[]> GenerateAsync(
+        SearchModel search,
+        CancellationToken cancellationToken = default);
+}
+```
+
+#### Business Rules
+
+- The `GenerateAsync` method MUST return `Task<byte[]>`
+- The method MUST accept `CancellationToken` for cancellation support
+- Since ClosedXML's `SaveAs` to `MemoryStream` is synchronous, the implementation MUST wrap CPU-bound work in `Task.Run()`
+- The method MUST check cancellation token before generating each sheet
+- The method MUST throw `OperationCanceledException` when cancelled
+
+#### Scenario: Support cancellation during export
+
+- **WHEN** `GenerateAsync` is called with a `CancellationToken` that is cancelled
+- **THEN** the operation throws `OperationCanceledException`
+- **AND** partial workbook resources are disposed
+
+---
+
+### Requirement: Scoped Structured Logging
+
+The system SHALL use scoped structured logging for export operations.
+
+#### Business Rules
+
+- The service MUST use `ILogger<ExcelExportService>` for structured logging
+- Log entries MUST include search context via `ILogger.BeginScope()`
+- Scope MUST include `SearchId` and `SearchName` keys
+- Export start, sheet generation, and completion MUST be logged at Information level
+- Errors MUST be logged at Error level with exception details
+
+#### Implementation Pattern
+
+```csharp
+using var scope = _logger.BeginScope(new Dictionary<string, object>
+{
+    ["SearchId"] = search.Id,
+    ["SearchName"] = search.Name
+});
+
+_logger.LogInformation("Starting Excel export generation");
+```
+
+#### Scenario: Log export operations with context
+
+- **WHEN** generating an export for a search
+- **THEN** log entries include SearchId and SearchName via scope
+- **AND** structured logging captures operation progress
+
+---
+
+### Requirement: Configuration via IOptions Pattern
+
+The system SHALL use IOptions<T> pattern for configuration.
+
+#### Configuration Class
+
+```csharp
+public class ExcelExportOptions
+{
+    public const string SectionName = "ExcelExport";
+
+    public string CriteriaSheetPassword { get; set; } = "JDE_SCOPING_TOOL_PASS";
+    public string DataSheetPassword { get; set; } = "JDESCOPINGTOOL";
+    public bool DebugWriteToFile { get; set; } = false;
+    public string DebugOutputDirectory { get; set; } = "";
+}
+```
+
+#### Business Rules
+
+- Protection passwords MUST be loaded from `IOptions<ExcelExportOptions>`
+- Default password values MUST match legacy values for backward compatibility
+- Configuration section MUST be named "ExcelExport" in appsettings.json
+- Debug file writing MUST be optional and disabled by default
+
+#### Scenario: Configure via appsettings.json
+
+- **WHEN** appsettings.json contains ExcelExport section
+- **THEN** ExcelExportOptions binds to configured values
+- **AND** passwords from configuration are used for worksheet protection
+
+---
+
+### Requirement: Service Registration Extension Method
+
+The system SHALL provide a DI extension method for service registration.
+
+#### Implementation
+
+```csharp
+public static class ServiceCollectionExtensions
+{
+    public static IServiceCollection AddExcelExport(
+        this IServiceCollection services,
+        IConfiguration configuration)
+    {
+        services.Configure<ExcelExportOptions>(
+            configuration.GetSection(ExcelExportOptions.SectionName));
+
+        services.AddScoped<IExcelExportService, ExcelExportService>();
+        services.AddSingleton<OutputColumnCache>();
+        services.AddSingleton<AttributeTableWriter>();
+        services.AddSingleton<DataEntryTemplateGenerator>();
+
+        return services;
+    }
+}
+```
+
+#### Business Rules
+
+- `IExcelExportService` MUST be registered as scoped (per-request lifetime)
+- Helper classes (caches, writers) MUST be registered as singleton (stateless)
+- Options MUST be bound from IConfiguration
+- Extension method MUST return IServiceCollection for chaining
+
+#### Scenario: Register service in DI container
+
+- **WHEN** the application starts and calls `AddExcelExport()`
+- **THEN** `IExcelExportService` is registered with `ExcelExportService` implementation
+- **AND** helper services are registered as singletons
+
+---
+
+### Requirement: Native Reflection for Property Access
+
+The system SHALL use native .NET reflection for attribute-driven column configuration.
+
+#### Business Rules
+
+- Property access MUST use native `PropertyInfo.GetValue()` (not Fasterflect)
+- Column metadata MUST be cached using `ConcurrentDictionary` for performance
+- Cache key MUST be the model Type
+- Cached data MUST include PropertyInfo, OutputColumnAttribute, and computed values
+
+#### Implementation Pattern
+
+```csharp
+public class OutputColumnCache
+{
+    private readonly ConcurrentDictionary<Type, IReadOnlyList<OutputColumn>> _cache = new();
+
+    public IReadOnlyList<OutputColumn> GetColumns<T>() =>
+        _cache.GetOrAdd(typeof(T), BuildColumns);
+
+    private IReadOnlyList<OutputColumn> BuildColumns(Type type)
+    {
+        return type.GetProperties()
+            .Where(p => p.GetCustomAttribute<OutputColumnAttribute>() != null)
+            .Select(p => new OutputColumn(
+                p.Name,
+                p,
+                p.GetCustomAttribute<OutputColumnAttribute>()!))
+            .OrderBy(c => c.Attribute.Order)
+            .ThenBy(c => c.Name)
+            .ToList();
+    }
+}
+```
+
+#### Scenario: Cache column metadata on first access
+
+- **WHEN** `GetColumns<SearchResult>()` is called multiple times
+- **THEN** reflection is performed only once
+- **AND** subsequent calls return cached metadata
+
+---
+
+### Requirement: Temp File Cleanup
+
+The system SHALL clean up any debug temp files based on configuration.
+
+#### Business Rules
+
+- Debug file writing MUST only occur when `DebugWriteToFile` is true
+- Debug files MUST be written to `DebugOutputDirectory` path
+- File naming MUST follow pattern: `Search_{SearchId}_{timestamp}.xlsx`
+- Cleanup of old debug files is NOT automatic (manual cleanup responsibility)
+
+#### Scenario: Write debug file when enabled
+
+- **WHEN** `DebugWriteToFile` is true in configuration
+- **THEN** a copy of the export is written to the debug directory
+- **AND** the byte[] result is still returned normally
+
+---
+
+## MODIFIED Requirements
+
+### Requirement: Table Style Application
+
+The system SHALL use ClosedXML table theme enumeration.
+
+#### Migration
+
+| Legacy (EPPlus) | New (ClosedXML) |
+|-----------------|-----------------|
+| `TableStyles.Light18` | `XLTableTheme.TableStyleLight18` |
+| `TableStyles.Medium1` | `XLTableTheme.TableStyleMedium1` |
+
+#### Business Rules
+
+- Filter tables in criteria sheet MUST use `XLTableTheme.TableStyleLight18`
+- Data tables (Results, MIS Info, Investigation) MUST use `XLTableTheme.TableStyleLight18`
+- Table totals row MUST be disabled (`table.ShowTotalsRow = false`)
+
+#### Scenario: Apply table theme via ClosedXML
+
+- **WHEN** creating a data table
+- **THEN** the system uses `XLTableTheme.TableStyleLight18`
+- **AND** disables the totals row via `table.ShowTotalsRow = false`
+
+---
+
+### Requirement: Color Type Usage
+
+The system SHALL use ClosedXML color types.
+
+#### Migration
+
+| Legacy (EPPlus/System.Drawing) | New (ClosedXML) |
+|--------------------------------|-----------------|
+| `Color.Gainsboro` | `XLColor.Gainsboro` |
+| `Color.FromArgb(...)` | `XLColor.FromArgb(...)` |
+
+#### Business Rules
+
+- Header background color MUST use `XLColor.Gainsboro`
+- All color assignments MUST use `XLColor` type
+
+#### Scenario: Apply Gainsboro background via ClosedXML
+
+- **WHEN** formatting a header cell
+- **THEN** the system uses `cell.Style.Fill.BackgroundColor = XLColor.Gainsboro`
+
+---
+
+### Requirement: Column Auto-Fit Method
+
+The system SHALL use ClosedXML auto-fit methods.
+
+#### Migration
+
+| Legacy (EPPlus) | New (ClosedXML) |
+|-----------------|-----------------|
+| `column.AutoFit()` | `column.AdjustToContents()` |
+| `column.Width = x` | `column.Width = x` (same) |
+
+#### Business Rules
+
+- Auto-fit MUST use `AdjustToContents()` method
+- Padding factor MUST be applied after auto-fit: `column.Width *= paddingFactor`
+- Criteria sheet padding: 1.15 (15%)
+- Data sheet padding: 1.30 (30%)
+- Wrapped columns MUST NOT call `AdjustToContents()` (use fixed width)
+
+#### Scenario: Auto-fit column with padding
+
+- **WHEN** auto-fitting a data column
+- **THEN** the system calls `column.AdjustToContents()`
+- **AND** applies 30% padding via `column.Width *= 1.30`
+
+---
+
+### Requirement: Worksheet Protection API
+
+The system SHALL use ClosedXML protection API.
+
+#### Migration
+
+| Legacy (EPPlus) | New (ClosedXML) |
+|-----------------|-----------------|
+| `worksheet.Protection.SetPassword(pwd)` | `worksheet.Protect(pwd)` |
+| `worksheet.Protection.AllowAutoFilter = true` | `protection.AllowElement(XLSheetProtectionElements.AutoFilter)` |
+| `worksheet.ProtectedRanges.Add(...)` | `range.Style.Protection.Locked = false` |
+
+#### Business Rules
+
+- Protection MUST return `IXLSheetProtection` object
+- Allowed operations MUST use `AllowElement()` method
+- Cells beyond data range MUST have `Locked = false` for user editing
+- Extension area: 1000 rows and columns beyond data
+
+#### Scenario: Apply worksheet protection via ClosedXML
+
+- **WHEN** protecting a data worksheet
+- **THEN** the system calls `worksheet.Protect(password)`
+- **AND** enables filtering via `protection.AllowElement(XLSheetProtectionElements.AutoFilter)`
+
+---
+
+## NuGet Package Changes
+
+### REMOVED Dependencies
+
+| Package | Reason |
+|---------|--------|
+| EPPlus (4.x LGPL) | Replaced by ClosedXML |
+| Fasterflect | Replaced by native reflection |
+
+### ADDED Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| ClosedXML | 0.104.* | Excel generation (MIT license) |
+| Microsoft.Extensions.Options | 9.0.* | IOptions<T> pattern |
+| Microsoft.Extensions.Logging.Abstractions | 9.0.* | ILogger<T> interface |
+| Microsoft.Extensions.Configuration.Abstractions | 9.0.* | IConfiguration interface |
@@ -0,0 +1,247 @@
+# Tasks: Implement Excel Export
+
+## Phase 1: Project Setup
+
+- [x] Create JdeScoping.ExcelExport project
+  - Location: `NEW/src/JdeScoping.ExcelExport/JdeScoping.ExcelExport.csproj`
+  - Target: net10.0
+  - Validation: Project builds successfully
+  - Dependencies: JdeScoping.Core (for base models)
+
+- [x] Add NuGet package references
+  - Packages: ClosedXML, Microsoft.Extensions.Options, Microsoft.Extensions.Logging.Abstractions, Microsoft.Extensions.Configuration.Abstractions
+  - Validation: `dotnet restore` succeeds
+
+- [x] Create folder structure
+  - Folders: Attributes/, Configuration/, Generators/, Formatting/, Helpers/, Models/, Interfaces/
+  - Validation: Directories exist
+
+## Phase 2: Attributes and Configuration
+
+- [x] Create OutputColumnAttribute class
+  - Location: `Attributes/OutputColumnAttribute.cs`
+  - Properties: Order, HeaderText, Format, AutoWidth, Width, WrapText
+  - Constants: STD_FORMAT, DATE_FORMAT, TIMESTAMP_FORMAT, WRAPPED_COLUMN_WIDTH
+  - Validation: Class compiles, matches legacy signature
+
+- [x] Create OutputTableAttribute class
+  - Location: `Attributes/OutputTableAttribute.cs`
+  - Properties: TabName, TableName, ShowHeader
+  - Validation: Class compiles, matches legacy signature
+
+- [x] Create ExcelExportOptions class
+  - Location: `Configuration/ExcelExportOptions.cs`
+  - Properties: CriteriaSheetPassword, DataSheetPassword
+  - Const: SectionName = "ExcelExport"
+  - Validation: Class compiles with default values
+
+## Phase 3: Helper Classes
+
+- [x] Create OutputColumn model
+  - Location: `Models/OutputColumn.cs`
+  - Properties: Name, Property (PropertyInfo), Attribute (OutputColumnAttribute)
+  - Validation: Class compiles
+
+- [x] Create OutputColumnCache class
+  - Location: `Helpers/OutputColumnCache.cs`
+  - Pattern: ConcurrentDictionary for type-to-columns mapping
+  - Method: GetColumns<T>() returns IReadOnlyList<OutputColumn>
+  - Validation: Cache correctly caches and retrieves column metadata
+
+## Phase 4: Formatting Utilities
+
+- [x] Create HeaderFormatter static class
+  - Location: `Formatting/HeaderFormatter.cs`
+  - Methods: ApplyHeaderFormat(IXLCell, string?), ApplyHeaderFormat(IXLRange, string?, bool merge)
+  - Style: Bold, centered, Gainsboro background
+  - Validation: Unit tests verify cell styling
+
+- [x] Create ColumnFormatter static class
+  - Location: `Formatting/ColumnFormatter.cs`
+  - Methods: ApplyColumnFormat(IXLColumn, OutputColumnAttribute)
+  - Handles: Auto-fit with padding, wrapped text, number formats
+  - Constants: ExcelFormats class with format strings
+  - Validation: Unit tests verify column formatting
+
+- [x] Create WorksheetProtector class
+  - Location: `Formatting/WorksheetProtector.cs`
+  - Method: ApplyProtection(IXLWorksheet, string password)
+  - Configures: AllowElement for filter, sort, format operations
+  - Validation: Protected sheet allows specified operations
+
+## Phase 5: Sheet Generators
+
+- [x] Create AttributeTableWriter class
+  - Location: `Generators/AttributeTableWriter.cs`
+  - Dependencies: OutputColumnCache
+  - Method: WriteTable<T>(worksheet, startRow, startCol, data, tableNameOverride?)
+  - Features: Header row, data rows, Light18 table style, column formatting
+  - Validation: Generated table matches expected structure
+
+- [x] Create CriteriaSheetGenerator class
+  - Location: `Generators/CriteriaSheetGenerator.cs`
+  - Dependencies: IOptions<ExcelExportOptions>
+  - Method: Generate(XLWorkbook, SearchModel)
+  - Features: Search info, timestamps, filter tables, MIS indicator, protection
+  - Validation: Sheet matches legacy criteria sheet structure
+
+- [x] Create DataEntryTemplateGenerator class
+  - Location: `Generators/DataEntryTemplateGenerator.cs`
+  - Methods: Generate<T>(data, headerText), Generate(data[][], headers[])
+  - Features: Single/multi-column templates, text format, header styling
+  - Validation: Generated templates match legacy output
+
+## Phase 6: Service Interface and Implementation
+
+- [x] Create IExcelExportService interface
+  - Location: `Interfaces/IExcelExportService.cs`
+  - Method: Task<byte[]> GenerateAsync(SearchModel, CancellationToken)
+  - Validation: Interface compiles
+
+- [x] Create ExcelExportService class
+  - Location: `ExcelExportService.cs`
+  - Dependencies: ILogger<ExcelExportService>, IOptions<ExcelExportOptions>, OutputColumnCache, AttributeTableWriter
+  - Validation: Class compiles
+
+- [x] Implement GenerateAsync method
+  - Creates XLWorkbook
+  - Generates criteria sheet (always)
+  - Generates results sheet (always)
+  - Generates MIS Info sheet (conditional)
+  - Generates Investigation sheet (conditional)
+  - Returns byte[] via MemoryStream
+  - Validation: All sheet types generated correctly
+
+- [x] Implement Search Criteria sheet generation
+  - Uses CriteriaSheetGenerator
+  - Filter tables with 2 blank row spacing
+  - Auto-fit columns with 15% padding
+  - Criteria sheet password protection
+  - Validation: Matches legacy criteria sheet
+
+- [x] Implement Search Results sheet generation
+  - Uses AttributeTableWriter with SearchResult model
+  - 19 columns per spec
+  - Auto-fit with 30% padding
+  - Light18 table style
+  - Data sheet password protection
+  - Validation: Matches legacy results sheet
+
+- [x] Implement MIS Info sheet generation
+  - Uses AttributeTableWriter with MisSearchResult model
+  - 19 columns per spec
+  - Wrapped columns (Test Description, Tools & Gauges, Work Instructions) with fixed 65-char width
+  - Other columns: auto-fit with 30% padding
+  - Null check: skip if MisResults is null
+  - Validation: Matches legacy MIS Info sheet
+
+- [x] Implement Investigation sheet generation
+  - Uses AttributeTableWriter with MisNonMatchSearchResult model
+  - 12 columns per spec
+  - Date columns with DATE_FORMAT
+  - Auto-fit with 30% padding
+  - Null check: skip if MisNonMatchResults is null
+  - Validation: Matches legacy Investigation sheet
+
+## Phase 7: Logging and Error Handling
+
+- [x] Implement structured logging
+  - Use BeginScope with SearchId, SearchName
+  - Log export start, sheet generation, completion
+  - Log warnings for empty result sets
+  - Validation: Log messages include search context
+
+- [x] Implement cancellation support
+  - Check CancellationToken before each sheet
+  - Wrap workbook generation in Task.Run
+  - Throw OperationCanceledException on cancellation
+  - Validation: Long exports can be cancelled
+
+## Phase 8: Service Registration
+
+- [x] Create ServiceCollectionExtensions class
+  - Location: `ServiceCollectionExtensions.cs`
+  - Method: AddExcelExport(this IServiceCollection, IConfiguration)
+  - Registers: ExcelExportOptions, IExcelExportService (scoped), helpers (singleton)
+  - Validation: Services resolved correctly from DI
+
+## Phase 9: Unit Tests
+
+- [x] Create test project
+  - Location: `NEW/tests/JdeScoping.ExcelExport.Tests/JdeScoping.ExcelExport.Tests.csproj`
+  - Dependencies: xUnit, Shouldly, NSubstitute, ClosedXML
+  - Validation: Project builds
+
+- [x] Create OutputColumnCacheTests
+  - Tests: Column caching, ordering by Order property, tie-breaking by name
+  - Validation: Tests pass
+
+- [x] Create HeaderFormatterTests
+  - Tests: Cell formatting, range formatting, merge behavior
+  - Validation: Tests pass
+
+- [x] Create ColumnFormatterTests
+  - Tests: Auto-fit with padding, wrapped text, number formats
+  - Validation: Tests pass
+
+- [x] Create WorksheetProtectorTests
+  - Tests: Protection application, allowed operations
+  - Validation: Tests pass
+
+- [x] Create AttributeTableWriterTests
+  - Tests: Table generation, column ordering, styling
+  - Validation: Tests pass
+
+- [x] Create CriteriaSheetGeneratorTests
+  - Tests: Sheet structure, filter tables, timestamps
+  - Validation: Tests pass
+
+- [x] Create ExcelExportServiceTests
+  - Tests: Full export generation, conditional sheets, null handling
+  - Mock: ILogger, IOptions
+  - Validation: Tests pass
+
+- [x] Create InclusionReasonTests
+  - Tests: ManuallySpecified, Flagged, CARDEX, PartsList, CARDEX+PartsList, SplitOrder, UNKNOWN
+  - Validation: All inclusion reason scenarios covered
+
+- [x] Create DataEntryTemplateGeneratorTests
+  - Tests: Single-column, multi-column, empty data, pre-populated
+  - Validation: Tests pass
+
+## Phase 10: Integration Tests
+
+- [x] Create ExcelExportIntegrationTests
+  - Tests: Generate actual .xlsx files, verify with ClosedXML
+  - Validate: Sheet count, sheet names, column headers, table styles
+  - Validation: Integration tests pass
+
+- [x] Create LegacyComparisonTests
+  - Tests: Compare generated output against legacy sample files
+  - Validate: Column order, formats, protection
+  - Validation: Output matches legacy format
+
+## Phase 11: Verification
+
+- [x] Build complete solution
+  - Command: `dotnet build NEW/JdeScoping.slnx`
+  - Validation: JdeScoping.ExcelExport builds successfully
+
+- [x] Run all unit tests
+  - Command: `dotnet test tests/JdeScoping.ExcelExport.Tests`
+  - Validation: All 124 tests pass
+
+- [x] Validate OpenSpec change
+  - Command: `openspec validate implement-excel-export --strict`
+  - Validation: No validation errors
+
+- [x] Generate sample exports
+  - Create sample exports with various configurations
+  - Open in Excel to verify appearance
+  - Validation: Visual inspection passes (verified through integration tests)
+
+- [x] Codex MCP review
+  - Review: Implementation against spec
+  - Verify: Column definitions match legacy exactly (verified in LegacyComparisonTests)
+  - Verify: Format strings match legacy exactly (verified in LegacyComparisonTests)
+  - Verify: Protection settings match legacy exactly (verified in LegacyComparisonTests)
@@ -0,0 +1,518 @@
+# Search Processing Design
+
+## Overview
+
+This document describes the architecture and implementation approach for the search processing subsystem, including the SqlKata query builder pattern, filter handler architecture, and search processor service.
+
+## Architecture
+
+### High-Level Component Diagram
+
+```
+┌─────────────────────────────────────────────────────────────────────────┐
+│                         SearchProcessor                                   │
+│  - Orchestrates search execution                                         │
+│  - Coordinates filter enrichment, query building, execution              │
+└────────────────────────────────┬────────────────────────────────────────┘
+                                 │
+         ┌───────────────────────┼───────────────────────┐
+         │                       │                       │
+         ▼                       ▼                       ▼
+┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
+│ ILotFinder      │    │ ISearchQuery    │    │ IWorkOrder      │
+│ Repository      │    │ Builder         │    │ TraversalService│
+│ (enrichment)    │    │ (SQL generation)│    │ (downstream)    │
+└─────────────────┘    └────────┬────────┘    └─────────────────┘
+                                │
+                    ┌───────────┴───────────┐
+                    │                       │
+                    ▼                       ▼
+         ┌─────────────────┐     ┌─────────────────┐
+         │ Filter Handlers │     │ SqlServerCompiler│
+         │ (composable)    │     │ (SQL output)    │
+         └─────────────────┘     └─────────────────┘
+```
+
+### Project Structure
+
+```
+NEW/src/JdeScoping.SearchProcessing/
+├── Interfaces/
+│   ├── ISearchProcessor.cs
+│   ├── ISearchQueryBuilder.cs
+│   ├── IFilterHandler.cs
+│   └── IWorkOrderTraversalService.cs
+├── QueryBuilders/
+│   ├── SqlKataSearchQueryBuilder.cs
+│   └── MisQueryBuilder.cs
+├── FilterHandlers/
+│   ├── FilterHandlerBase.cs
+│   ├── WorkOrderFilterHandler.cs
+│   ├── ItemNumberFilterHandler.cs
+│   ├── ProfitCenterFilterHandler.cs
+│   ├── WorkCenterFilterHandler.cs
+│   ├── OperatorFilterHandler.cs
+│   ├── ComponentLotFilterHandler.cs
+│   ├── ItemOperationMisFilterHandler.cs
+│   └── TimespanFilterHandler.cs
+├── Models/
+│   ├── SearchModel.cs
+│   ├── SearchQueryResult.cs
+│   ├── FilterEntries/
+│   │   ├── WorkOrderFilterEntry.cs
+│   │   ├── ItemNumberFilterEntry.cs
+│   │   ├── ProfitCenterFilterEntry.cs
+│   │   ├── WorkCenterFilterEntry.cs
+│   │   ├── OperatorFilterEntry.cs
+│   │   ├── ComponentLotFilterEntry.cs
+│   │   └── ItemOperationMisFilterEntry.cs
+│   └── Results/
+│       ├── SearchResult.cs
+│       ├── MisSearchResult.cs
+│       └── MisNonMatchSearchResult.cs
+├── Services/
+│   ├── SearchProcessor.cs
+│   └── WorkOrderTraversalService.cs
+├── Configuration/
+│   └── SearchProcessingOptions.cs
+├── Attributes/
+│   ├── OutputColumnAttribute.cs
+│   └── OutputTableAttribute.cs
+├── Extensions/
+│   ├── SearchModelExtensions.cs
+│   └── TableValuedParameterExtensions.cs
+├── ServiceCollectionExtensions.cs
+└── JdeScoping.SearchProcessing.csproj
+```
+
+## SqlKata Query Builder Architecture
+
+### ISearchQueryBuilder Interface
+
+```csharp
+public interface ISearchQueryBuilder
+{
+    /// <summary>
+    /// Builds the main search query for flagging and retrieving work orders.
+    /// </summary>
+    SearchQueryResult BuildSearchQuery(SearchModel model);
+
+    /// <summary>
+    /// Builds the MIS data extraction query when ExtractMisData is enabled.
+    /// </summary>
+    SearchQueryResult BuildMisQuery(SearchModel model);
+
+    /// <summary>
+    /// Builds the MIS non-match query for work orders without MIS records.
+    /// </summary>
+    SearchQueryResult BuildMisNonMatchQuery(SearchModel model);
+}
+
+public record SearchQueryResult(
+    string Sql,
+    IDictionary<string, object> Parameters,
+    IReadOnlyList<string> TempTableSetupSql);
+```
+
+### SqlKata Integration Pattern
+
+The SqlKata query builder composes queries using fluent methods:
+
+```csharp
+public sealed class SqlKataSearchQueryBuilder : ISearchQueryBuilder
+{
+    private readonly SqlServerCompiler _compiler = new();
+    private readonly IEnumerable<IFilterHandler> _filterHandlers;
+
+    public SqlKataSearchQueryBuilder(IEnumerable<IFilterHandler> filterHandlers)
+    {
+        _filterHandlers = filterHandlers;
+    }
+
+    public SearchQueryResult BuildSearchQuery(SearchModel model)
+    {
+        var setupStatements = new List<string>();
+        var parameters = new Dictionary<string, object>();
+
+        // Build temp table setup SQL
+        setupStatements.Add(BuildTempWoTableSql());
+
+        // Apply filter handlers (each may add setup SQL and parameters)
+        foreach (var handler in _filterHandlers.Where(h => h.IsEnabled(model)))
+        {
+            var filterResult = handler.Apply(model, _compiler);
+            setupStatements.AddRange(filterResult.SetupSql);
+            foreach (var param in filterResult.Parameters)
+            {
+                parameters[param.Key] = param.Value;
+            }
+        }
+
+        // Build final result query
+        var resultQuery = BuildResultQuery();
+        var compiled = _compiler.Compile(resultQuery);
+
+        return new SearchQueryResult(
+            compiled.Sql,
+            MergeParameters(parameters, compiled.NamedBindings),
+            setupStatements);
+    }
+}
+```
+
+### Why SqlKata Instead of T4 Templates
+
+| Aspect | T4 Template (Legacy) | SqlKata (New) |
+|--------|---------------------|---------------|
+| Testability | Cannot unit test | Test query structure without DB |
+| Type Safety | String concatenation | Fluent API with IntelliSense |
+| SQL Injection | Manual parameter handling | Parameterized by default |
+| Maintenance | Edit .tt file, regenerate | Edit C# code directly |
+| SDK Support | Limited in modern .NET | Full .NET 10 support |
+| Composability | Monolithic template | Pluggable filter handlers |
+
+## Filter Handler Pattern
+
+### IFilterHandler Interface
+
+```csharp
+public interface IFilterHandler
+{
+    /// <summary>
+    /// Determines if this filter is active for the given search model.
+    /// </summary>
+    bool IsEnabled(SearchModel model);
+
+    /// <summary>
+    /// Applies the filter, returning setup SQL and parameters.
+    /// </summary>
+    FilterResult Apply(SearchModel model, SqlServerCompiler compiler);
+
+    /// <summary>
+    /// Priority for handler execution order (lower = earlier).
+    /// </summary>
+    int Priority { get; }
+}
+
+public record FilterResult(
+    IReadOnlyList<string> SetupSql,
+    IDictionary<string, object> Parameters);
+```
+
+### Filter Handler Implementations
+
+Each filter handler encapsulates the logic for one filter type:
+
+#### WorkOrderFilterHandler
+
+```csharp
+public sealed class WorkOrderFilterHandler : FilterHandlerBase
+{
+    public override int Priority => 10;
+
+    public override bool IsEnabled(SearchModel model)
+        => model.WorkOrderFilterEnabled;
+
+    public override FilterResult Apply(SearchModel model, SqlServerCompiler compiler)
+    {
+        // Generates MERGE into #Temp_WO with ManuallySpecified = 1
+        // Followed by split order detection
+        var sql = BuildWorkOrderMergeSql();
+        var parameters = new Dictionary<string, object>
+        {
+            ["p_WorkOrderFilter"] = model.CreateWorkOrderFilterParameter()
+        };
+
+        return new FilterResult(new[] { sql }, parameters);
+    }
+}
+```
+
+#### ComponentLotFilterHandler
+
+```csharp
+public sealed class ComponentLotFilterHandler : FilterHandlerBase
+{
+    public override int Priority => 30;
+
+    public override bool IsEnabled(SearchModel model)
+        => model.ComponentLotFilterEnabled;
+
+    public override FilterResult Apply(SearchModel model, SqlServerCompiler compiler)
+    {
+        // Joins Lot -> WorkOrderComponent/LotUsage -> WorkOrder
+        // Sets CARDEX = 1 flag
+        var sql = BuildComponentLotMergeSql();
+        var parameters = new Dictionary<string, object>
+        {
+            ["p_ComponentLotFilter"] = model.CreateComponentLotFilterParameter()
+        };
+
+        return new FilterResult(new[] { sql }, parameters);
+    }
+}
+```
+
+### Handler Execution Order
+
+Handlers execute in priority order to ensure dependent temp tables exist:
+
+| Priority | Handler | Creates/Uses |
+|----------|---------|--------------|
+| 10 | WorkOrderFilterHandler | Creates #Temp_WO entries |
+| 20 | ItemNumberFilterHandler | Creates #P_ItemNumbers |
+| 30 | ComponentLotFilterHandler | Uses Lot, creates #Temp_WO entries |
+| 40 | ProfitCenterFilterHandler | Creates #P_WorkCenters |
+| 50 | WorkCenterFilterHandler | Creates #P_WorkCenters |
+| 60 | OperatorFilterHandler | Creates #P_OperatorIDs |
+| 70 | ItemOperationMisFilterHandler | Creates #P_PartOperations |
+| 80 | TimespanFilterHandler | Adds WHERE clause |
+
+## IAsyncEnumerable Streaming Pattern
+
+### Large Result Set Handling
+
+For searches returning thousands of work orders, streaming avoids loading all results into memory:
+
+```csharp
+public interface ISearchProcessor
+{
+    /// <summary>
+    /// Executes search and returns results as async stream.
+    /// </summary>
+    IAsyncEnumerable<SearchResult> ExecuteSearchAsync(
+        SearchModel model,
+        CancellationToken ct = default);
+
+    /// <summary>
+    /// Executes search and materializes all results into SearchModel.
+    /// </summary>
+    Task<SearchModel> ExecuteSearchToModelAsync(
+        SearchModel model,
+        CancellationToken ct = default);
+}
+```
+
+### Streaming Implementation
+
+```csharp
+public sealed class SearchProcessor : ISearchProcessor
+{
+    private readonly IDbConnectionFactory _connectionFactory;
+    private readonly ISearchQueryBuilder _queryBuilder;
+    private readonly IWorkOrderTraversalService _traversalService;
+    private readonly ILogger<SearchProcessor> _logger;
+
+    public async IAsyncEnumerable<SearchResult> ExecuteSearchAsync(
+        SearchModel model,
+        [EnumeratorCancellation] CancellationToken ct = default)
+    {
+        await using var connection = await _connectionFactory
+            .CreateLotFinderConnectionAsync(ct);
+
+        // Execute setup SQL (temp tables, filter population)
+        var queryResult = _queryBuilder.BuildSearchQuery(model);
+        foreach (var setupSql in queryResult.TempTableSetupSql)
+        {
+            await connection.ExecuteAsync(setupSql, queryResult.Parameters);
+        }
+
+        // Stream results
+        await foreach (var result in connection.QueryUnbufferedAsync<SearchResult>(
+            queryResult.Sql,
+            queryResult.Parameters)
+            .WithCancellation(ct))
+        {
+            yield return result;
+        }
+    }
+}
+```
+
+## Downstream Work Order Traversal
+
+### Stored Procedure Approach
+
+The iterative traversal logic (up to 20 iterations finding downstream work orders) is better suited to a stored procedure:
+
+```csharp
+public interface IWorkOrderTraversalService
+{
+    /// <summary>
+    /// Traverses downstream work orders via stored procedure.
+    /// Called after initial filtering to find related work orders.
+    /// </summary>
+    Task TraverseDownstreamAsync(
+        SqlConnection connection,
+        CancellationToken ct = default);
+}
+```
+
+### Why Stored Procedure
+
+- **Iterative logic**: WHILE loops with temp table operations are efficient in T-SQL
+- **Reduced round trips**: Single call instead of 20+ iterations from C#
+- **Transaction scope**: All MERGE operations in same transaction
+- **Legacy compatibility**: Mirrors existing QueryTemplate.tt behavior
+
+## Table-Valued Parameter Helpers
+
+### Extension Methods
+
+```csharp
+public static class TableValuedParameterExtensions
+{
+    public static SqlMapper.ICustomQueryParameter CreateWorkOrderFilterParameter(
+        this SearchModel model)
+    {
+        var dataTable = new DataTable();
+        dataTable.Columns.Add("WorkOrderNumber", typeof(long));
+
+        foreach (var entry in model.WorkOrderFilter)
+        {
+            dataTable.Rows.Add(entry.WorkOrderNumber);
+        }
+
+        return dataTable.AsTableValuedParameter("WorkOrderFilterParameter");
+    }
+
+    // Similar methods for all 7 filter types...
+}
+```
+
+### TVP Type Mapping
+
+| C# Method | SQL Server Type | Columns |
+|-----------|-----------------|---------|
+| `CreateWorkOrderFilterParameter` | `WorkOrderFilterParameter` | `WorkOrderNumber BIGINT` |
+| `CreateItemNumberFilterParameter` | `ItemNumberFilterParameter` | `ItemNumber VARCHAR(25)` |
+| `CreateProfitCenterFilterParameter` | `ProfitCenterFilterParameter` | `Code VARCHAR(12)` |
+| `CreateWorkCenterFilterParameter` | `WorkCenterFilterParameter` | `Code VARCHAR(12)` |
+| `CreateOperatorFilterParameter` | `OperatorFilterParameter` | `UserName VARCHAR(10)` |
+| `CreateComponentLotFilterParameter` | `ComponentLotFilterParameter` | `ComponentLotNumber VARCHAR(30), ItemNumber VARCHAR(25)` |
+| `CreateItemOperationMisFilterParameter` | `ItemOperationMisFilterParameter` | `ItemNumber, OperationNumber, MisNumber, MisRevision` |
+
+## Configuration Options
+
+### SearchProcessingOptions Class
+
+```csharp
+public class SearchProcessingOptions
+{
+    public const string SectionName = "SearchProcessing";
+
+    /// <summary>
+    /// Query timeout in seconds for search execution.
+    /// </summary>
+    public int QueryTimeoutSeconds { get; set; } = 600;
+
+    /// <summary>
+    /// Maximum downstream traversal iterations.
+    /// </summary>
+    public int MaxTraversalIterations { get; set; } = 20;
+
+    /// <summary>
+    /// Enable debug SQL logging.
+    /// </summary>
+    public bool EnableDebugSql { get; set; } = false;
+
+    /// <summary>
+    /// Path to write debug SQL files (when EnableDebugSql is true).
+    /// </summary>
+    public string? DebugSqlPath { get; set; }
+}
+```
+
+### Configuration Binding
+
+```json
+{
+  "SearchProcessing": {
+    "QueryTimeoutSeconds": 600,
+    "MaxTraversalIterations": 20,
+    "EnableDebugSql": false,
+    "DebugSqlPath": null
+  }
+}
+```
+
+## Service Registration
+
+### AddSearchProcessing Extension Method
+
+```csharp
+public static class ServiceCollectionExtensions
+{
+    public static IServiceCollection AddSearchProcessing(
+        this IServiceCollection services,
+        IConfiguration configuration)
+    {
+        // Bind options
+        services.Configure<SearchProcessingOptions>(
+            configuration.GetSection(SearchProcessingOptions.SectionName));
+
+        // Register SqlKata compiler (singleton, thread-safe)
+        services.AddSingleton<SqlServerCompiler>();
+
+        // Register filter handlers (scoped)
+        services.AddScoped<IFilterHandler, WorkOrderFilterHandler>();
+        services.AddScoped<IFilterHandler, ItemNumberFilterHandler>();
+        services.AddScoped<IFilterHandler, ProfitCenterFilterHandler>();
+        services.AddScoped<IFilterHandler, WorkCenterFilterHandler>();
+        services.AddScoped<IFilterHandler, OperatorFilterHandler>();
+        services.AddScoped<IFilterHandler, ComponentLotFilterHandler>();
+        services.AddScoped<IFilterHandler, ItemOperationMisFilterHandler>();
+        services.AddScoped<IFilterHandler, TimespanFilterHandler>();
+
+        // Register query builders (scoped)
+        services.AddScoped<ISearchQueryBuilder, SqlKataSearchQueryBuilder>();
+
+        // Register services (scoped)
+        services.AddScoped<ISearchProcessor, SearchProcessor>();
+        services.AddScoped<IWorkOrderTraversalService, WorkOrderTraversalService>();
+
+        return services;
+    }
+}
+```
+
+## Testing Strategy
+
+### Unit Tests
+
+- **Query Builder Tests**: Verify generated SQL structure without executing
+- **Filter Handler Tests**: Test each handler in isolation
+- **Parameter Tests**: Verify TVP creation for all filter types
+- **Mock Repository**: Use NSubstitute for `ILotFinderRepository`
+
+### Integration Tests
+
+- **Full Search Flow**: Execute search against test database
+- **Filter Combinations**: Matrix of filter permutations
+- **Large Result Sets**: Verify streaming behavior
+- **MIS Extraction**: Test with and without MIS data
+
+### Test Frameworks
+
+- **xUnit**: Test framework
+- **Shouldly**: Fluent assertions
+- **NSubstitute**: Mocking framework
+
+## NuGet Dependencies
+
+```xml
+<ItemGroup>
+  <PackageReference Include="SqlKata" Version="3.0.*" />
+  <PackageReference Include="SqlKata.Execution" Version="3.0.*" />
+  <PackageReference Include="Dapper" Version="2.1.*" />
+  <PackageReference Include="Microsoft.Data.SqlClient" Version="5.2.*" />
+  <PackageReference Include="Microsoft.Extensions.Options" Version="9.0.*" />
+  <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="9.0.*" />
+</ItemGroup>
+
+<ItemGroup Condition="'$(Configuration)' == 'Test'">
+  <PackageReference Include="xunit" Version="2.9.*" />
+  <PackageReference Include="Shouldly" Version="4.2.*" />
+  <PackageReference Include="NSubstitute" Version="5.1.*" />
+</ItemGroup>
+```
@@ -0,0 +1,98 @@
+# Implement Search Processing
+
+## Summary
+
+Implement the search processing subsystem that executes user-defined filter queries against the SQL Server cache database. This phase replaces the legacy T4 text template (`QueryTemplate.tt`) with a SqlKata fluent query builder, providing type-safe query construction, parameterized SQL generation, and composable filter handling.
+
+## Scope
+
+### In Scope
+
+- `ISearchQueryBuilder` interface and `SqlKataSearchQueryBuilder` implementation
+- Filter handler pattern with individual handlers per filter type:
+  - `WorkOrderFilterHandler`
+  - `ItemNumberFilterHandler`
+  - `ProfitCenterFilterHandler`
+  - `WorkCenterFilterHandler`
+  - `OperatorFilterHandler`
+  - `ComponentLotFilterHandler`
+  - `ItemOperationMisFilterHandler`
+  - `TimespanFilterHandler`
+- `ISearchProcessor` interface and `SearchProcessor` service implementation
+- `IWorkOrderTraversalService` interface for downstream work order traversal
+- `SearchModel` class (reporting model with enriched filter entries)
+- Filter entry record types (immutable DTOs with output attributes)
+- Result record types: `SearchResult`, `MisSearchResult`, `MisNonMatchSearchResult`
+- Table-valued parameter creation helpers
+- MIS data extraction query building
+- `SearchProcessingOptions` configuration class
+- `AddSearchProcessing` service registration extension method
+- Unit tests with xUnit, Shouldly, and NSubstitute
+
+### Out of Scope
+
+- Background job scheduling (handled by Phase 5 data-sync or separate worker phase)
+- Excel export generation (Phase 7: excel-export)
+- API endpoints for search submission (Phase 8: web-api-auth)
+- SignalR real-time status updates (Phase 8: web-api-auth)
+- Database schema changes (Phase 1: migrate-database-schema)
+
+## Motivation
+
+The legacy T4 text template approach has significant limitations:
+- **SDK incompatibility**: T4 templates are poorly supported in modern .NET SDK-style projects
+- **Untestable**: Generated SQL cannot be unit tested without database execution
+- **Fragile**: String concatenation prone to SQL injection and syntax errors
+- **Untyped**: No compile-time validation of query structure
+
+SqlKata provides:
+- **Fluent API**: Readable, composable query building with IntelliSense support
+- **Parameterized by default**: SQL injection protection built-in
+- **Testable**: Unit test query building without database
+- **Type-safe**: Compile-time checking of method calls
+- **SQL Server optimized**: SqlServerCompiler generates optimized T-SQL
+
+## Acceptance Criteria
+
+1. `ISearchQueryBuilder` interface defined with `BuildSearchQuery(SearchModel)` method
+2. `SqlKataSearchQueryBuilder` generates equivalent SQL to legacy `QueryTemplate.tt`
+3. All 8 filter handlers implemented with conditional join/where clause generation
+4. `SearchProcessor` orchestrates:
+   - Filter entry enrichment via repository lookups
+   - Query building via SqlKata
+   - Query execution via Dapper
+   - Result aggregation into `SearchModel.Results`
+   - MIS data extraction when `ExtractMisData = true`
+5. Downstream work order traversal calls stored procedure `dbo.TraverseWorkOrders`
+6. Table-valued parameters created correctly for all filter types
+7. All result types include `OutputColumnAttribute` and `OutputTableAttribute` for Excel export
+8. Unit tests verify:
+   - Query builder generates expected SQL structure
+   - Filter handlers apply correct joins and conditions
+   - Parameter binding works for all TVP types
+9. `AddSearchProcessing` registers all services with appropriate lifetimes
+10. `openspec validate implement-search-processing --strict` passes
+
+## Dependencies
+
+- **Phase 1**: migrate-database-schema - Database tables, TVP types, stored procedures
+- **Phase 3**: implement-domain-models - Core domain entities (Search, SearchCriteria, etc.)
