# F-187 — Implementer evidence

## Delivered

- Added reversible migration `055_pos_cashier_lifecycle.js` with active/deactivated/deleted account lifecycle, consistency constraint and cashier status index.
- Extended backoffice domain roles to include POS manager/cashier and lifecycle fields.
- Blocked inactive/deleted accounts in both credential lookup and live session authentication.
- Made cash-session opening transactional and serialized against lifecycle mutation using the same `backoffice_users ... FOR UPDATE` row lock.
- Extended admin-only POS user list with lifecycle status.
- Added admin-only cashier activate/deactivate and soft-delete endpoints.
- Lifecycle mutations reject open cash sessions, revoke every live session, preserve the cashier row/UUID and write an atomic security audit event.
- Added TPV admin cashier UI for create, status display, confirmed deactivate/reactivate and irreversible deletion.
- Added real PostgreSQL integration coverage in `pos-cashier-lifecycle.itest.ts`.

## Validation

- Backend typecheck: PASS.
- Admin typecheck: PASS.
- Backend production build: PASS.
- Admin production build: PASS (only pre-existing Turbopack upload tracing warnings).
- Targeted ESLint for every changed TypeScript/TSX file: PASS.
- Prettier for every changed source/migration/test file: PASS.
- POS unit tests: 12/12 PASS.
- Full unit suite without DB: 268/268 PASS.
- F-187 PostgreSQL integration: 4/4 PASS.
- Full real-PostgreSQL sequential suite: 354/354 PASS across 79 files.
- Migration fresh up / second no-op / full down / re-up: 4/4 PASS.
- `git diff --check`: PASS.
- `./scripts/verify.sh`: PASS.

## Repository baseline notes

- Full backend lint remains red on 9 pre-existing errors in thumbnail script, log broadcaster, an old POS test, and reporting files; all F-187 changed files pass targeted ESLint and Prettier.
- Boundary check retains the single pre-existing security-module import violation; F-187 adds no module-boundary violation.
- Full admin lint has zero errors and 23 pre-existing warnings.
- Existing untracked upload JPGs were not touched.