IntelliVision Merchant Operating Manual

Open auth.html in any modern browser. It shows two tabs: Create New Business and Existing Sign In, switched instantly with no page reload. A visitor who arrived by tapping a "Try the demo" link, or who was bounced off a page that requires sign-in, is shown a one-tap Open the Demo Till banner above the forms instead of being pushed straight at a password box.

One sector sign-in page names its tabs differently and behaves differently too: restaurant_auth.html shows "Sign In" and "Register New" tabs, but tapping "Register New" never reveals a local form — there isn't one on this page — it immediately redirects you to this same real auth.html signup, with the restaurant sector carried in the link. That makes it an honest shortcut rather than a broken control, just a differently-built one from the global tab switch above.

Creating your real owner login

The sign-up form is deliberately two fields — email and an 8+ character password. Submitting it calls the real registration engine: your password is hashed on your device (see PBKDF2 below), the account is written, and you are signed straight in. The moment that real login exists, the shared demo accounts are deleted from this device forever — demo mode does not coexist with a real business.

Signing up also creates your merchant tenant record — a random MERCHANT-NNNNN id, your email, ZAR as the default currency, and VAT-registered defaulting to No until the wizard asks — and hands you straight to the Setup Wizard in Step 2. Which sector page you clicked "Sign Up" from is remembered (from the link's ?industry= parameter, or failing that from the page that referred you) and pre-fills the wizard's industry step — shown on-screen as "Setting up: <Sector> — you can change this in setup" so nothing is silently decided for you.

Signing in with an existing login

Sign in with your registered email, username, or phone number, plus your password — all three identifier types are actually checked, not just email. Don't have a login yet? The "Create your owner login" link on every sector sign-in page routes to this same real signup, with your sector pre-filled in the URL.

Submitting the sign-in form calls the real authentication engine: every one of the 28 sector sign-in pages (e.g. retail_auth.html) runs the identical call — type your credentials, press Sign In, and you land in that sector's workspace. A wrong username or password shows one generic message — it never reveals which field was wrong, so a shared till doesn't leak which usernames are real. If you arrived here bounced off a protected page (the URL carries ?next=), a successful sign-in sends you straight back to that page instead of dropping you at a generic home screen.

Tick "Remember me on this device for 30 days" on your own tablet and you won't have to sign in again until the month is up; leave it unticked on a till the whole team shares. Typed the wrong email into the sign-up form and want to sign in instead? The error message under a clashing sign-up offers a "Sign in instead" link that switches tabs and carries your typed email across so you don't have to retype it.

Try before you buy: demo mode

Passwords are stored only as salted PBKDF2-SHA256 hashes (100,000 iterations), computed and verified directly on your device — the password itself is never written anywhere.

Role-based access fails closed: every page checks your session before it renders, and a role without the right capability never sees the page at all — its content is replaced, in full, by a red "Access Restricted" panel naming your role, with a single Sign out button as the only way off it. There is no partial peek and no redirect back to the till; the deny screen is the whole page.

What "manage / sell / view" actually means

Every account has exactly one role — Owner, Manager, Cashier or Staff — and every role maps to a fixed set of capabilities: Owner and Manager get manage + sell + view, Cashier gets sell + view, Staff gets view only. Which capability a page needs is decided purely by matching the filename, not by checking individual buttons on the page: anything containing _setup, _accounting, vat201, fixed_assets, multibranch, payroll, data_export or team_logins needs manage; anything containing _pos, _till, checkout or grv_receiving needs sell; everything else only needs view. Practically: a Cashier can ring sales and see dashboards, but every Setup screen, Team & Logins, payroll, VAT201, the fixed asset register, and every multi-branch page are Owner/Manager-only — including the Setup Wizard and Camera Manager covered later on this page.

Sales agents: joining the partner fleet

A "Looking to earn money as a Sales Agent?" panel sits under the sign-in and sign-up forms on the main auth.html door, linking to the real partner sign-up flow (sales_rep_signup.html) — a separate application from a merchant account. The 28 sector-branded sign-in pages do not carry this panel; reach it from the main sign-in screen.

After signup you land in master_setup_wizard.html — the one setup screen in the product that actually saves what you type. It runs four numbered steps top to bottom on one page (not a click-through wizard), followed by a launch bar and an onboarding checklist.

Step 1: Business Profile & Tax Registration

Enter your trading name and owner/director name, then answer "VAT / Tax Registered Vendor?" — choosing Yes reveals the VAT number field and makes it required; a South African number must be exactly 10 digits starting with 4, checked before launch. "Who runs the business?" — Just me / Me + staff / Multiple branches right-sizes what your dashboard shows: solo hides payroll and staff tools until you need them, and every hidden tool still appears by itself the moment reality calls for it — your first staff member surfaces payroll, your second branch surfaces multibranch. "Do customers buy on account?" turns the debtors book on or off — No keeps it tucked away until your first account sale surfaces it automatically. A branch/location name and a read-only e-invoicing law field (set from your country in Step 3) round out this step.