+- **Phase 4**: implement-data-access - `IDbConnectionFactory`, `ILotFinderRepository` for lookups
+- **NuGet packages**: `SqlKata`, `SqlKata.Execution`, `Dapper`, `Microsoft.Data.SqlClient`
+
+## Risks
+
+| Risk | Mitigation |
+|------|------------|
+| Query logic drift from legacy | Codex MCP review comparing generated SQL against QueryTemplate.tt output |
+| Complex filter combinations | Comprehensive unit test matrix covering all filter permutations |
+| MIS extraction query complexity | Retain MIS extraction as separate stored procedure if needed |
+| Performance regression | Benchmark query execution time against legacy implementation |
+| Downstream traversal correctness | Stored procedure `dbo.TraverseWorkOrders` encapsulates iterative logic |
+
+## Related Specs
+
+- `search-processing` - Primary specification for query building and search execution
+- `domain-models` - Entity types used in search criteria and results
+- `data-access` - Repository interfaces for filter enrichment lookups
+- `database-schema` - SQL Server tables and TVP types for search execution
@@ -0,0 +1,272 @@
+# Search Processing Specification Delta
+
+## Purpose
+
+This document captures ADDED and MODIFIED requirements for the search processing subsystem specific to the .NET 10 migration. It supplements the base specification at `openspec/specs/search-processing/spec.md`.
+
+## ADDED Requirements
+
+### Requirement: SqlKata Query Builder Integration
+
+The system SHALL use SqlKata fluent query builder instead of T4 text templates for dynamic SQL generation.
+
+#### Inputs
+
+- `SearchModel` containing filter criteria and enriched filter entries
+- `SqlServerCompiler` for T-SQL generation
+
+#### Outputs
+
+- `SearchQueryResult` record containing:
+  - `Sql`: Parameterized T-SQL query string
+  - `Parameters`: Dictionary of named parameter values
+  - `TempTableSetupSql`: List of temp table creation/population statements
+
+#### Business Rules
+
+- SqlKata `SqlServerCompiler` SHALL be registered as a singleton (thread-safe)
+- All queries SHALL use named parameters (not positional)
+- Parameter names SHALL match legacy convention (`@p_*` prefix)
+- Generated SQL SHALL produce equivalent results to legacy QueryTemplate.tt
+
+#### Scenario: Build query with SqlKata
+
+- **WHEN** `ISearchQueryBuilder.BuildSearchQuery(model)` is called
+- **THEN** SqlKata generates parameterized SQL with named bindings
+- **AND** the `SearchQueryResult.Sql` is executable via Dapper
+- **AND** `SearchQueryResult.Parameters` contains all TVP parameters
+
+---
+
+### Requirement: Filter Handler Pattern
+
+The system SHALL use a composable filter handler pattern for modular query building.
+
+#### Inputs
+
+- `SearchModel` with active filter criteria
+- `SqlServerCompiler` for SQL compilation
+
+#### Outputs
+
+- `FilterResult` record containing:
+  - `SetupSql`: List of temp table setup statements
+  - `Parameters`: Dictionary of parameters for this filter
+
+#### Business Rules
+
+- Each filter type SHALL have a dedicated `IFilterHandler` implementation
+- Filter handlers SHALL be registered in dependency injection container
+- Handlers SHALL execute in priority order (lower priority = earlier execution)
+- Handler priorities SHALL ensure dependent temp tables exist before use:
+  - WorkOrder: 10
+  - ItemNumber: 20
+  - ComponentLot: 30
+  - ProfitCenter: 40
+  - WorkCenter: 50
+  - Operator: 60
+  - ItemOperationMis: 70
+  - Timespan: 80
+
+#### Scenario: Execute filter handlers in order
+
+- **WHEN** search criteria includes work orders, items, and operators
+- **THEN** WorkOrderFilterHandler executes first (priority 10)
+- **AND** ItemNumberFilterHandler executes second (priority 20)
+- **AND** OperatorFilterHandler executes later (priority 60)
+
+---
+
+### Requirement: IAsyncEnumerable Result Streaming
+
+The system SHALL support streaming large result sets using `IAsyncEnumerable<T>`.
+
+#### Inputs
+
+- `SearchModel` with executed query
+- `CancellationToken` for cooperative cancellation
+
+#### Outputs
+
+- `IAsyncEnumerable<SearchResult>` streaming results one at a time
+
+#### Business Rules
+
+- Streaming SHALL use Dapper's `QueryUnbufferedAsync` method
+- Cancellation SHALL be supported via `[EnumeratorCancellation]` attribute
+- Memory allocation SHALL remain constant regardless of result set size
+- Consumer MAY materialize results using `ToListAsync()` when needed
+
+#### Scenario: Stream large result set
+
+- **WHEN** search returns 10,000 work orders
+- **THEN** results stream via `IAsyncEnumerable<SearchResult>`
+- **AND** memory usage remains constant during enumeration
+- **AND** `await foreach` consumes results incrementally
+
+---
+
+### Requirement: Async-First Design
+
+The system SHALL use async methods throughout the search processing pipeline.
+
+#### Business Rules
+
+- All repository methods SHALL accept `CancellationToken` parameter
+- All database operations SHALL use async Dapper methods (`QueryAsync`, `ExecuteAsync`)
+- Long-running operations SHALL respect cancellation tokens
+- `ISearchProcessor.ExecuteSearchAsync` SHALL be the primary entry point
+
+#### Scenario: Cancel long-running search
+
+- **WHEN** a search is in progress and cancellation is requested
+- **THEN** the operation throws `OperationCanceledException`
+- **AND** database connections are properly disposed
+
+---
+
+### Requirement: Configuration via IOptions Pattern
+
+The system SHALL use `IOptions<SearchProcessingOptions>` for configuration.
+
+#### Inputs
+
+- `appsettings.json` section: `SearchProcessing`
+
+#### Outputs
+
+- Strongly-typed `SearchProcessingOptions` injected via DI
+
+#### Configuration Properties
+
+| Property | Type | Default | Description |
+|----------|------|---------|-------------|
+| `QueryTimeoutSeconds` | int | 600 | SQL query timeout |
+| `MaxTraversalIterations` | int | 20 | Downstream traversal limit |
+| `EnableDebugSql` | bool | false | Write SQL to debug files |
+| `DebugSqlPath` | string? | null | Path for debug SQL files |
+
+#### Scenario: Configure query timeout
+
+- **WHEN** `SearchProcessingOptions.QueryTimeoutSeconds` is set to 900
+- **THEN** Dapper queries use `commandTimeout: 900`
+
+---
+
+### Requirement: Service Registration Extension
+
+The system SHALL provide an `AddSearchProcessing` extension method for DI registration.
+
+#### Service Lifetimes
+
+| Service | Lifetime | Rationale |
+|---------|----------|-----------|
+| `SqlServerCompiler` | Singleton | Thread-safe, stateless |
+| `IFilterHandler` implementations | Scoped | Per-request state |
+| `ISearchQueryBuilder` | Scoped | Uses scoped handlers |
+| `ISearchProcessor` | Scoped | Uses scoped repositories |
+| `IWorkOrderTraversalService` | Scoped | Uses connection factory |
+
+#### Scenario: Register search processing services
+
+- **WHEN** `services.AddSearchProcessing(configuration)` is called
+- **THEN** all search processing services are registered
+- **AND** `ISearchProcessor` can be resolved from service provider
+
+---
+
+## MODIFIED Requirements
+
+### Requirement: Work Order Traversal
+
+The system SHALL execute downstream work order traversal via stored procedure `dbo.TraverseWorkOrders` instead of inline WHILE loop in generated SQL.
+
+#### Inputs
+
+- Active database connection with `#Temp_WO` temporary table populated
+- Maximum iteration count (default 20)
+
+#### Outputs
+
+- Updated `#Temp_WO` table with downstream work orders flagged
+
+#### Business Rules
+
+- `IWorkOrderTraversalService.TraverseDownstreamAsync` SHALL call stored procedure
+- Stored procedure SHALL contain iterative WHILE loop logic
+- Single stored procedure call SHALL replace 20 inline iterations
+- Transaction scope SHALL be maintained within stored procedure
+
+#### Scenario: Execute downstream traversal via stored procedure
+
+- **WHEN** initial work orders are flagged in `#Temp_WO`
+- **THEN** `dbo.TraverseWorkOrders` stored procedure is called
+- **AND** downstream work orders are added with PartsList and CARDEX flags
+- **AND** split orders are detected and flagged
+
+---
+
+### Requirement: Filter Entry Types
+
+The system SHALL use C# record types for filter entry DTOs to provide immutability and value semantics.
+
+#### Inputs
+
+- Raw filter values from `SearchCriteria`
+- Reference data lookups from `ILotFinderRepository`
+
+#### Outputs
+
+- Immutable record instances with output attributes for Excel export
+
+#### Business Rules
+
+- All filter entry types SHALL be declared as C# records
+- Records SHALL use primary constructor syntax
+- Output attributes SHALL be applied using `[property:]` target
+- Records SHALL provide value-based equality for testing
+
+#### Scenario: Create immutable filter entry record
+
+- **WHEN** a WorkOrderFilterEntry is created with WorkOrderNumber 12345 and ItemNumber "ITEM-001"
+- **THEN** the record is immutable (properties are init-only)
+- **AND** two records with same values are considered equal
+
+---
+
+### Requirement: SQL Client Package
+
+The system SHALL use `Microsoft.Data.SqlClient` instead of deprecated `System.Data.SqlClient` for SQL Server connectivity.
+
+#### Business Rules
+
+- All SQL Server connections SHALL use `Microsoft.Data.SqlClient.SqlConnection`
+- All SQL commands SHALL use `Microsoft.Data.SqlClient.SqlCommand`
+- NuGet package `Microsoft.Data.SqlClient` version 5.2+ SHALL be referenced
+- Code SHALL NOT reference `System.Data.SqlClient` namespace
+
+#### Scenario: Create SQL connection with modern client
+
+- **WHEN** `IDbConnectionFactory.CreateLotFinderConnectionAsync` is called
+- **THEN** a `Microsoft.Data.SqlClient.SqlConnection` instance is returned
+- **AND** connection supports all modern SQL Server features
+
+---
+
+## Migration Notes
+
+| Legacy Pattern | New Pattern | Status |
+|----------------|-------------|--------|
+| T4 Text Template | SqlKata fluent builder | ADDED |
+| Inline WHILE loop | Stored procedure | MODIFIED |
+| Filter entry classes | Record types | MODIFIED |
+| Synchronous Dapper | Async Dapper | MODIFIED |
+| System.Data.SqlClient | Microsoft.Data.SqlClient | MODIFIED |
+| Static class methods | DI-registered services | MODIFIED |
+| Newtonsoft.Json | System.Text.Json | Retained in domain models |
+
+---
+
+## Open Questions
+
+None - all design decisions resolved per base specification.
@@ -0,0 +1,306 @@
+# Tasks: Implement Search Processing
+
+## Phase 1: Project Setup
+
+- [x] 001: Create JdeScoping.SearchProcessing project
+  - Location: `NEW/src/JdeScoping.SearchProcessing/JdeScoping.SearchProcessing.csproj`
+  - Dependencies: SqlKata, SqlKata.Execution, Dapper, Microsoft.Data.SqlClient
+  - Validation: `dotnet build` succeeds
+
+- [x] 002: Add project reference to JdeScoping.Host
+  - Location: `NEW/src/JdeScoping.Host/JdeScoping.Host.csproj`
+  - Validation: Solution builds with new reference
+
+- [x] 003: Create SearchProcessingOptions configuration class
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Configuration/SearchProcessingConfiguration.cs`
+  - Properties: QueryTimeoutSeconds, MaxTraversalIterations, EnableDebugSql, DebugSqlPath
+  - Validation: Options bind from appsettings.json
+
+## Phase 2: Output Attributes
+
+- [x] 004: Create OutputColumnAttribute
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Attributes/OutputColumnAttribute.cs`
+  - Properties: Order, HeaderText, Format, AutoWidth, Width, WrapText
+  - Constants: DATE_FORMAT, TIMESTAMP_FORMAT, WRAPPED_COLUMN_WIDTH
+  - Validation: Attribute compiles and is applicable to properties
+
+- [x] 005: Create OutputTableAttribute
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Attributes/OutputTableAttribute.cs`
+  - Properties: TabName, TableName, ShowHeader
+  - Validation: Attribute compiles and is applicable to classes/records
+
+## Phase 3: Filter Entry Records
+
+- [x] 006: Create WorkOrderFilterEntry record
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Models/FilterEntries/WorkOrderFilterEntry.cs`
+  - Properties: WorkOrderNumber (long), ItemNumber (string)
+  - Include OutputTable and OutputColumn attributes
+  - Validation: Record compiles with proper attributes
+
+- [x] 007: Create ItemNumberFilterEntry record
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Models/FilterEntries/ItemNumberFilterEntry.cs`
+  - Properties: ItemNumber, ItemDescription
+  - Validation: Record compiles with proper attributes
+
+- [x] 008: Create ProfitCenterFilterEntry record
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Models/FilterEntries/ProfitCenterFilterEntry.cs`
+  - Properties: Code, Description
+  - Validation: Record compiles with proper attributes
+
+- [x] 009: Create WorkCenterFilterEntry record
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Models/FilterEntries/WorkCenterFilterEntry.cs`
+  - Properties: Code, Description
+  - Validation: Record compiles with proper attributes
+
+- [x] 010: Create OperatorFilterEntry record
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Models/FilterEntries/OperatorFilterEntry.cs`
+  - Properties: AddressNumber (long), UserID, FullName
+  - Validation: Record compiles with proper attributes
+
+- [x] 011: Create ComponentLotFilterEntry record
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Models/FilterEntries/ComponentLotFilterEntry.cs`
+  - Properties: LotNumber, ItemNumber
+  - Validation: Record compiles with proper attributes
+
+- [x] 012: Create ItemOperationMisFilterEntry record
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Models/FilterEntries/ItemOperationMisFilterEntry.cs`
+  - Properties: ItemNumber, OperationNumber, MisNumber, MisRevision
+  - Validation: Record compiles with proper attributes
+
+## Phase 4: Result Records
+
+- [x] 013: Create SearchResult record
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Models/Results/SearchResult.cs`
+  - Source: `OLD/WorkerService/Models/Reporting/SearchResult.cs`
+  - Include all OutputColumn attributes matching legacy
+  - Include computed InclusionReason property
+  - Validation: All 18 output columns present with correct attributes
+
+- [x] 014: Create MisSearchResult record
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Models/Results/MisSearchResult.cs`
+  - Source: `OLD/WorkerService/Models/Reporting/MisSearchResult.cs`
+  - Validation: All MIS-related columns present
+
+- [x] 015: Create MisNonMatchSearchResult record
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Models/Results/MisNonMatchSearchResult.cs`
+  - Source: `OLD/WorkerService/Models/Reporting/MisNonMatchSearchResult.cs`
+  - Include: WasJobStepAdded, MatchedJobStepNumber columns
+  - Validation: All non-match columns present
+
+## Phase 5: SearchModel and Extensions
+
+- [x] 016: Create SearchModel class
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Models/SearchModel.cs`
+  - Source: `OLD/WorkerService/Models/Reporting/SearchModel.cs`
+  - Include all filter collections and computed *Enabled properties
+  - Include Results, MisResults, MisNonMatchResults collections
+  - Validation: All filter enabled properties work correctly
+
+- [x] 017: Create SearchQueryResult record
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Models/SearchQueryResult.cs`
+  - Properties: Sql, Parameters, TempTableSetupSql
+  - Validation: Record compiles
+
+- [x] 018: Create TableValuedParameterExtensions
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Extensions/TableValuedParameterExtensions.cs`
+  - Methods: Create*FilterParameter for all 7 filter types
+  - Source: `OLD/WorkerService/Helpers/SearchModelHelpers.cs`
+  - Validation: All TVP methods compile and match legacy schema
+
+- [x] 019: Create SearchModelExtensions
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Extensions/SearchModelExtensions.cs`
+  - Methods: ShouldSearchSteps, ToSearchModel (from Search entity)
+  - Source: `OLD/WorkerService/Helpers/SearchModelHelpers.cs`
+  - Validation: ShouldSearchSteps logic matches legacy
+
+## Phase 6: Query Builder Interfaces
+
+- [x] 020: Create IFilterHandler interface
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Interfaces/IFilterHandler.cs`
+  - Methods: IsEnabled, Apply, Priority property
+  - Validation: Interface compiles
+
+- [x] 021: Create FilterResult record
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Models/FilterResult.cs`
+  - Properties: SetupSql (IReadOnlyList<string>), Parameters (IDictionary)
+  - Validation: Record compiles
+
+- [x] 022: Create ISearchQueryBuilder interface
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Interfaces/ISearchQueryBuilder.cs`
+  - Methods: BuildSearchQuery, BuildMisQuery, BuildMisNonMatchQuery
+  - Validation: Interface compiles
+
+## Phase 7: Filter Handlers
+
+- [x] 023: Create FilterHandlerBase abstract class
+  - Location: `NEW/src/JdeScoping.SearchProcessing/FilterHandlers/FilterHandlerBase.cs`
+  - Common functionality for all handlers
+  - Validation: Abstract class compiles
+
+- [x] 024: Create WorkOrderFilterHandler
+  - Location: `NEW/src/JdeScoping.SearchProcessing/FilterHandlers/WorkOrderFilterHandler.cs`
+  - Source: QueryTemplate.tt lines 26-96
+  - Generates: MERGE #Temp_WO with ManuallySpecified flag, split order detection
+  - Validation: Unit test verifies SQL structure
+
+- [x] 025: Create ItemNumberFilterHandler
+  - Location: `NEW/src/JdeScoping.SearchProcessing/FilterHandlers/ItemNumberFilterHandler.cs`
+  - Source: QueryTemplate.tt lines 48-64
+  - Generates: #P_ItemNumbers temp table
+  - Validation: Unit test verifies SQL structure
+
+- [x] 026: Create ProfitCenterFilterHandler
+  - Location: `NEW/src/JdeScoping.SearchProcessing/FilterHandlers/ProfitCenterFilterHandler.cs`
+  - Source: QueryTemplate.tt lines 65-89
+  - Generates: #P_WorkCenters temp table via OrgHierarchy join
+  - Validation: Unit test verifies SQL structure
+
+- [x] 027: Create WorkCenterFilterHandler
+  - Location: `NEW/src/JdeScoping.SearchProcessing/FilterHandlers/WorkCenterFilterHandler.cs`
+  - Source: QueryTemplate.tt lines 90-102
+  - Generates: MERGE into #P_WorkCenters
+  - Validation: Unit test verifies SQL structure
+
+- [x] 028: Create OperatorFilterHandler
+  - Location: `NEW/src/JdeScoping.SearchProcessing/FilterHandlers/OperatorFilterHandler.cs`
+  - Source: QueryTemplate.tt lines 147-172
+  - Generates: #P_OperatorIDs temp table with JdeUser lookup
+  - Validation: Unit test verifies SQL structure
+
+- [x] 029: Create ComponentLotFilterHandler
+  - Location: `NEW/src/JdeScoping.SearchProcessing/FilterHandlers/ComponentLotFilterHandler.cs`
+  - Source: QueryTemplate.tt lines 103-146
+  - Generates: WorkOrderComponent/LotUsage joins, CARDEX flag
+  - Validation: Unit test verifies SQL structure
+
+- [x] 030: Create ItemOperationMisFilterHandler
+  - Location: `NEW/src/JdeScoping.SearchProcessing/FilterHandlers/ItemOperationMisFilterHandler.cs`
+  - Source: QueryTemplate.tt lines 173-198
+  - Generates: #P_PartOperations temp table
+  - Validation: Unit test verifies SQL structure
+
+- [x] 031: Create TimespanFilterHandler
+  - Location: `NEW/src/JdeScoping.SearchProcessing/FilterHandlers/TimespanFilterHandler.cs`
+  - Source: QueryTemplate.tt lines 254-258
+  - Generates: WHERE clause with @p_MinimumDT/@p_MaximumDT
+  - Business rule: Requires BOTH min and max for combined condition
+  - Validation: Unit test verifies SQL structure
+
+## Phase 8: Query Builder Implementation
+
+- [x] 032: Create SqlKataSearchQueryBuilder
+  - Location: `NEW/src/JdeScoping.SearchProcessing/QueryBuilders/SqlKataSearchQueryBuilder.cs`
+  - Orchestrates filter handlers
+  - Builds #Temp_WO setup, downstream traversal call, final SELECT
+  - Source: QueryTemplate.tt full template
+  - Validation: Generated SQL matches legacy structure
+
+- [x] 033: Create MisQueryBuilder
+  - Location: `NEW/src/JdeScoping.SearchProcessing/QueryBuilders/MisQueryBuilder.cs`
+  - Builds MIS extraction queries (MIS_CTE, #TempMisData)
+  - Source: QueryTemplate.tt lines 353-482
+  - Note: MIS extraction does NOT join #Temp_WO
+  - Validation: Generated SQL matches legacy structure
+
+## Phase 9: Services
+
+- [x] 034: Create ISearchProcessor interface
+  - Note: Existing interface at `NEW/src/JdeScoping.Core/Interfaces/ISearchProcessor.cs`
+  - Methods: ExecuteSearchAsync (IAsyncEnumerable), ExecuteSearchToModelAsync
+  - Validation: Interface compiles
+
+- [x] 035: Create IWorkOrderTraversalService interface
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Interfaces/IWorkOrderTraversalService.cs`
+  - Method: TraverseDownstreamAsync
+  - Validation: Interface compiles
+
+- [x] 036: Create WorkOrderTraversalService
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Services/WorkOrderTraversalService.cs`
+  - Calls dbo.TraverseWorkOrders stored procedure
+  - Executes WHILE loop logic for downstream work orders
+  - Source: QueryTemplate.tt lines 285-349
+  - Validation: Service compiles, stored procedure exists
+
+- [x] 037: Create SearchProcessor service
+  - Location: `NEW/src/JdeScoping.SearchProcessing/Services/SearchProcessor.cs`
+  - Constructor: IDbConnectionFactory, ISearchQueryBuilder, IWorkOrderTraversalService, ILotFinderRepository, ILogger
+  - Implements full search flow:
+    1. Enrich filter entries via repository lookups
+    2. Build query via SqlKata
+    3. Execute temp table setup
+    4. Call downstream traversal
+    5. Execute result query
+    6. Optionally extract MIS data
+  - Validation: Service compiles, all dependencies injected
+
+## Phase 10: Service Registration
+
+- [x] 038: Create ServiceCollectionExtensions
+  - Location: `NEW/src/JdeScoping.SearchProcessing/ServiceCollectionExtensions.cs`
+  - Method: AddSearchProcessing(IServiceCollection, IConfiguration)
+  - Registers: Options, SqlServerCompiler (singleton), filter handlers (scoped), services (scoped)
+  - Validation: Services resolve correctly at runtime
+
+- [x] 039: Register search processing in Program.cs
+  - Location: `NEW/src/JdeScoping.Host/Program.cs`
+  - Note: Updated to use SearchProcessing module's AddSearchProcessing; renamed Core's method to AddSearchProcessingOptions
+  - Validation: Application starts without DI errors
+
+## Phase 11: Unit Tests
+
+- [x] 040: Create test project
+  - Location: `NEW/tests/JdeScoping.SearchProcessing.Tests/JdeScoping.SearchProcessing.Tests.csproj`
+  - Dependencies: xUnit, Shouldly, NSubstitute
+  - Validation: Test project builds
+
+- [x] 041: Write WorkOrderFilterHandler tests
+  - Location: `NEW/tests/JdeScoping.SearchProcessing.Tests/FilterHandlers/WorkOrderFilterHandlerTests.cs`
+  - Test: IsEnabled returns correct value
+  - Test: Generated SQL contains MERGE and ManuallySpecified
+  - Validation: All tests pass (7 tests)
+
+- [x] 042: Write ComponentLotFilterHandler tests
+  - Location: `NEW/tests/JdeScoping.SearchProcessing.Tests/FilterHandlers/ComponentLotFilterHandlerTests.cs`
+  - Test: IsEnabled returns correct value
+  - Test: Generated SQL contains WorkOrderComponent join
+  - Test: CARDEX flag is set (not PartsList)
+  - Validation: All tests pass (9 tests)
+
+- [x] 043: Write SqlKataSearchQueryBuilder tests
+  - Location: `NEW/tests/JdeScoping.SearchProcessing.Tests/QueryBuilders/SqlKataSearchQueryBuilderTests.cs`
+  - Test: Empty filters produces minimal query
+  - Test: Single filter produces correct structure
+  - Test: Multiple filters combine correctly
+  - Validation: All tests pass (10 tests)
+
+- [x] 044: Write TableValuedParameterExtensions tests
+  - Location: `NEW/tests/JdeScoping.SearchProcessing.Tests/Extensions/TableValuedParameterExtensionsTests.cs`
+  - Test: Each Create*Parameter method produces correct DataTable schema
+  - Test: Empty collections produce empty DataTables
+  - Validation: All tests pass (17 tests)
+
+- [x] 045: Write SearchResult tests
+  - Location: `NEW/tests/JdeScoping.SearchProcessing.Tests/Models/SearchResultTests.cs`
+  - Test: InclusionReason returns correct values for all flag combinations
+  - Test: ManuallySpecified takes priority over Flagged
+  - Test: Unknown returned when no flags set
+  - Validation: All tests pass (21 tests)
+
+## Phase 12: Verification
+
+- [x] 046: Run full test suite
+  - Command: `dotnet test NEW/tests/JdeScoping.SearchProcessing.Tests/`
+  - Validation: All 64 tests pass
+
+- [x] 047: Verify solution builds
+  - Command: `dotnet build NEW/JdeScoping.sln`
+  - Validation: No errors or warnings
+
+- [x] 048: Run OpenSpec validation
+  - Command: `openspec validate implement-search-processing --strict`
+  - Validation: No validation errors - "Change 'implement-search-processing' is valid"
+
+- [x] 049: Codex MCP review of query builder output
+  - SqlKataSearchQueryBuilder generates SQL matching legacy QueryTemplate.tt structure
+  - Key features verified: #Temp_WO creation, MERGE statements, filter handler priority ordering
+  - Validation: SQL structure matches legacy implementation
@@ -0,0 +1,91 @@
+# Implement Web API
+
+## Summary
+
+Implement the REST API layer and real-time SignalR hub for the JDE Scoping Tool, providing HTTP endpoints for search management, lookup operations, file upload/download, and authentication. This phase creates the web-facing interface that connects the Blazor WebAssembly client to the backend search processing and data access layers.
+
+## Scope
+
+### In Scope
+
+- `AuthController` with login, logout, and current user endpoints
+- `SearchController` with CRUD operations and result downloads
+- `LookupController` with autocomplete APIs for items, profit centers, work centers, and operators
+- `FileController` with Excel upload/download for bulk data import
+- `StatusHub` SignalR hub for real-time status and search updates
+- `IAuthService` interface with LDAP and fake authentication implementations
+- `LdapAuthService` using `System.DirectoryServices.Protocols` (cross-platform)
+- `FakeAuthService` for development mode authentication bypass
+- `LdapOptions` and `AuthOptions` configuration classes
+- `UserInfo` model (renamed from legacy `LDAPEntry`)
+- API model DTOs (`LoginRequest`, `AuthResult`, `FileUploadResult<T>`, etc.)
+- Cookie-based session management with ASP.NET Core authentication
+- Service registration extension methods (`AddWebApi`, `AddAuthentication`)
+- OpenAPI/Swagger documentation
+- Unit tests with xUnit, Shouldly, and NSubstitute
+
+### Out of Scope
+
+- Blazor WebAssembly client implementation (Phase 9)
+- Background worker service (Phase 5: implement-data-sync)
+- Search execution logic (Phase 6: implement-search-processing)
+- Excel export generation (Phase 7: implement-excel-export)
+- Database schema changes (Phase 1: migrate-database-schema)
+- Rate limiting and advanced security (future enhancement)
+
+## Motivation
+
+The Web API layer is the bridge between the Blazor WebAssembly client and the backend services. This phase delivers:
+
+- **REST API Endpoints**: Standard HTTP APIs for search, lookup, and file operations
+- **Real-Time Updates**: SignalR hub for live status updates during search processing
+- **Cross-Platform Authentication**: LDAP authentication using `System.DirectoryServices.Protocols` (not the Windows-only `System.DirectoryServices`)
+- **Development Mode Support**: Fake authentication for local development without LDAP server
+- **OpenAPI Documentation**: Auto-generated API documentation for Blazor client development
+
+## Acceptance Criteria
+
+1. `AuthController` implements login, logout, and current user endpoints
+2. `SearchController` implements all CRUD operations with proper authorization
+3. `LookupController` implements autocomplete APIs without authorization (public access)
+4. `FileController` implements Excel upload/download with caching
+5. `StatusHub` broadcasts status and search updates to all connected clients
+6. `LdapAuthService` authenticates against LDAP with group membership verification
+7. `FakeAuthService` accepts any credentials when `AuthOptions.UseFakeAuth = true`
+8. Cookie authentication configured with proper timeout and no redirect on 401
+9. All protected endpoints return HTTP 401 (not redirect) for Blazor WASM compatibility
+10. SignalR hub maps to `/hubs/status` endpoint
+11. OpenAPI documentation generated via Swagger
+12. All services registered via `AddWebApi()` extension method
+13. Unit tests achieve >80% code coverage for controllers and services
+14. `openspec validate implement-web-api --strict` passes
+
+## Dependencies
+
+| Phase | Dependency | Type |
+|-------|------------|------|
+| Phase 4: implement-data-access | `ILotFinderRepository` for lookups and search storage | Required |
+| Phase 5: implement-data-sync | Worker service publishes status updates (soft dependency) | Soft |
+| Phase 6: implement-search-processing | Search execution produces results | Required |
+| Phase 7: implement-excel-export | `IExcelExportService` for file downloads | Required |
+
+**Note:** Controllers can be implemented with interface dependencies, allowing parallel development with mock implementations for testing.
+
+## Risks
+
+| Risk | Likelihood | Impact | Mitigation |
+|------|------------|--------|------------|
+| LDAP connectivity issues | Medium | High | Implement `FakeAuthService` for development; add connection retry logic |
+| `System.DirectoryServices.Protocols` complexity | Medium | Medium | Follow Microsoft documentation; create comprehensive LDAP integration tests |
+| SignalR connection management | Low | Medium | Use ASP.NET Core SignalR defaults; implement client reconnection in Blazor |
+| Cookie authentication with Blazor WASM | Low | Medium | Configure `SuppressAuthenticationChallengeOnUnauthorized`; test cross-origin scenarios |
+| File upload size limits | Low | Low | Configure `IFormFile` limits in `Program.cs`; document limits |
+| Memory cache expiration for file downloads | Low | Low | Use 1-minute expiration matching legacy; remove after download |
+
+## Related Specs
+
+- `web-api-auth/spec.md` - Base specification for Web API and authentication
+- `domain-models/spec.md` - Domain entities used by controllers
+- `data-access/spec.md` - Repository interfaces for data operations
+- `search-processing/spec.md` - Search processing service interfaces
+- `excel-export/spec.md` - Excel export service for result downloads
@@ -0,0 +1,194 @@
+# Web API and Authentication - Migration Deltas
+
+## Purpose
+
+This document specifies requirements ADDED or MODIFIED for the .NET 10 migration of the Web API and authentication layer. These requirements extend the base specification at `openspec/specs/web-api-auth/spec.md`.
+
+## ADDED Requirements
+
+### Requirement: Cross-Platform LDAP Support
+
+The system SHALL use `System.DirectoryServices.Protocols` for LDAP authentication to ensure cross-platform compatibility.
+
+#### Business Rules
+
+- The system SHALL NOT use `System.DirectoryServices.DirectoryEntry` or `System.DirectoryServices.DirectorySearcher` (Windows-only APIs)
+- The system SHALL use `LdapConnection` from `System.DirectoryServices.Protocols`
+- The system SHALL use asynchronous patterns with `Task.Run()` for LDAP operations (the LDAP API is synchronous)
+- The system SHALL dispose `LdapConnection` after each operation
+
+#### Scenario: LDAP authentication on Linux
+
+- **WHEN** the application runs on Linux with LDAP configuration
+- **THEN** the system authenticates successfully using `System.DirectoryServices.Protocols`
+
+### Requirement: ClosedXML for Excel Operations
+
+The system SHALL use ClosedXML library for Excel file parsing in the File API.
+
+#### Business Rules
+
+- The system SHALL NOT use EPPlus (commercial license required in v7+)
+- The system SHALL use `XLWorkbook` from ClosedXML for reading uploaded Excel files
+- The system SHALL use 1-indexed row/column access matching ClosedXML conventions
+- The system SHALL handle empty worksheets gracefully using `LastRowUsed()?.RowNumber()`
+
+#### Scenario: Parse Excel upload with ClosedXML
+
+- **WHEN** a user uploads an Excel file to any file upload endpoint
+- **THEN** the system parses the file using ClosedXML and returns matching data
+
+### Requirement: OpenAPI Documentation
+
+The system SHALL provide OpenAPI/Swagger documentation for all API endpoints.
+
+#### Business Rules
+
+- The system SHALL use Swashbuckle.AspNetCore for OpenAPI generation
+- The system SHALL expose Swagger UI at `/swagger` in development mode
+- The system SHALL document all endpoints with correct HTTP methods and response types
+- The system SHALL document authentication requirements for protected endpoints
+
+#### Scenario: Developer accesses API documentation
+
+- **WHEN** a developer navigates to `/swagger` in development mode
+- **THEN** the system displays interactive API documentation for all endpoints
+
+### Requirement: JSON Serialization with System.Text.Json
+
+The system SHALL use System.Text.Json for all JSON serialization.
+
+#### Business Rules
+
+- The system SHALL NOT use Newtonsoft.Json (legacy)
+- The system SHALL use `JsonStringEnumConverter` for enum serialization
+- The system SHALL configure JSON options via `AddControllers().AddJsonOptions()`
+- The system SHALL return JSON responses (not redirects) for all API errors
+
+#### Scenario: Enum serialization in API response
+
+- **WHEN** an API endpoint returns a model with an enum property
+- **THEN** the system serializes the enum as a string (e.g., "Submitted" not 1)
+
+### Requirement: IHubContext Dependency Injection
+
+The system SHALL use `IHubContext<StatusHub>` for publishing SignalR updates from outside the hub.
+
+#### Business Rules
+
+- The system SHALL NOT use static `GlobalHost.ConnectionManager` pattern (legacy)
+- The system SHALL inject `IHubContext<StatusHub>` into controllers and services
+- The system SHALL use `Clients.All.SendAsync()` for broadcasting
+- The system SHALL handle SignalR publish failures gracefully (log and continue)
+
+#### Scenario: Controller publishes search update
+
+- **WHEN** SearchController creates a new search
+- **THEN** the system uses injected `IHubContext<StatusHub>` to broadcast the update
+
+### Requirement: Async-First Pattern
+
+The system SHALL use async/await patterns for all I/O operations.
+
+#### Business Rules
+
+- All controller actions SHALL be async with `CancellationToken` parameter
+- All service methods SHALL be async with `CancellationToken` parameter
+- The system SHALL use `IAsyncEnumerable` for streaming scenarios where applicable
+- The system SHALL propagate `CancellationToken` to all downstream async calls
+
+#### Scenario: Cancellation during long-running operation
+
+- **WHEN** a client cancels a request during LDAP authentication
+- **THEN** the system throws `OperationCanceledException` and stops the operation
+
+### Requirement: Structured Logging
+
+The system SHALL use `ILogger<T>` for structured logging.
+
+#### Business Rules
+
+- The system SHALL NOT use NLog directly (legacy)
+- The system SHALL inject `ILogger<T>` into all controllers and services
+- The system SHALL use structured logging with named parameters: `_logger.LogWarning("Failed to authenticate {Username}", username)`
+- The system SHALL log at appropriate levels (Information, Warning, Error)
+
+#### Scenario: Failed LDAP authentication logged
+
+- **WHEN** LDAP authentication fails
+- **THEN** the system logs a warning with structured username and error details
+
+### Requirement: Options Pattern Configuration
+
+The system SHALL use `IOptions<T>` for strongly-typed configuration.
+
+#### Business Rules
+
+- The system SHALL NOT use `ConfigurationManager` or `WebConfigurationManager` (legacy)
+- The system SHALL bind `LdapOptions` from `Ldap` configuration section
+- The system SHALL bind `AuthOptions` from `Auth` configuration section
+- The system SHALL inject `IOptions<T>` or `IOptionsSnapshot<T>` as needed
+
+#### Scenario: Configuration changes without restart
+
+- **WHEN** configuration values change in appsettings.json
+- **THEN** the system can use `IOptionsSnapshot<T>` to read updated values
+
+## MODIFIED Requirements
+
+### Requirement: Cookie Authentication Events (Modified)
+
+The system SHALL suppress cookie authentication redirects and return HTTP status codes for Blazor WASM compatibility.
+
+#### Modified Business Rules
+
+- The system SHALL configure `OnRedirectToLogin` to return HTTP 401 instead of redirect
+- The system SHALL configure `OnRedirectToAccessDenied` to return HTTP 403 instead of redirect
+- The system SHALL return JSON error responses (not HTML) for authentication failures
+
+#### Scenario: Unauthenticated API request from Blazor
+
+- **WHEN** an unauthenticated Blazor WASM client requests a protected endpoint
+- **THEN** the system returns HTTP 401 with JSON error body (no redirect)
+
+### Requirement: SignalR Hub Endpoint Path (Modified)
+
+The system SHALL map the StatusHub to the `/hubs/status` endpoint path.
+
+#### Modified Business Rules
+
+- The system SHALL map StatusHub to `/hubs/status` endpoint
+- The system SHALL configure SignalR with default settings (no custom protocols)
+
+#### Scenario: Client connects to SignalR hub
+
+- **WHEN** a Blazor WASM client connects to SignalR
+- **THEN** the system accepts connections at `/hubs/status`
+
+### Requirement: Dependency Injected Memory Cache (Modified)
+
+The system SHALL use DI-injected `IMemoryCache` for file template caching.
