celerp 2.0.0__tar.gz → 2.1.0__tar.gz

{celerp-2.0.0 → celerp-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: celerp
-Version: 2.0.0
+Version: 2.1.0
 Summary: Free, self-hosted ERP for small businesses
 License: Business Source License 1.1
         

{celerp-2.0.0 → celerp-2.1.0}/celerp/cli.py

@@ -10,6 +10,7 @@ import signal
 import subprocess
 import sys
 import time
+from contextlib import contextmanager
 from pathlib import Path
 
 import click
@@ -639,21 +640,19 @@ def _stamped_revision(db_url: str) -> str | None:
         engine.dispose()
 
 
-def _migrate_to_head(db_url: str) -> None:
-    """Apply pending migrations, the grants, then the develop→release reconcile.
+@contextmanager
+def _migration_lock(db_url: str):
+    """Hold the shared Postgres migration advisory lock for the wrapped block.
 
-    Shared by `celerp migrate` and `celerp start` so the steps and their order
-    exist once. The start path cannot drift from the explicit command.
+    Single source of the lock protocol (acquire, guaranteed release, engine
+    disposal), so every path that migrates a database serializes the same way
+    and cannot drift. Reused by `_migrate_to_head` and the restore reconcile.
 
-    Held under a Postgres advisory lock, because a service restart overlapping a
-    manual start would otherwise have both processes migrating the same database:
-    the loser re-applies DDL that already exists and is stamped past it by the
+    The lock exists because a service restart overlapping a manual start would
+    otherwise have both processes migrating the same database: the loser
+    re-applies DDL that already exists and is stamped past it by the
     duplicate-object handler, which reaches the right answer for the wrong
     reason. The second holder waits here and then finds nothing pending.
-
-    Reports the stamp it moved, and says nothing when it moved nothing, so a
-    routine start is as quiet as it was and a start that changed the schema
-    cannot be mistaken for one that did not.
     """
     from sqlalchemy import create_engine, text
 
@@ -662,25 +661,40 @@ def _migrate_to_head(db_url: str) -> None:
     engine = create_engine(_sync_url(db_url), pool_pre_ping=True).execution_options(
         isolation_level="AUTOCOMMIT"
     )
-    before = after = None
     try:
         with engine.connect() as lock_conn:
             lock_conn.execute(text("SELECT pg_advisory_lock(:key)"), {"key": _MIGRATION_LOCK_KEY})
             try:
-                before = _stamped_revision(db_url)
-                _run_migrations(db_url)
-                _post_migration_grants(db_url)
-                _reconcile_after_migrate(db_url)
-                # Read inside the lock: outside it, a process queued behind this
-                # one could move the stamp further and this would report a
-                # transition that never happened here.
-                after = _stamped_revision(db_url)
+                yield
             finally:
                 lock_conn.execute(
                     text("SELECT pg_advisory_unlock(:key)"), {"key": _MIGRATION_LOCK_KEY}
                 )
     finally:
         engine.dispose()
+
+
+def _migrate_to_head(db_url: str) -> None:
+    """Apply pending migrations, the grants, then the develop→release reconcile.
+
+    Shared by `celerp migrate` and `celerp start` so the steps and their order
+    exist once. The start path cannot drift from the explicit command. Held
+    under the shared migration advisory lock (`_migration_lock`).
+
+    Reports the stamp it moved, and says nothing when it moved nothing, so a
+    routine start is as quiet as it was and a start that changed the schema
+    cannot be mistaken for one that did not.
+    """
+    before = after = None
+    with _migration_lock(db_url):
+        before = _stamped_revision(db_url)
+        _run_migrations(db_url)
+        _post_migration_grants(db_url)
+        _reconcile_after_migrate(db_url)
+        # Read inside the lock: outside it, a process queued behind this one
+        # could move the stamp further and this would report a transition that
+        # never happened here.
+        after = _stamped_revision(db_url)
     if after != before:
         click.echo(f"  ✓ Database migrated: {before or 'base'} -> {after}")
 
