OmniStock

51 screens · custody ledger for 3PL warehousing

Every screen is annotated with the specification requirement it has to make visible. A screen that carries nothing got cut. Built in plain HTML and CSS against the design system — no framework, no build step.

Start at login Jump to dashboard Handheld Client portal

A · Auth & scope

Device credential and operator credential are separate, because a picker cannot type a password 200 times a shift and devices are shared from a charging rack.

01LoginOffice access, mesh at full strength 02Operator auth64px keypad · who is on shift 03Scope selectSite and owner, before data loads 04Session lockedShift survives · outbox intact

B · Overview

05DashboardExposure-ranked queue · throughput 06Command palette⌘K — primary way in at 500k SKUs 07AlertsSignals needing a person

C · Catalog & locations

Reserved accounts are shown as real locations, because that is what they are — every unit is always somewhere, including the missing ones.

08Catalog14 columns · the density test 09Item detailNo edit affordance anywhere 10Item editNo quantity field exists 11BalancesThe projection · a cache 12LocationsTree + reserved accounts 13Lots & serialsCustody travels with the lot

D · Movements

Eight document types, one write path. Every movement has a from, a to, a positive quantity and a stated reason.

14Movement ledgerAppend-only · no edit action 15Movement detailHash chain · actor vs device · skew 16Post movement422 quantity_not_settable 17ReceivingEXTERNAL → bin 18FulfillmentLast-unit contention 19TransferTwo movements, never one 20Title transfer409 custody_violation

E · Counting & variance

Two operators counting the same bin both post. The system does not pick a winner.

21Count sessionsProcess-failure flag rate 22Count sessionBoth counts survive 23Variance triageRanked by exposure 24DispositionSecond approver, DB-enforced

F · Sync & exceptions

25QuarantineNever rejected · evidence attached 26DevicesQueue depth · clock skew

G · Owners

27OwnersThe entity competitors lack 28Owner detailSLA weight · reason set 29AttestationQuarantine shown to the client 30DisputesAnswerable without phoning the site

H · Client portal

A separate shell. No site layout, no bin paths, no operator names, no write control — structurally, not by hiding.

31Portal loginOwner-scoped external auth 32HoldingsVariance shown, not hidden 33StatementsWhat "verified" has not earned 34Raise a queryBound to a balance line

I · Supply chain

35SuppliersThin by segment logic 36Purchase ordersShort ship ≠ stock variance 37ReservationsOpen architectural question

J · Admin

38UsersTenant → site → owner scope 39RolesAdmin cannot delete a movement 40IntegrationsHonest about stubs 41API keysscan-write reserved floor 42Audit logSeparate from the ledger, on purpose 43SettingsEvery number a hypothesis

K · Handheld · 390px

Targets lock to ≥48px and body to ≥16px. The desktop density modes do not apply — this shows one record at a time.

44Start shiftBadge or PIN, one-handed 45ScanStatic reticle, no ambient motion 46Offline queueDepth shown, never a false tick 47Bin countExpected figure hidden until submit 48PutawayPosted ≠ queued 49Can't completeYour record is kept

L · States

50State gallery3 empties · 4 error tiers 51Error pages403 never confirms existence

OmniStock

Sign in

Office access. Floor operators sign in on a handheld with a badge or PIN.

Sessions last 10 minutes and refresh silently. A lost device is revocable within one window.

OmniStock

Device TC-52-014Enrolled

Who is on shift?

The device is already trusted. This identifies you — every movement you post is stamped with your operator ID, never the terminal's.

Start shift

Device credential and operator credential are separate. "Device TC-52-014 posted this" is not an attribution.

OmniStock

Choose your scope

You hold goods for four clients across two sites. Scope is set before any data loads — nothing outside it is queryable, not just hidden.

Site SITE-4 · Tilbury DC 42 operators on shift · 6 dock doors Assigned SITE-9 · Daventry 18 operators on shift · 4 dock doors

Owner All owners Kestrel Foods · Northvale · Aldgate · Penrose Kestrel Foods only Narrow scope — other owners return zero rows

OmniStock

LockedShift still open

Screen locked after 15 minutes

Your shift is still running and nothing has been lost. 3 movements are queued on this device and will post when you unlock.

Operator PIN

Unlock End shift and sign out

Tuesday · shift 2 · 14:26

42 operators on the floor

Everything below is derived from the movement ledger. Nothing on this page is a stored figure that someone typed.

Post movement

Movements today38,204 +6.2% vs last Tuesday

Open variances412 12 above disposition threshold

Quarantined27 oldest 3h 12m

Devices offline6 64 writes queued

Movement throughput

Reserved scan-write floor holding — no 429 issued today p99 112ms

Variance queue — ranked by exposure

Open triage

Item	Owner	Units	Exposure	Age	Gate
29944-H	Aldgate Supply Co	−472	£5,286	3h	2nd approver
44102-T	Kestrel Foods	−240	£1,008	1d	2nd approver
88213-K	Kestrel Foods	−12	£214	23m	Controller
55810-Q	Aldgate Supply Co	+8	£112	4h	Controller

Ranked by extended value × contractual SLA weight — not by recency 412 total

Quarantine

Review

27 movements accepted but
not yet reconciled

Each one is a real physical action that failed validation on reconnect. They were quarantined, not rejected — discarding them would destroy the only evidence the action happened.

Devices

All 48

TC-52-014 Synced

TC-52-031 Offline · 38

TC-52-007 Offline · 61

TC-52-044 Clock skew 41m

Cold room and trailer dead zones are ordinary

Owners

Kestrel Foods184,220

Northvale Ltd71,904

Aldgate Supply Co29,118

Penrose Group11,662

Units held under custodyManage

Command palette

Press ⌘K anywhere. At 500k+ SKUs across four owners, navigation by clicking through a tree stops working — search is the primary way in.

Alerts

Operational signals that need a person. Not a feed.

Catalog

Items scoped to (tenant, owner). Quantities shown here are derived balances — this table has no editable quantity, at any privilege level.