+
+#### Modified Business Rules
+
+- The system SHALL inject `IMemoryCache` via constructor (not `MemoryCache.Default`)
+- The system SHALL use `MemoryCacheEntryOptions` with `AbsoluteExpirationRelativeToNow`
+- The system SHALL use `TryGetValue<T>` pattern for type-safe cache retrieval
+
+#### Scenario: File template cached with DI cache
+
+- **WHEN** a file template is generated
+- **THEN** the system stores it in the injected `IMemoryCache` with 1-minute expiration
+
+## Migration Notes
+
+| Legacy Pattern | New Pattern | Rationale |
+|----------------|-------------|-----------|
+| `System.DirectoryServices.DirectoryEntry` | `System.DirectoryServices.Protocols.LdapConnection` | Cross-platform compatibility |
+| EPPlus | ClosedXML | MIT license (EPPlus commercial in v7+) |
+| Newtonsoft.Json | System.Text.Json | Built-in, better performance |
+| `GlobalHost.ConnectionManager.GetHubContext<T>()` | `IHubContext<T>` via DI | Standard DI pattern, testable |
+| NLog | `ILogger<T>` | Built-in logging abstraction |
+| `WebConfigurationManager.AppSettings` | `IOptions<T>` | Strongly-typed configuration |
+| `MemoryCache.Default` | `IMemoryCache` via DI | Standard caching abstraction |
+| Login redirect on 401 | HTTP 401 response | Blazor WASM SPA compatibility |
@@ -0,0 +1,329 @@
+# Tasks: Implement Web API
+
+## Phase 1: Project Setup
+
+- [x] 001: Create JdeScoping.Api project
+  - Location: `NEW/src/JdeScoping.Api/JdeScoping.Api.csproj`
+  - Dependencies: Microsoft.AspNetCore.Authentication.Cookies, System.DirectoryServices.Protocols, Swashbuckle.AspNetCore, ClosedXML
+  - Validation: `dotnet build` succeeds
+
+- [x] 002: Add project reference to JdeScoping.Host
+  - Location: `NEW/src/JdeScoping.Host/JdeScoping.Host.csproj`
+  - Validation: Solution builds with new reference
+
+- [x] 003: Create configuration option classes
+  - LdapOptions: `NEW/src/JdeScoping.Api/Configuration/LdapOptions.cs`
+  - AuthOptions: `NEW/src/JdeScoping.Api/Configuration/AuthOptions.cs`
+  - Properties per design.md specification
+  - Validation: Options bind from appsettings.json
+
+## Phase 2: Data Models
+
+- [x] 004: Create UserInfo model
+  - Location: `NEW/src/JdeScoping.Core/Models/UserInfo.cs`
+  - Source: `OLD/DataModel/Models/LDAPEntry.cs`
+  - Include computed DisplayName property
+  - Validation: Model compiles with correct properties
+  - Note: Updated existing model with DN property
+
+- [x] 005: Create StatusUpdate model
+  - Location: `NEW/src/JdeScoping.Core/Models/StatusUpdate.cs`
+  - Source: `OLD/DataModel/Models/StatusUpdate.cs`
+  - Properties: Message, Timestamp
+  - Validation: Model compiles
+  - Note: Already existed in Core project
+
+- [x] 006: Create SearchUpdate model
+  - Location: `NEW/src/JdeScoping.Core/Models/SearchUpdate.cs`
+  - Source: `OLD/DataModel/Models/SearchUpdate.cs`
+  - Include JsonStringEnumConverter for Status
+  - Validation: Model compiles with JSON serialization working
+  - Note: Already existed in Core project
+
+- [x] 007: Create LoginRequest model
+  - Location: `NEW/src/JdeScoping.Api/Models/LoginRequest.cs`
+  - Source: `OLD/WebInterface/Models/LogonRequest.cs`
+  - Include Required attributes for validation
+  - Validation: Model compiles
+
+- [x] 008: Create AuthResult record
+  - Location: `NEW/src/JdeScoping.Api/Models/AuthResult.cs`
+  - Properties: Success, User, ErrorMessage
+  - Validation: Record compiles
+
+- [x] 009: Create FileUploadResult<T> model
+  - Location: `NEW/src/JdeScoping.Api/Models/FileUploadResult.cs`
+  - Source: `OLD/WebInterface/Models/FileUploadResult.cs`
+  - Validation: Generic model compiles
+
+## Phase 3: Authentication Service
+
+- [x] 010: Create IAuthService interface
+  - Location: `NEW/src/JdeScoping.Api/Services/IAuthService.cs`
+  - Methods: AuthenticateAsync, GetUserInfoAsync
+  - Include CancellationToken parameters
+  - Validation: Interface compiles
+
+- [x] 011: Create LdapAuthService implementation
+  - Location: `NEW/src/JdeScoping.Api/Services/LdapAuthService.cs`
+  - Source: `OLD/WebInterface/Helpers/LDAPHelper.cs`
+  - Use System.DirectoryServices.Protocols (NOT System.DirectoryServices)
+  - Implement failover across multiple server URLs
+  - Implement group membership verification
+  - Validation: Service compiles, passes unit tests for mocked scenarios
+
+- [x] 012: Create FakeAuthService implementation
+  - Location: `NEW/src/JdeScoping.Api/Services/FakeAuthService.cs`
+  - Accept any credentials, return predefined UserInfo
+  - Validation: Service compiles, unit tests pass
+
+## Phase 4: Security Helpers
+
+- [x] 013: Create UserIdentity helper
+  - Location: `NEW/src/JdeScoping.Api/Security/UserIdentity.cs`
+  - Source: `OLD/WebInterface/Security/UserIdentity.cs`
+  - Create ClaimsIdentity from UserInfo
+  - Validation: Helper compiles
+
+- [x] 014: Create ClaimsPrincipalExtensions
+  - Location: `NEW/src/JdeScoping.Api/Security/ClaimsPrincipalExtensions.cs`
+  - Method: ToUserInfo() extension for ClaimsPrincipal
+  - Validation: Extension compiles and works correctly
+
+## Phase 5: Base Controller
+
+- [x] 015: Create ApiControllerBase
+  - Location: `NEW/src/JdeScoping.Api/Controllers/ApiControllerBase.cs`
+  - Source: `OLD/WebInterface/Controllers/CrudController.cs`
+  - Provide CurrentUser and CurrentUserName properties
+  - Validation: Base controller compiles
+
+## Phase 6: Auth Controller
+
+- [x] 016: Create AuthController
+  - Location: `NEW/src/JdeScoping.Api/Controllers/AuthController.cs`
+  - Source: `OLD/WebInterface/Controllers/AccountController.cs`
+  - Endpoints: POST /api/auth/login, POST /api/auth/logout, GET /api/auth/me
+  - Use IAuthService for authentication
+  - Use HttpContext.SignInAsync/SignOutAsync
+  - Return JSON (not redirect) for Blazor WASM
+  - Validation: Controller compiles, endpoints respond correctly
+
+## Phase 7: Search Controller
+
+- [x] 017: Create SearchController
+  - Location: `NEW/src/JdeScoping.Api/Controllers/SearchController.cs`
+  - Source: `OLD/WebInterface/Controllers/SearchController.cs`
+  - Endpoints:
+    - GET /api/search - user's searches
+    - GET /api/search/queue - queued searches
+    - GET /api/search/{id} - single search
+    - POST /api/search/{id}/copy - copy search
+    - POST /api/search - create search
+    - GET /api/search/{id}/results - download results
+  - Apply [Authorize] at controller level
+  - Inject IHubContext<StatusHub> for SignalR notifications
+  - Validation: Controller compiles, endpoints respond correctly
+
+## Phase 8: Lookup Controller
+
+- [x] 018: Create LookupController
+  - Location: `NEW/src/JdeScoping.Api/Controllers/LookupController.cs`
+  - Source: `OLD/WebInterface/Controllers/LookupController.cs`
+  - Endpoints:
+    - GET /api/lookup/items?q= - search items
+    - GET /api/lookup/profit-centers?q= - search profit centers
+    - GET /api/lookup/work-centers?q= - search work centers
+    - GET /api/lookup/operators?q= - search operators
+  - NO authorization required (public endpoints)
+  - Validation: Controller compiles, endpoints respond correctly
+
+## Phase 9: File Controller
+
+- [x] 019: Create ExcelTemplateGenerator helper
+  - Location: `NEW/src/JdeScoping.Api/Helpers/ExcelTemplateGenerator.cs`
+  - Source: `OLD/DataModel/Helpers/ExcelTemplateGenerator.cs`
+  - Use ClosedXML (not EPPlus)
+  - Methods: Generate(data, headers)
+  - Validation: Helper generates valid Excel files
+
+- [x] 020: Create FileController
+  - Location: `NEW/src/JdeScoping.Api/Controllers/FileController.cs`
+  - Source: `OLD/WebInterface/Controllers/FileIOController.cs`
+  - Endpoints:
+    - POST /api/file/work-orders/upload
+    - POST /api/file/work-orders/template (returns cache key)
+    - GET /api/file/work-orders/template/{key}
+    - POST /api/file/part-numbers/upload
+    - POST /api/file/part-numbers/template
+    - GET /api/file/part-numbers/template/{key}
+    - POST /api/file/component-lots/upload
+    - POST /api/file/component-lots/template
+    - GET /api/file/component-lots/template/{key}
+    - POST /api/file/part-operations/upload
+    - POST /api/file/part-operations/template
+    - GET /api/file/part-operations/template/{key}
+  - Use IMemoryCache with 1-minute expiration
+  - Use ClosedXML for Excel parsing
+  - NO authorization required (matches legacy)
+  - Validation: Controller compiles, file upload/download works
+
+## Phase 10: SignalR Hub
+
+- [x] 021: Create StatusHub
+  - Location: `NEW/src/JdeScoping.Api/Hubs/StatusHub.cs`
+  - Source: `OLD/WebInterface/Hubs/StatusHub.cs`
+  - Methods:
+    - SetStatus(StatusUpdate) - cache and broadcast
+    - GetCachedStatus() - return cached status
+    - PublishSearchUpdate(SearchUpdate) - broadcast to all
+  - Use static cached status with "Unknown" default
+  - Use Clients.All.SendAsync() pattern
+  - Validation: Hub compiles, connections work
+
+## Phase 11: Service Registration
+
+- [x] 022: Create ServiceCollectionExtensions
+  - Location: `NEW/src/JdeScoping.Api/ServiceCollectionExtensions.cs`
+  - Methods:
+    - AddWebApi(services, configuration) - registers all services
+    - UseWebApi(app) - configures middleware
+  - Register IAuthService based on UseFakeAuth setting
+  - Configure cookie authentication with 401 on unauthorized
+  - Configure SignalR
+  - Configure Swagger/OpenAPI
+  - Validation: Services resolve correctly at runtime
+
+- [x] 023: Update Program.cs to use web API services
+  - Location: `NEW/src/JdeScoping.Host/Program.cs`
+  - Add: `builder.Services.AddWebApi(builder.Configuration);`
+  - Add: `app.UseWebApi();`
+  - Validation: Application starts without DI errors
+
+## Phase 12: Configuration Files
+
+- [x] 024: Update appsettings.json with Auth and Ldap sections
+  - Location: `NEW/src/JdeScoping.Host/appsettings.json`
+  - Add Auth section with production defaults
+  - Add Ldap section with placeholder values
+  - Validation: Configuration binds correctly
+
+- [x] 025: Create appsettings.Development.json
+  - Location: `NEW/src/JdeScoping.Host/appsettings.Development.json`
+  - Set UseFakeAuth = true for development
+  - Validation: Dev mode uses fake authentication
+  - Note: File already existed with UseFakeAuth = true
+
+## Phase 13: Unit Tests
+
+- [x] 026: Create test project
+  - Location: `NEW/tests/JdeScoping.Api.Tests/JdeScoping.Api.Tests.csproj`
+  - Dependencies: xUnit, Shouldly, NSubstitute, Microsoft.AspNetCore.Mvc.Testing
+  - Validation: Test project builds
+
+- [x] 027: Write AuthController tests
+  - Location: `NEW/tests/JdeScoping.Api.Tests/Controllers/AuthControllerTests.cs`
+  - Test: Login with valid credentials returns UserInfo
+  - Test: Login with invalid credentials returns 401
+  - Test: Logout clears authentication
+  - Test: GetCurrentUser returns user when authenticated
+  - Test: GetCurrentUser returns 401 when not authenticated
+  - Validation: All tests pass
+
+- [x] 028: Write SearchController tests
+  - Location: `NEW/tests/JdeScoping.Api.Tests/Controllers/SearchControllerTests.cs`
+  - Test: GetSearches returns user's searches ordered by date
+  - Test: CreateSearch saves and publishes to SignalR
+  - Test: CopySearch resets status and timestamps
+  - Test: GetResults returns file with correct content type
+  - Test: Unauthenticated requests return 401
+  - Validation: All tests pass
+
+- [x] 029: Write LookupController tests
+  - Location: `NEW/tests/JdeScoping.Api.Tests/Controllers/LookupControllerTests.cs`
+  - Test: FindItems returns ordered results
+  - Test: FindProfitCenters returns ordered results
+  - Test: FindWorkCenters returns ordered results
+  - Test: FindOperators returns ordered results
+  - Validation: All tests pass
+
+- [x] 030: Write FileController tests
+  - Location: `NEW/tests/JdeScoping.Api.Tests/Controllers/FileControllerTests.cs`
+  - Test: UploadWorkOrders parses Excel correctly
+  - Test: GenerateTemplate caches and returns key
+  - Test: DownloadTemplate returns file and removes from cache
+  - Test: Expired cache key returns 404
+  - Validation: All tests pass
+
+- [x] 031: Write LdapAuthService tests
+  - Location: `NEW/tests/JdeScoping.Api.Tests/Services/LdapAuthServiceTests.cs`
+  - Test: Invalid credentials returns failure
+  - Test: User not in group returns appropriate error
+  - Test: All servers unavailable returns connection error
+  - Note: Use mocks for LDAP connection (integration tests separate)
+  - Validation: All tests pass
+
+- [x] 032: Write FakeAuthService tests
+  - Location: `NEW/tests/JdeScoping.Api.Tests/Services/FakeAuthServiceTests.cs`
+  - Test: Any credentials return success
+  - Test: UserInfo populated correctly
+  - Validation: All tests pass
+
+- [x] 033: Write StatusHub tests
+  - Location: `NEW/tests/JdeScoping.Api.Tests/Hubs/StatusHubTests.cs`
+  - Test: SetStatus caches and broadcasts
+  - Test: GetCachedStatus returns cached value
+  - Test: Initial cached status is "Unknown"
+  - Validation: All tests pass
+
+## Phase 14: Integration Tests
+
+- [x] 034: Create integration test project
+  - Location: `NEW/tests/JdeScoping.Api.IntegrationTests/JdeScoping.Api.IntegrationTests.csproj`
+  - Use WebApplicationFactory for testing
+  - Validation: Test project builds
+
+- [x] 035: Write authentication integration tests
+  - Location: `NEW/tests/JdeScoping.Api.IntegrationTests/AuthenticationTests.cs`
+  - Test: Full login/logout flow with cookies
+  - Test: Protected endpoints return 401 without auth
+  - Test: Protected endpoints work with auth cookie
+  - Validation: All tests pass
+
+- [x] 036: Write SignalR integration tests
+  - Location: `NEW/tests/JdeScoping.Api.IntegrationTests/SignalRTests.cs`
+  - Test: Client can connect to /hubs/status
+  - Test: Client receives status updates
+  - Test: Client can call GetCachedStatus
+  - Validation: All tests pass
+
+## Phase 15: Verification
+
+- [x] 037: Run full test suite
+  - Command: `dotnet test NEW/tests/JdeScoping.Api.Tests/`
+  - Command: `dotnet test NEW/tests/JdeScoping.Api.IntegrationTests/`
+  - Validation: All tests pass (34 unit tests pass)
+
+- [x] 038: Verify solution builds
+  - Command: `dotnet build NEW/JdeScoping.slnx`
+  - Validation: No errors or warnings (Host project builds successfully)
+
+- [x] 039: Verify application starts
+  - Command: `dotnet run --project NEW/src/JdeScoping.Host`
+  - Validation: Application starts, Swagger UI accessible at /swagger
+
+- [x] 040: Verify API endpoints
+  - Test: /api/auth/login responds
+  - Test: /api/lookup/* endpoints respond without auth
+  - Test: /api/search/* endpoints require auth
+  - Test: /hubs/status SignalR connection works
+  - Validation: All endpoints functional
+
+- [x] 041: Run OpenSpec validation
+  - Command: `openspec validate implement-web-api --strict`
+  - Validation: No validation errors
+
+- [x] 042: Codex MCP review of controller implementations
+  - Compare controller actions against legacy
+  - Verify all endpoints match legacy behavior
+  - Validation: No significant behavioral differences
@@ -0,0 +1,116 @@
+# Database Migration Design
+
+## Overview
+
+This document describes the approach for migrating legacy SQL Server objects to DbUp migration scripts.
+
+## Script Naming Convention
+
+Scripts follow the pattern: `NNN_Description.sql`
+
+```
+001_CreateSearchTable.sql           (existing)
+002_CreateDataUpdateTable.sql       (existing)
+003_CreateBranchTable.sql
+...
+025_CreateLotUsageHistTable.sql
+026_CreateWorkOrderView.sql
+...
+032_CreateLastDataUpdatesView.sql
+033_CreateWorkOrderFilterParameterType.sql
+...
+039_CreateItemOperationMisFilterParameterType.sql
+040_CreateSubmitSearchProcedure.sql
+...
+043_CreateResetPartialSearchesProcedure.sql
+044_CreateMatchMisFunction.sql
+```
+
+### Number Ranges
+
+| Range | Category | Count |
+|-------|----------|-------|
+| 001-002 | Already done (Search, DataUpdate) | 2 |
+| 003-025 | Tables | 23 |
+| 026-032 | Views | 7 |
+| 033-039 | Table-valued parameter types | 7 |
+| 040-043 | Stored procedures | 4 |
+| 044 | Functions | 1 |
+
+## Execution Order
+
+Objects must be created in dependency order:
+
+```
+1. Reference tables (no FK dependencies)
+   - Branch, StatusCode, FunctionCode, ProfitCenter, WorkCenter
+   - Item, JdeUser, OrgHierarchy, RouteMaster, MisData
+
+2. Core tables (depend on reference tables)
+   - Lot, LotLocation, WorkOrder_Curr, WorkOrder_Hist
+   - WorkOrderStep_Curr, WorkOrderStep_Hist
+   - WorkOrderTime_Curr, WorkOrderTime_Hist
+   - WorkOrderComponent_Curr, WorkOrderComponent_Hist
+   - LotUsage_Curr, LotUsage_Hist
+
+3. Views (depend on tables)
+   - Union views: WorkOrder, WorkOrderStep, WorkOrderTime, WorkOrderComponent, LotUsage
+   - Aggregation views: WorkOrderTotalScrap, LastDataUpdates
+
+4. Types (no dependencies, but used by procedures)
+   - All 7 TVP types
+
+5. Procedures and Functions (depend on tables, views, types)
+   - SubmitSearch, StartSearch, CompleteSearch, ResetPartialSearches
+   - MatchMis function
+```
+
+## Schema Mapping
+
+### Data Type Decisions
+
+| Legacy | New | Rationale |
+|--------|-----|-----------|
+| DATETIME | DATETIME2(7) | Better precision, recommended for new development |
+| VARCHAR | VARCHAR | Keep as-is for JDE/CMS compatibility |
+| NVARCHAR | NVARCHAR | Keep as-is |
+| VARBINARY(MAX) | VARBINARY(MAX) | Keep for Excel storage (per user decision) |
+
+**Note:** The DATETIME → DATETIME2(7) conversion requires updating the database-schema spec to reflect this decision. This is a deliberate modernization choice.
+
+### Index Strategy
+
+- Primary keys: Defined in table creation scripts
+- Foreign keys: NOT created (legacy doesn't have them, cache tables)
+- Clustered indexes: On primary keys
+- Non-clustered indexes: Included in table creation scripts (match legacy exactly)
+
+## DbUp Configuration
+
+The existing `DatabaseMigrator.cs` configuration is appropriate:
+- Uses `WithTransaction()` for atomic migrations
+- Uses `WithScriptsEmbeddedInAssembly()` for embedded resources
+- Uses `EnsureDatabase.For.SqlDatabase()` to create DB if needed
+
+No changes needed to the migrator itself.
+
+## Verification Approach
+
+1. **Script syntax**: Run against local SQL Server container
+2. **Object existence**: Query sys.tables, sys.views, sys.procedures
+3. **Schema accuracy**: Compare column definitions to legacy
+4. **Codex review**: Cross-reference with specs
+
+## File Structure
+
+```
+NEW/src/JdeScoping.Database/
+├── Scripts/
+│   ├── 001_CreateSearchTable.sql          (existing)
+│   ├── 002_CreateDataUpdateTable.sql      (existing)
+│   ├── 003_CreateBranchTable.sql          (new)
+│   ├── ...
+│   └── 046_CreateMatchMisFunction.sql     (new)
+├── DatabaseMigrator.cs                     (existing, no changes)
+└── JdeScoping.Database.csproj             (existing, no changes)
+```
@@ -0,0 +1,64 @@
+# Migrate Database Schema
+
+## Summary
+
+Migrate all SQL Server database objects from the legacy .sqlproj to DbUp migration scripts in the new .NET 10 solution. This establishes the data layer foundation for subsequent migration phases.
+
+## Scope
+
+### In Scope
+
+- 25 tables (23 remaining - Search and DataUpdate already migrated)
+- 7 views (union views for _Curr/_Hist tables, aggregation views)
+- 7 table-valued parameter types (filter parameters for search queries)
+- 4 stored procedures (SubmitSearch, StartSearch, CompleteSearch, ResetPartialSearches)
+- 1 table-valued function (MatchMis)
+
+### Out of Scope
+
+- Application code changes
+- Connection string configuration
+- Data migration from existing databases
+- Index optimization (will be addressed separately)
+
+## Why
+
+The legacy .sqlproj format is not compatible with .NET 10 and cross-platform development. DbUp provides:
+- Version-controlled, sequential migrations
+- Idempotent deployments
+- Cross-platform compatibility
+- Integration with application startup
+
+## What Changes
+
+- **Added**: 44 DbUp migration scripts in `NEW/src/JdeScoping.Database/Scripts/`
+- **Modified**: All DATETIME columns converted to DATETIME2(7) for better precision
+- **Added**: Spec requirements for DbUp migration patterns and idempotency
+
+## Acceptance Criteria
+
+1. All 44 database objects exist as numbered DbUp migration scripts
+2. Scripts run successfully against empty database
+3. Scripts are idempotent (can re-run without error)
+4. Schema matches legacy database with approved modernizations:
+   - DATETIME → DATETIME2(7) for better precision
+   - Non-clustered indexes included in table scripts
+5. `openspec validate migrate-database-schema --strict` passes
+
+## Dependencies
+
+- None (this is the foundation phase)
+
+## Risks
+
+| Risk | Mitigation |
+|------|------------|
+| Schema drift from legacy | Codex MCP review against OLD/Database/ files |
+| Missing dependencies between objects | Order scripts by dependency (tables → views → types → procs) |
+| Data type mismatches | Use exact types from legacy schema |
+
+## Related Specs
+
+- `database-schema` - Table definitions and relationships
+- `sql-views-types` - Views and TVP types
+- `sql-business-logic` - Stored procedures and functions
@@ -0,0 +1,81 @@
+# Database Schema - Migration Implementation
+
+## ADDED Requirements
+
+### Requirement: Date/time column types
+
+The system SHALL use DATETIME2(7) for all date/time columns instead of legacy DATETIME.
+
+#### Rationale
+
+- DATETIME2(7) provides nanosecond precision vs millisecond for DATETIME
+- Larger date range (0001-01-01 to 9999-12-31)
+- Recommended for all new SQL Server development
+- Compatible with .NET DateTimeOffset
+
+#### Affected Tables
+
+All tables with date/time columns:
+- Search (SubmitDT, StartDT, EndDT)
+- DataUpdate (UpdateDT)
+- WorkOrder_Curr/Hist (various date columns)
+- WorkOrderStep_Curr/Hist (LastUpdateDT)
+- WorkOrderTime_Curr/Hist (GlDate, LastUpdateDT)
+- And all other tables with DATETIME columns
+
+#### Scenario: Date precision preserved
+
+- **WHEN** a datetime value is stored with sub-millisecond precision
+- **THEN** the full precision is preserved in DATETIME2(7) columns
+
+## ADDED Requirements
+
+### Requirement: DbUp migration scripts
+
+The system SHALL use DbUp migration scripts to create and maintain the database schema.
+
+#### Migration Script Organization
+
+- Scripts SHALL be numbered sequentially (NNN_Description.sql)
+- Scripts SHALL be embedded as resources in JdeScoping.Database assembly
+- Scripts SHALL execute in dependency order (tables → views → types → procedures)
+
+#### Script Numbering Ranges
+
+| Range | Category |
+|-------|----------|
+| 001-025 | Tables |
+| 026-032 | Views |
+| 033-039 | Table-valued parameter types |
+| 040-043 | Stored procedures |
+| 044+ | Functions |
+
+#### Scenario: Fresh database deployment
+
+- **WHEN** the application starts against an empty database
+- **THEN** DbUp creates all 44 database objects in dependency order
+- **AND** the SchemaVersions table records each applied migration
+
+#### Scenario: Incremental migration
+
+- **WHEN** the application starts against a database with some migrations applied
+- **THEN** DbUp applies only new migrations not in SchemaVersions
+- **AND** existing data is preserved
+
+### Requirement: Migration idempotency
+
+The system SHALL ensure migration scripts are idempotent for safe re-execution.
+
+#### Idempotency Patterns
+
+- Tables: Use `IF NOT EXISTS` checks
+- Views: Use `CREATE OR ALTER VIEW`
+- Types: Check sys.types before creation
+- Procedures: Use `CREATE OR ALTER PROCEDURE`
+- Functions: Use `CREATE OR ALTER FUNCTION`
+
+#### Scenario: Re-run migration on existing database
+
+- **WHEN** a migration script runs against a database where the object already exists
+- **THEN** the script completes without error
+- **AND** the object definition matches the script
@@ -0,0 +1,210 @@
+# Tasks: Migrate Database Schema
+
+## Phase 0: Foundation Tables (Corrected)
+
+- [x] 001: Search table migration script
+  - Source: `OLD/Database/Tables/Search.sql`
+  - Note: Corrected to match legacy schema (ID, UserName, Name, Status, SubmitDT, StartDT, EndDT, Criteria, Results)
+  - Location: `NEW/src/JdeScoping.Database/Scripts/001_CreateSearchTable.sql`
+
+- [x] 002: DataUpdate table migration script
+  - Source: `OLD/Database/Tables/DataUpdate.sql`
+  - Note: Corrected to match legacy schema (SourceSystem, SourceData, TableName, StartDT, EndDT, UpdateType, WasSuccessful, NumberRecords)
+  - Location: `NEW/src/JdeScoping.Database/Scripts/002_CreateDataUpdateTable.sql`
+
+## Phase 1: Reference Tables (No Dependencies)
+
+- [x] 003: Create Branch table migration script
+  - Source: `OLD/Database/Tables/Branch.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/003_CreateBranchTable.sql`
+
+- [x] 004: Create StatusCode table migration script
+  - Source: `OLD/Database/Tables/StatusCode.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/004_CreateStatusCodeTable.sql`
+
+- [x] 005: Create FunctionCode table migration script
+  - Source: `OLD/Database/Tables/FunctionCode.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/005_CreateFunctionCodeTable.sql`
+
+- [x] 006: Create ProfitCenter table migration script
+  - Source: `OLD/Database/Tables/ProfitCenter.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/006_CreateProfitCenterTable.sql`
+
+- [x] 007: Create WorkCenter table migration script
+  - Source: `OLD/Database/Tables/WorkCenter.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/007_CreateWorkCenterTable.sql`
+
+- [x] 008: Create Item table migration script
+  - Source: `OLD/Database/Tables/Item.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/008_CreateItemTable.sql`
+
+- [x] 009: Create JdeUser table migration script
+  - Source: `OLD/Database/Tables/JdeUser.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/009_CreateJdeUserTable.sql`
+
+- [x] 010: Create OrgHierarchy table migration script
+  - Source: `OLD/Database/Tables/OrgHierarchy.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/010_CreateOrgHierarchyTable.sql`
+
+- [x] 011: Create RouteMaster table migration script
+  - Source: `OLD/Database/Tables/RouteMaster.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/011_CreateRouteMasterTable.sql`
+
+- [x] 012: Create MisData table migration script
+  - Source: `OLD/Database/Tables/MisData.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/012_CreateMisDataTable.sql`
+
+## Phase 2: Core Tables (Depend on Reference Tables)
+
+- [x] 013: Create Lot table migration script
+  - Source: `OLD/Database/Tables/Lot.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/013_CreateLotTable.sql`
+
+- [x] 014: Create LotLocation table migration script
+  - Source: `OLD/Database/Tables/LotLocation.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/014_CreateLotLocationTable.sql`
+
+- [x] 015: Create WorkOrder_Curr table migration script
+  - Source: `OLD/Database/Tables/WorkOrder_Curr.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/015_CreateWorkOrderCurrTable.sql`
+
+- [x] 016: Create WorkOrder_Hist table migration script
+  - Source: `OLD/Database/Tables/WorkOrder_Hist.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/016_CreateWorkOrderHistTable.sql`
+
+- [x] 017: Create WorkOrderStep_Curr table migration script
+  - Source: `OLD/Database/Tables/WorkOrderStep_Curr.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/017_CreateWorkOrderStepCurrTable.sql`
+
+- [x] 018: Create WorkOrderStep_Hist table migration script
+  - Source: `OLD/Database/Tables/WorkOrderStep_Hist.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/018_CreateWorkOrderStepHistTable.sql`
+
+- [x] 019: Create WorkOrderTime_Curr table migration script
+  - Source: `OLD/Database/Tables/WorkOrderTime_Curr.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/019_CreateWorkOrderTimeCurrTable.sql`
+
+- [x] 020: Create WorkOrderTime_Hist table migration script
+  - Source: `OLD/Database/Tables/WorkOrderTime_Hist.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/020_CreateWorkOrderTimeHistTable.sql`
+
+- [x] 021: Create WorkOrderComponent_Curr table migration script
+  - Source: `OLD/Database/Tables/WorkOrderComponent_Curr.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/021_CreateWorkOrderComponentCurrTable.sql`
+
+- [x] 022: Create WorkOrderComponent_Hist table migration script
+  - Source: `OLD/Database/Tables/WorkOrderComponent_Hist.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/022_CreateWorkOrderComponentHistTable.sql`
+
+- [x] 023: Create WorkOrderRouting table migration script
+  - Source: `OLD/Database/Tables/WorkOrderRouting_Curr.sql`
+  - Note: File creates `dbo.WorkOrderRouting` (no _Curr suffix, single table)
+  - Location: `NEW/src/JdeScoping.Database/Scripts/023_CreateWorkOrderRoutingTable.sql`
+
+- [x] 024: Create LotUsage_Curr table migration script
+  - Source: `OLD/Database/Tables/LotUsage_Curr.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/024_CreateLotUsageCurrTable.sql`
+
+- [x] 025: Create LotUsage_Hist table migration script
+  - Source: `OLD/Database/Tables/LotUsage_Hist.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/025_CreateLotUsageHistTable.sql`
+
+## Phase 3: Views (Depend on Tables)
+
+- [x] 026: Create WorkOrder view migration script
+  - Source: `OLD/Database/Views/WorkOrder.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/026_CreateWorkOrderView.sql`
+
+- [x] 027: Create WorkOrderTime view migration script
+  - Source: `OLD/Database/Views/WorkOrderTime.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/027_CreateWorkOrderTimeView.sql`
+
+- [x] 028: Create WorkOrderStep view migration script
+  - Source: `OLD/Database/Views/WorkOrderStep.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/028_CreateWorkOrderStepView.sql`
+
+- [x] 029: Create WorkOrderComponent view migration script
+  - Source: `OLD/Database/Views/WorkOrderComponent.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/029_CreateWorkOrderComponentView.sql`
+
+- [x] 030: Create LotUsage view migration script
+  - Source: `OLD/Database/Views/LotUsage.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/030_CreateLotUsageView.sql`
+
+- [x] 031: Create WorkOrderTotalScrap view migration script
+  - Source: `OLD/Database/Views/WorkOrderTotalScrap.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/031_CreateWorkOrderTotalScrapView.sql`
+
+- [x] 032: Create LastDataUpdates view migration script
+  - Source: `OLD/Database/Views/LastDataUpdates.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/032_CreateLastDataUpdatesView.sql`
+
+## Phase 4: Table-Valued Parameter Types
+
+- [x] 033: Create WorkOrderFilterParameter type migration script
+  - Source: `OLD/Database/Types/WorkOrderFilterParameter.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/033_CreateWorkOrderFilterParameterType.sql`
+
+- [x] 034: Create ItemNumberFilterParameter type migration script
+  - Source: `OLD/Database/Types/ItemNumberFilterParameter.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/034_CreateItemNumberFilterParameterType.sql`
+
+- [x] 035: Create ProfitCenterFilterParameter type migration script
+  - Source: `OLD/Database/Types/ProfitCenterFilterParameter.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/035_CreateProfitCenterFilterParameterType.sql`
+
+- [x] 036: Create WorkCenterFilterParameter type migration script
+  - Source: `OLD/Database/Types/WorkCenterFilterParameter.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/036_CreateWorkCenterFilterParameterType.sql`
+
+- [x] 037: Create OperatorFilterParameter type migration script
+  - Source: `OLD/Database/Types/OperatorFilterParameter.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/037_CreateOperatorFilterParameterType.sql`
+
+- [x] 038: Create ComponentLotFilterParameter type migration script
+  - Source: `OLD/Database/Types/ComponentLotFilterParameter.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/038_CreateComponentLotFilterParameterType.sql`
+
+- [x] 039: Create ItemOperationMisFilterParameter type migration script
+  - Source: `OLD/Database/Types/ItemOperationMISFilterParameter.sql`
+  - Note: Using lowercase "Mis" per Codex review naming convention
+  - Location: `NEW/src/JdeScoping.Database/Scripts/039_CreateItemOperationMisFilterParameterType.sql`
+
+## Phase 5: Stored Procedures
+
+- [x] 040: Create SubmitSearch stored procedure migration script
+  - Source: `OLD/Database/StoredProcedures/SubmitSearch.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/040_CreateSubmitSearchProcedure.sql`
+
+- [x] 041: Create StartSearch stored procedure migration script
+  - Source: `OLD/Database/StoredProcedures/StartSearch.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/041_CreateStartSearchProcedure.sql`
+
+- [x] 042: Create CompleteSearch stored procedure migration script
+  - Source: `OLD/Database/StoredProcedures/CompleteSearch.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/042_CreateCompleteSearchProcedure.sql`
+
+- [x] 043: Create ResetPartialSearches stored procedure migration script
+  - Source: `OLD/Database/StoredProcedures/ResetPartialSearches.sql`
+  - Location: `NEW/src/JdeScoping.Database/Scripts/043_CreateResetPartialSearchesProcedure.sql`
+
+## Phase 6: Functions
+
+- [x] 044: Create MatchMis table-valued function migration script
+  - Source: `OLD/Database/Functions/MatchMis.sql`
+  - Dependencies: Item, WorkOrder, WorkOrderRouting, RouteMaster, MisData tables
+  - Location: `NEW/src/JdeScoping.Database/Scripts/044_CreateMatchMisFunction.sql`
+
+## Phase 7: Verification
+
+- [x] 045: Run full migration against clean database
+  - Validation: All 44 scripts executed in order without error
+  - Command: `dotnet run --project NEW/src/JdeScoping.Host`
+
+- [x] 046: Verify all objects exist
+  - Validation: Query sys.tables, sys.views, sys.procedures, sys.types
+  - Results: 26 tables (25 + SchemaVersions), 7 views, 7 types, 4 procedures, 1 function
+
+- [x] 047: Codex MCP review of migration scripts
+  - All scripts verified against legacy source during creation
+  - DATETIME -> DATETIME2(7) conversion applied consistently
@@ -0,0 +1,294 @@
+# Solution Foundation Design
+
+## Overview
+
+This document describes the infrastructure architecture for the .NET 10 solution, including project structure, dependency injection patterns, and configuration management.
+
+## Project Structure
+
+```
+NEW/src/
+├── JdeScoping.Core/           # Domain models, interfaces, shared logic
+│   ├── Models/                # Entity classes (Search, WorkOrder, Lot, etc.)
+│   ├── Interfaces/            # Service contracts (ISearchRepository, etc.)
+│   ├── Options/               # Configuration binding classes
+│   └── Extensions/            # Service registration extension methods
+├── JdeScoping.Host/           # ASP.NET Core host (Web API + BackgroundServices)
+│   ├── Program.cs             # Application entry point, DI configuration
+│   ├── appsettings.json       # Production configuration
+│   ├── appsettings.Development.json  # Development overrides
+│   └── Controllers/           # API endpoints
+├── JdeScoping.Client/         # Blazor WebAssembly UI
+│   └── (deferred to UI phase)
+└── JdeScoping.Database/       # DbUp migrations (already exists)
+    ├── Scripts/               # Migration SQL files
+    └── DatabaseMigrator.cs    # DbUp configuration
+```
+
+## DI Registration Pattern
+
+### Extension Method Convention
+
+Each module provides an extension method on `IServiceCollection`:
+
+```csharp
+public static class DataAccessServiceExtensions
+{
+    public static IServiceCollection AddDataAccess(
+        this IServiceCollection services,
+        IConfiguration configuration)
+    {
+        // Bind configuration
+        services.Configure<DataAccessOptions>(
+            configuration.GetSection(DataAccessOptions.SectionName));
+
+        // Register services
+        services.AddScoped<ILotFinderRepository, LotFinderRepository>();
+        services.AddScoped<IJdeRepository, JdeRepository>();
+        services.AddScoped<ICmsRepository, CmsRepository>();
+
+        return services;
+    }
+}
+```
+
+### Module Registration Order
+
+Extensions are called in dependency order in Program.cs:
+
+```csharp
+builder.Services
+    .AddDataAccess(builder.Configuration)      // 1. Database access
+    .AddDataSync(builder.Configuration)        // 2. Cache synchronization
+    .AddSearchProcessing(builder.Configuration) // 3. Search execution
+    .AddExcelExport(builder.Configuration)     // 4. Result export
+    .AddAuth(builder.Configuration);           // 5. Authentication
+```
+
+### Lifetime Guidelines
+
+| Service Type | Lifetime | Rationale |
+|--------------|----------|-----------|
+| Repository | Scoped | Database connection per request |
+| DbContext (if used) | Scoped | EF Core default |
+| Options classes | Singleton | Cached configuration |
+| HttpClient | Singleton | Connection pooling |
+| BackgroundService | Singleton | Long-running workers |
+| Processors | Transient | Stateless operations |
+
+## Configuration Sections
+
+### appsettings.json Structure
+
+```json
+{
+  "ConnectionStrings": {
+    "LotFinder": "Server=...;Database=LotFinder;...",
+    "JDE": "Data Source=...;User ID=...;Password=...",
+    "CMS": "Data Source=...;Port=...;Database=..."
+  },
+  "DataAccess": {
+    "CommandTimeoutSeconds": 120,
+    "EnableDetailedLogging": false
+  },
+  "DataSync": {
+    "MassRefreshCronSchedule": "0 0 6 * * SAT",
+    "DailyRefreshCronSchedule": "0 0 4 * * *",
+    "HourlyRefreshCronSchedule": "0 0 * * * *",
+    "MaxConcurrentUpdates": 4
+  },
+  "Auth": {
+    "LdapUrl": "LDAP://directory.company.com",
+    "LdapGroup": "CN=LotFinderUsers,OU=Groups,DC=company,DC=com",
+    "CookieExpirationMinutes": 480
+  },
+  "ExcelExport": {
+    "TempDirectory": "/tmp/lotfinder",
+    "MaxRowsPerSheet": 1048576,
+    "DefaultDateFormat": "yyyy-MM-dd HH:mm:ss"
+  },
+  "SearchProcessing": {
+    "PollingIntervalSeconds": 5,
+    "MaxConcurrentSearches": 2,
+    "SearchTimeoutMinutes": 30
+  }
+}
+```
+
+### appsettings.Development.json Overrides
+
+```json
+{
+  "ConnectionStrings": {
+    "LotFinder": "Server=localhost,1434;Database=LotFinder;User Id=scopingapp;Password=...;TrustServerCertificate=True"
+  },
+  "DataAccess": {
+    "EnableDetailedLogging": true
+  },
+  "DataSync": {
+    "MassRefreshCronSchedule": "",
+    "DailyRefreshCronSchedule": "",
+    "HourlyRefreshCronSchedule": ""
+  },
+  "Logging": {
+    "LogLevel": {
+      "Default": "Debug",
+      "Microsoft.AspNetCore": "Warning"
+    }
+  }
+}
+```
+
+## Options Classes
+
+### Naming Convention
+
+- Class name: `{Module}Options`
+- Section name: Same as class name without "Options" suffix
+- Static constant: `SectionName` for configuration binding
+
+### DataAccessOptions
+
+```csharp
+public class DataAccessOptions
+{
+    public const string SectionName = "DataAccess";
+
+    public int CommandTimeoutSeconds { get; set; } = 120;
+    public bool EnableDetailedLogging { get; set; } = false;
+}
+```
+
+### DataSyncOptions
+
+```csharp
+public class DataSyncOptions
+{
+    public const string SectionName = "DataSync";
+
+    public string MassRefreshCronSchedule { get; set; } = "0 0 6 * * SAT";
+    public string DailyRefreshCronSchedule { get; set; } = "0 0 4 * * *";
+    public string HourlyRefreshCronSchedule { get; set; } = "0 0 * * * *";
+    public int MaxConcurrentUpdates { get; set; } = 4;
+}
+```
+
+### AuthOptions
+
+```csharp
+public class AuthOptions
+{
+    public const string SectionName = "Auth";
+
+    public string LdapUrl { get; set; } = string.Empty;
+    public string LdapGroup { get; set; } = string.Empty;
+    public int CookieExpirationMinutes { get; set; } = 480;
+}
+```
+
+### ExcelExportOptions
+
+```csharp
+public class ExcelExportOptions
+{
+    public const string SectionName = "ExcelExport";
+
+    public string TempDirectory { get; set; } = "/tmp/lotfinder";
+    public int MaxRowsPerSheet { get; set; } = 1048576;
+    public string DefaultDateFormat { get; set; } = "yyyy-MM-dd HH:mm:ss";
+}
+```
+
+### SearchProcessingOptions
+
+```csharp
+public class SearchProcessingOptions
+{
+    public const string SectionName = "SearchProcessing";
+
+    public int PollingIntervalSeconds { get; set; } = 5;
+    public int MaxConcurrentSearches { get; set; } = 2;
+    public int SearchTimeoutMinutes { get; set; } = 30;
+}
+```
+
+## NuGet Package Dependencies
+
+### JdeScoping.Core
+
+```xml
+<PackageReference Include="Microsoft.Extensions.Options" Version="9.0.0" />
+<PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="9.0.0" />
+<PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="9.0.0" />
+```
+
+### JdeScoping.Host
+
+```xml
+<PackageReference Include="Microsoft.Data.SqlClient" Version="5.2.0" />
+<PackageReference Include="Dapper" Version="2.1.35" />
+<PackageReference Include="EPPlus" Version="7.0.0" />
+<PackageReference Include="DbUp-SqlServer" Version="5.0.37" />
+<PackageReference Include="Quartz" Version="3.8.0" />
+```
+
+## Program.cs Structure
+
+```csharp
+var builder = WebApplication.CreateBuilder(args);
+
+// Database migrations
+DatabaseMigrator.Migrate(builder.Configuration.GetConnectionString("LotFinder")!);
+
+// Module registration
+builder.Services
+    .AddDataAccess(builder.Configuration)
+    .AddDataSync(builder.Configuration)
+    .AddSearchProcessing(builder.Configuration)
+    .AddExcelExport(builder.Configuration)
+    .AddAuth(builder.Configuration);
+
+// ASP.NET Core services
+builder.Services.AddControllers();
+builder.Services.AddSignalR();
+
+var app = builder.Build();
+
+// Middleware pipeline
+app.UseAuthentication();
+app.UseAuthorization();
+app.MapControllers();
+app.MapHub<StatusHub>("/statushub");
+
+app.Run();
+```
+
+## Validation Approach
+
+### Startup Validation
+
+Validate critical services are registered at startup:
+
+```csharp
+// In Program.cs after building
+using var scope = app.Services.CreateScope();
+_ = scope.ServiceProvider.GetRequiredService<ILotFinderRepository>();
+_ = scope.ServiceProvider.GetRequiredService<IOptions<DataAccessOptions>>();
+// ... validate other critical services
+```
+
+### Configuration Validation
+
+Use DataAnnotations or IValidateOptions for configuration:
+
+```csharp
+public class DataAccessOptionsValidator : IValidateOptions<DataAccessOptions>
+{
+    public ValidateOptionsResult Validate(string? name, DataAccessOptions options)
+    {
+        if (options.CommandTimeoutSeconds <= 0)
+            return ValidateOptionsResult.Fail("CommandTimeoutSeconds must be positive");
+        return ValidateOptionsResult.Success;
+    }
+}
+```
@@ -0,0 +1,57 @@
+# Setup Solution Foundation
+
+## Summary
+
+Set up the .NET 10 solution infrastructure including dependency injection configuration, options pattern for configuration binding, and modular service registration extension methods. This establishes the architectural foundation for all subsequent migration phases.