Step 2: Industry Sector Template

Pick one of the 28 sector pills (Retail, Restaurant, Hardware, Butchery, Petrol, and so on) — one is always active, pre-selected from your sign-up page when known. Your choice drives which POS and dashboard the launch button opens and which checklist links appear below.

Step 3: Country, Currency & Camera Link

Choose your operating country from a 15-entry list (South Africa/SARS through UK/HMRC, EU/OSS and US state tax) and the VAT/GST rate, currency, and the tax-number field's label all update to match — e.g. selecting Kenya relabels the field for KRA and switches the rate to 16%.

Step 4: Review & Launch

A review grid mirrors back your trading name, owner, industry, country/currency, VAT status and branch before you commit. Pressing Save & Open Industry Dashboard validates the form (business name and VAT number format, if applicable), writes your tenant record, and takes you straight to your sector's POS — the button relabels itself to name the exact sector once saved. Not ready to fill all of it in? Skip for now writes a minimal, honest tenant record — your typed business name if you gave one, your sector, "Skip" recorded — and opens My Business directly; nothing here is invented on your behalf.

Post-setup onboarding checklist

Four milestones — import your products, ring your first sale, print a test receipt, meet your dashboard — each with a link to the right screen and a checkbox you can tap to mark it done or undone yourself. Only one of the four checks itself, and only on page load: every time you (re)open this wizard, it looks for a real (non-history, non-sample) order in your database and, if one exists, silently flips "Ring your first sale" to done — it does not update live while you're on the till. The other three are entirely self-reported, so ticking "Print a test receipt" records that you say you did, not that a printer actually fired.

On the retail-style layout (used by retail, and equivalent pages for other product-heavy sectors): a "1-Click Quick Start (Tiny Shop / Corner Mart)" button shows a success message and sends you to the sector's POS, without writing any configuration; three "Business Scale" tier cards (Tuck Shop / Independent Store / Enterprise Chain) visually highlight your pick but nothing downstream reads it; module accordions expand and collapse on click to show or hide their settings; the first checkbox in each module flips its badge between "Active" and "Skipped" on screen only, while the second checkbox in each module (Bettcher recipe display, SMS alerts, exit turnstile) has no handler at all and does nothing when clicked; the trading-name and VAT-number fields accept typing — the trading-name field is read only to echo it back in the confirmation message, and the VAT-number field is never read at all; neither is written to any configuration; and "Save Configuration & Launch Workspace" shows a confirmation message naming whatever you typed as the store name, then opens the sector dashboard — the message, not a database write, is the entire effect.

The hospitality-style layout (used by hospitality/guest-house pages) is the same story in miniature: "1-Click Quick Start (B&B / Guest House)" shows a success message and opens the front-desk POS, and "Save Configuration & Launch Hotel Dashboard" shows a "Hotel Setup Saved" message and opens the dashboard — again, neither writes anything.

Every sector setup preview's own banner links straight to the real Master Setup Wizard — that link is the one control on these 28 pages that reliably takes you somewhere useful; use it instead of the preview's own buttons.

A "Fixed Asset Register" button in the retail setup header opens fixed_assets_register.html — a real page, but as with several `*_setup` companions its "Register new asset" and "Post depreciation" controls currently show a confirmation message rather than writing to the ledger; documenting that page's own add/post functions in full belongs to a different package (they carry the separate assets.register.* function family), so only the act of opening it is covered here.

Both "+ Add New Camera / Device" in the header and "+ Add Camera (IP / RTSP)" in the provisioning bar open the same form, pre-filled with a randomly generated camera ID and a placeholder IP, asking for a name, mounting location, an AI purpose from a 12-option list, IP/port, and a confidence-sensitivity slider. Clicking "Edit" on any of the four example cards opens the same form pre-filled with that card's hardcoded details so you can see the fields in context.

Submitting the form ("Save & Deploy Camera AI") shows a confirmation alert repeating back what you typed, including an invented "Calibrated to 30 FPS Edge" line, then closes the dialog — the camera list on screen does not change; nothing you entered is added to it or saved anywhere. "Scan LAN (ONVIF Auto-Discover)" shows the same two hardcoded "discovered" cameras every time it is pressed, regardless of what is actually on your network — it does not perform a real scan. The × button and the form's own Cancel button both simply hide the dialog with no confirmation and no save.

For pairing a camera that actually works, this is the wrong page: the till's own camera (Vision Live) and a real IVOPS Vision kit (Edge Node pairing) are genuine, gate-proven features documented in the Vision chapter of this manual — this screen is not how either is set up today.

Bring a complete business pack—or run a deliberately limited quick import—from Square, Loyverse, Yoco, GAAP POS, Pilot Software, Arch Retail, IQ Retail, Lightspeed (Vend), Shopify POS, Clover, iKhokha, Sage Pastel, a local export folder or a spreadsheet. The complete route reconciles structured records before writing and retains every selected source row, including vendor-specific fields it cannot safely map.

Two migration lanes work together on pos_connect.html. Complete Business Migration is the cutover route for the whole business. The vendor API and CSV shortcuts are quick connections for products, customers and sales history where exposed; they are not presented as a full changeover. The older legacy_pos_migration_portal.html remains the quick CSV upload-or-paste screen.

