@wix/himalaya-cli 0.1391.0 → 0.1393.0

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-orders/index.ts

@@ -8,7 +8,7 @@
 
 import { defineBackendCollection } from "../_shared/collection-service.js";
 import { searchOrders, type WixOrder } from "@himalaya/wix-ecom";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_ORDERS, DEMO_NOTE, demoOrderDate } from "../_shared/owner-preview-demo.js";
 import { copyParam } from "../_shared/himi-copy.js";
 import { compareText, formatMonthDay } from "../_shared/engine-intl.js";
@@ -276,7 +276,7 @@ const svc = defineBackendCollection("himiOwnerLiteOrders", {
         if (metadata?.hasNext && !nextCursor) throw new Error("Orders response is missing its next-page cursor");
         return { items: (response.orders ?? []).filter(order => !!order?.id).map(normalize), nextCursor, metadata: { demoNote: "" } };
       } catch (error) {
-        if (!cursor && isBridgeUnavailable(error)) return demoPage();
+        if (!cursor && ownerDemoFallback(error)) return demoPage();
         throw error;
       }
     },

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -27,7 +27,7 @@ import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
 import { site } from "@himalaya/wix-platform";
 import { searchOrders } from "@himalaya/wix-ecom";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
@@ -203,7 +203,7 @@ async function loadRollup(): Promise<OverviewState> {
     return shape({ status: "ready", rows });
   } catch (e) {
     // Only the ACCOUNT-level list failing gets here; a per-business failure is a row.
-    if (isBridgeUnavailable(e)) return demoRollup();
+    if (ownerDemoFallback(e)) return demoRollup();
     return shape({ status: "error", rows: [], error: ownerLoadError(e) });
   }
 }

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-post/index.ts

@@ -10,25 +10,24 @@ import { getPost, getDraftPost, publishDraftPost, revertDraftPost, deleteDraftPo
 import { parseRicosJson } from "@himalaya/wix-rich-content";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isBridgeUnavailable, isTransportFailure, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError, isNotFound } from "../_shared/owner-load-error.js";
 import { DEMO_POSTS, DEMO_NOTE, DEMO_SAVE_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
-import { get as dbGet, upsert as dbUpsert, remove as dbRemove, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, upsert as dbUpsert, remove as dbRemove, type DbEntity } from "../_shared/owner-local-db.js";
 import { formatDateMedium } from "../_shared/engine-intl.js";
 import { blankFlags } from "../_shared/detail-facts.js";
 
-// Offline-first (data-offline): owner CRUD is WRITE-BEHIND against the encrypted
-// `owner_posts` entity — publish/unpublish/delete update the local store
-// OPTIMISTICALLY so the detail/list repaint from cache immediately, then the wix
-// write is attempted; if it can't reach the bridge/network the mutation is ENQUEUED
-// for replay on reconnect, and detail reads fall back to the last-synced local row.
+// Offline-first (data-offline): detail reads fall back to the last-synced local row
+// of the encrypted `owner_posts` entity. Publish/unpublish/delete are
+// SERVER-CONFIRMED: the local row changes only after Wix accepts the write; a failed
+// one leaves it alone and tells the owner why. No host replays a queued write, so
+// nothing is queued.
 // Every local-db call is wrapped (try/catch) so a build that ships without the
-// `local_database` grant behaves exactly as before (online-only, no cache/queue).
+// `local_database` grant behaves exactly as before (online-only, no cache).
 const ENTITY = "owner_posts";
 async function cachePut(row: DbEntity): Promise<void> { try { await dbUpsert(ENTITY, row); } catch { /* capability not granted */ } }
 async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTITY, id); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 /** [rico] #3370 — keep the body's plain text with the post's cached row, so the offline detail shows it. It is
  *  merged into the row the posts list wrote rather than replacing it; a later list re-sync writes its own rows
  *  and drops it again, until the detail is next opened online. */
@@ -250,16 +249,39 @@ function cachedDetail(s: PostState, row: DbEntity): PostState {
   });
 }
 