New item

Item catalog, 14 columns. Quantities are derived balances and are not editable.
SKU	Description	Owner	UoM	Class	On hand	Reserved	Available	Primary bin	Lots	Min	Status	Last movement	Doc
88213-K	Ambient pallet wrap, 500mm × 300m	Kestrel Foods	EA	Ambient	1,847	120	1,727	SITE-4/A/12/03	2	400	In stock	2026-08-19 14:03	CS-8812
88214-M	Chilled tray liner, 400 × 600	Kestrel Foods	CS	Chilled	212	200	12	SITE-4/C/02/11	1	250	Below min	2026-08-19 13:58	PCK-88301
90551-B	Corrugated shipper, single wall	Northvale Ltd	EA	Ambient	0	0	0	SITE-4/A/04/18	0	1,000	Stockout	2026-08-19 13:40	TTL-00088
73390-X	Frozen carton, 12 × 400g	Kestrel Foods	CS	Frozen	4,096	512	3,584	SITE-4/F/01/02	7	800	In stock	2026-08-19 14:01	RCV-44214
61027-D	Returnable dolly, blue	Northvale Ltd	EA	Equipment	318	0	318	SITE-4/Y/00/01	0	50	In transit	2026-08-19 13:51	TRF-10233
55810-Q	Shrink sleeve, 65mm lay-flat	Aldgate Supply Co	RL	Ambient	76	0	76	SITE-4/B/09/07	2	100	Below min	2026-08-18 16:30	ADJ-00918
44102-T	Thermal label roll, 100 × 150	Kestrel Foods	RL	Ambient	12,480	1,200	11,280	SITE-4/A/01/01	4	2,000	In stock	2026-08-19 13:44	PUT-71121
29944-H	Desiccant sachet, 5g	Aldgate Supply Co	EA	Ambient	0	0	0	VARIANCE:aldgate	1	500	Variance	2026-08-19 13:47	DMG-00412

88213-K

In stock

Ambient pallet wrap, 500mm × 300m · Kestrel Foods · There is no edit control for quantity on this page. There is no such control anywhere.

Edit catalog fields Post movement

On hand1,847 3 bins · 18 more in other accounts

Reserved120 2 open orders

Available1,727 on hand − reserved

Ledger depth9,412 movements, all replayable

Position	Lot	Owner	On hand	Reserved	Available	Last touched
SITE-4/A/12/03	LOT/2026-0114	Kestrel Foods	1,204	120	1,084	2026-08-19 14:03
SITE-4/A/12/04	LOT/2026-0114	Kestrel Foods	431	0	431	2026-08-19 11:02
SITE-4/A/12/09	LOT/2026-0088	Kestrel Foods	212	0	212	2026-08-17 08:41
PENDING:site-4	LOT/2026-0114	Kestrel Foods	6	0	0	2026-08-19 13:55
VARIANCE:kestrel	LOT/2026-0114	Kestrel Foods	12	0	0	2026-08-19 14:03

PENDING:site-4 holds 6 units posted offline that failed validation on reconnect. They are quarantined, not rejected — the physical action already happened.

Seq	Recorded	From	To	Qty	Reason	Actor	Doc	Hash
1000412	2026-08-19 14:03:11	A/12/03	VARIANCE:kestrel	12	COUNT_SHORT	op-4471	CS-8812	9f3a…c1f2
1000398	2026-08-19 13:58:02	EXTERNAL:acme	A/12/03	600	RECEIPT	op-2210	RCV-44192	7b21…8e31
1000355	2026-08-19 11:02:44	A/12/03	A/12/04	431	PUTAWAY	op-2210	PUT-71120	4c88…a07f
1000341	2026-08-19 09:15:20	A/12/03	EXTERNAL:cust-8871	240	PICK	op-1180	PCK-88301	e019…3d55

Lot	Owner	Expiry	On hand	Positions	Status
LOT/2026-0114	Kestrel Foods	2027-01-14	1,635	2	Good
LOT/2026-0088	Kestrel Foods	2026-10-02	212	1	Expiring

Edit item · 88213-K

Catalog fields only.

Balances

Stock on hand by (owner, item, location, lot) — the projection. A cache of the ledger. If the two ever disagree, the ledger wins and this table is rebuilt.

Owner	Item	Position	Lot	On hand	Reserved	Available	Level
Kestrel Foods	88213-K	SITE-4/A/12/03	LOT/2026-0114	1,204	120	1,084	1,204ok
Kestrel Foods	88213-K	SITE-4/A/12/04	LOT/2026-0114	431	0	431	431ok
Kestrel Foods	88213-K	SITE-4/A/12/09	LOT/2026-0088	212	0	212	212ok
Kestrel Foods	88213-K	VARIANCE:kestrel	LOT/2026-0114	12	0	0	12variance
Kestrel Foods	73390-X	SITE-4/F/01/02	LOT/2026-0201	4,096	512	3,584	4,096ok
Kestrel Foods	88214-M	SITE-4/C/02/11	LOT/2026-0177	212	200	12	212below min
Northvale Ltd	90551-B	SITE-4/A/04/18	—	0	0	0	0stockout
Northvale Ltd	61027-D	SITE-4/Y/00/01	—	318	0	318	318in transit
Aldgate Supply Co	29944-H	VARIANCE:aldgate	LOT/2025-9911	472	0	0	472variance
Kestrel Foods	88213-K	PENDING:site-4	LOT/2026-0114	6	0	0	6pending

The last two rows are units that are not in a bin. They are still somewhere — that is the point. "Unaccounted for" is never an answer this system can give.

Locations

site > zone > aisle > rack > bay > bin — plus the reserved accounts, which are real locations, not statuses.

Physical

4,812 bins

SITE-4Tilbury DC
- AAmbient1,840 bins
  - A/12Aisle 12
    - A/12/031,204
    - A/12/04431
    - A/12/09212
- CChilled602 bins
- FFrozen318 bins
- YYard44 bays

Reserved accounts

These behave exactly like bins in the ledger. Every movement has a from and a to, so supply, shipment, loss and damage all need an address — which is what makes conservation a structural property rather than a check.