Route 1 — Complete Business Migration

A complete pack can map branches, disabled-until-activated staff, products, prices, stock and batches, customers/debtors, suppliers/creditors, purchases and GRV lines, supplier payments, sales receipts, item lines, tenders, returns, chart of accounts, balanced ledger entries, VAT history, loyalty, gift cards, payroll and settings. Open laybys, quotes, sales orders, job cards, bill-of-quantity records, promotions, bank reconciliations, budgets, assets, report definitions, audit history and other unmatched vendor tables are retained with their original source fields; preservation does not pretend that a corresponding live IntelliVision workflow exists.

Sales need the receipt header, every item line, tender breakdown and returns/credit notes for the full date range—not merely a daily or receipt total. One detailed CSV containing receipt reference, date, product, quantity and line total is split into reconciled receipt and item records automatically; explicit tender rows are deduplicated by their source reference. Preflight shows missing detail before anything is written.

The source picker below still helps you: tell it which system you're coming from and it routes you automatically identify the right source. Use Complete Business Migration for a cutover; use the quick portal only when the merchant intentionally wants the smaller product/customer/sales-history move.

Quick route A — Connect directly by API

Direct API connect with legacy POS accounts (Square, Loyverse, Lightspeed/Vend, Shopify, Clover): open Connect Your Old POS, paste one token, approve each data class, and products, customers and sales history import duplicate-proof (Shopify includes stock-on-hand) — other systems follow the guided export recipes on the same page, with one-click buttons that open YOUR vendor portal's export screen (your login never touches us).

1. Test connection — before anything is fetched, press this to prove the token actually works. IntelliVision checks it live against IntelliVision's own relay service and tells you plainly if it can't reach your account — nothing is pulled until this passes.
2. Fetch my data — a preview only, nothing is written to your books yet. Live counts tick up per data type as it runs. It pages through your ENTIRE account, not just the first screen — a large catalogue comes across whole, not truncated at page one.
3. Tick what to bring in — Products, Customers, Sales history, Staff & roles. Anything left unticked is never pulled into IntelliVision.
4. Import now runs each ticked class through the exact same zero-loss, duplicate-safe engine as every other route on this page — an API pull gets no shortcuts around validation.

Where the vendor shares it (Square, Loyverse, Lightspeed, Clover), your staff and their roles import too — sign-in disabled until you set each password on Team & Logins, and a vendor "owner" becomes a manager here, never a second owner. And Business Setup opens pre-filled from what was found: shop name, team size, account customers detected — all waiting for your one final review before launch.

Quick route B — Read product/customer/sales files right off this machine

If the old till is on this same machine, choose This same computer instead: pick its export folder and IntelliVision reads the CSV files and SQLite databases locally — every file is listed with what it is, nothing is uploaded, and re-imports can never duplicate your records.

• Pick a folder or Pick files — everything you choose is scanned in this browser and listed, supported or not, with a plain reason for anything skipped. Recognized formats: CSV exports (all vendor column maps apply), SQLite databases read via a bundled reader (tables whose columns look like customers, products or sales are offered; a table over 100,000 rows is refused with the real count rather than silently cut off — export it as CSV in date ranges instead), and IntelliVision's own backup archives, which are pointed at the separate Data Export → Restore screen because restoring replaces your current data, not adds to it.
• Tick the entries you want and press Import selected. Each ticked entry runs through the same proven import funnel as every other route — the same validation, loss reporting and dedupe.

Safe to run again: re-scanning the same folder writes nothing and re-posts nothing — every file already imported is recognized and skipped.

Quick route C — Paste straight from a spreadsheet

Coming from Excel or a paper book typed into a spreadsheet? On pos_connect.html, choose Excel / spreadsheet: copy your cells (header row included), paste them straight in, fix any cell in the preview grid, and import — the grid is what gets imported, so a typo fixed there is fixed in your books.

• Spreadsheet pastes are read as tab-separated automatically (the normal case when you copy real cells); typed or copied CSV/text falls back to a quote-aware parser, so commas inside names and a cell that itself contains a line break survive intact.
• The header row is read automatically to guess Products, Customers or Sales history — shown as a badge next to the grid; change it yourself if it guessed wrong.
• Click any cell to edit it, use ✕ to drop a row you don't want — only what's left in the grid at the moment you press Import the grid is written.
• Clear empties the box and grid so you can start over with a fresh paste.

A second, simpler paste tool lives on legacy_pos_migration_portal.html itself: a plain text box for raw CSV or TSV content (no editable grid) — paste it in and press Import Pasted CSV. Useful when you already have CSV text copied from somewhere, rather than live spreadsheet cells.

Route D — Guided export for a complete cutover or a quick import

For systems with no live API, Connect Your Old POS shows a full cutover checklist and vendor-specific guidance. Use Complete Business Migration takes the complete set through preflight, reconciliation, one atomic write and retained-source archiving. Quick products/customers/sales only opens legacy_pos_migration_portal.html when the merchant intentionally wants only that smaller move.

