A local-first point of sale, written in Rust

Every amount in the core is a Decimal, and it travels as text, not as a binary float — sale signatures hash Decimal::to_string(), so a SHA-256 stays reproducible across platforms and versions. A malformed amount never becomes a silent zero: the backend has exactly one parser, and it fails loudly.

pub fn total_bs(&self) -> Decimal {
    self.cantidades
        .iter()
        .zip(self.precios_usd.iter())
        .zip(self.tasas_bloqueadas.iter())
        .fold(Decimal::ZERO, |acc, ((q, p), t)| acc + *q * *p * *t)
}

fn decimal_de(texto: &str) -> Result<Decimal, UIError> {
    Decimal::from_str(texto.trim().replace(',', ".").as_str())
        .map_err(|_| UIError::new("monto invalido", "Se esperaba un numero decimal"))
}

Settlement sums per line with each line's locked rate, so one ticket can mix rates and still reconcile to the cent. The TypeScript side mirrors it with integer cents (Money.toCents, sum, usdToBsCents), and property tests assert exact sums and ≤1-cent reversibility.

The embedded store gives no multi-tree ACID, so inventory doesn't pretend otherwise: one writer at a time (con_ledger on a global Mutex<Ledger>), validate before write, an append-only movements ledger, and flush() as the durability point.

pub fn aplicar_movimiento(
    &self,
    mut movimiento: MovimientoStock,
    delta_catalogo: impl FnOnce(&str, Decimal),
) -> Result<MovimientoStock, DbError> {
    // stock + delta < 0 is rejected here, before anything is written
}

fn clave_cronologica(fecha_unix: i64, id: &[u8]) -> Vec<u8> {
    let mut clave = Vec::with_capacity(8 + id.len());
    clave.extend_from_slice(&(fecha_unix as u64).to_be_bytes());
    clave.extend_from_slice(id);
    clave
}

Movements are keyed chronologically, so iter().rev() is recency order without sorting. IDs and names are fixed-size, zero-heap types (struct Sku([u8; 32], u8)), so scans don't allocate.

Perishables consume from lots in expiry order, and the reverse path puts units back into the nearest valid lot. Packaging is not a second inventory: "2 boxes" is converted to base units once, by a single conversion shared by the preview and the charge.

pub fn descontar_fefo(
    &mut self,
    sku: &str,
    mut cantidad: Decimal,
    ahora_unix: i64,
) -> Result<Vec<(String, Decimal)>, ErrorNegocio> {
    let mut tocados = Vec::new();
    while cantidad > Decimal::ZERO {
        // take from the next valid lot, record (lote, cantidad)
    }
}

fn resolver_precio_presentacion(catalogo: &Catalogo, idx: usize, modo: &str) -> (Decimal, u32)

resolver_precio_presentacion is the only place that decides price and factor, and construir_lineas_venta is the only line factory — shared by previsualizar_cobro and registrar_venta. What the screen confirms is exactly what gets written.

Records use positional bincode: adding, removing or reordering a field would corrupt every installed client. Persisted structs are therefore frozen, new features go to new trees, and backups are versioned and checksummed end to end.

pub struct BackupMetadata {
    pub version: u32,
    pub timestamp_unix: i64,
    pub arboles: Vec<String>,
    pub total_registros: usize,
    pub checksum_sha256: String,
}

fn importar_backup(&self, ruta, licencia_esperada) -> Result<(), DbError> {
    // SHA-256 and the embedded license are verified before anything is written
}

A fixture from the client's installed build is imported in CI and byte-compared against HEAD (compat_backup_cliente.rs). Restoring also clears trees that an older backup didn't have, so no residue survives.

A real bug motivated this: the UI called eliminar_consumo with an extra cantidad argument, Tauri silently ignores unknown arguments, and removing one unit deleted the whole line. The fix was structural — an audit that parses #[tauri::command] signatures and every invocar() call.

GUARDAS_ESPERADAS = {
    "abonar_cuenta", "abrir_cuenta", "agregar_consumo", "cerrar_cuenta",
    "editar_abono_cuenta", "eliminar_consumo", "eliminar_venta", "registrar_venta",
}

# plus: every command registered, no unknown keys sent,
# no required argument missing, 10 license keys mirrored Rust<->TS

The audit asserts that the shift guard appears in exactly these eight commands — add a ninth without updating the audit, and CI fails.

The UI sends a heartbeat every 5 seconds; the shell stores it in an AtomicI64, and a watchdog thread reloads the window if it goes quiet for 30 seconds — with a 120-second cooldown so it cannot loop.

std::thread::spawn(move || loop {
    std::thread::sleep(Duration::from_secs(10));
    let visto = ultimo.load(Ordering::Relaxed);
    if visto > 0 && ahora - visto > 30 && ahora - ultimo_reload > 120 {
        if let Some(ventana) = handle.get_webview_window("main") {
            let _ = ventana.reload();
        }
        ultimo.store(ahora, Ordering::Relaxed);
        ultimo_reload = ahora;
    }
});

The E2E suite validates it by freezing the renderer for 45 seconds and asserting the window comes back. The same discipline applies to state: the manual exchange rate is re-checked inside the same write lock that refreshes from BCV, so a stale scrape can never overwrite an operator's decision.

The BCV (Banco Central de Venezuela) publishes the rate as an HTML page, not an API. The shell fetches it hourly with a 30-second timeout, selects the USD box, normalizes the number (1.234,56 and 36,92 both parse), rejects zero and out-of-range values, and writes a signed rate event plus a cache. If the page changes or the network fails, the last rate stays. A manual rate set by the operator wins until they explicitly return to BCV, and the decision is re-checked under the same write lock as the write, so a scrape in flight cannot overwrite it. A missing rate blocks the sale instead of becoming zero.

async fn scrapear_bcv(cliente: &reqwest::Client) -> Result<Decimal, UIError> {
    let html = cliente.get(URL_BCV).send().await?.error_for_status()?.text().await?;
    extraer_valor_usd(&html).ok_or(UIError { /* keep the last rate */ })
}

// "1.234,56" and "36,92" both parse; zero and out-of-range are rejected
fn normalizar_valor_bcv(texto: &str) -> Option<Decimal>

It is a small pipeline, not a data platform: one source, one value, hourly. The engineering is in the failure contract: untrusted HTML, validation, fallback, operator override and a signed history. Six tests cover USD vs EUR, number formats, manual stickiness and the cache.