Account	Purpose	Negative
EXTERNAL:{party}	Supplier receipts and customer shipments	Allowed
VARIANCE:{owner}	Count discrepancies awaiting disposition	Allowed
DAMAGE:{owner}	Written-off units, still attributable	Allowed
PENDING:{site}	Quarantined offline posts	Allowed
WIP:{owner}	Reserved for kitting. Unused in v1.	Allowed
Any physical bin	Racking, floor, yard	Blocked

A movement that would drive a physical bin negative aborts at commit with OS003 negative_position, and the API returns 409 with the current position so the operator can be shown what is actually there.

Lots & serials

Custody travels with the lot, not with the bin — owner_id is carried here, which is why moving a pallet never silently moves ownership.

Lot	Item	Owner	Received	Expiry	On hand	Positions	Status
LOT/2026-0114	88213-K	Kestrel Foods	2026-01-14	2027-01-14	1,635	2	Good
LOT/2026-0201	73390-X	Kestrel Foods	2026-02-01	2026-12-01	4,096	1	Good
LOT/2026-0088	88213-K	Kestrel Foods	2026-03-29	2026-10-02	212	1	Expiring 44d
LOT/2026-0177	88214-M	Kestrel Foods	2026-06-11	2026-09-11	212	1	Expiring 23d
LOT/2025-9911	29944-H	Aldgate Supply Co	2025-11-02	2026-08-02	472	1	Expired
SER/TC-52-014	61027-D	Northvale Ltd	2024-08-19	—	1	1	Serialised

Movement ledger

Append-only, hash-chained, partitioned monthly. 292M rows a year at current volume. No row on this page has an edit or delete action, at any privilege level.

Post movement

Seq	Recorded	Item	From	To	Qty	Reason	Actor	Device	Doc	State
1000412	14:03:11	88213-K	A/12/03	VARIANCE:kestrel	12	COUNT_SHORT	op-4471	TC-52-014	CS-8812	Posted
1000411	14:01:52	73390-X	EXTERNAL:acme	F/01/02	1,200	RECEIPT	op-2210	TC-52-009	RCV-44214	Posted
1000410	13:58:40	88214-M	C/02/11	EXTERNAL:cust-8871	200	PICK	op-1180	TC-52-022	PCK-88301	Posted
1000409	13:55:02	88213-K	A/12/03	PENDING:site-4	6	QUARANTINE	op-4471	TC-52-014	QRN-0091	Quarantined
1000408	13:51:19	61027-D	SITE-9/Y/00/04	SITE-4/Y/00/01	318	TRANSFER	op-3302	TC-52-031	TRF-10233	In transit
1000407	13:47:33	29944-H	B/09/07	DAMAGE:aldgate	24	DAMAGE	op-1180	TC-52-022	DMG-00412	Posted
1000406	13:44:07	44102-T	A/01/01	A/01/02	2,400	PUTAWAY	op-2210	TC-52-009	PUT-71121	Posted
1000405	13:40:55	90551-B	A/04/18	A/04/18	640	TITLE_XFER	adm-0004	—	TTL-00088	Paired

seq 1,000,412

Posted

Immutable. To correct this, post a compensating movement that references it — the corrected state and the record of correction stay the same object.

Effect

FromSITE-4/A/12/03

ToVARIANCE:kestrel

Quantity 12

Item: 88213-K — Ambient pallet wrap
Lot: LOT/2026-0114
Owner: Kestrel Foods
Reason code: COUNT_SHORT
Document: CS-8812 line 41
Net at source: −12
Net at destination: +12
System net: 0 — always, by construction

Chain

Verified

prev_hash: 7b21f0a9c4e8…3d81
row_hash: 9f3a44e10b7c…c1f2
Tenant sequence: 1,000,412
Partition: stock_movement_2026_08

Chaining is per-tenant, which serialises movement posting for a tenant at roughly 50–100µs — a ceiling near 10–20k/second, well above the 2k/minute target. Per-(tenant, site) chaining with a daily Merkle root is the escape hatch if it ever binds.

Attribution

Actor: op-4471 · S. Okonkwo
Role: Floor Operator
Device: TC-52-014
Idempotency: 8f21-b40c-9d33
client_seq: 44,118

The human and the device are recorded separately. An attestation built on device IDs is worthless in a dispute.

Clock

occurred_at: 14:02:47 device
recorded_at: 14:03:11 server
clock_skew_ms: 24,000

Timelines display by occurred_at because that is what happened on the floor. Balances, sequencing and attestation use recorded_at — a tamper-evident chain cannot be ordered by a clock the client controls.

Post movement

The only write path to a balance. Every movement needs a source account, a destination account, a positive quantity and a stated reason — there is no field on this form that sets a quantity to a value.

Movement

Document RCV-44215

From account External supply is an account, never null.

To account Units are neither created nor destroyed — both sides are required.

Item Ambient pallet wrap, 500mm × 300m

Lot Custody travels with the lot, not the bin.

Quantity Always positive. Direction comes from the accounts above.

Reason code

A reason is required. A movement without a stated cause is exactly what this system exists to prevent — pick the closest match, or use RECLASSIFY and add a note.

Note

Effect

EXTERNAL:acme-supplies SITE-4/A/12/03

Net at source: −600
Net at dest: +600
System net: 0 — always

Request

Idempotency key: c07d-51ea-4b62
Actor: op-2210 · J. Halloran
Device: TC-52-009
Occurred at: 14:22:09 device
Recorded at: — server, on accept

Replaying this key returns the original response rather than posting twice.

422 quantity_not_settable

What the API returns if a client tries to PATCH a quantity directly instead of posting a movement. There is no route that accepts a quantity as a target value, and no privilege level that unlocks one.

