toga-ai 1.0.696 → 1.0.698

package/knowledge/1.0/apps/library/features/netsuite-suiteql-api-reference.md

@@ -6,7 +6,7 @@ project: Library
 client: shared
 type: feature
 status: active
-updated: 2026-08-19
+updated: 2026-08-29
 owners: ["dfranks", "jcardinal", "kyalamarthi"]
 files:
   - library/app/api/netsuite/rest.php
@@ -16,6 +16,7 @@ related:
   - netsuite-suiteql-rest-shim.md
   - ../architecture.md
   - ../../worker/features/forecast2-netsuite-reconciliation.md
+  - ../../../clients/nychh/features/netsuite-inventory-adjustment-fulfillment-link.md
 ---
 
 ## Summary
@@ -219,6 +220,22 @@ Other JE line facts (same probes):
 > NetSuite custom field supplying those dimensions is created and populated (no `salesrep` column, no
 > `item`). Re-evaluate only once that custom field exists — don't re-probe this from scratch.
 
+### Item Fulfillment (`ItemShip`) lines — ~3 rows per fulfilled item, and `mainline` is NOT the filter
+
+For an Item Fulfillment (`transaction.type = 'ItemShip'`), `transactionline` returns **~3 rows per
+fulfilled item**: the order-linked line, a positive "wash" line, and an `isinventoryaffecting = 'T'`
+line. **Only the order-linked line maps to a source-order line.** Keep exactly that one by requiring
+a `previoustransactionlinelink` of type `SalesOrd`/`TrnfrOrd` (via an `EXISTS` correlated subquery),
+and derive the source `orderLine` from that link's `previousline` (a correlated subquery — see the
+`previousTransactionLineLink` section below).
+
+- **⚠ `mainline = 'F'` is the WRONG filter for an ItemShip line.** NetSuite sometimes marks the
+  first real fulfilled line `mainline = 'T'`, so a `mainline='F'` predicate **silently drops it**.
+  Filter on the `SalesOrd`/`TrnfrOrd` line-link instead, not on `mainline`. (Same "extra posting
+  lines per item" shape as the credit-memo/cash-refund COGS lines in
+  `netsuite-suiteql-rest-shim.md`.) Surfaced building
+  [NYCHH inventory-adjustment → item-fulfillment linking](../../../clients/nychh/features/netsuite-inventory-adjustment-fulfillment-link.md).
+
 ## `previousTransactionLineLink` table
 
 The bridge between a child line (e.g. invoice) and its originating parent line (e.g. SO).
@@ -322,6 +339,15 @@ Used for fields SuiteQL doesn't expose on `transaction`: `shippingCost`, `taxTot
   `linesequencenumber` can diverge from REST `line` for SOAP-era records (confirmed empirically),
   so keying on `linesequencenumber` risks duplicate Sales rows that can't be matched or deleted.
   **`listSales()` keeps the per-id GET for this reason — do not eliminate it.**
+- **⚠ REST record SUBLIST endpoints reject `limit`/`offset` (HTTP 400).**
+  `GET /record/v1/{type}/{id}/{sublist}` (e.g. `.../itemFulfillment/{id}/item?limit=1000&offset=N`)
+  returns **400 `INVALID_PARAMETER`** — *"Use one of: fields, expand, expandRecords,
+  expandSubResources, simpleEnumFormat, ids"*. `limit`/`offset` are valid only on **collection**
+  endpoints, not on a record's sublist. A shim that paginated a sublist this way silently got
+  **0 lines** and imported the record **header-only** with no error. Fetch line data via **SuiteQL
+  `transactionline`** instead (the pattern every other shim in `rest.php` already uses). Surfaced
+  when `fetchItemFulfillmentById` returned zero lines — see
+  [NYCHH inventory-adjustment → item-fulfillment linking](../../../clients/nychh/features/netsuite-inventory-adjustment-fulfillment-link.md).
 
 ## `list*()` helpers — behavior & cost
 
@@ -392,6 +418,17 @@ numbers. Budget hours for multi-year runs and launch them under `nohup`/`tmux`.
 
 ## Change history
 
+- 2026-08-29 — Recorded two NetSuite REST/SuiteQL facts from the NYCHH inventory-adjustment →
+  item-fulfillment **REST migration**: **REST record sublist endpoints
+  (`/record/v1/{type}/{id}/{sublist}`) reject `limit`/`offset` with a 400 `INVALID_PARAMETER`** (a
+  paginated sublist fetch silently returns 0 lines → header-only import; use SuiteQL
+  `transactionline`), and an **Item Fulfillment (`ItemShip`) `transactionline` returns ~3 rows per
+  fulfilled item** (order-linked + positive "wash" + `isinventoryaffecting='T'`) — keep only the line
+  with a `previoustransactionlinelink` of type `SalesOrd`/`TrnfrOrd` and derive `orderLine` from its
+  `previousline`; **`mainline='F'` is the wrong filter** because NetSuite sometimes marks the first
+  real line `mainline='T'`. See
+  [NYCHH inventory-adjustment → item-fulfillment linking](../../../clients/nychh/features/netsuite-inventory-adjustment-fulfillment-link.md).
+  (jcardinal)
 - 2026-08-19 — Added two SuiteQL mechanics that fail **silently**, both found porting the customer
   account-type sync (TRUE-80206): **column aliases come back lower-cased** (`AS accountTypeLabel` →
   `accounttypelabel`, so a camelCase read is `NULL` with no error — it made a backfill report success while

package/knowledge/1.0/apps/worker/features/netsuite-togasupply-per-client-sync.md

@@ -520,8 +520,29 @@ Parameters are stored **per client DB** but accessed **through the TOGa2 API**,
   item-fulfillment lookup set through for the on-demand fulfillment import (lookups are passed
   function-to-function, like the other sync functions).
 
+- **⚠ Inventory-adjustment sync migrated SOAP → REST + now fails LOUD (2026-08-29).** The SOAP path
+  flagged just above (`App_NetSuite::getInventoryNumber*`, ~2 round-trips per serial) has been
+  **migrated to REST/SuiteQL** via `App_Api_Netsuite_Rest`, and the **on-demand fulfillment /
+  sales-order import** it triggers was converted to REST too — closing the ~1h-per-large-adjustment
+  cost that was the previously-planned next step. Also, the remaining **error-log-and-swallow
+  `try/catch` blocks in the NetSuite→DB sync path were removed** so a data-corruption failure surfaces
+  loudly (StarTech/Sentry catches left alone) — the same loud-failure policy as the 2026-08-27
+  per-order `try/catch` removal. Full detail (the REST-shim fixes it required, and the bridges →
+  direct-FK-column change) on
+  [NYCHH inventory-adjustment → item-fulfillment linking](../../../clients/nychh/features/netsuite-inventory-adjustment-fulfillment-link.md).
+
 ## Change history
 
+- 2026-08-29 — The inventory-adjustment sync (and the on-demand fulfillment / sales-order import it
+  triggers) in `syncInventoryAdjustmentFromNetsuite` was **migrated SOAP → REST/SuiteQL**, closing the
+  SOAP round-trip cost flagged 2026-08-28; the remaining error-log-and-swallow `try/catch` in the
+  NetSuite→DB sync path were removed for loud failure (StarTech/Sentry catches untouched). The
+  migration required two `App_Api_Netsuite_Rest` shim fixes (a record-sublist `limit`/`offset` 400 and
+  the ItemShip 3-rows-per-item line filter) and moved the NYCHH adjustment↔fulfillment link off bridge
+  tables onto direct FK columns — see
+  [NYCHH inventory-adjustment → item-fulfillment linking](../../../clients/nychh/features/netsuite-inventory-adjustment-fulfillment-link.md).
+  (jcardinal)
+
 - 2026-08-28 — Recorded two shared-engine inventory-adjustment fixes in
   `syncInventoryAdjustmentFromNetsuite` (prune child `InventoryAdjustmentItemUnits` before the item —
   FK RESTRICT/1451/EV-11; index the item lookup **one-level** `[$partNumber]` to match what the cron

package/knowledge/2.0/apps/api2/architecture.md

@@ -302,6 +302,27 @@ the deploy/version timeline before hunting app bugs. **Fixed 2026-08-28:** all t
 to **Rolling / batch-size 1** (≥1 healthy backend throughout a deploy), which eliminates the blip —
 config + tradeoffs in the [deploy workflow](workflows/codepipeline-codeconnections-deploy.md).
 
