#Hardware, peripherals and the device fleet

TL;DR

• Buying the hardware is easy; driving it is 13 eng-months and ~45% of your support tickets forever [estimate] — of which ~60% are printing, i.e. ~27% of all tickets. Canonical Domain D effort is 5.0 eng-months at MVP, 10.0 at v1 sellable (S1 cut), 13.0 at Full, +4.0 in v2 (of which 3.0 is v2 core, the P3 build, and 1.0 is v3 handheld SKU certification — see §10) — see 07 — Roadmap, Team and Budget for how that sits against the 125 eng-month total.
• Certify six SKUs, not twenty. v1 ships one till family (Sunmi D3 Mini/Pro GMS), one till printer (Epson TM-m30III all-interface, C31CK50152, EUR 314.87 [verified]), one kitchen printer (Epson TM-U220II impact), one CloudPRNT printer (Star TSP143IV), one KDS (Elo I-Series 4), one router (Teltonika RUT241). Every additional SKU costs ~0.25 eng-months to certify and 0.25 eng-months/quarter forever to keep certified.
• Per-site hardware: EUR 1,374–1,764 (café) · EUR 4,900–5,800 (40-seat bistro, 2 tills + kitchen) · EUR 11,800–13,400 v1-shippable / EUR 14,300–15,900 with v3 handhelds (120-seat multi-station, and that site is out of v1 scope). The café figure carries the verified GMS till price of EUR 579 (§2.1); canon §5.5 has been corrected from EUR 1,260–1,650 to match. Sold at cost + 15%, which is a 10–13% gross margin after freight, spares and DOA, ~EUR 700–900 of working-capital float per site for 30–90 days.
• The router and a validated AP are a contractual precondition of installation, not a recommendation. Without them peer sync cannot establish on an AP-isolated network and we owe 1.5–2.0 eng-months of cloud-relayed peer path nobody costed. Anything that prints gets a cable.
• Do not build hardware. The BOM saving is EUR 0 at white-label tier and EUR 60–120/unit at custom tier, recoverable only after 3,000–8,000 units — against CE + GPSR + WEEE + Battery Regulation + CRA producer liability. Note the sting: the CRA does not spare us anyway. Our installable Android app plus the backend it requires to function are plausibly a "product with digital elements" regardless of whose logo is on the tablet [verified — CRA reporting obligations from 11 Sep 2026, full application 11 Dec 2027].
• Hardware operations cost EUR 25–43/Site/month at 100 Sites against the canonical EUR 110–130/Site/month subscription (POS+CRM+KDS, excluding payments residual and messaging). That number, not the BOM, is why the certified matrix stays small and why the in-app Device Health screen is MVP scope.

Cross-references: card-reader commercial choice and PCI posture live in 04 — Payments, fiscalisation, privacy and security; the offline/Coordinator/Epoch semantics that print dispatch depends on live in 02 — System architecture; install-day labour and CAC live in 07 — Roadmap, Team and Budget.

#1. The five rules that generate everything else

R2 has one consequence people miss: on the TM-U220II impact printer a 40-line raster Ticket takes ~2.5 s against ~0.8 s for text [estimate]. That is acceptable at counter-service volumes and is the price of never owning a code-page table. Reinstate the text fast path on the first Customer who measures it and complains.

#2. The certified hardware matrix for v1

Prices are single-unit EU reseller, ex VAT. "Tier" is the canonical scope tier the SKU first appears in (see 05 — The CRM Product and Scope Tiers).

#2.1 The one price in the matrix I do not believe

Canon fixed the Tier A till at Sunmi D3 Mini GMS, EUR 465. The nearest thing I can verify is the D3 Mini GMS with the 80 mm printer at EUR 579 [verified 2026-08-18, shopnfc.com single-unit listing]; r01's EUR 465 anchor was the non-GMS SKU, and R3 forbids non-GMS. The gap is the EUR 30–260 GMS/EDLA delta [verified from the r01 price table]. The verified EUR 579 wins and canon §5.5 has been corrected to match: the Tier A BOM total is EUR 1,374–1,764, not EUR 1,260–1,650 — the canonical pair of verified till prices is now EUR 579 (D3 Mini GMS) / EUR 639 (D3 Pro GMS), and no other figure should be quoted for either SKU.

