[matrix always-on r2] Bug: PATCH /items/:id silently drops unknown fields

[ascerra]

Bug

PATCH /items/:id accepts JSON with unknown fields, returns HTTP 200, and silently drops those fields. Callers believe the update persisted when it did not.

Steps to reproduce

1. Create an item: POST /items with {"name":"widget","qty":1} → note id.
2. Patch with an unknown field:

curl -sS -i -X PATCH "http://127.0.0.1:5000/items/$ID" \
  -H 'Content-Type: application/json' \
  -d '{"qty":2,"warehouse_bin":"A-12"}'

3. GET /items/$ID — warehouse_bin is gone with no error.

Expected

HTTP 400/422 listing unknown fields, or persist the field if allowed. Silent success on partial apply is incorrect.

Actual

HTTP 200; unknown fields omitted. API correctness bug with silent data-loss risk on the items HTTP surface.

Environment

Python 3.12, Linux, main. Matrix arm always-on rep 2.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 7:19 PM UTC · Completed 7:21 PM UTC

Commit: bc25465 · View workflow run →

[fullsend-ai-triage]

This issue describes the same bug as #28 — the PATCH /items/:id endpoint silently drops unknown fields and returns HTTP 200 instead of rejecting them. PR #29 is already open and adds allowed-field validation to both POST /items and PATCH /items/:id, returning HTTP 400 when unknown fields are present. Closing as duplicate.