celerp 2.0.0__tar.gz → 2.1.1__tar.gz

{celerp-2.0.0 → celerp-2.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: celerp
-Version: 2.0.0
+Version: 2.1.1
 Summary: Free, self-hosted ERP for small businesses
 License: Business Source License 1.1
         

{celerp-2.0.0 → celerp-2.1.1}/celerp/cli.py

@@ -10,6 +10,7 @@ import signal
 import subprocess
 import sys
 import time
+from contextlib import contextmanager
 from pathlib import Path
 
 import click
@@ -639,21 +640,19 @@ def _stamped_revision(db_url: str) -> str | None:
         engine.dispose()
 
 
-def _migrate_to_head(db_url: str) -> None:
-    """Apply pending migrations, the grants, then the develop→release reconcile.
+@contextmanager
+def _migration_lock(db_url: str):
+    """Hold the shared Postgres migration advisory lock for the wrapped block.
 
-    Shared by `celerp migrate` and `celerp start` so the steps and their order
-    exist once. The start path cannot drift from the explicit command.
+    Single source of the lock protocol (acquire, guaranteed release, engine
+    disposal), so every path that migrates a database serializes the same way
+    and cannot drift. Reused by `_migrate_to_head` and the restore reconcile.
 
-    Held under a Postgres advisory lock, because a service restart overlapping a
-    manual start would otherwise have both processes migrating the same database:
-    the loser re-applies DDL that already exists and is stamped past it by the
+    The lock exists because a service restart overlapping a manual start would
+    otherwise have both processes migrating the same database: the loser
+    re-applies DDL that already exists and is stamped past it by the
     duplicate-object handler, which reaches the right answer for the wrong
     reason. The second holder waits here and then finds nothing pending.
-
-    Reports the stamp it moved, and says nothing when it moved nothing, so a
-    routine start is as quiet as it was and a start that changed the schema
-    cannot be mistaken for one that did not.
     """
     from sqlalchemy import create_engine, text
 
@@ -662,25 +661,40 @@ def _migrate_to_head(db_url: str) -> None:
     engine = create_engine(_sync_url(db_url), pool_pre_ping=True).execution_options(
         isolation_level="AUTOCOMMIT"
     )
-    before = after = None
     try:
         with engine.connect() as lock_conn:
             lock_conn.execute(text("SELECT pg_advisory_lock(:key)"), {"key": _MIGRATION_LOCK_KEY})
             try:
-                before = _stamped_revision(db_url)
-                _run_migrations(db_url)
-                _post_migration_grants(db_url)
-                _reconcile_after_migrate(db_url)
-                # Read inside the lock: outside it, a process queued behind this
-                # one could move the stamp further and this would report a
-                # transition that never happened here.
-                after = _stamped_revision(db_url)
+                yield
             finally:
                 lock_conn.execute(
                     text("SELECT pg_advisory_unlock(:key)"), {"key": _MIGRATION_LOCK_KEY}
                 )
     finally:
         engine.dispose()
+
+
+def _migrate_to_head(db_url: str) -> None:
+    """Apply pending migrations, the grants, then the develop→release reconcile.
+
+    Shared by `celerp migrate` and `celerp start` so the steps and their order
+    exist once. The start path cannot drift from the explicit command. Held
+    under the shared migration advisory lock (`_migration_lock`).
+
+    Reports the stamp it moved, and says nothing when it moved nothing, so a
+    routine start is as quiet as it was and a start that changed the schema
+    cannot be mistaken for one that did not.
+    """
+    before = after = None
+    with _migration_lock(db_url):
+        before = _stamped_revision(db_url)
+        _run_migrations(db_url)
+        _post_migration_grants(db_url)
+        _reconcile_after_migrate(db_url)
+        # Read inside the lock: outside it, a process queued behind this one
+        # could move the stamp further and this would report a transition that
+        # never happened here.
+        after = _stamped_revision(db_url)
     if after != before:
         click.echo(f"  ✓ Database migrated: {before or 'base'} -> {after}")
 