-async function refresh(prev: PostState, id: string, actionMessage = ""): Promise<PostState> {
+/** The re-read after a write Wix CONFIRMED: when it fails — thrown or as an error state
+ *  ("post not found" for a 5xx on both reads) — the confirmed change stays on screen. */
+async function reread(prev: PostState, actionMessage: string, confirmed: PostState): Promise<PostState> {
+  try {
+    // A reread right after a CONFIRMED write never drops the row that write just cached: a
+    // both-404 here is a lagging read, not proof the post is gone.
+    const next = await refresh(prev, prev.id, actionMessage, { dropIfGone: false });
+    return next.status === "error" ? confirmed : next;
+  } catch {
+    return confirmed;
+  }
+}
+
+async function refresh(prev: PostState, id: string, actionMessage = "", opts: { dropIfGone?: boolean } = {}): Promise<PostState> {
   let post: any | undefined;
   let draft: any | undefined;
   let lastError: unknown;
-  try { post = (await getPost(id)).post; } catch (e) { lastError = e; /* draft-only */ }
+  let postError: unknown;
+  try { post = (await getPost(id)).post; } catch (e) { lastError = postError = e; /* draft-only */ }
   try { draft = (await getDraftPost(id)).draftPost; } catch (e) { lastError = e; /* published-only or missing */ }
   if (!post && !draft) {
     // Both arms swallowed their errors above; surface the DESIGNED bridge
-    // boundary so the callers' catches can fall back to the demo post.
-    if (isBridgeUnavailable(lastError)) throw lastError;
+    // boundary (and a device with no connection) so the callers' catches can fall
+    // back to the cached row or the demo post — never "post not found" for a post
+    // that was only unreachable.
+    // Either read counts: a published-only post's draft read is always a 404, so the
+    // published read's failure is the one that says whether the post was only unreachable.
+    for (const err of [postError, lastError]) {
+      if (isBridgeUnavailable(err) || isTransportFailure(err)) throw err;
+    }
+    // Wix says it is gone on BOTH reads (a published-only post's draft read is a 404 on its
+    // own): its cached row must not outlive it, or an offline load repaints a deleted post.
+    if (opts.dropIfGone !== false && isNotFound(postError) && isNotFound(lastError)) await cacheDrop(id);
     return shape({ ...prev, id, status: "error", title: "", error: copyParam("ownerPost.errorNotFound", "post not found"), actionMessage });
   }
   const title = (draft?.title || post?.title || "Untitled post").trim();
@@ -336,9 +358,10 @@ const svc = defineService<PostState, {
         return loaded;
       } catch (e) {
         // Offline: fall back to the last-synced local row before the demo/error paths.
-        const cached = await cacheGet(id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(id), null) : await cacheGet(id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, id);
           if (demo) return demo;
         }
@@ -359,9 +382,10 @@ const svc = defineService<PostState, {
         await cacheBodyText(loaded);
         return loaded;
       } catch (e) {
-        const cached = await cacheGet(s.id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(s.id), null) : await cacheGet(s.id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, s.id);
           if (demo) return demo;
         }
@@ -373,19 +397,18 @@ const svc = defineService<PostState, {
       if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
       if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerPost.noIdMessage", "No post id.") });
       if (s.postStatusRaw === "PUBLISHED") return shape({ ...s, actionMessage: copyParam("ownerPost.alreadyPublished", "Post is already published.") });
-      // Optimistic local write — the detail/list repaint from cache immediately.
-      const optimistic = shape({ ...s, postStatusRaw: "PUBLISHED", postStatus: "Published", actionMessage: copyParam("ownerPost.publishedMessage", "Post published.") });
-      await cachePut(cacheRow(optimistic));
       try {
         await publishDraftPost(s.id);
-        return refresh(s, s.id, copyParam("ownerPost.publishedMessage", "Post published."));
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          await queueWrite("tier5.himiOwnerLitePost.publish", { id: s.id });
-          return shape({ ...optimistic, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-        }
-        return shape({ ...s, actionMessage: ownerLoadError(e) });
+        // Nothing replays a queued write: the post is as it was, and the owner is told why.
+        return shape({ ...s, actionMessage: ownerWriteError(e) });
       }
+      // Wix confirmed it: the list repaints from cache at once, and a re-read that fails
+      // afterwards still shows the confirmed change rather than undoing it on screen.
+      const published = copyParam("ownerPost.publishedMessage", "Post published.");
+      const confirmed = shape({ ...s, postStatusRaw: "PUBLISHED", postStatus: "Published", actionMessage: published });
+      await cachePut(cacheRow(confirmed));
+      return reread(s, published, confirmed);
     },
     unpublish: async (s0) => {
       const s = disarm(s0);
@@ -394,19 +417,16 @@ const svc = defineService<PostState, {
       if (s.postStatusRaw !== "PUBLISHED" && s.postStatusRaw !== "SCHEDULED") {
         return shape({ ...s, actionMessage: copyParam("ownerPost.alreadyDraft", "Post is already a draft.") });
       }
-      // Optimistic local write — the detail/list repaint from cache immediately.
-      const optimistic = shape({ ...s, postStatusRaw: "UNPUBLISHED", postStatus: "Draft", actionMessage: "Post moved to drafts." });
-      await cachePut(cacheRow(optimistic));
       try {
         await revertDraftPost(s.id);
-        return refresh(s, s.id, copyParam("ownerPost.unpublishedMessage", "Post moved to drafts."));
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          await queueWrite("tier5.himiOwnerLitePost.unpublish", { id: s.id });
-          return shape({ ...optimistic, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-        }
-        return shape({ ...s, actionMessage: ownerLoadError(e) });
+        // Nothing replays a queued write: the post is as it was, and the owner is told why.
+        return shape({ ...s, actionMessage: ownerWriteError(e) });
       }
+      const unpublished = copyParam("ownerPost.unpublishedMessage", "Post moved to drafts.");
+      const confirmed = shape({ ...s, postStatusRaw: "UNPUBLISHED", postStatus: "Draft", actionMessage: unpublished });
+      await cachePut(cacheRow(confirmed));
+      return reread(s, unpublished, confirmed);
     },
     // #3158 — destructive, so two steps. `delete` (the Manage card's Delete button)
     // only ARMS the inline confirmation, which names the record and says it cannot
@@ -423,18 +443,15 @@ const svc = defineService<PostState, {
         const s = disarm(s0);
         if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
         if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerPost.noIdMessage", "No post id.") });
-        // Optimistic local delete — the list drops the row immediately.
-        await cacheDrop(s.id);
         try {
           await deleteDraftPost(s.id);
-          return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: "" });
         } catch (e) {
-          if (shouldQueueOwnerWrite(e)) {
-            await queueWrite("tier5.himiOwnerLitePost.delete", { id: s.id });
-            return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-          }
-          return shape({ ...s, actionMessage: ownerLoadError(e) });
+          // Nothing replays a queued write: the post stays, and the owner is told why.
+          return shape({ ...s, actionMessage: ownerWriteError(e) });
         }
+        // Only a delete Wix confirmed leaves the local list.
+        await cacheDrop(s.id);
+        return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: "" });
       } finally {
         deleteInFlight = false;
       }