PATCH /v1/items/88213-K
{ "on_hand": 1847 }

422 { "error": {
  "code": "quantity_not_settable",
  "post_to": "/v1/movements" } }

Receiving

Inbound. Every line posts EXTERNAL:{supplier} → bin. External supply is an account, so a receipt conserves units like any other movement.

DocumentRCV-44215Dock 3 · Acme Supplies

Expected2,400from PO-9912

Received1,80075% complete

Discrepancy−6001 line short

Line	Item	Lot	Expected	Received	Delta	To bin	Status
01	88213-K	LOT/2026-0114	600	600	0	A/12/03	Matched
02	55810-Q	LOT/2026-0233	1,200	1,200	0	B/09/07	Matched
03	44102-T	LOT/2026-0220	600	0	−600	—	Short

Fulfillment

Outbound pick. bin → EXTERNAL:{customer}. Availability is checked against on_hand − active_reservations under a per-position lock.

Order	Owner	Item	Ordered	Available	Picked	From bin	Status
SO-77401	Kestrel Foods	88214-M	200	12	200	C/02/11	Picked
SO-77402	Kestrel Foods	73390-X	512	3,584	512	F/01/02	Picked
SO-77403	Northvale Ltd	90551-B	400	0	0	—	Cannot allocate
SO-77404	Aldgate Supply Co	55810-Q	52	76	52	B/09/07	Last unit

409 negative_position

SO-77403 cannot be allocated: 90551-B is at zero. The API returns the current position in the error body so the picker is shown what is actually in the bin rather than a generic failure.

Last-unit contention

SO-77404 takes the final 52 units. This is the one genuine read-modify-write in the system, so it takes a pessimistic per-position advisory lock — two orders promised the same unit is a customer-facing broken promise, not a data inconvenience.

Transfer

Inter-bin and inter-site. Owner never changes — a transfer that crossed owners would be a title transfer, and the database refuses to let the two be confused.

Two movements, not one

An inter-site transfer posts a dispatch and a receipt, with an in-transit account between them. Units are never in two places, and never in none.

SITE-9/Y/00/04

↓ dispatch

TRANSIT:site-9→site-4

↓ receipt on arrival

SITE-4/Y/00/01

If the trailer never arrives, the units sit visibly in transit rather than disappearing from one site's balance and never reaching the other's.

Title transfer

Moving units between two owners. Not an inventory event — a transfer of legal title, and it must be impossible to do by accident.

What gets written

Two movements in one transaction. The bin does not change — only custody does.

From	To	Qty
A/04/18 Northvale	TITLE:northvale	640
TITLE:penrose	A/04/18 Penrose	640

Both owners' attestations show this event from their own side, referencing the same contract. Neither can be produced without the other.

Count sessions

Cycle counts by zone. A session flagged above the variance rate is treated as a probable process failure, not as hundreds of individual stock problems.

Session	Zone	Owner	Opened	Controller	Lines	Variances	Rate	Status
CS-8812	A/12	Kestrel Foods	13:40	ctl-0331	96	11	11.5%	Open
CS-8811	B/09	Aldgate Supply Co	11:02	ctl-0331	144	31	21.5%	Flagged
CS-8810	F/01	Kestrel Foods	08:15	ctl-0117	62	2	3.2%	Closed
CS-8809	A/04	Northvale Ltd	Yesterday	ctl-0117	210	6	2.9%	Closed

CS-8812

Open

Zone A/12 · Kestrel Foods · opened 13:40 by ctl-0331

Two operators counted bin A/12/03. Both counts are in the ledger.

The system does not pick a winner. Both operators really did count what they recorded, and the disagreement between them is the strongest available signal that something is wrong — silently resolving it would discard exactly the evidence the controller needs.

Bin	Item	Counter	Time	Counted	Expected	Delta	Outcome
A/12/03	88213-K	op-4471 · S. Okonkwo	14:02:47	1,192	1,204	−12	Variance
A/12/03	88213-K	op-2210 · J. Halloran	14:09:15	1,204	1,204	0	Disagrees
A/12/04	88213-K	op-4471 · S. Okonkwo	14:11:02	431	431	0	Matched
A/12/09	88213-K	op-2210 · J. Halloran	14:14:38	208	212	−4	Variance

Disagreement on A/12/03

Send to triage

First count · 14:02:47 1,192 op-4471 · device TC-52-014 · online, recorded 14:03:11

Recount · 14:09:15 1,204 op-2210 · device TC-52-009 · online

Neither count was discarded. The variance of 12 units sits in VARIANCE:kestrel until a human disposes of it.

Variance triage

412 open. Ranked by exposure — extended value × contractual SLA weight — because the real question is not "what is different" but "which of these can become a claim".

Open412across 4 owners

Above threshold12above the owner's threshold

Total exposure£18,402extended value

Median age4holdest 3d

Exposure	Item	Owner	Account	Units	Value	SLA	Age	Session	Gate
£5,286	29944-H	Aldgate Supply Co	VARIANCE:aldgate	−472	£3,776	1.4×	3h	CS-8811	2nd approver	Dispose
£1,008	44102-T	Kestrel Foods	VARIANCE:kestrel	−240	£840	1.2×	1d	CS-8802	2nd approver	Dispose
£214	88213-K	Kestrel Foods	VARIANCE:kestrel	−12	£178	1.2×	23m	CS-8812	Controller	Dispose
£112	55810-Q	Aldgate Supply Co	VARIANCE:aldgate	+8	£80	1.4×	4h	CS-8811	Controller	Dispose

Exposure is extended value × SLA weight — £3,776 × 1.4 = £5,286. SLA weight comes from the owner's contract. A discrepancy of the same value is not the same problem for a client with a 4-hour reconciliation SLA as for one with 30 days.

Dispose variance

29944-H · Aldgate Supply Co · −472 units · £5,286 exposure

Separation of duties

Proposed byctl-0331 · you

Approvernot selected

£5,286 is above Aldgate's £250 threshold, so this needs a second approver who is not you. Enforced by CHECK (approved_by IS DISTINCT FROM created_by) — it holds against a direct API call with a valid token, not just against this form.