@@ -693,6 +707,13 @@ def _reconcile_after_migrate(db_url: str) -> None:
     are idempotent, so a redundant run would be a no-op anyway. The projection
     rebuild (the other half of the version-change reconcile) runs in the API
     lifespan, where module projection handlers are loaded.
+
+    Each backfill replays in its own transaction; the version marker is written
+    in a SEPARATE final transaction, and only when every backfill succeeded, so
+    a backfill that fails is retried on the next start instead of being marked
+    done for this version's lifetime. The marker write no longer shares a
+    transaction with the replay, so its own failure cannot roll back committed
+    backfills.
     """
     import sqlalchemy as _sa
 
@@ -710,8 +731,16 @@ def _reconcile_after_migrate(db_url: str) -> None:
         with engine.begin() as conn:
             if get_meta(conn, BACKFILL_VERSION_KEY) == __version__:
                 return  # already reconciled for this version
-            replayed = replay_data_backfills(conn)
-            set_meta(conn, BACKFILL_VERSION_KEY, __version__)
+        replayed, failures = replay_data_backfills(engine)
+        if failures:
+            click.echo(
+                f"  ! {len(failures)} data-backfill migration(s) failed to reconcile for "
+                f"{__version__}; leaving the version marker unset so they retry next start: "
+                f"{', '.join(failures)}"
+            )
+        else:
+            with engine.begin() as conn:
+                set_meta(conn, BACKFILL_VERSION_KEY, __version__)
         if replayed:
             click.echo(f"  · Reconciled {len(replayed)} data-backfill migration(s) for {__version__}")
     finally:

{celerp-2.0.0 → celerp-2.1.1}/celerp/events/schemas.py

@@ -125,6 +125,10 @@ class ItemSplit(BaseModel):
     # One entry per child: {child_id, child_sku, origin_event_id, qty_before, qty_after,
     # pieces_before, pieces_after, weight_before, weight_after}. Sequential mother deltas.
     children_detail: list[dict[str, Any]] = Field(default_factory=list)
+    # Weight expected to remain minus weight measured, recorded only when a real
+    # measurement exists (full weighed break-up, or an operator re-weigh). None when
+    # the remainder is only derived, so no false anomaly is asserted.
+    delta: float | None = None
 
 
 class ItemSplitFrom(BaseModel):
@@ -150,6 +154,9 @@ class ItemTransform(BaseModel):
     pieces_after: float | None = None
     weight_before: float | None = None
     weight_after: float | None = None
+    # Processing/trim loss: mother weight in minus child weight out, recorded only
+    # when both weights exist. None otherwise (no fabricated loss).
+    delta: float | None = None
 
 
 class ItemTransformedFrom(BaseModel):

{celerp-2.0.0 → celerp-2.1.1}/celerp/main.py

@@ -211,9 +211,20 @@ async def lifespan(_app: FastAPI):
             # instance that already has companies).
             from celerp.modules.slots import fire_lifecycle as _fire
             from celerp.db import SessionLocal as _SessionLocal
+            # Best-effort, like the two sibling blocks below: a hook that fails
+            # during flush poisons the shared session, so the commit raises.
+            # Roll back and log at ERROR rather than let that crash boot - the
+            # manufacturing seed hook, for one, must never be able to take the
+            # app down.
             async with _SessionLocal() as _sess:
-                await _fire("on_modules_ready", session=_sess)
-                await _sess.commit()
+                try:
+                    await _fire("on_modules_ready", session=_sess)
+                    await _sess.commit()
+                except Exception:
+                    await _sess.rollback()
+                    logging.getLogger(__name__).exception(
+                        "on_modules_ready hooks failed (non-fatal); their data was rolled back"
+                    )
 
             # A bundled default whose content no longer matches the first-party
             # lock is demoted to untrusted. Surface that in the notification bell
@@ -255,6 +266,21 @@ async def lifespan(_app: FastAPI):
             "stale until rebuilt via doctor or /ledger/rebuild"
         )
 
