Alcove a Craftpine practice
520 Barton · an unattended-retail feasibility study6 min

06
The platform build

While the retail question was being researched, the software it would need was built by one principal over 76 days and tested to destruction.

The platform is a production-grade payments and inventory system: 173 commits from April 30 to July 14, 2026; 57 API route handlers; 20 database tables, every one carrying row-level security; 48 schema migrations; 44 automated regression suites.1 It ships four ways to move money: a code-confirmed shopper checkout, a cash and external-card walk-in register, tap-to-pay through a card processor’s terminal rails, and an unattended charge-on-exit loop for a store with nobody in it.

Seventy-six days of commits, one principal.
Fig. 6.1Commit cadence across the program. The bursts are build days; the quiet weeks are when the strategy questions of chapters 02 to 05 were being worked instead.git history of the platform repository, counted per author date through the close-out commit.

Money state machines, built for missing webhooks

The design assumption throughout: the network is unreliable and event delivery is optional. Every money mutation takes a mandatory idempotency key through a reserve-then-complete envelope; every webhook is deduplicated by event identity; and a reconciliation job converges any stuck payment or refund against the processor’s truth through the same idempotent operations, so webhook delivery is a latency optimization rather than a correctness dependency. Refunds on the terminal path are two-phase and confirmed by event, with an atomic claim so two concurrent refund attempts cannot both fire.

That posture was then attacked on purpose. Nineteen adversarial scenarios, 71 checks: oversell races, idempotency storms, duplicate-webhook floods, cron-versus-webhook finalize races, decline storms with inventory restore, out-of-order refund events, reconciliation cap saturation. All nineteen held. The destruction pass surfaced exactly one real defect, an idempotency key that leaked across two transactions; it was fixed and the pass re-run clean.2

Nineteen adversarial scenarios against the money loop; all held.
#ScenarioSuiteResult
AOversell racelocal concurrencyheld
BIdempotency stormlocal concurrencyheld
CRate-limit burstlocal concurrencyheld
DConcurrent refundlocal concurrencyheld
ECheckout key stormlocal concurrencyheld
FRefund-initiate stormlive payment railsheld
GCron ∥ webhook racelive payment railsheld
HDuplicate webhookslive payment railsheld
IPersist-race adoptlive payment railsheld
JDecline stormlive payment railsheld
KWebhook-drop convergelive payment railsheld
LCron-only backstoplive payment railsheld
MRate-limit isolationlive payment railsheld
NReconcile caplive payment railsheld
OCross-path collisionlive payment railsheld
PPending refund arclive payment railsheld
QOut-of-order eventslive payment railsheld
RTwo-cron racelive payment railsheld
SKey reuse across transactionslive payment railsheld · found the one real defect (fixed, re-run clean)
Fig. 6.2The chaos record. Scenario S found the run’s one real defect.The platform's chaos suites: 23 local concurrency checks; 48 checks against live test-mode payment rails, June 2026.

The live transaction

The loop was proven with money. A physical bench unit, a single-board computer driving a real lock behind a small touchscreen, rang up a live $1.99 purchase by phone wallet against production infrastructure on July 9, 2026: charged on the practice’s own merchant account and receipted with no personal data, then refunded by hand from the processor’s dashboard. The refund exposed a gap the program recorded rather than closed: nothing ingests a dashboard-initiated refund, so the platform’s own ledger still reads the sale as succeeded.3

