[mforce]

Closes #66 (epic #14, Phase 1.1). Part 2 of the split — consumption + the correction path agreed on the issue. Builds on part 1 (PR #68).

What

• FeedUsage — create-only feeding record (date, flock, item, quantity, unit snapshot, note) with a lot-cost estimate: Σ(consumed-per-lot × that lot's unit cost) — the §19 feed-cost KPI input. Repo seam rejects Update/Remove; corrections are compensating ledger rows, never edits.
• POST /inventory/items/{id}/usage — drains lots FIFO under the canonical (ReceivedDate, Id) FOR UPDATE lock; one Usage movement per lot drained (lot-level provenance, the F14: Void confirmed sales order — return allocated stock #60 lesson); insufficient stock → 422 with nothing committed. Flock gate reuses CanRecordProductionOn (depleted backfill OK, archived never). Inactive items may still be used up — deactivation only stops new stock.
• InventoryLot.Adjust — signed correction bounded to [0, QuantityReceived]: below-consumed refuses (InsufficientStock), beyond-received refuses (AdjustExceedsReceived — extra stock is a purchase, not an adjustment).
• POST /inventory/items/{id}/adjustments — Adjustment (signed) or Discard (negative only) against a specific locked lot, reason mandatory (whitespace-guarded). A typo'd 5000-instead-of-500 purchase = one negative adjustment; both rows stay in the ledger.
• GET /inventory/usage — newest first, flock/date filters, paged.
• SPA — usage form (active-flock picker, date, quantity, note) + correction form (lot picker showing remaining/received, type, reason) on the item panel; ledger reflects both immediately.

Tests (11 new, 173 green)

• Domain: Adjust bounds both directions, FeedUsage guards.
• Integration: FIFO drain across two lots with per-lot movements and exact cost math (30×2400 + 20×2500 = 122 000); insufficient-stock 422 leaves zero side effects; archived-flock 422; typo-fix adjustment with both ledger rows; guard matrix (below-consumed 422, beyond-received 422, positive discard 400, whitespace reason 400, valid restore); parallel-usage race — two 60s against a 100 lot: one OK, one 422, lot at 40, Version delta 1, single usage row.

Runtime verified

API scenario (cost 122000 exact, on-hand 80→60 through usage+adjustment, all guard codes) + Playwright UI flow (purchase → usage → correction, headings and ledger updating) — zero console errors.

[mforce]

Review round — applied in 3bb1a0d

Reviewers: codex + local stand-in for pi (weekly cap, resets ~tomorrow). codex: 0 P1, 12 accepted findings. Stand-in reviewed the post-fix tree: 0 findings.

#	Sev	Finding (codex)	Resolution
1	P2	Usage skipped the item lock — backdated purchase could insert an older lot after the FIFO read.	Item row locked first (item → lots, same order as purchases), inside the transaction.
2	P2	Flock gate checked before the transaction — raced concurrent deplete/archive.	Moved inside; remaining same-day race documented as business-valid (birds ate before they left).
3	P2	FIFO included lots received after a backdated usage date.	Lock query is as-of the usage date. Test.
4	P2	Adjustment/discard could predate its lot's receipt.	422 guard. Test.
5	P2	Cost math could overflow decimal→long (valid inputs).	Decimal accumulation + explicit bound → 422; unit-cost minor units capped 1e13 across validators.
6	P2	Usage movements had no reference to their FeedUsage — same-day feedings unreconcilable.	ReferenceType/ReferenceId (spec §12.3), exposed on the movements endpoint. Test.
7	P2	No category gate — packaging recordable as flock feed.	Feed/Supplement/Additive only, API 422 + SPA hides the form. Test.
8	P2	Usage POST response omitted CurrencyMinorUnit.	Added (matches GET).
9	P2	Math.Abs(decimal.MinValue) throws → 500.	Not reproducible — decimal's range is symmetric, unlike int/long. Expression rewritten to InclusiveBetween anyway.
10	P3	FeedUsage lacked CreatedAt — same-day order undefined.	CreatedAtUtc + list tiebreak.
11	P3	SPA hid depleted flocks — valid backfill unreachable.	Back in the picker, labeled "depleted — backfill only".
12	P3	DailyEntryId had no FK.	FK (Restrict) added.
13	P3	Offset pagination / FluentValidation message shape vs spec §3.2 cursor+codes.	Declined here: both are the existing convention on every list/write endpoint in the app — changing them is a cross-cutting slice, not a PR #70 fix. Happy to file it.

Stand-in's independent verification of the post-fix tree: no deadlock cycle possible across the four locking paths (item-lockers never wait on lots; lot-lockers only touch the item via FK FOR KEY SHARE); per-lot rounding is the documented KPI tradeoff; raw-SQL tenant filtering is stronger than the check-after pattern; idempotency middleware only replays 2xx so failed-submit key reuse is safe.

Migration regenerated (branch-only). 178 tests green. Runtime re-verified: FIFO cost math exact, all guard codes, as-of-date behavior.