feat(payroll): driver settlements, Dash driver portal, and instant pay

Payroll & settlements:
- Driver settlement lifecycle (draft -> approve -> post -> paid) with GL
  posting, batches, workspace, disputes, escrow ledger (49 CFR 376.12(k)),
  pay advances, recurring earnings/deductions, pay codes, and YTD summaries
- Instant pay: payWorkerNow builds an off-cycle settlement from selected
  accrued events and drives approve/post/paid in one pass; recurring items
  skipped by default to avoid double-dipping the period settlement
- Driver expenses with receipt capture and a back-office review queue that
  applies approved reimbursements to the driver's open settlement

Dash driver portal (second Vite entry at /dash):
- Me-rooted GraphQL security model with permission-less Driver role and
  invitation-based activation
- Loads with stop-level arrive/depart, POD/BOL capture, realtime chat,
  accept/decline with dispatch alerts, and pay estimates
- Settlement statements, disputes, escrow/advances, PTO requests, expense
  submission, DQ-file compliance profile with document upload
- Web push (VAPID) notifications and a driver notification center
- Credential expiry sweep (Temporal) with driver reminders and compliance
  alerts; detention candidate alerts for dispatch

Dash Control (org feature toggles):
- Per-org toggles for every driver-facing capability (load refusals, stop
  actions, uploads, messaging, pay visibility, expenses, disputes, PTO,
  contact edits, credential reminders, detention alerts) enforced
  server-side with realtime propagation to active drivers

Also: worker autocomplete owner-operator filter (Contractor type or
effective OwnerOperator pay profile), driver_settlement sequence type,
overflow tab lists, Office/Driver login split.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dtt7xTGRTj51u87Vgezhh5

Author: emoss08

AGENTS.md

@@ -29,8 +29,9 @@ Use service-local commands from each module.
 - Naming: use descriptive domain-based names (`userservice`, `locationcategory`, `formula_template`); keep files/packages lower-case.
 - Keep functions small and explicit; avoid introducing `encoding/json` in Go where project lint rules disallow it.
 - Bun ORM: use the [docs](docs/bun/) for help.
+- **Repositories**: When writing repositories, always use the generated column helpers in `services/tms/pkg/buncolgen/` — never hand-write column references. Read [docs/bun/buncolgen.md](docs/bun/buncolgen.md) for the full method reference, canonical repository patterns, and regeneration workflow before writing any repository code.
 - **Function signatures**: When a Go function has more than ~3-4 parameters, define a params struct instead of a long parameter list.
-- **Utility functions go in `shared/`**: Do NOT place generic utility/helper functions inside domain, service, or handler files. The `shared/` directory (`shared/stringutils`, `shared/sliceutils`, `shared/intutils`, etc.) is the home for all reusable utilities. Create new sub-packages there if needed.
+- **Utility functions go in `shared/` (backend) and `client/src/lib/` (frontend)**: Do NOT place generic utility/helper functions inside domain, service, or handler files, nor inline in React components/hooks/routes. Backend utilities live in `shared/` (`shared/stringutils`, `shared/sliceutils`, `shared/intutils`, etc.) — create new sub-packages there if needed. Frontend utilities live in `client/src/lib/` (`utils.ts`, `date.ts`, etc.). If a utility that does the same thing already exists, reuse it — never write a duplicate.
 - **Performance**: Write efficient, allocation-conscious code. Preallocate slices/maps when sizes are known. Avoid unnecessary copies. Use appropriate data structures for the problem.
 - **Code quality**: Prefer clarity and correctness. No dead code, no unused imports, no TODO placeholders left behind. Every function should have a single clear responsibility.
 
@@ -65,9 +66,15 @@ Use service-local commands from each module.
 
 ## Code Quality Non-Negotiables
 
-- **No "v1" or placeholder code**: This is an enterprise TMS application. Implement features fully and completely on the first pass. No stubs, no TODO comments, no "we can improve this later" shortcuts, no simplified versions of what was asked. Handle all edge cases, error states, validation, and integration points. If the feature is complex, that's fine — implement the full complexity.
+- **No "v1", "MVP", or placeholder code**: This is an enterprise TMS application. Never write a "v1", "MVP", or simplified version of what was asked. Implement features fully and completely on the first pass. No stubs, no TODO comments, no "we can improve this later" shortcuts. Handle all edge cases, error states, validation, and integration points. If the feature is complex, that's fine — implement the full complexity.
+- **Secure and bug-free**: All code must be secure — no injection vectors, no unvalidated input, no leaked secrets, proper authorization checks — and free of bugs. Follow DRY & SOLID principles in every implementation.
 - Never deviate from the established code style in the repository. Match the patterns already in use.
 - Do not introduce new dependencies without justification.
 - Do not leave commented-out code, TODO comments, or placeholder implementations.
 - Prefer the simplest correct solution. Do not over-engineer.
 - All error paths must be handled explicitly — no swallowed errors.
+
+## Do Not
+
+- Do not run high usage tasks that will max out CPU, Disk and/or memory usage.
+- Do not run mockery against the entire codebase — manually adjust mocks in the codebase.

