Document authoritative database routing

agent.md

@@ -10,6 +10,7 @@ This project replaces the Excel/VBA workflow named `Catalog maker - 20` with a N
 - Local DB may later allow controlled writes, but writes must remain explicit, logged and protected by transaction/dry-run settings.
 - Never print, commit or share endpoint tokens, usernames or passwords.
 - Never use Live DB as a fallback when Local DB is selected. If Local DB is unavailable, show an error and keep the UI running.
+- The selected database mode is authoritative for every database call. When `Local 9bplus DB` is selected, manufacturers, languages, products, combinations, mapping, source configuration and all other catalog reads must use the local MariaDB connection; no endpoint or Live DB call is allowed. When `Live 9bplus DB` is selected, every catalog call must use the existing endpoint and remain read-only. Do not mix sources within one workflow.
 - Keep the development server on port `3404` unless the user explicitly requests another port.
 - Do not delete or revert user files or unrelated changes.
 
@@ -77,7 +78,7 @@ This project replaces the Excel/VBA workflow named `Catalog maker - 20` with a N
 - Open `http://127.0.0.1:3404/`.
 - The current server is `src/server.ts`, run through `tsx`.
 - Configuration is loaded from `config/local.json`, merged over `config/local.example.json`.
-- `.env` exists for local MariaDB notes, but the application does not yet load `.env` automatically. Do not assume `.env` is active until configuration loading is explicitly wired to it.
+- `.env` is loaded automatically by `src/config.ts` for local MariaDB settings. Never expose its values. The explicit local write capability flag is `DB_LOCAL_ALLOW_WRITES`; it never enables Live DB writes.
 
 ## Database architecture
 
@@ -117,8 +118,10 @@ There are three selectable data sources:
 
 - The UI has `Local 9bplus DB`, `Live 9bplus DB` and `Local scrape DB` settings.
 - The UI sends the selected mode using the `X-Database-Mode` request header.
+- The backend must resolve that header before every API database operation and route the complete request through the selected source. A Local DB request must use `queryMariaDb`; a Live DB request must use `queryEndpoint`; there is no silent fallback or mixed-source response.
 - Backend data API routes reject a Local DB request when MariaDB is not configured instead of silently using the endpoint.
 - Backend data API routes reject a Live DB request when the project is configured only for MariaDB.
+- Mapping endpoints follow the same rule as product endpoints and must read mapping tables from the selected database.
 - Static HTML/CSS/JS files must remain available even when a database is not configured.
 - The top status shows the selected source, connection state, permissions and execution mode.
 - Selecting Live 9bplus DB or Local scrape DB disables catalog write permissions in the UI.