Island-mode server

The ledger separates what the audit changed, what was kept on purpose, and what has not run in production yet.

1. Fixed in the templates

   • Cloud sync-ingestion endpoints had no authentication The earlier implementation's /api/sync/* routes (bookings, inventory-transactions, lock-logs) accepted unauthenticated POSTs on the public internet — anyone could inject confirmed bookings, apply arbitrary stock increments, or forge audit logs. Shipped: x-sync-secret shared-secret check on every ingestion endpoint (sync-flush.md).
   • Offline JWT fallback reachable while online Staff auth fell back to decode-without-verification whenever verifyIdToken threw — including for forged tokens while fully online, making signature verification unenforceable. Expiry was never checked. Shipped: fallback gated on the network monitor reporting offline, plus an exp check on the offline path (auth.md).
   • Non-idempotent stock apply under at-least-once delivery The ingestion route applied FieldValue.increment() per transaction with no already-applied check; a retried flush (lost ack, crash between apply and mark-synced) double-decremented stock and duplicated logs. Shipped: Firestore transaction doing existence-check + increment + log atomically, keyed on the client-generated transaction ID (sync-flush.md).
   • Wholesale delta reset after a possibly-failed flush flushAll cleared the entire local stock-delta map after flushing, but the per-collection flush methods swallowed their own errors — so a failed flush still wiped the deltas and effectiveStock reverted to the stale snapshot (oversell window). Shipped: per-ID delta fold-out on acknowledged syncedIds only; no wholesale reset (sync-flush.md).
   • Flush only ran on the offline→online transition A flush that failed right after reconnect was not retried until the next outage cycle; unsynced work could sit indefinitely while online. Shipped: a 60 s retry timer that flushes whenever unsynced work remains (sync-flush.md).
   Show 5 moreShow fewer

   • Client never rescanned for the local server while offline The terminal-side manager searched for the local server once, at the online→offline transition. A local server that booted after that moment was never found until the cloud recovered and failed again. Shipped: rescan on every offline tick (network-failover.md).
   • Island availability ignored site config Slot generation hardcoded 10:00–20:00 and derived "today" from UTC ISO strings, diverging from the cloud's opening-hours-driven availability (and shifting the day boundary for non-UTC sites). Shipped: hours derived from the replicated site document; site-timezone todayAtSite() helper (local-api.md).
   • Undeclared and dead meta-fields _locallyModified was patched but absent from every RxDB schema (worked only because schema validation was off); _syncConflict was written once at creation and never used by anything. Shipped: _locallyModified declared in schemas; _syncConflict dropped, with conflict handling documented as an explicit LWW decision (architecture.md, replication.md).
   • Dead persistence configuration RXDB_STORAGE_PATH existed in config, env examples, and the deployment guide (which instructed operators to provision a data directory) while the code unconditionally used memory storage — operators believed offline data survived restarts; it did not. Shipped: the config removed; the memory-vs-persistent trade-off stated loudly with options (replication.md), and the Restart=always interaction called out (operations.md).
   • Sticky replication errors lastError was never cleared after recovery, so /status showed a replica as erroring long after it had healed. Shipped: error timestamping + clearing once replication cycles cleanly (replication.md).