QODY Kitchen KDS live update — MC #107293 / #106857 — 2026-08-18
QODY Kitchen KDS live update — final evidence
Status: Functionally implemented, deployed, and live-verified on demo and production surfaces.
Tasks: MC #107293 (missed KDS updates), MC #106857 (demo Kitchen credential blocker), MC #107308 (deterministic first health request).
Incident and confirmed causes
An already-open Kitchen Display System could remain Uzivo while a new order was absent until manual SINKRONIZIRAJ. A controlled pre-fix reproduction dropped the new-order WebSocket frames: the order remained absent after 20 seconds and appeared immediately after manual sync. Confirmed causes were:
- order events could be broadcast before the transaction committed, so a separate listener connection could fetch no payload;
- PostgreSQL NOTIFY/WebSocket delivery is intentionally non-durable and the KDS had no bounded authoritative replay;
- the existing-order pay-at-table transition had no KDS event;
- the demo KITCHEN fixture password in the long-lived database no longer matched the documented fixture, blocking exact-role UAT.
Implemented remediation
- Backend broadcasts order/payment/lifecycle events only after commit.
ORDER_PAYMENT_MODE_UPDATEDmaps to the KDSorder_updatewire event.- Visible Kitchen boards reconcile from the authoritative database every 10 seconds, pause while hidden, refresh on visibility return, abort hung requests, coalesce overlaps, and reject stale responses that race newer WebSocket events.
- Pending-payment and terminal orders remain excluded; no unbounded polling was added.
- A demo-only repeatable Flyway migration repairs the canonical KITCHEN fixture without exposing a reset endpoint or loading in production.
- E2E login now uses the real httpOnly-cookie KITCHEN form path; obsolete bearer/localStorage and OWNER fallbacks were removed. It waits deterministically for the initial
/staff/ordersresponse and connected WS label.
Source, reviews, and rollout
- Core fix commit
14d38c6b68381a74e73375b712f898d87af8734d, PR 347, merged and deployed to production in build 1126. - Credential repair commit
b884161362c2f05243c21812ca70dbb56ba22dae, PR 355, policy build 1135 PASS, merged. - Exact-role harness commit
c47d846457d42c4a2937e9fc7cbbb630e20b798d, PR 358, policy build 1143 PASS, merged as5aca15661402ccfede109c70ec67063a3e2cd9ee. - Demo API canary
qody-api--bc227a76-1140: health/RLS PASS, 100% traffic; previous serving revision retained as rollback. - Demo Kitchen
qody-staff-kitchen--0000031: Healthy/Provisioned at 100%; former serving revision retained at 0% rollback. - Production Kitchen
qody-staff-kitchen-prod--71fd83c7-1126: Healthy/Provisioned at 100%. - Staff-Kitchen unit suite 28/28 PASS; backend tests PASS; real-PostgreSQL credential migration test PASS.
- CodeCraft review P0=0/P1=0; Redžo and Gemini final verdicts APPROVE.
Exact live acceptance proof
The final test uses the canonical KITCHEN role and real cookie authentication. No OWNER fallback, token injection, manual sync, or reload is permitted.
| Flow | Result | Evidence |
|---|---|---|
| K-02 normal WebSocket | PASS | Order appeared in 47 ms with two order-related WS frames |
| K-02b missed frame | PASS | Exactly one order_created frame deliberately dropped; one card recovered in 9,919 ms |
| Duplicate guard | PASS | Exactly one recovered KDS card |
| Cleanup | PASS | Both test orders canceled successfully |
| Credential causal check | PASS | Canonical demo KITCHEN login changed from pre-deploy 401 to post-deploy 200/KITCHEN |
Evidence paths
- Final manifest:
/Users/makinja/system/evidence/106857/kitchen-live-update/final-live-verification.json - Live test log:
/Users/makinja/system/evidence/106857/kitchen-live-update/k02-k02b-live-r5.stdout.log - Screenshots and WS frames:
/Users/makinja/system/evidence/106857/kitchen-live-update/live-proof-deterministic/ - API canary/retention:
/Users/makinja/system/evidence/106857/kitchen-live-update/manual-api-canary-result.json - Root-cause verdict:
/Users/makinja/system/evidence/107293/root-cause-verdict.md - Dual review:
/Users/makinja/system/evidence/107293/dual-review/dual-review-summary.json
Administrative note
Company Mesh verification prompts timed out because no responder payload was available. This was an orchestration-gate failure, not a product/test failure. No peer PASS was fabricated; closure is based on deterministic live Playwright evidence, Azure policy builds, merged PRs, deployed revision identity, cleanup proof, and independent Redžo/Gemini/CodeCraft reviews.