A billing doubt lets the kitchen through
Every access decision in the platform refuses by default. The one deciding which features a restaurant has paid for does the opposite: an unassigned plan, an inactive plan or a malformed record all allow everything. Wrongly allowing a feature costs the business a little revenue until somebody notices. Wrongly denying one locks a paying restaurant out of its own menu in the middle of service.
src/lib/entitlement-rules.ts
Marketing goes out on the restaurant's own number
The first version sent campaigns from a shared platform number. He overruled it: promotional messages leave on the same WhatsApp number that carries the restaurant's order confirmations. The customer recognises the sender, and a number that earns a ban suffers it alone instead of taking every other restaurant's marketing down with it. What separates the two lanes is the queue and the pacing, never the phone number.
src/lib/marketing-drain.ts
A promotion can never delay an order ticket
Transactional messages and marketing travel in queues that cannot merge, each claimed separately. A campaign of several hundred messages cannot put itself in front of the ticket that tells a kitchen an order has just come in.
src/lib/marketing-gate.ts
The price previewed is the price charged
The checkout preview and the real charge come from the same calculation rather than two that are meant to agree, and every price is recomputed on the server from the database — the browser's numbers are never trusted. A quote that promises one discount and then takes another is a trust problem, not a rounding problem.
src/lib/cart-pricing.ts
No card details exist anywhere in the system
Customers pay at the door, in cash or on the restaurant's own card machine. That is a deliberate choice rather than a missing feature: a system that never accepts a card number cannot lose one.
src/app/t/[tenant]/actions.ts
Nothing here carries a date it did not earn
When the community forum was first filled in, backdating the threads to look established was the obvious move and he declined it. The seeding script now refuses outright to write any date earlier than the platform's real launch day, and checks itself afterwards. Articles follow the same rule: the freshness date a reader sees moves only when the text actually changes.
scripts/seed-forum.mjs, src/lib/blog.ts
Work out the blast radius before changing anything
The engineering handbook for the platform opens with his rule, and the tooling enforces it: before a file is edited, the modules importing it and the database tables it touches are extracted from the code rather than recalled from memory. The database module alone is imported by more than two hundred others.
docs/book/_tools/map.mjs