# P1 patch 1 — Company selection and isolation

Date: 2026-10-19
Status: Applied to the primary ERP development installation with owner authorization on 2026-10-19.

## Behavior
- Membership-filtered active-company selection; multiple memberships require an explicit choice.
- Saved context is revalidated on each resolution; revoked memberships and inactive companies fail closed.
- Switching companies clears the selected branch and records an audit event.
- Company, access, team and branch routes use the active company rather than the first database row.
- System administrators can create additional legal companies; creation selects the new company.
- Role permission rows loaded for administration are limited to roles in the selected company.
- Branch ownership is validated before owner/admin permission bypasses.
- Inactive users fail permission checks.
- Company selection is available from the companies page.

## Verification
SQLite in-memory tests rebuild the existing schema, with no production database access.
10 tests and 41 assertions pass, including:
- Company switching and branch reset.
- Forbidden selection of a company without membership.
- Cross-company product listing, edit and update denial.
- Branch and role writes scoped to the selected company.
- Revoked membership invalidating saved context.
- Rejection of a branch from another company.
- Creation of a second legal company by a system administrator.

## Scope and pending work
No new migrations in this patch. Applied directly to /home/snyt/public_html/SubDomain/ERP after a protected file backup. No Git push.
Warehouses, warehouse grants, complete record-scope enforcement, session revocation,
approval limits, full audit coverage and API authentication remain pending.
This patch is not a claim that P1 is complete.
Browser review and MariaDB staging integration are required before production rollout.
Product-master SKU/barcode policy remains proposed for P2 review.