Adds pre-flight checks for AdminSiteName/AdminAppPool at the top of
deploy-iis-remote-apply.ps1 (same pattern as the public site), so a
wrong name fails fast with a clear error instead of silently skipping
the stop and leaving files locked for the wipe.

Root cause: the final restart block called Get-WebAppPoolState first to
decide Restart- vs Start-WebAppPool. With \Continue = 'Stop',
any transient error from that check (most likely right after
Wait-AppPoolFullyStopped had to force-kill a lingering worker process,
leaving the pool's WAS state briefly inconsistent) threw an uncaught
error and aborted the rest of the script - silently skipping the admin
site/pool start even though the public site had already restarted
successfully by that point.

Fix: Start-WebAppPool/Start-Website are no-ops if already started, so
drop the state check entirely. Both public and admin site/pool starts
now go through Start-SiteAndPool, which wraps each call independently
in try/catch so one failing doesn't prevent the other from starting,
and reports (rather than swallows or aborts on) any failure.

Stop-WebAppPool only requests a stop - the w3wp.exe worker process can
keep running for a few seconds afterwards, still holding the site's
files open, so the previous fix (stopping both sites before the wipe)
wasn't sufficient on its own.

- Wait-AppPoolFullyStopped: polls app pool state until Stopped (30s
  timeout), then force-kills any lingering w3wp.exe for that pool
- Remove-DirectoryContentsWithRetry: retries the wipe a few times with
  a short delay, since file handles can take a moment to release even
  after the worker process is confirmed gone

The admin site's physical path lives inside RemoteDir (RemoteDir\public-admin).
On a redeploy it was still running while RemoteDir was wiped, so IIS held its
files open and Remove-Item failed with Access is denied. Now both the public
and admin site/app pool are stopped up front, before the wipe.

SendOrderDetailsEmail now CCs natascham, erickaw, danielc, and
katelyne @kentcommunications.com on the 'order received' email sent
to the customer after they submit their order details.

Root cause: OrderController.Continue (GET /order/continue) was calling
MarkTokenUsed the moment the link loaded, not when the customer
actually submitted the order. This burns a one-time link before the
customer opens it whenever anything else issues a GET first - most
likely mail security link-scanners (e.g. Outlook Safe Links) that
pre-fetch URLs found in email bodies, which matches the admin site's
mailto-link workflow.

- OrderController.Continue: only checks TokenUsedAt/TokenExpiresAt for
  validity now, no longer marks the token used
- OrderApiController.SubmitOrderDetails: rejects an already-used token
  (410), and marks the token used only after the order details are
  successfully saved

- New AdminOrdersController + view: table of Orders with search by
  email/jurisdiction #, pagination (20/page), and per-row mailto link
  to resend the order-continue URL
- OrdersRepository: add GetAll() and SearchPaged() (LIKE search,
  PagedQuery-based pagination)
- MailtoEncode helper added to core/helpers.asp (mailto-safe URL
  encoding: %20 not +)
- Controller registered in autoload + ControllerRegistry
- public-admin/ folder: dedicated Default.asp routes, web.config with
  192.168.1.0/24 ipSecurity, production template with same restriction
- applicationhost.config: second IIS Express site (Admin Web Site,
  port 8081)
- run_site.cmd: launches both sites (public in separate window,
  admin in foreground)
- build-release.ps1: public-admin in allow-list, swaps its
  web.config from production template
- deploy-iis-remote-apply.ps1: optional admin site/app-pool config
  + restart
- deploy-iis.ps1: -AdminSiteName/-AdminAppPool/-AdminBaseUrl params,
  admin smoke test

KCI wants to know if a jurisdiction needs extra office copies when ordering
blue AV envelopes, and the old flash-message confirmation after submitting a
jurisdiction number was easy to miss (auto-dismissed in a few seconds).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Purple and blue envelope details were getting mixed up on both the
order form and the confirmation email. The purple screen no longer
asks about blue envelopes at all; the blue screen now owns the
provider question and always shows its permit questions (not just
when buying from KCI), and the order-confirmation email keeps purple
and blue answers in separate sections.

