Answer the catalogue as a delta when the terminal sends a revision

Every pull was a full snapshot, so a shop with a thousand products
re-sent all of them to correct one price. The response now carries a
revision the terminal stores and hands back, and a pull that supplies
one gets only what moved: the product row, its row at that outlet, or
its stock ledger. Stock is included because a shop's count drifts from a
till's on every sale rung at another counter, and a delta that ignored
it would let that drift persist until someone forced a full pull.

The dangerous part is the flag, not the filter. A response marked
is_delta:false tells the terminal to withdraw every product it does not
mention — so a filtered result carrying that label empties the shelf.
Both are now derived from one value, and there is no path through the
function that filters without also setting the flag.

Everything ambiguous resolves toward the snapshot. A revision that is
malformed, empty, or issued to another outlet yields a zero cutoff and a
complete response; the opposite would leave a terminal permanently
missing changes with nothing to show for it. The revision advances only
on the final page, so a terminal that abandons a paginated pull cannot
end up holding one that claims it saw pages it never received. And the
stamp is taken a second in the past, because a product written during
the same second the query ran would otherwise fall on the wrong side of
the next cutoff and be skipped for good.

A delta still cannot withdraw a deleted product — removing a row from
productlocations leaves no tombstone — so a periodic pull without a
revision is what collects those.

Verified against the live outlet: a full pull of 12, a delta returning
only the one product whose price had changed, and pagination that stays
exact now that productid <= 0 is excluded in SQL rather than after the
LIMIT.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

repositories/posRepository_test.go

@@ -1,6 +1,9 @@
 package repositories
 
-import "testing"
+import (
+	"testing"
+	"time"
+)
 
 // The terminal holds a unique index on barcode, so this rule decides whether a
 // catalogue import succeeds at all. Measured against live data when it was
@@ -95,3 +98,65 @@ func TestLegacyOrderQtyIsUnchanged(t *testing.T) {
 		}
 	}
 }
+
+// A catalogue revision is the terminal's memory of when it last pulled. If it
+// does not survive a round trip, every pull silently becomes a full snapshot —
+// or worse, a filtered result gets labelled as one and the shop's shelf empties.
+func TestPosRevisionRoundTrips(t *testing.T) {
+	at := time.Date(2026, 8, 3, 12, 30, 45, 0, time.UTC)
+
+	revision := posRevisionFor(1135, at)
+	if revision != "loc1135-20260803T123045Z" {
+		t.Fatalf("revision = %q, want loc1135-20260803T123045Z", revision)
+	}
+
+	got := posRevisionCutoff(1135, revision)
+	if !got.Equal(at) {
+		t.Errorf("cutoff = %v, want %v", got, at)
+	}
+}
+
+func TestAnUnusableRevisionFallsBackToAFullSnapshot(t *testing.T) {
+	// A zero cutoff means "send everything", and the caller turns that into
+	// is_delta:false. Falling back the other way — answering an unreadable
+	// revision with a change set — would leave a terminal permanently missing
+	// every change it had not already seen, with nothing to show for it.
+	cases := []struct {
+		name     string
+		location int
+		revision string
+	}{
+		{"empty", 1135, ""},
+		{"whitespace", 1135, "   "},
+		{"no prefix", 1135, "20260803T123045Z"},
+		{"malformed timestamp", 1135, "loc1135-not-a-time"},
+		{"truncated timestamp", 1135, "loc1135-20260803"},
+		{"another outlet's revision", 1135, "loc1097-20260803T123045Z"},
+		{"prefix collision", 113, "loc1135-20260803T123045Z"},
+		{"garbage", 1135, "../../etc/passwd"},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			if got := posRevisionCutoff(c.location, c.revision); !got.IsZero() {
+				t.Errorf("cutoff = %v, want zero (full snapshot) for %q", got, c.revision)
+			}
+		})
+	}
+}
+
+func TestAnOutletCannotReplayAnotherOutletsRevision(t *testing.T) {
+	// loc1135 and loc113 share a textual prefix. Matching loosely would let one
+	// shop's cutoff silently scope another shop's delta.
+	at := time.Date(2026, 8, 3, 12, 30, 45, 0, time.UTC)
+	revision := posRevisionFor(1135, at)
+
+	if got := posRevisionCutoff(1135, revision); got.IsZero() {
+		t.Error("the issuing outlet could not read back its own revision")
+	}
+	for _, other := range []int{113, 11350, 1097, 1} {
+		if got := posRevisionCutoff(other, revision); !got.IsZero() {
+			t.Errorf("outlet %d accepted outlet 1135's revision (cutoff %v)", other, got)
+		}
+	}
+}