1. On the portal, Step 1 is picking your system again (Square, Loyverse, Yoco, GAAP POS, Pilot Software, Arch Retail, IQ Retail, or Generic CSV) — this sets which vendor's columns it expects.
2. Step 2 is choosing what you're importing: Products & Inventory, Sales history, or Customers & balances.
3. Step 3 is the file itself — click the drop zone to browse for your exported CSV/TXT, or use the paste box from Route C above.

On the restaurant till specifically, a 🔄 Import GAAP CSV shortcut sits right in the header — one click straight to the import portal, no need to go via Connect Your Old POS first. The till-side view of that button is in Chapter 1's till reference.

Every route shares the same safety engine underneath

The vendor format is auto-detected from the file's header row (or its filename) the moment it's read, so you rarely need to tell IntelliVision which system it came from. The migration engine handles South African comma-decimal prices (such as R 89,50 or 1 250,00) correctly without truncation or parsing errors.

• Every product row either imports, is rejected with its specific reason, or is recognized as a duplicate already in your system — never silently skipped.
• Before anything is written, IntelliVision counts what it found and what it will skip — a preview-only parse, so you see the shape of the import before committing to it.
• Rejected rows can be downloaded as their own CSV — fix them in your spreadsheet and try again, rather than starting the whole file over.
• Records that already match an existing one (by barcode/SKU/name for products, email/phone/name for customers, receipt number for history) are shown as skipped, not re-imported — nothing is ever double-counted and no opening balance is ever posted twice, even if you run the exact same file again.

Whichever route you used, the results screen ("What happened — exactly" on POS Connect, or the Imported Records table on the portal) shows imported / already-in-your-system / rejected counts for every data class, with the specific reason behind every single rejection — nothing about an import is ever a black box.

Sales history & customer accounts — available now

Sales history from your old system imports as history rows, flagged so they can never deduct stock, never post to your general ledger, and never count as today's sales — they exist purely so your reports show real trading history from day one, with no limit on how many years back your export covers. Receipt numbers already imported are recognized, so re-running the same file never doubles your history.

Customer accounts arrive as real debtor balances. For everyone newly imported with a non-zero balance, IntelliVision posts one balanced opening-balances journal — a customer who owes you debits Debtors Control (1100) against Opening Balances Equity (3900); a customer in credit posts the other way — summed once, for that import only, so duplicates never re-post.

Sign in on any of 22 tills — every sector except butchery, carwash, funeral, liquor, petrol and restaurant — and a floating pill-shaped dock appears bottom-centre of the screen: Search, Admin, Tutorial, Help, Modules, Hold, Draft, and API Vault. It never appears on auth.html itself (it used to sit on top of the Sign In button), and it never appears for a signed-out visitor. One caution worth passing to every role, not just cashiers: the dock shows the same eight buttons — including Admin and API Vault, links into platform-operator territory — to every signed-in role. It does not hide itself for a Cashier account; the fail-closed role check happens only after you tap through.

Tap Search, or press Ctrl+K (Cmd+K on a Mac), and a full-screen command palette opens with a search box already focused. Type any part of a screen name or category — "Admin", "POS", "Cashier", "Silo" — and the list filters live against a fixed roster of roughly 40 platform screens (every sector's POS and dashboard, the Super Admin console, camera setup, the free calculators, role SOP pages, the API vault) grouped by category tag; tap a result to jump straight there. Escape, or a click outside the box, closes it again.

Draft saves whatever you have typed into any input, dropdown or text box on the current screen — it also runs on its own every 5 seconds in the background, not only when you press the button, so you rarely need to press it. Saving shows a confirmation alert. If a save exists from an earlier visit to this exact page, a yellow banner appears at the top offering Restore, which re-fills every matching field by its id or name and clears the banner; Dismiss clears the banner and deletes the saved draft without restoring it. One precision worth knowing: this saves form fields — search boxes, quantity inputs, setup forms — keyed to the page's own filename. On tills where the cart is built as plain rows in a table or list rather than form inputs (every till in this manual), Draft does not capture or restore the cart itself; a held sale is not a saved draft, and neither one is a safety net for the other.

Tap Tutorial (or the 🎓 icon inside the role-help panel, see below) to start a real guided walkthrough: a dimmed overlay, a highlight ring drawn around the actual on-screen element for each step, and a step card with Next/Prev, a step counter, and a "Fill Demo Data" shortcut. It scrolls the page to bring each target into view rather than assuming it is already visible.

Every one of the 28 tills carries a floating "?" button, bottom right, at all times — this is the one help control that reaches every till with no exceptions. Tapping it opens a small drawer listing up to six of the functions that actually exist on the screen you are standing on, looked up by filename in the platform's help map, and filtered against your signed-in role: a cashier is not shown manager-only functions. Below the list sits "📖 Open the full manual for this screen →", which jumps to the section of this manual covering that screen, and below that a link to the role knowledge base. If a screen is not in the map, the drawer falls back to one of seven generic buckets (POS pages, dashboards, accounting, payroll, migration, setup/admin, or a catch-all) so it is never empty. The ✕ in the drawer's corner, or a click outside it, closes it.

