Sales survive the outage
The customer paid and walked out with the box, so the record has to exist. A sale rung with the network down is held locally, with the id it was rung under and the minute it happened. Replay is a plain retry — idempotent, so a timeout that lands after the server already committed cannot bill twice — and it books into the hour it was sold, not the hour it synced.
