Domain Invariants & Business Rules (“The Law”)

The POS domain enforces a strict set of business invariants. These rules are non-negotiable constraints that protect cash accountability, transaction integrity, checkout correctness, and auditability across every retail location.

---

1. Active Session Prerequisite

Zero commercial transactions or receipt issuances can occur on a terminal without an explicitly opened session and a recorded opening float.

Session Prerequisite Rules

Rule	Invariant
Session Required	Every sale, refund, cash drop, and petty expense must belong to an active shift session.
Opening Float Declaration	A session cannot be opened until the cashier declares and confirms the opening float amount.
Terminal Lock	A terminal without an active session operates in a locked or training mode only; no financial transactions are recorded.
Single Active Session	Only one session may be active on a terminal/drawer at a time.
Cashier Authentication	The cashier must be authenticated against Identity policies before opening a session.

Business Consequence

If a terminal attempts to process a transaction without an active session:

• The transaction is blocked.
• An audit event is recorded.
• The cashier is instructed to open a session or escalate to a supervisor.

---

2. Immutability of Closed Shifts

Once a POS session is closed and the cash drawer is reconciled, the session ledger, recorded sales, cash movements, and closing counts are permanently sealed against retroactive edits.

Closed Shift Rules

Rule	Invariant
No Post-Close Editing	Transaction lines, tender amounts, cash drops, petty expenses, and closing counts cannot be edited after session close.
Sealed Discrepancy	The overage or shortage amount recorded at close is final; corrections occur downstream via compensating journal vouchers.
No Deletion	Session records and receipts are never deleted; corrections require compensating documents.
Audit Chain	Every closed session links opening count, all movements, closing count, and discrepancy into an immutable chain.

Correction Path

Errors discovered after session closure are corrected through:

• Compensating Variance Journal in FMS for drawer discrepancies.
• Refund Receipt in a subsequent session for customer returns.
• Manager Adjustment Note for operational explanations, linked but non-mutating.

The original session remains sealed.

---

3. Non-Negative Tender Validation

Tendered amounts and calculated change cannot be negative. Total tenders received must equal or exceed the receipt value before transaction completion.

Tender Validation Rules

Rule	Invariant
Non-Negative Tender	Every tender amount must be zero or positive.
Non-Negative Change	Change due cannot be negative.
Total Tender Coverage	Sum of tender amounts must be greater than or equal to the receipt total.
Exact Change for Non-Cash	Card, wallet, and gift card tenders typically must match the charged amount exactly.
Cash Overpayment	Cash tender may exceed the total to enable change; change is calculated as tendered minus total.
No Refund Without Return	Negative tender (refund) is only permitted within a return/refund transaction context.

Change Calculation Formula

$$ \text{Change Due} = \sum \text{Tender Amounts} - \text{Receipt Total} $$

Change due must satisfy:

$$ \text{Change Due} \geq 0 $$

If the result is negative, the transaction cannot complete until additional tender is provided.

---

4. Strict Offline Monotonicity

Offline transactions generated during network disconnection must possess strictly ascending sequential counters per terminal to eliminate replay attacks and gap duplicates.

Monotonicity Rules

Rule	Invariant
Strictly Ascending	Each new transaction on a terminal uses the previous sequence number plus one.
No Reassignment	Sequence numbers are assigned at transaction creation time and never reused or reordered.
Gap Detection	Central systems reject or flag any sequence that skips ahead of the expected next value.
Duplicate Rejection	A transaction with a sequence already accepted is rejected as a replay.
Offline Continuity	Sequence counters persist across reboots and application restarts on the terminal.

Replay Protection

Scenario	Handling
Same sequence, same payload	Idempotently accepted; no double processing.
Same sequence, different payload	Rejected as conflict; requires manual investigation.
Sequence gap	Central system flags missing transactions; terminal must backfill before advancing.
Future sequence	Rejected until all intermediate sequences are received.

---

5. Cash Drawer Accountability

Every cash movement affecting the drawer must be recorded with a timestamp, operator, reason, and amount.

Cash Movement Rules

Rule	Invariant
All Movements Recorded	Sales, refunds, drops, petty expenses, and float adjustments are all logged.
Reason Required	Cash drops and petty expenses require a reason code or supervisor authorization.
Operator Attribution	Every cash movement is attributed to the active session operator.
No Drawer Removal Without Log	Physical removal of cash from the drawer must correspond to a recorded drop or expense.
Supervisor Override	Drawer overrides (e.g., forced open) require supervisor credentials and are audited.

---

6. Receipt Snapshot Immutability

Line item snapshots on a completed receipt are frozen at transaction time and cannot be altered.

Snapshot Rules

Rule	Invariant
Frozen Prices	Unit prices, taxes, and discounts are frozen on the receipt at completion.
Frozen Descriptions	Product descriptions and barcodes are frozen to preserve historical accuracy.
No Post-Sale Edit	A completed receipt cannot be edited to change amounts or items.
Correction via Return	Errors after completion are corrected through a separate return/refund receipt.

This ensures that historical receipts remain accurate even if central product prices or descriptions change later.

---

7. Tax Calculation Integrity

Taxes must be calculated according to the tax rules active at the time and place of sale.

Tax Rules

Rule	Invariant
Store Tax Jurisdiction	Tax rates are determined by the store’s registered tax jurisdiction.
Product Tax Category	Each line item uses the tax category assigned to the product at sale time.
Rounding Policy	Tax rounding follows the store’s configured policy (per line, per item, or per receipt).
Tax Total Reconciliation	Sum of tax lines must equal the total tax collected on the receipt.
Tax Exemption	Tax-exempt transactions require valid exemption evidence and are audited.

---

8. Summary of “The Law”

Invariant	Violation Consequence
No transactions without an active session and opening float.	Transaction blocked; audit event recorded.
Closed shifts are sealed and immutable.	Retroactive edits rejected; corrections via compensating documents.
Tender and change amounts cannot be negative.	Transaction rejected until valid tender is provided.
Offline sequences must be strictly monotonic.	Gaps/duplicates rejected or flagged for investigation.
Every cash movement is logged with reason and operator.	Missing movement triggers drawer discrepancy and audit exception.
Completed receipt snapshots are immutable.	Post-sale edits rejected; corrections via return/refund.
Tax calculation follows jurisdiction and product category rules.	Incorrect tax triggers compliance exception and reconciliation adjustment.

These invariants collectively ensure that the POS domain remains the authoritative source of truth for frontline retail transactions while preserving cash accountability, auditability, and operational resilience.