Pizza pe Bune: from GloriaFood and a phone's contact list to one system

Every restaurant already has an operating system. It is made of a shout across the pass, a printed slip held down by a jar, a waiter who remembers that table six has already had the bread, and a courier counting cash out of his own pocket at the end of the night. It works, in the sense that food reaches people. It does not close a shift by itself, it does not survive somebody being ill, and it cannot tell the owner on Tuesday what Monday actually cost.

The website was the part that already had software, and it turned out to be the easy half. What a public checkout has to do is refuse things: too small an order, an address outside the delivery zones, a kitchen that is closed. All of that is a gate, and gates are well-understood. The order that arrives at a table has to pass none of it, and that difference is most of the engineering.

A table is already seated. Nobody is going to tell four people at nine in the evening that the kitchen shut at half past eight, and nobody is going to enforce a minimum order on a couple who want one more coffee. So the floor has its own route in. The waiter builds a draft against the table’s session rather than against a customer — a table does not have a customer, and pretending it does is where this design usually goes wrong — and sends it in waves. Starters now, the rest when they have decided. Each wave becomes an order in its own right, with its own tickets, and a wave is sent whole or not at all.

Which leaves the question of what the table owes, and the answer is that nothing stores it. The bill is derived across every wave in the session, every time it is asked for. Payments against it are entries in an append-only ledger, never a running total on a column, and they settle on coverage rather than on equality: four people paying for six is normal, and somebody absorbing the difference is a decision a person makes and the ledger records, not an arithmetic error the software has to hide. Closing a session asks for a signature and a reason. A reversal is a negative entry, not a deletion.

The kitchen sees none of that complexity, which is the point. An order breaks into tickets by production station rather than by menu category, because categories are a menu’s idea and stations are a building’s. The bar sees its own slice and announces that it is ready; the kitchen sees the announcement on the card and is the only station that can close the order. Two screens, two different kinds of authority, one map from a staff member’s abilities to what they are allowed to see — and the same map serves the web panel and the Android app, so the two cannot drift into disagreeing about who sees what.

Printing is where the theory meets the hardware. The server never talks to a printer. It publishes print jobs; a tablet in the kitchen claims one, drives the thermal printer over Bluetooth itself, and reports the result. The claim is the interesting part: it is locked on the pair of account and device, not on the account, because the first version compared only accounts and two tablets on the same kitchen login produced exactly the double paper the lock exists to prevent. Failed attempts are logged rather than retried blindly, a reprint is something a human asks for, and there is an absolute ceiling per station. Bluetooth thermal printers fail often enough that all of this is load-bearing rather than defensive.

Money closes the same way it is taken. A courier’s cash is a ledger, opened by the first delivery rather than by a button, and the entry is written by the delivery being marked delivered rather than by anyone pressing anything. The session belongs to a person in a role, not merely to a person, so the same human waiting tables and driving later in the week keeps two separate envelopes. Closing is blind: you declare what you are handing over, and only then does the system show you the difference.

The staff app is a single Android binary that becomes six different products depending on who signs in: kitchen, bar, printer, courier, waiter, owner. The courier’s screen is the one that had to work with no signal — everything needed for one delivery in one request, cached, with the route through pick-up, en route, arrived and delivered available from a van in a courtyard. Push notifications and a live channel keep the screens current; a device holds its own token, so disabling somebody removes the panel, the app and the phone at once.

Pizza pe Bune runs on Restaurant OS, the same system as Erra and the two Prestij restaurants.