fix(customers): durable space-mirror backup + merge so web/zalo customers (NBV2fc) survive ketoan sync clobber

- Seed the space mirror customers.json with NBV2fc (+ admin VAS6b9) — the
durable web/zalo backup the ketoan sync never touches.
- GET /api/customers now MERGES the space mirror into the read base, so live
reads always include NBV2fc even if a concurrent writer dropped it from the
dataset file.
- POST /api/customers also MERGES the space mirror into the write base, so a
web save never drops NBV2fc / other web customers.
- Root cause: bot write 'Add VAS6b9' (b91ee83) wrote back a stale base that
had lost NBV2fc (read-modify-write race with the ketoan sync CN:96). The
mirror merge self-heals any future such loss.
- No Space write-through (avoids per-save rebuild data-loss race).

customers.json

@@ -5,5 +5,12 @@
     "cid": "479b1cfad6a83ff666b9",
     "created_at": "11/08/2026 20:56",
     "ck": "Malloca 40, Eurogold 54, Grob 54, Demax 40"
+  },
+  "26b87badb2ed5bb302fc": {
+    "name": "Nhà Bếp Vuông",
+    "ma_kh": "NBV2fc",
+    "cid": "26b87badb2ed5bb302fc",
+    "created_at": "12/08/2026 07:14",
+    "ck": "Malloca 40, Eurogold 54, Grob 54, Demax 40"
   }
-}
+}

index.ts

@@ -1480,6 +1480,29 @@ const server = Bun.serve({
               }
             }
           } catch (_e) {}
+          // Merge the SPACE mirror (durable web/zalo backup, never touched by the
+          // ketoan sync) so reads always include web/zalo customers like NBV2fc
+          // even if a concurrent ketoan sync clobbered the dataset file.
+          try {
+            const mr = await fetch("https://huggingface.co/spaces/bep40/vai-avatar2/resolve/main/customers.json", {
+              headers: token ? { Authorization: "Bearer " + token } : {},
+              signal: AbortSignal.timeout(6000),
+            });
+            if (mr.ok) {
+              const sp: any = JSON.parse(await mr.text());
+              if (sp && typeof sp === "object") {
+                for (const k in sp) {
+                  const v = sp[k];
+                  if (!v || !v.cid) continue;
+                  if (data[k]) {
+                    if (!data[k].ck && v.ck) data[k].ck = v.ck;
+                  } else {
+                    data[k] = Object.assign({}, v);
+                  }
+                }
+              }
+            }
+          } catch (_e) {}
           return new Response(JSON.stringify(data), {
             headers: { "Content-Type": "application/json; charset=utf-8", "Access-Control-Allow-Origin": "*" }
           });
@@ -1539,6 +1562,31 @@ const server = Bun.serve({
               }
             }
           } catch (_e) {}
+          // Merge the SPACE mirror (bep40/vai-avatar2/customers.json — the
+          // durable web/zalo backup that the ketoan sync never touches) so a web
+          // POST never drops web/zalo customers (e.g. NBV2fc) that a concurrent
+          // ketoan sync removed from the dataset. The bot's write path already
+          // merges this mirror; this extends the same self-healing to web writes.
+          try {
+            const mr = await fetch("https://huggingface.co/spaces/bep40/vai-avatar2/resolve/main/customers.json", {
+              headers: token ? { Authorization: "Bearer " + token } : {},
+              signal: AbortSignal.timeout(6000),
+            });
+            if (mr.ok) {
+              const sp: any = JSON.parse(await mr.text());
+              if (sp && typeof sp === "object") {
+                for (const k in sp) {
+                  const v = sp[k];
+                  if (!v || !v.cid) continue;
+                  if (data[k]) {
+                    if (!data[k].ck && v.ck) data[k].ck = v.ck;
+                  } else {
+                    data[k] = Object.assign({}, v);
+                  }
+                }
+              }
+            }
+          } catch (_e) {}
 
           let changed = 0;
           candidates.forEach((c: any) => {
@@ -1571,6 +1619,12 @@ const server = Bun.serve({
           // Persist locally too so the live GET keeps reflecting the save
           // immediately (no rebuild dependency).
           try { writeFileSync(f, content); } catch (_e) {}
+          // NOTE: we do NOT write-through to the vai-avatar2 Space mirror here —
+          // committing to the Space repo triggers a rebuild on every save (the
+          // exact data-loss race we removed). Instead the mirror is seeded with
+          // the durable web/zalo backup and merged on every read/write, so it
+          // self-heals (restores customers like NBV2fc after a ketoan sync
+          // clobbers the dataset) without any rebuild.
           return Response.json({ ok: true, updated: changed, customers: data });
         } catch (e: any) {
           return Response.json({ error: e.message }, { status: 500 });