CLAUDE.md

@@ -149,11 +149,12 @@ Supports nested paths (`user.address.street`) and array indices (`items[0].name`
 ## Code Style
 
 ### General Principles
-- **Production-grade, fully featured code**: This is an enterprise application. Every feature must be implemented completely — no stubs, no "v1" shortcuts, no "can be improved later" placeholders. If a feature needs error handling, edge cases, validation, proper UX states, or integration with existing systems, implement all of it in the first pass. Do not simplify or reduce scope unless explicitly told to.
+- **Production-grade, fully featured code**: This is an enterprise application. Never write "v1", "MVP", or simplified versions of a feature. Every feature must be implemented completely — no stubs, no shortcuts, no "can be improved later" placeholders. If a feature needs error handling, edge cases, validation, proper UX states, or integration with existing systems, implement all of it in the first pass. Do not simplify or reduce scope unless explicitly told to.
+- **Secure and correct**: All code must be secure (no injection vectors, no unvalidated input, no leaked secrets, proper authz checks) and free of bugs — handle every error path and edge case explicitly.
 - **DRY**: Do not repeat yourself — extract shared logic rather than duplicating code
 - **SOLID**: Follow SOLID principles strictly (single responsibility, open/closed, Liskov substitution, interface segregation, dependency inversion)
 - **Performance**: Write the most efficient and performant code possible — avoid unnecessary allocations, prefer stack over heap, minimize copies, use appropriate data structures
-- **Utility functions**: Place reusable utility functions in the `shared/` package (e.g., `shared/stringutils`, `shared/sliceutils`, `shared/intutils`). Do NOT scatter utility/helper functions in domain or service files. If a utility package doesn't exist for the category, create one in `shared/`
+- **Utility functions**: Never duplicate a utility — if a function that does the same thing already exists, reuse it. Backend: place reusable utilities in the `shared/` package (e.g., `shared/stringutils`, `shared/sliceutils`, `shared/intutils`); do NOT scatter utility/helper functions in domain or service files; if a utility package doesn't exist for the category, create one in `shared/`. Frontend: place reusable utilities in `client/src/lib/` (`utils.ts`, `date.ts`, etc.); do NOT define them inline in components, hooks, or routes
 
 ### Go
 - Follow the [Uber Go Style Guide](https://github.com/uber-go/guide/blob/master/style.md) as the baseline for all Go code
@@ -179,3 +180,9 @@ Supports nested paths (`user.address.street`) and array indices (`items[0].name`
 ## Bun ORM
 
 For help with Bun ORM, look in the [docs](docs/bun/).
+When writing repositories, always use the generated column helpers in `services/tms/pkg/buncolgen/` — never hand-write column references. Read [docs/bun/buncolgen.md](docs/bun/buncolgen.md) for the full method reference, canonical repository patterns, and regeneration workflow before writing any repository code.
+
+## DO NOT
+- **Processes**: Do not run high usage tasks that will max out CPU, Disk and/or memory usage.
+- **Mockery**: Do not run mockery against the entire codebase — manually adjust mocks in the codebase.
+

client/dash.html

@@ -0,0 +1,29 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta
+      name="viewport"
+      content="width=device-width, initial-scale=1.0, viewport-fit=cover"
+    />
+    <link rel="icon" type="image/x-icon" href="/logo.ico" />
+    <link rel="manifest" href="/dash.webmanifest" />
+    <meta name="theme-color" content="#09090b" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-status-bar-style" content="default" />
+    <meta name="apple-mobile-web-app-title" content="Dash" />
+    <title>Dash</title>
+    <meta name="description" content="Your driver portal: loads, settlements, and pay." />
+
+    <meta property="og:title" content="Dash" />
+    <meta
+      property="og:description"
+      content="Your driver portal: loads, settlements, and pay."
+    />
+    <meta property="og:type" content="website" />
+  </head>
+  <body class="overscroll-none antialiased">
+    <div id="root"></div>
+    <script type="module" src="/src/dash/main.tsx"></script>
+  </body>
+</html>