+    # One-time backfill: stamp the status→document pairing on items sold, memo'd,
+    # or consigned in before that field shipped, so their inventory status links
+    # to its document. Marker-gated (runs once); non-fatal like the guard above.
+    try:
+        from celerp.db import SessionLocal as _BackfillSession
+        from celerp.services.status_doc_backfill import run_status_doc_backfill
+        async with _BackfillSession() as _bf_sess:
+            await run_status_doc_backfill(_bf_sess)
+            await _bf_sess.commit()
+    except Exception:
+        logging.getLogger(__name__).exception(
+            "Status-doc backfill failed (non-fatal); pre-existing sold/memo items "
+            "may show their status without a document link until a later boot"
+        )
+
     # Bring up the relay tunnel per the lazy free-tier lifecycle (3.1). A token-holder
     # is past first activation and never re-enters it. Paid instances (public_url set)
     # keep the tunnel always-on; a free instance opens it at boot only when it already

{celerp-2.0.0 → celerp-2.1.1}/celerp/migrations/_data_reconcile.py

@@ -20,13 +20,16 @@ against — so no SQL is duplicated and nothing is monkeypatched.
 """
 from __future__ import annotations
 
+import logging
 from pathlib import Path
 from typing import TYPE_CHECKING
 
 from celerp.migrations._auto_stamp import extract_signatures
 
 if TYPE_CHECKING:
-    from sqlalchemy.engine import Connection
+    from sqlalchemy.engine import Connection, Engine
+
+_log = logging.getLogger(__name__)
 
 # ── Instance metadata marker ────────────────────────────────────────────────
 # A tiny key/value table recording which celerp version last applied each
@@ -92,22 +95,37 @@ def data_backfill_scripts():
     return out
 
 
-def replay_data_backfills(connection: "Connection") -> list[str]:
-    """Re-run every data-backfill migration's `upgrade()` against `connection`.
+def replay_data_backfills(engine: "Engine") -> tuple[list[str], list[str]]:
+    """Re-run every data-backfill migration's `upgrade()`, each in its OWN
+    transaction, against `engine`.
+
+    A per-backfill top-level transaction (not a savepoint inside one outer
+    transaction) is what makes the replay durable: each backfill that succeeds
+    commits on its own, so a later backfill failure, or a failed marker write
+    afterwards, cannot silently undo work that already converged. One failing
+    backfill is logged loudly and skipped; the rest still run.
 
-    `connection` is a sync SQLAlchemy Connection; the caller owns the
-    transaction. Returns the revision ids replayed, in apply order.
+    Returns `(replayed, failures)`: the revision ids that applied cleanly and
+    the ids that raised, both in apply order.
     """
     from alembic.operations import Operations
     from alembic.runtime.migration import MigrationContext
 
     scripts = data_backfill_scripts()
-    ctx = MigrationContext.configure(connection)
     replayed: list[str] = []
-    # Operations.context binds the global `alembic.op` proxy these migrations
-    # import, so their `op.get_bind()` returns this connection.
-    with Operations.context(ctx):
-        for sc in scripts:
-            sc.module.upgrade()
+    failures: list[str] = []
+    for sc in scripts:
+        try:
+            with engine.begin() as conn:
+                ctx = MigrationContext.configure(conn)
+                # Operations.context binds the global `alembic.op` proxy these
+                # migrations import, so their `op.get_bind()` returns this
+                # connection; the with-block commits on clean exit, rolls back
+                # on any exception.
+                with Operations.context(ctx):
+                    sc.module.upgrade()
             replayed.append(sc.revision)
-    return replayed
+        except Exception:
+            _log.exception("data backfill %s failed to replay; skipping it", sc.revision)
+            failures.append(sc.revision)
+    return replayed, failures

{celerp-2.0.0 → celerp-2.1.1}/celerp/migrations/env.py

@@ -35,7 +35,12 @@ except ImportError:
 config = context.config
 
 if config.config_file_name is not None:
-    fileConfig(config.config_file_name)
+    # disable_existing_loggers=False: alembic runs in-process during
+    # `celerp migrate`/`celerp start` and the restore reconcile, so the default
+    # (True) would silence every application logger already created, including
+    # the reconcile's own failure logger. Configure alembic's loggers without
+    # muting the app's.
+    fileConfig(config.config_file_name, disable_existing_loggers=False)
 
 target_metadata = Base.metadata
 

celerp-2.1.1/celerp/migrations/versions/b3c4d5e6f7a8_expand_role_permissions_to_role_grants.py