+**A fifth cause — a brief, self-healing "no-cause TargetGroup reduced health" flip on a
+LOW-TRAFFIC, IDLE 2-instance env is EB Enhanced Health FLAPPINESS, not worker starvation.**
+Distinct from the third cause (that one is the *busy* env, `api-production-1`, under Compass ASN
+worker saturation). This is a single missed ALB `/health` check — a network/agent transient.
+Fingerprint (verified `api-production-3`, eu-west-1, 2026-08-29 13:31 UTC `Severe`, static-`/health`
+build deployed): self-heals in ~2–5 min; throughout, `HealthyHostCount` stays 2 (1-min minimum),
+**0** target/ELB 5xx, sub-second latency, idle CPU, near-zero traffic; ALB target health already
+reads "healthy" by the time you check. On an idle env there is no worker starvation, so **no
+server-side app fix applies** — do not chase it. The mitigation is alert de-sensitization: the
+worker2 EB health monitor now applies a **persistence-delay gate** (a non-5xx `Degraded`/`Severe`
+must persist ≥ `nonFivexxPersistMinutes`, default 5, before it pages), which suppresses these flaps.
+See [worker2 EB health monitor](../worker2/features/elastic-beanstalk-health-monitor.md).
+
+**Triage aid — break an EB "% requests failing with HTTP 5xx" flag into ELB 502/503/504 to find
+the cause:** **503** = no healthy backend (a deploy with no capacity); **504** = target timeout
+(worker saturation); **502** = connection dropped mid-response (an `AllAtOnce` deploy killing
+in-flight requests, or a PHP worker crash). Because **ELB-generated 5xx (any of these) never reach
+PHP**, they leave **no row in `Logs.Api`** (api2 logs only *after* a completed response) — so an EB
+"% 5xx" flag with an **empty `Logs.Api`** means an **ELB-level** 5xx, not an app 5xx. Discriminate
+with CloudWatch `HTTPCode_ELB_502/503/504_Count` vs `HTTPCode_Target_5XX_Count`.
+
 ## Known issues / accepted risks
 
 Open items a maintainer should know before changing this tier. None are "bugs to fix right now" —
@@ -379,6 +400,14 @@ they are the known sharp edges. Do not re-discover these from scratch.
   single-caller branches in `V2.php` as unverified until exercised directly.
 
 ## Change history
+- 2026-08-29 — Recorded a **fifth EB-`Degraded` cause**: a brief self-healing "no-cause reduced
+  health" flip on a low-traffic *idle* 2-instance env (e.g. `api-production-3`, eu-west-1) is EB
+  Enhanced Health flappiness (a single missed ALB `/health` check), distinct from the busy-env
+  PHP-`/health`-starvation cause — no server-side fix applies; mitigated by the worker2 monitor's
+  new non-5xx persistence-delay gate. Added an ELB **502/503/504 discrimination** triage aid
+  (503=no healthy backend, 504=target timeout/worker saturation, 502=dropped connection from an
+  AllAtOnce deploy or PHP crash); ELB-generated 5xx never reach PHP so they leave no `Logs.Api`
+  row — an EB "% 5xx" flag with an empty `Logs.Api` is ELB-level, not app 5xx. (jcardinal)
 - 2026-08-28 — Recorded a **fourth EB-`Degraded` cause — the deploy-restart ELB 502**: under the old
   `AllAtOnce`/100% policy a deploy restarts both instances of a 2-instance env at once, dropping
   in-flight connections → an ELB-502 burst (43 in one minute on `api-production-1`, 2026-08-28) that

package/knowledge/2.0/apps/api2/features/request-logging.md

@@ -6,8 +6,8 @@ project: API
 client: shared
 type: feature
 status: active
-updated: 2026-08-28
-owners: ["mhammontree", "dfranks", "bala"]
+updated: 2026-08-29
+owners: ["mhammontree", "dfranks", "bala", "jcardinal"]
 files:
   - api2/Component/Api/V2/V2.php
   - api2/Controller/Index.php
@@ -175,6 +175,14 @@ There is no usable index on those columns. Do not start from a payload search.
 
 The working pattern, in order:
 
+> **`route` values are stored WITH the `/v2` prefix** (e.g. `/v2/inventory-adjustments/{uuid}`,
+> `/v2/item-fulfillment-items`), so any narrowing predicate must filter `route LIKE '/v2/...'` — a
+> bare `/inventory-adjustments` matches **nothing**. `route` also carries `requestPayload` +
+> `responsePayload` + `responseCode` per row, so once narrowed the log gives the full request/response
+> for a call **without NetSuite access** — it was the decisive tool for confirming a V2 PUT persisted
+> a field its response echo omitted (see the [V2 query contract](v2-rest-query-contract.md) PUT-echo
+> gotcha).
+
 1. **Narrow with indexed / non-text columns only** — a `dtStamp` range plus `route`,
    `method`, `responseCode`, `hostname`. A
    `GROUP BY hostname, route, method, responseCode` over one day is cheap and is the fastest way
@@ -217,6 +225,12 @@ re-send.
 
 ## Change history
 
+- 2026-08-29 — Noted that `Logs.Api.route` values are stored **with the `/v2` prefix** (e.g.
+  `/v2/inventory-adjustments/{uuid}`), so narrowing queries must filter `route LIKE '/v2/...'` — a
+  bare `/inventory-adjustments` predicate matches nothing. Reinforced that a narrowed row's
+  `requestPayload`/`responsePayload` is the decisive, NetSuite-access-free tool for diagnosing V2
+  write behavior — here, confirming a V2 PUT persisted a field its response echo omitted (NYCHH
+  inventory-adjustment → item-fulfillment linking). (jcardinal)
 - 2026-08-13 — **Important limit on the "an HTTP 400 leaves a full log row" rule** (TRUE-80412):
   `execute()` writes the transaction log near its **end** (~L2225-2271), *after* route processing
   (~L1742-2043), so **a throw from a PRE interceptor produces no `Logs.Api` row at all** — the

package/knowledge/2.0/apps/api2/features/v2-rest-query-contract.md

@@ -6,8 +6,8 @@ project: API
 client: shared
 type: feature
 status: active
-updated: 2026-08-28
-owners: [tcox, bala, apeterson]
+updated: 2026-08-29
+owners: [tcox, bala, apeterson, jcardinal]
 files:
   - api2/Component/Api/V2/V2.php
 related:
@@ -108,6 +108,19 @@ calculated field is null on a nested object but correct when that object is fetc
 Definition of the fields themselves:
 [FIELD_SQL calculated fields](../../_underscore/features/calculated-sql-fields.md).
 