@@ -693,6 +707,13 @@ def _reconcile_after_migrate(db_url: str) -> None:
     are idempotent, so a redundant run would be a no-op anyway. The projection
     rebuild (the other half of the version-change reconcile) runs in the API
     lifespan, where module projection handlers are loaded.
+
+    Each backfill replays in its own transaction; the version marker is written
+    in a SEPARATE final transaction, and only when every backfill succeeded, so
+    a backfill that fails is retried on the next start instead of being marked
+    done for this version's lifetime. The marker write no longer shares a
+    transaction with the replay, so its own failure cannot roll back committed
+    backfills.
     """
     import sqlalchemy as _sa
 
@@ -710,8 +731,16 @@ def _reconcile_after_migrate(db_url: str) -> None:
         with engine.begin() as conn:
             if get_meta(conn, BACKFILL_VERSION_KEY) == __version__:
                 return  # already reconciled for this version
-            replayed = replay_data_backfills(conn)
-            set_meta(conn, BACKFILL_VERSION_KEY, __version__)
+        replayed, failures = replay_data_backfills(engine)
+        if failures:
+            click.echo(
+                f"  ! {len(failures)} data-backfill migration(s) failed to reconcile for "
+                f"{__version__}; leaving the version marker unset so they retry next start: "
+                f"{', '.join(failures)}"
+            )
+        else:
+            with engine.begin() as conn:
+                set_meta(conn, BACKFILL_VERSION_KEY, __version__)
         if replayed:
             click.echo(f"  · Reconciled {len(replayed)} data-backfill migration(s) for {__version__}")
     finally:

{celerp-2.0.0 → celerp-2.1.0}/celerp/events/schemas.py

@@ -125,6 +125,10 @@ class ItemSplit(BaseModel):
     # One entry per child: {child_id, child_sku, origin_event_id, qty_before, qty_after,
     # pieces_before, pieces_after, weight_before, weight_after}. Sequential mother deltas.
     children_detail: list[dict[str, Any]] = Field(default_factory=list)
+    # Weight expected to remain minus weight measured, recorded only when a real
+    # measurement exists (full weighed break-up, or an operator re-weigh). None when
+    # the remainder is only derived, so no false anomaly is asserted.
+    delta: float | None = None
 
 
 class ItemSplitFrom(BaseModel):
@@ -150,6 +154,9 @@ class ItemTransform(BaseModel):
     pieces_after: float | None = None
     weight_before: float | None = None
     weight_after: float | None = None
+    # Processing/trim loss: mother weight in minus child weight out, recorded only
+    # when both weights exist. None otherwise (no fabricated loss).
+    delta: float | None = None
 
 
 class ItemTransformedFrom(BaseModel):

{celerp-2.0.0 → celerp-2.1.0}/celerp/main.py

@@ -211,9 +211,20 @@ async def lifespan(_app: FastAPI):
             # instance that already has companies).
             from celerp.modules.slots import fire_lifecycle as _fire
             from celerp.db import SessionLocal as _SessionLocal
+            # Best-effort, like the two sibling blocks below: a hook that fails
+            # during flush poisons the shared session, so the commit raises.
+            # Roll back and log at ERROR rather than let that crash boot - the
+            # manufacturing seed hook, for one, must never be able to take the
+            # app down.
             async with _SessionLocal() as _sess:
-                await _fire("on_modules_ready", session=_sess)
-                await _sess.commit()
+                try:
+                    await _fire("on_modules_ready", session=_sess)
+                    await _sess.commit()
+                except Exception:
+                    await _sess.rollback()
+                    logging.getLogger(__name__).exception(
+                        "on_modules_ready hooks failed (non-fatal); their data was rolled back"
+                    )
 
             # A bundled default whose content no longer matches the first-party
             # lock is demoted to untrusted. Surface that in the notification bell
@@ -255,6 +266,21 @@ async def lifespan(_app: FastAPI):
             "stale until rebuilt via doctor or /ledger/rebuild"
         )
 