On the 22 dock sectors, the dock's own "❓ Help" button and the Ctrl+H / Cmd+H shortcut open a second, different, full-screen panel — the role SOP modal, not the floating "?" drawer above. It carries role tabs (Cashier, Waiter, Manager, Mechanic, Owner and several trade-specific roles) down one side and, for the tab you land on, a couple of longer operational SOP cards plus a "🎓 Practice Interactive Simulation" button that starts the same guided tour described above. It always opens on the Cashier tab first, regardless of which role is actually signed in — switch tabs yourself if you need a different role's guide. On the six sectors with no dock (butchery, carwash, funeral, liquor, petrol, restaurant), neither this panel nor the Ctrl+H shortcut exists at all; only the floating "?" is available there.

The dock's ⚙️ Modules icon is a plain link to the owner's module hub (owner_modules_hub.html), and the 👑 Admin icon is a plain link to the platform Super Admin console (super_admin_dashboard.html) — the platform-operator dashboard, not a per-shop admin screen — while ⚡ API Vault links to the API integrations hub (api_integrations_hub.html). All three are ordinary navigation links with no logic of their own on the till; what you can actually do once you land on each is out of this fragment's scope.

Every till's header carries a small "🌍 Tax Regime" dropdown listing 15 countries — South Africa through Nigeria, Kenya, the UAE, the UK, the EU and the US — and switching it live-swaps the currency, the VAT/GST rate and the tax label used across the page. Beside it, a small pill reads 🟢 with the active tax period's name, or turns 🔴 EXPIRED the moment the loaded tax rule's validity window has passed, and a ⚙️ icon opens the admin tax and pricing cockpit for anyone with the rights to change rates. One condition worth knowing: this toolbar only renders into a page that has a .app-header, .header class, or a bare <header> element, and only once the currency engine script has loaded — on a page missing either, the toolbar simply does not appear; it fails silently rather than with an error.

A breadcrumb plus a "<Sector> pages ▾" dropdown sits at the top of every till and every platform page — IntelliVision › your sector › the current screen — and opening the dropdown lists every sibling page in that sector, a "Run the business" section linking the universal cross-sector tools (books, stock, cash-up, payroll, team — these used to be unreachable from a sector till before this switcher existed), a Platform section, and a link back to "All industries". It only appears on pages the platform actually recognises as belonging to a sector or the shared platform set; a page outside that registry keeps whatever nav it was built with instead.

When a new build ships, a "What's new" card slides in naming the version and a bullet list of what changed, with an "Update now" button, and a "Later" button that simply removes the card for this visit without dismissing it permanently — it can reappear next load until you do update.

Try to open a screen your licence tier does not cover and, instead of the screen, you land on a lock page naming the module, the required tier, its draft price, and how many days your trial has left, with a field to type an offline unlock code and a one-tap "Back to the till (Free forever)" link so you are never stranded. The single POS till itself is never gated this way — only the modules layered on top of it are.

On 16 of the 28 tills, a pulsing "Ask IntelliVision AI" launcher sits in a corner (agriculture, construction, ecommerce, education, fitness, hardware, healthcare, hospitality, logistics, manufacturing, property, repair, retail, salon, trades, wholesale) and opens a small chat window pre-loaded with a page-aware welcome line and four quick-question chips — offline and data location, how POS works, Vision AI hardware requirements, and hardware prices. The other 12 tills do not load this widget at all.

On 16 of the 28 tills (agriculture, construction, ecommerce, education, fitness, hardware, healthcare, hospitality, logistics, manufacturing, property, repair, retail, salon, trades, wholesale — exactly the same 16 tills the AI assistant loads on; butchery, carwash, funeral, liquor, petrol and restaurant do not load it) right-clicking anywhere opens a small dark context menu positioned at the cursor, closing on the next left click or a click outside it. What it shows depends on what you clicked.

Right-click empty space (or anywhere that is not a camera tile or a ticket row) instead, and the menu offers five items. Three of the five are real navigation: "🚀 Quick Role Switcher" opens the role login simulator, "🇿🇦 SARS VAT201 Tax Ledger" opens an accounting page — but that link is hardcoded to restaurant_accounting.html on every till it appears on, not the sector you are actually working in, so a cashier on agriculture_pos.html who picks this item lands in the restaurant sector's books, not their own — and a "🏢 Multi-Client Portal" link. The other two are not navigation: "❓ Page Guided Tutorial" starts the real guided tour where one exists on the page and falls back to a toast where it does not, and "💬 Open AI Assistant" is a toast only — it shows the message "IntelliVision AI Chatbot Ready" and closes the menu without opening the assistant. The assistant's own launcher, documented below, is the control that actually opens it.

Right-click a camera tile and the menu offers "Full Screen WebRTC", "Take HD Snapshot" and "Recalibrate Vision AI" — all three are toasts as well, plus one real link through to a vision-AI log page; camera functions belong to the Vision chapter of this manual, not this one, and are only named here because they share the same right-click handler.

