System Boundaries

Place each piece with the tier test. Apply the questions in order and stop at the first yes. The check-digit math is a generic mechanism any app could need, so it belongs in core. The rule "refuse bad labels at dock 4" is this warehouse's policy and stays in the app.

# Ask in order; the first yes decides the tier.
# core      a generic mechanism any app could need, with no scenario
#           value, choice or policy baked in        -> C and t.* libraries
# kit       a reusable authoring capability several
#           interfaces compose, with no branding     -> first-party .tri
# app       users, scenes, schema, handlers, data
#           and declared policy                      -> config plus .tri
# product   skin, arrangement, storefront, pricing  -> config plus .tri,
#                                                       its own repository

Lay the app out by convention. a/ is code both builds share, s/ is the server, and c/ is the scanner client. A leading _ marks a folder the runtime reads, and an unknown one refuses instead of being ignored.

palletyard/
  a/                       shared: compiled into every build
    audience.tri           the audience flagset every unit reads
    labels.tri             label rules both sides run
    _security/             access policy vocabulary every build knows
    _test/                 tests beside the code they prove
  s/                       the server build only
    main.tri
    holds.tri              receives hold requests
    _auth/                 the sign-in realm; a client build refuses it
    _security/             private access implementations
  c/                       the scanner build only
    main.tri
    scan.tri
  _db/
    troves/holdNote.tri    the store is the server's
  _app/  _grant/  _host/  _target/

Put shared vocabulary in a/ and protected data behind an audience. A declaration's locality is the root of its unit. The hold-note trove crosses only to connections granted supervisor or admin, so a scanner is never pushed a note row.

# a/audience.tri: the one declaration every audience row names.
flagset audience { scanner = 1, supervisor = 2, admin = 4 }

# _db/troves/holdNote.tri: pushed only at a supervisor or admin grant.
trove holdNote {
    audience = supervisor | admin
    u64 pallet = 0
    text body = ""
}

Cross from client to server only with send. The scanner asks the server to place a hold, and the server decides. A plain dotted reach from c/ into s/ refuses at compile, and so does a send to a handle the server never declared.

# c/scan.tri: a scanner asks; it never writes the note itself.
void askHold(u64 pallet, text reason) {
    send s.holds.place(pallet, reason)
}
# s.holds.place(pallet, reason) without send refuses at compile.

# s/holds.tri: only a supervisor connection may place a hold.
handle place(const ctx, u64 pallet, text reason) require (ctx.audience.has(audience.supervisor), "supervisor audience") {
    holdNote.insert({ pallet = pallet, body = reason })
}

The C underneath follows the same direction. A node includes only the public headers of strictly lower nodes. The math library can use the type registry but never the database engine. An include that points up stops the build.

/* A Keel source: Keel is a tier-2 node. */
#include "keel/keel_time_civil.h"       /* its own area's contract */

#include <stddef.h>
#include <stdint.h>
#include <string.h>

#include "mertektypes/mertektypes.h"   /* tier 0: strictly lower */

/* #include "merdb/merdb.h"   refused: MerDB is tier 4, above Keel */