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-post-form/index.ts

@@ -10,21 +10,20 @@ import { wixCall } from "@himalaya/wix-site-media";
 import { wixMediaUrl, WIX_DETAIL_IMAGE } from "../_shared/himi-store.js";
 import { defineService } from "@himalaya/state";
 import { getDraftPost, createDraftPost, updateDraftPost, type WixDraftPostWrite, type WixRichContent } from "@himalaya/wix-blog";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError } from "../_shared/owner-load-error.js";
 import { DEMO_POSTS, DEMO_NOTE, DEMO_SAVE_NOTE, demoRefusalPatch } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
-import { get as dbGet, upsert as dbUpsert, remove as dbRemove, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, upsert as dbUpsert, remove as dbRemove, type DbEntity } from "../_shared/owner-local-db.js";
 
 // Offline-first (data-offline): owner CRUD is WRITE-BEHIND against the encrypted
-// `owner_posts` entity — cache confirmed writes, or enqueue offline edits for
-// replay on reconnect. Failed cover imports must not appear as saved drafts.
+// `owner_posts` entity — cache confirmed writes only; a failed save says nothing was
+// saved (no host replays a queue). Failed cover imports must not appear as saved drafts.
 // Every local-db call is wrapped (try/catch) so a build that ships without the
 // `local_database` grant behaves exactly as before (online-only, no cache/queue).
 const ENTITY = "owner_posts";
 async function cachePut(row: DbEntity): Promise<void> { try { await dbUpsert(ENTITY, row); } catch { /* capability not granted */ } }
 async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTITY, id); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 
 type Mode = "create" | "edit";
 