Open your industry till. The clearest example is the pattern shared by 16 sectors — agriculture, automotive, construction, ecommerce, education, events, fitness, freelancer, healthcare, logistics, manufacturing, nonprofit, professional, property, rentals, repair — which is also the best-built ring-up flow in the product: retail_pos.html, despite being the page the old manual walked through, is actually the odd one out (see the Reference cards below for exactly how it, and every other sector, differs).

Tap any item tile in the catalogue and it is added to the active ticket immediately — one line per tap, quantity always 1; tapping the same tile again adds a second separate line rather than incrementing a quantity, because there is no quantity field anywhere on this screen. The ticket panel lists every line live, each with its own ✕ to remove just that line, and a running subtotal, VAT (15% while you are a registered VAT vendor, nothing at all while you are not) and total recompute after every add or remove, worked out directly from what is actually in the cart array, not a separate stored figure.

The 15% VAT is split out of the tax-inclusive price shown on the tile, not added on top of it — the same rule used everywhere else in the platform. That split only happens at all if you are a registered VAT vendor; if you are not, the price on the tile is the whole of your revenue and no VAT line is shown or posted (Chapter 3, §3.3). not VAT registered? ↗

Three genuinely distinct tender buttons sit under the total — 💳 Speedpoint Card, 💵 Cash Payment and ⚡ Ozow Instant EFT — and each one really does record that exact method: the checkout function normalises whatever text a button passes it (matching "CASH", "OZOW"/ "EFT", or "CARD"/"SPEEDPOINT") into one of the three, so the sale ledger genuinely reflects which button the cashier pressed. This is the one sector family where tender choice is real end to end.

Press a tender button with nothing in the cart and the sale is refused with a plain message, and a cart that somehow totals zero is refused the same way — both checked before anything is written.

Once the guards pass, the sale is written in one call to the shared ledger engine — items, the tender line, and a stock deduction all go in together, and this is the one call every till in the product ultimately shares, however different their buttons look. The signed-in cashier's name is stamped onto the sale automatically from the current session, falling back to a generic label only if no session is found.

The remaining tills each build their own ticket a little differently. Five sectors — butchery, carwash, funeral, liquor and petrol ring an item onto the active ticket the same one-tap-per-line way as the 16-sector pattern above, just with their own catalogue and their own single combined tender button (covered in the payment Reference card below).

restaurant_pos.html's menu grid adds most cards straight to the cart the same way, filtered by a category bar (All / Steaks / Burgers / Seafood / Beverages / Desserts) that shows and hides cards live, and re-priced by a Standard / Happy Hour (20% off) / Delivery (+15%) tier toggle that recalculates every currently-visible tile's price the instant you switch it.

Two of restaurant's menu cards (steak and burger) are gated behind a forced popup instead: tapping Ribeye Steak or the Bacon & Cheddar Burger opens a modal asking for a cooking temperature before anything is added. Rare / Medium-Rare / Medium / Well Done each close the modal and add the item immediately, temperature baked into its name, while an optional side-upgrade button (Salad +R12, Sweet Potato Fries +R18) adds a second, separate priced line and Cancel closes the popup with nothing added.

salon_pos.html adds services and retail products from a row of quick buttons below the active client's appointment the same one-tap way, on top of the three line items the appointment already arrived with. trades_pos.html's field catalogue (call-outs, materials, parts) taps straight onto the active job invoice the same way, and wholesale_pos.html's pallet/case catalogue taps straight onto the active dispatch invoice, identically.

hardware_pos.html carries a genuine cut-to-length calculator: pick a timber spec, a cut length and a piece count, press Calculate & Add, and it multiplies length by pieces by the rate-per-metre, adds one correctly-priced line naming the total metres cut, and confirms the figures in an alert. This is real arithmetic on real inputs, not a fixed demo line.

On the 16-sector pattern and its five single-tender siblings, every cart line's own ✕ removes exactly that line, instantly, no confirmation. A separate Clear button on five tills — healthcare, logistics, manufacturing, property and repair — empties the whole ticket in one tap, also with no confirmation prompt: one stray tap loses the entire order, though nothing is charged until checkout so re-adding items costs only time.

Eleven tills carry a "Scan … / Search…" text box above the catalogue — worded to suit the sector ("Scan Barcode / SKU / Search…" on six of them, "Scan Waybill / Consignment", "Scan BOM / Part Number", "Scan Unit / Tenant ID", "Scan Part SKU" and "Scan Barcode / ICD-10" on the rest — automotive, events, freelancer, healthcare, logistics, manufacturing, nonprofit, professional, property, rentals, repair) that does nothing — it has no id, no name, and no input handler anywhere in the page. You can type into it; nothing filters, nothing scans, nothing is added. On these 11 tills the only working way to ring up an item is tapping a catalogue tile.

retail_pos.html has one flat "Apply Voucher" button that announces a fixed R50 discount and edits the total banner's text, and a "Member Card" button that shows a fixed loyalty-cashback message with no other effect.