+    # One-time backfill: stamp the status→document pairing on items sold, memo'd,
+    # or consigned in before that field shipped, so their inventory status links
+    # to its document. Marker-gated (runs once); non-fatal like the guard above.
+    try:
+        from celerp.db import SessionLocal as _BackfillSession
+        from celerp.services.status_doc_backfill import run_status_doc_backfill
+        async with _BackfillSession() as _bf_sess:
+            await run_status_doc_backfill(_bf_sess)
+            await _bf_sess.commit()
+    except Exception:
+        logging.getLogger(__name__).exception(
+            "Status-doc backfill failed (non-fatal); pre-existing sold/memo items "
+            "may show their status without a document link until a later boot"
+        )
+
     # Bring up the relay tunnel per the lazy free-tier lifecycle (3.1). A token-holder
     # is past first activation and never re-enters it. Paid instances (public_url set)
     # keep the tunnel always-on; a free instance opens it at boot only when it already

{celerp-2.0.0 → celerp-2.1.0}/celerp/migrations/_data_reconcile.py

@@ -20,13 +20,16 @@ against — so no SQL is duplicated and nothing is monkeypatched.
 """
 from __future__ import annotations
 
+import logging
 from pathlib import Path
 from typing import TYPE_CHECKING
 
 from celerp.migrations._auto_stamp import extract_signatures
 
 if TYPE_CHECKING:
-    from sqlalchemy.engine import Connection
+    from sqlalchemy.engine import Connection, Engine
+
+_log = logging.getLogger(__name__)
 
 # ── Instance metadata marker ────────────────────────────────────────────────
 # A tiny key/value table recording which celerp version last applied each
@@ -92,22 +95,37 @@ def data_backfill_scripts():
     return out
 
 
-def replay_data_backfills(connection: "Connection") -> list[str]:
-    """Re-run every data-backfill migration's `upgrade()` against `connection`.
+def replay_data_backfills(engine: "Engine") -> tuple[list[str], list[str]]:
+    """Re-run every data-backfill migration's `upgrade()`, each in its OWN
+    transaction, against `engine`.
+
+    A per-backfill top-level transaction (not a savepoint inside one outer
+    transaction) is what makes the replay durable: each backfill that succeeds
+    commits on its own, so a later backfill failure, or a failed marker write
+    afterwards, cannot silently undo work that already converged. One failing
+    backfill is logged loudly and skipped; the rest still run.
 
-    `connection` is a sync SQLAlchemy Connection; the caller owns the
-    transaction. Returns the revision ids replayed, in apply order.
+    Returns `(replayed, failures)`: the revision ids that applied cleanly and
+    the ids that raised, both in apply order.
     """
     from alembic.operations import Operations
     from alembic.runtime.migration import MigrationContext
 
     scripts = data_backfill_scripts()
-    ctx = MigrationContext.configure(connection)
     replayed: list[str] = []
-    # Operations.context binds the global `alembic.op` proxy these migrations
-    # import, so their `op.get_bind()` returns this connection.
-    with Operations.context(ctx):
-        for sc in scripts:
-            sc.module.upgrade()
+    failures: list[str] = []
+    for sc in scripts:
+        try:
+            with engine.begin() as conn:
+                ctx = MigrationContext.configure(conn)
+                # Operations.context binds the global `alembic.op` proxy these
+                # migrations import, so their `op.get_bind()` returns this
+                # connection; the with-block commits on clean exit, rolls back
+                # on any exception.
+                with Operations.context(ctx):
+                    sc.module.upgrade()
             replayed.append(sc.revision)
-    return replayed
+        except Exception:
+            _log.exception("data backfill %s failed to replay; skipping it", sc.revision)
+            failures.append(sc.revision)
+    return replayed, failures

