Inventory Pilot Controls QA

Use a disposable local or staging test facility. Obtain a real facility-lead approval before live counts. Apply migrations through 20261011000006_add_inventory_opening_approval_kind.rb. Use Pilot Operations for operator commands and evidence. Do not inject projection drift outside a disposable database. Never use real patient data in stock references.

• Record the count date and explicit scoped item/location/unit/tracking rows. Obtain the facility lead's approval.
• Record the approval with View, Manage, and adjustments. Remove adjustments and verify another approval is denied.
• Retry the approval key unchanged. It returns the original operation without a second approval.
• Import the approved manifest. Retry it; quantities and movement count do not increase.
• Change an approved row quantity or source identity. The direct opening API rejects it without stock effects.
• Submit an opening row without approval or with another facility's approval. Expect denial.
• Try a second opening manifest for the same facility. Expect denial. Later discrepancies need reasoned adjustments.
• In a disposable test, fail the required audit write for a later import row. Verify all new rows roll back. Restore audit delivery and retry the identical approved manifest without new identities or row edits.
• Reconcile the opening counts. Expect zero mismatches and exactly one audit record per confirmed operation.
• Reserve stock, issue to tracked custody, consume part, and return unused stock. Reconcile after each step.
• Validate and correct expiry with approved rules. Quantities stay unchanged and reconciliation remains clean.
• In a disposable test, change one balance or hold projection. Reconciliation reports it and does not repair it.
• Remove View or facility assignment. Reconciliation and direct API reads are denied, not reported as a clean empty ledger.
• Fail the required audit write. Retry with the original command key after recovery. Verify one stock effect and one stock-only audit record.
• Set the write stop in every web and worker process. A new API mutation returns STOCK_WRITES_DISABLED/503.
• While stopped, read stock/history, reconcile, and retry an already-confirmed key. They remain available with current grants.
• Re-enable writes deliberately. Run the expiry sweep and reconcile again. No event or populated table was deleted.
• Attach the evidence checklist to the existing PR/issue. Leave deployment, product acceptance, and Hospital U10 unchecked until performed.

This checklist is not a record of completed manual QA. Automated source checks are recorded in the developer guide.