CW-025 · Harden offline punch capture

Priority P1 · Area attendance · security · Estimate M · Phase 2

The server credits the instant a punch was captured, which is right — someone in a warehouse with no signal should not lose the time. But punch_queue.dart keeps that queue in SharedPreferences, which the owner of a rooted device can edit, so arrival times are forgeable.

Meanwhile the API accepts dto.isRootedDevice and the app never sends it: there is no root-detection dependency in pubspec.yaml, so ROOTED_DEVICE can never be raised.

Scope

• Move the queue to flutter_secure_storage, which tokens already use.
• Detect and send rooted/jailbroken status so the flag the backend is waiting for actually fires.
• A configurable ceiling — 12 hours as the starting value — beyond which a queued punch is flagged for a manager to confirm. The real number comes from the pilot's flag rate; 12 is a placeholder, not a decision.
• Confirmation runs through the existing approval engine, with only two outcomes: acknowledge, or reject the flag. It must never create or delete a punch: attendance_punches is append-only at the database level and that property is load-bearing.

Acceptance

• A punch replayed 14 hours late is accepted, flagged, and appears in a manager's queue.
• Confirming or rejecting writes no new punch and deletes none.
• A rooted device produces ROOTED_DEVICE end to end.

Files mobile/lib/features/attendance/data/, backend/src/modules/attendance/, backend/src/modules/approvals/

Tracked in docs/backlog.md.

Start with mobile/lib/features/attendance/data/punch_queue.dart and the existing secure token storage, then trace the attendance API DTO and the approval engine in backend/src/modules/attendance/ and backend/src/modules/approvals/. Done means delayed punches can be flagged and queued for managers, rooted-device status reaches the backend, and approval outcomes create or delete no punches.