client/package.json

@@ -40,6 +40,7 @@
     "@fontsource-variable/inter": "^5.2.8",
     "@fontsource/geist-mono": "^5.2.8",
     "@fontsource/ibm-plex-mono": "^5.2.7",
+    "@foony/realtime": "^0.14.0",
     "@graphql-typed-document-node/core": "^3.2.0",
     "@hookform/resolvers": "^5.4.0",
     "@lezer/highlight": "^1.2.3",
@@ -48,14 +49,14 @@
     "@nivo/colors": "^0.99.0",
     "@number-flow/react": "^0.6.1",
     "@radix-ui/react-collapsible": "^1.1.16",
+    "@shadcn/react": "^0.2.1",
     "@tailwindcss/vite": "^4.3.2",
     "@tanstack/react-hotkeys": "^0.10.0",
     "@tanstack/react-query": "^5.101.2",
     "@tanstack/react-table": "^8.21.3",
     "@tanstack/react-virtual": "^3.14.6",
     "@uiw/react-codemirror": "^4.25.11",
     "@vis.gl/react-google-maps": "^1.9.0",
-    "@foony/realtime": "^0.14.0",
     "chrono-node": "^2.9.1",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",

client/pnpm-lock.yaml

@@ -0,0 +1,48 @@
+/* Dash service worker: receives web push notifications and routes clicks. */
+
+self.addEventListener("install", () => {
+  self.skipWaiting();
+});
+
+self.addEventListener("activate", (event) => {
+  event.waitUntil(self.clients.claim());
+});
+
+self.addEventListener("push", (event) => {
+  let payload = { title: "Dash", body: "", link: "/dash" };
+  if (event.data) {
+    try {
+      payload = { ...payload, ...event.data.json() };
+    } catch {
+      payload.body = event.data.text();
+    }
+  }
+
+  event.waitUntil(
+    self.registration.showNotification(payload.title, {
+      body: payload.body,
+      icon: "/logo.ico",
+      badge: "/logo.ico",
+      tag: payload.eventId || undefined,
+      data: { link: payload.link || "/dash" },
+    }),
+  );
+});
+
+self.addEventListener("notificationclick", (event) => {
+  event.notification.close();
+  const link = (event.notification.data && event.notification.data.link) || "/dash";
+  const url = new URL(link, self.location.origin).href;
+
+  event.waitUntil(
+    self.clients.matchAll({ type: "window", includeUncontrolled: true }).then((clients) => {
+      for (const client of clients) {
+        if (client.url.startsWith(self.location.origin) && "focus" in client) {
+          client.navigate(url);
+          return client.focus();
+        }
+      }
+      return self.clients.openWindow(url);
+    }),
+  );
+});

client/public/dash-sw.js

@@ -0,0 +1,18 @@
+{
+  "name": "Dash — Driver Portal",
+  "short_name": "Dash",
+  "description": "Your driver portal: loads, settlements, and pay.",
+  "start_url": "/dash",
+  "scope": "/dash",
+  "display": "standalone",
+  "orientation": "portrait",
+  "background_color": "#09090b",
+  "theme_color": "#09090b",
+  "icons": [
+    {
+      "src": "/logo.ico",
+      "sizes": "48x48",
+      "type": "image/x-icon"
+    }
+  ]
+}

client/public/dash.webmanifest

@@ -118,7 +118,7 @@ export function JournalLineItemsEditor({ className }: JournalLineItemsEditorProp
                     onValueCommit={clearOpposite(index, "debitAmount")}
                   />
                 </td>
-                <td className="px-1 py-1.5 pt-4 justify-center flex items-center text-center">
+                <td className="flex items-center justify-center px-1 py-1.5 pt-4 text-center">
                   <Button
                     type="button"
                     variant="ghost"

client/src/components/accounting/journal-line-items-editor.tsx

@@ -562,12 +562,24 @@ export function ServiceTypeAutocompleteField<T extends FieldValues>({
 }
 
 export function WorkerAutocompleteField<T extends FieldValues>({
+  ownerOperatorsOnly,
   ...props
-}: BaseAutocompleteFieldProps<GraphQLSelectOption, T>) {
+}: BaseAutocompleteFieldProps<GraphQLSelectOption, T> & {
+  /**
+   * Narrows the picker to owner-operators: Contractor-type workers, plus any
+   * driver whose effective pay profile carries the OwnerOperator
+   * classification.
+   */
+  ownerOperatorsOnly?: boolean;
+}) {
   return (
     <AutocompleteField<GraphQLSelectOption, T>
       link="/workers/select-options/"
-      graphql={workerSelectOptionsGraphQL}
+      graphql={
+        ownerOperatorsOnly
+          ? { ...workerSelectOptionsGraphQL, filters: { ownerOperatorsOnly: true } }
+          : workerSelectOptionsGraphQL
+      }
       popoutLink="/workers"
       getOptionValue={(option) => option.id || ""}
       getDisplayValue={(option) => option.label}
@@ -1039,7 +1051,9 @@ export function ControlledShipmentAutocompleteField({
       renderOption={(option) => (
         <EDIOptionStack
           primary={option.label}
-          secondary={selectOptionMetaString(option, "bol") || selectOptionMetaString(option, "status")}
+          secondary={
+            selectOptionMetaString(option, "bol") || selectOptionMetaString(option, "status")
+          }
         />
       )}
       {...props}