{celerp-2.0.0 → celerp-2.1.0}/celerp/migrations/env.py

@@ -35,7 +35,12 @@ except ImportError:
 config = context.config
 
 if config.config_file_name is not None:
-    fileConfig(config.config_file_name)
+    # disable_existing_loggers=False: alembic runs in-process during
+    # `celerp migrate`/`celerp start` and the restore reconcile, so the default
+    # (True) would silence every application logger already created, including
+    # the reconcile's own failure logger. Configure alembic's loggers without
+    # muting the app's.
+    fileConfig(config.config_file_name, disable_existing_loggers=False)
 
 target_metadata = Base.metadata
 

celerp-2.1.0/celerp/migrations/versions/e7c9a1b3d5f2_work_center_default_columns.py

@@ -0,0 +1,51 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+
+"""work center hours_per_day + is_default columns and the one-default index
+
+Revision ID: e7c9a1b3d5f2
+Revises: d5e6f7a8b9c0
+Create Date: 2026-08-06
+
+Adds hours_per_day and is_default to work_centers and the partial unique index
+that enforces one default center per company. Verifiable DDL only (op.*), so
+extract_signatures detects it and the auto-stamp walker never false-stamps a
+create_all/restore database past these columns. The data move (seeding a
+Default center, the notice, stripping the old setting) lives in the child
+data-backfill migration f8a9b0c1d2e3. Forward-only.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "e7c9a1b3d5f2"
+down_revision = "d5e6f7a8b9c0"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("work_centers", sa.Column("hours_per_day", sa.Float(), nullable=True))
+    # NOT NULL with a transient server default so existing rows backfill to false,
+    # then drop the default for parity with the model (celerp/models/company.py
+    # declares none). is_default is added before the index that references it.
+    op.add_column(
+        "work_centers",
+        sa.Column("is_default", sa.Boolean(), nullable=False, server_default=sa.text("false")),
+    )
+    op.create_index(
+        "uq_work_center_one_default",
+        "work_centers",
+        ["company_id"],
+        unique=True,
+        postgresql_where=sa.text("is_default"),
+    )
+    op.alter_column("work_centers", "is_default", server_default=None)
+
+
+def downgrade() -> None:
+    op.drop_index("uq_work_center_one_default", table_name="work_centers")
+    op.drop_column("work_centers", "is_default")
+    op.drop_column("work_centers", "hours_per_day")

celerp-2.1.0/celerp/migrations/versions/f8a9b0c1d2e3_work_center_default_backfill.py