+### ⚠ A non-null FK object at the MAX requested `depth` is OMITTED from the response
+
+A GET serialized to `depth: N` renders FK objects down to level N, but a **non-null FK object that
+sits at level N+1** — one hop *past* the max — is **dropped from the payload with no error**. It is
+easy to miss because a **null** sibling FK still renders as `null`, so the omission reads like "that
+FK is null" rather than "that FK was not serialized." Observed on `GET /item-fulfillment-items` at
+`depth: 2`: the grandchild `item` (level 3 — `itemFulfillmentItem → salesOrderItem → item`) was
+absent, so a product-match keyed on `salesOrderItem.item.uuid` came back empty and no link was
+written. **Fix: request `depth: N+1`, or name the nested path explicitly in `fields`** (e.g.
+`salesOrderItem.item.uuid` / `transferOrderItem.item.uuid`). Rule of thumb: the deepest FK you
+actually read must sit at least one level *inside* `depth`, not on the boundary. Surfaced building
+[NYCHH inventory-adjustment → item-fulfillment linking](../../../../clients/nychh/features/netsuite-inventory-adjustment-fulfillment-link.md).
+
 ### What nests by default is `InherentRecordChildren` — everything else needs the nested ROUTE
 
 A record's one-to-many children arrive inside the record response **only** if `Core.
@@ -271,8 +284,24 @@ where=(field:op:value,LOGIC,field:op:value,(nested,OR,nested))
 - **`gte`/`lte` silently are not operators** — use `ge`/`le`.
 - **Do not trust a 200 with missing fields.** Without an explicit `fields=` list, ACL removal is
   invisible; re-request with `fields=` to force `EZ-2` and see the denied list.
+- **⚠ A PUT response ECHO can omit a field that DID persist — verify against the DB, not the echo.**
+  A `PUT /v2/inventory-adjustments/{uuid}` with `{"itemFulfillment":{"uuid":…}}` returned **200 with
+  an empty `messages[]`** and an echo that did **not** contain `itemFulfillment`, yet the FK column
+  **persisted correctly**. An absent field in the write-response echo is **not** proof the write
+  failed — confirm the field against the record's DB row (or the `Logs_<Client>.Api` `responsePayload`),
+  never from the write's own echoed body. See
+  [V2 request logging](request-logging.md).
 
 ## Change history
+- 2026-08-29 — Recorded two response-shape facts from the NYCHH inventory-adjustment REST work: **a
+  non-null FK object one hop past the max `depth` is silently omitted** (a null sibling FK still
+  renders, so it reads as "null" not "missing") — `GET /item-fulfillment-items` at `depth:2` dropped
+  the level-3 `salesOrderItem.item`; fix with `depth+1` or an explicit nested `fields` path — and a
+  **PUT response echo can omit a field that persisted** (a `PUT /v2/inventory-adjustments/{uuid}`
+  returned 200 / empty-`messages` without echoing `itemFulfillment` though the FK saved), so verify a
+  write against the DB / `Logs_<Client>.Api`, not the echo. See
+  [NYCHH inventory-adjustment → item-fulfillment linking](../../../../clients/nychh/features/netsuite-inventory-adjustment-fulfillment-link.md).
+  (jcardinal)
 - 2026-08-28 — Documented two response-shape facts hit while building the Transfer Orders modal.
   **`calcDepth` defaults to 1**, so a `FIELD_SQL` calculated field on a record one FK hop out returns
   `null` with **no** message (Location's `_address*` fields needed `calcDepth: 2`) — raise it one per

package/knowledge/2.0/apps/api2/workflows/codepipeline-codeconnections-deploy.md

@@ -152,6 +152,10 @@ one 15 s interval (~45 s → 30 s) of per-batch health settle.
   `BatchSize`); `aws:elasticbeanstalk:environment:process:default` (`HealthyThresholdCount`).
 - Trade-off: Rolling is slower end-to-end than the old ~31 s `AllAtOnce`, and capacity briefly
   drops to 1/2 instances per batch (fine at current traffic).
+- **Confirmed working in production (2026-08-29).** The 2026-08-29 00:49 UTC deploy ran as
+  Rolling batches ("Batch 1 / Batch 2, one instance at a time, register and wait for healthy")
+  across all three API prod envs with **no post-deploy 5xx flip** — the `AllAtOnce`
+  deploy-restart 502 blip is eliminated in practice, not just in config.
 
