IWMS events

Every ledger write carries a composite unique index on (source_system, idempotency_key). A replay re-runs the classifier with the current ruleset and attempts the same inserts; the duplicates are rejected by the database, not by an application-level check-then-act.

That distinction matters. ops2's bridge guards idempotency with a SELECT ... WHERE reference_type='iwms' AND reference_id=? inside the same transaction as the insert, which is a race under concurrency and a silent double-post when it loses.

Replay is refused for any event type in dual_write or not_started, because ops2 still owns that type's ledger and a replay would post into a ledger i3 does not own. The refusal is a 409 with the event type's current state in the body, not a silent no-op.

Bulk replay above 10 events writes an approval row naming the approver before anything runs. Today's two replays produced 0 new ledger rows, which is the acceptance test for GATE 5 criterion 9: replaying the last 24 hours must change nothing.

picking.remove_to_picking is highlighted in the migration table with never in the ops2 column, and that is not a typo.

In ops2, partial removal to the picking area calls record_movement(event_type="remove_to_picking"). That string is absent from the valid-event frozenset, so the call raises immediately. The caller catches it with a bare handler whose comment reads "movement logging is audit-only; swallow so the stock move itself is the authoritative record".

The carton is decremented. The picking row is incremented. No movement row is created, so the ledger bridge never runs, so no ledger row exists. Every partial replenishment since that feature shipped is invisible to the quantity ledger. The swallow was written to protect an audit write and it is eating a stock write.

i3's fix is structural rather than a patch: carton_events.event_type is a foreign key to this registry, so an unregistered type is a constraint violation at insert time, and the carton event plus its ledger row are written in the same transaction or neither is. There is no audit-only path to swallow.

The type sits in shadow with 0 clean days because there is nothing on the ops2 side to compare against. It goes straight to i3_owns once the historical gap is quantified by the reconciler in T-04.16.