@@ -0,0 +1,93 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+
+"""seed a Default work center and move the hours_per_day setting onto it
+
+Revision ID: f8a9b0c1d2e3
+Revises: e7c9a1b3d5f2
+Create Date: 2026-08-06
+
+The data half of the work-center default split. Signature-less (raw SQL), so
+the develop-to-release reconcile replays it on every create_all/restore
+database once the schema migration has added the columns. Seeds one Default
+center per manufacturing-active company carrying the old company hours value
+(the module's x-or-8.0 mapping), posts one company-wide notice that the setting
+moved, and strips the now-migrated settings key. Idempotent: every step guards
+against a prior application, because it replays on each version-change
+reconcile and, on a restore boot, can be both alembic-applied and
+reconcile-replayed in one pass. Forward-only.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "f8a9b0c1d2e3"
+down_revision = "e7c9a1b3d5f2"
+branch_labels = None
+depends_on = None
+
+_NOTICE_TITLE = "Hours per day moved to work centers"
+_NOTICE_BODY = (
+    "Your company Hours per day setting now lives on the new Default work center under "
+    "Settings > Manufacturing > Work centers. Nothing changed in your To-Make estimates."
+)
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # One dedicated Default center per manufacturing-active company, carrying its
+    # old hours value. The nested CASE mirrors the module's `x or 8.0`: a stored
+    # 0, blank, absent, or non-numeric value maps to 8.0. The regex guard runs
+    # BEFORE the ::float cast because Postgres does not guarantee AND
+    # short-circuit, so a flat `regex AND value::float` would still cast 'abc'
+    # and abort the whole insert. settings is a JSON column, so the ? membership
+    # test needs a jsonb cast; the -> / ->> extraction works on json directly.
+    conn.execute(sa.text("""
+        INSERT INTO work_centers (id, company_id, name, hours_per_day, is_default, created_at)
+        SELECT gen_random_uuid(), c.id, 'Default',
+               CASE WHEN (c.settings->'manufacturing'->>'hours_per_day') ~ '^[0-9]+(\\.[0-9]+)?$'
+                    THEN CASE WHEN (c.settings->'manufacturing'->>'hours_per_day')::float <> 0
+                              THEN (c.settings->'manufacturing'->>'hours_per_day')::float
+                              ELSE 8.0 END
+                    ELSE 8.0 END,
+               true, NOW()
+        FROM companies c
+        WHERE (c.settings::jsonb ? 'manufacturing'
+               OR EXISTS (SELECT 1 FROM work_centers wc WHERE wc.company_id = c.id))
+          AND NOT EXISTS (SELECT 1 FROM work_centers d WHERE d.company_id = c.id AND d.is_default)
+    """))
+
+    # One company-wide notice per company that just received a Default center
+    # (user_id NULL = company-wide). Guarded so a re-run never doubles it. The
+    # notifications table is created when the application boots, not by the
+    # migration chain, so on a database migrated before its first boot it is
+    # absent. Such a database has never run the app and therefore holds no
+    # company whose value could have moved, so there is nothing to notify. The
+    # regclass check is unqualified so it resolves against the same search path
+    # the INSERT targets (public in production), not a hardcoded schema.
+    if conn.execute(sa.text("SELECT to_regclass('notifications')")).scalar() is not None:
+        conn.execute(sa.text("""
+            INSERT INTO notifications
+                (id, company_id, user_id, category, title, body, action_url, priority, read, created_at)
+            SELECT gen_random_uuid(), w.company_id, NULL, 'manufacturing', :title, :body,
+                   '/settings/manufacturing', 'high', false, NOW()
+            FROM work_centers w
+            WHERE w.is_default
+              AND w.name = 'Default'
+              AND NOT EXISTS (SELECT 1 FROM notifications n
+                              WHERE n.company_id = w.company_id AND n.title = :title)
+        """), {"title": _NOTICE_TITLE, "body": _NOTICE_BODY})
+
+    # Strip the now-migrated key (jsonb #- needs the cast, then back to json).
+    conn.execute(sa.text(
+        "UPDATE companies SET settings = (settings::jsonb #- '{manufacturing,hours_per_day}')::json "
+        "WHERE settings::jsonb #> '{manufacturing,hours_per_day}' IS NOT NULL"
+    ))
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+    conn.execute(sa.text("DELETE FROM work_centers WHERE is_default AND name = 'Default'"))

{celerp-2.0.0 → celerp-2.1.0}/celerp/models/company.py

@@ -42,9 +42,17 @@ class WorkCenter(Base):
 
     Optionally carries a WIP location, an hourly labor rate and a capacity (capacity is reserved for
     later scheduling work). Runs may reference a work centre via work_center_id.
+
+    hours_per_day is the working day length used to turn daily labour into hours; the
+    company's default centre supplies it to the To-Make board. A partial unique index
+    keeps at most one default centre per company.
     """
     __tablename__ = "work_centers"
-    __table_args__ = (UniqueConstraint("company_id", "name", name="uq_work_center_company_name"),)
+    __table_args__ = (
+        UniqueConstraint("company_id", "name", name="uq_work_center_company_name"),
+        sa.Index("uq_work_center_one_default", "company_id",
+                 unique=True, postgresql_where=sa.text("is_default")),
+    )
 
     id: Mapped[uuid.UUID] = mapped_column(sa.Uuid(as_uuid=True), primary_key=True, default=uuid.uuid4)
     company_id: Mapped[uuid.UUID] = mapped_column(ForeignKey("companies.id"), nullable=False)
@@ -52,6 +60,8 @@ class WorkCenter(Base):
     wip_location_id: Mapped[uuid.UUID | None] = mapped_column(sa.Uuid(as_uuid=True), nullable=True)
     labor_rate: Mapped[float | None] = mapped_column(sa.Float, nullable=True)
     capacity: Mapped[float | None] = mapped_column(sa.Float, nullable=True)
+    hours_per_day: Mapped[float | None] = mapped_column(sa.Float, nullable=True)
+    is_default: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=lambda: datetime.now(timezone.utc), nullable=False)
 