 ### Deploy-policy guidance (don't reach for immutable expecting speed)
 - **Immutable does NOT reduce deploy time.** It is the **slowest** policy — it boots a fresh
@@ -295,6 +299,10 @@ aws codeconnections get-connection --connection-arn "<CONN_ARN>" --region "$REGI
 ```
 
 ## Change history
+- 2026-08-29 — Confirmed the Rolling/batch-1 policy works in production: the 2026-08-29
+  00:49 UTC deploy ran as Rolling batches (one instance at a time, register + wait for healthy)
+  on all three API prod envs with **no post-deploy 5xx flip** — the AllAtOnce deploy-restart
+  502 blip is eliminated. (jcardinal)
 - 2026-08-28 — Recorded the **production deploy trigger + policy change**: the `api-production-1/2/3`
   CodePipelines **auto-deploy on every push to `_production`** (WebhookV2 on the CodeConnections
   connection, repos `_underscore` + `api2`), so a merge to `_production` **is** a three-region prod

package/knowledge/2.0/apps/worker2/features/elastic-beanstalk-health-monitor.md

@@ -6,7 +6,7 @@ project: Worker
 client: shared
 type: feature
 status: active
-updated: 2026-08-25
+updated: 2026-08-29
 owners: [jcardinal]
 files:
   - worker2/Worker/Infrastructure/CloudWatch.php
@@ -28,10 +28,13 @@ OneUptime string-matches — OneUptime cannot compare numbers on a pushed body.
 
 The load-bearing design decision this doc records is the **paging (alarm) criteria**, and
 the key **2026-08-25** change: the 5xx page is now driven by a **CloudWatch windowed
-request-rate gate**, fully **decoupled from EB's own `HealthStatus`**. A non-5xx
-`Degraded`/`Severe` still pages immediately off EB health; but whether a *5xx* problem pages
-is decided by the true per-environment 5xx **rate over a trailing window** (default 5 min),
-not by EB's ~10-second `ApplicationMetrics` snapshot.
+request-rate gate**, fully **decoupled from EB's own `HealthStatus`**. Whether a *5xx*
+problem pages is decided by the true per-environment 5xx **rate over a trailing window**
+(default 5 min), not by EB's ~10-second `ApplicationMetrics` snapshot. As of **2026-08-29**,
+a non-5xx `Degraded`/`Severe` no longer pages immediately either — it must **persist** past a
+threshold (`nonFivexxPersistMinutes`, default 5) before paging, which suppresses the brief
+self-healing "reduced health" flips that EB Enhanced Health throws on low-traffic 2-instance
+envs (see the persistence gate below).
 
 **Why the change:** the old gate read EB `describeEnvironmentHealth`'s `ApplicationMetrics`,
 a ~10-**second** window. At low traffic a single 500 in a near-empty bucket reads as 100%
@@ -52,6 +55,10 @@ itself runs non-fatal. CloudWatch read failures are caught **internally** and re
   `_Worker::runTask('Infrastructure/CloudWatch/ElasticBeanstalkHealth', {awsAccountId,
   environments, oneuptimeUrl, …thresholds})`.
 - New private `fetchWindowedRequestCounts()` reads the CloudWatch metrics (below).
+- New private `fetchNonOkDepartureAgeSeconds(ElasticBeanstalkClient $eb, string
+  $environmentName, int $lookbackSeconds): ?int` returns how long the current non-Ok episode
+  has persisted, from EB `describeEvents` (below). **Never throws** — catches `AwsException`
+  and returns `null`.
 - AWS access is obtained through `_Component_Aws_Workloads::assumeCredentials()` (STS-assume
   a read-only role per account, one assume reused across regions) — see
   [Cross-account AWS access](./cross-account-aws-access.md), which also documents the
@@ -64,11 +71,14 @@ itself runs non-fatal. CloudWatch read failures are caught **internally** and re
 
 Two independent paths now feed `alarm=HIGH`:
 
-1. **EB-health path (non-5xx).** EB `HealthStatus` `Degraded` or `Severe` that is **not**
-   attributable solely to 5xx (latency, instances down, a failed deploy, a mixed cause, or
-   no stated cause) **pages immediately** — unchanged, still driven off EB health.
-   `Suspended` never pages. `causesAttributeSolelyTo5xx()` is what tells a solely-5xx event
-   apart from everything else.
+1. **EB-health path (non-5xx) — now gated on PERSISTENCE (2026-08-29).** EB `HealthStatus`
+   `Degraded` or `Severe` that is **not** attributable solely to 5xx (latency, instances
+   down, a failed deploy, a mixed cause, or no stated cause) pages **only once the current
+   non-Ok episode has persisted ≥ `nonFivexxPersistMinutes`** (new optional param, default 5)
+   — it no longer pages on the first snapshot. A sub-threshold blip is **reported but does not
+   page**. `Suspended` never pages. `causesAttributeSolelyTo5xx()` is what tells a solely-5xx
+   event apart from everything else. See the persistence-gate section below for how episode
+   age is measured and the fail-safe.
 2. **CloudWatch windowed 5xx-rate path.** For a solely-5xx `Degraded`/`Severe`, the page is
    decided **not** by EB but by the true windowed rate from CloudWatch. Given the window's
    `requests` (ApplicationRequestsTotal) and `fivexx` (ApplicationRequests5xx), page when:
@@ -91,6 +101,7 @@ The four thresholds are **optional cron parameters** spread as **named arguments
 | `minRequests` | `100` | Minimum windowed request count before the **share** gate applies |
 | `min5xxPercent` | `20.0` | 5xx share (percent) at/above which a solely-5xx env pages, once `minRequests` is met |
 | `min5xxAbsolute` | `20` | Absolute windowed 5xx count at/above which a solely-5xx env pages regardless of share |
+| `nonFivexxPersistMinutes` | `5` | Minutes a **non-5xx** `Degraded`/`Severe` episode must persist before it pages (added 2026-08-29; a trailing optional param — existing `CronJobs.parameters` without the key still run) |
 
 Removed this iteration: `shouldPageForHealth()` and the old
 `HTTP_5XX_ALARM_RATIO` / `HTTP_5XX_ALARM_ABSOLUTE_COUNT` constants (superseded by the
@@ -123,6 +134,43 @@ A CloudWatch read *failure* (as opposed to empty data) sets **`probe=DEGRADED`**
 gap), distinct from a measured-bad `alarm=HIGH` — same alarm-vs-probe split as the
 multi-client monitors in [OneUptime push-metric monitors](./oneuptime-worker2-monitoring.md).
 
+## Persistence gate on the non-5xx page (2026-08-29)
+
+A non-5xx `Degraded`/`Severe` now pages only after the **current non-Ok episode has persisted
+≥ `nonFivexxPersistMinutes`** (default 5). This exists because the brief "no-cause TargetGroup
+reduced health" flips on low-traffic 2-instance envs are **EB Enhanced Health flappiness** —
+a single missed ALB `/health` check (a network/agent transient), not a real app problem — and
+they self-heal in ~2–5 min. A persistence delay suppresses those while a genuinely sustained
+non-5xx degradation still pages, delayed only by the threshold. (The windowed 5xx-flood gate
+is **unchanged** — it has its own, independent decision.)
+
+**Fingerprint of the idle-env flap** (verified `api-production-3`, eu-west-1, 2026-08-29
+13:31 UTC `Severe`, static-`/health` build deployed): self-heals in ~2–5 min; throughout,
+`HealthyHostCount` stays 2 (1-min minimum), **0** target/ELB 5xx, sub-second latency, idle
+CPU, near-zero traffic; ALB target health already reads "healthy" by the time you look. On an
+idle env there is **no worker starvation**, so there is nothing to fix server-side — the
+mitigation is this monitor persistence-delay gate, not more app code. **This is DISTINCT from
+the PHP-`/health`-starvation cause** (that one is the *busy* env, `api-production-1`, under
+ASN worker saturation, fixed by the static-`/health` file) — see
+[api2 architecture — EB "Degraded" health](../../api2/architecture.md).
+
+**Measuring episode age — `fetchNonOkDepartureAgeSeconds()`** reads EB `describeEvents`:
+
+- The most recent **"transitioned from Ok to …"** event marks the current episode's start.
+  Once non-Ok, later transitions stay between non-Ok states until a to-Ok event; because
