This source repair reserves tracked stock before a card payment starts and keeps
that reservation during card authentication or uncertain payment recovery.
Retrying the same completed cash sale returns its original transaction. Cash,
account credit, product course perks and staff benefits—including product carts
without tracked stock—and stock changes share the canonical sale-effect transaction, and stock adjustments
cannot spend units already promised to another payment.

Booking add-on cancellation retains its explicit stock-return behavior, now
bounded by the original sale. A monetary refund alone does not imply that a
physical product was returned. Inventory remains organization-wide; location is
movement attribution, not a new location balance.

The native tracked-product route now delegates to this same canonical stock
authority. Its release requires migrations89/90 and the paired app changes;
production rollout, provider and installed-app acceptance remain separate verification.
No automatic customer send, price, VAT or legal policy changes are included.
Tracked direct service sales include the existing paid-proof promotion and
appointment confirmation in the sale transaction. Product commission and audit
records commit once, while low-stock notices use the existing recoverable job
queue. Full-schema staging and integrated cashier acceptance are still required.

The paired register can preview product and standard-pass prices before payment
and retain the selected staff converter and location through recovery. Course
perks belong to product or bundle-only sales; a pass or service cart with a perk
claim is refused before payment instead of silently dropping the claim.

The quote and sale endpoints share the same pass-field mapping in a dedicated
module, keeping the HTTP route exports valid for generated release type checks.
This structural correction does not change the purchase or quote contract.

The release also preserves account identity while a sale is being recovered.
Profiles with canonical POS sale-effect history cannot be merged away until that
history has an explicitly supported transfer path. Account erasure involving
these retained records requires review; it is not silently reported as complete.
The database prevents new POS identity links from attaching to a profile already
fenced for deletion. These safeguards require migration92 before release.