 

{celerp-2.0.0 → celerp-2.1.0}/celerp/modules/slots.py

@@ -60,7 +60,9 @@ async def fire_lifecycle(slot: str, **kwargs) -> None:
 
     Each contribution must have a "handler" key pointing to a dotted path
     "module.path:function_name". The function is called with **kwargs.
-    Failures are logged and swallowed (non-fatal).
+    A failing hook never blocks its siblings or boot: it is logged at ERROR
+    (with traceback) and swallowed, so a recurrence surfaces as an alert
+    instead of vanishing.
     """
     import importlib
     import logging
@@ -77,7 +79,7 @@ async def fire_lifecycle(slot: str, **kwargs) -> None:
             func = getattr(mod, func_name)
             await func(**kwargs)
         except Exception as exc:
-            _log.warning(
+            _log.exception(
                 "Lifecycle hook %s from %s failed: %s",
                 slot, contrib.get("_module", "?"), exc,
             )

{celerp-2.0.0 → celerp-2.1.0}/celerp/routers/companies.py

@@ -559,10 +559,19 @@ async def list_users(company_id=Depends(get_current_company_id), session: AsyncS
     return {"items": items, "total": len(items)}
 
 
+def _assert_role_assignable(caller_role: str, target_role: str) -> None:
+    """A holder of manage_users may not assign a role above their own. The matrix can
+    grant manage_users down to any role, so this ceiling is what stops that from
+    becoming a self-promotion path."""
+    if ROLE_LEVELS[target_role] > ROLE_LEVELS[caller_role]:
+        raise HTTPException(status_code=403, detail="You cannot assign a role above your own.")
+
+
 @router.post("/me/users")
 async def create_user(
     payload: UserCreate,
     company_id=Depends(get_current_company_id),
+    caller_role: str = Depends(get_current_role),
     _: None = require_permission("manage_users"),
     session: AsyncSession = Depends(get_session),
 ) -> dict:
@@ -570,6 +579,7 @@ async def create_user(
 
     if payload.role not in ROLE_LEVELS:
         raise HTTPException(400, f"Invalid role. Must be one of: {', '.join(sorted(ROLE_LEVELS, key=ROLE_LEVELS.get))}")
+    _assert_role_assignable(caller_role, payload.role)
 
     # Check if user with this email already exists globally; if so, just link them.
     existing_user = (await session.execute(select(User).where(User.email == payload.email))).scalar_one_or_none()
@@ -615,6 +625,7 @@ async def patch_user(
     user_id: uuid.UUID,
     payload: UserPatch,
     company_id=Depends(get_current_company_id),
+    caller_role: str = Depends(get_current_role),
     _: None = require_permission("manage_users"),
     session: AsyncSession = Depends(get_session),
 ) -> dict:
@@ -627,11 +638,16 @@ async def patch_user(
     )).scalar_one_or_none()
     if not user or not link:
         raise HTTPException(status_code=404, detail="User not found")
+    # A holder of manage_users may not modify a user whose role outranks their own.
+    if ROLE_LEVELS.get(link.role, 0) > ROLE_LEVELS[caller_role]:
+        raise HTTPException(status_code=403, detail="You cannot modify a user whose role is above your own.")
     if payload.name is not None:
         user.name = payload.name
     if payload.role is not None:
         if payload.role not in ROLE_LEVELS:
             raise HTTPException(400, f"Invalid role. Must be one of: {', '.join(sorted(ROLE_LEVELS, key=ROLE_LEVELS.get))}")
+        # Nor may they promote anyone above their own role.
+        _assert_role_assignable(caller_role, payload.role)
         # Guard: cannot demote the last active owner
         old_level = ROLE_LEVELS.get(link.role, 0)
         new_level = ROLE_LEVELS.get(payload.role, 0)