+  `describeEvents` returns **newest-first**, the first "from Ok to …" match wins.
+- The query is **TIME-bounded**: `StartTime = now − (persistWindow +
+  HEALTH_EVENTS_LOOKBACK_BUFFER_SECONDS = 600)`, with a `MaxRecords = 100` cap — so a chatty
+  env's deploy/config events cannot push the departure event out of range.
+- **Fail-safe:** an episode **older than the window** returns `null` → the caller **pages**.
+  That is correct: if the departure is beyond the lookback, the episode has already persisted
+  past the threshold, so paging is the safe outcome. A read failure also returns `null`
+  (the method catches `AwsException` and never throws) → same fail-safe.
+
+**Auditable suppression:** a sub-threshold blip is reported, not paged, and the suppression is
+made visible — `pendingPersistSeconds` is added to the OneUptime payload and a `pending=Ns`
+annotation to the WorkerJobs summary — so a suppressed episode is never silent.
+
 ## Reading the windowed 5xx rate from CloudWatch (durable AWS reference)
 
 - **EB application-request metrics are PER-INSTANCE ONLY.** `ApplicationRequestsTotal`,
@@ -214,6 +262,8 @@ the `probe` token; this is a OneUptime config change the developer applies.
   `min5xxPercent`; absolute at `min5xxAbsolute-1` vs `min5xxAbsolute`; `requests` just below
   `minRequests`; empty/zero window; mixed 5xx + non-5xx cause) — deferred pending a harness.
 - **Deploy fails without degrading health** — still not caught (accepted residual).
+- **`ElasticBeanstalkHealth()` is long** and grew with the persistence gate — php-reviewer
+  (0 critical) flagged it as a decomposition candidate; deferred pending the missing harness.
 
 ## Gotchas / known issues
 
@@ -235,6 +285,21 @@ the `probe` token; this is a OneUptime config change the developer applies.
   record its value in a doc.
 
 ## Change history
+- 2026-08-29 — Added a **persistence gate on the non-5xx page**: a non-5xx `Degraded`/`Severe`
+  no longer pages on the first snapshot — it must persist ≥ `nonFivexxPersistMinutes` (new
+  optional trailing param, default 5; existing `CronJobs.parameters` without the key still
+  run) before paging. Episode age comes from EB `describeEvents` via new never-throwing helper
+  `fetchNonOkDepartureAgeSeconds()` (most recent "from Ok to …" marks episode start; events
+  are newest-first so the first match wins; TIME-bounded `StartTime = now − (persistWindow +
+  HEALTH_EVENTS_LOOKBACK_BUFFER_SECONDS=600)`, `MaxRecords=100`, so an episode older than the
+  window returns `null` → the caller pages — correct fail-safe). Sub-threshold blips are
+  reported not paged, with `pendingPersistSeconds` (OneUptime payload) + `pending=Ns`
+  (WorkerJobs summary) so suppressions stay auditable. The windowed 5xx gate is unchanged.
+  Rationale: the brief self-healing "no-cause reduced health" flips on low-traffic 2-instance
+  envs are EB Enhanced Health flappiness (a single missed ALB `/health` check), not app bugs
+  — distinct from the busy-env PHP-`/health`-starvation cause. worker2-only; the param is
+  optional-with-default so no `_underscore`/dbchanges2 change. Not yet committed/deployed.
+  (jcardinal)
 - 2026-08-25 — Replaced the EB `ApplicationMetrics` 5xx gate (a ~10s window that false-paged
   "100% failing" on a lone 500 in a near-empty bucket — real worker-production incident: 16
   500s / 516 req = 3.1% over 17 min) with a **CloudWatch windowed request-rate gate**. Reads

package/knowledge/clients/nychh/INDEX.md

@@ -2,7 +2,7 @@
 
 | Doc | Framework | Summary | Files |
 |-----|-----------|---------|-------|
-| [NYCHH inventory-adjustment → item-fulfillment linking (custbody_stock_adjustment bridges)](features/netsuite-inventory-adjustment-fulfillment-link.md) | 1.0 | For NYCHH stock adjustments, the NetSuite **inventory adjustment** carries a link to the **Item Fulfillment** it corrects, on the multi-select body custom field | library/app/api/toga2.php, worker/crons/toga2/netsuite/common_sync_togasupply.php, worker/crons/toga2/netsuite/sync_togasupply_hh.php, worker/crons/toga2/netsuite/diagnose_hh_import_inventory_adjustment.php, _underscore/Model/Client/ItemFulfillments/InventoryAdjustment.php, _underscore/Model/Client/ItemFulfillmentItems/InventoryAdjustmentItem.php, dbchanges2/Core/2026-08-27b - ItemFulfillmentsInventoryAdjustmentsBridge.sql, dbchanges2/Core/2026-08-28b - ItemFulfillmentItemsInventoryAdjustmentItemsBridge.sql, dbchanges2/Client/2026-08-27a - ItemFulfillmentsInventoryAdjustmentsBridgeTable.sql, dbchanges2/Client/2026-08-28c - ItemFulfillmentItemsInventoryAdjustmentItemsBridgeTable.sql |
+| [NYCHH inventory-adjustment → item-fulfillment linking (direct FK columns, REST)](features/netsuite-inventory-adjustment-fulfillment-link.md) | 1.0 | For NYCHH stock adjustments, the NetSuite **inventory adjustment** carries a link to the **Item Fulfillment** it corrects, on the multi-select body custom field | library/app/api/toga2.php, library/app/api/netsuite/rest.php, worker/crons/toga2/netsuite/common_sync_togasupply.php, worker/crons/toga2/netsuite/sync_togasupply_hh.php, worker/crons/toga2/netsuite/diagnose_hh_import_inventory_adjustment.php |
 | [NYCHH NetSuite → TransferOrders import (stocking-flag routing, PO bridges, origin location)](features/netsuite-transfer-order-import.md) | 1.0 | NYCHH's NetSuite **transfer orders are represented as NetSuite sales orders** (same as the GroWrk pattern), so the shared NetSuite → TOGa Supply importer (`App_ | library/app/api/toga2.php, library/app/api/netsuite/rest.php, library/app/netsuite.php, worker/crons/toga2/netsuite/sync_togasupply_hh.php, worker/crons/toga2/netsuite/common_sync_togasupply.php, worker/crons/toga2/netsuite/diagnose_hh_stuck_transfer_order.php, dbchanges2/Core/2026-08-27a - TransferOrderUuidSearchableIdentifier.sql, dbchanges2/Client/2026-08-28a - TransferOrderItemsTimestampColumns.sql, dbchanges2/Client/2026-08-28b - TransferOrderItemsTimestampColumnsReposition.sql |
 | [NYCHH PO links are UPSTREAM — the downstream SO→PO route returns empty](features/po-number-upstream-direction.md) | 2.0 | NYCHH's sales orders are created **from the customer's purchase order**, so their SO↔PO links live in the **upstream** table `PurchaseOrders_SalesOrders` (route | _underscore/Model/Client/SalesOrder.php, _underscore/Trait/Netsuite/SalesOrder.php, toga25-supply/src/pages/SalesOrders/view/SalesOrderRecordModalLayout/hooks/usePurchaseOrderDetails.ts, dbchanges2/Client/2026-08-11b - SalesOrderPurchaseOrdersField.sql, dbchanges2/Client/2026-08-25 - SalesOrderPurchaseOrdersFieldAllClients.sql |
 | [NYCHH transfer-order 2.0 model — inventory quantities + V2 field enablement](features/transfer-order-inventory-quantities.md) | 2.0 | The 2.0 (`_underscore`) side of NYCHH transfer-order support: a **two-branch inventory quantity model** on the NYCHH `Item` override, plus the **client-override | _underscore/Model/Nychh/Item.php, _underscore/Model/Nychh/TransferOrder.php, _underscore/Model/Nychh/TransferOrderStage.php, _underscore/Model/Client/TransferOrder.php, _underscore/Model/Client/TransferOrderItem.php, dbchanges2/Client_Nychh/2026-08-27a - TransferOrderCustomFieldWritePermission.sql, dbchanges2/Client_Nychh/2026-08-27b - TransferOrderStageStatusIdentifier.sql, dbchanges2/Client_Nychh/2026-08-28c - TransferOrderRecordAcl.sql, dbchanges2/Client/2026-08-28b - TransferOrderItemsTimestamps.sql |

package/knowledge/clients/nychh/features/netsuite-inventory-adjustment-fulfillment-link.md

@@ -1,29 +1,28 @@
 ---
-title: "NYCHH inventory-adjustment → item-fulfillment linking (custbody_stock_adjustment bridges)"
+title: "NYCHH inventory-adjustment → item-fulfillment linking (direct FK columns, REST)"
 framework: "1.0"
 repo: library
 project: Library
 client: nychh
 type: client-feature
 status: active
