v2.22.0 — the door closes, the catalog fits, the nine have a cause

Thirty-nine commits since v2.21.0. Three additive migrations. The tag is cut after this page, not by it.

Shipped

SEC-C1 (#401): public registration is closed. POST /api/v1/auth/register answers 410 Gone, the same way the company-onboarding route above it already did. Anyone with an email and a password could become a default member of the DockingWare company. The route is gone. The service method that creates a user is still in the code, because how a person is invited is the rest of the hardening wave, not this commit.

SEC-MEDIA-01 (#398): a filename is not an access control. A signed-in request asks for the document, the server checks the company, and it returns a link that lasts fifteen minutes. Visibility lives on the row — public or private — and every existing row stays private. Rotating the stored keys is media:rotate-keys: each object moves to a new key, and a row that stopped halfway can resume. That command has not been run in production.

ONBOARD-SCALE-01 (#407): an opening inventory file of a real catalog confirms in batches of 300, on the import job. The bar moves while pallets and putaway run, not only when a batch finishes. A putaway that fails names the row, the SKU, the pallet, and the reason. Retry continues from what already landed. Reverse cancels the receipt, leaves the pallet empty, and frees the customer’s pallet number so it can be used again; when every receipt on that load is cancelled, the same file can be loaded again. The birth certificate adds the whole file, one line per SKU, and says whether the file and the warehouse match. A mixed file of 4,562 rows completed on a local database: 16 receipts, 4,562 pallets, no named putaway failure. The same file has not been run on the hosted database.

PICK-CASE-BREAK-01 (#363): a piece pick from a case on a pallet breaks that case into pieces, on every channel. The break writes no movement of its own.

PACK-COMPLETE-IDEMPOTENT-01 (#389): completing a pack that is already complete returns the pack. It does not pack the order a second time, and it does not replace the carrier or the tracking number.

The packing bench: a cleared station must not pack a split order by itself (#392), and going idle must not wipe the tote scan (#395). The spec that watches that path was not edited. It still fails about half the time, so the check is quarantined until 2026-10-03 (#405) and does not block the build until that date.

Also: the harness routes that mint stock for tests now write a ledger row when they do it (#364). Ecommerce writes a transfer at pick and the shipment at closure, in the same transaction as the stock (#369). The wholesale pick was left writing a shipment at pick, on purpose, in that sprint.

Website

The blog opens with three posts. The table of contents was linking every heading to #undefined, because it read an id the renderer does not emit; it reads the slug now (#403). Twenty-two glossary terms. This page is the eighty-first URL.

Known and open

The nine products from v2.21.0 are known, the cause is named, and they are not fixed.

Each gap is a wholesale pick that wrote a shipment movement and did not move the stock. Stock on the shelf is ahead of the ledger by exactly those rows. The ecommerce path was changed so the pick writes a transfer and the shipment is written when the order ships. The wholesale path was not. The repair belongs to LEDGER-GUARD-07, which is not sealed. LEDGER-DRIFT-03 (#406) closed the diagnosis and did not start a fix.

The ninety rows on the owner’s company are a different set. They are quantity that predates the ledger, and they are classified. A script can mark where counting begins. It dry-runs unless someone passes the write flag, and this release does not record that write.

Migrations: three, all additive — visibility on the document row (default private) plus a place to remember a half-rotated key; the opening-load job and its batches; the line identity and the pallet link that let a retry resume and a repeated file be refused by name.

Rollback: return to v2.21.0. No flags to switch. The previous build ignores the new tables and the new columns. Rolling the code back also reopens public registration, and it does not restore object keys if media:rotate-keys has already been run — it has not, as of this page.