@@ -0,0 +1,175 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+
+"""expand the role_permissions threshold overrides into explicit role_grants sets
+
+Revision ID: b3c4d5e6f7a8
+Revises: f8a9b0c1d2e3
+Create Date: 2026-08-09
+
+The data half of the per-role permissions change. Role overrides used to be a
+single minimum-role threshold per permission (Company.settings["role_permissions"]
+= {permission_key: minimum_role_key}); every role at or above that threshold was
+granted, so the roles moved as a block. They are now an explicit set of granted
+roles per permission (Company.settings["role_grants"] = {permission_key:
+[role_key, ...]}), each role granted independently. This migration rewrites every
+stored threshold into the exact set of roles it used to grant, so no company's
+effective permissions change, then drops the retired key.
+
+Deltas only: it materializes a grant set for the keys a company actually
+overrode, never the whole catalogue; unoverridden keys keep resolving to their
+registry default. Each threshold expands to every role at or above it, clamped up
+to the permission's floor (so a grandfathered sub-floor override lands on the
+floor exactly as the resolver reads it). A threshold on a permission that is no
+longer overridable, unknown to the catalogue, or naming a role that no longer
+exists never resolved to anything but the default, so it becomes no delta and is
+left absent.
+
+Signature-less (data only), so the develop-to-release reconcile replays it on
+every create_all/restore database. Idempotent: guarded on the presence of the
+retired key, so a second application is a no-op. The downgrade is the best-effort
+inverse: it collapses each grant set back to a single threshold at its lowest
+granted role and restores the retired key, so a rollback to the threshold-reading
+code keeps a company's effective permissions. This round-trips exactly for the
+contiguous sets the upgrade produces; a hand-authored non-contiguous set is
+documented lossy (it collapses to its lowest role, which the older resolver then
+re-expands as a block).
+
+The catalogue (floor role and overridability per permission) and the role levels
+are snapshotted here as literals, because a migration is immutable history: it
+must expand exactly as the rules stood when it was written, even after the
+registry in celerp.services.permissions later changes.
+"""
+
+from __future__ import annotations
+
+import json
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "b3c4d5e6f7a8"
+down_revision = "f8a9b0c1d2e3"
+branch_labels = None
+depends_on = None
+
+# Snapshot of auth.ROLE_LEVELS at this revision.
+_ROLE_LEVELS = {"viewer": 1, "operator": 2, "manager": 3, "admin": 4, "owner": 5}
+
+# Snapshot of the permission catalogue at this revision: key -> (floor_role,
+# grantable). default_role is irrelevant here because every key processed carries
+# an explicit override; only the floor (which clamps the expansion) and whether
+# the key is overridable at all matter.
+_CATALOGUE = {
+    "view_dashboards": ("viewer", True),
+    "view_documents": ("viewer", True),
+    "view_contacts": ("viewer", True),
+    "view_inventory": ("viewer", True),
+    "edit_documents": ("viewer", True),
+    "edit_contacts": ("viewer", True),
+    "edit_inventory": ("viewer", True),
+    "edit_inventory_amounts": ("viewer", True),
+    "finalize_documents": ("viewer", True),
+    "fulfill_documents": ("viewer", True),
+    "record_payments": ("viewer", True),
+    "manage_labels": ("viewer", True),
+    "manage_manufacturing": ("viewer", True),
+    "use_ai_assistant": ("viewer", True),
+    "run_backups": ("viewer", True),
+    "view_subscriptions": ("viewer", True),
+    "view_inventory_costs": ("viewer", True),
+    "set_inventory_prices": ("viewer", True),
+    "set_sales_doc_prices": ("viewer", True),
+    "delete_documents": ("viewer", True),
+    "adjust_inventory": ("viewer", True),
+    "import_export_data": ("viewer", True),