+
+## Scope
+
+### In Scope
+
+- Program.cs with DI container configuration
+- appsettings.json structure with sections for each module
+- Service registration extension methods (AddDataAccess, AddDataSync, AddAuth, AddExcelExport)
+- Options classes for IOptions<T> configuration binding
+- Project references and NuGet package dependencies
+
+### Out of Scope
+
+- Actual service implementations (deferred to domain-specific phases)
+- Database connection testing (covered by migrate-database-schema)
+- Authentication implementation details (deferred to auth phase)
+- Background service scheduling (deferred to data-sync phase)
+
+## Motivation
+
+A well-structured DI configuration provides:
+- Modular, testable architecture with clear separation of concerns
+- Strongly-typed configuration binding via IOptions<T> pattern
+- Extension methods that encapsulate module-specific registration logic
+- Clear dependency graph visible in Program.cs
+
+## Acceptance Criteria
+
+1. Solution builds successfully with `dotnet build`
+2. All Options classes bind correctly from appsettings.json
+3. Extension methods register services with appropriate lifetimes:
+   - Scoped: Database services, repositories
+   - Singleton: Configuration, HTTP clients
+   - Transient: Short-lived processors
+4. Program.cs clearly shows module registration order
+5. `openspec validate setup-solution-foundation --strict` passes
+
+## Dependencies
+
+- migrate-database-schema (provides JdeScoping.Database project)
+
+## Risks
+
+| Risk | Mitigation |
+|------|------------|
+| Circular dependencies | Extension methods register only their module's services |
+| Configuration drift | Options classes map 1:1 with appsettings sections |
+| Missing services at runtime | Startup validation via GetRequiredService checks |
+
+## Related Specs
+
+- `infrastructure` - DI registration and configuration binding patterns
@@ -0,0 +1,131 @@
+# Infrastructure Specification
+
+## Purpose
+
+Define dependency injection registration patterns and configuration binding patterns for the .NET 10 solution infrastructure.
+
+## ADDED Requirements
+
+### Requirement: Service registration pattern
+
+The system SHALL use extension methods on IServiceCollection to register module-specific services.
+
+#### Inputs
+
+- IServiceCollection services
+- IConfiguration configuration
+
+#### Outputs
+
+- IServiceCollection (fluent return for chaining)
+
+#### Business Rules
+
+- Each module SHALL have one extension method (AddDataAccess, AddDataSync, AddAuth, AddExcelExport, AddSearchProcessing)
+- Extension methods SHALL bind their module's Options class from configuration
+- Extension methods SHALL register services with appropriate lifetimes:
+  - Scoped: Database connections, repositories, unit-of-work
+  - Singleton: Configuration options, HTTP clients, caching services
+  - Transient: Stateless processors, validators
+- Extension methods SHALL return IServiceCollection for fluent chaining
+
+#### Scenario: Module service registration
+
+- **WHEN** Program.cs calls builder.Services.AddDataAccess(configuration)
+- **THEN** DataAccessOptions is bound from the "DataAccess" configuration section
+- **AND** ILotFinderRepository is registered with Scoped lifetime
+- **AND** the method returns IServiceCollection for further chaining
+
+#### Scenario: Service lifetime correctness
+
+- **WHEN** a Scoped service is requested multiple times within the same HTTP request
+- **THEN** the same instance is returned each time
+- **AND** a new instance is created for the next HTTP request
+
+#### Scenario: Chained registration
+
+- **WHEN** Program.cs chains multiple extension methods
+- **THEN** all modules are registered in the order called
+- **AND** the final IServiceCollection contains all registered services
+
+### Requirement: Configuration binding pattern
+
+The system SHALL use IOptions<T> pattern to bind strongly-typed configuration from appsettings.json.
+
+#### Inputs
+
+- appsettings.json with named sections
+- Options class with matching property names
+
+#### Outputs
+
+- IOptions<T> resolved from DI with bound values
+
+#### Business Rules
+
+- Each Options class SHALL define a static SectionName constant matching the JSON section
+- Options classes SHALL use C# naming conventions (PascalCase properties)
+- Configuration sections SHALL use matching PascalCase names
+- Default values SHALL be defined in Options class properties
+- Options classes SHALL be registered using services.Configure<T>(section)
+
+#### Scenario: Configuration binding at startup
+
+- **WHEN** the application starts with valid appsettings.json
+- **THEN** IOptions<DataAccessOptions> resolves with values from the DataAccess section
+- **AND** properties not specified in JSON use their default values
+
+#### Scenario: Missing configuration section
+
+- **WHEN** the application starts without a required configuration section
+- **THEN** IOptions<T> resolves with all default property values
+- **AND** no exception is thrown at startup
+
+#### Scenario: Development override
+
+- **WHEN** the application runs in Development environment
+- **THEN** appsettings.Development.json values override appsettings.json values
+- **AND** IOptions<DataAccessOptions>.Value.EnableDetailedLogging is true
+
+### Requirement: Extension method organization
+
+The system SHALL organize extension methods in the JdeScoping.Core project under an Extensions namespace.
+
+#### Business Rules
+
+- Extension methods SHALL be in namespace JdeScoping.Core.Extensions
+- Each module SHALL have a dedicated static class: {Module}ServiceExtensions
+- Extension method SHALL be named Add{Module}
+- Files SHALL be located at: JdeScoping.Core/Extensions/{Module}ServiceExtensions.cs
+
+#### Scenario: Extension method discovery
+
+- **WHEN** a developer adds using JdeScoping.Core.Extensions
+- **THEN** all AddXxx extension methods are available on IServiceCollection
+- **AND** IntelliSense shows method documentation
+
+### Requirement: Options class organization
+
+The system SHALL organize Options classes in the JdeScoping.Core project under an Options namespace.
+
+#### Business Rules
+
+- Options classes SHALL be in namespace JdeScoping.Core.Options
+- Class names SHALL follow pattern: {Module}Options
+- SectionName constant SHALL match the JSON section name exactly
+- Files SHALL be located at: JdeScoping.Core/Options/{Module}Options.cs
+
+#### Scenario: Options class consistency
+
+- **WHEN** DataAccessOptions is defined with SectionName = "DataAccess"
+- **THEN** configuration.GetSection("DataAccess") returns the matching section
+- **AND** services.Configure<DataAccessOptions>(section) binds all properties
+
+## Migration Notes
+
+| Legacy Pattern | New Pattern | Rationale |
+|----------------|-------------|-----------|
+| Static Config class | IOptions<T> injection | Testable, supports hot reload |
+| Hardcoded values | appsettings.json | Environment-specific configuration |
+| Constructor instantiation | DI container registration | Loose coupling, lifetime management |
+| Web.config | appsettings.json + environment files | .NET Core standard |
@@ -0,0 +1,113 @@
+# Tasks: Setup Solution Foundation
+
+## Phase 1: Options Classes
+
+- [x] Create DataAccessOptions class
+  - Location: `NEW/src/JdeScoping.Core/Options/DataAccessOptions.cs`
+  - Properties: CommandTimeoutSeconds, EnableDetailedLogging
+  - Validation: Verify binds from appsettings.json
+
+- [x] Create DataSyncOptions class
+  - Location: `NEW/src/JdeScoping.Core/Options/DataSyncOptions.cs`
+  - Properties: MassRefreshCronSchedule, DailyRefreshCronSchedule, HourlyRefreshCronSchedule, MaxConcurrentUpdates
+  - Validation: Verify binds from appsettings.json
+
+- [x] Create AuthOptions class
+  - Location: `NEW/src/JdeScoping.Core/Options/AuthOptions.cs`
+  - Properties: LdapUrl, LdapGroup, CookieExpirationMinutes
+  - Validation: Verify binds from appsettings.json
+
+- [x] Create ExcelExportOptions class
+  - Location: `NEW/src/JdeScoping.Core/Options/ExcelExportOptions.cs`
+  - Properties: TempDirectory, MaxRowsPerSheet, DefaultDateFormat
+  - Validation: Verify binds from appsettings.json
+
+- [x] Create SearchProcessingOptions class
+  - Location: `NEW/src/JdeScoping.Core/Options/SearchProcessingOptions.cs`
+  - Properties: PollingIntervalSeconds, MaxConcurrentSearches, SearchTimeoutMinutes
+  - Validation: Verify binds from appsettings.json
+
+## Phase 2: Extension Methods
+
+- [x] Create DataAccessServiceExtensions class
+  - Location: `NEW/src/JdeScoping.Core/Extensions/DataAccessServiceExtensions.cs`
+  - Method: AddDataAccess(IServiceCollection, IConfiguration)
+  - Registers: DataAccessOptions, placeholder ILotFinderRepository
+  - Validation: Services resolve without error
+
+- [x] Create DataSyncServiceExtensions class
+  - Location: `NEW/src/JdeScoping.Core/Extensions/DataSyncServiceExtensions.cs`
+  - Method: AddDataSync(IServiceCollection, IConfiguration)
+  - Registers: DataSyncOptions, placeholder IUpdateProcessor
+  - Validation: Services resolve without error
+
+- [x] Create AuthServiceExtensions class
+  - Location: `NEW/src/JdeScoping.Core/Extensions/AuthServiceExtensions.cs`
+  - Method: AddAuth(IServiceCollection, IConfiguration)
+  - Registers: AuthOptions, authentication services
+  - Validation: Services resolve without error
+
+- [x] Create ExcelExportServiceExtensions class
+  - Location: `NEW/src/JdeScoping.Core/Extensions/ExcelExportServiceExtensions.cs`
+  - Method: AddExcelExport(IServiceCollection, IConfiguration)
+  - Registers: ExcelExportOptions, placeholder IExcelWriter
+  - Validation: Services resolve without error
+
+- [x] Create SearchProcessingServiceExtensions class
+  - Location: `NEW/src/JdeScoping.Core/Extensions/SearchProcessingServiceExtensions.cs`
+  - Method: AddSearchProcessing(IServiceCollection, IConfiguration)
+  - Registers: SearchProcessingOptions, placeholder ISearchProcessor
+  - Validation: Services resolve without error
+
+## Phase 3: Configuration Files
+
+- [x] Update appsettings.json with all configuration sections
+  - Location: `NEW/src/JdeScoping.Host/appsettings.json`
+  - Sections: ConnectionStrings, DataAccess, DataSync, Auth, ExcelExport, SearchProcessing
+  - Validation: JSON parses without error
+
+- [x] Create appsettings.Development.json with dev overrides
+  - Location: `NEW/src/JdeScoping.Host/appsettings.Development.json`
+  - Overrides: Local SQL Server connection, detailed logging, disabled sync schedules
+  - Validation: JSON parses without error
+
+## Phase 4: Program.cs Update
+
+- [x] Update Program.cs with service registration
+  - Location: `NEW/src/JdeScoping.Host/Program.cs`
+  - Call all AddXxx extension methods
+  - Add database migration at startup
+  - Validation: Application starts without DI errors
+
+- [x] Add startup validation for critical services
+  - Location: `NEW/src/JdeScoping.Host/Program.cs`
+  - Validate: GetRequiredService for IOptions<T> classes
+  - Validation: Startup fails fast on misconfiguration
+
+## Phase 5: Project References
+
+- [x] Add NuGet packages to JdeScoping.Core
+  - Packages: Microsoft.Extensions.Options, Microsoft.Extensions.DependencyInjection.Abstractions, Microsoft.Extensions.Configuration.Abstractions, Microsoft.Extensions.Configuration.Binder, Microsoft.Extensions.Options.ConfigurationExtensions
+  - Validation: `dotnet build` succeeds
+
+- [x] Add NuGet packages to JdeScoping.Host
+  - Packages: Microsoft.Data.SqlClient, Dapper, EPPlus, DbUp-SqlServer, Quartz (or similar scheduler)
+  - Validation: `dotnet build` succeeds
+
+- [x] Add project reference from Host to Core
+  - Reference: JdeScoping.Host references JdeScoping.Core
+  - Validation: `dotnet build` succeeds
+
+## Phase 6: Verification
+
+- [x] Run full solution build
+  - Command: `dotnet build NEW/JdeScoping.sln`
+  - Validation: Build succeeds with no errors
+
+- [x] Verify configuration binding
+  - Test: Startup resolves IOptions<DataAccessOptions> etc.
+  - Validation: All options have expected default values
+
+- [x] Run openspec validation
+  - Command: `openspec validate setup-solution-foundation --strict`
+  - Validation: No errors reported
@@ -0,0 +1,295 @@
+# Unanswered Questions
+
+This file collects questions that cannot be answered with best practices alone and require user decision.
+
+---
+
+## Best Practice Decisions (Already Applied)
+
+These common questions have been pre-answered with best practices:
+
+| Question | Decision | Rationale |
+|----------|----------|-----------|
+| Async vs sync methods | Async-first with CancellationToken | Modern .NET pattern, better scalability |
+| Exception handling | Custom typed exceptions per layer | Clear error propagation, testability |
+| Configuration | IOptions<T> pattern | Type-safe, hot-reload support |
+| Logging | ILogger<T> with structured logging | Framework integration, filtering |
+| Testing | xUnit + Shouldly + NSubstitute | Project constraints (no FluentAssertions) |
+| DI lifetime | Scoped for DB, Singleton for config | Standard patterns |
+| Nullable refs | Enable project-wide | Modern C# safety |
+| Oracle driver | Oracle.ManagedDataAccess.Core | Single driver for JDE and CMS |
+| Excel library | ClosedXML (MIT) | Free, replaces EPPlus |
+| Date types | DATETIME2(7) | Better precision |
+
+---
+
+## Phase-Specific Questions
+
+Questions below require user input before implementation.
+
+---
+
+### Phase 2: setup-solution-foundation
+
+**Q2.1: Cron schedule disable pattern**
+- Context: Design uses empty cron strings to disable schedules in Development
+- Options: (a) Empty string = disabled, (b) Add `Enabled` flag, (c) Use `string?` with null = disabled
+- Recommendation: Use `Enabled` flag for clarity
+- Impact: DataSyncOptions, schedule evaluation logic
+
+**Q2.2: Temp directory portability**
+- Context: ExcelExportOptions defaults to `/tmp/lotfinder` which is Linux-only
+- Options: (a) Use `Path.GetTempPath()`, (b) Make required config, (c) Platform-detect at runtime
+- Recommendation: `Path.Combine(Path.GetTempPath(), "lotfinder")` as default
+- Impact: Excel export temp file handling
+
+---
+
+### Phase 3: implement-domain-models
+
+**Q3.1: Requirement count discrepancy**
+- Context: Tasks claim 52 requirements but base spec has 34 sections
+- Options: (a) Count includes delta spec additions, (b) Update to correct count
+- Recommendation: Update to accurate count from base spec
+- Impact: Acceptance criteria verification
+
+**Q3.2: Namespace convention**
+- Context: Base spec references `ScopingTool.Domain.Models`, tasks use `JdeScoping.Core/Models`
+- Options: (a) Use JdeScoping.Core (matches solution), (b) Use ScopingTool.Domain (matches spec)
+- Recommendation: Use `JdeScoping.Core.Models` (matches existing solution structure)
+- Impact: All entity file locations, using statements
+
+---
+
+### Phase 4: implement-data-access
+
+**Q4.1: Repository method counts**
+- Context: Tasks list wrong method counts (17/18) vs spec (23/22)
+- Options: Update task counts to match spec
+- Recommendation: Fix counts during implementation
+- Impact: Task list accuracy
+
+---
+
+### Phase 5: implement-data-sync
+
+**Q5.1: JDE/CMS fetcher deferral**
+- Context: Proposal defers real JDE/CMS connectivity and CMS circuit breaker
+- Options: (a) Implement real fetchers now, (b) Use mock fetchers initially, (c) Implement core service with stub fetchers
+- Recommendation: Implement core service pattern with interface abstraction, defer real Oracle/Sybase connectivity
+- Impact: Testing approach, deployment timeline
+
+---
+
+### Phase 6: implement-search-processing
+
+**Q6.1: Stored Procedure for Downstream Traversal**
+- Context: Legacy system generates WHILE loop inline in T4 template for downstream work order traversal (up to 20 iterations). Base spec suggests stored procedure.
+- Options: (a) Create new stored procedure `dbo.TraverseWorkOrders`, (b) Keep inline WHILE loop in SqlKata-generated SQL, (c) Use C# iterative approach with multiple queries
+- Recommendation: Option (a) - stored procedure reduces network round trips and maintains transaction consistency
+- Impact: Requires adding stored procedure to Phase 1 (migrate-database-schema) if not already present
+
+**Q6.2: MIS Extraction Query Strategy**
+- Context: MIS data extraction queries do NOT join `#Temp_WO` per Codex review findings. MIS extraction is somewhat independent of main search.
+- Options: (a) Keep MIS extraction as separate SqlKata queries, (b) Create dedicated stored procedure for MIS extraction, (c) Separate MIS extraction into its own service
+- Recommendation: Option (a) - separate SqlKata queries via `MisQueryBuilder` class
+- Impact: Affects `ISearchQueryBuilder` interface design
+
+**Q6.3: Filter Entry Location**
+- Context: Legacy filter entry classes are in `OLD/WorkerService/Models/Reporting/`. Design places them in `JdeScoping.SearchProcessing/Models/FilterEntries/`.
+- Options: (a) Place in SearchProcessing project, (b) Place in Domain Models project, (c) Create separate JdeScoping.Shared project
+- Recommendation: Option (a) - filter entries are specific to search processing
+- Impact: Project references and potential code duplication
+
+**Q6.4: Streaming vs Materialization Default**
+- Context: Design supports both `IAsyncEnumerable<SearchResult>` streaming and `Task<SearchModel>` materialization.
+- Options: (a) Primary API returns streaming, caller materializes, (b) Primary API returns materialized, streaming is secondary, (c) Two equal methods, caller chooses
+- Recommendation: Option (c) - provide both `ExecuteSearchAsync` (streaming) and `ExecuteSearchToModelAsync` (materialized)
+- Impact: Excel export needs materialized; real-time progress benefits from streaming
+
+---
+
+### Phase 7: implement-excel-export
+
+**Q7.1: Test Data Source**
+- Context: Integration tests need sample search results to generate Excel files
+- Options: (a) Create mock data factories in test project, (b) Use shared test data from Phase 3, (c) Load sample data from JSON fixtures
+- Recommendation: Option (a) - mock data factories reusable across test projects
+- Impact: Test project structure and data sharing
+
+**Q7.2: Debug File Output Location**
+- Context: Legacy code wrote debug Excel files to disk for troubleshooting. Design includes `DebugWriteToFile` option.
+- Options: (a) Keep debug file feature but default to disabled, (b) Remove debug file feature, (c) Replace with structured logging
+- Recommendation: Option (a) - keep for backward compatibility, disabled by default
+- Impact: Configuration schema and troubleshooting capabilities
+
+**Q7.3: Empty Results Handling**
+- Context: What should happen when SearchResults is empty (not null)?
+- Options: (a) Generate sheet with headers only, (b) Generate sheet with "No results found" message, (c) Skip results sheet entirely
+- Recommendation: Option (a) - generate sheet with headers only (matches legacy behavior)
+- Impact: Sheet generation logic and user expectations
+
+**Q7.4: Large Export Memory Threshold**
+- Context: Design notes large exports (>100K rows) may need streaming approach
+- Options: (a) Implement now with configurable threshold, (b) Defer to future phase if memory issues arise, (c) Add memory monitoring without streaming
+- Recommendation: Option (b) - defer to future phase; current in-memory approach handles typical workloads
+- Impact: Scope of Phase 7 and future optimization work
+
+---
+
+## Codex MCP Review Findings (Phase 6-7)
+
+### Phase 6 Codex Findings
+
+**F6.1: Work order traversal design conflict** (HIGH)
+- Finding: Base spec fixes 20 iterations with seed-list API, but change spec makes it configurable (`MaxTraversalIterations`) with `TraverseDownstreamAsync`
+- Action: Choose authoritative model and update spec/tasks
+- Recommendation: Keep configurable approach (more flexible), update base spec to align
+
+**F6.2: SqlKata parameter naming** (HIGH)
+- Finding: Delta spec requires `@p_*` named parameters and singleton compiler, but design uses `new SqlServerCompiler()` which defaults to `@p0` style
+- Action: Add parameter naming requirements to tasks, use singleton compiler pattern
+
+**F6.3: MIS behavior requirements missing from tasks** (MEDIUM)
+- Finding: MIS rules (always include non-match results when ExtractMisData=true, min-only/max-only timespan handling) not explicit in tasks
+- Action: Add explicit task items for MIS behavior requirements
+
+**F6.4: Filter handler priority order** (LOW)
+- Finding: Tasks don't require setting/validating priority order per spec delta
+- Action: Add explicit priority ordering requirements to filter handler tasks
+
+### Phase 7 Codex Findings
+
+**F7.1: Sheet protection inconsistency** (HIGH)
+- Finding: Tasks call for protecting data sheets, spec says Search Results is unprotected, missing allowlist + unlocked 1000x1000 extension area
+- Action: Reconcile protection behavior between spec/design/tasks
+- Recommendation: Follow spec (Search Results unprotected), add allowlist + unlock range for other sheets
+
+**F7.2: ShowHeader handling missing** (HIGH)
+- Finding: Attribute-driven tables omit `ShowHeader` handling for merged section header rows (needed for criteria filter tables)
+- Action: Add ShowHeader support to AttributeTableWriter
+
+**F7.3: Project dependency name** (MEDIUM)
+- Finding: Tasks reference `JdeScoping.Domain` but NEW/src only has `JdeScoping.Core`
+- Action: Update dependency target to correct project name
+
+**F7.4: Multi-sheet rules incomplete** (MEDIUM)
+- Finding: No explicit requirements for sheet order, totals row disabled, empty-but-not-null MIS results
+- Action: Add explicit tasks/tests for multi-sheet behavior
+
+---
+
+### Phase 8: implement-web-api
+
+**Q8.1: LDAP Connection Pooling**
+- Context: Current design creates and disposes LdapConnection for each authentication attempt
+- Options: (a) Keep simple connection-per-request, (b) Implement connection pooling
+- Recommendation: Option (a) - connection-per-request for simplicity, authentication is infrequent
+- Impact: Performance for high-volume login scenarios
+
+**Q8.2: SignalR Authentication Requirement**
+- Context: Legacy StatusHub does not require authentication for connections
+- Options: (a) Keep hub open to all connections, (b) Require authentication for hub connections
+- Recommendation: Option (a) - keep open, status updates are not user-specific and user base is internal
+- Impact: Security posture for SignalR connections
+
+**Q8.3: Admin Bypass Configuration**
+- Context: Legacy code has hardcoded username bypass for group check ("dohertj2")
+- Options: (a) Remove entirely, (b) Make configurable via AuthOptions.AdminBypassUsers array
+- Recommendation: Option (b) - make configurable for dev flexibility without hardcoding
+- Impact: Developer experience during testing
+
+**Q8.4: File Upload Size Limits**
+- Context: Legacy has no explicit file size limits for Excel uploads
+- Options: (a) No limits, (b) Configure reasonable limit (e.g., 10MB)
+- Recommendation: Option (b) - configure 10MB limit to prevent abuse
+- Impact: User experience for bulk data uploads
+
+**Q8.5: CORS Configuration for Blazor WASM**
+- Context: If Blazor client is served from a different origin than API
+- Options: (a) Same-origin only, (b) Configure CORS for Blazor origin
+- Recommendation: Depends on deployment - same-origin if single host, CORS with explicit origins if separate
+- Impact: Blazor WASM deployment architecture
+
+---
+
+### Phase 9: implement-blazor-ui
+
+**Q9.1: Mock Services Strategy**
+- Context: Phase 8 (API) is not yet implemented. UI needs data to function.
+- Options: (a) Create mock services that return static/test data, (b) Create mock API endpoints in JdeScoping.Host, (c) Wait for Phase 8 before implementing UI
+- Recommendation: Option (a) - mock services allow parallel development
+- Impact: API client services can use mock implementations initially
+
+**Q9.2: Test Strategy for Blazor Components**
+- Context: bUnit is standard for Blazor component testing but adds complexity
+- Options: (a) Add bUnit tests as part of this phase, (b) Defer component testing to separate phase, (c) Manual testing only
+- Recommendation: Option (b) - focus on functional implementation first
+- Impact: No test tasks included in current tasks.md
+
+**Q9.3: Navigation Menu Visibility**
+- Context: Base spec shows minimal header with just title and user menu
+- Options: (a) Add navigation links to header, (b) Keep minimal header as specified, (c) Add collapsible sidebar navigation
+- Recommendation: Option (a) - header navigation for quick access
+- Impact: MainLayout.razor design
+
+---
+
+## Codex MCP Review Findings (Phase 8-9)
+
+### Phase 8 Codex Findings
+
+**F8.1: NEW/src diverges from spec/plan** (HIGH)
+- Finding: Current auth API shape and LDAP behavior don't match spec (no `GetUserInfoAsync`, no multi-server/group checks), `/hubs/status` not mapped
+- Action: Align implementation plan with actual repo layout, add hub mapping
+
+**F8.2: SPA behaviors not in tasks** (HIGH)
+- Finding: CORS with credentials, JSON error responses, SignalR reconnection support are required but not planned
+- Action: Add explicit tasks for CORS, API error JSON behavior, SignalR reconnection
+
+**F8.3: LDAP scenarios incomplete** (MEDIUM)
+- Finding: Legacy has hardcoded group-bypass user, design adds `AdminBypassUsers` but doesn't use it, `GetUserInfoAsync` throws NotSupported
+- Action: Decide on admin bypass path, clarify GetUserInfoAsync behavior
+
+**F8.4: Project structure issues** (MEDIUM)
+- Finding: Tasks reference `JdeScoping.Domain` but only `JdeScoping.Core` exists; SearchController scheduled before StatusHub
+- Action: Align to actual project structure (use JdeScoping.Core), reorder dependencies
+
+**F8.5: SearchUpdate missing fields** (LOW)
+- Finding: Design omits `SubmitDT/StartDT/EndDT` fields that exist in spec/legacy model
+- Action: Add missing timestamp fields to SearchUpdate DTO
+
+### Phase 9 Codex Findings
+
+**F9.1: Route conflict** (HIGH)
+- Finding: `Home.razor` owns `/`, but tasks add `/` to `Searches.razor` without removal/rename
+- Action: Remove template pages (Home.razor, Counter.razor, Weather.razor) before adding Searches
+
+**F9.2: JWT auth requirements incomplete** (HIGH)
+- Finding: Token attachment and 401 re-auth redirect required but not captured in auth tasks
+- Action: Add tasks for auth header injection and 401 redirect handling
+
+**F9.3: SearchStatus enum mismatch** (HIGH)
+- Finding: Spec uses New/Submitted/Started/Ended/Error but JdeScoping.Core uses Queued/Processing/Completed/Failed
+- Action: Decide on enum alignment - either map or standardize
+
+**F9.4: SearchEdit behaviors missing** (HIGH)
+- Finding: Search-type detection, submit confirmation, download results, Extract MIS checkbox required but not in tasks
+- Action: Expand SearchEdit tasks with spec behaviors
+
+**F9.5: SignalR reconnection requirements partial** (MEDIUM)
+- Finding: Backoff schedule + UI connection state + reconnect logging required but tasks only say "auto-reconnect"
+- Action: Add explicit tasks for reconnection UI and logging
+
+**F9.6: Clear Data confirmation missing** (MEDIUM)
+- Finding: Clear Data confirmations required per spec but filter panel tasks say "Clear empties grid" with no confirmation
+- Action: Add confirmation dialog to Clear Data functionality
+
+**F9.7: Template pages cleanup** (LOW)
+- Finding: Blazor template pages (Home, Counter, Weather, NavMenu) should be removed
+- Action: Add task to remove template pages as part of UI change set
+
+**F9.8: NuGet version mismatch** (LOW)
+- Finding: Base spec calls for Radzen 5.*/SignalR 9.* but design uses Radzen 8.4.2/SignalR 10.0.1
+- Action: Update spec to reflect actual .NET 10 versions
+
@@ -0,0 +1,63 @@
+# JDE Scoping Tool Migration
+
+## Overview
+
+Migration of legacy .NET Framework 4.8 "LotFinder" application to .NET 10.
+
+## Source
+
+- **Legacy Code**: `OLD/` - .NET Framework 4.8 (read-only reference)
+- **New Code**: `NEW/` - .NET 10 solution (build target)
+
+## System Purpose
+
+A manufacturing/ERP search tool that:
+- Caches data from JDE (Oracle) and CMS (Sybase) into SQL Server
+- Allows complex searches across work orders, lots, items, operators, and work centers
+- Processes searches asynchronously and exports results to Excel
+- Provides real-time status updates via SignalR
+
+## Migration Goals
+
+- Single .NET 10 service (combines web app + worker service)
+- Blazor WebAssembly UI with Radzen components (replaces ASP.NET MVC + Kendo)
+- Modern ASP.NET Core SignalR
+- Interface-based authentication (LDAP in prod, fake auth in dev)
+- Interface-based data sources (Oracle in prod, file-based in dev)
+- DbUp for database schema management
+
+## Constraints
+
+- Preserve existing query logic and data models
+- Maintain compatibility with JDE/CMS/SQL Server data sources
+- Keep search criteria and Excel export formats consistent
+- No FluentAssertions (paid) - use Shouldly for tests
+
+## Spec Organization
+
+Specifications are organized by functional area:
+
+| Spec | Purpose | Legacy Source |
+|------|---------|---------------|
+| domain-models | Entity definitions | DataModel/Models/*.cs |
+| database-schema | SQL Server tables for DbUp | Database/*.sql |
+| data-access | JDE/CMS/SQL repositories | DataModel/Process/*.cs |
+| data-sync | Cache refresh scheduling | WorkerService/Process/UpdateProcessor*.cs |
+| search-processing | Criteria and query building | WorkerService/Models/Reporting/*.cs |
+| excel-export | Result formatting | WorkerService/Process/ExcelWriter.cs |
+| web-api-auth | API endpoints and authentication | WebInterface/Controllers/*.cs |
+
+## Execution Plan
+
+See `PLANS/legacy-spec-capture-plan.md` for:
+- Session-by-session workflow
+- Detailed checklists per spec
+- Codex MCP review process
+
+## Architecture Reference
+
+See `DOCUMENTATION/Architecture/` for:
+- Solution structure
+- Component dependencies
+- Interface patterns (data sources, authentication)
+- Database migration approach (DbUp)
@@ -0,0 +1,858 @@
+# Data Sync Specification
+
+## Purpose
+
+The Data Sync subsystem maintains a local SQL Server cache of enterprise data from JDE (JD Edwards - Oracle) and CMS (Sybase) source systems. Implemented as a .NET 10 `BackgroundService`, it enables fast search operations by synchronizing data on configurable schedules (mass/daily/hourly) and uses incremental updates with MERGE operations to minimize data transfer while keeping the cache current. The service integrates with the ASP.NET Core hosting model, supporting graceful shutdown, health checks, and telemetry.
+
+## Source Reference
+
+| Legacy Files | Purpose |
+|--------------|---------|
+| `OLD/WorkerService/Process/UpdateProcessor.cs` | Main sync orchestration, schedule checking, update execution |
+| `OLD/WorkerService/Process/UpdateProcessor.TableManagement.cs` | Staging table creation, MERGE generation, bulk copy, index management |
+| `OLD/WorkerService/Process/UpdateProcessor.DataUpdateEntry.cs` | Update logging, history tracking, cleanup |
+| `OLD/WorkerService/dsconfig/*.json` | Per-table sync configuration files |
+| `OLD/WorkerService/Models/DataSourceConfig.cs` | Configuration model with fetch functions |
+| `OLD/WorkerService/Models/DataUpdateConfig.cs` | Schedule configuration (interval, prepurge, reindex) |
+| `OLD/WorkerService/Process/WorkProcessor.cs` | Work loop that triggers sync checks |
+| `OLD/Database/Views/LastDataUpdates.sql` | View for determining last successful sync per table/type |
+## Requirements
+### Requirement: Background Service Lifecycle
+
+The system SHALL implement data synchronization as a .NET `BackgroundService` with proper lifecycle management.
+
+#### Inputs
+
+- `CancellationToken` from the host for graceful shutdown signals
+- `IServiceScopeFactory` for creating scoped services per sync operation
+- `IOptions<DataSyncOptions>` for configuration
+
+#### Outputs
+
+- Long-running background task that processes sync schedules
+- Graceful shutdown with in-progress operation completion or cancellation
+
+#### Business Rules
+
+- The service MUST inherit from `BackgroundService` and implement `ExecuteAsync`
+- The service SHALL respect `CancellationToken` for graceful shutdown
+- Each sync operation MUST create a new `IServiceScope` via `IServiceScopeFactory`
+- At startup, the service MUST call `CloseOpenUpdateEntries()` to mark interrupted syncs as failed
+- The service SHALL call `PurgeUpdateEntries()` periodically to clean old history records
+- The main loop SHALL use `Task.Delay` with the cancellation token between sync checks
+
+#### Scenario: Service startup initialization
+
+- **WHEN** the BackgroundService starts
+- **THEN** the system SHALL invoke `CloseOpenUpdateEntries()` to mark any `DataUpdate` records with `NumberRecords = -2` as failed
+- **THEN** the system SHALL begin the main sync check loop
+
+#### Scenario: Graceful shutdown during sync
+
+- **WHEN** the host signals shutdown via `CancellationToken`
+- **AND** a sync operation is in progress
+- **THEN** the cancellation token SHALL propagate to all child operations
+- **THEN** the service SHALL wait for current batch completion or cancel gracefully
+- **THEN** any incomplete syncs SHALL be marked as failed with `WasSuccessful = false`
+
+#### Scenario: Scoped service creation per sync
+
+- **WHEN** a sync operation begins
+- **THEN** the system SHALL create a new `IServiceScope`
+- **THEN** all services for that sync operation SHALL be resolved from the scope
+- **THEN** the scope SHALL be disposed after the sync completes or fails
+
+### Requirement: Strongly-Typed Configuration
+
+The system SHALL use strongly-typed options classes bound from configuration instead of JSON file parsing with reflection.
+
+#### Inputs
+
+- `IOptions<DataSyncOptions>` injected via dependency injection
+- Configuration bound from `appsettings.json` or environment variables
+
+#### Outputs
+
+- `DataSyncOptions` containing global sync settings
+- `DataSourceOptions` containing per-table configuration
+- Type-resolved `IDataFetcher<T>` implementations
+
+#### Business Rules
+
+- Configuration SHALL use `IOptions<DataSyncOptions>` pattern instead of JSON file loading
+- `DataSyncOptions` SHALL define: `MaxDegreeOfParallelism`, `BatchSize`, `BulkCopyBatchSize`, `LookbackMultiplier`, `PurgeRetentionDays`
+- `DataSourceOptions` SHALL define: `SourceSystem`, `TableName`, `IsEnabled`, `MassConfig`, `DailyConfig`, `HourlyConfig`, `FetcherTypeName`, `PostProcessorTypeName`
+- Each schedule config (`MassConfig`, `DailyConfig`, `HourlyConfig`) SHALL include an `Enabled` boolean flag for explicit schedule enable/disable control
+- The `FetcherTypeName` SHALL be resolved to an `IDataFetcher<T>` implementation at startup
+- The `PostProcessorTypeName` SHALL be resolved to an `IPostProcessor` implementation at startup
+- Invalid or unresolvable type names SHALL cause startup failure with descriptive error
+
+#### Scenario: Configuration binding at startup
+
+- **WHEN** the application starts
+- **THEN** `DataSyncOptions` SHALL be bound from the `DataSync` configuration section
+- **THEN** each `DataSourceOptions` entry SHALL be validated for required fields
+- **THEN** `FetcherTypeName` values SHALL be resolved to registered `IDataFetcher<T>` services
+
+#### Scenario: Invalid fetcher type configuration
+
+- **WHEN** a `DataSourceOptions.FetcherTypeName` cannot be resolved to a registered service
+- **THEN** the system SHALL throw a descriptive exception at startup
+- **THEN** the error message SHALL include the invalid type name and table name
+
+### Requirement: Data Fetcher Abstraction
+
+The system SHALL use `IDataFetcher<TEntity>` interfaces instead of reflection-based delegates for data retrieval.
+
+#### Inputs
+
+- `DateTime? minimumDT` parameter for incremental fetches
+- `CancellationToken` for cancellation support
+- Source system connection (JDE Oracle or CMS Sybase)
+
+#### Outputs
+
+- `IAsyncEnumerable<TEntity>` streaming data from source systems
+- Support for cancellation during long-running fetches
+
+#### Business Rules
+
+- Each data source MUST have a corresponding `IDataFetcher<TEntity>` implementation
+- The `FetchAsync` method SHALL return `IAsyncEnumerable<TEntity>` for memory-efficient streaming
+- All fetch operations MUST accept and respect `CancellationToken`
+- JDE fetchers SHALL use `Oracle.ManagedDataAccess.Core` connections
+- CMS fetchers SHALL use `Oracle.ManagedDataAccess.Core` connections (CMS uses Oracle via legacy DDTek driver, consolidated in migration)
+- Initial implementation MAY use stub fetchers that return empty `IAsyncEnumerable<T>` streams while JDE/CMS connectivity is deferred
+- Stub fetchers SHALL implement `IDataFetcher<T>` interface with `yield break` to enable testing without external dependencies
+
+#### Scenario: Streaming data fetch
+
+- **WHEN** a sync operation requests data from a source system
+- **THEN** the system SHALL call `IDataFetcher<T>.FetchAsync(minimumDT, cancellationToken)`
+- **THEN** data SHALL stream via `IAsyncEnumerable<T>` without loading all records into memory
+- **THEN** cancellation SHALL stop the enumeration gracefully
+
+#### Scenario: Cancellation during fetch
+
+- **WHEN** the cancellation token is triggered during a fetch operation
+- **THEN** the async enumerable SHALL stop yielding records
+- **THEN** database resources SHALL be properly disposed
+- **THEN** the sync operation SHALL be marked as failed
+
+### Requirement: Health Checks
+
+The system SHALL expose health check endpoints for monitoring sync status.
+
+#### Inputs
+
+- `IHealthCheck` registration with ASP.NET Core health checks
+- Current sync state and last successful sync timestamps
+
+#### Outputs
+
+- Health status: Healthy, Degraded, or Unhealthy
+- Diagnostic data including last sync times and any error messages
+
+#### Business Rules
+
+- The health check SHALL report `Healthy` when all enabled tables have synced within their configured intervals
+- The health check SHALL report `Degraded` when any table is overdue but syncs are progressing
+- The health check SHALL report `Unhealthy` when syncs have been failing repeatedly or the service is not running
+- Health check response SHALL include per-table sync status and timestamps
+
+#### Scenario: All syncs current
+
+- **WHEN** health check executes
+- **AND** all enabled tables have successful syncs within their intervals
+- **THEN** the check SHALL return `Healthy` status
+- **THEN** response SHALL include last sync timestamps per table
+
+#### Scenario: Overdue syncs with progress
+
+- **WHEN** health check executes
+- **AND** some tables are overdue for sync
+- **AND** sync operations are currently running or recently completed
+- **THEN** the check SHALL return `Degraded` status
+- **THEN** response SHALL identify which tables are overdue
+
+#### Scenario: Repeated failures
+
+- **WHEN** health check executes
+- **AND** multiple recent sync operations have failed
+- **THEN** the check SHALL return `Unhealthy` status
+- **THEN** response SHALL include error details from failed syncs
+
+### Requirement: Telemetry and Metrics
+
+The system SHALL emit metrics and traces for observability.
+
+#### Inputs
+
+- `System.Diagnostics.Metrics` meter for metrics
+- `System.Diagnostics.ActivitySource` for distributed tracing
+
+#### Outputs
+
+- Counters: sync operations started, completed, failed
+- Histograms: sync duration, records processed
+- Activity spans for distributed tracing
+
+#### Business Rules
+
+- The service SHALL create a `Meter` named `DataSync`
+- The service SHALL emit counters for: `sync.operations.started`, `sync.operations.completed`, `sync.operations.failed`
+- The service SHALL emit histograms for: `sync.duration.seconds`, `sync.records.processed`
+- Each sync operation SHALL create an `Activity` span with tags for table name, update type, and source system
+- Activity spans SHALL include record count and duration on completion
+
+#### Scenario: Sync operation telemetry
+
+- **WHEN** a sync operation starts
+- **THEN** the system SHALL increment `sync.operations.started` counter
+- **THEN** the system SHALL start an `Activity` span with table and type tags
+
+- **WHEN** a sync operation completes successfully
+- **THEN** the system SHALL increment `sync.operations.completed` counter
+- **THEN** the system SHALL record duration in `sync.duration.seconds` histogram
+- **THEN** the system SHALL record count in `sync.records.processed` histogram
+- **THEN** the Activity span SHALL be completed with success status
+
+- **WHEN** a sync operation fails
+- **THEN** the system SHALL increment `sync.operations.failed` counter
+- **THEN** the Activity span SHALL be completed with error status and exception details
+
+### Requirement: Schedule-Based Sync Triggering
+
+The system SHALL support three distinct sync schedule types: Mass, Daily, and Hourly, each with independent intervals and behaviors per table.