Why: the person who found the discrepancy has the strongest incentive to make it go away.

What gets posted

Disposition does not erase the variance. It moves the units on again, with a cause.

VARIANCE:aldgate

↓ 472 · SUSPECTED_MISPICK

WRITEOFF:aldgate

Aldgate's attestation will show the units entering variance at 11:04, sitting there for six hours, and being written off at 17:22 by two named people under a stated reason.

Quarantine

27 movements accepted but not yet reconciled. Each is a real physical action that failed validation on reconnect — quarantined, never rejected.

Ref	Item	Attempted	Qty	Operator	Device	Failed because	Evidence	Age
QRN-0091	88213-K	A/12/03 → cust-8871	6	op-4471	TC-52-014	Bin emptied while offline	scan photo	3h 12m
QRN-0090	55810-Q	B/09/07 → B/09/08	24	op-1180	TC-52-022	Destination bin merged	scan	2h 40m
QRN-0089	73390-X	F/01/02 → VARIANCE:kestrel	96	op-3302	TC-52-031	Count session already closed	scan	1h 08m
QRN-0088	29944-H	EXTERNAL:acme → B/09/07	500	op-2210	TC-52-009	Lot deleted during merge	scan photo	55m

Devices

48 enrolled handhelds. Offline is an ordinary condition here — racking dead zones, cold rooms that behave like Faraday cages, and trailer interiors are daily, not exceptional.

Synced42

Offline664 queued writes

Clock skew > 5m1

Battery < 20%3

Device	Model	Operator	Zone	Last sync	Queued	Skew	Batt	State
TC-52-014	Zebra TC52	op-4471 · S. Okonkwo	A/12	14:26:33	0	24ms	78%	Synced
TC-52-031	Zebra TC52	op-3302 · M. Dube	F/01	13:48:02	3	—	41%	Offline 38m
TC-52-007	Zebra TC52	op-1180 · A. Reyes	C/02	13:12:55	61	—	16%	Offline 74m
TC-52-044	Honeywell CT30	op-2210 · J. Halloran	A/01	14:20:11	0	41m	92%	Clock skew

Owners

Whose goods these are. Distinct from the tenant — this is the entity Sortly and Zoho have no concept of, and the axis every table, permission and attestation partitions on.

Owner	Contract	Sites	SKUs	Units held	SLA weight	Threshold	Open variances	Portal
Kestrel Foods	MSA-2024-0088	SITE-4, SITE-9	612	184,220	1.2×	£500	188	Active	Attest
Northvale Ltd	MSA-2025-0141	SITE-4	338	71,904	1.0×	£500	94	Active	Attest
Aldgate Supply Co	MSA-2026-0007	SITE-4	241	29,118	1.4×	£250	118	Active	Attest
Penrose Group	MSA-2026-0114	SITE-9	93	11,662	1.0×	£1,000	12	Onboarding	Attest

Kestrel Foods

Active

Contract MSA-2024-0088 · onboarded 2024-03-02 · SITE-4, SITE-9

Disputes (1) Generate attestation

Units held184,220

Active SKUs612

Open variances188£6,204 exposure

Attestations41last 2026-08-01

Contract terms

SLA weight: 1.2× — applied to variance exposure ranking
Reconciliation SLA: 24 hours from variance raise
Dispute response: 4 hours
Disposition threshold: £500 — above this needs a 2nd approver
Retention: 18 months hot, then cold archive
Portal access: 3 users · read-only, owner-scoped

Disposition reasons

Configured per owner. A reason set that does not match how this client actually operates produces dispositions nobody can defend.

SUSPECTED_MISPICKMISLABELLED_RACK DAMAGE_UNRECORDEDSUPPLIER_SHORT_SHIP COUNT_ERRORTHEFT_SUSPECTED

Attestation

A point-in-time account of what we hold for a client, readable by someone who has never been in a warehouse, with every line traceable to the movements that produced it.

Kestrel Foods · as at 2026-08-19 14:26 UTC

Chain verified

Item	Description	Lot	Held at	Units	Note
88213-K	Ambient pallet wrap	LOT/2026-0114	Tilbury DC	1,635	—
88213-K	Ambient pallet wrap	LOT/2026-0088	Tilbury DC	212	Expiring 44d
73390-X	Frozen carton, 12 × 400g	LOT/2026-0201	Tilbury DC	4,096	—
88214-M	Chilled tray liner	LOT/2026-0177	Tilbury DC	212	—
88213-K	Ambient pallet wrap	LOT/2026-0114	Awaiting reconciliation	6	Quarantined 3h
88213-K	Ambient pallet wrap	LOT/2026-0114	Variance account	12	Under investigation
73390-X	Frozen carton, 12 × 400g	LOT/2026-0201	Awaiting reconciliation	96	Quarantined 1h

7 lines · 184,220 units total across 612 SKUs seq 1,000,412

Why the last two rows matter

Most inventory systems would show this client 184,202 units and say nothing about the other 18. Here the quarantined and variance units appear on the client's own statement, with their age and status, because every unit is always in an account. "Unaccounted for" is not a state this system can represent.

Chain

Head seq: 1,000,412
Head hash: 9f3a44e1…c1f2
Verified: 2,214,908 rows
Anchored: Not yet — see below

Open question: a hash chain proves the record was not altered by anyone who does not control the database. It does not, on its own, prove anything to a court about an operator who controls their own backups. Daily Merkle-root anchoring to an external service is the fix, and whether it is legally necessary is a question for a logistics contracts lawyer, not a designer.

Disputes

Raised by clients against a specific balance line. Bound to the ledger position, so the resolution stays attached to the record it resolved — rather than living in someone's inbox.

