Upload shopper registrations, and charge GST to the lines that earned it

Two defects that share a shape: a figure landing on the wrong record.

Bill-level discounts were apportioned across every line by a single
factor, so "20% off Beverages" pulled tax out of the atta line as well.
The bill total was right either way, which is what made it easy to ship
— only the slab split on a filed return was wrong. Targeted campaigns
now reduce the lines they name, and bill-wide reductions still spread
pro rata, so the arithmetic is unchanged wherever it was already right.

Shoppers registered at a till only ever reached the back office as three
fields riding along on a bill. Somebody who signed up and bought nothing
existed on one terminal and nowhere else, and two tills registering the
same mobile each minted their own row. Customers are now an outbox of
their own on pos/{store}/{terminal}/customer, and the id is a UUIDv5
over the normalised mobile number — so a hundred terminals agree on who
a shopper is without talking to each other.

Registrations go up before bills, and a failure there cannot strand a
day's takings. No loyalty figures are sent: they belong to the bill
stream, which is idempotent and knows about every counter.

Two things found while building it. Numbers were keyed on raw digits, so
a cashier typing +91 forked a shopper as effectively as a random id
would. And the sale path wrote the customer with ConflictAlgorithm
.replace, which is a DELETE and an INSERT — every column absent from the
row reverts to its schema default, so the new sync flag would have been
cleared by the shopper's next purchase.

Schema v8. Existing customers are queued rather than assumed sent: the
terminal cannot tell an imported row from a locally registered one, and
only one of those mistakes loses somebody.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

test/unit/sync_engine_test.dart

@@ -39,6 +39,23 @@ class _StubRepository implements SyncRepository {
   @override
   Future<int> unsyncedCount() async => pending;
 
+  /// Counted so a test can prove registrations go up before bills do.
+  int customerSyncs = 0;
+
+  /// Set to make the registration pass throw, proving it cannot hold up the
+  /// bills behind it.
+  bool customerSyncThrows = false;
+
+  @override
+  Future<int> unsyncedCustomerCount() async => 0;
+
+  @override
+  Future<SyncOutcome> syncCustomers() async {
+    customerSyncs++;
+    if (customerSyncThrows) throw Exception('registration upload failed');
+    return const SyncOutcome(attempted: 0, uploaded: 0);
+  }
+
   @override
   Future<int> purgeExpired() async => 0;
 
@@ -308,6 +325,10 @@ void main() {
       final engine = build(connectivity: connectivity.stream);
       await engine.start();
 
+      // start() fires a drain of its own. Let it finish before taking the
+      // baseline, so this measures what connectivity did rather than how many
+      // awaits happen to sit in front of the repository call.
+      await _settle();
       final atStart = repo.calls;
 
       connectivity.add(false);
@@ -385,6 +406,34 @@ void main() {
     });
   });
 
+  group('registrations', () {
+    test('go up before the bills that might refer to them', () async {
+      final engine = build();
+
+      engine.nudge(SyncTrigger.saleCommitted);
+      await _settle();
+
+      expect(repo.customerSyncs, 1);
+      expect(repo.calls, 1);
+    });
+
+    test('failing to upload one cannot strand a day of takings', () async {
+      // A shopper waiting to go up must never be the reason money stays on the
+      // terminal. The registration pass is allowed to fail on its own.
+      repo.customerSyncThrows = true;
+      final engine = build();
+
+      engine.nudge(SyncTrigger.saleCommitted);
+      await _settle();
+
+      expect(repo.calls, 1, reason: 'the bills still went');
+      expect(engine.state.consecutiveFailures, 0);
+      expect(engine.state.isHalted, isFalse);
+
+      await engine.dispose();
+    });
+  });
+
   test('a repository that throws is treated as a retryable failure, not a crash',
       () async {
     // Anything escaping the repository is a defect. The engine must still empty