+    "view_payments": ("viewer", True),
+    "view_financial_reports": ("viewer", True),
+    "manage_accounting": ("viewer", True),
+    "manage_module_settings": ("viewer", True),
+    "manage_users": ("viewer", True),
+    "manage_company_settings": ("admin", True),
+    "manage_integrations": ("viewer", True),
+    "manage_permissions": ("owner", False),
+    "manage_company_lifecycle": ("owner", False),
+    "manage_billing": ("owner", False),
+}
+
+
+def _expand(stored_role: str, floor_role: str) -> list[str]:
+    """The role keys a threshold used to grant: every role at or above the
+    threshold, clamped up to the floor, ordered low to high."""
+    threshold = max(_ROLE_LEVELS[stored_role], _ROLE_LEVELS[floor_role])
+    return sorted(
+        (r for r, lvl in _ROLE_LEVELS.items() if lvl >= threshold),
+        key=lambda r: _ROLE_LEVELS[r],
+    )
+
+
+def _collapse(granted_roles: list[str]) -> str | None:
+    """Best-effort inverse of _expand: the threshold role at the lowest granted
+    level. Exact for a contiguous set (the shape upgrade produces); lossy for a
+    non-contiguous set, which no longer round-trips to the same set. None when no
+    granted role is known, leaving the permission absent (resolves to default)."""
+    levels = [_ROLE_LEVELS[r] for r in granted_roles if r in _ROLE_LEVELS]
+    if not levels:
+        return None
+    low = min(levels)
+    return next(r for r, lvl in _ROLE_LEVELS.items() if lvl == low)
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+    # Only companies that still carry the retired key; this is also the
+    # idempotency guard, so a replay after the key is stripped touches nothing.
+    rows = conn.execute(sa.text(
+        "SELECT id, settings FROM companies WHERE settings::jsonb ? 'role_permissions'"
+    )).fetchall()
+
+    for cid, settings in rows:
+        data = settings if isinstance(settings, dict) else json.loads(settings)
+        role_perms = data.get("role_permissions")
+        grants = dict(data.get("role_grants") or {})
+        if isinstance(role_perms, dict):
+            for key, stored_role in role_perms.items():
+                meta = _CATALOGUE.get(key)
+                if meta is None:
+                    continue  # unknown key: never resolved to an override
+                floor_role, grantable = meta
+                if not grantable:
+                    continue  # fixed permission: overrides were never honored
+                if stored_role not in _ROLE_LEVELS:
+                    continue  # stale role: resolved to the default, no delta
+                grants[key] = _expand(stored_role, floor_role)
+        if grants:
+            data["role_grants"] = grants
+        data.pop("role_permissions", None)
+        conn.execute(
+            sa.text("UPDATE companies SET settings = CAST(:s AS json) WHERE id = :id"),
+            {"s": json.dumps(data), "id": str(cid)},
+        )
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+    # Only companies that carry the new key; this is also the idempotency guard.
+    rows = conn.execute(sa.text(
+        "SELECT id, settings FROM companies WHERE settings::jsonb ? 'role_grants'"
+    )).fetchall()
+
+    for cid, settings in rows:
+        data = settings if isinstance(settings, dict) else json.loads(settings)
+        grants = data.get("role_grants")
+        role_perms = dict(data.get("role_permissions") or {})
+        if isinstance(grants, dict):
+            for key, roles in grants.items():
+                threshold = _collapse(roles if isinstance(roles, list) else [])
+                if threshold is not None:
+                    role_perms[key] = threshold
+        if role_perms:
+            data["role_permissions"] = role_perms
+        data.pop("role_grants", None)
+        conn.execute(
+            sa.text("UPDATE companies SET settings = CAST(:s AS json) WHERE id = :id"),
+            {"s": json.dumps(data), "id": str(cid)},
+        )