Ref	Owner	Item	Position	Disputed	Our figure	Raised	SLA	Status
DSP-0044	Kestrel Foods	88214-M	C/02/11	252	212	12:02	1h 36m left	Open	Trace
DSP-0043	Aldgate Supply Co	29944-H	VARIANCE:aldgate	500	0	Yesterday	Breached	Investigating	Trace
DSP-0042	Northvale Ltd	90551-B	A/04/18	400	0	2026-08-14	Met	Resolved	Trace

DSP-0044 · what the account manager can answer without phoning the site

12:02 Client asserts 252 units at C/02/11

13:58 C/02/11 → EXTERNAL:cust-8871 · 200 · PICK · op-1180 · b3f0…7c

09:15 EXTERNAL:acme → C/02/11 · 412 · RECEIPT · op-2210 · d18a…52

08:02 Opening balance 0

412 received − 200 picked = 212. The client's 252 predates the 13:58 pick.

Suppliers

Integration-facing and deliberately thin in v1. In a 3PL the operator does not own the goods, so replenishment is the client's decision — we record what arrives, we do not decide what should.

Supplier	Account	Owner	Channel	Open POs	On-time	Last inbound	Status
Acme Supplies Ltd	EXTERNAL:acme	Kestrel Foods	EDI 856	4	96.2%	14:01	Active
Brookfield Packaging	EXTERNAL:brookfield	Northvale Ltd	CSV	2	88.0%	Yesterday	Active
Halden Cold Chain	EXTERNAL:halden	Kestrel Foods	REST	1	99.1%	2026-08-17	Active
Penrose Direct	EXTERNAL:penrose-d	Penrose Group	Manual	0	—	—	Onboarding

Purchase orders

Inbound expectation versus what actually arrived. A PO is not stock — nothing here affects a balance until a receipt posts movements.

PO	Supplier	Owner	Expected	Lines	Ordered	Received	Open	Status
PO-9912	Acme Supplies Ltd	Kestrel Foods	2026-08-19	3	2,400	1,800	600	Part received
PO-9908	Halden Cold Chain	Kestrel Foods	2026-08-17	1	4,096	4,096	0	Closed
PO-9915	Brookfield Packaging	Northvale Ltd	2026-08-21	2	8,000	0	8,000	Awaiting
PO-9901	Acme Supplies Ltd	Kestrel Foods	2026-08-12	4	12,000	11,400	600	Short — claim open

Reservations

Soft claims against available stock. Not movements — a reservation has not moved anything. available = on_hand − active_reservations, checked under the same per-position lock as a post.

Ref	Order	Owner	Item	Position	Reserved	On hand	Available	Expires	Status
RSV-3301	SO-77401	Kestrel Foods	88214-M	C/02/11	200	212	12	16:00	Active
RSV-3302	SO-77402	Kestrel Foods	73390-X	F/01/02	512	4,096	3,584	18:00	Active
RSV-3299	SO-77398	Aldgate Supply Co	55810-Q	B/09/07	24	76	76	Expired 13:00	Expired
RSV-3288	SO-77390	Kestrel Foods	88213-K	A/12/03	120	1,204	1,084	Tomorrow	Active

Open architectural question

Reservations currently live beside the ledger rather than in it, on the reasoning that a reservation has not moved anything. But RSV-3299 expired at 13:00 and simply stopped applying — which is an unrecorded state change, and a client auditing why stock was unavailable at 12:55 has nothing to look at. Moving reservations into the ledger as zero-quantity claim events is the likely resolution, and it is not settled.

Users

Membership binds a user to a tenant, then to a site scope, then to an owner scope. All three are enforced by row-level security, not by the application.

User	ID	Role	Site scope	Owner scope	Auth	Last active	Status
R. Vance	adm-0004	Tenant Admin	All sites	All owners	SSO · Okta	14:22	Active
D. Ferreira	mgr-0088	Ops Manager	SITE-4	All owners	SSO · Okta	14:19	Active
K. Adeyemi	ctl-0331	Controller	SITE-4	Kestrel, Aldgate	SSO · Okta	14:26	Active
S. Okonkwo	op-4471	Floor Operator	SITE-4 · zone A	Active work only	Badge + PIN	14:26	On shift
M. Dube	op-3302	Floor Operator	SITE-4 · zone F	Active work only	Badge + PIN	13:48	Offline
T. Bright	cli-0912	Client User	— none	Kestrel Foods only	Portal	Yesterday	Active

Client users have no site scope at all. They never see warehouse layout or operator names — only their own goods.

Roles

Six roles. The greyed cells are not "not yet built" — several of them are constraints the database refuses to allow, including for the role that can do everything else.

Capability	Tenant Admin	Ops Manager	Controller	Floor Operator	Client User	Service acct
Post movements	Yes	Yes	Yes	In scope	—	Scoped
Read balances	All	Site	Site	Active work	Own owner	Scoped
Open / close count sessions	Yes	Yes	Yes	—	—	—
Dispose variance below threshold	Yes	Yes	Yes	—	—	—
Approve variance above threshold	Yes	Yes	Not own	—	—	—
Void a document	Yes	Yes	—	—	—	—
Grant roles / onboard owners	Yes	—	—	—	—	—
See other owners' data	Yes	Site	Assigned	No	Zero rows	Scoped
Set a stock quantity	Impossible	Impossible	Impossible	Impossible	Impossible	Impossible
Modify or delete a movement	Impossible	Impossible	Impossible	Impossible	Impossible	Impossible

Why Tenant Admin cannot do these two things

Not a policy that an admin could change, and not a permission flag with a default of false. The application role holds no UPDATE or DELETE grant on either table — there is no privilege to escalate to, because the privilege was never created.

UPDATE stock_movement SET qty = 100 WHERE id = ...;
ERROR:  OS001: stock_movement is append-only

UPDATE stock_balance SET qty = 100 WHERE ...;
ERROR:  permission denied for table stock_balance

There is no admin flag, support tool, or migration that turns this off. That is the whole product.

The honest risk

This position has never met an angry operations director at 2am during a peak-season count. There will be pressure for an override, and the answer is that there is none — the escalation path is a compensating movement with an executive reason code.