@@ -223,7 +222,7 @@ const svc = defineService<PostFormState, {
             status: "idle", error: "", savedMessage: "",
           });
         }
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const d = DEMO_POSTS.find((x) => x.id === id);
           if (d) {
             return shape({
@@ -342,23 +341,11 @@ const svc = defineService<PostFormState, {
         await cachePut(localRow(id));
         return savedState(id, editing ? copyParam("ownerPostForm.updatedMessage", "Post updated.") : copyParam("ownerPostForm.createdMessage", "Draft created."));
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          // Demo / web-preview (no owner bridge; the record came from demo sample
-          // data, marked by demoNote): a queued write could never replay, so answer
-          // with the demo save note instead of the real-offline write-behind.
-          if (s.demoNote) return demoRefusal(s);
-          // Real device offline: cache and queue the edit for reconnect. `preserveBody` stays
-          // "true" even for a body edit, so a bundle rolled back past this change keeps the stored
-          // body rather than flattening it to text. This bundle replays `richContentJson`.
-          await cachePut(localRow(localId));
-          await queueWrite("tier5.himiOwnerLitePostForm.submit", {
-            id: targetId, title, excerpt, coverUrl, coverChanged: String(coverChanged), preserveBody: "true",
-            body: postBodyText(kept), ...(bodyEdited ? { richContentJson: bodyRaw } : {}),
-            isFeatured: String(isFeatured), mode: editing ? "edit" : "create",
-          });
-          return savedState(localId, copyParam("ownerPostForm.savedOffline", "Saved offline — will sync when you reconnect."));
-        }
-        return shape({ ...s, status: "error", error: ownerLoadError(e), savedMessage: "" });
+        // Demo / web-preview: the record came from demo sample data (marked by demoNote).
+        if (s.demoNote) return demoRefusal(s);
+        // Never "saved offline": nothing replays a queued write on any platform. The
+        // typed values stay in the form (the body in its editor), so a retry is one tap.
+        return shape({ ...s, title, excerpt, coverUrl, isFeatured: isFeatured ? "true" : "false", status: "error", error: ownerWriteError(e), savedMessage: "" });
       }
     })()),
   },

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-posts/index.ts

@@ -4,7 +4,7 @@
 
 import { defineService } from "../_shared/collection-service.js";
 import { queryPosts, queryDraftPosts } from "@himalaya/wix-blog";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_POSTS, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { getAll, upsert, type DbEntity } from "../_shared/owner-local-db.js";
@@ -227,7 +227,7 @@ async function loadList(s: PostsState): Promise<PostsState> {
   } catch (e) {
     // Offline / fetch failure: keep the last-synced cache BEFORE the demo/error fallbacks.
     if (cached.length) return base;
-    if (isBridgeUnavailable(e)) return demoList(s);
+    if (ownerDemoFallback(e)) return demoList(s);
     return shape({ ...s, status: "error", allPosts: [], posts: [], error: ownerLoadError(e) });
   }
 }

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-product/index.ts

@@ -7,24 +7,22 @@
 import { defineService } from "@himalaya/state";
 import { getProduct, updateProduct, deleteProduct, type WixProduct } from "@himalaya/wix-stores";
 import { plainText, productImage, wixMediaUrl, WIX_DETAIL_IMAGE, type StoreProduct } from "../_shared/himi-store.js";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError, isNotFound } from "../_shared/owner-load-error.js";
 import { DEMO_PRODUCTS, DEMO_NOTE, DEMO_SAVE_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
-import { get as dbGet, upsert as dbUpsert, remove as dbRemove, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, upsert as dbUpsert, remove as dbRemove, type DbEntity } from "../_shared/owner-local-db.js";
 import { blankFlags } from "../_shared/detail-facts.js";
 
