Transactional consistency
Stock deduction on acceptance is split across several DynamoDB transactions; a failure midway resumes from the checkpoint without double-deducting, and a failed large receipt rolls back automatically.
Idempotent · resumable · auto-rollbackTesting discipline
Playwright E2E tests hit a real test environment and inject 5xx errors, dropped connections and latency; hundreds of backend Python tests isolate AWS with moto.
Real environment · fault injectionServer-side recalculation
The tenant is taken only from the sign-in token, and totals are recomputed on the server from the catalogue and tax rates, so the client cannot tamper with them.
Zero-trust client