celerp-2.1.1/celerp/migrations/versions/e7c9a1b3d5f2_work_center_default_columns.py

@@ -0,0 +1,51 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+
+"""work center hours_per_day + is_default columns and the one-default index
+
+Revision ID: e7c9a1b3d5f2
+Revises: d5e6f7a8b9c0
+Create Date: 2026-08-06
+
+Adds hours_per_day and is_default to work_centers and the partial unique index
+that enforces one default center per company. Verifiable DDL only (op.*), so
+extract_signatures detects it and the auto-stamp walker never false-stamps a
+create_all/restore database past these columns. The data move (seeding a
+Default center, the notice, stripping the old setting) lives in the child
+data-backfill migration f8a9b0c1d2e3. Forward-only.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "e7c9a1b3d5f2"
+down_revision = "d5e6f7a8b9c0"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("work_centers", sa.Column("hours_per_day", sa.Float(), nullable=True))
+    # NOT NULL with a transient server default so existing rows backfill to false,
+    # then drop the default for parity with the model (celerp/models/company.py
+    # declares none). is_default is added before the index that references it.
+    op.add_column(
+        "work_centers",
+        sa.Column("is_default", sa.Boolean(), nullable=False, server_default=sa.text("false")),
+    )
+    op.create_index(
+        "uq_work_center_one_default",
+        "work_centers",
+        ["company_id"],
+        unique=True,
+        postgresql_where=sa.text("is_default"),
+    )
+    op.alter_column("work_centers", "is_default", server_default=None)
+
+
+def downgrade() -> None:
+    op.drop_index("uq_work_center_one_default", table_name="work_centers")
+    op.drop_column("work_centers", "is_default")
+    op.drop_column("work_centers", "hours_per_day")

celerp-2.1.1/celerp/migrations/versions/f8a9b0c1d2e3_work_center_default_backfill.py

@@ -0,0 +1,93 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+
+"""seed a Default work center and move the hours_per_day setting onto it
+
+Revision ID: f8a9b0c1d2e3
+Revises: e7c9a1b3d5f2
+Create Date: 2026-08-06
+
+The data half of the work-center default split. Signature-less (raw SQL), so
+the develop-to-release reconcile replays it on every create_all/restore
+database once the schema migration has added the columns. Seeds one Default
+center per manufacturing-active company carrying the old company hours value
+(the module's x-or-8.0 mapping), posts one company-wide notice that the setting
+moved, and strips the now-migrated settings key. Idempotent: every step guards
+against a prior application, because it replays on each version-change
+reconcile and, on a restore boot, can be both alembic-applied and
+reconcile-replayed in one pass. Forward-only.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "f8a9b0c1d2e3"
+down_revision = "e7c9a1b3d5f2"
+branch_labels = None
+depends_on = None
+
+_NOTICE_TITLE = "Hours per day moved to work centers"
+_NOTICE_BODY = (
+    "Your company Hours per day setting now lives on the new Default work center under "
+    "Settings > Manufacturing > Work centers. Nothing changed in your To-Make estimates."
+)
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # One dedicated Default center per manufacturing-active company, carrying its
+    # old hours value. The nested CASE mirrors the module's `x or 8.0`: a stored
+    # 0, blank, absent, or non-numeric value maps to 8.0. The regex guard runs
+    # BEFORE the ::float cast because Postgres does not guarantee AND
+    # short-circuit, so a flat `regex AND value::float` would still cast 'abc'
+    # and abort the whole insert. settings is a JSON column, so the ? membership
+    # test needs a jsonb cast; the -> / ->> extraction works on json directly.
+    conn.execute(sa.text("""
+        INSERT INTO work_centers (id, company_id, name, hours_per_day, is_default, created_at)
+        SELECT gen_random_uuid(), c.id, 'Default',
+               CASE WHEN (c.settings->'manufacturing'->>'hours_per_day') ~ '^[0-9]+(\\.[0-9]+)?$'
+                    THEN CASE WHEN (c.settings->'manufacturing'->>'hours_per_day')::float <> 0
+                              THEN (c.settings->'manufacturing'->>'hours_per_day')::float
+                              ELSE 8.0 END
+                    ELSE 8.0 END,
+               true, NOW()
+        FROM companies c
+        WHERE (c.settings::jsonb ? 'manufacturing'
+               OR EXISTS (SELECT 1 FROM work_centers wc WHERE wc.company_id = c.id))
+          AND NOT EXISTS (SELECT 1 FROM work_centers d WHERE d.company_id = c.id AND d.is_default)
+    """))
+
+    # One company-wide notice per company that just received a Default center
+    # (user_id NULL = company-wide). Guarded so a re-run never doubles it. The
+    # notifications table is created when the application boots, not by the
+    # migration chain, so on a database migrated before its first boot it is
+    # absent. Such a database has never run the app and therefore holds no
+    # company whose value could have moved, so there is nothing to notify. The
+    # regclass check is unqualified so it resolves against the same search path
+    # the INSERT targets (public in production), not a hardcoded schema.
+    if conn.execute(sa.text("SELECT to_regclass('notifications')")).scalar() is not None:
+        conn.execute(sa.text("""
+            INSERT INTO notifications
+                (id, company_id, user_id, category, title, body, action_url, priority, read, created_at)
+            SELECT gen_random_uuid(), w.company_id, NULL, 'manufacturing', :title, :body,
+                   '/settings/manufacturing', 'high', false, NOW()
+            FROM work_centers w
+            WHERE w.is_default
+              AND w.name = 'Default'
+              AND NOT EXISTS (SELECT 1 FROM notifications n
+                              WHERE n.company_id = w.company_id AND n.title = :title)
+        """), {"title": _NOTICE_TITLE, "body": _NOTICE_BODY})
+
+    # Strip the now-migrated key (jsonb #- needs the cast, then back to json).
+    conn.execute(sa.text(
+        "UPDATE companies SET settings = (settings::jsonb #- '{manufacturing,hours_per_day}')::json "
+        "WHERE settings::jsonb #> '{manufacturing,hours_per_day}' IS NOT NULL"
+    ))
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+    conn.execute(sa.text("DELETE FROM work_centers WHERE is_default AND name = 'Default'"))

