The invoice takes REVOKE DELETE, not REVOKE UPDATE

Shipped

August 28, 2026 at 12:28 AM UTC

Author

Kamo

Commit

7b69a3c

attachPdf writes PDF_BLOB_ID after the finalize transaction commits, on purpose: rendering inside it would hold the document-counter row lock across a MinIO round trip, so a blob-store stall would surface as a lock timeout on the invoice number. A blanket REVOKE UPDATE on commerce_invoices would therefore make every PDF attach fail silently after a successful finalize. Credit notes take the full WORM revoke; they are never amended, only superseded.