-updated: 2026-08-28
+updated: 2026-08-29
 owners: [jcardinal]
 files:
   - library/app/api/toga2.php
+  - library/app/api/netsuite/rest.php
   - worker/crons/toga2/netsuite/common_sync_togasupply.php
   - worker/crons/toga2/netsuite/sync_togasupply_hh.php
   - worker/crons/toga2/netsuite/diagnose_hh_import_inventory_adjustment.php
-  - _underscore/Model/Client/ItemFulfillments/InventoryAdjustment.php
-  - _underscore/Model/Client/ItemFulfillmentItems/InventoryAdjustmentItem.php
-  - dbchanges2/Core/2026-08-27b - ItemFulfillmentsInventoryAdjustmentsBridge.sql
-  - dbchanges2/Core/2026-08-28b - ItemFulfillmentItemsInventoryAdjustmentItemsBridge.sql
-  - dbchanges2/Client/2026-08-27a - ItemFulfillmentsInventoryAdjustmentsBridgeTable.sql
-  - dbchanges2/Client/2026-08-28c - ItemFulfillmentItemsInventoryAdjustmentItemsBridgeTable.sql
 related:
   - ./netsuite-transfer-order-import.md
   - ./transfer-order-inventory-quantities.md
   - ../../../1.0/apps/worker/features/netsuite-togasupply-per-client-sync.md
   - ../../../1.0/apps/library/features/toga2-api-client-and-bridge.md
+  - ../../../1.0/apps/library/features/netsuite-suiteql-api-reference.md
+  - ../../../1.0/apps/library/features/netsuite-suiteql-rest-shim.md
+  - ../../../2.0/apps/api2/features/v2-rest-query-contract.md
+  - ../../../2.0/apps/api2/features/request-logging.md
   - ../../../2.0/apps/_underscore/features/sales-order-purchase-order-bridge-direction.md
   - ../profile.md
 ---
@@ -32,86 +31,134 @@ related:
 
 For NYCHH stock adjustments, the NetSuite **inventory adjustment** carries a link to the **Item
 Fulfillment** it corrects, on the multi-select body custom field **`custbody_stock_adjustment`**
-(internalId **9735**). This feature imports that link into TOGa Supply as two new bridge tables
-(header + line), so H&H gets **adjustment → item fulfillment → sales order → purchase order**
-traceability for their PO-specific fulfillment. Per the **2026-08-27 TOGa Supply meeting**; the
-NetSuite custom field was implemented **<1 year ago**, so older adjustments carry **no** link.
-
-Like [NYCHH transfer-order import](./netsuite-transfer-order-import.md), the **tables and models are
-all-client infrastructure** (`dbchanges2/Client/` + shared `_Model_Client_*` bridge models) but the
-**attach is gated NYCHH-only** by `IS_ENABLED_TRANSFER_ORDER_STOCKING_FLAG_ROUTING`.
-
-## The two bridges (both mirror the transfer-order bridge pattern)
-
-| Level | Bridge table | `Core.Records` id | `RecordFields` | Model |
-|---|---|---|---|---|
-| Header | `ItemFulfillments_InventoryAdjustments` | 353 | 2515–2518 | `_Model_Client_ItemFulfillments_InventoryAdjustment` |
-| Item | `ItemFulfillmentItems_InventoryAdjustmentItems` | 354 | 2519–2522 | `_Model_Client_ItemFulfillmentItems_InventoryAdjustmentItem` |
-
-Each shipped as: an all-client `Client/` bridge table, Core registration (`Records` + `RecordFields`),
-a Super-User ACL grant, and a per-client ACL **copied from the parent record**. The parent record
-uuids are already `isIdentifier = 1`, so — unlike the transfer-order bridges — **no `EV-12`
-uuid-identifier fix was needed** (contrast the 312/313 anomaly on
-[the ACL permission chain](../../../2.0/apps/_underscore/features/acl-permission-chain.md)).
-
-> **Bridge FK writes via a nested `{uuid}` need only record-level ACL, not field-level.** Verified
-> against the existing transfer-order bridges — the nested-write ACL check is at the record level for a
-> bridge link, so no `AclCustomFieldPermissions` grant is required on the FK columns.
+(internalId **9735**). This feature imports that link into TOGa Supply so H&H gets **adjustment →
+item fulfillment → sales order → purchase order** traceability for their PO-specific fulfillment.
+Per the **2026-08-27 TOGa Supply meeting**; the NetSuite custom field was implemented **<1 year
+ago**, so older adjustments carry **no** link.
+
+**Current design (2026-08-29): direct FK columns, over REST.** The link is now stored as **two
+direct FK columns** — `InventoryAdjustments.itemFulfillmentId` and
+`InventoryAdjustmentItems.itemFulfillmentItemId` — **replacing** the two bridge tables the
+prior-session build used (`ItemFulfillments_InventoryAdjustments` /
+`ItemFulfillmentItems_InventoryAdjustmentItems`). And the whole inventory-adjustment sync — plus the
+on-demand fulfillment/sales-order import it triggers — was **migrated from SOAP to REST** for speed
+(the SOAP path was ~2 NetSuite round-trips per serial, ~1h for a large serialized adjustment).
+
+Like [NYCHH transfer-order import](./netsuite-transfer-order-import.md), the FK columns and models
+are **all-client infrastructure** but the **attach is gated NYCHH-only** by
+`IS_ENABLED_TRANSFER_ORDER_STOCKING_FLAG_ROUTING`.
+
+## The two FK links (replaced the header/line bridge tables)
+
+| Level | FK column | `Core.Records` | `Core.RecordFields` |
+|---|---|---|---|
+| Header | `InventoryAdjustments.itemFulfillmentId` | 154 (InventoryAdjustments) | reuses 2517 |
+| Item | `InventoryAdjustmentItems.itemFulfillmentItemId` | 155 (InventoryAdjustmentItems) | reuses 2521 |
+
+The FK columns **reuse the `RecordFields` already registered/granted from the earlier bridge work**
+(2517 on record 154, 2521 on record 155), so this change needed **no new Core registration or ACL
+grant** — the bridge tables (records 353/354) and their per-client copies are superseded. Writing a
+link is now a plain PUT of the FK uuid onto the parent record, not a bridge-row insert.
 
 ## Attach code — `App_Api_Toga2::attachInventoryAdjustmentToItemFulfillment`
 
 Lives in `library/app/api/toga2.php`, called from `syncInventoryAdjustmentFromNetsuite` **after the
-header upsert**, gated on `IS_ENABLED_TRANSFER_ORDER_STOCKING_FLAG_ROUTING`, and wrapped in
-`try/catch` — it is **best-effort and must never freeze the section** (a failed link is logged, the
-adjustment import still completes). It:
+header upsert**, gated on `IS_ENABLED_TRANSFER_ORDER_STOCKING_FLAG_ROUTING`. It:
 
 1. reads `custbody_stock_adjustment` off the adjustment (the related Item Fulfillment),
 2. resolves that fulfillment by `ItemFulfillments.c_netsuiteInternalItemFulfillmentId`,
-3. idempotently creates the **header** link row, then
-4. links **line items** by matching `itemId` — every same-product adjustment-item ↔ fulfillment-item
-   pair is linked; the bridge's `UNIQUE(fk, fk)` dedupes re-runs.
-
-## On-demand dependency import (fulfillment not yet in TOGA)
-
-When the linked fulfillment has **not** been imported into TOGA yet, the attach no longer skips and
-waits for the fulfillment backfill — it **imports the fulfillment on demand** via
-`syncItemFulfillmentFromNetsuite` (which itself cascades to the originating sales order when missing),
-then **re-resolves and links**.
-
-This required threading the **full item-fulfillment lookup set** — customer, country, state, location,
-manufacturer, item, all-catalog-items, vendor-item, shipping-carrier, shipping-method, warehouse —
-through `syncInventoryAdjustmentFromNetsuite` (signature **expanded 5 → 13 args**) and into
-`attachInventoryAdjustmentToItemFulfillment`, plus updating the `common_sync_togasupply.php`
-`INVENTORY_ADJUSTMENTS` call to pass them (the same set already passed to the item-fulfillment
-section). **Design rule (developer instruction): all lookups are passed function-to-function**, like
-the other sync functions — not rebuilt or fetched inside the callee.
-
-## Two fixes in `syncInventoryAdjustmentFromNetsuite` (shared engine, surfaced by the harness)
-
-Both are in the shared library method, so they affect **any** client running inventory adjustments —
-see also the [per-client sync](../../../1.0/apps/worker/features/netsuite-togasupply-per-client-sync.md):
