fix(AWAN-149): show local data first and never keep deleted data

[mSaayeh]

What & Why

A zone edited in the profile screen never appeared on Home until the user changed the day. That has two independent causes, and both are instances of a wider gap: AWAN-205 declared Room the single read model, but the implementation only carried it through for sessions and the profile.

1. Zone mutations never reached Room. All 12 of them called the network and returned — yet getZonesForDate, getEffectiveZones and Home all read Room. Profile looked correct only because it reads the network straight into in-memory state.
2. Home's Flow could not see zones anyway. getDaySchedule mapped over the sessions Flow and resolved zones with suspend one-shots inside the map, so Room invalidated it for the sessions table alone. Changing the day — which builds a new Flow — was the only thing that re-read zones.

The deletion half was systemic: of five sync functions only syncScheduleRange removed anything, so a template, override, zone, goal or category deleted on another device never disappeared here.

This PR fixes the reported bug, applies the rule to the zones and Home verticals, and writes the rule into CLAUDE.md so it is reviewable rather than remembered.

Key Changes

• ZoneDao.observeEffectiveZonesForDate — one query whose subqueries span zones, template_overrides and template_days_of_week, so Room's invalidation tracker covers all three. Home now combines it with the sessions Flow; the duplicated resolution logic in ZonesRepositoryImpl collapses into it.
• ZonesLocalDataSource.replaceAll — the only writer of the four zone tables. Deletes templates and overrides first (zones and day rows CASCADE), so nothing removed elsewhere survives a refresh.
• All 12 zone mutations end in refreshZones() — one shared refresh rather than 12 write-throughs, and the only version where the three delete* mutations are correct with no extra code.
• syncZonesAndTemplates returns false when either GET fails — it previously returned success unconditionally and could write half a replace.
• Refresh on screen open — Home refreshes zones and the visible day on open and on date change, forced past the TTL. Days outside the background sync's week were never fetched at all before.
• Home's local writes — deleteSession, deleteTask, updateTaskDetails and updateSessionLock now land in Room, and got the connectivity guard all four lacked.
• Account data isolation — every table is cleared on logout and when a different account signs in. Room is keyed by server ids alone, so the previous account's rows read back as the new one's; that was producing 404 CATEGORY_NOT_FOUND on zone writes.
• AWAN-125 restore — the zone categoryId wiring the AWAN-205 merge dropped from OnboardingRepositoryImpl and ZonesRepositoryImpl is back, and the guard test that had been edited to pass against the broken version now exercises it again.
• Categories refill from the network when Room is empty — onboarding needs them before SyncWorker has run, and skipping the setup used to outrun the fetch.
• v1/goals/inbox decodes into bare tasks instead of {task, sessions} pairs.
• Offset-free timestamps are parsed. extractTimeFromIso tried OffsetDateTime then LocalTime; the API sends neither ("2026-08-09T14:30:00"), so every caller silently kept its fallback — which in cacheSession is the session's existing time. Moving a session rewrote it with the time it already had: the card snapped back and Room never changed. The sync path hid this because SessionDto.toEntity uses substring, so the read and write paths disagreed about the same field.
• A session moved past midnight updates its date, instead of keeping the old day's row and vanishing from both.
• HomeLocalDataSource owns every Room read and write for Home; HomeRepositoryImpl holds no DAOs. The repository test went from five DAO fakes to one.
• CLAUDE.md gains the offline-first contract (four method shapes, replace-never-merge, provable scope, one local data source per table group) with a three-grep review checklist. Traps for the deferred tables are recorded in docs/feature/offline-first/2026-08-09-replace-on-refresh.md.

Related

AWAN-149. Extends docs/feature/offline-first/2026-08-06-offline-first-ssot-plan.md (AWAN-205) and restores work from AWAN-125.

Testing

./gradlew assembleDebug testDebugUnitTest lint --rerun-tasks   # green
./gradlew connectedDebugAndroidTest                            # NOT run — needs a device

New coverage:

• ZoneDaoTest — override-over-template resolution, and the load-bearing one: a single live subscription re-emits after a zone edit, a day reassignment, and a new override. This is the assumption the whole design rests on and it has not been executed yet (needs a device).
• TemplateDaoTest — deleteAllTemplates cascades days and template zones while leaving override zones intact.
• ZonesRepositoryImplTest — parameterised over all 12 mutations: each writes to Room exactly once, a failed one writes nothing, offline returns AppError.Network without touching the network.
• HomeRepositoryImplTest — getDaySchedule re-emits when only the zones change (the regression test for the reported bug).
• OfflineSyncCoordinatorTest — syncZonesAndTemplates writes nothing and returns false when either call fails.
• IsoTimeUtilsTest — offset-free, zoned, time-only, fractional and unparseable inputs.
• HomeLocalDataSourceTest — a moved session stores its new times (verified failing against the old parser), a cross-midnight move changes the date, a status-less response keeps the stored status, an uncached row reports it wrote nothing, and deleting a task clears its dependencies.

On a device: edit a zone in profile → Home updates without a day change; delete a template on one device → it is gone on the other rather than merged back; airplane mode → everything still renders from cache and writes report the network error; install over an existing build → data survives.

Notes for Reviewers

• No entity changes, so no migration and no version bump. fallbackToDestructiveMigration(dropAllTables = true) is armed, so this deliberately touches only queries and repository code.
• Two one-method interfaces were added for testability, not speculatively: ScheduleSynchronizer (so a repository depends on one coordinator method rather than its fifteen data sources) and LocalDataCleaner (AwanDatabase is an abstract Room class a JVM test cannot construct, and the project has no mocking library).
• Categories, goals and tasks are deliberately not migrated. Two of them fail badly if fixed the obvious way: tasks.categoryId is a NO_ACTION FK so deleteAllCategories() throws a constraint error, and listGoals is page 0 with includeInbox = false — replacing from it deletes the user's Inbox goal. Both are written up in the feature doc.
• Users will need one logout/login or reinstall to clear rows already cached from another account.
• Only Home and zones have a local data source so far. TaskRepositoryImpl, AiTaskRepositoryImpl, TemplateRepositoryImpl, GoalRepositoryImpl, CategoryRepositoryImpl, ProfileRepositoryImpl, OnboardingRepositoryImpl and InventoryRepositoryImpl still inject DAOs directly, and OfflineSyncCoordinator still holds seven. Until it calls the per-feature local sources instead, the "zero upsert in the coordinator" grep in CLAUDE.md is aspirational rather than true.