The single question every cashier eventually asks — "can I actually tell the till how the customer paid?" — has a different answer on almost every sector. This table is the honest version of manual.html:847's tender list.

retail's PAY NOW button calls the checkout function with no tender argument at all, so every retail sale books as CARD regardless of how the customer actually paid.

butchery, carwash, funeral, liquor and petrol each give the cashier three buttons — Cash, Card and Ozow Instant EFT, and the one you press is the one recorded. Until 20 August 2026 these five shared a single "Instant Pay (Ozow / Card / Cash)" button that passed no method at all, so the literal label went into the record as the payment method. That was not merely untidy: a label matching neither cash nor account classified as a bank receipt, so cash taken over these five counters posted to GL 1010 Bank instead of GL 1000 Cash on Hand and never appeared in the shift cash-up — a butchery closing its drawer would have seen the float alone as expected and thrown the whole day's takings into Cash Over. Cash rung on these tills now reaches the cash-up.

restaurant's "💳 CARD (1.75%)" button records a CARD tender — the 1.75% named in the button is a label only; nothing in the checkout path actually deducts a fee from the total charged or recorded. "💵 CASH" prompts for the amount tendered, and calculates and shows the change due once you confirm, while a tendered amount less than the total is rejected outright with a message, before anything is recorded. The confirmation alert also claims the RJ11 cash drawer was kicked open; no hardware-bridge call happens anywhere in this function, so treat that line as informational rather than a hardware confirmation.

salon has one "COMPLETE SALON CHECKOUT" button, hardcoded to always pass CARD — there is no way to record a client's cash or EFT payment as anything but a card tender on this till.

trades' "💳 CARD (TAP-ON-PHONE)", "⚡ INSTANT EFT" and "💵 CASH PAYMENT" buttons each pass their own distinct method string through to the ledger — a field technician genuinely can record which of the three the client used.

wholesale's "🏢 30-DAY TRADE CREDIT", "⚡ INSTANT EFT" and "💳 SPEEDPOINT CARD SETTLEMENT" buttons are likewise three genuinely distinct methods. Unlike hardware's version below, choosing Trade Credit here runs no credit-limit check at all — it is recorded exactly like any other tender, with no available-balance guard and no link to a specific debtor account.

hardware's "CHARGE TO TRADE CREDIT" button genuinely checks the account's available credit before allowing the sale, refusing with "TRADE CREDIT LIMIT EXCEEDED! Manager approval required" if the total would exceed it, and deducting from the shown available-credit figure on success. Its counterpart, "PAY CASH / CARD (SPEEDPOINT)", always records CARD regardless of the "Cash / Card" wording on the button — there is no separate cash path here, and no tendered-amount or change prompt like restaurant's.

hospitality's single "ACCEPT PAYMENT & CHECK-IN GUEST" button settles the whole folio and checks the guest in together, and — like retail and salon — it passes no tender argument, so it always books as CARD no matter how the guest actually paid at the desk. The R2,500 incidental pre-authorisation hold shown beside it is fixed decorative text, never read or updated by this function.

Until 20 August 2026 this product had no way to reverse a sale at all. Nothing on any till, in any book, undid a transaction: a mis-rung sale stayed rung, and a returned item had to be handled outside the system entirely.

Retail’s [REFUND / RETURN] button opens a small panel on the till: the order number being reversed, an amount (leave it blank to refund the whole sale), and a reason. The reason is not optional — a refund with no stated reason is refused, so the audit trail can never contain a silent reversal.

What it does to the books: revenue and output VAT are both reversed, and the money goes back out the same way it came in — a cash sale refunds cash, a card sale refunds the bank, and an on-account sale becomes a credit note against GL 1100 and the customer’s balance rather than a cash payout. That credit note shows on their statement, allocates against the invoice in the same oldest-first order as a payment, and stops the aging schedule chasing money they no longer owe.

The control is on the retail till today. The engine behind it is shared, so the other twenty-seven tills can carry the same button without a second implementation — but until they do, reverse their sales from retail or from Books.

restaurant's "💳 Charge to Corporate Tab" button opens a modal listing pre-set approved corporate accounts — Sasol Corporate, an FNB commercial tab, and one named individual account, each with a fixed limit and used-balance shown in its own dropdown option. Picking a different account from that dropdown does not update anything else in the modal: the "Available Credit" figure shown stays fixed at its opening value, because the function the dropdown calls on change — onDebtorSelectChange() — is not defined anywhere in the page. Selecting a different account is silently a no-op beyond changing which name is highlighted.

"✓ Authorize Charge" records the sale against the account shown, with the VAT portion broken out, and confirms with the order number and the amount, while Cancel simply closes the modal with nothing charged. This control runs no credit-limit check of its own before authorising.

Both restaurant's tab modal and hardware's credit banner show a limit, an owing balance, and an available-credit figure for the account in view — on hardware this available-credit number is genuinely live within the session (see the Reference card above for its reset-on-reload caveat); on restaurant it is fixed decorative text that the dropdown never refreshes. Only hardware's trade-credit button actually blocks a charge that would exceed the shown limit — restaurant's corporate-tab flow and wholesale's trade-credit tender both authorise regardless of balance.