-// Offline-first (data-offline): owner CRUD is WRITE-BEHIND against the encrypted
-// `owner_products` entity — the local store is updated OPTIMISTICALLY so the
-// detail/list repaint from cache immediately, then the Wix write is attempted; if
-// it can't reach the bridge/network the mutation is ENQUEUED for replay on
-// reconnect, and detail reads fall back to the last-synced local row. Every
-// local-db call is wrapped (try/catch) so a build that ships without the
-// `local_database` grant behaves exactly as before (online-only, no cache/queue).
+// Offline-first (data-offline): detail reads fall back to the last-synced local row
+// of the encrypted `owner_products` entity. Writes are SERVER-CONFIRMED: the local
+// row changes only after Wix accepts the write; a failed one leaves it alone and
+// tells the owner why. No host replays a queued write, so nothing is queued.
+// Every local-db call is wrapped (try/catch) so a build that ships without the
+// `local_database` grant behaves exactly as before (online-only, no cache).
 const ENTITY = "owner_products";
 async function cachePut(row: DbEntity): Promise<void> { try { await dbUpsert(ENTITY, row); } catch { /* capability not granted */ } }
 async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTITY, id); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 
 interface ProductState {
   id: string;
@@ -265,19 +263,21 @@ async function setVisibility(s: ProductState, visible: boolean, msg: string): Pr
         : copyParam("ownerProduct.alreadyHidden", "Already hidden."),
     });
   }
-  // Optimistic local write — the detail/list repaint from cache immediately.
-  const optimistic = shape({ ...s, visibleRaw: visible, statusLabel: visible ? "Visible in store" : "Hidden", subtitle: visible ? "Visible in store" : "Hidden from store", actionMessage: msg });
-  await cachePut(cacheRow(optimistic));
   try {
     await updateProduct(s.id, { visible });
-    return refresh(s, s.id, msg);
   } catch (e) {
-    if (shouldQueueOwnerWrite(e)) {
-      // Offline / no bridge: queue the visibility write to replay on reconnect.
-      await queueWrite("tier5.himiOwnerLiteProduct." + (visible ? "show" : "hide"), { id: s.id });
-      return shape({ ...optimistic, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-    }
-    return shape({ ...s, actionMessage: ownerLoadError(e) });
+    // Nothing replays a queued write: the record is as it was, and the owner is told why.
+    return shape({ ...s, actionMessage: ownerWriteError(e) });
+  }
+  // Wix confirmed it: the list repaints from cache at once, and a re-read that fails
+  // afterwards still shows the confirmed change rather than undoing it on screen.
+  const confirmed = shape({ ...s, visibleRaw: visible, statusLabel: visible ? "Visible in store" : "Hidden", subtitle: visible ? "Visible in store" : "Hidden from store", actionMessage: msg });
+  await cachePut(cacheRow(confirmed));
+  try {
+    const next = await refresh(s, s.id, msg);
+    return next.status === "error" ? confirmed : next;
+  } catch {
+    return confirmed;
   }
 }
 
@@ -321,9 +321,10 @@ const svc = defineService<ProductState, {
         return await refresh(shape({ ...s, id, status: "loading" }), id);
       } catch (e) {
         // Offline: fall back to the last-synced local row before the demo/error paths.
-        const cached = await cacheGet(id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(id), null) : await cacheGet(id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, id);
           if (demo) return demo;
         }
@@ -342,9 +343,10 @@ const svc = defineService<ProductState, {
       try {
         return await refresh(shape({ ...s, status: "loading" }), s.id);
       } catch (e) {
-        const cached = await cacheGet(s.id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(s.id), null) : await cacheGet(s.id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, s.id);
           if (demo) return demo;
         }
@@ -368,18 +370,15 @@ const svc = defineService<ProductState, {
         const s = disarm(s0);
         if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
         if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerProduct.noIdMessage", "No product id.") });
-        // Optimistic local delete — the list drops the row immediately.
-        await cacheDrop(s.id);
         try {
           await deleteProduct(s.id);
-          return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerProduct.deletedEmpty", "Product deleted."), actionMessage: "" });
         } catch (e) {
-          if (shouldQueueOwnerWrite(e)) {
-            await queueWrite("tier5.himiOwnerLiteProduct.delete", { id: s.id });
-            return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerProduct.deletedEmpty", "Product deleted."), actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-          }
-          return shape({ ...s, actionMessage: ownerLoadError(e) });
+          // Nothing replays a queued write: the record stays, and the owner is told why.
+          return shape({ ...s, actionMessage: ownerWriteError(e) });
         }
+        // Only a delete Wix confirmed leaves the local list.
+        await cacheDrop(s.id);
+        return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerProduct.deletedEmpty", "Product deleted."), actionMessage: "" });
       } finally {
         deleteInFlight = false;
       }