Whether that path is fast enough to be usable under real pressure is untested. If override requests turn out to be frequent and legitimate, the thesis is wrong and should be revised in daylight rather than defended.

Instrumented: count of 422 quantity_not_settable responses, and support tickets asking for an override.

Integrations

Honest about what is real and what is stubbed.

Connection	Type	Partner	Direction	Docs	Last message	24h	Status
Acme EDI	X12 via VAN	Acme Supplies	Inbound	856, 810	14:01	42	Stub
Kestrel WMS feed	X12 via VAN	Kestrel Foods	Bidirectional	940, 945	13:44	118	Stub
Halden REST	REST	Halden Cold Chain	Inbound	ASN	2026-08-17	3	Live
Brookfield CSV	CSV drop	Brookfield Packaging	Inbound	PO, ASN	Yesterday	1	Live
Owner webhooks	Webhook	All owners	Outbound	movement.posted	14:26	38,204	Live
ZPL print server	Network print	SITE-4	Outbound	4×6 label	—	0	Stub

API keys

Service accounts. Scoped per endpoint, IP-allowlisted, and with no interactive session — a key cannot log into this console.

Name	Key	Owner scope	Scopes	Rate class	Allowlist	Last used	Status
Kestrel ERP sync	os_live_8f21…9d33	Kestrel Foods	movements:write balances:read	document-write	2 CIDRs	14:19	Active
Portal read-only	os_live_4c88…a071	All owners	balances:read attestations:read	read	1 CIDR	14:26	Active
Scan gateway	os_live_e019…3d55	All owners	movements:write	scan-write	Site subnet	14:26	Active
Legacy BI export	os_live_2200…7712	All owners	reports:read	report	— any	2026-06-02	Stale 78d

Why scan-write is its own rate class

It has a reserved throughput floor per site that no other class can consume. Under global pressure, read and reporting traffic degrade first — always. The reason is a product reason, not an infrastructure one: a picker who receives a 429 writes on paper and reconciles at end of shift, which destroys the completeness of the ledger the entire product depends on. Every other class can wait. That one cannot.

Audit log

Everything that is not stock — role grants, location renames, threshold changes. Append-only and hash-chained like the ledger, but deliberately a separate table.

When	Actor	Event	Target	Before	After	Hash
14:02:11	adm-0004	threshold.changed	Aldgate Supply Co	£500	£250	a91c…44
13:40:55	ctl-0331	count_session.opened	CS-8812	—	zone A/12	7d02…19
11:18:03	adm-0004	role.granted	ctl-0331	Floor Operator	Controller	3e88…b2
09:44:20	mgr-0088	location.renamed	B/09/07	B/09/07-OLD	B/09/07	c410…7f
04:00:00	system	snapshot.completed	All positions	—	1,204,882 rows	0b57…e3
Yesterday	adm-0004	api_key.created	os_live_e019…	—	scan-write	9911…20

Settings

Every number on this page is a hypothesis — a guess with no usage data behind it. They are configurable precisely because none of them is defensible yet.

Variance

Hypothesis

Second-approver threshold GBP extended value per variance line. Set too low and managers rubber-stamp, which is worse than no threshold at all.

Session process-failure flag rate Percent of lines in variance. Above this, the session is flagged as one probable process failure rather than N independent losses.

Block self-approval above threshold

Enforced by a database constraint regardless of this switch. The toggle only controls whether the UI offers the action.

Retention & sync

Hypothesis

Hot ledger retention Months online before cold-tiering to Parquet. Should be set from real dispute lookback windows in 3PL contracts — currently anchored on nothing.

Device cache cap SKUs held per handheld. Almost certainly far larger than the real number of shift-active SKUs.

Clock skew badge threshold Minutes. Above this, human-facing timelines show a skew badge.

Operator idle re-prompt Minutes before a handheld locks. Shift and outbox survive the lock.

State gallery

Every empty, loading and error state in one place, so they can be checked against each other rather than discovered one at a time.

Empty — three distinct kinds

Collapsing these into one "no data" screen is a common and costly mistake. They mean different things and need different actions.

No movements posted

Nothing has moved at this site yet. Post the first movement to start the ledger.

Post movement

No movements match these 3 filters

Owner: Penrose · Zone: F/01 · Today. There is data here — your filters exclude it.

You don't have access to this owner

Your scope covers Kestrel and Aldgate. Request access from an administrator.

Loading

Skeleton — 400ms delay, no shimmer

Static opacity pulse, 0.6 → 1.0 over 1600ms. No travelling highlight — a shimmer sweep is horizontal motion across a data region. Nothing renders before 400ms, because a sub-400ms flash is more disruptive than the wait.

Spinner — only where shape is unknowable

Used when the result has no predictable shape. Loading is always scoped to the region that is loading — navigation and the scan affordance stay live. Never a full-screen block.

Error — four tiers, matched to recoverability

Reason code

A reason is required. Tier 1 — field. Error sits below the field it belongs to. No shake.

88213-K	Failed to post — bin emptied while offline. Tier 2 — row. The row is never removed; a failed record is still a record.

Offline is not an error · 3 queued — turns green and dismisses itself on drain

A recoverable error never gets a modal. Modals are for decisions, not notifications — an operator dismissing a modal mid-scan loses their place in the pick.

Error pages

Full-page failures. Each states the cause and a recovery path — never just a code.

403 — not in your scope

Your membership covers SITE-4 and two owners. Nothing outside that scope is readable from this account — including whether it exists.

Back to dashboard

404 — no such record

The document or item ID in this URL does not exist in your tenant. Check the reference, or search for it.

Search

500 — we could not read the ledger

Reads are failing. Writes are unaffected — keep scanning. Queued work is safe on device and will post.

Retry

TC-52-014

Enrolled

Device trusted

Who is on shift?

Every movement you post carries your operator ID, not this terminal's.