+3. writes the **header** FK (`InventoryAdjustments.itemFulfillmentId`), then
+4. writes the **line** FK (`InventoryAdjustmentItems.itemFulfillmentItemId`) for each
+   same-product adjustment-item ↔ fulfillment-item pair, matched by product `item` uuid.
+
+### ⚠ Reading the product uuid needs `depth=3` (the max-depth omission trap)
+
+Step 4's product match reads `salesOrderItem->item->uuid` from `GET /item-fulfillment-items`. The
+V2 read engine **omits a non-null FK object that sits at the max requested `depth`** — and a null
+sibling FK still renders, so the omission is easy to miss. At `depth=2` the grandchild `item`
+(level 3: `itemFulfillmentItem → salesOrderItem → item`) was dropped → the product-match map was
+empty → **no `itemFulfillmentItemId` was written**. Fix: request **`depth=3`** *plus* explicit
+nested fields `salesOrderItem.item.uuid` / `transferOrderItem.item.uuid`. Framework detail:
+[V2 REST query contract — max-depth FK omission](../../../2.0/apps/api2/features/v2-rest-query-contract.md).
+
+### ⚠ The FK write's PUT echo may not reflect what persisted
+
+A `PUT /v2/inventory-adjustments/{uuid}` with `{"itemFulfillment":{"uuid":…}}` returned **200,
+empty `messages[]`, and an echo that did NOT contain `itemFulfillment`** — yet the FK column
+**persisted correctly**. Do not read an empty echo as a failed write; verify against the DB or the
+`Logs_<Client>.Api` `responsePayload`. This was diagnosed entirely from `Logs_Nychh.Api` (routes
+stored with the `/v2` prefix — filter `route LIKE '/v2/...'`), with **no NetSuite access needed**.
+See [V2 request logging](../../../2.0/apps/api2/features/request-logging.md).
+
+### Loud failure (best-effort try/catch removed)
+
+The attach and the surrounding NetSuite→DB sync path **no longer swallow errors**: the
+error-log-and-swallow `try/catch` blocks were removed so a data-corruption failure surfaces loudly
+(StarTech/Sentry catches left alone). This is the same loud-failure policy as the 2026-08-27 removal
+of the per-order `try/catch` skips across all six sync sections — see
+[NetSuite → TOGa Supply per-client sync](../../../1.0/apps/worker/features/netsuite-togasupply-per-client-sync.md).
+**Do not "soften" this back into a swallow** — a bridge/link miss must be visible, not silently
+dropped.
+
+## On-demand dependency import (fulfillment not yet in TOGA) — now REST
+
+When the linked fulfillment has **not** been imported into TOGA yet, the attach **imports the
+fulfillment on demand** via `syncItemFulfillmentFromNetsuite` (which itself cascades to the
+originating sales order when missing), then **re-resolves and links**. This on-demand import was
+**converted from SOAP to REST** this session.
+
+Threading the on-demand import required the **full item-fulfillment lookup set** — customer,
+country, state, location, manufacturer, item, all-catalog-items, vendor-item, shipping-carrier,
+shipping-method, warehouse — to be passed through `syncInventoryAdjustmentFromNetsuite` (signature
+**expanded 5 → 13 args**) and into `attachInventoryAdjustmentToItemFulfillment`, plus updating the
+`common_sync_togasupply.php` `INVENTORY_ADJUSTMENTS` call to pass them. **Design rule (developer
+instruction): all lookups are passed function-to-function**, like the other sync functions — not
+rebuilt or fetched inside the callee.
+
+## The REST-shim fixes this migration required (`library/app/api/netsuite/rest.php`)
+
+Both are framework-level NetSuite facts — full detail on
+[NetSuite SuiteQL/REST API Reference](../../../1.0/apps/library/features/netsuite-suiteql-api-reference.md):
+
+- **Item-fulfillment REST shim returned zero line items.** `fetchItemFulfillmentById` fetched
+  fulfillment lines from the REST **record sublist** `GET /record/v1/itemFulfillment/{id}/item?limit=1000&offset=N`.
+  **REST record sublist endpoints reject `limit`/`offset`** (HTTP 400 `INVALID_PARAMETER`), so the
+  shim silently got 0 lines and every fulfillment imported **header-only** — starving all downstream
+  ItemFulfillmentItems and the line-level link. **Fix:** fetch lines via SuiteQL `transactionline`
+  (the pattern every other shim in the file already uses).
+- **Fulfillment SuiteQL returned ~3 rows per fulfilled item.** An Item Fulfillment (`ItemShip`) has
+  three `transactionline` rows per fulfilled item: the order-linked line, a positive "wash" line, and
+  an `isinventoryaffecting='T'` line — only the order-linked line maps to a source-order line.
+  **Fix:** keep only lines with a `previoustransactionlinelink` of type `SalesOrd`/`TrnfrOrd` (via
+  `EXISTS`), and derive `orderLine` from that link's `previousline` (correlated subquery).
+  **`mainline='F'` is the WRONG filter** — NetSuite sometimes marks the first real fulfilled line
+  `mainline='T'`.
+
+## Two shared-engine fixes in `syncInventoryAdjustmentFromNetsuite` (surfaced here, affect any client)
+
+Both are in the shared library method — see also the
+[per-client sync](../../../1.0/apps/worker/features/netsuite-togasupply-per-client-sync.md):
 
 - **(a) Prune-order FK violation.** The stale-item prune deleted an `InventoryAdjustmentItem` while
   its child `InventoryAdjustmentItemUnits` still referenced it (FK **RESTRICT**, no cascade) → MySQL
   **1451** → `EV-11`. **Fix:** delete the child units (`/inventory-adjustment-item-units/{uuid}`)
-  **before** the item. (Same "delete bridge/child rows first" rule as the tracking-number bridges.)
-- **(b) Item-lookup indexing mismatch → duplicate items every run.** The item lookup was consumed as a
-  **two-level** `[$uuidManufacturer][$partNumber]`, but the cron passes it **one-level** `[$partNumber]`
-  (populated in `common_sync_togasupply.php` ~L313). The two-level
-  `$lookupItemByClientUuidAndManufacturerUuidAndPartNumberUpper` is declared but **never populated
-  (dead)**. The mismatch meant existing items were never found, so items were **re-created every run**
-  (duplicates / `EV-10`). **Fix:** index one-level `[$partNumber]`.
+  **before** the item. (Same "delete child rows first" rule as the tracking-number bridges.)
+- **(b) Item-lookup indexing mismatch → duplicate items every run.** The item lookup was consumed
+  **two-level** `[$uuidManufacturer][$partNumber]`, but the cron passes it **one-level**
+  `[$partNumber]` (populated in `common_sync_togasupply.php` ~L313); the two-level lookup is declared
+  but **never populated (dead)**. Existing items were never found, so items were **re-created every
+  run** (duplicates / `EV-10`). **Fix:** index one-level `[$partNumber]`.
 
 ## Diagnostic harness — `diagnose_hh_import_inventory_adjustment.php`
 
 A **manual operator tool** in `worker/crons/toga2/netsuite/` (NOT in `cron.worker.sync.json`; does
 **not** call `cronInitialization`, so no process lock / no cursor writes; installs a strict
 `set_error_handler` that rethrows warnings as `ErrorException` for exact crash lines). It imports
-**one** inventory adjustment (default NS internal id **6516616**) by calling the real
-`syncInventoryAdjustmentFromNetsuite`, seeds the warehouse/item/manufacturer lookups (the item loop
-**filters** items to known warehouses and **creates** items on a lookup-miss, so empty lookups drop or
-duplicate items), and has a **read-only** diagnostic tail that dumps the NS item list +
-`custbody_stock_adjustment` + whether the referenced fulfillment already exists in TOGA.
+**one** inventory adjustment by calling the real `syncInventoryAdjustmentFromNetsuite`, seeds the
+warehouse/item/manufacturer lookups (the item loop **filters** items to known warehouses and
+**creates** items on a lookup-miss, so empty lookups drop or duplicate items), and has a
+**read-only** diagnostic tail that dumps the NS item list + `custbody_stock_adjustment` + whether the
+referenced fulfillment already exists in TOGA.
 