{celerp-2.0.0 → celerp-2.1.0}/celerp/services/backup_import.py

@@ -298,10 +298,19 @@ async def _reconcile_schema() -> str | None:
     from celerp.config import settings
 
     def _sync() -> None:
-        from celerp.cli import _apply_migrations, _post_migration_grants, _reconcile_after_migrate
-        _apply_migrations(settings.database_url)
-        _post_migration_grants(settings.database_url)
-        _reconcile_after_migrate(settings.database_url)
+        from celerp.cli import (
+            _apply_migrations,
+            _migration_lock,
+            _post_migration_grants,
+            _reconcile_after_migrate,
+        )
+        # Serialize under the shared migration advisory lock, the same one
+        # `celerp migrate`/`celerp start` hold, so a restore reconcile cannot
+        # run concurrently with a service migration or a second restore.
+        with _migration_lock(settings.database_url):
+            _apply_migrations(settings.database_url)
+            _post_migration_grants(settings.database_url)
+            _reconcile_after_migrate(settings.database_url)
 
     try:
         await asyncio.get_event_loop().run_in_executor(None, _sync)

{celerp-2.0.0 → celerp-2.1.0}/celerp/services/field_schema.py

@@ -19,6 +19,11 @@ from celerp.services.pricing import is_cost_list_name, is_derived, price_key
 # "Mixed", stored and displayed verbatim — no separate lowercase sentinel vs capitalized label.
 MIXED_VALUE = "Mixed"
 
+# Item amount fields hand-edited on the item surface, gated by the
+# edit_inventory_amounts permission. One source of truth, mirroring the
+# COST_ITEM_KEYS precedent in celerp.services.cost_visibility.
+AMOUNT_ITEM_KEYS: frozenset[str] = frozenset({"quantity", "weight", "pieces", "gross_weight"})
+
 # Default price lists (used when company has none configured)
 _DEFAULT_PRICE_LISTS: list[dict] = [
     {"name": "Wholesale"},
@@ -51,6 +56,7 @@ _BASE_FIELDS: list[dict] = [
     {"key": "barcode",           "label": "Barcode",           "type": "text",   "editable": True,  "required": False, "options": [],                                            "visible_to_roles": [],               "position": 104, "show_in_table": True,  "tooltip_key": "field.tooltip.barcode"},
     {"key": "hs_code",           "label": "HS Code",           "type": "text",   "editable": True,  "required": False, "options": [],                                            "visible_to_roles": [],               "position": 104.5, "show_in_table": False, "tooltip_key": "field.tooltip.hs_code"},
     {"key": "country_of_origin", "label": "Country of Origin", "type": "text",   "editable": True,  "required": False, "options": [],                                            "visible_to_roles": [],               "position": 104.52,"show_in_table": False, "tooltip_key": "field.tooltip.country_of_origin"},
+    {"key": "preferred_supplier","label": "Preferred Supplier","type": "text",   "editable": True,  "required": False, "options": [],                                            "visible_to_roles": [],               "position": 104.54,"show_in_table": False, "tooltip_key": "field.tooltip.preferred_supplier"},
     {"key": "batch_no",          "label": "Batch / Lot No",    "type": "text",   "editable": True,  "required": False, "options": [],                                            "visible_to_roles": [],               "position": 104.55,"show_in_table": False, "tooltip_key": "field.tooltip.batch_no"},
     {"key": "purchase_sku",              "label": "Purchase SKU",              "type": "text",   "editable": True,  "required": False, "options": [],  "visible_to_roles": [],  "position": 104.6, "show_in_table": False, "tooltip_key": "field.tooltip.purchase_sku"},
     {"key": "purchase_name",             "label": "Purchase Name",             "type": "text",   "editable": True,  "required": False, "options": [],  "visible_to_roles": [],  "position": 104.7, "show_in_table": False, "tooltip_key": "field.tooltip.purchase_name"},