# MVP-TASK-031 — Visible failure isolation

**Status:** Implemented  
**Parent:** MVP-REL-001-S01–S03, S05

## Objective and required behavior

Make backend/provider outages explicit, never show false success/offline acceptance, and keep
unrelated active orders durable and usable after one failed operation.

## Scope, areas, and non-goals

Expected existing safe error/notification patterns, query/mutation recovery, backend transaction
isolation and tests. No offline queue/sync, silent replay, or infrastructure monitoring platform.

## Evidence and acceptance

Use all four IDs in frontend integration, application/database integration and representative E2E
network/fake failures. Accept when existing queue records remain intact and copy/actions are safe,
traceability is current, and inherited DoD passes. Handoff records unrecoverable external cases.

## Implementation record

The KDS now distinguishes an unavailable read from an empty or successful read. A failed refresh
keeps the last loaded queue and sales figure on screen with an explicit stale-data warning, while a
failure to read unresolved checkout attempts warns the operator not to infer that none exist. The
copy explicitly states that failed work is not accepted for later synchronization. Finalization
failures retain the reviewed draft and never show success.

Executable evidence covers all four scenarios: frontend integration forces the operational reads
offline after loading queue data; PostgreSQL integration makes the checkout boundary throw and
proves unrelated queue and sales records remain byte-identical; Playwright aborts a finalization
request and proves the visible failure, retained draft, intact existing queue, and absence of
offline-success wording. The existing deterministic unknown-checkout integration/E2E evidence
continues to cover provider-result uncertainty.

An external failure before a definitive checkout result remains intentionally unrecoverable by this
task: there is no offline queue, silent replay, or invented reconciliation. The stable operation ID
and durable admission prevent an unrecognized second initiation, but a live provider adapter must
map its own transport outcomes conservatively and supply reconciliation semantics through the later
provider work.

Local validation is recorded in [current-state.md](../../../current-state.md): `pnpm quality`, both
coverage suites, all 79 real-PostgreSQL integration tests, and all 70 browser tests pass. Hosted CI
and `pnpm validate:docker` were not run, so this is Implemented and awaiting CI rather than Done.