 ```
 php crons/toga2/netsuite/diagnose_hh_import_inventory_adjustment.php <togaClient> <togaApi> <togaSecret> [adjustmentInternalId]
@@ -120,53 +167,53 @@ php crons/toga2/netsuite/diagnose_hh_import_inventory_adjustment.php <togaClient
 
 ## Go-live toggle
 
-`IS_ENABLED_INTEGRATION_INVENTORY_ADJUSTMENTS` is still **`false`** in `sync_togasupply_hh.php` —
-enabling it is the go-live switch for this feature on the scheduled cron.
-
-## Open / next-session — migrate the inventory-adjustment sync from SOAP to REST
-
-The inventory-adjustment sync is still **SOAP**: `App_NetSuite::getInventoryNumberFromSerialNumber` +
-`getInventoryNumber` per serial (`toga2.php` ~5371/5374), plus `getObject('inventoryAdjustment')`,
-`getItemDetails`, `detectItemType`, `getItemIsSerialized`, `getItemIsFulfillable`. For a **serialized**
-adjustment this is ~2 NetSuite SOAP round-trips **per serial** → ~1 hour for a large adjustment; the
-on-demand fulfillment import inherits the same cost. **Decision:** migrate the whole
-inventory-adjustment sync to REST via `App_Api_Netsuite_Rest` (`rest.php` already has
-`send`/`authenticate`/`suiteqlListAll`/`getCustomFieldValue`/`fetchItemById`/`listInventoryAdjustments`
-(minimal) — the gaps are a full inventory-adjustment fetch with inventory detail/serials, and an
-inventory-number/serial batch lookup). **This is the next session's task.**
+`IS_ENABLED_INTEGRATION_INVENTORY_ADJUSTMENTS` in `sync_togasupply_hh.php` is the go-live switch for
+this feature on the scheduled cron.
 
-## Known state — test adjustment 6516616
+## Validation (end-to-end, prod)
 
-NYCHH adjustment **6516616** (tranId **2136**) has **4 NON-serialized** items (adjustQtyBy
-1800/1800/700/40) and `custbody_stock_adjustment` → Item Fulfillment **#289938** (NS internal
-6507274). That fulfillment is **not yet imported** in TOGA, so the bridges stay empty until the
-on-demand import lands it. Import + item-sync of the adjustment itself works (4
-`InventoryAdjustmentItems`).
+- **Non-serialized:** linked adjustment **6994071** → fulfillment **6827251** — header FK + line FK
+  both populate.
+- **Serialized:** linked adjustment **6871592** → fulfillment **6868763** (2 serials) — header FK,
+  line FK, **and 2 serial units on BOTH** the adjustment item and the fulfillment item all populate
+  correctly.
 
 ## Gotchas / known issues
 
 - **Older adjustments have no link.** `custbody_stock_adjustment` was added in NetSuite <1 year ago;
-  adjustments predating it will never populate a bridge — not a bug.
-- **The attach is best-effort by design.** It is gated NYCHH-only and wrapped in `try/catch`; a link
-  failure logs and lets the adjustment import complete. Do not "harden" it into a throw — a bridge miss
-  must not freeze `INVENTORY_ADJUSTMENTS`.
+  adjustments predating it will never populate an FK — not a bug.
+- **Reading the product uuid at `depth=2` silently returns nothing** — the level-3 `item` object is
+  omitted at max depth. Use `depth=3` + explicit nested `fields` (see above).
+- **A V2 PUT echo that omits `itemFulfillment` does NOT mean the write failed** — verify against the
+  DB / `Logs_<Client>.Api`, not the echoed body.
 - **Empty lookups drop or duplicate items.** The item loop filters to known warehouses and creates
   items on lookup-miss, so any manual/diagnostic invocation must seed the warehouse/item/manufacturer
   lookups (the harness does).
 
 ## Change history
 
-- 2026-08-28 — Built NYCHH inventory-adjustment → item-fulfillment linking off NetSuite
-  `custbody_stock_adjustment` (internalId 9735): two all-client bridges
-  (`ItemFulfillments_InventoryAdjustments` record 353 / `ItemFulfillmentItems_InventoryAdjustmentItems`
-  record 354, Core-registered + Super-User/per-client ACL), a gated best-effort
-  `App_Api_Toga2::attachInventoryAdjustmentToItemFulfillment` (resolves the fulfillment by
-  `c_netsuiteInternalItemFulfillmentId`, idempotent header + itemId-matched line links), and **on-demand
-  import** of a not-yet-imported fulfillment via `syncItemFulfillmentFromNetsuite` (cascades to the SO)
-  — which expanded `syncInventoryAdjustmentFromNetsuite` 5→13 args to thread the full IF lookup set.
-  Fixed two shared-engine bugs: the stale-item prune deleted an item before its child units (FK
-  RESTRICT → 1451/EV-11 — now deletes units first), and the item lookup was consumed two-level while the
-  cron populates it one-level `[$partNumber]` (re-created items every run → duplicates/EV-10 — now
-  one-level). Added the `diagnose_hh_import_inventory_adjustment.php` operator harness. Go-live toggle
-  `IS_ENABLED_INTEGRATION_INVENTORY_ADJUSTMENTS` still false. **Open (next session):** migrate the
-  inventory-adjustment sync from SOAP (~2 round-trips/serial, ~1h for a large adjustment) to REST. (jcardinal)
+- 2026-08-29 — **Migrated the feature to direct FK columns over REST, and made it fail loud.**
+  Replaced the two bridge tables with direct FK columns
+  (`InventoryAdjustments.itemFulfillmentId` reusing `RecordField` 2517/record 154;
+  `InventoryAdjustmentItems.itemFulfillmentItemId` reusing 2521/record 155 — no new Core
+  registration/ACL). Migrated `syncInventoryAdjustmentFromNetsuite` and its on-demand
+  fulfillment/sales-order import **SOAP → REST** (was ~2 round-trips/serial → ~1h for a large
+  serialized adjustment), and removed the error-log-and-swallow `try/catch` in the NetSuite→DB sync
+  path (StarTech/Sentry catches left alone). Fixed three read-path traps hit along the way: the REST
+  **record-sublist `limit`/`offset` 400** (`fetchItemFulfillmentById` returned 0 lines → header-only
+  import; now uses SuiteQL `transactionline`), the **ItemShip 3-rows-per-item** filter (keep the
+  `SalesOrd`/`TrnfrOrd` line-linked line, `mainline='F'` is wrong), and the **V2 max-depth FK
+  omission** (`depth=2` dropped `salesOrderItem.item` → now `depth=3` + explicit nested fields).
+  Discovered a **V2 PUT echo can omit a field that persisted** (verified via `Logs_Nychh.Api`, no
+  NetSuite access). Validated end-to-end in prod: non-serialized 6994071→6827251 and serialized
+  6871592→6868763 (header FK, line FK, and 2 serial units on both sides). (jcardinal)
+- 2026-08-28 — Built the initial NYCHH inventory-adjustment → item-fulfillment linking off NetSuite
+  `custbody_stock_adjustment` (internalId 9735) as **two all-client bridge tables** (header record
+  353 / item record 354, Core-registered + Super-User/per-client ACL) with a gated best-effort
+  `App_Api_Toga2::attachInventoryAdjustmentToItemFulfillment` and **on-demand import** of a
+  not-yet-imported fulfillment via `syncItemFulfillmentFromNetsuite` (cascades to the SO) — which
+  expanded `syncInventoryAdjustmentFromNetsuite` 5→13 args to thread the full IF lookup set. Fixed the
+  two shared-engine bugs (prune child units before the item — FK RESTRICT/1451/EV-11; index the item
+  lookup one-level `[$partNumber]` — was two-level dead → duplicates/EV-10). Added the
+  `diagnose_hh_import_inventory_adjustment.php` operator harness. *(This bridge-table design was
+  superseded by the 2026-08-29 direct-FK / REST migration above.)* (jcardinal)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.696",
+  "version": "1.0.698",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",