A shop with four tills has four computers that all believe they are the shop. Most point-of-sale systems solve that with a server in the back room, which works right up until the back room's power strip does not.
What each terminal owns#
The model is one line long: a terminal owns the sales it rings up, and nothing else. Everything else is either read-only replication or a single-writer resource. That constraint is what keeps the merge logic small enough to reason about at closing time.
| Data | Owner | On conflict |
|---|---|---|
| Sales, refunds | the terminal that made it | never conflicts — append only |
| Product catalogue | the back office | last write wins, by version |
| Prices | the back office | last write wins, by version |
| Stock level | one elected terminal | not merged — see below |
| Open tab / table | claimed by one terminal | claim is a lease, 30s |
Stock is not a CRDT#
You can absolutely model stock as a counter that converges. It will converge on a number that was never true at any moment, and the shop will have sold two of the last one. So stock has a single writer: one terminal is elected, the others ask it, and if it disappears the next one takes over after a short lease expires.
- 01Election
The terminal with the lowest identifier that has been seen in the last ten seconds holds the stock lease. No consensus algorithm — the set is four devices on one LAN, and a wrong election costs one lease period.
- 02Decrement on sale
The selling terminal asks the holder to decrement. If it cannot reach it within 400ms it sells anyway and marks the line unverified — a shop that stops selling because a peer is slow is worse than a count that needs reconciling.
- 03Reconcile at close
Unverified lines are replayed against the authoritative count at closing. In eight months of pilots, that list has averaged under two lines a day per shop.
What it looks like on the counter#
None of the above is visible during a normal day, which is the entire point. The only surface the model gets is a small state dot: green when the terminal has seen every peer recently, amber when it is selling unverified lines, and a count of what still has to reconcile.