Also drop the blue page's visibleIf tied to the purple envelope
stock choice - it was hiding all blue questions for anyone using
their own purple stock, which is unrelated to blue envelope needs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Page 3 (Blue AV Envelope Order Form) now shows only when the purple
envelope stock question is answered "KCI's stock" - choosing "My own
stock" skips it, since KCI wouldn't be sourcing envelopes either way.
Falls back to visible if that question was never reached.

Also sets clearInvisibleValues: "onHidden" on the survey so answers to
a question don't linger after the question that revealed it gets
changed back (e.g. flipping "purchase blue AV envelopes?" from Yes to
No no longer leaves the permit/nonprofit-status answers underneath it
in place) - applies to every conditional branch on the form, not just
this one.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

The top-level prune step deleted the whole db/ folder before the
second step meant to keep db/migrations under it ever ran, so no
deploy has actually shipped migrations - the remote apply step was
running runMigrations.vbs against an empty migrations folder and
silently reporting nothing pending.

Also adds scripts/run-migrations-remote(-apply).ps1, a lighter
migrations-only counterpart to deploy-iis.ps1 for catching a
production schema up without redeploying app code - used just now to
patch prod after this bug meant it never received prior migrations.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

- scp/ssh now force a fallback to password auth so a missing/rejected
  key fails with a real prompt instead of an opaque "Permission denied
  (publickey)".
- Smoke test now checks each path against its expected status (/404 is
  expected to 404) instead of treating any non-throwing response as a
  pass, and surfaces the actual failure reason.
- The remote IIS server has the 64-bit Access Database Engine, unlike
  the local dev machine, so its app pool stays 64-bit and migrations
  run through the plain (64-bit) cscript.exe instead of SysWOW64.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Blue AV Envelope (Q3) no longer asks for a nonprofit authorization code
after confirming nonprofit status - it wasn't needed there. Ballot
Mailing Service (Q4) gains the same follow-up instead, with an "I don't
know my authorization code" checkbox that lets the applicant skip it.

Adds MailingNonprofitAuthCode and MailingNonprofitAuthCodeUnknown
columns to OrderDetails via migration, wired through the model,
repository, answers mapper, and confirmation email by hand rather than
via GenerateRepo.vbs, since regenerating would have dropped existing
fixups (leading-zero-preserving text fields, nullable boolean/date
guards) already baked into those files.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

The success/error banners (e.g. "Check your email for a link") were
dismissing after only 3 seconds, too quick to read comfortably.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

- .gitattributes + an explicit allow-list in build-release.ps1 assemble a
  clean release tree (app/, core/, public/, scripts/, db/migrations only) -
  anything not on the allow-list is deleted from the deploy, so a stray
  file added later can't ship to production by accident.
- public/web.config.production.template holds the production appSettings
  (DB path outside the deploy dir, Environment=Production, error logging on).
- deploy-iis.ps1 builds, zips, and scp's a release to the IIS host, then
  runs deploy-iis-remote-apply.ps1 there over ssh to swap in the new files,
  run migrations, and restart the site/app pool - the DB and error log live
  outside the deploy directory so a redeploy never touches them.
- Removed deploy-iis-git.ps1 and migrate_isbusiness_to_households.vbs,
  leftovers from a different template project that didn't apply here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Schema changes go through db/migrations/; the live Access file itself
should never be committed or overwritten by a deploy. Its history was
purged from all commits/branches with git-filter-repo.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

- Implement Election Materials order-form revisions (docs/lucid *(2).pdf):
  new "permanent ballot list" question, and a Yes/No/Unsure nonprofit-status
  question now asked on both blue-envelope permit-ownership branches, with
  a matching migration, model/repository regen, and validation updates.
- Box the /request-order form and heading in the site's form-panel style.
- Shrink the site footer.
- After request-order and order submission, redirect to / with a flash
  message instead of re-rendering the form page inline.
- Skin the continuation and order-confirmation emails to match the site's
  branding (logo, navy header/footer, purple accents) instead of plain
  unstyled HTML.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Extract email sending into OrderMailer, answer-to-model mapping into
OrderDetailsAnswersMapper, label mapping into OrderDetailsLabels, and
generic dictionary-based field validation into core/lib.Validations.asp
(alongside a small lib.JsonResponse helper), replacing the private
helpers previously duplicated inline in OrderApiController and
RequestOrderController.