+
+#### Inputs
+
+- Data source configuration via `IOptions<DataSyncOptions>`
+- `LastDataUpdates` view providing timestamps of last successful syncs
+- Current system time
+
+#### Outputs
+
+- List of pending `DataUpdateTask` objects requiring execution
+- Each task specifies: target table, update type, and minimum timestamp for incremental fetches
+
+#### Business Rules
+
+- Mass updates SHALL trigger when no prior successful mass update exists OR when the configured mass interval has elapsed since the last mass update
+- Daily updates SHALL trigger when mass is current AND daily interval has elapsed since last daily update
+- Hourly updates SHALL trigger when mass and daily are current AND hourly interval has elapsed since last hourly update
+- Schedule priority SHALL be: Mass > Daily > Hourly (mass takes precedence)
+- Incremental updates (Daily/Hourly) SHALL use a configurable lookback window (default 3x) of the interval to capture delayed records
+- Hourly incremental updates use the last Daily sync timestamp with the lookback multiplier applied to the Daily interval (not Hourly interval)
+- Only tables with `IsEnabled = true` AND the specific schedule enabled SHALL be considered for automatic sync
+
+#### Scenario: Initial system startup with no prior syncs
+
+- **WHEN** the system starts and no `DataUpdate` records exist for a table
+- **AND** the table has `IsEnabled = true` and `MassConfig.Enabled = true`
+- **THEN** the system SHALL queue a Mass update task for that table
+- **THEN** the `MinimumDT` parameter SHALL be null (full data fetch)
+
+#### Scenario: Mass sync interval elapsed
+
+- **WHEN** a table's last successful Mass update occurred more than `MassConfig.Interval` minutes ago
+- **THEN** the system SHALL queue a Mass update task for that table
+- **THEN** any pending Daily or Hourly updates for that table SHALL be superseded
+
+#### Scenario: Daily sync triggers after mass is current
+
+- **WHEN** a table's Mass update is current (within interval)
+- **AND** the last Daily update occurred more than `DailyConfig.Interval` minutes ago
+- **THEN** the system SHALL queue a Daily update task
+- **THEN** the `MinimumDT` SHALL be set to `LastDailyUpdateDT - (LookbackMultiplier * DailyInterval)` minutes
+
+#### Scenario: Hourly sync with lookback window
+
+- **WHEN** an Hourly update is triggered
+- **THEN** the system SHALL fetch records modified since `MinimumDT`
+- **AND** `MinimumDT` SHALL equal `LastDailyUpdateDT - (LookbackMultiplier * DailyInterval)` minutes (using Daily timestamp, not Hourly)
+
+#### Scenario: Disabled table not scheduled
+
+- **WHEN** a table has `IsEnabled = false` OR all schedule configs have `Enabled = false`
+- **THEN** the table SHALL NOT be automatically scheduled for sync
+- **THEN** syncs MAY only occur via explicit manual trigger through the admin API
+
+### Requirement: Data Source Configuration
+
+The system SHALL load and validate data source configurations defining sync behavior per table.
+
+#### Inputs
+
+- `DataSourceOptions` entries within `DataSyncOptions`
+- Each entry specifies: SourceSystem, TableName, FetcherTypeName, PostProcessorTypeName, and schedule configs
+
+#### Outputs
+
+- Validated `DataSourceOptions` with resolved service types
+- Only configurations with `IsEnabled = true` are active
+
+#### Business Rules
+
+- Each data source MUST specify a `FetcherTypeName` that resolves to an `IDataFetcher<T>` implementation
+- `PostProcessorTypeName` is optional and specifies an `IPostProcessor` implementation
+- Standard intervals SHALL be: Mass = 10080 minutes (7 days), Daily = 1440 minutes (24 hours), Hourly = 60 minutes
+- CMS data sources MAY have different intervals (e.g., MisData uses Mass = 100800 minutes / 70 days)
+- Archive tables MAY disable all schedules and require manual triggering via admin API
+
+#### Scenario: Configuration validation at startup
+
+- **WHEN** the service starts
+- **THEN** all `DataSourceOptions` entries SHALL be validated
+- **THEN** `FetcherTypeName` values SHALL be resolved to registered services
+- **THEN** only configurations with `IsEnabled = true` SHALL be added to the active configs list
+
+#### Scenario: Disabled archive table configuration
+
+- **WHEN** a configuration has `MassConfig.Enabled = false`, `DailyConfig.Enabled = false`, and `HourlyConfig.Enabled = false`
+- **THEN** the table SHALL never be automatically scheduled for sync
+- **THEN** syncs MAY only occur via explicit manual trigger through the admin API
+
+#### Scenario: Post-processing action execution
+
+- **WHEN** a data source specifies a `PostProcessorTypeName`
+- **AND** the data merge completes successfully
+- **THEN** the system SHALL resolve and invoke the `IPostProcessor.ProcessAsync()` method
+- **THEN** the update SHALL only be marked complete after post-processing succeeds
+
+#### Scenario: CMS vs JDE source configuration
+
+- **WHEN** a data source has `SourceSystem = "CMS"`
+- **THEN** the `FetcherTypeName` SHALL reference a CMS-specific `IDataFetcher<T>` implementation
+- **WHEN** a data source has `SourceSystem = "JDE"`
+- **THEN** the `FetcherTypeName` SHALL reference a JDE-specific `IDataFetcher<T>` implementation
+
+### Requirement: Table Management and Merge Operations
+
+The system SHALL use staging tables and SQL MERGE operations to efficiently upsert data while preserving existing records.
+
+#### Inputs
+
+- Source data from `IDataFetcher<T>.FetchAsync()` execution
+- Destination table schema (columns, primary key, indexes)
+- Update configuration (PrepurgeData, ReIndexData flags)
+
+#### Outputs
+
+- Updated destination table with merged data
+- Rebuilt indexes (if configured)
+- Staging and temp tables cleaned up
+
+#### Business Rules
+
+- Mass updates with `PrepurgeData = true` SHALL TRUNCATE the destination table before loading
+- Incremental updates (Daily/Hourly) SHALL use MERGE to upsert without deleting existing records
+- Data SHALL be batched in groups of 1,000,000 records for bulk copy operations
+- Bulk copy SHALL use batch size of 10,000 rows with streaming enabled
+- Staging tables SHALL be named `#Staging{TableName}_{OperationId}` (local temp tables with unique suffix for parallel isolation)
+- Temp tables SHALL be named `#{TableName}_{OperationId}` (local temp tables with unique suffix)
+- MERGE SHALL update existing records only when `LastUpdateDT` in source is greater than target (if column exists)
+- Tables without `LastUpdateDT` column SHALL update all matched rows unconditionally
+- Non-primary-key indexes SHALL be disabled during bulk load and rebuilt after
+
+#### Scenario: Mass update with table truncation
+
+- **WHEN** a Mass update executes with `PrepurgeData = true`
+- **THEN** the destination table SHALL be truncated before data load
+- **THEN** all records from source SHALL be inserted
+- **THEN** indexes SHALL be rebuilt if `ReIndexData = true`
+
+#### Scenario: Incremental update with MERGE
+
+- **WHEN** a Daily or Hourly update executes
+- **THEN** the system SHALL create a staging table matching destination schema with unique suffix
+- **THEN** source data SHALL be bulk copied to staging table
+- **THEN** data SHALL be deduplicated into temp table using `ROW_NUMBER() OVER(PARTITION BY PK ORDER BY LastUpdateDT DESC)`
+- **THEN** MERGE SHALL insert new records and update existing records where source `LastUpdateDT > target.LastUpdateDT`
+
+#### Scenario: Table without LastUpdateDT column
+
+- **WHEN** MERGE executes on a table without `LastUpdateDT` column
+- **THEN** all matched rows SHALL be updated unconditionally
+- **THEN** the `ReleaseDate` column (if present) SHALL only be used for ORDER BY in deduplication, not for update filtering
+
+#### Scenario: Large dataset batching
+
+- **WHEN** the data fetch streams more than 1,000,000 records
+- **THEN** records SHALL be processed in batches of 1,000,000
+- **THEN** each batch SHALL create fresh staging/temp tables with unique suffixes
+- **THEN** each batch SHALL execute MERGE independently
+- **THEN** total record count SHALL accumulate across all batches
+
+#### Scenario: Index management during bulk load
+
+- **WHEN** staging table is created
+- **THEN** an index SHALL be created on primary key columns plus `LastUpdateDT` (or `ReleaseDate`)
+- **THEN** non-PK, non-unique indexes SHALL be disabled before bulk copy
+- **THEN** indexes SHALL be rebuilt after bulk copy completes
+
+### Requirement: Update Logging and Recovery
+
+The system SHALL log all sync operations and support recovery from interrupted syncs.
+
+#### Inputs
+
+- `DataUpdate` table for recording sync history
+- `LastDataUpdates` view for querying last successful syncs
+
+#### Outputs
+
+- Complete audit trail of all sync operations
+- Automatic recovery of interrupted syncs
+
+#### Business Rules
+
+- Each sync operation MUST create a `DataUpdate` record at start with `NumberRecords = -2` (in-progress marker)
+- The sync operation MUST be wrapped in try/catch to ensure failed operations are marked properly
+- Successful completion SHALL update `EndDT`, `WasSuccessful = true`, and actual `NumberRecords`
+- Failed operations SHALL set `WasSuccessful = false` and `NumberRecords = -1`
+- Open entries (NumberRecords = -2) from prior runs SHALL be closed as failed at service startup via `CloseOpenUpdateEntries()`
+- Old `DataUpdate` records SHALL be purged periodically via `PurgeUpdateEntries()` after configurable retention period
+- All logging SHALL use `ILogger<T>` with `BeginScope()` for structured context (table name, update type, operation ID)
+
+#### Scenario: Sync operation start logging
+
+- **WHEN** a sync operation begins
+- **THEN** a `DataUpdate` record SHALL be inserted with `NumberRecords = -2`
+- **THEN** the record SHALL include SourceSystem, SourceData, TableName, UpdateType, StartDT
+- **THEN** the operation SHALL create a logging scope with table name and operation ID
+
+#### Scenario: Successful sync completion
+
+- **WHEN** a sync operation completes without errors
+- **THEN** the `DataUpdate` record SHALL be updated with `EndDT = GETDATE()`
+- **THEN** `WasSuccessful` SHALL be set to `true`
+- **THEN** `NumberRecords` SHALL reflect the total rows processed
+
+#### Scenario: Failed sync handling
+
+- **WHEN** a sync operation throws an exception
+- **THEN** the exception SHALL be caught in the operation wrapper
+- **THEN** the `DataUpdate` record SHALL be updated with `WasSuccessful = false`, `NumberRecords = -1`
+- **THEN** the error SHALL be logged via `ILogger<T>` with full exception details
+- **THEN** subsequent sync attempts SHALL retry the operation
+
+#### Scenario: Recovery from interrupted sync at startup
+
+- **WHEN** the service starts and finds `DataUpdate` records with `NumberRecords = -2`
+- **THEN** `CloseOpenUpdateEntries()` SHALL update those records to `EndDT = GETDATE()`, `WasSuccessful = false`, `NumberRecords = -1`
+- **THEN** the system SHALL treat those tables as needing fresh sync based on last successful update
+
+#### Scenario: Periodic history purge
+
+- **WHEN** `PurgeUpdateEntries()` executes
+- **THEN** `DataUpdate` records older than `PurgeRetentionDays` SHALL be deleted
+- **THEN** the purge SHALL run periodically (e.g., daily) independent of sync operations
+
+### Requirement: Parallel Sync Execution
+
+The system SHALL execute multiple table syncs in parallel to optimize throughput with proper cancellation support.
+
+#### Inputs
+
+- List of pending `DataUpdateTask` objects
+- `MaxDegreeOfParallelism` from `DataSyncOptions`
+- `CancellationToken` for cancellation support
+
+#### Outputs
+
+- Concurrent execution of sync operations
+- Proper isolation between parallel syncs
+- Graceful cancellation of parallel operations
+
+#### Business Rules
+
+- Pending updates SHALL be executed in parallel using `Parallel.ForEachAsync` or `SemaphoreSlim` with `Task.WhenAll`
+- Maximum degree of parallelism SHALL be configurable (default = 8)
+- Each sync operation MUST use its own `IServiceScope` for scoped service resolution
+- Each sync operation MUST use its own database connection
+- Staging tables MUST use unique suffixes (`_{OperationId}`) to avoid conflicts in parallel scenarios
+- `CancellationToken` MUST be passed to all parallel operations
+- Search processing is blocked while any sync operations are pending
+
+#### Scenario: Multiple tables need sync
+
+- **WHEN** multiple tables have pending sync tasks
+- **THEN** the system SHALL execute up to `MaxDegreeOfParallelism` sync operations concurrently
+- **THEN** each operation SHALL create its own `IServiceScope`
+- **THEN** each operation SHALL use independent SQL connections
+- **THEN** completion of one operation SHALL not affect others
+
+#### Scenario: Cancellation during parallel sync
+
+- **WHEN** cancellation is requested during parallel sync execution
+- **THEN** the `CancellationToken` SHALL propagate to all running operations
+- **THEN** operations SHALL check the token and exit gracefully
+- **THEN** incomplete operations SHALL be marked as failed
+
+#### Scenario: Sync blocks search processing
+
+- **WHEN** the work processor checks for pending sync tasks
+- **AND** pending tasks exist
+- **THEN** sync operations SHALL execute before processing any queued searches
+- **THEN** search processing SHALL only begin when no sync tasks remain pending
+
+#### Scenario: Sync with isolated resources
+
+- **WHEN** multiple sync operations run in parallel
+- **THEN** each operation SHALL create staging tables with unique suffixes
+- **THEN** each operation SHALL use its own scoped database connection
+- **THEN** no shared mutable state SHALL exist between parallel operations
+
+### Requirement: CMS Availability and Circuit Breaker
+
+The system SHALL handle CMS (Sybase) connectivity issues with circuit breaker pattern.
+
+#### Inputs
+
+- CMS connection state
+- Recent CMS sync failure history
+
+#### Outputs
+
+- Automatic retry with backoff for transient failures
+- Circuit breaker to prevent repeated failed connection attempts
+
+#### Business Rules
+
+- CMS connections SHALL use Polly or similar circuit breaker pattern
+- The circuit SHALL open after consecutive failures (configurable, default = 3)
+- The circuit SHALL remain open for a configurable duration (default = 5 minutes)
+- Health checks SHALL report CMS circuit state
+- JDE syncs SHALL continue independently of CMS circuit state
+
+#### Scenario: CMS transient failure
+
+- **WHEN** a CMS sync fails with a transient error
+- **THEN** the system SHALL retry with exponential backoff
+- **THEN** the failure count SHALL increment
+
+#### Scenario: Circuit breaker opens
+
+- **WHEN** consecutive CMS sync failures exceed threshold
+- **THEN** the circuit breaker SHALL open
+- **THEN** subsequent CMS sync attempts SHALL fail fast without attempting connection
+- **THEN** JDE syncs SHALL continue normally
+
+#### Scenario: Circuit breaker recovery
+
+- **WHEN** the circuit breaker open duration elapses
+- **THEN** the circuit SHALL transition to half-open state
+- **THEN** the next CMS sync attempt SHALL be allowed
+- **THEN** success SHALL close the circuit; failure SHALL reopen it
+
+### Requirement: Archive Sync Manual Trigger
+
+The system SHALL support manual triggering of archive table syncs via admin API.
+
+#### Inputs
+
+- HTTP request to admin API endpoint
+- Table name and optional update type parameters
+
+#### Outputs
+
+- Queued sync task for the specified archive table
+- Status response indicating task queued
+
+#### Business Rules
+
+- Archive tables with all schedules disabled SHALL only sync via manual trigger
+- The admin API endpoint SHALL require authentication and authorization
+- Manual triggers SHALL queue a Mass update task for the specified table
+- The system SHALL return immediate acknowledgment; sync runs asynchronously
+
+#### Scenario: Manual archive sync trigger
+
+- **WHEN** an authenticated admin calls the manual sync API for an archive table
+- **THEN** a Mass update task SHALL be queued for that table
+- **THEN** the API SHALL return 202 Accepted with task ID
+- **THEN** the sync SHALL execute in the background service
+
+### Requirement: Periodic Index Maintenance
+
+The system SHALL support periodic index maintenance independent of mass syncs.
+
+#### Inputs
+
+- Index maintenance configuration (schedule, tables)
+- Current table statistics
+
+#### Outputs
+
+- Rebuilt or reorganized indexes
+- Updated statistics
+
+#### Business Rules
+
+- Index maintenance MAY be configured to run on a schedule independent of mass syncs
+- Maintenance SHALL check index fragmentation before rebuilding
+- Indexes with fragmentation > 30% SHALL be rebuilt; 10-30% SHALL be reorganized
+- Statistics SHALL be updated after index maintenance
+- Maintenance operations SHALL be logged for audit
+
+#### Scenario: Scheduled index maintenance
+
+- **WHEN** the index maintenance schedule triggers
+- **THEN** the system SHALL check fragmentation levels for configured tables
+- **THEN** highly fragmented indexes SHALL be rebuilt
+- **THEN** moderately fragmented indexes SHALL be reorganized
+- **THEN** table statistics SHALL be updated
+
+### Requirement: Background service implementation pattern
+
+The system SHALL implement the data synchronization service following .NET BackgroundService best practices for hosted service lifecycle management.
+
+#### Inputs
+
+- `IServiceScopeFactory` for creating scoped service instances
+- `IOptions<DataSyncOptions>` for configuration access
+- `ILogger<DataSyncService>` for structured logging
+- `CancellationToken` from `ExecuteAsync` stoppingToken parameter
+
+#### Outputs
+
+- Continuously running background task that checks schedules and executes syncs
+- Proper cleanup on shutdown with all resources disposed
+- Logging scope context for all operations
+
+#### Business Rules
+
+- The service MUST implement `BackgroundService.ExecuteAsync(CancellationToken)`
+- The main loop MUST use `Task.Delay(checkInterval, stoppingToken)` between cycles
+- Each sync cycle MUST create a new `IServiceScope` via `IServiceScopeFactory.CreateAsyncScope()`
+- All scoped services MUST be resolved from the current scope, not from root provider
+- The scope MUST be disposed using `await using` pattern after each cycle
+- Exception handling MUST catch and log errors without crashing the service
+- `OperationCanceledException` MUST be caught and result in graceful loop exit when `stoppingToken.IsCancellationRequested`
+- The service MUST NOT use static state or shared mutable collections
+
+#### Scenario: Normal sync cycle execution
+
+- **WHEN** the BackgroundService enters ExecuteAsync
+- **THEN** the service SHALL call CloseOpenUpdateEntriesAsync to recover from prior crashes
+- **THEN** the service SHALL enter a while loop checking `!stoppingToken.IsCancellationRequested`
+- **THEN** each iteration SHALL create a new IServiceScope
+- **THEN** the ISyncOrchestrator SHALL be resolved from the scope
+- **THEN** ExecutePendingSyncsAsync SHALL be called with the stoppingToken
+- **THEN** the scope SHALL be disposed after the call completes
+- **THEN** Task.Delay SHALL pause before the next iteration
+
+#### Scenario: Exception during sync cycle
+
+- **WHEN** an exception occurs during sync execution (not OperationCanceledException)
+- **THEN** the exception SHALL be caught and logged with LogError
+- **THEN** the service SHALL continue to the next iteration
+- **THEN** the current scope SHALL still be disposed properly
+- **THEN** the service SHALL NOT crash or stop unexpectedly
+
+#### Scenario: Graceful shutdown request
+
+- **WHEN** the host signals shutdown by canceling the stoppingToken
+- **THEN** any running Task.Delay SHALL throw OperationCanceledException
+- **THEN** the while loop SHALL exit on the IsCancellationRequested check
+- **THEN** the ExecuteAsync method SHALL complete normally
+- **THEN** any in-progress sync operations SHALL receive the cancellation and complete or cancel
+
+### Requirement: Parallel fetch isolation with scoped resources
+
+The system SHALL ensure complete isolation between parallel sync operations using scoped resources and unique identifiers.
+
+#### Inputs
+
+- List of `DataUpdateTask` objects to execute in parallel
+- `MaxDegreeOfParallelism` configuration value
+- `CancellationToken` for coordinated cancellation
+
+#### Outputs
+
+- Concurrent execution of sync operations with no resource conflicts
+- Unique staging tables per operation that do not collide
+- Independent database connections per operation
+
+#### Business Rules
+
+- `Parallel.ForEachAsync` MUST be used with `ParallelOptions.CancellationToken` set
+- Each parallel task MUST create its own `IServiceScope` inside the parallel delegate
+- Database connections MUST NOT be shared across parallel operations
+- Staging table names MUST include a unique `OperationId` suffix (GUID or sequential ID)
+- Format: `#Staging{TableName}_{OperationId}` and `#{TableName}_{OperationId}`
+- Each parallel operation MUST resolve its own instances of all scoped services
+- No `ConcurrentDictionary`, shared counters, or other shared mutable state SHALL exist between operations
+- Total record counts SHALL be accumulated via return values, not shared state
+
+#### Scenario: Parallel sync with isolated scopes
+
+- **WHEN** multiple DataUpdateTasks are executed via Parallel.ForEachAsync
+- **THEN** each task SHALL execute the async delegate independently
+- **THEN** each delegate SHALL create a new IServiceScope using CreateAsyncScope
+- **THEN** ITableSyncOperation SHALL be resolved from each scope independently
+- **THEN** each operation SHALL use its own database connection from the scope
+- **THEN** staging tables SHALL use unique OperationId suffixes preventing name collisions
+- **THEN** completion of one operation SHALL NOT affect the execution of others
+
+#### Scenario: Parallel cancellation propagation
+
+- **WHEN** cancellation is requested during Parallel.ForEachAsync execution
+- **THEN** the CancellationToken SHALL propagate to all running parallel operations
+- **THEN** Parallel.ForEachAsync SHALL stop starting new operations
+- **THEN** running operations SHALL receive the token in their async methods
+- **THEN** each operation SHALL check the token and exit gracefully
+- **THEN** incomplete operations SHALL mark their DataUpdate records as failed
+
+#### Scenario: Staging table uniqueness verification
+
+- **WHEN** two sync operations for the same table run in parallel
+- **THEN** each operation SHALL generate a unique OperationId as GUID
+- **THEN** operation A SHALL create staging table with GuidA suffix
+- **THEN** operation B SHALL create staging table with GuidB suffix
+- **THEN** no SQL errors SHALL occur from table name conflicts
+- **THEN** each operation cleanup SHALL only drop its own staging tables
+
+### Requirement: Structured logging context
+
+The system SHALL use ILogger.BeginScope to attach contextual information to all log entries during sync operations.
+
+#### Inputs
+
+- `ILogger<T>` injected into sync operation classes
+- TableName, UpdateType, OperationId values from current operation
+
+#### Outputs
+
+- All log entries within the scope contain the contextual properties
+- Log aggregation systems can filter and group by table, type, or operation
+
+#### Business Rules
+
+- Each sync operation MUST call `_logger.BeginScope(...)` at the start
+- The scope MUST include at minimum: TableName, UpdateType, OperationId
+- The scope MUST be disposed using `using` statement when operation completes
+- Nested scopes for batches SHALL preserve parent scope properties
+- LogInformation, LogWarning, LogError calls within the scope SHALL include the context automatically
+
+#### Scenario: Log scope creation and usage
+
+- **WHEN** a TableSyncOperation begins execution
+- **THEN** the operation SHALL create a logging scope with TableName, UpdateType, OperationId
+- **THEN** all log calls within ExecuteAsync SHALL include these properties
+- **THEN** when the operation completes the scope SHALL be disposed
+- **THEN** subsequent operations SHALL have their own independent scopes
+
+## Data Source Configurations
+
+### Current/Transactional Tables (Full Schedule)
+
+| Table | Source | Mass Interval | Daily Interval | Hourly Interval |
+|-------|--------|---------------|----------------|-----------------|
+| WorkOrder_Curr | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+| LotUsage_Curr | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+| WorkOrderTime_Curr | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+| WorkOrderStep_Curr | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+| WorkOrderComponent_Curr | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+| WorkOrderRouting | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+
+### Reference Tables (Full Schedule)
+
+| Table | Source | Mass Interval | Daily Interval | Hourly Interval |
+|-------|--------|---------------|----------------|-----------------|
+| Item | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+| Lot | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+| WorkCenter | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+| ProfitCenter | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+| Branch | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+| JdeUser | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+| StatusCode | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+| FunctionCode | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+| OrgHierarchy | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+| RouteMaster | JDE | 10080 min (7d) | 1440 min (24h) | 60 min |
+
+### CMS Tables
+
+| Table | Source | Mass Interval | Daily Interval | Hourly Interval | Notes |
+|-------|--------|---------------|----------------|-----------------|-------|
+| MisData | CMS | 100800 min (70d) | 1440 min (24h) | Disabled | Has PostProcessor |
+
+### Archive Tables (Disabled - Manual Trigger via Admin API)
+
+| Table | Source | Notes |
+|-------|--------|-------|
+| WorkOrder_Hist | JDE | All schedules disabled |
+| LotUsage_Hist | JDE | All schedules disabled |
+| WorkOrderStep_Hist | JDE | All schedules disabled |
+| WorkOrderTime_Hist | JDE | All schedules disabled |
+| WorkOrderComponent_Hist | JDE | All schedules disabled |
+
+## Migration Notes
+
+| Legacy Pattern | New Pattern | Rationale |
+|----------------|-------------|-----------|
+| `Topshelf` Windows Service | .NET `BackgroundService` | Native .NET hosting, cross-platform support |
+| `ManualResetEvent` for shutdown | `CancellationToken` | Standard .NET cancellation pattern |
+| `Thread` while loop | `BackgroundService.ExecuteAsync` with `Task.Delay` | Proper async/await, no thread blocking |
+| `Parallel.ForEach` with `MaxDegreeOfParallelism` | `Parallel.ForEachAsync` or `SemaphoreSlim` with `Task.WhenAll` | Modern async patterns, cancellation support |
+| JSON config files + `Newtonsoft.Json` | `System.Text.Json` + `IOptions<T>` pattern | Built-in JSON support, configuration binding |
+| `FunctionConverter` reflection-based delegates | `IDataFetcher<T>` interfaces | Type safety, dependency injection, testability |
+| `ActionConverter` reflection-based delegates | `IPostProcessor` interfaces | Type safety, dependency injection, testability |
+| Static `UpdateProcessor` class | Scoped/singleton services with DI | Testability, proper lifecycle management |
+| NLog | `ILogger<T>` injected + `BeginScope()` for context | Framework-integrated logging, structured context |
+| Global temp tables `##staging_*` | Local temp tables `#Staging{Table}_{OperationId}` | Better isolation in parallel scenarios |
+| `System.Data.SqlClient` | `Microsoft.Data.SqlClient` | Modern SQL Server driver with better performance |
+| Manual SQL MERGE generation | Continue with Dapper + manual MERGE | Performance critical, maintain fine control |
+| No health checks | `IHealthCheck` implementation | Kubernetes/container orchestration support |
+| No metrics/tracing | `System.Diagnostics.Metrics` + `ActivitySource` | Observability, distributed tracing |
+
+## Resolved Design Decisions
+
+### Archive Sync Strategy
+
+**Decision**: Archive tables will be synced via manual trigger through an authenticated admin API endpoint.
+
+**Rationale**: Archive data changes infrequently and full syncs are expensive. Manual triggering allows administrators to control when these resource-intensive operations occur.
+
+### CMS Availability Handling
+
+**Decision**: Use circuit breaker pattern (Polly) for CMS connections with configurable failure threshold and open duration.
+
+**Rationale**: CMS (Sybase) may have different availability characteristics than JDE. Circuit breaker prevents cascading failures and allows JDE syncs to continue independently.
+
+### Post-Processing Migration
+
+**Decision**: Replace reflection-based `PostProcessingAction` with `IPostProcessor` interfaces resolved via DI.
+
+**Rationale**: Type-safe interfaces enable compile-time checking, better testability, and clearer contracts. DI resolution allows for proper scoping and dependency management.
+
+### Lookback Window Configuration
+
+**Decision**: Make lookback multiplier configurable via `DataSyncOptions.LookbackMultiplier` (default = 3).
+
+**Rationale**: Different environments may need different lookback windows based on data arrival patterns. Configuration allows tuning without code changes.
+
+### Index Rebuild Strategy
+
+**Decision**: Add periodic index maintenance independent of mass syncs, checking fragmentation before rebuilding.
+
+**Rationale**: Mass syncs may not run frequently enough for optimal index health. Separate maintenance allows proactive optimization based on actual fragmentation levels.
+
+## Codex Review Findings (Addressed)
+
+The following issues were identified during code review and have been addressed in this specification:
+
+1. **Hourly MinimumDT Calculation**: ADDRESSED - Spec now correctly documents that hourly updates use the daily timestamp with daily interval lookback (not hourly interval). See "Schedule-Based Sync Triggering" requirement.
+
+2. **Failure Recovery**: ADDRESSED - Spec now requires `DoUpdate` wrapper with try/catch to mark failed updates. `CloseOpenUpdateEntries()` is invoked at startup. `PurgeUpdateEntries()` is invoked periodically. See "Update Logging and Recovery" and "Background Service Lifecycle" requirements.
+
+3. **Disabled Schedules Can Run**: ADDRESSED - Spec now requires checking both `IsEnabled` AND specific schedule `Enabled` flags. Tables with all schedules disabled are only synced via manual trigger. See "Schedule-Based Sync Triggering" requirement.
+
+4. **Temp Table Naming**: ADDRESSED - Spec now correctly documents `#Staging{Table}_{OperationId}` and `#{Table}_{OperationId}` naming with unique suffixes for parallel isolation. See "Table Management and Merge Operations" requirement.
+
+5. **Archive Table Names**: ADDRESSED - Data Source Configurations table now uses correct `_Hist` suffix (LotUsage_Hist, WorkOrderStep_Hist, etc.).
+
+6. **WorkOrderRouting Table**: ADDRESSED - Data Source Configurations table now correctly shows `WorkOrderRouting` (no `_Curr` suffix).
+
+7. **MERGE LastUpdateDT Edge Case**: ADDRESSED - Spec now documents that tables without `LastUpdateDT` column update all matched rows unconditionally, and `ReleaseDate` is only used for ORDER BY in deduplication. See "Table without LastUpdateDT column" scenario.
@@ -0,0 +1,728 @@
+# Excel Export Specification
+
+## Purpose
+
+The Excel Export subsystem generates multi-sheet Excel workbooks (.xlsx) containing search results and criteria documentation using the ClosedXML library on .NET 10. It provides an injectable `IExcelExportService` that transforms search data into formatted, protected spreadsheets that users can download, analyze, and share. The subsystem supports conditional sheet generation based on search options (MIS data extraction) and applies consistent styling, column definitions, and worksheet protection across all output.
+
+## Source Reference
+
+| Legacy File | Purpose |
+|-------------|---------|
+| OLD/WorkerService/Process/ExcelWriter.cs | Main Excel generation orchestration and sheet writing |
+| OLD/WorkerService/Helpers/ExcelHelpers.cs | Generic table loading and attribute-driven column formatting |
+| OLD/WebInterface/Helpers/ExcelTemplateGenerator.cs | Data entry template generation for bulk uploads |
+| OLD/WorkerService/Models/Reporting/OutputColumnAttribute.cs | Column metadata (order, format, width, wrap) |
+| OLD/WorkerService/Models/Reporting/OutputTableAttribute.cs | Table/tab metadata (name, header display) |
+| OLD/WorkerService/Models/Reporting/SearchResult.cs | Search results data model with column definitions |
+| OLD/WorkerService/Models/Reporting/MisSearchResult.cs | MIS data model with column definitions |
+| OLD/WorkerService/Models/Reporting/MisNonMatchSearchResult.cs | Investigation (mismatch) data model |
+| OLD/WorkerService/Models/Reporting/*.cs | Filter entry models for criteria documentation |
+
+## Requirements
+
+### Requirement: Injectable Excel Export Service
+
+The system SHALL provide an injectable service for Excel generation following .NET dependency injection patterns.
+
+#### Service Interface
+
+```csharp
+public interface IExcelExportService
+{
+    Task<byte[]> GenerateAsync(SearchModel search, CancellationToken cancellationToken = default);
+    Task GenerateToStreamAsync(SearchModel search, Stream outputStream, CancellationToken cancellationToken = default);
+}
+```
+
+#### Test Support
+
+For unit testing, the system SHALL provide mock data factories to generate sample data without database dependencies:
+
+```csharp
+public static class ExcelTestDataFactory
+{
+    public static SearchModel CreateSampleSearch(int resultCount = 10);
+    public static List<SearchResult> CreateSampleResults(int count);
+    public static List<MisSearchResult> CreateSampleMisResults(int count);
+    public static List<MisNonMatchSearchResult> CreateSampleInvestigationResults(int count);
+}
+```
+
+#### Configuration Class
+
+```csharp
+public class ExcelExportOptions
+{
+    public string CriteriaSheetPassword { get; set; } = "JDE_SCOPING_TOOL_PASS";
+    public string DataSheetPassword { get; set; } = "JDESCOPINGTOOL";
+}
+```
+
+#### Business Rules
+
+- The service MUST be registered as scoped or transient in the DI container
+- The service MUST accept `ILogger<ExcelExportService>` for structured logging
+- The service MUST accept `IOptions<ExcelExportOptions>` for configuration
+- Logging MUST use `BeginScope()` to include search context (SearchId, SearchName)
+- The service MUST use ClosedXML (`XLWorkbook`) for workbook generation
+- Temporary files SHALL use `Path.GetTempPath()` for cross-platform temp directory access
+- Debug file output (`DebugWriteToFile`) SHALL be disabled by default; enable via configuration for troubleshooting
+
+#### Scenario: Register service in DI container
+
+- **WHEN** the application starts
+- **THEN** `IExcelExportService` is registered with `ExcelExportService` implementation as scoped
+
+#### Scenario: Log export operations with context
+
+- **WHEN** generating an export for a search
+- **THEN** log entries include SearchId and SearchName via `ILogger.BeginScope()`
+
+---
+
+### Requirement: Multi-Sheet Workbook Generation
+
+The system SHALL generate Excel workbooks with multiple worksheets based on search configuration and results.
+
+#### Inputs
+
+- `SearchModel` containing:
+  - Search metadata (name, username, timestamps)
+  - Filter criteria (timespan, work orders, items, profit centers, work centers, operators, component lots, item/operation/MIS)
+  - Search results (`List<SearchResult>`)
+  - MIS results (`List<MisSearchResult>`) - when ExtractMisData is enabled
+  - MIS non-match results (`List<MisNonMatchSearchResult>`) - when ExtractMisData is enabled
+- `ExtractMisData` boolean flag
+
+#### Outputs
+
+- Excel workbook as `byte[]` containing:
+  - "Search Criteria" sheet (always present)
+  - "Search Results" sheet (always present)
+  - "MIS Info" sheet (conditional - only when ExtractMisData is true and results not null)
+  - "Investigation" sheet (conditional - only when ExtractMisData is true and results not null)
+
+#### Business Rules
+
+- The "Search Criteria" sheet MUST always be the first sheet in the workbook
+- The "Search Results" sheet MUST always be the second sheet
+- MIS-related sheets SHALL only be included when `ExtractMisData` is true AND respective result collections are not null
+- The workbook MUST be returned as a byte array for storage in the database
+
+#### Scenario: Generate standard search export
+
+- **WHEN** a search completes with ExtractMisData set to false
+- **THEN** the system creates a workbook with exactly two sheets: "Search Criteria" and "Search Results"
+
+#### Scenario: Generate full export with MIS data
+
+- **WHEN** a search completes with ExtractMisData set to true and both MIS collections populated
+- **THEN** the system creates a workbook with four sheets: "Search Criteria", "Search Results", "MIS Info", and "Investigation"
+
+#### Scenario: Generate export with empty MIS results
+
+- **WHEN** a search completes with ExtractMisData true but MisResults is empty (not null)
+- **THEN** the system creates the "MIS Info" sheet with empty data table
+
+#### Scenario: Generate export with null MIS results
+
+- **WHEN** a search completes with ExtractMisData true but MisResults is null
+- **THEN** the system skips the "MIS Info" sheet entirely
+
+#### Scenario: Generate export with null investigation results
+
+- **WHEN** a search completes with ExtractMisData true but MisNonMatchResults is null
+- **THEN** the system skips the "Investigation" sheet entirely
+
+---
+
+### Requirement: Search Criteria Documentation Sheet
+
+The system SHALL generate a "Search Criteria" sheet documenting all search parameters and execution metadata.
+
+#### Inputs
+
+- Search metadata: Name, UserName, SubmitDT, StartDT, EndDT
+- Timespan filter: MinimumDT, MaximumDT
+- Filter collections: WorkOrderFilter, ItemNumberFilter, ProfitCenterFilter, WorkCenterFilter, OperatorFilter, ComponentLotFilter, ItemOperationMisFilter
+- ExtractMisData flag
+
+#### Outputs
+
+- Worksheet named "Search Criteria" containing:
+  - Search name and username header rows
+  - Timestamp section (submit, start, completed)
+  - Timespan filter table
+  - Multiple filter tables (one per filter type)
+  - Extract MIS data indicator
+
+#### Business Rules
+
+- Header cells MUST use bold, centered text with Gainsboro (light gray) background via `XLColor.Gainsboro`
+- Timestamps MUST be formatted as "MMM dd, yyyy hh:mm:ss tt EST"
+- Filter tables MUST be separated by 2 blank rows (current row + 3 for next table start)
+- Columns MUST auto-fit with 15% additional padding (width * 1.15)
+- The sheet MUST be password-protected using password from `ExcelExportOptions.CriteriaSheetPassword`
+- Filter tables MUST use the Light18 table style (`XLTableTheme.TableStyleLight18`)
+
+#### Scenario: Document search with all filters populated
+
+- **WHEN** generating criteria sheet for a search with all filter types populated
+- **THEN** the system creates tables for each filter type in order: Timespan, Work Order, Item Number, Profit Center, Work Center, Component Lot, Operator, Item/Operation/MIS
+
+#### Scenario: Document search with empty filters
+
+- **WHEN** generating criteria sheet for a search with empty filter collections
+- **THEN** the system still creates empty tables with headers for each filter type
+
+#### Scenario: Format ExtractMisData indicator
+
+- **WHEN** ExtractMisData is true
+- **THEN** the system displays "YES" in the Extract MIS data row
+
+#### Scenario: Format ExtractMisData indicator negative
+
+- **WHEN** ExtractMisData is false
+- **THEN** the system displays "NO" in the Extract MIS data row
+
+---
+
+### Requirement: Search Results Sheet Generation
+
+The system SHALL generate a "Search Results" sheet containing work order search results with standardized columns.
+
+#### Inputs
+
+- `List<SearchResult>` containing work order data with:
+  - Work order identifiers (number, branch code, lot number)
+  - Item information (number, planning family, stocking type)
+  - Quantities (order, held, scrapped, shipped)
+  - Operation details (step branch, number, description, function description)
+  - Timestamps (step update, status update)
+  - Status information (code, description)
+  - Inclusion reason (computed from flags)
+
+#### Outputs
+
+- Worksheet named "Search Results" with:
+  - 19 columns in defined order
+  - Data formatted as Excel table named "Search_Results"
+  - Light18 table style applied
+  - No worksheet protection (attribute-driven path)
+
+#### Column Definitions
+
+| Order | Header | Data Type | Format |
+|-------|--------|-----------|--------|
+| 10 | Work Order Number | long | Standard |
+| 20 | Work Order Branch Code | string | Standard |
+| 30 | Lot Number | string | Standard |
+| 40 | Item Number | string | Standard |
+| 50 | Planning Family | string | Standard |
+| 55 | Stocking Type | string | Standard |
+| 60 | Order Quantity | decimal | Standard |
+| 70 | Held Quantity | decimal | Standard |
+| 80 | Scrapped Quantity | decimal | Standard |
+| 90 | Shipped Quantity | decimal | Standard |
+| 100 | Operation Step Branch Code | string | Standard |
+| 110 | Operation Step | decimal | Standard |
+| 120 | Operation Step Description | string | Standard |
+| 130 | Function Operation Description | string | Standard |
+| 140 | Operation Step Update Timestamp | DateTime | `[$-409]m/d/yy h:mm AM/PM;@` |
+| 150 | Status Code | string | Standard |
+| 160 | Status Description | string | Standard |
+| 170 | Status Update Timestamp | DateTime? | `[$-409]MM/dd/yyyy;@` |
+| 180 | Inclusion Reason | string (computed) | Standard |
+| 190 | (Additional column per legacy code) | - | Standard |
+
+#### Business Rules
+
+- Columns MUST auto-fit with 30% additional padding (width * 1.3)
+- The table MUST NOT show totals row
+- Timestamp columns MUST use the defined Excel number formats for proper date/time display
+- The Inclusion Reason column MUST compute values from boolean flags (ManuallySpecified, Flagged, CARDEX, PartsList, SplitOrder)
+
+#### Scenario: Format inclusion reason for manually specified
+
+- **WHEN** a result has ManuallySpecified = true
+- **THEN** the Inclusion Reason displays "ManuallySpecified"
+
+#### Scenario: Format inclusion reason for flagged
+
+- **WHEN** a result has Flagged = true (and ManuallySpecified = false)
+- **THEN** the Inclusion Reason displays "Flagged"
+
+#### Scenario: Format inclusion reason for CARDEX only
+
+- **WHEN** a result has CARDEX = true and PartsList = false
+- **THEN** the Inclusion Reason displays "ComponentUsage (CARDEX)"
+
+#### Scenario: Format inclusion reason for PartsList only
+
+- **WHEN** a result has PartsList = true and CARDEX = false
+- **THEN** the Inclusion Reason displays "ComponentUsage (Parts List)"
+
+#### Scenario: Format inclusion reason for CARDEX and parts list
+
+- **WHEN** a result has both CARDEX = true and PartsList = true
+- **THEN** the Inclusion Reason displays "ComponentUsage (CARDEX + Parts List)"
+
+#### Scenario: Format inclusion reason for split order
+
+- **WHEN** a result has only SplitOrder = true
+- **THEN** the Inclusion Reason displays "Split order"
+
+#### Scenario: Format inclusion reason unknown
+
+- **WHEN** a result has no matching boolean flags
+- **THEN** the Inclusion Reason displays "UNKNOWN"
+
+---
+
+### Requirement: MIS Info Sheet Generation
+
+The system SHALL generate a "MIS Info" sheet containing Manufacturing Instruction Sheet data when enabled.
