fix(finance): preserve per-movement stock accounting and retry failures #37

Source-reviewed risk (not an executed exploit)

At baseline acf623e, InventoryService queues inventory.stock_depleted per immutable transaction with idempotency key stock_depleted:{transaction.id}. Multiple allocations/partial shipments share business reference SALE-SHIP-{orderNo}. FinanceBridgeListener.onStockDepleted instead skips when any INV journal exists with that business reference; later legitimate movement events can be discarded. Its catch records Finance DLQ then returns, unlike corrected supplier handlers; outer event delivery may interpret the failure as success.

Scope for a separate focused fix

• Keep business reference readable while deduplicating by durable movement/event identity.
• Prove same-reference distinct movements each account exactly once, replay/concurrent delivery cannot duplicate, and posting failure remains retryable without queue-ownership ambiguity.
• Tenant/cost/account mapping and period enforcement must remain intact; no invented finance policy or blanket historical replay.
• Inspect AccountingService transaction-level journal dedupe and outbox dispatch semantics before implementation; use real PostgreSQL regressions.
• Audit existing historical gaps separately; do NOT automatically backfill production.

This is not solved by shipment quantity safety, Chromium UI regression, or passing the 13-step stocked-trade HTTP journey. Track as a blocker for claiming complete shipment-to-accounting maturity.