{celerp-2.0.0 → celerp-2.1.1}/celerp/models/company.py

@@ -42,9 +42,17 @@ class WorkCenter(Base):
 
     Optionally carries a WIP location, an hourly labor rate and a capacity (capacity is reserved for
     later scheduling work). Runs may reference a work centre via work_center_id.
+
+    hours_per_day is the working day length used to turn daily labour into hours; the
+    company's default centre supplies it to the To-Make board. A partial unique index
+    keeps at most one default centre per company.
     """
     __tablename__ = "work_centers"
-    __table_args__ = (UniqueConstraint("company_id", "name", name="uq_work_center_company_name"),)
+    __table_args__ = (
+        UniqueConstraint("company_id", "name", name="uq_work_center_company_name"),
+        sa.Index("uq_work_center_one_default", "company_id",
+                 unique=True, postgresql_where=sa.text("is_default")),
+    )
 
     id: Mapped[uuid.UUID] = mapped_column(sa.Uuid(as_uuid=True), primary_key=True, default=uuid.uuid4)
     company_id: Mapped[uuid.UUID] = mapped_column(ForeignKey("companies.id"), nullable=False)
@@ -52,6 +60,8 @@ class WorkCenter(Base):
     wip_location_id: Mapped[uuid.UUID | None] = mapped_column(sa.Uuid(as_uuid=True), nullable=True)
     labor_rate: Mapped[float | None] = mapped_column(sa.Float, nullable=True)
     capacity: Mapped[float | None] = mapped_column(sa.Float, nullable=True)
+    hours_per_day: Mapped[float | None] = mapped_column(sa.Float, nullable=True)
+    is_default: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=lambda: datetime.now(timezone.utc), nullable=False)
 
 

{celerp-2.0.0 → celerp-2.1.1}/celerp/modules/slots.py

@@ -60,7 +60,9 @@ async def fire_lifecycle(slot: str, **kwargs) -> None:
 
     Each contribution must have a "handler" key pointing to a dotted path
     "module.path:function_name". The function is called with **kwargs.
-    Failures are logged and swallowed (non-fatal).
+    A failing hook never blocks its siblings or boot: it is logged at ERROR
+    (with traceback) and swallowed, so a recurrence surfaces as an alert
+    instead of vanishing.
     """
     import importlib
     import logging
@@ -77,7 +79,7 @@ async def fire_lifecycle(slot: str, **kwargs) -> None:
             func = getattr(mod, func_name)
             await func(**kwargs)
         except Exception as exc:
-            _log.warning(
+            _log.exception(
                 "Lifecycle hook %s from %s failed: %s",
                 slot, contrib.get("_module", "?"), exc,
             )