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-product-form/index.ts

@@ -15,29 +15,28 @@ import {
   type WixProduct,
   type WixProductWrite,
 } from "@himalaya/wix-stores";
-import { get as dbGet, upsert as dbUpsert, remove as dbRemove, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, upsert as dbUpsert, remove as dbRemove, type DbEntity } from "../_shared/owner-local-db.js";
 import { htmlIsTrivial, htmlPreviewText } from "../_shared/owner-rich-guard.js";
 import { postBodyText, plainPostBody } from "../_shared/owner-post-content.js";
 import { editorSubmitValue, queuedDocument, editorChanged, cachedRichVerdict, editorRunKeys, resetHydratedEditorOnOlderRuntime, editorAfterSave, liveState, settleOverLive } from "../_shared/owner-editor-value.js";
 import { parseRicosJson } from "@himalaya/wix-rich-content";
 import { ricosUploadService } from "@himalaya/wix-rich-content-editor";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError } from "../_shared/owner-load-error.js";
 import { DEMO_PRODUCTS, DEMO_NOTE, DEMO_SAVE_NOTE, demoRefusalPatch, editablePrice } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 
 type Mode = "create" | "edit";
 
-// Offline-first (data-offline): owner CRUD is WRITE-BEHIND against the encrypted
-// `owner_products` entity — the local store is updated OPTIMISTICALLY so the list
-// repaints from cache immediately, then the Wix write is attempted; if it can't
-// reach the bridge/network the mutation is ENQUEUED for replay on reconnect. Every
-// local-db call is wrapped (try/catch) so a build that ships without the
-// `local_database` grant behaves exactly as before (online-only, no cache/queue).
+// Offline-first (data-offline): writes to the encrypted `owner_products` entity are
+// SERVER-CONFIRMED — the list's local row changes only after Wix accepts the save;
+// a failed one leaves it alone, keeps the form, and tells the owner why. No host
+// replays a queued write, so nothing is queued.
+// Every local-db call is wrapped (try/catch) so a build that ships without the
+// `local_database` grant behaves exactly as before (online-only, no cache).
 const ENTITY = "owner_products";
 async function cachePut(row: DbEntity): Promise<void> { try { await dbUpsert(ENTITY, row); } catch { /* capability not granted */ } }
 async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTITY, id); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 
 // The store's currency — the Apptestersite detail view shows € prices.
 const CURRENCY = "EUR";
@@ -268,7 +267,7 @@ const svc = defineService<ProductFormState, {
             status: "idle", error: "", savedMessage: "",
           });
         }
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const d = DEMO_PRODUCTS.find((p) => p.id === id);
           if (d) {
             return shape({
@@ -356,7 +355,7 @@ const svc = defineService<ProductFormState, {
       const knownPlain = s.descriptionMode === "plain" || (s.descriptionMode === "editor" && !s.descriptionPending && s.descriptionJson === "");
       const descriptionProtected = cachedRichVerdict(heldDoc as never, knownPlain);
 