"Print Splits" shows a printing confirmation alert naming the table and a receipt number — no print call reaches the hardware bridge; treat it the same as the context menu's duplicate-receipt item above.

hardware's "PRINT YARD DISPATCH PASS" shows a confirmation alert with a fixed pass number and a hardcoded three-item list — 6x Custom Cut Pine, 20x PPC Cement, 1x DeWalt Drill Kit, regardless of what is actually in the trade cart at the time — then sends you to the timber yard screen. No print call is made.

On retail, restaurant and butchery — and on the trade-debtors screen's customer statements, described below — a genuinely working "💬 Share receipt on WhatsApp" button appears the moment a sale completes. It is real: the button's link is built from the actual order just recorded and opens WhatsApp with that receipt attached, ready to send. This is a shipped, gate-proven feature (G25) — it is not "Coming soon" on any till that carries it.

On the same three tills, a green confirmation banner appears in place of (not on top of) the tender buttons once a sale completes — the order number, the amount, and the WhatsApp button described above — and stays until the next item is added, at which point it hides itself again ready for the next sale.

restaurant_pos.html carries a "🔄 Import GAAP CSV" link in its own header, alongside the pricing-tier toggle — it is a plain navigation shortcut straight to the real legacy-migration portal covered in Chapter 1's import section, not a separate importer built into the till itself.

The Sign out button described above ends the session and returns to auth.html — again, reachable only via the access-denied path, not as a routine control a manager taps at the end of a shift.

Opening a shift asks for a cashier name (quick pills for Cashier 1 / Cashier 2 / Supervisor, or your own signed-in name pre-filled) and an opening float (quick pills for R200 / R500 / R1,000). This is genuinely enforced server-side, not just labelled: attempting to open a second shift for a name that already has one open is rejected outright, naming the existing shift number. The cashier field and the float field are both plain inputs behind that same validation — a blank cashier name or a negative float is refused before the shift is created.

Closing a shift is genuinely blind: the "System Expected Cash" and "Cash-Up Variance" figures are replaced with 🔒 placeholder text and stay that way for the whole shift — there is no way to peek at them before you count. Only once you type the physically counted cash and submit does the real close happen, and only then do both figures reveal themselves, colour-coded green for balanced, red for a shortage, blue for an overage. The reveal names the exact figures and the ledger accounts each variance posts against — Cash Short (5900) against Cash on Hand (1000) for a shortage, Cash on Hand against Cash Over (4900) for an overage.

Petty cash payouts require a positive amount and a written reason — both are required fields, refused if either is missing — against the currently open shift only; four quick-pick reason pills (cleaning supplies, staff refreshments, hardware consumables, courier/postage) fill the reason field for you, and every payout posts a real balanced ledger pair, debit 5800 against credit 1000, confirmed in the response message. Every voucher recorded on the currently active shift lists below the form — time, reason, amount, and the GL posting — and the engine itself refuses a payout once its shift has already been closed.

A full audit table of every shift session — ID, cashier, status, opened time, float, expected, counted and variance — sits below the open/close cards, clickable row by row to load any past shift back into the active-shift panel above for inspection. A cashier dropdown, built from every distinct cashier name that has ever opened a shift, filters that table to just their sessions, and a Refresh button re-reads everything from the database — shift list, active shift, and history together — useful after a sale posts on another device sharing this till, since the screen also refreshes itself automatically on that broadcast.

Charging a sale to a customer's account at the till (hardware's trade credit button, restaurant's corporate tab, both covered above) is one side of this. The account itself — its credit limit, its balance, its statement and its aging — is managed from one shared screen reachable from wholesale, hardware and restaurant.

"➕ Add Account Customer" opens a form for a business name, contact details, and an optional credit limit — leaving the limit blank means unlimited, and the field's own helper text calls this "Fail-Closed Enforced": a limited account really does refuse a sale that would push its balance over the cap, surfaced as an explicit "FAIL-CLOSED ENFORCEMENT" error rather than a silent skip.

"💳 Receive Payment" takes an amount, a method (EFT / Card / Cash), and an optional reference note, and settles it against the chosen account, applying the payment oldest-invoice-first (FIFO) across whatever is outstanding — the confirmation names exactly how many invoices the payment was allocated across and the account's new balance.

"⚡ Test Account Sale (POS)" rings a chosen item, quantity and price straight onto a chosen debtor's account, going through the same shared sale-recording call every till uses — a deliberate demonstration/verification control living on the debtors screen itself, distinct from charging a live sale on an actual till (restaurant's corporate tab and hardware's trade credit button, both covered above, are the real till-side equivalents).

Opening any account's statement shows credit limit, current balance and available credit, plus a full running-balance ledger of every charge and payment on that account, each row typed CHARGE or PAYMENT with a reference and description. "🖨️ Print Statement" calls the browser's own print dialog directly — a genuinely real, simple print, not a simulated one — and the statement also carries its own working "💬 Send statement on WhatsApp" share link.

A tab toggle switches the whole screen between the Account Customers list and a 30/60/90+ day aging schedule, the latter a full table per customer with a totals row, backing the four aging figures (current, 30, 60, 90+ days) shown as headline metrics at the top of the page.