Booking kiosk

The ledger separates what the audit changed, what was kept on purpose, and what has not run in production yet.

1. Fixed in the templates

   • Device auth that a missing header bypassed All four kiosk routes checked if (sent && configured && sent !== configured) , only a wrong key was rejected; omitting the header passed, and the kiosk client never sent one. Unauthenticated internet callers could create and mutate bookings and consume stock. Shipped: configured key means required header (api-contract.md).
   • Client-priced Stripe charges Slot and consumable prices arrived in the request body and flowed into the total and the Stripe amount. Any caller could book for zero. Shipped: prices removed from the wire; server resolves from its catalog (api-contract.md, booking-backend.md).
   • Online payment was a dead end The confirmation screen rendered QR: <first 50 chars of URL>... as text (a placeholder comment said "use a QR library in production"); the main-flow customer had no way to pay online. Separately, three of the six text inputs set inputMode="none" (suppressing the native keyboard) without opening the on-screen keyboard, email/phone/promo entry and the whole booking-lookup screen were unusable on touch-only hardware. Shipped: QR requirement + keyboard-on-every-field rule (screens.md).
   • Background refresh teleported the user The silent availability refresh re-dispatched SET_SLOT, whose reducer arm also navigates, a booking made by anyone else yanked a kiosk user from the summary back to station selection, discarding progress. Selected stations also never reconciled against refreshed availability, so a stolen station could still be submitted. Shipped: separate REFRESH_SLOT data-only action that drops taken stations and keeps names index-aligned, with tests (state-machine.md).
   • Stock reserved and never released on failure paths A capacity conflict returned 409 with the just-taken stock locks still ACTIVE for the full 15-min TTL; the edit route released old locks before acquiring new ones (a failure stranded the booking with no reservation); the payment webhook released locks for failed add-item payments but not for failed bookings. Shipped: release-on-failure in the route skeleton; webhook failure path releases booking locks (api-contract.md, booking-backend.md).
   Show 12 moreShow fewer

   • No idempotency The client generated a sessionId nobody ever read; the server minted lock session keys from Date.now() (collides across terminals); the only duplicate-submit guard was a client boolean. Retries and double-taps made double bookings. Shipped: sessionId as a server-checked idempotency key (api-contract.md).
   • Promo failures were silent, then fatal An invalid/expired/wrong-location code was ignored, the customer silently paid full price. And usage-limit increments ran after booking commit without a catch, so hitting the limit returned a 500 for a booking that existed. Shipped: invalid promo is a 400 before any write; post-commit usage recording is caught (api-contract.md).
   • PII on an unauthenticated, unthrottled lookup GET .../lookup?shortId= returned full name, email, phone and participants for any guessable 8-char code (31-char alphabet), min query length 3, with no rate limit, an enumeration target. Shipped: rate limit + masked contact fields (api-contract.md).
   • Edit/add-items trusted and raced The edit route re-wrote slots with no capacity re-check (could double-book a station), recalculated pricing without the promo (silently un-discounting on every edit), and skipped the module-block gate its siblings had. Add-items had no cancelled-booking guard, mutated pricing in a read-modify-write outside a transaction (concurrent adds lost increments), appended lines via a set-union that deduplicated identical purchases while still charging for both, and its webhook wrote back absolute totals computed minutes earlier, with no event-id dedupe on redelivery. Shipped: the guard table and delta-in-transaction rules (api-contract.md, booking-backend.md).
   • Unbounded transactional read The capacity re-check read every PENDING/CONFIRMED booking for the location, no date filter, no limit, inside every create transaction. Grows forever; eventually every sale times out. Shipped: date-overlap filter as part of the transaction spec (booking-backend.md).
   • A drawer of smaller correctness fixes Back button inert on the side-flow steps (they were outside STEP_ORDER); participant seeding clobbering a hand-edited contact name; cart surviving a location switch with the old location's item ids; the calendar's "today" memoized once (wrong after midnight); a 60 s clock under seconds-granularity UI and slot cutoffs; the summary's payment method captured once and stale after connectivity changes; a retry timer firing after unmount; no request aborts anywhere; catch(() => {}) on the pricing/equipment/locations fetches (symptom: submit disabled with no reason shown); raw Error.message in 500 bodies; two error-envelope shapes (client showed blank errors for one); localhost as the default payment-redirect base URL; inactivity ref written during render; silent per-lock confirm failures; equipment lines silently skipped when unresolvable. Each fix lives in the reference that owns the topic.
   • Operator and accessibility gaps No remote heartbeat (a dead kiosk was found by walking past), no stock-confirm-failure surfacing, modal without dialog semantics or focus management, globally stripped focus outlines, icon-only buttons without labels, 32 px touch targets on the busiest screen, failing contrast on hint text, hardcoded source-language strings in shared hooks and persisted values, dead dictionary keys, and an edit endpoint whose UI trigger was wired but never called. Shipped: rules in screens.md and the operator table in operations.md; heartbeat is documented as an extension, not shipped code.
   • A new slot kept the stations taken in it Found by the prompt-1 agent eval of 0.1.6, in this skill's own reducer, not in the audit. SET_SLOT replaced the slot and kept selectedStations as they were, and SET_DATE kept the previous date's slot. A customer who picked stations, went back and chose another slot carried a station already taken there onto the participants screen, which derives from context, and the submit came back 409. Shipped: SET_DATE drops the slot; SET_SLOT keeps only the stations free in the new slot, names aligned, and still navigates. The thirteenth reducer test covers both (state-machine.md).
   • A failed checkout kept its locks Found while verifying the templates for the same release. The create route's online path called createCheckoutSession after the booking and its stock locks existed, with no catch: a provider error escaped as an unhandled 500 and left the booking PENDING, holding its stations and locks until the cleanup jobs ran, and a retry with the same sessionId returned that booking without a checkoutUrl. The fifth hard rule, broken by its own template. Shipped: failPendingBooking on KioskBackend marks the booking FAILED, releases its locks and stations and clears its idempotency key; the route calls it and answers 502 (api-contract.md, booking-backend.md).
   • Optional fields reached the backend unchecked Found by the prompt-1 agent eval of 0.1.7, reported in its handover. parseCreateRequest said the shape was proven field by field, yet accepted a number as promoCode, an object as parentBookingId, an array as email, a missing locale, any value as equipment, and a null slot, which threw; a missing consumables array passed through as undefined. Shipped: every optional field is absent or a bounded string, equipment lines are checked, and parseCart returns the cart with consumables normalised, shared by create and the promo check (api-contract.md).
   • A failed stock confirm answered 500 for a booking that existed Found by the same eval. On the counter path the route awaited confirmStockLocks after the booking was committed; a confirm that threw escaped the route, and the customer saw an error for a booking that was made. Shipped: the confirm contract is retry once, flag the booking, reject; the route logs the rejection and answers 201 (booking-backend.md).
   • An idle kiosk kept a booking on screen Found by the same eval. The inactivity timeout spared service-select and the booking-* side flow. A session adding a slot to a looked-up booking sits on service-select with parentBookingId set, so the next customer could book onto it; the side flow showed a looked-up customer's name until someone touched the screen. Both break the first hard rule. Shipped: resetsOnIdle in the reducer module spares only the untouched entry screen, with the fourteenth reducer test (state-machine.md, screens.md). The staff-assisted exemption of the side flow is dropped: a staff member who is helping touches the screen.