syncro: Phase-1b breadth findings (leads/vendors/products/PO/worksheets)

Live-tested the remaining write resources on Howard Test. Recorded:
- wrapped response shapes (.lead.id/.vendor.id/.product.id/.purchase_order.id/
  .po_line_item.id/.worksheet_result.id) added to Verified Response Shapes.
- create_po_line_item requires product maintain_stock:true.
- worksheet templates live in GET /tickets/settings (.worksheet_templates[]), no standalone
  endpoint; need a valid worksheet_template_id.
- PUT /products requires name+description; leads/vendors/products/POs have NO DELETE (global
  test records persist -> GUI cleanup).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/standards/syncro/test-findings.md

@@ -29,6 +29,33 @@ policy-folder objects). Host is `rmm.syncromsp.com` (Kabuto/RMM), separate from
 - The token embeds an enrollment secret → it is a **credential**: vault it (per client), never
   commit plaintext. `policy_folder_id` comes from `GET /policy_folders?customer_id=N`.
 
+## 2026-07-10 — Phase 1b (breadth: leads / vendors / products / PO / worksheets)
+
+**Response shapes — these are all WRAPPED (unlike contacts/contracts):** `POST /leads` →
+`{"lead":{...}}` (`.lead.id`); `POST /vendors` → `{"vendor":{...}}`; `POST`/`PUT /products` →
+`{"product":{...}}`; `POST /purchase_orders` → `{"purchase_order":{...}}`;
+`POST /purchase_orders/{id}/create_po_line_item` → `{"po_line_item":{...}}`;
+`POST /tickets/{id}/worksheet_results` → `{"worksheet_result":{...}}`;
+`DELETE .../worksheet_results/{id}` → `{"message":"N: We deleted <title>."}`.
+
+**PO line items require the product to have `maintain_stock:true`.** `create_po_line_item`
+against a non-stock product returns `{"errors":"...ensure that the item ... is set to
+'Maintain Stock'."}`. Flip the product (`PUT /products/{id}` `maintain_stock:true`) first.
+
+**Worksheet templates are NOT a standalone endpoint — they live in `GET /tickets/settings` →
+`.worksheet_templates[]`** (`{id,title,account_id}`). You need a valid `worksheet_template_id`
+to create a worksheet result (e.g. "Virus Removal" = 11341).
+
+**`PUT /products/{id}` requires `name` AND `description`** (same as create) — 422 without.
+
+**No DELETE endpoint for leads, vendors, products, purchase_orders** — test records in those
+GLOBAL catalogs PERSIST (can't be removed via API; archive/hide in the GUI). Mark test items
+`[TEST]` and set products `disabled:true`. Created this run (need GUI cleanup): lead 43492446,
+vendor 809317, product 23639304 (disabled), PO 2101221 (+ line 8918508).
+
+**Minor:** `POST /leads` `business_name` didn't persist (came back null); `first_name`/
+`last_name`/`email`/`customer_id` did. Re-check the correct field for a lead's company name.
+
 ## 2026-07-10 — Phase 1 (PSA CRUD)
 
 **Emailing an invoice/estimate returns 200 "Email sent" even when it delivered to NOBODY.**