+
+#### Inputs
+
+- `List<MisSearchResult>` containing:
+  - Item identification (number, description)
+  - MIS metadata (number, revision, status, release date)
+  - Sequence/step numbers (MIS job step, job step, matched)
+  - Match indicators (RoutingMatch, MasterMatch)
+  - Description fields (function operation, test description)
+  - Sampling information (type, value)
+  - Long text fields (tools/gauges, work instructions)
+
+#### Outputs
+
+- Worksheet named "MIS Info" with:
+  - 19 columns in defined order
+  - Data formatted as Excel table named "MIS_Info"
+  - Light18 table style applied
+  - Specific columns with text wrapping and fixed width
+
+#### Column Definitions
+
+| Order | Header | Format | Width |
+|-------|--------|--------|-------|
+| 10 | Item Number | Standard | Auto |
+| 20 | MIS Job Step Sequence Number | Standard | Auto |
+| 30 | MIS Number | Standard | Auto |
+| 40 | MIS Revision | Standard | Auto |
+| 50 | Item Description | Standard | Auto |
+| 60 | MIS Release Status | Standard | Auto |
+| 70 | MIS Release Date | Timestamp | Auto |
+| 80 | Branch Code | Standard | Auto |
+| 90 | Job Step Sequence Number | Standard | Auto |
+| 100 | Matched Sequence Number | Standard | Auto |
+| 110 | Matched to F3112Z1? | Standard | Auto |
+| 120 | Matched to F3003? | Standard | Auto |
+| 130 | Function Operation Description | Standard | Auto |
+| 140 | Char Number | Standard | Auto |
+| 150 | Test Description | Standard | 65 (wrapped) |
+| 160 | Sampling Type | Standard | Auto |
+| 170 | Sampling Value | Standard | Auto |
+| 180 | Tools & Gauges | Standard | 65 (wrapped) |
+| 190 | Work Instructions | Standard | 65 (wrapped) |
+
+#### Business Rules
+
+- Columns with long text (Test Description, Tools & Gauges, Work Instructions) MUST have WrapText enabled and fixed width of 65
+- Auto-width columns MUST apply 30% additional padding
+- Wrapped columns MUST NOT be auto-fitted
+
+#### Scenario: Generate MIS sheet with wrapped columns
+
+- **WHEN** generating MIS Info sheet with data
+- **THEN** Test Description, Tools & Gauges, and Work Instructions columns have fixed 65-character width with text wrapping enabled
+
+#### Scenario: Handle null MIS results
+
+- **WHEN** MisResults is null
+- **THEN** the system skips MIS Info sheet generation entirely (returns early)
+
+#### Scenario: Format boolean match indicators
+
+- **WHEN** RoutingMatch or MasterMatch values are written
+- **THEN** they display as "True" or "False" text values
+
+---
+
+### Requirement: Investigation Sheet Generation
+
+The system SHALL generate an "Investigation" sheet containing router mismatch data for analysis.
+
+#### Inputs
+
+- `List<MisNonMatchSearchResult>` containing:
+  - Work center and order identification
+  - Job step details (number, description, dates)
+  - Function and routing information
+  - Item details (number, description)
+  - Match indicators (WasJobStepAdded, MatchedJobStepNumber)
+
+#### Outputs
+
+- Worksheet named "Investigation" with:
+  - 12 columns in defined order
+  - Data formatted as Excel table named "Investigation"
+  - Light18 table style applied
+
+#### Column Definitions
+
+| Order | Header | Format |
+|-------|--------|--------|
+| 10 | Work Center Code | Standard |
+| 20 | Work Order Number | Standard |
+| 30 | Work Order Start Date | `[$-409]MM/dd/yyyy;@` |
+| 40 | Job Step Number | Standard |
+| 50 | Function Operation Description | Standard |
+| 60 | Job Step End Date | `[$-409]MM/dd/yyyy;@` |
+| 70 | Function Code | Standard |
+| 75 | Was Job Step Added? | Standard (boolean) |
+| 76 | Matched Job Step Number | Standard |
+| 80 | Item Number | Standard |
+| 90 | Item Description | Standard |
+| 100 | Routing Type | Standard |
+
+#### Business Rules
+
+- Date columns MUST use `DATE_FORMAT` (`[$-409]MM/dd/yyyy;@`)
+- All columns MUST auto-fit with 30% additional padding
+
+#### Scenario: Handle null mismatch results
+
+- **WHEN** MisNonMatchResults is null
+- **THEN** the system skips Investigation sheet generation entirely
+
+#### Scenario: Format date columns
+
+- **WHEN** generating Investigation sheet
+- **THEN** Work Order Start Date and Job Step End Date columns use `[$-409]MM/dd/yyyy;@` number format
+
+---
+
+### Requirement: Worksheet Protection
+
+The system SHALL apply password-based protection to worksheets with configurable allowed operations.
+
+#### Inputs
+
+- Worksheet to protect
+- Protection password from `IOptions<ExcelExportOptions>`
+- Editable range definition (cells beyond data area)
+
+#### Outputs
+
+- Protected worksheet with:
+  - Locked data cells
+  - Unlocked extension area for user additions
+  - Specific operations allowed/disallowed
+
+#### Business Rules
+
+- Protection passwords MUST be loaded from `ExcelExportOptions` configuration
+- Protected ranges MUST allow the following operations via `IXLSheetProtection`:
+  - Delete columns: YES
+  - Delete rows: NO
+  - Auto filter: YES
+  - Format cells: YES
+  - Format columns: YES
+  - Format rows: YES
+  - Select locked cells: YES
+  - Select unlocked cells: YES
+  - Edit objects: YES
+  - Sort: YES
+- Unprotected area MUST extend 1000 rows and columns beyond data range
+
+#### ClosedXML Protection Example
+
+```csharp
+var protection = worksheet.Protect(options.Value.DataSheetPassword);
+protection.AllowElement(XLSheetProtectionElements.DeleteColumns);
+protection.AllowElement(XLSheetProtectionElements.AutoFilter);
+protection.AllowElement(XLSheetProtectionElements.FormatCells);
+protection.AllowElement(XLSheetProtectionElements.FormatColumns);
+protection.AllowElement(XLSheetProtectionElements.FormatRows);
+protection.AllowElement(XLSheetProtectionElements.SelectLockedCells);
+protection.AllowElement(XLSheetProtectionElements.SelectUnlockedCells);
+protection.AllowElement(XLSheetProtectionElements.EditObjects);
+protection.AllowElement(XLSheetProtectionElements.Sort);
+```
+
+#### Scenario: Protect search criteria sheet
+
+- **WHEN** generating Search Criteria sheet
+- **THEN** sheet is protected using `ExcelExportOptions.CriteriaSheetPassword`
+
+#### Scenario: Apply consistent protection settings
+
+- **WHEN** protecting any data worksheet
+- **THEN** all boolean protection flags match the defined allowed operations
+
+#### Scenario: Allow filtering and sorting
+
+- **WHEN** user opens protected worksheet
+- **THEN** they can filter and sort data without entering password
+
+---
+
+### Requirement: Attribute-Driven Column Configuration
+
+The system SHALL use C# attributes to define column metadata for automatic table generation.
+
+#### Inputs
+
+- Data model classes decorated with `OutputTableAttribute` and `OutputColumnAttribute`
+- Properties marked with `OutputColumnAttribute` defining column order, header, format, width, and wrap settings
+
+#### Outputs
+
+- Dynamically generated Excel tables based on attribute configuration
+
+#### Property Access Strategy
+
+- The system SHALL use native .NET reflection (`PropertyInfo.GetValue()`) for property access
+- Source generators MAY be used as future optimization for compile-time property mapping
+
+#### OutputColumnAttribute Properties
+
+| Property | Type | Default | Purpose |
+|----------|------|---------|---------|
+| Order | int | - | Column sort order |
+| HeaderText | string | - | Column header display text |
+| Format | string | "@" (text) | Excel number format |
+| AutoWidth | bool | true | Enable auto-fit |
+| Width | double | - | Fixed width (when AutoWidth=false) |
+| WrapText | bool | false | Enable text wrapping |
+
+#### OutputTableAttribute Properties
+
+| Property | Type | Purpose |
+|----------|------|---------|
+| TabName | string | Worksheet tab name |
+| TableName | string | Excel table name |
+| ShowHeader | bool | Show merged header row above table |
+
+#### Standard Formats
+
+| Constant | Value | Usage |
+|----------|-------|-------|
+| STD_FORMAT | "@" | Text format (default) |
+| DATE_FORMAT | "[$-409]MM/dd/yyyy;@" | Date only |
+| TIMESTAMP_FORMAT | "[$-409]m/d/yy h:mm AM/PM;@" | Date and time |
+| WRAPPED_COLUMN_WIDTH | 65 | Fixed width for wrapped columns |
+
+#### Scenario: Generate table from decorated model
+
+- **WHEN** LoadTab is called with a model type having OutputTableAttribute
+- **THEN** worksheet name and table name are derived from attribute values
+
+#### Scenario: Order columns by attribute
+
+- **WHEN** generating table from model with OutputColumnAttribute
+- **THEN** columns appear in Order property sequence, with ties broken alphabetically by property name
+
+#### Scenario: Apply custom format to column
+
+- **WHEN** a property has OutputColumnAttribute with Format specified
+- **THEN** that format is applied to the entire column's number format
+
+#### Scenario: Apply wrapped text configuration
+
+- **WHEN** a property has WrapText=true and AutoWidth=false
+- **THEN** column has text wrapping enabled and uses fixed Width value
+
+---
+
+### Requirement: Data Entry Template Generation
+
+The system SHALL generate simple Excel templates for bulk data entry of filter values.
+
+#### Inputs
+
+- Source data collection (optional, for pre-population)
+- Header text (single column) or header array (multi-column)
+
+#### Outputs
+
+- Single-sheet workbook named "Data Entry Template"
+- Header row with standard formatting
+- Optional pre-populated data rows
+- All columns formatted as text ("@")
+
+#### Business Rules
+
+- Header row MUST be bold, centered, with Gainsboro background via `XLColor.Gainsboro`
+- Single-column templates MUST use 45-character width
+- Multi-column templates MUST use 65-character width per column
+- All cells MUST use text format to preserve leading zeros in item/lot numbers
+
+#### Scenario: Generate empty single-column template
+
+- **WHEN** Generate is called with null sourceData
+- **THEN** template contains only header row with no data
+
+#### Scenario: Generate pre-populated template
+
+- **WHEN** Generate is called with sourceData containing values
+- **THEN** data rows are populated starting at row 2
+
+#### Scenario: Generate multi-column template
+
+- **WHEN** Generate is called with object[][] sourceData and string[] headers
+- **THEN** multiple columns are created with respective headers
+
+---
+
+### Requirement: Header Cell Formatting
+
+The system SHALL apply consistent header formatting across all worksheets.
+
+#### Inputs
+
+- Cell range to format
+- Optional text value
+- Optional merge flag
+
+#### Outputs
+
+- Formatted header cell(s) with:
+  - Horizontal center alignment
+  - Bold font
+  - Solid Gainsboro (light gray) background fill via `XLColor.Gainsboro`
+
+#### ClosedXML Formatting Example
+
+```csharp
+var cell = worksheet.Cell(row, column);
+cell.Value = headerText;
+cell.Style.Font.Bold = true;
+cell.Style.Alignment.Horizontal = XLAlignmentHorizontalValues.Center;
+cell.Style.Fill.BackgroundColor = XLColor.Gainsboro;
+```
+
+#### Business Rules
+
+- Header format MUST be applied to:
+  - All table header rows
+  - Label cells in criteria sheet (column 1)
+  - Filter table section headers
+- Merge flag MUST only be set for multi-cell ranges using `IXLRange.Merge()`
+- Text value MUST be written when provided
+
+#### Scenario: Format single header cell
+
+- **WHEN** ApplyHeaderFormat is called on single cell with text
+- **THEN** cell has bold font, center alignment, Gainsboro background, and displays provided text
+
+#### Scenario: Format merged header range
+
+- **WHEN** ApplyHeaderFormat is called on multi-cell range with merge=true
+- **THEN** cells are merged and formatted as single header
+
+---
+
+### Requirement: Async Generation Pattern
+
+The system SHALL support async/await patterns for export generation.
+
+#### Business Rules
+
+- The `GenerateAsync` method MUST return `Task<byte[]>`
+- Since ClosedXML's `SaveAs` to `MemoryStream` is synchronous, the implementation MAY wrap the CPU-bound work in `Task.Run()` to avoid blocking
+- The method MUST accept `CancellationToken` for cancellation support
+- For very large exports, future versions MAY implement `Stream`-based output
+
+#### Implementation Example
+
+```csharp
+public async Task<byte[]> GenerateAsync(SearchModel search, CancellationToken cancellationToken = default)
+{
+    using var scope = _logger.BeginScope(new Dictionary<string, object>
+    {
+        ["SearchId"] = search.Id,
+        ["SearchName"] = search.Name
+    });
+
+    _logger.LogInformation("Starting Excel export generation");
+
+    // ClosedXML operations are synchronous, wrap in Task.Run for non-blocking
+    return await Task.Run(() =>
+    {
+        using var workbook = new XLWorkbook();
+
+        // ... build sheets ...
+
+        using var stream = new MemoryStream();
+        workbook.SaveAs(stream);
+        return stream.ToArray();
+    }, cancellationToken);
+}
+```
+
+#### Scenario: Generate export asynchronously
+
+- **WHEN** `GenerateAsync` is called
+- **THEN** the method returns a `Task<byte[]>` that completes when workbook generation finishes
+
+#### Scenario: Support cancellation
+
+- **WHEN** `GenerateAsync` is called with a `CancellationToken` that is cancelled
+- **THEN** the operation throws `OperationCanceledException`
+
+---
+
+## Migration Notes
+
+| Legacy Pattern | New Pattern | Rationale |
+|----------------|-------------|-----------|
+| EPPlus 4.x (LGPL) | ClosedXML (MIT license) | EPPlus 7+ requires commercial license; ClosedXML is fully free and MIT licensed |
+| `System.Drawing.Color` | `XLColor` | ClosedXML uses its own color type (`XLColor.Gainsboro`, etc.) |
+| `ExcelPackage` | `XLWorkbook` | ClosedXML workbook class |
+| `ExcelWorksheet` | `IXLWorksheet` | ClosedXML worksheet interface |
+| `ExcelRange` | `IXLRange` or `IXLCell` | ClosedXML range/cell interfaces |
+| Fasterflect reflection | Native reflection or source generators | Reduce dependencies; native `PropertyInfo.GetValue()` is sufficient; source generators available for future optimization |
+| Extension methods on EPPlus types | Service class with `IExcelExportService` interface | Enable testing and alternative implementations |
+| Static `ExcelWriter.Generate()` | Injectable `IExcelExportService` | Dependency injection for testability and configuration |
+| Hard-coded passwords | `IOptions<ExcelExportOptions>` configuration | Move protection passwords to configuration for security and flexibility |
+| Byte array return | `byte[]` and `Stream` | Support both: `GenerateAsync` returns byte[], `GenerateToStreamAsync` writes to Stream for large exports |
+| Synchronous generation | Async wrapping via `Task.Run()` | Support async patterns; ClosedXML SaveAs is sync, wrap for non-blocking |
+| TableStyles enum | `XLTableTheme` | ClosedXML table themes (e.g., `XLTableTheme.TableStyleLight18`) |
+| NLog static logging | `ILogger<T>` injected + `BeginScope()` | Modern structured logging with contextual scopes |
+
+## Resolved Design Decisions
+
+1. **Library Selection**: Use ClosedXML (MIT license) - fully free for commercial use, similar API to EPPlus, active maintenance.
+
+2. **Password Protection**: Move to `IOptions<ExcelExportOptions>` configuration. Default values preserved for backward compatibility but can be overridden via appsettings.json.
+
+3. **Large Export Handling**: Implement streaming architecture for memory-efficient large exports.
+   - The system SHALL support `Stream`-based output for large workbooks to avoid memory pressure
+   - The system SHALL provide both `GenerateAsync` (returns `byte[]`) and `GenerateToStreamAsync` (writes to `Stream`) methods
+   - For exports exceeding a configurable row threshold, the streaming approach SHALL be preferred
+
+4. **Async Support**: `GenerateAsync` method wraps synchronous ClosedXML operations in `Task.Run()` to avoid blocking.
+
+5. **Format Compatibility**: Maintain locale ID 409 (US English) for timestamp formats. International configuration deferred to future version.
+
+6. **Template Generator**: Retain `ExcelTemplateGenerator` functionality for bulk data entry via the Blazor UI.
+
+## Codex Review Findings (Addressed)
+
+The following inaccuracies were identified during review and have been addressed in this specification:
+
+1. **Table Style and Protection**: CORRECTED - Spec now states data sheets use Light18 style (via `XLTableTheme.TableStyleLight18`) and protection is applied only to criteria sheet by default. Data sheets generated via attribute-driven `LoadTab` do not apply protection.
+
+2. **Column Counts Corrected**:
+   - Search Results: CORRECTED to 19 columns (was incorrectly 18)
+   - Investigation: CORRECTED to 12 columns (was incorrectly 11)
+
+3. **Investigation Date Format**: CORRECTED - Spec now states `DATE_FORMAT` (`[$-409]MM/dd/yyyy;@`) is used, not "m/d/yyyy".
+
+4. **Inclusion Reason Scenarios Complete**: ADDED - Scenarios now include CARDEX-only, PartsList-only, and UNKNOWN cases.
+
+5. **Null List Handling**: CLARIFIED - Spec now explicitly states null checks are required before calling sheet generation methods. Implementation MUST check for null before generating MIS Info and Investigation sheets.
+
+6. **Criteria Table Spacing**: CORRECTED - Spec now states "2 blank rows" between filter tables (current row + 3 for next table start).
@@ -0,0 +1,120 @@
+# infrastructure Specification
+
+## Purpose
+TBD - created by archiving change setup-solution-foundation. Update Purpose after archive.
+## Requirements
+### Requirement: Service registration pattern
+
+The system SHALL use extension methods on IServiceCollection to register module-specific services.
+
+#### Inputs
+
+- IServiceCollection services
+- IConfiguration configuration
+
+#### Outputs
+
+- IServiceCollection (fluent return for chaining)
+
+#### Business Rules
+
+- Each module SHALL have one extension method (AddDataAccess, AddDataSync, AddAuth, AddExcelExport, AddSearchProcessing)
+- Extension methods SHALL bind their module's Options class from configuration
+- Extension methods SHALL register services with appropriate lifetimes:
+  - Scoped: Database connections, repositories, unit-of-work
+  - Singleton: Configuration options, HTTP clients, caching services
+  - Transient: Stateless processors, validators
+- Extension methods SHALL return IServiceCollection for fluent chaining
+
+#### Scenario: Module service registration
+
+- **WHEN** Program.cs calls builder.Services.AddDataAccess(configuration)
+- **THEN** DataAccessOptions is bound from the "DataAccess" configuration section
+- **AND** ILotFinderRepository is registered with Scoped lifetime
+- **AND** the method returns IServiceCollection for further chaining
+
+#### Scenario: Service lifetime correctness
+
+- **WHEN** a Scoped service is requested multiple times within the same HTTP request
+- **THEN** the same instance is returned each time
+- **AND** a new instance is created for the next HTTP request
+
+#### Scenario: Chained registration
+
+- **WHEN** Program.cs chains multiple extension methods
+- **THEN** all modules are registered in the order called
+- **AND** the final IServiceCollection contains all registered services
+
+### Requirement: Configuration binding pattern
+
+The system SHALL use IOptions<T> pattern to bind strongly-typed configuration from appsettings.json.
+
+#### Inputs
+
+- appsettings.json with named sections
+- Options class with matching property names
+
+#### Outputs
+
+- IOptions<T> resolved from DI with bound values
+
+#### Business Rules
+
+- Each Options class SHALL define a static SectionName constant matching the JSON section
+- Options classes SHALL use C# naming conventions (PascalCase properties)
+- Configuration sections SHALL use matching PascalCase names
+- Default values SHALL be defined in Options class properties
+- Options classes SHALL be registered using services.Configure<T>(section)
+
+#### Scenario: Configuration binding at startup
+
+- **WHEN** the application starts with valid appsettings.json
+- **THEN** IOptions<DataAccessOptions> resolves with values from the DataAccess section
+- **AND** properties not specified in JSON use their default values
+
+#### Scenario: Missing configuration section
+
+- **WHEN** the application starts without a required configuration section
+- **THEN** IOptions<T> resolves with all default property values
+- **AND** no exception is thrown at startup
+
+#### Scenario: Development override
+
+- **WHEN** the application runs in Development environment
+- **THEN** appsettings.Development.json values override appsettings.json values
+- **AND** IOptions<DataAccessOptions>.Value.EnableDetailedLogging is true
+
+### Requirement: Extension method organization
+
+The system SHALL organize extension methods in the JdeScoping.Core project under an Extensions namespace.
+
+#### Business Rules
+
+- Extension methods SHALL be in namespace JdeScoping.Core.Extensions
+- Each module SHALL have a dedicated static class: {Module}ServiceExtensions
+- Extension method SHALL be named Add{Module}
+- Files SHALL be located at: JdeScoping.Core/Extensions/{Module}ServiceExtensions.cs
+
+#### Scenario: Extension method discovery
+
+- **WHEN** a developer adds using JdeScoping.Core.Extensions
+- **THEN** all AddXxx extension methods are available on IServiceCollection
+- **AND** IntelliSense shows method documentation
+
+### Requirement: Options class organization
+
+The system SHALL organize Options classes in the JdeScoping.Core project under an Options namespace.
+
+#### Business Rules
+
+- Options classes SHALL be in namespace JdeScoping.Core.Options
+- Class names SHALL follow pattern: {Module}Options
+- SectionName constant SHALL match the JSON section name exactly
+- Files SHALL be located at: JdeScoping.Core/Options/{Module}Options.cs
+
+#### Scenario: Options class consistency
+
+- **WHEN** DataAccessOptions is defined with SectionName = "DataAccess"
+- **THEN** configuration.GetSection("DataAccess") returns the matching section
+- **AND** services.Configure<DataAccessOptions>(section) binds all properties
+
@@ -0,0 +1,955 @@
+# Search Processing Specification
+
+## Purpose
+
+The search processing subsystem enables users to query manufacturing data (work orders, lots, items, operators, and work centers) from a locally cached JDE/CMS database. It accepts multi-dimensional filter criteria, dynamically generates SQL queries using a builder pattern, executes searches against the SQL Server cache using Microsoft.Data.SqlClient, and aggregates results including downstream work order tracking and MIS (Manufacturing Information System) data extraction. This specification targets .NET 10 with modern C# language features and patterns.
+
+## Source Reference
+
+| Legacy Files | Purpose |
+|--------------|---------|
+| `OLD/DataModel/Models/SearchCriteria.cs` | Core search criteria model storing filter parameters |
+| `OLD/DataModel/ViewModels/SearchCriteriaViewModel.cs` | View model with enriched filter data for UI binding |
+| `OLD/WorkerService/Models/Reporting/SearchModel.cs` | Reporting model combining criteria with filter entries and results |
+| `OLD/WorkerService/Templates/QueryTemplate.cs` | T4-generated SQL query builder (to be replaced with builder pattern) |
+| `OLD/WorkerService/Templates/QueryTemplateExtension.cs` | Partial class extension for QueryTemplate |
+| `OLD/WorkerService/Helpers/SearchModelHelpers.cs` | Helper methods for model conversion and parameter creation |
+| `OLD/WorkerService/Models/Reporting/*.cs` | Filter entry models and result models |
+
+## Requirements
+
+### Requirement: Search Criteria Model
+
+The system SHALL support a search criteria model with eight distinct filter types that can be combined in any combination.
+
+#### Inputs
+
+- **Timespan Filter**: Optional minimum and maximum datetime values
+- **Work Order Filter**: Collection of work order numbers (long integers)
+- **Item Number Filter**: Collection of item numbers (strings)
+- **Profit Center Filter**: Collection of profit center codes (strings)
+- **Work Center Filter**: Collection of work center codes (strings)
+- **Operator Filter**: Collection of operator user IDs (strings)
+- **Component Lot Filter**: Collection of lot number/item number pairs
+- **Item Operation MIS Filter**: Collection of item/operation/MIS number/MIS revision combinations
+- **Extract MIS Data Flag**: Boolean indicating whether to include MIS data in results
+
+#### Outputs
+
+- Serializable `SearchCriteria` object stored as JSON in the `Search.CriteriaJSON` column
+- `SearchModel` populated with enriched filter entries (descriptions, full names, etc.)
+
+#### Business Rules
+
+- All filter collections SHALL be initialized as empty lists by default
+- Filter lists MAY contain zero or more entries
+- The timespan filter is considered enabled when either `MinimumDT` or `MaximumDT` has a value
+- Each filter type is considered enabled when its collection contains at least one entry
+- Component lot filters MUST include both lot number and item number for proper matching
+- Item/Operation/MIS filters MUST include all four fields: item number, operation number, MIS number, and MIS revision
+
+#### Scenario: Create search with timespan filter only
+
+- **WHEN** a user specifies minimum date of 2024-01-01 and maximum date of 2024-12-31
+- **THEN** the system creates a SearchCriteria with `MinimumDT` = 2024-01-01 and `MaximumDT` = 2024-12-31
+- **AND** `TimespanFilterEnabled` returns true
+- **AND** all other filter collections remain empty
+
+#### Scenario: Create search with multiple filter types
+
+- **WHEN** a user specifies work order numbers [12345, 67890] and item numbers ["PART-001", "PART-002"]
+- **THEN** the system creates a SearchCriteria with both collections populated
+- **AND** `WorkOrderFilterEnabled` and `ItemNumberFilterEnabled` both return true
+- **AND** other filter collections remain empty
+
+#### Scenario: Create search with component lot filter
+
+- **WHEN** a user specifies component lot "LOT123" for item "ITEM-ABC"
+- **THEN** the system creates a ComponentLotFilter entry with both LotNumber and ItemNumber
+- **AND** the filter is used to find work orders that consumed material from that lot
+
+#### Scenario: Serialize and deserialize search criteria
+
+- **WHEN** a SearchCriteria object is serialized to JSON and stored
+- **THEN** the system can deserialize it back to the original object structure
+- **AND** all filter collections and values are preserved
+
+---
+
+### Requirement: Query Builder Generation
+
+The system SHALL dynamically generate SQL queries based on enabled filters using SqlKata fluent query builder (replacing the legacy T4 text template).
+
+#### Migration Note: T4 Template Replacement with SqlKata
+
+The legacy system uses a T4 text template (`QueryTemplate.tt`) for SQL generation. T4 templates have limited support in modern .NET SDK-style projects. The new implementation SHALL use **SqlKata** - a fluent SQL query builder that generates parameterized SQL and integrates well with Dapper.
+
+**NuGet Package:** `SqlKata` and `SqlKata.Execution`
+
+**Primary Query Building with SqlKata:**
+
+```csharp
+using SqlKata;
+using SqlKata.Compilers;
+
+public interface ISearchQueryBuilder
+{
+    SearchQueryResult BuildSearchQuery(SearchModel model);
+}
+
+public record SearchQueryResult(string Sql, IDictionary<string, object> Parameters);
+
+public sealed class SqlKataSearchQueryBuilder : ISearchQueryBuilder
+{
+    private readonly SqlServerCompiler _compiler = new();
+
+    public SearchQueryResult BuildSearchQuery(SearchModel model)
+    {
+        var query = new Query("WorkOrder_Curr as wo")
+            .Select("wo.*", "wo.WorkOrderNumber", "wo.ItemNumber", "wo.StatusCode");
+
+        // Conditional joins based on active filters
+        if (model.OperatorFilterEnabled)
+        {
+            query.Join("WorkOrderTime_Curr as wot", "wot.WorkOrderNumber", "wo.WorkOrderNumber");
+        }
+
+        if (model.ProfitCenterFilterEnabled || model.WorkCenterFilterEnabled)
+        {
+            query.Join("WorkOrderStep_Curr as wos", "wos.WorkOrderNumber", "wo.WorkOrderNumber");
+        }
+
+        if (model.ComponentLotFilterEnabled)
+        {
+            query.Join("WorkOrderComponent_Curr as woc", "woc.WorkOrderNumber", "wo.WorkOrderNumber");
+        }
+
+        // Conditional WHERE clauses
+        if (model.TimespanFilterEnabled)
+        {
+            query.WhereBetween("wo.StatusUpdateDT", model.MinimumDT, model.MaximumDT);
+        }
+
+        if (model.WorkOrderFilterEnabled)
+        {
+            query.WhereIn("wo.WorkOrderNumber", model.WorkOrderFilter.Select(w => w.WorkOrderNumber));
+        }
+
+        if (model.ItemNumberFilterEnabled)
+        {
+            query.WhereIn("wo.ItemNumber", model.ItemNumberFilter.Select(i => i.ItemNumber));
+        }
+
+        if (model.OperatorFilterEnabled)
+        {
+            query.WhereIn("wot.OperatorAN", model.OperatorFilter.Select(o => o.AddressNumber));
+        }
+
+        // Compile to SQL + parameters
+        var compiled = _compiler.Compile(query);
+        return new SearchQueryResult(compiled.Sql, compiled.NamedBindings);
+    }
+}
+```
+
+**Complex Query Composition with SqlKata:**
+
+```csharp
+public sealed class ComposableSearchQueryBuilder
+{
+    private readonly SqlServerCompiler _compiler = new();
+
+    public SearchQueryResult BuildFullSearchQuery(SearchModel model)
+    {
+        // Build composable query parts
+        var baseQuery = BuildBaseWorkOrderQuery(model);
+        var filterQuery = ApplyFilters(baseQuery, model);
+        var joinedQuery = ApplyConditionalJoins(filterQuery, model);
+
+        var compiled = _compiler.Compile(joinedQuery);
+        return new SearchQueryResult(compiled.Sql, compiled.NamedBindings);
+    }
+
+    private Query BuildBaseWorkOrderQuery(SearchModel model)
+    {
+        return new Query("WorkOrder_Curr as wo")
+            .Select("wo.WorkOrderNumber", "wo.ItemNumber", "wo.StatusCode",
+                    "wo.StatusUpdateDT", "wo.QuantityOrdered", "wo.QuantityCompleted");
+    }
+
+    private Query ApplyFilters(Query query, SearchModel model)
+    {
+        if (model.TimespanFilterEnabled && model.MinimumDT.HasValue && model.MaximumDT.HasValue)
+        {
+            query = query.WhereBetween("wo.StatusUpdateDT", model.MinimumDT, model.MaximumDT);
+        }
+
+        if (model.WorkOrderFilterEnabled)
+        {
+            query = query.WhereIn("wo.WorkOrderNumber",
+                model.WorkOrderFilter.Select(w => w.WorkOrderNumber).ToList());
+        }
+
+        if (model.ItemNumberFilterEnabled)
+        {
+            query = query.WhereIn("wo.ItemNumber",
+                model.ItemNumberFilter.Select(i => i.ItemNumber).ToList());
+        }
+
+        return query;
+    }
+
+    private Query ApplyConditionalJoins(Query query, SearchModel model)
+    {
+        if (model.ProfitCenterFilterEnabled)
+        {
+            query = query
+                .Join("WorkOrderStep_Curr as wos", "wos.WorkOrderNumber", "wo.WorkOrderNumber")
+                .Join("WorkCenter as wc", "wc.Code", "wos.WorkCenterCode")
+                .Join("OrgHierarchy as oh", "oh.WorkCenterCode", "wc.Code")
+                .WhereIn("oh.ProfitCenterCode",
+                    model.ProfitCenterFilter.Select(p => p.Code).ToList());
+        }
+
+        if (model.WorkCenterFilterEnabled)
+        {
+            query = query
+                .Join("WorkOrderStep_Curr as wos", "wos.WorkOrderNumber", "wo.WorkOrderNumber")
+                .WhereIn("wos.WorkCenterCode",
+                    model.WorkCenterFilter.Select(w => w.Code).ToList());
+        }
+
+        return query;
+    }
+}
+```
+
+**Work Order Traversal (Stored Procedure):**
+
+The iterative downstream work order traversal is implemented as a stored procedure (`dbo.TraverseWorkOrders`) due to its iterative nature with temp tables and MERGE operations. The maximum iteration count is configurable via `SearchProcessingOptions.MaxTraversalIterations` (default: 20):
+
+```csharp
+public class SearchProcessingOptions
+{
+    public const string SectionName = "SearchProcessing";
+    public int MaxTraversalIterations { get; set; } = 20;
+}
+```
+
+**TraverseWorkOrders Stored Procedure Interface:**
+
+```csharp
+public interface IWorkOrderTraversalService
+{
+    Task<List<long>> TraverseDownstreamAsync(
+        IEnumerable<long> seedWorkOrders,
+        CancellationToken ct = default);
+}
+
+public sealed class WorkOrderTraversalService : IWorkOrderTraversalService
+{
+    private readonly IDbConnectionFactory _connectionFactory;
+    private readonly IOptions<SearchProcessingOptions> _options;
+
+    public async Task<List<long>> TraverseDownstreamAsync(
+        IEnumerable<long> seedWorkOrders,
+        CancellationToken ct = default)
+    {
+        await using var connection = await _connectionFactory.CreateLotFinderConnectionAsync(ct);
+
+        var maxIterations = _options.Value.MaxTraversalIterations;
+
+        return (await connection.QueryAsync<long>(
+            "EXEC dbo.TraverseWorkOrders @p_SeedWorkOrders, @p_MaxIterations",
+            new {
+                p_SeedWorkOrders = seedWorkOrders.ToList().AsTableValuedParameter("dbo.WorkOrderList"),
+                p_MaxIterations = maxIterations
+            })).AsList();
+    }
+}
+```
+
+**MIS Query Builder (Separate):**
+
+For MIS data extraction, a separate `IMisQueryBuilder` SHALL be used to generate MIS-specific queries:
+
+```csharp
+public interface IMisQueryBuilder
+{
+    SearchQueryResult BuildMisDataQuery(SearchModel model);
+    SearchQueryResult BuildMisNonMatchQuery(SearchModel model);
+}
+
+public sealed class SqlKataMisQueryBuilder : IMisQueryBuilder
+{
+    private readonly SqlServerCompiler _compiler = new();
+
+    public SearchQueryResult BuildMisDataQuery(SearchModel model)
+    {
+        var query = new Query("MisData as m")
+            .Select("m.*")
+            .Join("WorkOrderStep_Curr as wos", q => q
+                .On("wos.ItemNumber", "m.ItemNumber")
+                .On("wos.OperationNumber", "m.OperationNumber"));
+        // Additional MIS-specific filtering...
+        var compiled = _compiler.Compile(query);
+        return new SearchQueryResult(compiled.Sql, compiled.NamedBindings);
+    }
+
+    public SearchQueryResult BuildMisNonMatchQuery(SearchModel model)
+    {
+        // Investigation query for router mismatches
+        var query = new Query("WorkOrderStep_Curr as wos")
+            .LeftJoin("MisData as m", q => q
+                .On("wos.ItemNumber", "m.ItemNumber")
+                .On("wos.OperationNumber", "m.OperationNumber"))
+            .WhereNull("m.ItemNumber"); // Non-matches
+        var compiled = _compiler.Compile(query);
+        return new SearchQueryResult(compiled.Sql, compiled.NamedBindings);
+    }
+}
+```
+
+**Streaming vs Materialized Results:**
+
+The system SHALL provide two methods for result retrieval:
+
+```csharp
+public interface ISearchResultReader
+{
+    /// <summary>Streaming - returns results as they are read (memory-efficient for large result sets)</summary>
+    IAsyncEnumerable<SearchResult> StreamResultsAsync(int searchId, CancellationToken ct = default);
+
+    /// <summary>Materialized - loads all results into memory (simpler for small result sets)</summary>
+    Task<List<SearchResult>> GetResultsAsync(int searchId, CancellationToken ct = default);
+}
+```
+
+**SqlKata Benefits:**
+
+- **Parameterized by default** - SQL injection protection built-in; all parameters use `@p_*` naming convention for clarity
+- **Fluent API** - Readable, composable query building
+- **Testable** - Unit test query building without database
+- **Type-safe** - Compile-time checking of method calls
+- **SQL Server optimized** - SqlServerCompiler generates optimized T-SQL
+
+**Parameter Naming Convention:**
+
+All SQL parameters SHALL use the `@p_` prefix for consistency:
+- `@p_SeedWorkOrders` (not `@SeedWorkOrders`)
+- `@p_MaxIterations` (not `@MaxIterations`)
+- `@p_MinimumDT`, `@p_MaximumDT`, etc.
+
+#### Inputs
+
+- `SearchModel` containing filter criteria and enabled filter flags
+- Table-valued parameters for each enabled filter type
+
+#### Outputs
+
+- Complete T-SQL query string including:
+  - Temporary table creation statements
+  - Filter parameter population
+  - Work order flagging logic
+  - Downstream work order traversal
+  - Final result selection
+  - Optional MIS data extraction queries
+
+#### Business Rules
+
+- The query builder MUST create a `#Temp_WO` temporary table to track flagged work orders
+- The builder SHALL include SQL segments only for enabled filters (conditional generation)
+- Work order step searching is triggered when any of these filters are enabled: timespan, profit center, work center, or operator
+- The query MUST perform iterative downstream traversal (up to 20 iterations) to find work orders that received material from flagged work orders
+- Split orders (orders created by splitting a parent order) SHALL be automatically included
+- Query parameters MUST be passed as table-valued parameters for multi-value filters
+
+#### Scenario: Generate query with work order filter only
+
+- **WHEN** search criteria includes only work order numbers [12345, 67890]
+- **THEN** the system generates SQL that creates `#Temp_WO` with ManuallySpecified flag
+- **AND** includes MERGE statements to add specified work orders
+- **AND** includes downstream traversal logic for related work orders
+- **AND** excludes timespan, profit center, work center, and operator filter logic
+
+#### Scenario: Generate query with profit center filter
+
+- **WHEN** search criteria includes profit center codes ["PC01", "PC02"]
+- **THEN** the system generates SQL that creates `#P_WorkCenters` temp table
+- **AND** populates it by joining profit center codes to work centers via `OrgHierarchy`
+- **AND** includes work order step search logic with profit center join
+- **AND** sets `ShouldSearchSteps()` to return true
+
+#### Scenario: Generate query with all filters enabled
+
+- **WHEN** search criteria includes values for all eight filter types
+- **THEN** the system generates SQL with all conditional segments included
+- **AND** joins all filter temp tables appropriately
+- **AND** includes MIS extraction queries when `ExtractMisData` is true
+
+#### Scenario: Generate query with operator filter
+
+- **WHEN** search criteria includes operator user IDs ["USER1", "USER2"]
+- **THEN** the system generates SQL that creates `#P_OperatorIDs` temp table
+- **AND** resolves user IDs to address numbers via `JdeUser` table
+- **AND** joins work order time records to filter by operator
+
+---
+
+### Requirement: Filter Entry Processing
+
+The system SHALL enrich raw filter values with descriptive information from reference tables using C# record types for immutability.
+
+#### Filter Entry Location
+
+Filter entry types SHALL be located in the `JdeScoping.Core.Models` namespace within the Domain Models project, not in a separate processing project. This ensures proper separation of domain models from processing logic.
+
+#### Migration Note: Record Types
+
+The legacy filter entry classes should be converted to C# record types for value semantics and immutability:
+
+```csharp
+// File: JdeScoping.Core/Models/FilterEntries.cs
+namespace JdeScoping.Core.Models;
+
+// Legacy class pattern
+public class WorkOrderFilterEntry
+{
+    public long WorkOrderNumber { get; set; }
+    public string ItemNumber { get; set; }
+}
+
+// Modern record pattern
+public record WorkOrderFilterEntry(long WorkOrderNumber, string ItemNumber);
+
+// With attributes for Excel output configuration
+[OutputTable(TabName = "Work Order Filter", ShowHeader = true)]
+public record WorkOrderFilterEntry(
+    [property: OutputColumn(Order = 10, HeaderText = "Work Order Number")]
+    long WorkOrderNumber,
+    [property: OutputColumn(Order = 20, HeaderText = "Item Number")]
+    string ItemNumber
+);
+```
+
+Records provide:
+- Immutability by default (init-only properties)
+- Value-based equality
+- Built-in `ToString()` and deconstruction
+- Cleaner syntax for data transfer objects
+
+#### Inputs
+
+- Raw filter values from `SearchCriteria` (IDs, codes, numbers)
+- Reference data from `LotFinderDB` lookup methods
+
+#### Outputs
+
+- Enriched filter entry records containing:
+  - `WorkOrderFilterEntry`: WorkOrderNumber + ItemNumber
+  - `ItemNumberFilterEntry`: ItemNumber + ItemDescription
+  - `ProfitCenterFilterEntry`: Code + Description
+  - `WorkCenterFilterEntry`: Code + Description
+  - `OperatorFilterEntry`: AddressNumber + UserID + FullName
+  - `ComponentLotFilterEntry`: LotNumber + ItemNumber
+  - `ItemOperationMisFilterEntry`: ItemNumber + OperationNumber + MisNumber + MisRevision
+
+#### Business Rules
+
+- Filter entries SHALL be populated via `LotFinderDB` lookup methods
+- Lookup methods MUST return empty collections for invalid or unmatched values
+- Operator filter entries MUST resolve user IDs to address numbers for query execution
+- Component lot entries MUST include both lot number and item number for proper traceability
+
+#### Scenario: Enrich work order filter entries
+
+- **WHEN** the system processes work order numbers [12345, 67890]
+- **THEN** it calls `LotFinderDB.LookupWorkorders()` with the numbers
+- **AND** creates `WorkOrderFilterEntry` records with work order number and item number
+- **AND** includes only work orders that exist in the database
+
+#### Scenario: Resolve operator user IDs to address numbers
+
+- **WHEN** the system processes operator user IDs ["JSMITH", "MBROWN"]
+- **THEN** it calls `LotFinderDB.LookupUsers()` to get JDE user records
+- **AND** creates `OperatorFilterEntry` records with AddressNumber, UserID, and FullName
+- **AND** the AddressNumber is used for joining to work order time records
+
+#### Scenario: Handle invalid filter values
+
+- **WHEN** the system processes item numbers containing non-existent items
+- **THEN** the lookup returns only matching items
+- **AND** non-existent item numbers are silently excluded from results
+
+#### Scenario: Process component lot filter with item validation
+
+- **WHEN** the system processes a component lot filter entry
+- **THEN** it validates both lot number and item number exist together
+- **AND** uses the combination to trace downstream work orders via `WorkOrderComponent` and `LotUsage` tables
+
+---
+
+### Requirement: Work Order Flagging and Traversal
+
+The system SHALL flag work orders for inclusion based on multiple criteria and traverse downstream relationships.
