Transfers

The in-transit invariant

For any transfer, the units that left the source are, at every instant, in exactly one of three places: counted at the destination, sitting at TRANSIT, or named on a drift case. There is no fourth option and there is no moment where the number is nowhere.

-- AC-07.1a  runs hourly, must return zero rows
WITH legs AS (
  SELECT p.transfer_id, t.state,
    SUM(p.quantity_delta) FILTER (WHERE p.location_id = t.from_location_id) AS out_at_source,
    SUM(p.quantity_delta) FILTER (WHERE p.location_id = t.to_location_id)   AS in_at_dest,
    SUM(p.quantity_delta) FILTER (WHERE p.location_id = transit_id())    AS at_transit
  FROM transfer_postings p JOIN transfers t ON t.id = p.transfer_id
  GROUP BY 1, 2, t.from_location_id, t.to_location_id)
SELECT * FROM legs
WHERE COALESCE(out_at_source,0) + COALESCE(in_at_dest,0) + COALESCE(at_transit,0) <> 0
   OR (state = 'reconciled' AND COALESCE(at_transit,0) <> 0);

Two more checks run every 15 minutes: every movement_pair_id has exactly two legs summing to zero, and no ledger row with a transfer_ source type is missing from the pair registry. A violation raises P1 inside the hour it happens. INV1 accumulated 1,205 cross-location orders because a single ledger row was allowed to change a location and nothing ever asked whether it balanced.