v0.2 Slice G — Customer Display LOCAL · GATE 1

H3.2Cross-device transport — hybrid (BC + polling)

Cashier still publishes to BroadcastChannel (instant, same-device) AND now mirrors the same payload to POST /cafe/api/display/<sessionId>/state (debounced 250ms; the paid event bypasses the debounce + uses fetch keepalive so it survives a tab close). Display subscribes to BC AND polls GET /cafe/api/display/<sessionId>/state?secret=… every 1500ms. Last-write- wins reconciliation via updated_at. Same-device cashiers keep the snappy UX they have today; QR/remote devices get ≤2s lag.

The route bypasses Cafe's middleware (alongside /display/ + /api/kitchen/); both POST and GET gate solely on ?secret matching cafe.sessions.display_secret — bad/missing → 404 (don't leak which session ids exist).

H3.2Toolbar Display button → mode picker modal

Replaced the immediate window.open(displayUrl) in three POS toolbars (Pro lockable, Starter lockable, Starter in-app) with a shared <DisplayModeDialog> with two CTAs:

• This device — existing window.open(url, "nix-customer-display"). Best for a second screen behind the counter.
• Display QR — renders a QR encoding the same display URL. Customer scans with their phone; the polling fallback delivers cart updates within ~2s. Includes a Copy URL fallback for when scanning isn't viable.

H3.3Slideshow on the idle screen

Three new columns on cafe.tenant_config: display_slideshow_images (jsonb array of URLs, soft cap 10), display_slideshow_enabled (bool, default false), and display_slideshow_speed_seconds (int, default 5, CHECK constraint pinned to {3,5,7}). The existing single promo_image_url stays — toggle picks which renders on the display's idle screen. Cross-fade transition between images via CSS opacity + a paired second that pre-loads the next URL.

Settings form gets a Slideshow card with: enable toggle, speed pills (3s/5s/7s), multi-upload (re-uses the existing UploadButton), a per-image list with remove, and live preview that mirrors the toggle.

Validation refuses to enable the slideshow with zero images + rejects speed values outside the enum + rejects URLs that aren't http(s):// + caps at 10 images. All probed in the DAO test below.

cleanupcloseShiftAction drops the display_state row

The cafe.display_states table has ON DELETE CASCADE on the FK to cafe.sessions, which catches hard-deletes, but sessions are only ever soft-closed (state='closed'). To keep the table from accumulating stale payloads, closeShiftAction now explicitly DELETEs the row. Best-effort: a failure here doesn't surface as a close failure (logged, swallowed).

Schema probe: cafe.display_states (3 columns, FK confdeltype=c for CASCADE, PK on session_id) + cafe.tenant_config 3 slideshow columns + the cafe_tenant_config_slideshow_speed_check constraint all confirmed.

DAO write probe: upsert(idle) → get returns idle; upsert(cart) → get returns cart with the right line count + subtotal; delete → get returns null. Round-trip through the jsonb column preserves the nested shape.

validateBranding probe: accepts {2 https URLs, enabled, speed=3}; rejects enable-with-no-images; rejects speed=4 (not in enum); rejects 11-image array; rejects javascript: URL.

Raw artefacts: 01-schema.txt · 02-dao-probe.json · result.json