+
+#### Inputs
+
+- Filter criteria from `SearchModel`
+- Work order relationships from database tables:
+  - `WorkOrder` (parent/child via ParentWorkOrderNumber)
+  - `WorkOrderComponent` (parts list relationships)
+  - `LotUsage` (CARDEX material usage)
+  - `WorkOrderStep` (operation details)
+  - `WorkOrderTime` (operator time records)
+
+#### Outputs
+
+- `#Temp_WO` temporary table containing:
+  - `WorkOrderNumber`: Primary key
+  - `LotNumber`: Associated lot number
+  - `BranchCode`: Branch code for the work order
+  - `ShortItemNumber`: Item's short number
+  - `ManuallySpecified`: Flag indicating direct specification
+  - `SplitOrder`: Flag indicating split from flagged order
+  - `CARDEX`: Flag indicating material receipt from flagged order (F4111) - **Note: Also set for WorkOrderComponent matches**
+  - `PartsList`: Flag indicating parts list relationship (F3111)
+  - `Flagged`: Flag indicating filter criteria match
+
+#### Business Rules
+
+- Work orders directly specified in the filter SHALL be marked with `ManuallySpecified = 1`
+- Work orders split from flagged orders (matching `ParentWorkOrderNumber`) SHALL be marked with `SplitOrder = 1`
+- Work orders receiving material from flagged lots via `WorkOrderComponent` SHALL be marked with `CARDEX = 1` (not PartsList as might be expected)
+- Work orders receiving material from flagged lots via `LotUsage` SHALL be marked with `CARDEX = 1`
+- Work orders matching filter criteria (timespan, profit center, work center, operator) SHALL be marked with `Flagged = 1`
+- Downstream traversal SHALL iterate up to 20 times to find all related work orders
+- Traversal stops when no new work orders are found or maximum iterations reached
+
+#### Scenario: Flag manually specified work orders
+
+- **WHEN** work order 12345 is specified in the work order filter
+- **THEN** the system marks it with `ManuallySpecified = 1` in `#Temp_WO`
+- **AND** finds any split orders from 12345 and marks them with `SplitOrder = 1`
+
+#### Scenario: Trace downstream work orders via parts list
+
+- **WHEN** work order 12345 produces lot "LOT-A" for item "ITEM-001"
+- **AND** work order 67890 consumes "LOT-A" for "ITEM-001" via parts list
+- **THEN** work order 67890 is added to `#Temp_WO` with `CARDEX = 1`
+
+#### Scenario: Trace downstream work orders via CARDEX
+
+- **WHEN** work order 12345 produces lot "LOT-A"
+- **AND** work order 67890 consumes "LOT-A" via LotUsage (CARDEX)
+- **THEN** work order 67890 is added to `#Temp_WO` with `CARDEX = 1`
+
+#### Scenario: Multi-level downstream traversal
+
+- **WHEN** work order A produces material consumed by work order B
+- **AND** work order B produces material consumed by work order C
+- **THEN** the iterative traversal finds A, B, and C
+- **AND** marks each with appropriate flags based on relationship type
+
+---
+
+### Requirement: Search Result Aggregation
+
+The system SHALL aggregate flagged work orders into structured result objects with complete details.
+
+#### Inputs
+
+- Flagged work orders from `#Temp_WO`
+- Work order details from `WorkOrder` table
+- Item details from `Item` table
+- Status details from `StatusCode` table
+- Latest step from `WorkOrderStep` table
+- Scrap totals from `WorkOrderTotalScrap` table
+
+#### Outputs
+
+- `SearchResult` objects containing:
+  - Work order identification (number, branch code, lot number, item number)
+  - Item details (planning family, stocking type)
+  - Quantities (order, held, scrapped, shipped)
+  - Latest operation step details
+  - Status information (code, description, update timestamp)
+  - Inclusion reason derived from flag combination
+
+#### Business Rules
+
+- Each result SHALL include the latest operation step (highest EndDT, then highest StepNumber)
+- Inclusion reason SHALL be calculated with strict priority order:
+  1. **ManuallySpecified** (highest) - Work order was directly specified in filter
+  2. **Flagged** - Work order matched timespan/profit center/work center/operator criteria
+  3. **ComponentUsage** - Work order received material from a flagged work order
+  4. **SplitOrder** (lowest) - Work order was split from a flagged parent order
+- Component usage reason SHALL distinguish between CARDEX only, Parts List only, or both
+- Scrapped quantity SHALL default to 0 when no scrap records exist
+- Results with null latest step are still included (work orders without operations)
+- Inclusion reason MAY return "UNKNOWN" when no flags are set (edge case)
+
+#### Scenario: Generate inclusion reason for manually specified order
+
+- **WHEN** a work order is marked with `ManuallySpecified = 1`
+- **THEN** the `InclusionReason` property returns "ManuallySpecified"
+
+#### Scenario: Generate inclusion reason for flagged order
+
+- **WHEN** a work order is marked with `Flagged = 1` and `ManuallySpecified = 0`
+- **THEN** the `InclusionReason` property returns "Flagged"
+
+#### Scenario: Generate inclusion reason for component usage with both sources
+
+- **WHEN** a work order is marked with `CARDEX = 1` and `PartsList = 1`
+- **THEN** the `InclusionReason` property returns "ComponentUsage (CARDEX + Parts List)"
+
+#### Scenario: Retrieve latest operation step for work order
+
+- **WHEN** work order 12345 has steps 10, 20, 30 with EndDT values
+- **THEN** the result includes the step with the highest EndDT
+- **AND** if EndDT values tie, the highest StepNumber wins
+
+---
+
+### Requirement: MIS Data Extraction
+
+The system SHALL optionally extract Manufacturing Information System (MIS) data for matching work orders.
+
+#### Inputs
+
+- `ExtractMisData` flag from search criteria
+- `ItemOperationMisFilter` entries (when filtering by specific MIS)
+- Work order step data joined with MIS matching function `dbo.MatchMIS`
+
+#### Outputs
+
+- `MisSearchResult` objects containing:
+  - Item and MIS identification
+  - Matching indicators (RoutingMatch, MasterMatch)
+  - Test descriptions, sampling information
+  - Tools/gauges and work instructions
+- `MisNonMatchSearchResult` objects containing:
+  - Work orders with steps that did not match MIS records
+  - Added job step indicators
+  - Matched job step suggestions based on work center and function code
+
+#### Business Rules
+
+- MIS extraction is only performed when `ExtractMisData = true`
+- The `MatchMIS` table-valued function handles MIS record matching logic
+- RoutingMatch indicates match to F3112Z1 (work order routing) records
+- MasterMatch indicates match to F3003 (item master routing) records
+- Non-match results include work orders where neither RoutingMatch nor MasterMatch is true, or MisNumber is null
+- Added job step detection uses routing type and F3111 records to identify manually added steps
+- Matched job step number suggests alternative step matching by work center and function code
+- **Note**: MIS extraction does NOT join `#Temp_WO` - work order/component lot filters do NOT constrain MIS results
+- **Note**: Timespan filtering in MIS extraction requires BOTH min and max values for the combined condition; separate handling exists for min-only or max-only cases
+
+#### Scenario: Extract MIS data for filtered work orders
+
+- **WHEN** search criteria has `ExtractMisData = true`
+- **THEN** the system generates MIS extraction queries
+- **AND** populates `#TempMisData` with MIS-matched step data
+- **AND** returns `MisSearchResult` list with matching records
+
+#### Scenario: Identify MIS non-matches for investigation
+
+- **WHEN** MIS data is extracted and a step has no routing or master match
+- **THEN** the system includes it in `MisNonMatchSearchResult` list
+- **AND** indicates whether the job step was added (not in original routing)
+- **AND** suggests matched job step number if one exists with same work center and function code
+
+#### Scenario: Filter by specific MIS number and revision
+
+- **WHEN** search criteria includes ItemOperationMisFilter with specific MIS entries
+- **THEN** the query joins to `#P_PartOperations` temp table
+- **AND** only returns work order steps matching the specified item/operation/MIS/revision combinations
+- **AND** the WorkOrderTime UNION branch is skipped (only WorkOrderStep branch used)
+
+#### Scenario: Handle NMR routing type
+
+- **WHEN** a work order has routing type "NMR" (No Master Routing)
+- **THEN** all job steps are considered added (`WasJobStepAdded = 1`)
+- **AND** matched job step number is null (no routing to match against)
+
+---
+
+### Requirement: Table-Valued Parameter Creation
+
+The system SHALL create SQL table-valued parameters for efficient filter data transmission using Microsoft.Data.SqlClient.
+
+#### Migration Note: SqlClient and TVP Options
+
+**SQL Client Package Change (Required)**
+
+Replace `System.Data.SqlClient` with `Microsoft.Data.SqlClient`:
+
+```csharp
+// Legacy
+using System.Data.SqlClient;
+
+// Modern .NET 10
+using Microsoft.Data.SqlClient;
+```
+
+This is a cross-cutting change affecting all database access code. The API is largely compatible but `Microsoft.Data.SqlClient` is the actively maintained package with security updates.
+
+**TVP Implementation Options**
+
+The legacy approach using `DataTable` remains valid. An alternative using `IEnumerable<SqlDataRecord>` offers better performance for large datasets:
+
+```csharp
+// Option 1: DataTable approach (legacy pattern, still supported)
+public static SqlMapper.ICustomQueryParameter CreateWorkOrderFilterParameter(
+    this SearchModel model)
+{
+    var dataTable = new DataTable();
+    dataTable.Columns.Add("WorkOrderNumber", typeof(long));
+    foreach (var entry in model.WorkOrderFilter)
+    {
+        dataTable.Rows.Add(entry.WorkOrderNumber);
+    }
+    return dataTable.AsTableValuedParameter("WorkOrderFilterParameter");
+}
+
+// Option 2: SqlDataRecord approach (more efficient for large datasets)
+public static IEnumerable<SqlDataRecord> ToWorkOrderRecords(
+    this IEnumerable<WorkOrderFilterEntry> entries)
+{
+    var metadata = new SqlMetaData("WorkOrderNumber", SqlDbType.BigInt);
+    var record = new SqlDataRecord(metadata);
+
+    foreach (var entry in entries)
+    {
+        record.SetInt64(0, entry.WorkOrderNumber);
+        yield return record;
+    }
+}
+```
+
+#### Inputs
+
+- `SearchModel` with populated filter entry collections
+- SQL Server table type definitions for each parameter type
+
+#### Outputs
+
+- `SqlMapper.ICustomQueryParameter` objects created via `AsTableValuedParameter()`:
+  - `WorkOrderFilterParameter`: WorkOrderNumber column
+  - `ItemNumberFilterParameter`: ItemNumber column
+  - `ProfitCenterFilterParameter`: Code column
+  - `WorkCenterFilterParameter`: Code column
+  - `ComponentLotFilterParameter`: ComponentLotNumber + ItemNumber columns
+  - `OperatorFilterParameter`: UserName column
+  - `ItemOperationMisFilterParameter`: ItemNumber + OperationNumber + MisNumber + MisRevision columns
+
+#### Business Rules
+
+- Each parameter type MUST match the corresponding SQL Server table type schema
+- DataTable column types MUST match the expected SQL types (long, string)
+- Parameters are created even for empty filter collections (empty DataTable)
+- Operator filter uses UserID (not AddressNumber) as the parameter value
+- All database operations SHOULD use async methods (`QueryAsync`, `ExecuteAsync`)
+
+#### Scenario: Create work order filter parameter
+
+- **WHEN** SearchModel contains WorkOrderFilter with entries [12345, 67890]
+- **THEN** the system creates a DataTable with WorkOrderNumber column
+- **AND** populates two rows with the work order numbers
+- **AND** returns parameter of type "WorkOrderFilterParameter"
+
+#### Scenario: Create component lot filter parameter
+
+- **WHEN** SearchModel contains ComponentLotFilter with lot "LOT-A" for item "ITEM-001"
+- **THEN** the system creates a DataTable with ComponentLotNumber and ItemNumber columns
+- **AND** populates one row with both values
+- **AND** returns parameter of type "ComponentLotFilterParameter"
+
+#### Scenario: Create empty filter parameter
+
+- **WHEN** SearchModel contains empty WorkOrderFilter collection
+- **THEN** the system creates a DataTable with WorkOrderNumber column
+- **AND** the DataTable has zero rows
+- **AND** returns valid parameter that produces empty result set
+
+#### Scenario: Create item operation MIS filter parameter
+
+- **WHEN** SearchModel contains ItemOperationMisFilter with one entry
+- **THEN** the system creates a DataTable with four columns
+- **AND** populates ItemNumber, OperationNumber, MisNumber, MisRevision
+- **AND** returns parameter of type "ItemOperationMisFilterParameter"
+
+---
+
+### Requirement: Output Column Configuration
+
+The system SHALL use attribute-based configuration for Excel output column formatting.
+
+#### Migration Note: Attributes and Reflection
+
+The attribute-based pattern works well in .NET 10 with standard reflection. For high-performance scenarios, consider:
+
+1. **Source generators** - Generate column metadata at compile time
+2. **Cached reflection** - Cache `PropertyInfo` and attribute lookups on first access
+
+```csharp
+// Attribute pattern preserved from legacy (works with records)
+[OutputTable(TabName = "Search Results", TableName = "Search_Results")]
+public record SearchResult(
+    [property: OutputColumn(Order = 10, HeaderText = "Work Order")]
+    long WorkOrderNumber,
+
+    [property: OutputColumn(Order = 20, HeaderText = "Status Date",
+              Format = OutputColumnAttribute.DATE_FORMAT)]
+    DateTime? StatusUpdateDT
+);
+
+// Cached reflection helper
+public static class OutputColumnCache
+{
+    private static readonly ConcurrentDictionary<Type, IReadOnlyList<OutputColumn>> _cache = new();
+
+    public static IReadOnlyList<OutputColumn> GetColumns<T>() =>
+        _cache.GetOrAdd(typeof(T), type => BuildColumns(type));
+}
+```
+
+#### Inputs
+
+- `OutputColumnAttribute` on result model properties:
+  - `Order`: Display order (integer)
+  - `HeaderText`: Column header text
+  - `Format`: Excel format string
+  - `AutoWidth`: Whether to auto-size column
+  - `Width`: Manual width when AutoWidth is false
+  - `WrapText`: Whether to wrap text in cells
+- `OutputTableAttribute` on result model classes:
+  - `TabName`: Excel worksheet tab name
+  - `TableName`: Table identifier for styling
+  - `ShowHeader`: Whether to display merged header
+
+#### Outputs
+
+- `OutputColumn` objects combining property info with attribute metadata
+- Configured Excel worksheets with proper formatting
+
+#### Business Rules
+
+- Columns are ordered by the `Order` attribute value (ascending)
+- Properties without `OutputColumnAttribute` are excluded from output
+- Standard format `"@"` treats values as text
+- Date format `"[$-409]MM/dd/yyyy;@"` applies US English date formatting
+- Timestamp format `"[$-409]m/d/yy h:mm AM/PM;@"` includes time component
+- Wrapped columns use fixed width of 65 characters by default
+- Filter entry tables show headers; result tables do not
+
+#### Scenario: Configure date column formatting
+
+- **WHEN** a property has `Format = OutputColumnAttribute.DATE_FORMAT`
+- **THEN** Excel displays values in MM/dd/yyyy format
+- **AND** the column width auto-sizes to fit content
+
+#### Scenario: Configure wrapped text column
+
+- **WHEN** a property has `WrapText = true` and `AutoWidth = false`
+- **THEN** Excel wraps long text within the cell
+- **AND** column width is set to `WRAPPED_COLUMN_WIDTH` (65 characters)
+
+#### Scenario: Order columns in output
+
+- **WHEN** SearchResult has properties with Order values 10, 20, 30
+- **THEN** Excel columns appear in ascending order by the Order value
+- **AND** gaps in Order values are allowed
+
+#### Scenario: Configure tab name for result type
+
+- **WHEN** SearchResult has `OutputTableAttribute` with `TabName = "Search Results"`
+- **THEN** the Excel worksheet tab is named "Search Results"
+- **AND** the table is styled with identifier "Search_Results"
+
+---
+
+## Migration Notes
+
+| Legacy Pattern | New Pattern | Rationale |
+|----------------|-------------|-----------|
+| T4 Text Template (`QueryTemplate.tt`) | **SqlKata** fluent query builder | SqlKata provides parameterized SQL by default, fluent API, composable queries, testability, and SQL Server-optimized output; T4 templates are not well-supported in modern .NET SDK projects |
+| Iterative work order traversal in T4 | Stored procedure `dbo.TraverseWorkOrders` | Iterative logic with temp tables and MERGE is better handled server-side; stored procedure reduces round trips and is transactionally consistent |
+| `System.Data.SqlClient` | `Microsoft.Data.SqlClient` | Legacy package is deprecated and no longer receives security updates; Microsoft.Data.SqlClient is the supported replacement |
+| Filter entry classes | C# record types | Records provide immutability, value equality, and cleaner syntax for DTOs |
+| Synchronous Dapper calls | Async Dapper methods (`QueryAsync`, `ExecuteAsync`) | Async operations improve scalability and are idiomatic in modern .NET |
+| `DataTable.AsTableValuedParameter()` | DataTable (unchanged) or `IEnumerable<SqlDataRecord>` | DataTable approach works; SqlDataRecord is more efficient for large datasets |
+| Conditional string concatenation in T4 | SqlKata fluent conditional methods (`.Join()`, `.WhereIn()`, `.When()`) | SqlKata handles conditional query building natively with compile-time safety |
+| `SqlMapper.ICustomQueryParameter` (Dapper) | Dapper table-valued parameters (unchanged) | Dapper's API remains compatible in .NET 10 |
+| Attribute-based output configuration | Attributes with optional cached reflection | Attributes work well; cached reflection improves performance |
+| Newtonsoft.Json for criteria serialization | System.Text.Json (recommended) or Newtonsoft.Json | System.Text.Json is built-in with better performance; Newtonsoft.Json works if polymorphism needed |
+
+### SqlKata Integration
+
+**NuGet Packages:**
+- `SqlKata` - Core query builder
+- `SqlKata.Execution` - Dapper integration for query execution
+
+**DI Registration:**
+```csharp
+services.AddScoped<ISearchQueryBuilder, SqlKataSearchQueryBuilder>();
+services.AddScoped<IWorkOrderTraversalService, WorkOrderTraversalService>();
+services.AddSingleton<SqlServerCompiler>();
+```
+
+**SqlKata with Dapper Execution:**
+```csharp
+// Build query with SqlKata
+var (sql, parameters) = _queryBuilder.BuildSearchQuery(model);
+
+// Execute with Dapper
+var results = await connection.QueryAsync<SearchResult>(sql, parameters);
+```
+
+## Design Decisions
+
+### Decision: 20-iteration limit for downstream traversal
+
+The 20-iteration limit (`@c_MAX_RUNS INT = 20`) for downstream work order traversal is **retained as a fixed value**. Rationale:
+- Manufacturing processes rarely exceed 20 levels of downstream consumption
+- A configurable limit adds complexity without practical benefit
+- The limit protects against runaway queries from circular references
+
+### Decision: Circular reference handling
+
+Circular references in work order relationships are **handled implicitly** by the MERGE statement's `ON` clause. When a work order is already in `#Temp_WO`, the MERGE updates rather than inserts, preventing infinite loops. No additional detection logic is required.
+
+### Decision: MIS non-match results
+
+MIS non-match results are **always included** when `ExtractMisData = true`. The non-match data is valuable for quality investigations and should not be optional.
+
+### Decision: MatchMIS function availability
+
+The `dbo.MatchMIS` table-valued function **must be recreated** in the migrated database. It is a custom SQL Server function that implements MIS record matching logic based on work order routing, master routing, and operation parameters.
+
+### Decision: Filter validation location
+
+Filter validation (e.g., requiring at least one filter) is enforced **at the UI/API level**, not in the model. This allows the model to represent any valid state while the API layer enforces business rules about minimum filter requirements.
+
+### Decision: Large result set handling
+
+Large result sets are handled via **streaming to Excel**. The EPPlus library supports streaming writes, and the existing pattern of writing directly to the output stream is preserved. Pagination is not implemented at the search level.
+
+---
+
+## Codex Review Findings (Spec Accuracy Issues)
+
+The following inaccuracies were identified during review and have been addressed in this specification:
+
+1. **MIS Extraction Not Filtered**: ~~The spec states MIS extraction joins `#Temp_WO` or `#P_PartOperations` to constrain results.~~ **CORRECTED**: Spec now documents that MIS extraction does NOT join `#Temp_WO`, so work-order/component-lot/item-operation-MIS filters do NOT constrain MIS results. See `QueryTemplate.tt:173,353`.
+
+2. **Timespan Filter Requires Both Bounds**: ~~The spec says either min or max boundary enables filtering.~~ **CORRECTED**: Spec now documents that the `LU_WO` timespan filtering requires BOTH min and max values for the combined condition, with separate handling for MIS-only min/max cases. See `QueryTemplate.tt:254,371`, `LotFinderDBExt.cs:157`.
+
+3. **WorkOrderComponent Flagged as CARDEX**: ~~The spec implies `PartsList` flag is set for WorkOrderComponent paths.~~ **CORRECTED**: Spec now explicitly states component-lot matches from `WorkOrderComponent` are flagged as CARDEX, not PartsList. See `QueryTemplate.tt:105`.
+
+4. **ItemOperationMisFilter Skips WorkOrderTime**: ~~Not documented.~~ **CORRECTED**: Spec now documents that when `ItemOperationMisFilterEnabled` is true, the WorkOrderTime UNION branch is skipped. See `QueryTemplate.tt:258`.
+
+5. **InclusionReason Edge Cases**: ~~Spec mentions "Split order" but not "UNKNOWN" case.~~ **CORRECTED**: Spec now documents that `InclusionReason` can return `"UNKNOWN"` when no flags are set. See `SearchResult.cs:152`.
+
+6. **Error Handling Not Documented**: Query timeout, debug SQL/Excel writes, and marking search failed on exception are legacy behaviors addressed in the separate error-handling specification. See `LotFinderDBExt.cs:136`, `WorkProcessor.cs:158`.
@@ -0,0 +1,302 @@
+# SQL Business Logic Specification
+
+## Purpose
+
+This specification documents stored procedures and functions that implement database-level business logic for the search processing workflow. These SQL objects manage the lifecycle of search requests (submission, execution, completion) and provide complex matching logic for Manufacturing Information System (MIS) data.
+
+## Source Reference
+
+| Legacy File | Purpose |
+|-------------|---------|
+| OLD/Database/StoredProcedures/SubmitSearch.sql | Create new search record with Queued status |
+| OLD/Database/StoredProcedures/StartSearch.sql | Transition search to Processing status |
+| OLD/Database/StoredProcedures/CompleteSearch.sql | Finalize search with results or failure |
+| OLD/Database/StoredProcedures/ResetPartialSearches.sql | Recovery procedure for stuck searches |
+| OLD/Database/Functions/MatchMis.sql | MIS data matching based on routing/master |
+
+## Requirements
+
+### Requirement: Submit search procedure
+
+The system SHALL provide a SubmitSearch stored procedure that creates new search records in the database.
+
+#### Inputs
+
+- @p_UserName (VARCHAR(128)) - Username of the person submitting the search
+- @p_Name (VARCHAR(128)) - User-provided name/description for the search
+- @p_Criteria (VARCHAR(MAX)) - JSON-serialized search criteria
+
+#### Outputs
+
+- @o_SearchID (INT OUTPUT) - The auto-generated ID of the newly created search record
+
+#### Business Rules
+
+- The procedure SHALL insert a new record into the Search table
+- Status SHALL be set to 1 (Queued) for all new searches
+- SubmitDT SHALL be set to the current date/time via GETDATE()
+- The new SearchId SHALL be retrieved using SCOPE_IDENTITY() to ensure the correct ID in concurrent scenarios
+
+#### Scenario: Submit new search
+
+- **WHEN** SubmitSearch is called with valid username, search name, and criteria
+- **THEN** a new Search record is inserted with Status = 1 (Queued)
+- **AND** SubmitDT is set to the current timestamp
+- **AND** the new SearchId is returned via the @o_SearchID OUTPUT parameter
+
+#### Scenario: Concurrent search submissions
+
+- **WHEN** multiple users submit searches simultaneously
+- **THEN** each call returns the correct SearchId via SCOPE_IDENTITY()
+- **AND** no cross-session ID contamination occurs
+
+---
+
+### Requirement: Start search procedure
+
+The system SHALL provide a StartSearch stored procedure that marks a search as being actively processed.
+
+#### Inputs
+
+- @p_SearchID (INT) - The ID of the search to start processing
+
+#### Outputs
+
+- None (procedure updates record in place)
+
+#### Business Rules
+
+- The procedure SHALL update the Status to 2 (Processing)
+- The procedure SHALL set StartDT to the current date/time via GETDATE()
+- Only the search record matching the provided ID SHALL be updated
+
+#### Scenario: Start processing a queued search
+
+- **WHEN** StartSearch is called with a valid SearchID
+- **THEN** the search Status is updated to 2 (Processing)
+- **AND** StartDT is set to the current timestamp
+
+---
+
+### Requirement: Complete search procedure
+
+The system SHALL provide a CompleteSearch stored procedure that finalizes a search with results or failure status.
+
+#### Inputs
+
+- @p_SearchID (INT) - The ID of the search to complete
+- @p_WasSuccessful (BIT) - Flag indicating success (1) or failure (0)
+- @p_Results (VARBINARY(MAX)) - Binary Excel file data (may be NULL on failure)
+
+#### Outputs
+
+- None (procedure updates record in place)
+
+#### Business Rules
+
+- When @p_WasSuccessful = 1, Status SHALL be set to 3 (Complete)
+- When @p_WasSuccessful = 0, Status SHALL be set to 4 (Failed)
+- The Results column SHALL be updated with the provided binary data
+- EndDT SHALL be set to the current date/time via GETDATE()
+
+#### Scenario: Complete successful search
+
+- **WHEN** CompleteSearch is called with WasSuccessful = 1 and Excel binary data
+- **THEN** the search Status is updated to 3 (Complete)
+- **AND** the Results column contains the Excel binary
+- **AND** EndDT is set to the current timestamp
+
+#### Scenario: Complete failed search
+
+- **WHEN** CompleteSearch is called with WasSuccessful = 0
+- **THEN** the search Status is updated to 4 (Failed)
+- **AND** EndDT is set to the current timestamp
+
+---
+
+### Requirement: Reset partial searches procedure
+
+The system SHALL provide a ResetPartialSearches stored procedure that recovers searches stuck in a processing state.
+
+#### Inputs
+
+- None (parameterless procedure)
+
+#### Outputs
+
+- None (procedure updates records in place)
+
+#### Business Rules
+
+- The procedure SHALL identify searches where StartDT IS NOT NULL AND EndDT IS NULL
+- These searches represent work that was started but never completed (e.g., service crash)
+- Status SHALL be reset to 1 (Queued) for all identified searches
+- StartDT SHALL be set to NULL to allow re-processing
+
+#### Scenario: Service restart recovery
+
+- **WHEN** the worker service starts and calls ResetPartialSearches
+- **THEN** all searches with StartDT set but EndDT NULL are reset
+- **AND** Status is changed back to 1 (Queued)
+- **AND** StartDT is cleared to NULL
+- **AND** these searches become eligible for re-processing
+
+#### Scenario: No stuck searches
+
+- **WHEN** ResetPartialSearches is called with no searches in partial state
+- **THEN** no records are modified
+
+---
+
+### Requirement: MIS matching function
+
+The system SHALL provide a MatchMIS table-valued function that correlates work order operations with Manufacturing Information System (MIS) quality documents.
+
+#### Inputs
+
+- @workOrderNumber (BIGINT) - Work order number to match
+- @itemNumber (VARCHAR(25)) - Item/part number
+- @branchCode (VARCHAR(12)) - Branch/plant code
+- @routingType (VARCHAR(3)) - Routing type identifier
+- @issueDate (DATETIME) - Issue date for routing validity
+- @workCenterCode (VARCHAR(12)) - Work center identifier
+- @sequenceNumber (DECIMAL(7,2)) - Operation sequence number
+- @steptimestamp (DATETIME) - Timestamp of the operation step
+- @functionCode (VARCHAR(15)) - Function/operation code
+- @functionOperationDescription (VARCHAR(80)) - Description of the operation
+
+#### Outputs
+
+Returns a table with the following columns:
+- WorkOrderNumber, ItemNumber, ItemDescription, BranchCode, WorkCenterCode
+- StepTimestamp, SequenceNumber, FunctionCode, FunctionOperationDescription
+- MatchedSequenceNumber (DECIMAL(7,2)) - Sequence number used for MIS lookup
+- RoutingMatch (BIT) - Whether match came from work order routing
+- MasterMatch (BIT) - Whether match came from route master
+- MisNumber, RevID, CharNumber, MisSequenceNumber (VARCHAR(32)) - MIS document identifiers
+- TestDescription, ToolsGauges, WorkInstructions (VARCHAR(2000)) - MIS content
+- SamplingType, SamplingValue, Status (VARCHAR(32)) - MIS metadata
+- ReleaseDate (DATETIME) - MIS document release date
+
+#### Business Rules
+
+1. **Parent Work Order Resolution**: The function SHALL resolve to the parent work order number if available (using TRY_CONVERT to handle non-numeric parent references)
+
+2. **Sequence Number Alias Discovery**: The function SHALL find alias sequence numbers using a two-tier approach:
+   - First, check WorkOrderRouting (F3112Z1) for matches on work center and function code using the earliest transaction date
+   - If no routing matches exist, check RouteMaster (F3003) for matches within the issue date validity range
+
+3. **MIS Matching Priority**: The function SHALL attempt MIS matching in priority order:
+   - First priority: Match MisData records with Status = 'Current' where steptimestamp falls within ReleaseDate to ObsoleteDate
+   - Second priority: Match MisData records with Status = 'BackLevel' where ReleaseDate falls between issueDate and steptimestamp
+   - Third priority: Return alias information without MIS data if aliases exist but no MIS match
+   - Fourth priority: Return input parameters with NULL matched sequence and both match flags = 0
+
+4. **Item Description Lookup**: The function SHALL lookup and include the item description from the Item table
+
+5. **Date Range Handling**: NULL ReleaseDate SHALL be treated as '1970-01-01', NULL ObsoleteDate SHALL be treated as '2029-01-01'
+
+#### Scenario: Match via work order routing with current MIS
+
+- **WHEN** MatchMIS is called for a work order with routing data
+- **AND** a current MIS document exists for the matched sequence
+- **THEN** results include RoutingMatch = 1 and full MIS details
+- **AND** MasterMatch indicates whether route master also matched
+
+#### Scenario: Match via route master when no routing exists
+
+- **WHEN** MatchMIS is called for a work order without specific routing
+- **AND** a route master entry exists for the item/branch/work center
+- **THEN** results include MasterMatch = 1 and RoutingMatch = 0
+- **AND** MIS details are included if available
+
+#### Scenario: BackLevel MIS fallback
+
+- **WHEN** no current MIS document matches
+- **AND** a BackLevel MIS document exists with ReleaseDate in the valid range
+- **THEN** results include the BackLevel MIS details with Status = 'BackLevel'
+
+#### Scenario: No MIS match found
+
+- **WHEN** no MIS documents match the routing or master sequence
+- **THEN** results include the input parameters with alias information
+- **AND** MIS-specific columns are NULL
+
+#### Scenario: No routing or master match
+
+- **WHEN** no work order routing or route master entries match
+- **THEN** results include input parameters only
+- **AND** MatchedSequenceNumber is NULL
+- **AND** RoutingMatch = 0 and MasterMatch = 0
+
+## Search Status Codes
+
+| Code | Name | Description |
+|------|------|-------------|
+| 1 | Queued | Search submitted, awaiting processing |
+| 2 | Processing | Search actively being executed |
+| 3 | Complete | Search finished successfully with results |
+| 4 | Failed | Search encountered an error |
+
+## State Transition Diagram
+
+```
+[New Search]
+     |
+     v
+ SubmitSearch
+     |
+     v
+ +-------+
+ |Queued |<---------+
+ |  (1)  |          |
+ +---+---+          |
+     |              |
+     v              |
+ StartSearch    ResetPartialSearches
+     |              |
+     v              |
+ +----------+       |
+ |Processing|-------+
+ |   (2)    |
+ +----+-----+
+      |
+      v
+ CompleteSearch
+      |
+      +---------------+
+      |               |
+      v               v
+ +--------+      +------+
+ |Complete|      |Failed|
+ |  (3)   |      | (4)  |
+ +--------+      +------+
+```
+
+## Migration Notes
+
+| Legacy Pattern | New Pattern | Rationale |
+|----------------|-------------|-----------|
+| Status as INT codes (1,2,3,4) | Consider enum type or constants | Improves readability and type safety |
+| SCOPE_IDENTITY() for new ID | EF Core auto-populates Id on SaveChanges | Framework handles identity retrieval |
+| Stored procedures for state transitions | Entity state management with domain events | Enables better testability and event sourcing |
+| VARBINARY(MAX) for Excel storage | Consider cloud blob storage reference | Reduces database size, enables streaming |
+| Table-valued function for MIS matching | LINQ query or stored procedure | Evaluate performance tradeoffs |
+
+## Decisions Made
+
+- **MatchMIS migration**: Keep as SQL function - proven logic, better performance for large datasets
+- **Domain events**: Yes, emit events on status transitions - enables audit trail and future event sourcing
+- **Excel storage**: Keep in database VARBINARY - match legacy, simpler deployment
+- **Reset timeout**: No timeout - match legacy behavior, reset any search with StartDT but no EndDT
+
+## Codex Review Findings
+
+### Medium Priority
+1. **State transitions lack validation**: Legacy procedures update by ID without checking current Status. ResetPartialSearches uses StartDT/EndDT presence, not Status value. The spec's state diagram implies stricter transitions than implemented.
+2. **MatchMIS alias discovery incomplete**: RouteMaster is still merged when routing aliases exist (to set MasterMatch on existing sequences). Routing uses earliest transaction date for entire work order which may skip later matches.
+3. **MatchMIS truncation**: Alias sequence numbers are cast to INT before string compare, which is a lossy conversion not documented in the spec.
+
+### Low Priority
+1. **CompleteSearch NULL behavior**: When @Success is NULL, SQL treats it as failure (Status=4) and still overwrites Results. This edge case is undocumented.
+2. **Output column order**: MatchMIS columns in spec differ from SQL (SamplingType/SamplingValue vs ToolsGauges/WorkInstructions position) - may matter for ordinal access.
@@ -0,0 +1,404 @@
+# SQL Views and Types Specification
+
+## Purpose
+
+This specification defines the SQL views that unify current and historical data across partitioned tables, the table-valued parameter (TVP) types used for efficient bulk filtering in search queries, and an aggregation view for work order scrap totals. These database objects provide the foundation for search query execution and data synchronization status tracking.
+
+## Source Reference
+
+| Legacy File | Purpose |
+|-------------|---------|
+| OLD/Database/Views/LastDataUpdates.sql | Aggregates latest successful sync timestamps per table/type |
+| OLD/Database/Views/WorkOrderTotalScrap.sql | Aggregates scrap quantities per work order |
+| OLD/Database/Views/WorkOrder.sql | Union of current and historical work orders |
+| OLD/Database/Views/WorkOrderTime.sql | Union of current and historical work order time entries |
+| OLD/Database/Views/WorkOrderStep.sql | Union of current and historical work order steps with function code join |
+| OLD/Database/Views/WorkOrderComponent.sql | Union of current and historical work order components |
+| OLD/Database/Views/LotUsage.sql | Union of current and historical lot usage records |
+| OLD/Database/Types/WorkOrderFilterParameter.sql | TVP for filtering by work order numbers |
+| OLD/Database/Types/ItemNumberFilterParameter.sql | TVP for filtering by item numbers |
+| OLD/Database/Types/ProfitCenterFilterParameter.sql | TVP for filtering by profit center codes |
+| OLD/Database/Types/WorkCenterFilterParameter.sql | TVP for filtering by work center codes |
+| OLD/Database/Types/OperatorFilterParameter.sql | TVP for filtering by operator user names |
+| OLD/Database/Types/ComponentLotFilterParameter.sql | TVP for filtering by component lot/item combinations |
+| OLD/Database/Types/ItemOperationMISFilterParameter.sql | TVP for filtering by item/operation/MIS combinations |
+
+## Requirements
+
+### Requirement: LastDataUpdates aggregation view
+
+The system SHALL provide a LastDataUpdates view that aggregates the most recent successful data synchronization timestamps per table and update type.
+
+#### Columns
+
+| Column | Type | Description |
+|--------|------|-------------|
+| TableName | VARCHAR(50) | Name of the synchronized table |
+| MassUpdateDT | DATETIME | Timestamp of last successful mass update (UpdateType=3), defaults to 1970-01-01 |
+| DailyUpdateDT | DATETIME | Timestamp of last successful daily update (UpdateType=2), falls back to MassUpdateDT |
+| HourlyUpdateDT | DATETIME | Timestamp of last successful hourly update (UpdateType=1), falls back to DailyUpdateDT then MassUpdateDT |
+
+#### Implementation Details
+
+- Uses a CTE with ROW_NUMBER() partitioned by TableName and UpdateType, ordered by StartDT DESC
+- Filters to WasSuccessful = 1 records only
+- Uses PIVOT to transform UpdateType values (1=Hourly, 2=Daily, 3=Mass) into columns
+- Uses COALESCE cascading to provide fallback timestamps when specific update types have not occurred
+
+#### Scenario: Query data freshness status
+
+- **WHEN** an administrator queries the LastDataUpdates view
+- **THEN** results show the most recent successful sync timestamp for each table at each update frequency level
+
+#### Scenario: Check if hourly sync is needed
+
+- **WHEN** the data sync service checks HourlyUpdateDT for a table
+- **THEN** it receives the most recent of hourly/daily/mass update timestamps to determine staleness
+
+### Requirement: WorkOrderTotalScrap aggregation view
+
+The system SHALL provide a WorkOrderTotalScrap view that calculates the total scrapped quantity per work order from work order steps.
+
+#### Columns
+
+| Column | Type | Description |
+|--------|------|-------------|
+| WorkOrderNumber | BIGINT | Work order identifier |
+| TotalScrappedQuantity | DECIMAL(18,2) | Sum of scrapped quantities, defaults to 0 |
+
+#### Implementation Details
+
+- Aggregates from the WorkOrderStep view (which unions _Curr and _Hist tables)
+- Filters to whole-number step numbers only (StepNumber = ROUND(StepNumber, 0))
+- Groups by WorkOrderNumber
+- Uses COALESCE to return 0 when no scrap exists
+
+#### Scenario: Calculate work order scrap total
+
+- **WHEN** a query joins to WorkOrderTotalScrap for a work order
+- **THEN** it receives the sum of all scrapped quantities from that work order's steps
+
+### Requirement: WorkOrder union view
+
+The system SHALL provide a WorkOrder view that unions WorkOrder_Curr and WorkOrder_Hist tables to present all work orders as a single queryable source.
+
+#### Columns
+
+| Column | Type | Source |
+|--------|------|--------|
+| WorkOrderNumber | BIGINT | Primary key |
+| BranchCode | VARCHAR(12) | Branch/plant code |
+| LotNumber | VARCHAR(30) | Associated lot number |
+| ItemNumber | VARCHAR(25) | Item being produced |
+| ShortItemNumber | BIGINT | Numeric item identifier |
+| ParentWorkOrderNumber | VARCHAR(8) | Parent work order for split orders |
+| OrderQuantity | DECIMAL(15,2) | Ordered quantity |
+| HeldQuantity | DECIMAL(15,2) | Quantity on hold |
+| ShippedQuantity | DECIMAL(15,2) | Quantity shipped |
+| StatusCode | VARCHAR(10) | Work order status |
+| StatusCodeUpdateDT | DATETIME | Status last changed |
+| IssueDate | DATETIME | Issue date |
+| StartDate | DATETIME | Scheduled start date |
+| RoutingType | VARCHAR(3) | Routing type code |
+| LastUpdateDT | DATETIME | Record last updated |
+
+#### Implementation Details
+
+- Uses UNION ALL to combine WorkOrder_Hist and WorkOrder_Curr
+- Selects all columns via wildcard (SELECT hist.*, SELECT curr.*)
+- No deduplication logic - assumes _Curr and _Hist are mutually exclusive
+
+#### Scenario: Query all work orders
+
+- **WHEN** a query selects from the WorkOrder view
+- **THEN** results include both current and historical work order records
+
+#### Scenario: Search by work order number
+
+- **WHEN** a search filter specifies work order numbers
+- **THEN** the query joins WorkOrder view to the filter TVP to match both current and historical records
+
+### Requirement: WorkOrderTime union view
+
+The system SHALL provide a WorkOrderTime view that unions WorkOrderTime_Curr and WorkOrderTime_Hist tables.
+
+#### Columns
+
+| Column | Type | Description |
+|--------|------|-------------|
+| UniqueID | BIGINT | Primary key |
+| WorkOrderNumber | BIGINT | Associated work order |
+| StepNumber | DECIMAL(7,2) | Step sequence number |
+| WorkCenterCode | VARCHAR(12) | Work center code |
+| BranchCode | VARCHAR(12) | Branch/plant code |
+| AddressNumber | BIGINT | Operator address number (links to JdeUser) |
+| GlDate | DATETIME | General ledger date |
+| LastUpdateDT | DATETIME | Record last updated |
+
+#### Implementation Details
+
+- Uses UNION ALL with explicit column list
+- AddressNumber column enables join to JdeUser table in search queries (join not in view itself)
+
+#### Scenario: Query operator time entries
+
+- **WHEN** a search filters by operator
+- **THEN** search queries join WorkOrderTime view to JdeUser via AddressNumber to match operator time entries
+
+### Requirement: WorkOrderStep union view with function code join
+
+The system SHALL provide a WorkOrderStep view that unions WorkOrderStep_Curr and WorkOrderStep_Hist tables and enriches with function code descriptions.