-      // Optimistic local write — the list repaints from cache immediately (offline or not).
+      // The row the cache gets once Wix accepts the save.
       // Replay starts with default worker state. An untouched description was omitted from the
       // queued PATCH, so retain its cached mirror/document/verdict when replacing the local row.
       const cached = replay && targetId ? await cacheGet(targetId) : null;
@@ -380,7 +379,6 @@ const svc = defineService<ProductFormState, {
         return { descriptionDirty: a.dirty, descriptionEdits: a.edits, ...(a.editedDuringSave ? { status: "idle" as const, savedMessage: "" } : {}) };
       };
       const localId = mode === "edit" && targetId ? targetId : `local-${Date.now()}`;
-      await cachePut(localRow(localId));
       try {
         let id = targetId;
         if (mode === "edit" && targetId) {
@@ -388,9 +386,9 @@ const svc = defineService<ProductFormState, {
         } else {
           const r = await createProduct(write);
           id = r.product?.id || localId;
-          // Reconcile the optimistic local id with the server-assigned id.
-          if (id !== localId) { await cacheDrop(localId); await cachePut(localRow(id)); }
         }
+        // The local row follows only what Wix confirmed, under the id Wix assigned.
+        await cachePut(localRow(id));
         return shape({
           ...s,
           mode: "edit",
@@ -407,44 +405,26 @@ const svc = defineService<ProductFormState, {
           ...afterSaved(),
         });
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          // Demo / web-preview (no owner bridge; the record came from DEMO_PRODUCTS,
-          // marked by demoNote): a queued write could never replay, so answer with
-          // the demo save note instead of the real-offline write-behind.
-          if (s.demoNote) return demoRefusal(s);
-          // Real device offline: the optimistic cache row already shows; queue the
-          // write to replay (WriteQueue, idempotent) when connectivity returns.
-          // A document rides as `descriptionJson` with descriptionEdited "false", so a bundle rolled back
-          // past this change leaves the description rather than flattening it to text.
-          await queueWrite("tier5.himiOwnerLiteProductForm.submit", { id: targetId, name, price, sku, description, visible: String(visible), mode,
-            ...(docRaw ? { descriptionJson: docRaw, descriptionEdited: "false" } : { descriptionEdited: String(descriptionEdited) }) });
-          return shape({
-            ...s, mode: "edit", id: localId, name, price, sku, ...savedDescription,
-            visible: visible ? "true" : "false", status: "saved",
-            savedMessage: copyParam("ownerProductForm.savedOffline", "Saved offline — will sync when you reconnect."),
-            savedId: localId,
-            ...afterSaved(),
-          });
-        }
-        return shape({ ...s, status: "error", error: ownerLoadError(e), savedMessage: "" });
+        // Never "saved offline": nothing replays a queued write on any platform. The cache was
+        // not touched, and the typed values stay in the form (the description in its editor) so
+        // a retry is one tap.
+        // Demo / web-preview: the record came from DEMO_PRODUCTS (marked by demoNote).
+        if (s.demoNote) return demoRefusal(s);
+        return shape({ ...s, name, price, sku, ...(s.descriptionMode === "editor" ? {} : { description }), visible: visible ? "true" : "false", status: "error", error: ownerWriteError(e), savedMessage: "" });
       }
     })()),
     remove: async (s) => {
       if (isOwnerPreviewDemo() || s.demoNote) return demoRefusal(s);
       if (!s.id) return shape({ ...s, status: "error", error: copyParam("ownerProductForm.errorNoDelete", "No product to delete."), savedMessage: "" });
-      // Optimistic local delete — the list drops the row immediately.
-      await cacheDrop(s.id);
       try {
         await deleteProduct(s.id);
-        return shape({ ...s, id: "", status: "saved", error: "", savedMessage: copyParam("ownerProductForm.deletedMessage", "Product deleted."), savedId: "" });
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          if (s.demoNote) return demoRefusal(s);
-          await queueWrite("tier5.himiOwnerLiteProductForm.remove", { id: s.id });
-          return shape({ ...s, id: "", status: "saved", error: "", savedMessage: copyParam("ownerProductForm.deletedOffline", "Deleted offline — will sync when you reconnect."), savedId: "" });
-        }
-        return shape({ ...s, status: "error", error: ownerLoadError(e), savedMessage: "" });
+        // Nothing replays a queued delete: the row stays, and the owner is told why.
+        return shape({ ...s, status: "error", error: ownerWriteError(e), savedMessage: "" });
       }
+      // Only a delete Wix confirmed leaves the local list.
+      await cacheDrop(s.id);
+      return shape({ ...s, id: "", status: "saved", error: "", savedMessage: copyParam("ownerProductForm.deletedMessage", "Product deleted."), savedId: "" });
     },
   },
 });

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-products/index.ts

@@ -7,7 +7,7 @@
 import { compareText } from "../_shared/engine-intl.js";
 import { defineBackendCollection } from "../_shared/collection-service.js";
 import { searchStoreProducts, productImage, productPrice, plainText, type StoreProduct } from "../_shared/himi-store.js";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_PRODUCTS, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { copyParam } from "../_shared/himi-copy.js";
 import { getAll, upsert, type DbEntity } from "../_shared/owner-local-db.js";
@@ -191,7 +191,7 @@ const svc = defineBackendCollection("himiOwnerLiteProducts", {
           const items = (await readCachedRows()).filter(item => !!item.id);
           if (items.length) return { items, nextCursor: "", complete: false, metadata: { fromCache: true, demoNote: "" } };
         }
-        if (!cursor && isBridgeUnavailable(error)) return demoPage();
+        if (!cursor && ownerDemoFallback(error)) return demoPage();
         throw error;
       }
     },