Start shift

op-4471 · TC-52-014

Online

Pick · SO-77401 · line 2 of 6

Scan the label

GS1-128 · Code 128 · QR

Go to

C/02/11

Pick

200

Item

88214-M

Chilled tray liner, 400 × 600

Confirm scan Can't complete

op-3302 · TC-52-031

Offline · 3

No signal · 3 queued

3 movements waiting

All three are saved on this device and will post in order when you get signal. Nothing here is lost by locking, rebooting or swapping the battery.

88214-M

A/12/03 → cust-8871 · 200

Queued

73390-X

F/01/02 → cust-8871 · 512

Queued

88213-K

A/12/03 → count CS-8812 · 1,192

Queued

Because every write is an append and never an update, these replay in order on reconnect. There is nothing to merge and no one's work to discard — if two of you worked the same bin offline, both movements survive.

Keep working

op-4471 · TC-52-014

Online

Count CS-8812 · bin 41 of 96

A/12/03

88213-K · Ambient pallet wrap

Counted 1,192

The expected figure is deliberately not shown until you submit. Seeing it first changes what people count.

Submit count

op-4471 · TC-52-014

Online

Posted

1,192 counted at A/12/03 · seq 1,000,412

Recorded on the server at 14:03:11. This is not a queued state.

Next task

Putaway

Take from

Dock 3 · pallet 4

Put to

F/01/02

Frozen · 12 bays free

Qty

1,200

Item

73390-X

Frozen carton, 12 × 400g · LOT/2026-0201

Scan destination Bin is full

op-3302 · TC-52-031

Offline · 3

Saved for review

Your record is kept. A controller will reconcile it.

What happened?

You moved stock but the system disagrees about the bin. We keep what you recorded — the movement already happened, and throwing away your record would destroy the only evidence of it.

Add a photo

Attached to the record permanently

Save and continue

OmniStock

Client portal

Your goods, held at Meridian 3PL

Read-only access to your own inventory, statements and disputes. You will not see any other client's data — not hidden, not filtered out at the screen: the database returns nothing.

OmniStock

Kestrel Foods

Sign out

Your holdings

As at 2026-08-19 14:26 UTC. Every figure traces to the movements that produced it.

Statement

Units held184,220across 612 SKUs

Awaiting reconciliation6oldest 3h

Under investigation12variance raised 14:03

Item	Description	Lot	Expiry	Units	Status
88213-K	Ambient pallet wrap, 500mm × 300m	LOT/2026-0114	2027-01-14	1,635	Held	Query
73390-X	Frozen carton, 12 × 400g	LOT/2026-0201	2026-12-01	4,096	Held	Query
88213-K	Ambient pallet wrap, 500mm × 300m	LOT/2026-0088	2026-10-02	212	Expiring 44d	Query
88214-M	Chilled tray liner, 400 × 600	LOT/2026-0177	2026-09-11	212	Queried	View
88213-K	Ambient pallet wrap, 500mm × 300m	LOT/2026-0114	—	6	Awaiting reconciliation	Query
88213-K	Ambient pallet wrap, 500mm × 300m	LOT/2026-0114	—	12	Under investigation	Query

Why the last two rows are shown to you

18 of your units are not currently on a shelf — 6 were recorded by a handheld that was offline and are being reconciled, and 12 are in a variance account after a stock count found fewer than expected. Most systems would simply show you 184,202 and not mention it. You are seeing them because every unit we hold for you has to be somewhere, including the ones we cannot currently put a hand on.

OmniStock

Kestrel Foods

Sign out

Statements

A point-in-time account of what we hold for you, signed and chain-verified.

Statement	As at	Lines	Units	Chain	Issued
ATT-2026-08-01	2026-08-01 00:00	612	179,004	Verified	2026-08-01
ATT-2026-07-01	2026-07-01 00:00	598	166,880	Verified	2026-07-01
ATT-2026-06-01	2026-06-01 00:00	571	154,220	Verified	2026-06-01

What "chain verified" means

Each movement affecting your goods is linked to the one before it by a cryptographic hash. Changing any historical record would break every link after it, which is detectable.

Rows verified: 2,214,908
Head hash: 9f3a44e1…c1f2

What it does not yet mean

The chain is currently held by Meridian. It proves the record has not been altered by anyone who does not control this database — it does not, on its own, prove that to a third party in a claim. Independent anchoring is on the roadmap and is not live. We would rather tell you that than let the word "verified" do more work than it has earned.

OmniStock

Kestrel Foods

Sign out

Raise a query

Bound to a specific line of your holdings, so the answer stays attached to the record it is about.

Response time

1h 36m remaining under
your 4-hour SLA

Your open queries

DSP-0044Open

DSP-0031Resolved

DSP-0022Resolved

OmniStock

A · Auth & scope

B · Overview

C · Catalog & locations

D · Movements

E · Counting & variance

F · Sync & exceptions

G · Owners

H · Client portal

I · Supply chain

J · Admin

K · Handheld · 390px

L · States

Sign in

Who is on shift?

Choose your scope

Screen locked after 15 minutes

42 operators on the floor

Movement throughput

Variance queue — ranked by exposure

Quarantine

Devices

Owners

Command palette

Alerts

Catalog

88213-K

Edit item · 88213-K

Identity

Physical

Balances

Locations

Physical

Reserved accounts

Lots & serials

Movement ledger

seq 1,000,412

Effect

Chain

Attribution

Clock

Post movement

Movement

Receiving

Fulfillment

Transfer

In-transit transfer

Two movements, not one

Title transfer

Paired document

What gets written

Count sessions

CS-8812

Disagreement on A/12/03

Variance triage

Dispose variance

Disposition

Separation of duties

What gets posted

Quarantine

Devices

Owners

Kestrel Foods

Contract terms

Disposition reasons

Attestation

Kestrel Foods · as at 2026-08-19 14:26 UTC

Why the last two rows matter

Chain

Disputes

DSP-0044 · what the account manager can answer without phoning the site

Suppliers

Purchase orders

Reservations

Users

Roles

Why Tenant Admin cannot do these two things

The honest risk

Integrations

API keys