+
+#### Columns
+
+| Column | Type | Description |
+|--------|------|-------------|
+| WorkOrderNumber | BIGINT | Associated work order |
+| WorkCenterCode | VARCHAR(12) | Work center code |
+| StepNumber | DECIMAL(7,2) | Step sequence number |
+| StepTypeCode | VARCHAR(2) | Step type code |
+| BranchCode | VARCHAR(12) | Branch/plant code |
+| StepDescription | VARCHAR(30) | Step description |
+| StartDT | DATETIME | Step start timestamp |
+| EndDT | DATETIME | Step end timestamp |
+| FunctionCode | VARCHAR(15) | Function/operation code |
+| FunctionOperationDescription | VARCHAR(MAX) | Description from FunctionCode table |
+| ScrappedQuantity | DECIMAL(18,2) | Quantity scrapped at this step |
+| LastUpdateDT | DATETIME | Record last updated |
+
+#### Implementation Details
+
+- Uses UNION ALL of _Curr and _Hist in a subquery
+- LEFT OUTER JOINs to FunctionCode table on FunctionCode = Code
+- Adds FunctionOperationDescription from joined FunctionCode.Description
+
+#### Scenario: Query work order steps with descriptions
+
+- **WHEN** a query selects from WorkOrderStep view
+- **THEN** results include enriched function operation descriptions from the FunctionCode reference table
+
+### Requirement: WorkOrderComponent union view
+
+The system SHALL provide a WorkOrderComponent view that unions WorkOrderComponent_Curr and WorkOrderComponent_Hist tables.
+
+#### Columns
+
+| Column | Type | Description |
+|--------|------|-------------|
+| UniqueID | BIGINT | Primary key |
+| WorkOrderNumber | BIGINT | Parent work order |
+| LotNumber | VARCHAR(30) | Component lot number |
+| BranchCode | VARCHAR(12) | Branch/plant code |
+| ShortItemNumber | BIGINT | Component item identifier |
+| Quantity | DECIMAL(15,2) | Quantity used |
+| LastUpdateDT | DATETIME | Record last updated |
+
+#### Implementation Details
+
+- Uses UNION ALL with wildcard column selection
+- Used to trace component lot consumption in work orders
+
+#### Scenario: Trace component lots
+
+- **WHEN** a search filters by component lot numbers
+- **THEN** WorkOrderComponent view is queried to find work orders that consumed those lots
+
+### Requirement: LotUsage union view
+
+The system SHALL provide a LotUsage view that unions LotUsage_Curr and LotUsage_Hist tables.
+
+#### Columns
+
+| Column | Type | Description |
+|--------|------|-------------|
+| UniqueID | BIGINT | Primary key |
+| WorkOrderNumber | BIGINT | Associated work order |
+| LotNumber | VARCHAR(30) | Lot number used |
+| BranchCode | VARCHAR(12) | Branch/plant code |
+| ShortItemNumber | BIGINT | Item identifier |
+| Quantity | DECIMAL(15,2) | Quantity used |
+| LastUpdateDT | DATETIME | Record last updated |
+
+#### Implementation Details
+
+- Uses UNION ALL with wildcard column selection
+- Used alongside WorkOrderComponent for complete lot traceability
+
+#### Scenario: Trace lot usage downstream
+
+- **WHEN** a search filters by component lot numbers
+- **THEN** LotUsage view is queried alongside WorkOrderComponent to find downstream work orders
+
+### Requirement: WorkOrderFilterParameter TVP type
+
+The system SHALL provide a table-valued parameter type for bulk filtering by work order numbers.
+
+#### Schema
+
+| Column | Type | Nullable |
+|--------|------|----------|
+| WorkOrderNumber | BIGINT | NULL |
+
+#### Usage Pattern
+
+The application creates a DataTable with WorkOrderNumber column, populates it from search criteria, and passes it as a TVP to search queries:
+
+```csharp
+DataTable dataTable = new DataTable();
+dataTable.Columns.Add("WorkOrderNumber", typeof(long));
+foreach (var entry in model.WorkOrderFilter)
+{
+    dataTable.Rows.Add(entry.WorkOrderNumber);
+}
+return dataTable.AsTableValuedParameter("WorkOrderFilterParameter");
+```
+
+#### Scenario: Filter by specific work orders
+
+- **WHEN** a user specifies work order numbers in search criteria
+- **THEN** the system passes a WorkOrderFilterParameter TVP to the query for efficient bulk matching
+
+### Requirement: ItemNumberFilterParameter TVP type
+
+The system SHALL provide a table-valued parameter type for bulk filtering by item numbers.
+
+#### Schema
+
+| Column | Type | Nullable |
+|--------|------|----------|
+| ItemNumber | VARCHAR(25) | NULL |
+
+#### Usage Pattern
+
+Populated from search criteria item number list and joined to WorkOrder.ItemNumber in search queries.
+
+#### Scenario: Filter by item numbers
+
+- **WHEN** a user specifies item numbers in search criteria
+- **THEN** the system passes an ItemNumberFilterParameter TVP for efficient bulk item matching
+
+### Requirement: ProfitCenterFilterParameter TVP type
+
+The system SHALL provide a table-valued parameter type for bulk filtering by profit center codes.
+
+#### Schema
+
+| Column | Type | Nullable |
+|--------|------|----------|
+| Code | VARCHAR(12) | NULL |
+
+#### Usage Pattern
+
+Profit center codes are expanded to work center codes via OrgHierarchy table join, then used to filter WorkOrderStep/WorkOrderTime records.
+
+#### Scenario: Filter by profit centers
+
+- **WHEN** a user specifies profit centers in search criteria
+- **THEN** the system passes a ProfitCenterFilterParameter TVP and expands to work centers via OrgHierarchy
+
+### Requirement: WorkCenterFilterParameter TVP type
+
+The system SHALL provide a table-valued parameter type for bulk filtering by work center codes.
+
+#### Schema
+
+| Column | Type | Nullable |
+|--------|------|----------|
+| Code | VARCHAR(12) | NULL |
+
+#### Usage Pattern
+
+Joined directly to WorkOrderStep.WorkCenterCode or WorkOrderTime.WorkCenterCode to filter by manufacturing work centers.
+
+#### Scenario: Filter by work centers
+
+- **WHEN** a user specifies work centers in search criteria
+- **THEN** the system passes a WorkCenterFilterParameter TVP for direct work center matching
+
+### Requirement: OperatorFilterParameter TVP type
+
+The system SHALL provide a table-valued parameter type for bulk filtering by operator user names.
+
+#### Schema
+
+| Column | Type | Nullable |
+|--------|------|----------|
+| UserName | VARCHAR(10) | NULL |
+
+#### Usage Pattern
+
+User names are resolved to AddressNumber via JdeUser table join, then matched to WorkOrderTime.AddressNumber to find work orders touched by specific operators.
+
+#### Scenario: Filter by operators
+
+- **WHEN** a user specifies operator IDs in search criteria
+- **THEN** the system passes an OperatorFilterParameter TVP and resolves to address numbers via JdeUser
+
+### Requirement: ComponentLotFilterParameter TVP type
+
+The system SHALL provide a table-valued parameter type for bulk filtering by component lot and item number combinations.
+
+#### Schema
+
+| Column | Type | Nullable |
+|--------|------|----------|
+| ComponentLotNumber | VARCHAR(30) | NULL |
+| ItemNumber | VARCHAR(128) | NULL |
+
+#### Usage Pattern
+
+Used to find downstream work orders that consumed specific component lots. The lot/item combination is matched against Lot table, then traced through WorkOrderComponent and LotUsage views.
+
+#### Scenario: Trace component lots to downstream products
+
+- **WHEN** a user specifies component lot numbers in search criteria
+- **THEN** the system passes a ComponentLotFilterParameter TVP to trace lot usage through manufacturing
+
+### Requirement: ItemOperationMisFilterParameter TVP type
+
+The system SHALL provide a table-valued parameter type for bulk filtering by item/operation/MIS number/revision combinations.
+
+#### Schema
+
+| Column | Type | Nullable |
+|--------|------|----------|
+| ItemNumber | VARCHAR(32) | NULL |
+| OperationNumber | VARCHAR(32) | NULL |
+| MisNumber | VARCHAR(32) | NULL |
+| MisRevision | VARCHAR(32) | NULL |
+
+#### Usage Pattern
+
+Used for MIS (Manufacturing Information System) data extraction. The four-part key identifies specific MIS records to match against work order routing and MIS data.
+
+#### Scenario: Filter by MIS specifications
+
+- **WHEN** a user specifies item/operation/MIS criteria
+- **THEN** the system passes an ItemOperationMISFilterParameter TVP for MIS data matching and extraction
+
+## Migration Notes
+
+| Legacy Pattern | New Pattern | Rationale |
+|----------------|-------------|-----------|
+| SELECT * in union views | Explicit column lists | Ensures schema changes are caught at compile time and improves maintainability |
+| VARCHAR types in TVPs | Consider NVARCHAR for some columns | Evaluate if Unicode support is needed for international data |
+| Multiple TVP types with single-column schemas | Consider consolidation | ProfitCenterFilterParameter and WorkCenterFilterParameter have identical schemas |
+| Dapper AsTableValuedParameter | Continue using Dapper or switch to EF Core | TVP support in .NET 10 works well with both Dapper and raw ADO.NET |
+
+## Open Questions
+
+1. Should the union views use UNION (with deduplication) instead of UNION ALL? The current implementation assumes _Curr and _Hist tables are mutually exclusive, but this should be verified during data sync analysis.
+
+2. The ComponentLotFilterParameter uses VARCHAR(128) for ItemNumber while other TVPs and tables use VARCHAR(25). Should this be standardized?
+
+3. Should LastDataUpdates view be replaced with a more flexible query or stored procedure that can report on any update type combination?
+
+## Codex Review Findings
+
+### Issues Fixed
+1. ~~**TVP nullability incorrect**~~: Fixed - all TVP columns now show NULL
+2. ~~**WorkOrderTime join logic misstated**~~: Fixed - clarified join happens in search queries, not in view
+3. ~~**TVP name case mismatch**~~: Fixed - renamed to `ItemOperationMisFilterParameter`
+
+### Remaining Notes
+- **WorkOrderTotalScrap datatype**: Spec lists `DECIMAL(18,2)` but SUM without casting returns higher precision (typically `DECIMAL(28,2)`) - acceptable for documentation purposes
@@ -0,0 +1,656 @@
+# Web API and Authentication Specification
+
+## Purpose
+
+This specification defines the REST API endpoints, SignalR real-time communication hub, and LDAP authentication system for the JDE Scoping Tool. The system provides a single .NET 10 service that exposes REST APIs for Blazor WebAssembly clients to manage searches, perform lookup operations, upload/download files, and receive real-time status updates via SignalR. Authentication is performed against an LDAP directory server with group membership verification, with support for a development-mode bypass.
+
+## Source Reference
+
+| Legacy Files | NEW/ Target | Purpose |
+|--------------|-------------|---------|
+| OLD/WebInterface/Controllers/SearchController.cs | NEW/ScopingTool.Api/Controllers/SearchController.cs | Search management API - create, view, copy, save searches and download results |
+| OLD/WebInterface/Controllers/AccountController.cs | NEW/ScopingTool.Api/Controllers/AuthController.cs | User authentication - login, logout, authorization |
+| OLD/WebInterface/Controllers/LookupController.cs | NEW/ScopingTool.Api/Controllers/LookupController.cs | Autocomplete lookup APIs for items, profit centers, work centers, operators |
+| OLD/WebInterface/Controllers/FileIOController.cs | NEW/ScopingTool.Api/Controllers/FileController.cs | Excel file upload/download for bulk data import |
+| OLD/WebInterface/Controllers/CrudController.cs | NEW/ScopingTool.Api/Controllers/ApiControllerBase.cs | Base controller with current user context |
+| OLD/WebInterface/Hubs/StatusHub.cs | NEW/ScopingTool.Api/Hubs/StatusHub.cs | SignalR hub for real-time status and search updates |
+| OLD/WebInterface/Helpers/LDAPHelper.cs | NEW/ScopingTool.Api/Services/LdapAuthService.cs | LDAP server authentication and user lookup |
+| OLD/WebInterface/Security/UserIdentity.cs | NEW/ScopingTool.Api/Security/UserIdentity.cs | Claims-based user identity from LDAP |
+| OLD/WebInterface/Models/LogonRequest.cs | NEW/ScopingTool.Api/Models/LoginRequest.cs | Login request model |
+| OLD/DataModel/Models/LDAPEntry.cs | NEW/ScopingTool.Domain/Models/UserInfo.cs | User information model (renamed from LDAPEntry) |
+| OLD/DataModel/Models/StatusUpdate.cs | NEW/ScopingTool.Domain/Models/StatusUpdate.cs | Process status update model |
+| OLD/DataModel/Models/SearchUpdate.cs | NEW/ScopingTool.Domain/Models/SearchUpdate.cs | Search status update model |
+
+## Requirements
+
+### Requirement: Authentication Service Interface
+
+The system SHALL provide an abstraction for authentication to support LDAP authentication in production and fake authentication in development mode.
+
+#### Interface Definition
+
+```csharp
+public interface IAuthService
+{
+    Task<AuthResult> AuthenticateAsync(string username, string password, CancellationToken ct = default);
+    Task<UserInfo?> GetUserInfoAsync(string username, CancellationToken ct = default);
+}
+
+public record AuthResult(bool Success, UserInfo? User, string? ErrorMessage);
+```
+
+#### Implementations
+
+- `LdapAuthService` - Production LDAP authentication using `System.DirectoryServices.Protocols`
+- `FakeAuthService` - Development mode bypass that accepts any credentials
+
+#### Business Rules
+
+- The system SHALL register `IAuthService` in the DI container based on configuration
+- The system SHALL use `LdapAuthService` when `AuthOptions.UseFakeAuth` is false
+- The system SHALL use `FakeAuthService` when `AuthOptions.UseFakeAuth` is true (development only)
+- `FakeAuthService` SHALL return a predefined `UserInfo` for any username/password combination
+
+#### Scenario: Production mode uses LDAP authentication
+
+- **WHEN** the application starts with `AuthOptions.UseFakeAuth = false`
+- **THEN** `LdapAuthService` is registered as `IAuthService` and all authentication flows use LDAP
+
+#### Scenario: Development mode uses fake authentication
+
+- **WHEN** the application starts with `AuthOptions.UseFakeAuth = true`
+- **THEN** `FakeAuthService` is registered as `IAuthService` and any credentials are accepted
+
+### Requirement: Configuration Options
+
+The system SHALL use strongly-typed configuration options for LDAP and authentication settings.
+
+#### LdapOptions
+
+```csharp
+public class LdapOptions
+{
+    public const string SectionName = "Ldap";
+
+    public string[] ServerUrls { get; set; } = Array.Empty<string>();
+    public string GroupDn { get; set; } = string.Empty;
+    public string SearchBase { get; set; } = string.Empty;
+    public int ConnectionTimeoutSeconds { get; set; } = 30;
+}
+```
+
+#### AuthOptions
+
+```csharp
+public class AuthOptions
+{
+    public const string SectionName = "Auth";
+
+    public bool UseFakeAuth { get; set; } = false;
+    public string CookieName { get; set; } = "ScopingTool.Auth";
+    public int CookieExpirationMinutes { get; set; } = 480; // 8 hours
+    public string[] AdminBypassUsers { get; set; } = Array.Empty<string>();  // Usernames that bypass group check
+    public long MaxUploadSizeBytes { get; set; } = 10 * 1024 * 1024;  // 10MB default
+}
+```
+
+#### LDAP Connection Management
+
+The system SHALL use a connection-per-request pattern for LDAP connections. Each authentication request creates a new `LdapConnection`, authenticates, and disposes. Connection pooling is NOT used due to LDAP bind credential requirements.
+
+#### Business Rules
+
+- The system SHALL bind `LdapOptions` from the `Ldap` configuration section
+- The system SHALL bind `AuthOptions` from the `Auth` configuration section
+- The system SHALL use `IOptions<LdapOptions>` and `IOptions<AuthOptions>` for injection
+
+### Requirement: LDAP Authentication
+
+The system SHALL authenticate users against an LDAP directory server and verify group membership before granting access.
+
+#### Inputs
+
+- Username (sAMAccountName format)
+- Password (plain text, transmitted over HTTPS)
+- LDAP server URLs (from `IOptions<LdapOptions>`, supports multiple URLs for failover)
+- LDAP group distinguished name (from `IOptions<LdapOptions>`)
+
+#### Outputs
+
+- `AuthResult` containing:
+  - Success/failure indicator
+  - `UserInfo` on success (see Data Models section)
+  - Error message on failure
+
+#### Business Rules
+
+- The system SHALL use `System.DirectoryServices.Protocols.LdapConnection` for cross-platform compatibility
+- The system SHALL attempt authentication against each configured LDAP server URL sequentially until one succeeds
+- The system SHALL verify the user is a member of the configured LDAP group after successful bind
+- The system SHALL use the sAMAccountName LDAP filter format `(sAMAccountName={0})` for user lookup
+- The system SHALL extract user properties: distinguishedName, givenName, sn, mail, title
+- The system SHALL compute DisplayName as `"{FirstName} {LastName}".Trim()` or fall back to Username if both are empty
+- The system SHALL sign out any existing session before creating a new one
+- The system SHALL use non-persistent (session-only) authentication cookies
+
+#### Scenario: Successful LDAP authentication with group membership
+
+- **WHEN** a user submits valid credentials for an LDAP user who is a member of the required group
+- **THEN** the system authenticates against the LDAP server, verifies group membership, creates a claims-based identity, signs in the user, and returns a success response with user info
+
+#### Scenario: Failed LDAP authentication with invalid credentials
+
+- **WHEN** a user submits invalid credentials
+- **THEN** the system returns `AuthResult { Success = false, ErrorMessage = "Incorrect username or password" }`
+
+#### Scenario: Valid credentials but user not in required group
+
+- **WHEN** a user submits valid credentials but is not a member of the required LDAP group
+- **THEN** the system returns `AuthResult { Success = false, ErrorMessage = "User is not a member of the required security group" }`
+
+#### Scenario: LDAP server unavailable with failover
+
+- **WHEN** the primary LDAP server is unavailable but a secondary server is configured
+- **THEN** the system attempts authentication against each configured server in sequence until one succeeds or all fail
+
+#### Scenario: All LDAP servers unavailable
+
+- **WHEN** all configured LDAP servers are unavailable
+- **THEN** the system returns `AuthResult { Success = false, ErrorMessage = "Unable to connect to directory server" }`
+
+### Requirement: User Session Management
+
+The system SHALL maintain user session state using ASP.NET Core cookie authentication.
+
+#### Inputs
+
+- Authenticated user identity (from LDAP or fake auth)
+- Session cookie
+
+#### Outputs
+
+- User context available to all authorized controllers via `HttpContext.User`
+- Session termination on logout
+
+#### Business Rules
+
+- The system SHALL use `HttpContext.SignInAsync()` with `CookieAuthenticationDefaults.AuthenticationScheme` for sign-in
+- The system SHALL use `HttpContext.SignOutAsync()` for sign-out
+- The system SHALL store user claims in a `ClaimsPrincipal` with cookie authentication scheme
+- The system SHALL provide access to current user's `UserInfo` through `HttpContext.User` claims
+- The system SHALL clear authentication cookies on logout
+- The system SHALL return HTTP 401 Unauthorized for unauthenticated API requests (no redirect for Blazor WASM)
+
+#### Scenario: Access protected resource while authenticated
+
+- **WHEN** an authenticated user requests a protected resource
+- **THEN** the system provides the current user context and serves the requested resource
+
+#### Scenario: Access protected resource while unauthenticated
+
+- **WHEN** an unauthenticated user requests a protected resource with `[Authorize]` attribute
+- **THEN** the system returns HTTP 401 Unauthorized
+
+#### Scenario: User logs out
+
+- **WHEN** an authenticated user requests logout via `POST /api/auth/logout`
+- **THEN** the system calls `HttpContext.SignOutAsync()`, clears all authentication cookies, and returns HTTP 200 OK
+
+#### Scenario: Parse user identity from claims
+
+- **WHEN** a controller accesses `HttpContext.User`
+- **THEN** the system provides access to user claims including Username, FirstName, LastName, Email, and Title
+
+### Requirement: Auth API Endpoints
+
+The system SHALL provide REST API endpoints for authentication operations.
+
+#### Inputs
+
+| Endpoint | Method | Parameters | Description |
+|----------|--------|------------|-------------|
+| `/api/auth/login` | POST | `LoginRequest` body | Authenticate user |
+| `/api/auth/logout` | POST | - | Sign out current user |
+| `/api/auth/me` | GET | - | Get current user info |
+
+#### Outputs
+
+- JSON responses with `UserInfo` on success
+- HTTP 401 Unauthorized on authentication failure
+- HTTP 200 OK on successful logout
+
+#### Business Rules
+
+- The system SHALL use `[ApiController]` attribute on the controller
+- The system SHALL use attribute routing with `/api/auth` prefix
+- The system SHALL return `UserInfo` JSON (not redirect) on successful login for Blazor WASM compatibility
+- The system SHALL call `IAuthService.AuthenticateAsync()` for login operations
+
+#### Scenario: Successful login
+
+- **WHEN** a user posts valid credentials to `/api/auth/login`
+- **THEN** the system authenticates, creates a session, and returns HTTP 200 with `UserInfo` JSON
+
+#### Scenario: Failed login
+
+- **WHEN** a user posts invalid credentials to `/api/auth/login`
+- **THEN** the system returns HTTP 401 Unauthorized with error message
+
+#### Scenario: Get current user
+
+- **WHEN** an authenticated user requests `/api/auth/me`
+- **THEN** the system returns HTTP 200 with `UserInfo` JSON for the current user
+
+#### Scenario: Get current user when not authenticated
+
+- **WHEN** an unauthenticated user requests `/api/auth/me`
+- **THEN** the system returns HTTP 401 Unauthorized
+
+### Requirement: Search API Endpoints
+
+The system SHALL provide REST API endpoints for search management operations.
+
+#### Inputs
+
+| Endpoint | Method | Parameters | Description |
+|----------|--------|------------|-------------|
+| `/api/search` | GET | - | Get current user's searches |
+| `/api/search/queue` | GET | - | Get all queued searches |
+| `/api/search/{id}` | GET | id (int) | Get search by ID |
+| `/api/search/{id}/copy` | POST | id (int) | Copy search with reset status |
+| `/api/search` | POST | `SearchViewModel` body | Create/submit search |
+| `/api/search/{id}/results` | GET | id (int) | Download search results Excel file |
+
+#### Outputs
+
+- JSON responses using System.Text.Json serialization
+- File download for results (application/vnd.openxmlformats-officedocument.spreadsheetml.sheet)
+- Search ID on successful create
+
+#### Business Rules
+
+- The system SHALL use `[ApiController]` attribute on the controller
+- The system SHALL use attribute routing with `/api/search` prefix
+- The system SHALL require authorization for all search endpoints via `[Authorize]` attribute
+- The system SHALL filter GetSearches to only return searches owned by the current user
+- The system SHALL order user searches by StartDT descending (most recent first)
+- The system SHALL reset Status, UserName, SubmitDT, StartDT, and EndDT when copying a search
+- The system SHALL publish a SearchUpdate to the SignalR hub when a new search is saved
+- The system SHALL return the new search ID on successful create
+- The system SHALL set filename to "search_results.xlsx" for result downloads
+- The system SHALL inject `IHubContext<StatusHub>` via DI for SignalR notifications
+
+#### Scenario: Get user's search history
+
+- **WHEN** an authenticated user requests `GET /api/search`
+- **THEN** the system returns a JSON array of `SearchViewModel` objects for searches owned by that user, ordered by most recent first
+
+#### Scenario: Create new search
+
+- **WHEN** an authenticated user posts a `SearchViewModel` to `POST /api/search`
+- **THEN** the system converts the view model to a Search entity, submits it to the database, publishes a SignalR notification via `IHubContext<StatusHub>`, and returns HTTP 201 Created with the new search ID
+
+#### Scenario: Copy existing search
+
+- **WHEN** an authenticated user requests `POST /api/search/{id}/copy`
+- **THEN** the system loads the original search, resets the status to New, clears timestamps, sets the current user as owner, saves the copy, and returns HTTP 201 Created with the new search ID
+
+#### Scenario: Download search results
+
+- **WHEN** an authenticated user requests `GET /api/search/{id}/results`
+- **THEN** the system retrieves the binary Excel data from the database and returns it as a file download with Content-Type `application/vnd.openxmlformats-officedocument.spreadsheetml.sheet`
+
+#### Scenario: Download results for search without results
+
+- **WHEN** an authenticated user requests results for a search that has not completed
+- **THEN** the system returns HTTP 404 Not Found
+
+### Requirement: Lookup API Endpoints
+
+The system SHALL provide REST API endpoints for autocomplete/lookup operations.
+
+#### Inputs
+
+| Endpoint | Method | Parameters | Description |
+|----------|--------|------------|-------------|
+| `/api/lookup/items` | GET | `q` (string) | Search items by number |
+| `/api/lookup/profit-centers` | GET | `q` (string) | Search profit centers |
+| `/api/lookup/work-centers` | GET | `q` (string) | Search work centers |
+| `/api/lookup/operators` | GET | `q` (string) | Search operators/users |
+
+#### Outputs
+
+- JSON arrays of matching entities converted to view models
+- Results ordered alphabetically by primary identifier
+
+#### Business Rules
+
+- The system SHALL use `[ApiController]` attribute on the controller
+- The system SHALL use attribute routing with `/api/lookup` prefix
+- The system SHALL NOT require authorization for lookup endpoints (public access)
+- The system SHALL order item results by ItemNumber
+- The system SHALL order profit center results by Code
+- The system SHALL order work center results by Code
+- The system SHALL order operator results by FullName
+
+#### Scenario: Search for items by partial number
+
+- **WHEN** a user requests `GET /api/lookup/items?q=ABC`
+- **THEN** the system searches for items matching the partial number and returns matching `ItemViewModel` objects ordered by ItemNumber
+
+#### Scenario: Search for profit centers
+
+- **WHEN** a user requests `GET /api/lookup/profit-centers?q=100`
+- **THEN** the system searches for profit centers matching the partial code and returns matching view models ordered by Code
+
+#### Scenario: Search for work centers
+
+- **WHEN** a user requests `GET /api/lookup/work-centers?q=MACH`
+- **THEN** the system searches for work centers matching the partial code and returns matching view models ordered by Code
+
+#### Scenario: Search for operators by name
+
+- **WHEN** a user requests `GET /api/lookup/operators?q=Smith`
+- **THEN** the system searches for users matching the partial name and returns matching view models ordered by FullName
+
+### Requirement: File API Endpoints
+
+The system SHALL provide REST API endpoints for Excel file upload and download operations using ClosedXML.
+
+#### Inputs
+
+| Endpoint | Method | Parameters | Description |
+|----------|--------|------------|-------------|
+| `/api/file/work-orders/upload` | POST | `IFormFile file` | Upload work orders from Excel |
+| `/api/file/work-orders/template` | POST | `List<long>` body | Generate work order template, returns cache key |
+| `/api/file/work-orders/template/{key}` | GET | key (Guid) | Download cached template |
+| `/api/file/part-numbers/upload` | POST | `IFormFile file` | Upload part numbers from Excel |
+| `/api/file/part-numbers/template` | POST | `List<ItemViewModel>` body | Generate part number template |
+| `/api/file/part-numbers/template/{key}` | GET | key (Guid) | Download cached template |
+| `/api/file/component-lots/upload` | POST | `IFormFile file` | Upload component lots from Excel |
+| `/api/file/component-lots/template` | POST | `List<LotViewModel>` body | Generate component lot template |
+| `/api/file/component-lots/template/{key}` | GET | key (Guid) | Download cached template |
+| `/api/file/part-operations/upload` | POST | `IFormFile file` | Upload part operations from Excel |
+| `/api/file/part-operations/template` | POST | `List<PartOperationViewModel>` body | Generate part operations template |
+| `/api/file/part-operations/template/{key}` | GET | key (Guid) | Download cached template |
+
+#### Outputs
+
+- `FileUploadResult<T>` with WasSuccessful, ErrorMessage, and Data properties
+- GUID key for cached file downloads
+- Excel file stream for GET download requests
+
+#### Business Rules
+
+- The system SHALL use `[ApiController]` attribute on the controller
+- The system SHALL use attribute routing with `/api/file` prefix
+- The system SHALL NOT require authorization for file endpoints (matches legacy behavior)
+- The system SHALL accept file uploads via `IFormFile` parameter
+- The system SHALL parse Excel files using ClosedXML library, reading from row 2 (skip header)
+- The system SHALL inject `IMemoryCache` via DI for template caching
+- The system SHALL cache generated templates with 1-minute absolute expiration
+- The system SHALL use GUID keys for cached file retrieval
+- The system SHALL return HTTP 404 if cached file not found or expired
+- The system SHALL remove cached data after successful download
+- The system SHALL deduplicate uploaded data using DistinctBy before returning (except part operations)
+
+#### Scenario: Upload work orders from Excel
+
+- **WHEN** a user uploads an Excel file to `POST /api/file/work-orders/upload`
+- **THEN** the system parses work order numbers from column 1 using ClosedXML, looks up matching work orders in the database, deduplicates results, and returns a `FileUploadResult` with matching `WorkOrderViewModel` objects
+
+#### Scenario: Generate and download work order template
+
+- **WHEN** a user posts work order numbers to `POST /api/file/work-orders/template`
+- **THEN** the system generates an Excel template using ClosedXML, caches it with a GUID key, and returns the key
+- **WHEN** the user requests `GET /api/file/work-orders/template/{guid}`
+- **THEN** the system retrieves the cached file and returns it as "work_order_template.xlsx"
+
+#### Scenario: Upload component lots with item numbers
+
+- **WHEN** a user uploads an Excel file with lot numbers and item numbers to `POST /api/file/component-lots/upload`
+- **THEN** the system parses lot numbers from column 1 and item numbers from column 2, looks up matching lots, deduplicates, and returns matching `LotViewModel` objects
+
+#### Scenario: Cached file expired
+
+- **WHEN** a user requests a download with an expired or invalid cache key
+- **THEN** the system returns HTTP 404 Not Found
+
+#### Scenario: No file uploaded
+
+- **WHEN** a user posts to an upload endpoint without a file
+- **THEN** the system returns `FileUploadResult { WasSuccessful = false, ErrorMessage = "No file uploaded" }`
+
+### Requirement: SignalR Real-Time Updates
+
+The system SHALL provide real-time status updates to connected clients via ASP.NET Core SignalR hub.
+
+#### Inputs
+
+- Status updates from worker service (via `IHubContext<StatusHub>`)
+- Search status changes (via `IHubContext<StatusHub>`)
+- Client requests for cached status (GetCachedStatus hub method)
+
+#### Outputs
+
+- Broadcasts to all connected clients via `SendAsync("statusUpdate", ...)` and `SendAsync("searchUpdate", ...)`
+
+#### Business Rules
+
+- The system SHALL use ASP.NET Core SignalR (`Microsoft.AspNetCore.SignalR`)
+- The system SHALL maintain a cached `StatusUpdate` with message and timestamp
+- The system SHALL broadcast status updates to ALL connected clients using `Clients.All.SendAsync()`
+- The system SHALL inject `IHubContext<StatusHub>` into controllers and services that need to publish updates
+- The system SHALL NOT use static `GlobalHost` pattern - use DI exclusively
+- The system SHALL initialize cached status with "Unknown" message and current timestamp
+- The system SHALL map the hub endpoint to `/hubs/status`
+
+#### Scenario: Worker service publishes status update
+
+- **WHEN** the worker service publishes a `StatusUpdate` via `IHubContext<StatusHub>`
+- **THEN** the system caches the update and broadcasts it to all connected clients via `Clients.All.SendAsync("statusUpdate", statusUpdate)`
+
+#### Scenario: New search submitted via controller
+
+- **WHEN** the SearchController saves a new search
+- **THEN** the controller uses injected `IHubContext<StatusHub>` to call `Clients.All.SendAsync("searchUpdate", searchUpdate)`
+
+#### Scenario: Client requests current status
+
+- **WHEN** a newly connected client invokes the `GetCachedStatus` hub method
+- **THEN** the system returns the most recent cached `StatusUpdate` (or the default "Unknown" status if none set)
+
+#### Scenario: Multiple clients receive broadcast
+
+- **WHEN** a status update is broadcast
+- **THEN** all connected SignalR clients receive the update simultaneously via their `statusUpdate` or `searchUpdate` event handlers
+
+### Requirement: Blazor Client Integration
+
+The system SHALL support Blazor WebAssembly client authentication and real-time updates.
+
+#### Authentication Flow
+
+1. Blazor client calls `POST /api/auth/login` with credentials
+2. Server validates credentials, creates cookie-based session
+3. Server returns `UserInfo` JSON
+4. Client stores user info in memory and sets authenticated state
+5. Subsequent API calls include auth cookie automatically
+
+#### SignalR Connection
+
+1. Blazor client creates `HubConnection` to `/hubs/status`
+2. Client registers handlers for `statusUpdate` and `searchUpdate` events
+3. Client calls `GetCachedStatus()` on connection to get initial state
+4. Client receives real-time updates via registered handlers
+
+#### Business Rules
+
+- The system SHALL use cookie authentication (not JWT) for browser-based Blazor WASM
+- The system SHALL configure CORS for same-origin only by default; cross-origin support is NOT required for single-domain deployment
+- The system SHALL return JSON responses (not redirects) for all API errors
+- The system SHALL support reconnection for SignalR clients with automatic retry
+- The SignalR hub SHALL remain open without requiring per-request authentication (cookies validated on connection)
+- The Blazor client SHALL handle SPA navigation behaviors (return URL handling, 401 interception for redirect to login)
+
+### Requirement: Authorization Patterns
+
+The system SHALL enforce authorization using ASP.NET Core attribute-based access control.
+
+#### Inputs
+
+- Authorization attributes on controllers and actions
+- User authentication status from cookie
+
+#### Outputs
+
+- Access granted or denied
+- HTTP 401 Unauthorized for unauthenticated API requests
+- HTTP 403 Forbidden for authenticated but unauthorized requests
+
+#### Business Rules
+
+- The system SHALL apply `[Authorize]` at controller level for `SearchController`
+- The system SHALL apply `[AllowAnonymous]` for `AuthController.Login` action
+- The system SHALL NOT require authorization for `LookupController` or `FileController` endpoints
+- The system SHALL return HTTP 401 (not redirect) for unauthorized API requests to support Blazor WASM
+- The system SHALL configure cookie authentication to suppress redirect on 401
+
+#### Scenario: Authorized user accesses protected controller
+
+- **WHEN** an authenticated user accesses a controller with `[Authorize]` attribute
+- **THEN** the system allows the request to proceed to the action method
+
+#### Scenario: Anonymous user accesses protected API
+
+- **WHEN** an anonymous user accesses a controller with `[Authorize]` attribute
+- **THEN** the system returns HTTP 401 Unauthorized (no redirect)
+
+#### Scenario: User accesses public lookup endpoint
+
+- **WHEN** any user (authenticated or not) accesses a `LookupController` endpoint
+- **THEN** the system allows the request without authentication check
+
+## Data Models
+
+### UserInfo (formerly LDAPEntry)
+
+```csharp
+public class UserInfo
+{
+    public string DN { get; set; } = string.Empty;           // Distinguished name
+    public string Username { get; set; } = string.Empty;    // sAMAccountName (lowercase)
+    public string FirstName { get; set; } = string.Empty;   // givenName
+    public string LastName { get; set; } = string.Empty;    // sn
+    public string DisplayName => string.IsNullOrWhiteSpace(FirstName) && string.IsNullOrWhiteSpace(LastName)
+        ? Username
+        : $"{FirstName} {LastName}".Trim();                 // Computed
+    public string Title { get; set; } = string.Empty;       // title
+    public string EmailAddress { get; set; } = string.Empty; // mail
+}
+```
+
+### StatusUpdate
+
+```csharp
+public class StatusUpdate
+{
+    public string Message { get; set; } = string.Empty;     // Update message to display
+    public DateTime Timestamp { get; set; }                  // When message was sent
+}
+```
+
+### SearchUpdate
+
+```csharp
+public class SearchUpdate
+{
+    public int ID { get; set; }                             // Search primary key
+    public string UserName { get; set; } = string.Empty;    // Username who submitted
+    public string Name { get; set; } = string.Empty;        // Search name
+
+    [JsonConverter(typeof(JsonStringEnumConverter))]
+    public SearchStatus Status { get; set; }                // Enum: New, Submitted, Started, Ended, Error
+
+    public DateTime? SubmitDT { get; set; }                 // When submitted (required for UI grid)
+    public DateTime? StartDT { get; set; }                  // When processing started (required for UI grid)
+    public DateTime? EndDT { get; set; }                    // When processing ended (required for UI grid)
+    public DateTime Timestamp { get; set; }                 // When update was generated (required for ordering)
+}
+```
+
+### FileUploadResult<T>
+
+```csharp
+public class FileUploadResult<T>
+{
+    public bool WasSuccessful { get; set; }
+    public string? ErrorMessage { get; set; }
+    public T[]? Data { get; set; }
+}
+```
+
+### LoginRequest
+
+```csharp
+public class LoginRequest
+{
+    public string Username { get; set; } = string.Empty;
+    public string Password { get; set; } = string.Empty;
+}
+```
+
+### AuthResult
+
+```csharp
+public record AuthResult(bool Success, UserInfo? User, string? ErrorMessage);
+```
+
+## Migration Notes
+
+| Legacy Pattern | New Pattern | Rationale |
+|----------------|-------------|-----------|
+| ASP.NET MVC 5 Controllers | ASP.NET Core Controllers with `[ApiController]` | Modern framework, automatic model binding and validation |
+| `JsonNetResult` custom result | `Results.Ok(data)` or `return Ok(data)` | Built-in JSON support with System.Text.Json |
+| Newtonsoft.Json `[JsonConverter(typeof(StringEnumConverter))]` | System.Text.Json `[JsonConverter(typeof(JsonStringEnumConverter))]` | Built-in serialization |
+| Legacy SignalR (`Microsoft.AspNet.SignalR`) | ASP.NET Core SignalR (`Microsoft.AspNetCore.SignalR`) | Built-in, cross-platform |
+| `GlobalHost.ConnectionManager.GetHubContext<T>()` | `IHubContext<T>` via dependency injection | Standard DI pattern, testable |
+| `Clients.All.statusUpdate(...)` | `Clients.All.SendAsync("statusUpdate", ...)` | Async-first API |
+| OWIN Authentication middleware | ASP.NET Core Authentication with `CookieAuthenticationDefaults` | Modern authentication stack |
+| `HttpContext.GetOwinContext().Authentication.SignIn()` | `HttpContext.SignInAsync()` | No OWIN abstraction layer |
+| `DefaultAuthenticationTypes.ApplicationCookie` | `CookieAuthenticationDefaults.AuthenticationScheme` | Standard scheme name |
+| `System.DirectoryServices.DirectoryEntry` | `System.DirectoryServices.Protocols.LdapConnection` | Cross-platform LDAP support |
+| `WebConfigurationManager.AppSettings` | `IOptions<LdapOptions>` / `IOptions<AuthOptions>` | Strongly-typed configuration |
+| `MemoryCache.Default` | `IMemoryCache` via dependency injection | Standard caching abstraction |
+| `Request.Files` collection | `IFormFile` parameter | Modern file upload handling |
+| EPPlus library | ClosedXML library | MIT license (EPPlus changed to non-commercial) |
+| Route-based MVC URLs (`/Search/GetSearches`) | Attribute routing (`/api/search`) | REST conventions, clear API structure |
+| Login redirect for unauthorized | HTTP 401 response | Blazor WASM SPA compatibility |
+| NLog for logging | `ILogger<T>` injected + `BeginScope()` for context | Built-in logging abstraction |
+| `LDAPEntry` model | `UserInfo` model | Clearer naming, not tied to LDAP implementation |
+| Hardcoded user exception in code | Configurable via `AuthOptions.AdminBypassUsers` | Production-safe configuration; empty array by default |
+
+## Codex Review Findings (Status)
+
+The following issues were identified during review and their resolution status:
+
+| Finding | Status | Resolution |
+|---------|--------|------------|
+| Missing Account Endpoints | Resolved | New `/api/auth/*` endpoints documented |
+| Controller Name Typo (`SessionController` vs `SessionsController`) | Resolved | Legacy session endpoints not needed - Blazor WASM handles client-side routing |
+| InvalidUA Route | Resolved | Not needed - Blazor WASM handles user agent detection client-side |
+| LDAP DisplayName Fallback | Clarified | Spec now correctly documents computed `DisplayName` logic |
+| File Upload Error Handling | Documented | Per-row parse errors swallowed, specific error messages documented |
+| SignalR Best-Effort | Documented | SignalR publish is best-effort, exceptions logged but swallowed |
+
+## Open Questions (Resolved)
+
+| Question | Decision | Rationale |
+|----------|----------|-----------|
+| LDAP Failover Strategy | Keep simple sequential | Simple sequential failover is sufficient for this use case. Health checks and circuit breaker add complexity without significant benefit given the expected load. |
+| Authorization Granularity | Group membership only | The legacy system only requires group membership. More granular RBAC is not needed for this tool. |
+| SignalR Connection Management | Broadcast to all | Broadcasting to all clients is acceptable since the status updates are not user-specific and the number of concurrent users is expected to be small. |
+| API Authentication | Cookie-based only | JWT tokens add complexity without benefit for this internal browser-based tool. Cookie auth is simpler and more secure for browser clients. |
+| File Upload Security | Keep anonymous | Maintain legacy behavior. File uploads only parse Excel data; they don't access protected resources. |
+| Rate Limiting | Not implemented initially | Can be added later if needed. Current user base is small and internal. |
+| Hardcoded User Exception | Configurable admin bypass | Move to `AuthOptions.AdminBypassUsers` configuration array (empty by default). Allows dev flexibility without hardcoding. |