Complete K-food deliveries while preserving two-hour return navigation

[OziinG]

K-food routes stayed active after delivery work finished, and return-to-store navigation on the final Arrived stop did not send a delivery event. This change resolves that final stop on an authenticated return intent, shows delivery work Complete immediately in server/Shopify reads, and preserves return navigation in existing mobile apps for two hours.

• Completion requires the current assignment, exact child snapshot, order ownership and terminal stops. Return intent resolves only a sole final Arrived stop when every earlier stop is terminal. Driver, admin and order bulk transitions also reconcile completion; corrections and child replacement invalidate it.
• Released apps 1.3.3/39 and 1.3.4/40 receive a command context with a valid immutable policy and null stop coordinates. Local GPS visit detection produces no candidates, and the server rejects inference commands for this context. Orders derives Delivered from the updated delivery stop.
• GPS and notes remain available during the fixed grace. Completion commands receive idempotent deferred acknowledgements. Lookup/token access expires at two hours; My Routes removes the route on refresh/reconnection. The existing worker finalizes raw status after expiry, on its 15-minute scan. Retries do not extend the deadline.
• The migration adds four nullable columns without historical backfill. Legacy rollback stops the candidate, requires zero incompatible completion acknowledgements, durably backs up and conditionally clears markers, then audits preserved route/stop state. An existing deferred acknowledgement requires a compatible image or forward fix.

Validation: Prisma generation, full lint/typecheck/build and 3,049 passing tests, including 39 PostgreSQL contracts; 189 unrelated opt-in tests skipped. Released-app reducers were executed with the command context. Real PostgreSQL rollback and backup-failure checks passed. A fresh production backup was restored, migrated twice and checked for zero schema drift. Independent review found no remaining blockers. Exact PR CI and merged main CI passed.

Production deployment completed at 2026-10-02T14:56Z, exact revision 90827faf60133e7df3b53779d1c2dc8acd286f8f.

• Image preparation and deployment dry-run passed. Production application used the reviewed simple SSM wrapper at that exact revision, command 7a5bf019-f11a-4245-8dcc-7933eb4f1804, Success/0.
• API digest: sha256:b2144fd675f23014646d810f4210eafa6f97a6afb8df7fdbeb84d9c2f2e8a26d; migration digest: sha256:6a6935aaf294e2f6455187156f19b8e166d6b0480ee08f66d58a2947904bdebd. Web static digest remained sha256:3363abce063d02988137ffe812393ebff73afdd14ab40a4b10c9264b1bdd0b38.
• Migration 20261002140000_kfood_delivery_navigation_grace applied successfully. Ownership audit found zero invalid associations. Both public health endpoints passed; the exact API and PostgreSQL containers are healthy with zero restarts after startup. The standard migration lane recreated PostgreSQL before API replacement; authenticated postchecks passed afterward.
• Both active K-food accounts returned HTTP 200 for profile, route lookup and completion assistance. Each received kfood_return_intent_only_v1 with all coordinates null and zero candidates. Existing delivery counts remained unchanged, the stale finalization worker remained enabled, and location inference remained disabled. Post-start logs contained only informational JSON levels and no fatal/unhandled error lines in the observed window.
• Authenticated Shopify Routes refresh rendered normally: North remained Completed and today's unfinished routes remained In progress. North was repaired separately before deployment; its screen is regression evidence, not proof of this new completion transition.
• A connected Galaxy SM-N981N has released 1.3.3/39 and displays the login screen. No authenticated physical-device last-stop or elapsed two-hour screen test was performed; the new transition and expiry are covered by database/API contracts and released-client reducer execution.

No mobile or Shopify source release. The private backup and restore proof are retained outside Git; no production delivery outcomes were fabricated for verification.