Money without floating point
Every amount is a Decimal in the core and integer cents in the frontend. A property-based suite plus 1:1 Rust↔TS contract tests keep both implementations identical; float arithmetic is banned by rule and by test.
Context
Retail shops in Venezuela run on modest Windows PCs with unreliable connectivity. Prices are anchored in USD while customers pay in bolivars at the official BCV rate, which changes daily. Software that assumes a server, an internet connection or a subscription is not an option: the shop must keep selling when the network is down, and the data must stay on the shop's machine.
- Offline-first: no cloud, no server, no web panel, no telemetry.
- Exact money: multi-currency (USD/VES) with zero floating point.
- Own the data: local database, verifiable backups, restore is sacred.
- Small and light: a 3.1 MB installer that runs on entry-level hardware.
Architecture
Three layers with one deliberate boundary: the interface never touches storage directly.
Frontend SPATypeScript · Vite · Tailwind
Tauri IPCin-process, no network
datiolabs-coreRust domain engine
Sledembedded DB · SHA-256 signed
- No network services: all communication is Tauri IPC inside the machine.
- All money and stock math happens in Rust (rust_decimal); the UI mirrors it with integer cents so both sides agree cent by cent.
- 15 persistence trees; backups carry header, trees, metadata and a SHA-256 checksum; a backup from any previous version restores in the current one.
Engineering decisions
A schema you cannot break
Records are stored with positional bincode. Adding, removing or reordering a field would corrupt every existing client database, so persisted structs are frozen and new features get new trees. Backups stay cross-version by construction.
Inventory as an atomic ledger
Stock changes only through movements. Perishables rotate FEFO; packaging (packs, boxes, fractions) discounts stock atomically; oversell is rejected and five concurrent sales leave the stock exact.
One binary, several verticals
Business types and features are encoded as u16 bitmasks: grocery, bakery, liquor and retail capabilities combine in a single build with no forked UI.
The exchange rate, offline
A BCV scraper keeps the official rate fresh, freezes it per transaction line, and falls back to a cached value when there is no connectivity. Manual mode is sticky and always wins.
Licensing and audit you can verify
License keys are validated by exact match against a canonical list mirrored in four places with checksums; a forged key stops the app. Operations are signed (SHA-256) and annulments keep a dedicated ledger.
Verification
Three layers, from unit tests to a remote harness that clicks the real desktop application.
L1 Unit & contract
64 Rust tests in the core plus 5 in the desktop shell, and 96 frontend tests across 9 suites. The frontend/backend money contract is enforced by 1:1 contract tests. Rust core coverage: 95.15% of lines (92.59% of functions, 91.13% of regions, measured with cargo-llvm-cov).
L2 Property & fuzz
proptest in Rust and fast-check in TypeScript attack the money and inventory invariants with randomized cases; two cargo-fuzz targets (full_system_fuzz, ingest_fuzz) fuzz the domain and the rate ingestion paths.
L3 Real E2E over CDP
No mocks: a test build of the Tauri app exposes the Chrome DevTools Protocol and Playwright-core drives real clicks on the real WebView2. The harness runs from a Linux workstation over SSH/SCP against a Windows Server, with an isolated APPDATA and a scheduled interactive task. The test binary and the debug flag never reach the installer — verified in the final artifact.
Linux workstation
-- scp/ssh -->
Windows Server
-- CDP :9222 -->
Real Tauri app (WebView2)
- Every Tauri command (69/69) has at least a happy path and an adverse path.
- Forged license rejected: the app refuses to operate (scenario A4).
- Double-click on CHARGE creates exactly one sale (idempotency by UUID).
- Five concurrent sales keep stock exact; oversell is rejected.
- Midnight crossing (VET) and all 8 shift guards verified.
- Unicode/XSS payloads in labels and notes are inert.
- Upgrade over an installed version preserves data with 0 hash differences.
- Final installer contains no debug flag and no debug port.
By the numbers
| Rust core tests | 64 all green |
|---|---|
| Desktop shell tests (Windows) | 5 |
| Frontend tests | 96 · 9 suites · 7.3 s |
| Rust core line coverage | 95.15% |
| E2E scenarios | 107 · matrices A–N |
| E2E scripts (CDP + Playwright) | 27 |
| Tauri command coverage | 69 / 69 |
| Persistence trees | 15 |
| Signed installer | 3,256,020 bytes · 3.1 MB |
| E2E test binary (never shipped) | 10,462,208 bytes · 10.0 MB |
| Source size | Rust 7,254 LOC · TypeScript 13,932 LOC (+2,134 tests) |
Method: measured on 2026-09-30 — cargo test (core and shell), vitest run, cargo llvm-cov -p datiolabs-core, artifact sizes, scenario counting from e2e/ESCENARIOS.md. Only numbers that can be reproduced with a documented command are published.
The product
Real screenshots of the running application (web demo, mock backend).
Status
Phases 1–4 are implemented, verified and packaged (2026-09-19): product, offline rate, multi-vertical capabilities and the verification stack. The desktop application is licensed and distributed directly; this page is the engineering view, not the storefront.