Extends the jurisdiction API cache to store JCode/Name pairs (not just
codes) and looks up the matching Name for an order's already-validated
JurisdictionNumber when rendering /order/continue. When a match is
found, the Municipality field is pre-filled and locked read-only;
otherwise it falls back to an empty, editable field so the user can
enter it manually.

- Blue AV Envelope: City of permit holder and Permit Number are now always
  collected for an own-organization permit, regardless of nonprofit status -
  a permit lookup using only the nonprofit authorization code doesn't work,
  so the code is now additional info when nonprofit status is Yes, not a
  replacement for city/permit number.
- Order confirmation email header simplified to "KCI Purple Envelope Order
  Confirmation" text, dropping the site's PE logo mark and tagline.
- Replaced the IsValidJurisdictionNumber stub (previously always returned
  true) with real validation against JurisdictionApiUrl, cached in
  Application scope (JurisdictionCacheMinutes, default 60) since the
  jurisdiction list is essentially static reference data. Falls back to
  stale cached data on a refresh failure rather than blocking order
  requests; fails open only when there's no cache at all.

  Hit two Classic ASP gotchas along the way: Scripting.Dictionary can't be
  stored in Application scope (ASP 0197, apartment-threaded COM object) -
  cached a delimited string instead - and the codebase's generic aspJSON
  parser took 43s to parse the ~1500-record API response, so switched to a
  targeted regex extraction of just the JCode field (~1s).

Order form revision (docs/lucid "(1)" PDFs):
- Purple Envelope: reordered stock/permit questions, renamed postage-only to
  state-permit-only, added colors question and blue-envelope-provider
  cross-sell
- Blue Envelope: reworked permit flow with KCI-vs-own-organization
  ownership and nonprofit-status branching
- Mailing Service: real per-piece pricing, new Presort Standard tier,
  estimated-quantity question, fixed pickup-date list, removed the
  ballot-sorting question
- Additional Items: added a special-requests field
- Added db/migrations/20260804153857_revise_order_details_columns.asp
  (additive only - columns retired by the revision are left in place,
  not dropped, since the table has real test data)

Tester feedback:
- Fixed "Spectrom" typo to "Spectrum" (value code + label + validation)
- Corrected First Class postage rate to $0.721/pc.
- Marked nearly every survey question required so SurveyJS blocks
  page navigation on missing answers

Color picker for envelope colors:
- Replaced free-text color entry with a modal image picker sourced from
  public/images/Purple_ballot_envelopes colors/*.bmp, converted to PNG
  in public/images/purple-envelope-colors/ (23MB -> 245KB)

Cleanup pass:
- Removed the redundant "KCI's blue envelopes or another provider's"
  question (redundant with the preceding yes/no)
- Removed the purple-envelope delivery-date picker in favor of a static
  lead-time note
- Trimmed the Mailing Service page title
- Fixed the post-submission message to stop showing SurveyJS's default
  "survey" wording

Response.ExpiresAbsolute was set to a far-future date at the same time as
Cache-Control: no-cache - contradictory directives that could let a cache
serve a stale copy of dynamic, session-tied content. Also, Response.AddHeader
"cache-control", ... doesn't affect the separate Response.CacheControl
intrinsic property (which defaults to "private" and was still being sent
regardless of AddHeader); set the property directly so the header is
actually correct on the wire.

Found while diagnosing a "Your form session expired" report that turned out
to be caused by something else (a server-side permissions issue), but this
is a real, independent correctness bug worth fixing regardless.

RouteKit Classic ASP MVC starter for the Purple Envelope election-materials
order site: request-order flow, token-based order continuation, SurveyJS
order-details form with server-side validation and a themed confirmation
email, plus the framework core, generators, and dev-only aspunit test harness.