The bench kiosk, mid-transaction, on its own screen.
Kiosk touchscreen showing a six-item shelf grid with prices and a Pay bar reading $0.00Kiosk touchscreen with one instant noodle cup in the cart totalling $1.99Kiosk touchscreen showing a QR code and the words scan to pay $1.99
Fig. 6.3The unattended storefront as the bench unit’s 800 by 480 touchscreen renders it: the shelf grid at idle, a $1.99 cart, and the handoff to the shopper’s phone. Captured from the physical bench unit, July 2026, running against test rails.Screen captures from the bench unit's own display, July 15, 2026.
The unit those screens run on, from a few angles.
The Alcove bench unit on a workbench, its touchscreen showing checkout: total $6.50 with a scan-to-pay QR beside a contactless tap-to-pay symbol.The bench unit showing the fresh-drink order menu, a grid of drink options under a Tap to order heading.The bench unit's checkout screen seen from the side, the scan-to-pay and tap-to-pay tiles at an angle.
Fig. 6.4The physical bench unit on the workbench: a single-board computer behind an 800 by 480 touchscreen, driving a real lock. Left to right: checkout, with a contactless “tap to pay” beside the phone-handoff QR; the shelf grid; and the same screen from the side. On the fresh-drink catalogue chapters 05 and 07 model.Photographed on the bench, July 2026; demo configuration.
The shopper’s side of the same dollar.
Phone checkout page reading Pay to finish up, $1.99, this charges your card only for what you took, with card and wallet optionsPublic receipt showing one Alcove instant noodle cup for $1.99, unattended checkout, July 9 2026
Fig. 6.5Left: the phone checkout the kiosk’s QR opens, backed by the payment processor’s own elements; on a real phone the wallet sheet sits above the card form. Right: the public receipt of the actual July 9 live purchase, one instant noodle cup, $1.99, no personal data on it.Phone checkout: capture of the live surface, test rails, July 15, 2026. Receipt: the production receipt of the July 9, 2026 live transaction, as publicly served.

The edge experiment

A parallel spike asked whether store intelligence could live in the store. On a $250-class edge computer with 8 GB of memory, a 3-billion-parameter language model and a speech-to-text model run co-resident; voice commands in the common case complete end to end in about 2.6 seconds, under the program’s 4-second bar.4 Two software levers did the work: a deterministic fast path that skips the model entirely for unambiguous commands, and grammar-constrained decoding against an indexed stock list, which cut the model’s proposal latency from 8.8 to 2.9 seconds.4 The edge device never holds payment authority; the cloud stays the ledger of record.

The $250 box: an NVIDIA edge module, on the bench.
An NVIDIA-branded heatsink and fan on a Jetson-class edge computer, the NVIDIA wordmark legible, wired up on a workbench beside the board.
Fig. 6.6The edge computer the voice spike ran on: an NVIDIA Jetson-class module, the language and speech models co-resident under the heatsink, beside the single-board computer driving the slab. On-device intelligence; the cloud keeps payment authority.Edge hardware spike, photographed July 2026.
Voice on a $250 box: 8.8 seconds cut to 2.6, under the 4-second bar, with software alone.
Fig. 6.7The latency levers. Mandarin lands around 3.7 seconds; Tamil, at roughly 5.9, is the documented miss.Edge hardware spike, June 2026, measured on-device; per-language results as recorded, including the documented Tamil miss.

The platform, the money state machines, the chaos suites, and the edge pattern are assets of the practice, independent of any particular corner.

Notes

  1. Counts audited at the program’s close-out commit, 2026-07-14: commits, route handlers, tables with row-level security, migrations, and regression suites counted directly from the repository tree and git history.
  2. Chaos suites: 23 checks across five local concurrency scenarios; 48 checks across fourteen adversarial scenarios against live test-mode payment rails, all fourteen held, one defect found (cross-transaction idempotency-key leak), fixed and re-verified, June 2026.
  3. Live-mode verification, 2026-07-09: $1.99 wallet purchase on the bench unit against production, charged and subsequently refunded on the practice’s own merchant account.
  4. Edge spike, June 3–9, 2026, on an 8 GB Jetson-class single-board computer: 3B-parameter instruct model plus whisper-class speech-to-text co-resident; English end-to-end voice ~2.6 s, Mandarin ~3.7 s, Tamil ~5.9 s (the documented miss); grammar-constrained decode 8.8 s → 2.9 s.