design(startup): older app opening a newer database (downgrade flow) #1341

Parent: #830 (S6). state: needs decision. The maintainer deferred this on 23 Oct; logged here so it is not lost. Verified against main @ 8e39053.

Problem

A user who installs a newer FloCafe and then goes back to an older build (Bankim, 8 Sep) gets a startup error, and the app quits with no way forward.

Current behavior (verified)

• runMigrations throws SchemaVersionMismatchError when the DB schema is newer than the app (main/db.ts ~L7816-7839). The message says "Please update Flo Cafe to the latest version before continuing."
• main/index.ts (~L1660-1680) treats it as a generic startup failure: dialog.showErrorBox('Initialization Error', ...), then exit.
• A pre-migration backup is written automatically before each upgrade (main/db.ts ~L7765-7793, L7848), but nothing points the user to it.
• Restoring a newer backup into an older app is rejected in direct mode (tests/backup-restore-production.test.ts ~L585-602).
• autoUpdater.allowDowngrade is beta-only (main/index.ts ~L220).

Options to decide

1. Recommended: a dedicated dialog for SchemaVersionMismatchError with three choices.
   • "Get latest version" (default).
   • "Open backups folder".
   • "Restore pre-upgrade backup". This asks for confirmation, warns that data entered since the upgrade is lost, and moves the newer DB aside instead of deleting it.
2. Better message plus docs only (per-OS data and backup paths on docs.flopos.com), with no in-app restore.
3. Do nothing. A downgrade is unsupported, and only the docs say so.

If option 1 is chosen

• Branch on SchemaVersionMismatchError in main/index.ts before the generic error box.
• List pre-upgrade backups with app and schema version from _flo_meta (helpers around main/db.ts ~L2350-2390). Restore only backups whose schema is at most the app's schema.
• Never delete the newer DB. Move it to a timestamped file next to it.
• Tests next to tests/startup-failure-child.cjs and tests/backup-restore-production.test.ts.

Acceptance (once decided)

• The older app opening a newer DB shows the chosen flow, never a raw "Initialization Error".
• No data file is deleted by any choice.