Story: Commission: business_centre

Commission business_centre properly through codegen: author/update its codegen entity model to match the entity's current hand-written structure, enable the correct variability knobs, regenerate every applicable profile, and reconcile the diffs – this is what fixes the SQL security-definer/ bootstrap-guard gaps and the wrong-plugin Qt CRUD location (ores.qt/party instead of ores.qt/refdata) found during appraisal, as regeneration output rather than hand edits. Then do a full manual Qt test, add the entity chapter to the user manual (Qt windows only — shell and CLI commands are a horizontal layer handled by the top-level Shell entity commands and CLI commands commissioning stories, not per-entity), and file backlog captures for Wt and HTTP support.

• A codegen entity model exists for business_centre with the correct variability knobs enabled (sql, domain, repository, service, generator, protocol, nats-eventing, nats-handler, qt).
• Every regenerated profile is a zero-diff or explicitly signed-off delta against the repo; output lands in the correct split-project location.
• No cross-component leakage: business_centre's Qt CRUD code and plugin wiring live entirely in ores.qt/refdata under RefdataPlugin, not ores.qt/party under PartyPlugin – achieved via regeneration.
• business_centre's insert and validate SQL functions carry security definer + set search_path = public, pg_temp, and the validate function's bootstrap guard filters to active rows only – achieved via regeneration.
• Qt list window (MDI): loads and displays records correctly.
• Qt detail window: edit and save round-trips without error.
• Qt history window: shows change history for the entity.
• Qt delete command: removes the record; history is preserved.
• Qt eventing: a change made in one connected session appears in a second session without manual refresh.
• Manual: entity chapter documents all Qt windows (shell and CLI sections added later, once the top-level Shell entity commands / CLI commands stories reach this entity).
• Backlog captures filed for shell, CLI, Wt, and HTTP support.
• All regressions found are fixed inline or filed as captures.
• Site builds cleanly.

• Rescoped after the appraisal task surfaced four findings (SQL security/bootstrap gaps, wrong Qt plugin, no live codegen model). Initial rescope (2026-07-12) treated the codegen model as out of scope and hand-fixed the SQL and hand-moved the Qt CRUD directly; both were reverted (commit a1018a239 for SQL; working-tree revert for Qt) once it was clarified that authoring a proper codegen model and regenerating is the actual objective of this story – the SQL security fix and Qt relocation should be a byproduct of correct codegen output, not hand edits, matching this story's own commissioning pattern.
• Revised task order: appraise -> update/author codegen model -> regenerate and reconcile diffs -> full Qt test -> manual chapter -> Wt/HTTP captures. The old "Fix SQL security" and "Move Qt to RefdataPlugin" tasks were repurposed in place (same Task-IDs) into "Update codegen model" and "Regenerate and reconcile diffs"; the old "Sync codegen" task (duplicate of the repurposed regenerate task) was deleted.
• business_unit and contact_type show the identical wrong-plugin pattern (also under PartyPlugin) but are out of scope here – their own Commission stories should pick this up, or a shared capture filed.
• Codegen bugs and gaps found while regenerating are fixed at the template/loader level, never by hand-patching generated output (project convention) – caught mid-task when a nullable-column insert-trigger guard had initially been hand-patched into generated SQL before its root cause was traced to org_loader.py not propagating a column's :nullable: flag into the Validations table rows.
• Manual feature-testing (not just codegen diffing) is what surfaced three further real gaps the regeneration alone didn't catch: missing list pagination, coding_scheme_code as free text instead of a validated combo (plus a spelling mismatch against the actual seeded coding scheme), and no flag icon for the new country_alpha2_code-derived flag mechanism – all fixed via the model + a new icon_columns=/=country_flag_icon codegen path rather than hand-written Qt code.
• The coding-scheme combo also exposed a provisioning bug unrelated to business_centre itself: iso.coding_schemes=/=fpml.coding_schemes were both seeded once to the system tenant at DB build time and republished per-tenant via the base=/=crypto bundles, duplicating every code for any provisioned tenant since every coding-scheme validator only ever checks the system tenant. Fixed by removing the two bundle-member entries; the broader missing system-vs-tenant publish-scope convention is captured separately rather than redesigned here.

• Relocating business_unit or contact_type's Qt code (separate stories).
• Portfolio's equivalent Qt-plugin relocation, if it has the same issue (not checked as part of this appraisal).