Reading: EUR 465 is a distributor number, not a retail number. It is reachable at 28–40% off list at 50+ units/yr [estimate], which we will not have until P2. Until a distributor account exists, quote and budget the till at EUR 579 — that is what the corrected EUR 1,374–1,764 Tier A range already assumes — and treat any distributor discount as upside, not as the plan. This is the highest-value line item in the P0 procurement work: get written quotes from Jarltech, Logiscenter, ITG Store and Sunmi EU direct for a 100-unit annual commitment on D3 Mini GMS, D3 Pro GMS, TM-m30III, TM-U220II and TSP143IV.

#2.2 What we explicitly do NOT support in v1

Publishing this list saves more engineering time than any feature. It goes in the MSA and on the website.

#3. Per-site BOM at three Site sizes

#3.1 Size 1 — café / bakery, 1 till (the canonical ICP Site)

Sold at cost + 15% → EUR 1,580–2,030 invoiced, EUR 206–265 gross before freight and the spare-pool allocation. Cost + 15% is 13.0% of revenue before freight, spares and DOA, so the achievable hardware gross margin is 10–13%, not the 15–25% canon §5.5 previously stated (corrected). This BOM does not pay anybody's salary; it exists to control the install.

#3.2 Size 2 — 40-seat bistro, counter-service, 2 tills + kitchen

A 40-seat bistro that runs table service is not a v1 Customer. Canon restricts the ICP to counter-service, single-station-first; table plans, coursing, seat splits and handhelds are v3 — they moved out of the P3 build when the v2 tier was split into v2 core (T2 LAN multi-station, UA/PL fiscal, guest ordering + QR PWA + Wallet passes, card-linked identity, Brand Vouchers, WhatsApp/Viber, segmentation, the payments-attach machinery) and v3 (P4 and later). Table service and the handheld waiter app serve a different ICP than canon §1's counter-service-only, single-station-first shape and cannot be funded before the counter-service base is at ~150 Sites. If this Site wants tableside ordering, add 2 × Sunmi V3 Mix (EUR 1,150) and 3 spare batteries, and quote the software as v3.

#3.3 Size 3 — 120-seat multi-station (out of v1 ICP; costed so sales can say no with a number)

[estimate throughout — derived from the canonical unit prices, not a canonical BOM]

Three honest notes on this tier. (a) It needs T2 LAN multi-station — elected Coordinator, Epochs, fencing — which is v2 core, the P3 build (+9.0 eng-months in Domain A). Selling it in v1 is selling a product that does not exist. (b) Networking is EUR 2,000–3,600 = 17–27% of the bill, and the Customer has budgeted EUR 0 of it. (c) Install is 2 people × 2 days, not 5–8 hours; the canonical EUR 550–1,400 install cost is a Tier A/B number and does not hold here.

#3.4 Rules that are part of the BOM, not commentary

• GMS/EDLA SKUs for anything running our app (R3).
• Kitchen printers are impact, never thermal — thermal paper fades to black near a pass. Two-colour is used for allergens and 86'd items.
• Cash drawer voltage is specified with the printer, always. A 12 V drawer on a 24 V DK port burns out. This is the classic destroyed-hardware incident and it is entirely preventable by never selling a drawer separately.
• Spare pool 5–8% in-region · 1 spare card reader per 25 live units · 2–4% RMA/DOA reserve.
• Device lab capex EUR 8–12k for rig 1, second CI rig EUR 8–10k by M12. Without the lab every estimate in this document is fiction.
• Re-certify the matrix every 18 months at 0.25 eng-months/quarter forever. Sunmi and Elo refresh SKUs on a 24–36 month cycle; your runbooks decay with them.

#4. How each peripheral class is actually driven

#4.1 The print dispatch path, with the Epoch

Print dispatch is the one peripheral path that touches the correctness core. Every print job carries the durable monotonic Epoch the Coordinator stamped on it; a Device that loses an election stops dispatching. Ticket numbers are cosmetic in the fiscal sense — they are never allocated by the fiscal component and carry no legal meaning — but they are the only human dedupe primitive when fsync turns out to be dishonest (assumption A7), so they are printed in 24 pt and monotonic per Station.

Two properties of this diagram are non-negotiable. CloudPRNT gives genuine at-least-once with dedupe because the printer acks the job ID — that is the technical reason kitchen and bar printers are pull, not push. Raw 9100 has an irreducible ambiguity window — the printer may print and then lose power before your socket flushes — which is why the verify queue and the printed Ticket number exist, and why an engineering-led argument says sell the KDS, not the printer, wherever the Customer will take it.

The fallback chain needs a rate limit that nobody writes down until it bites: when a kitchen switch dies, 40 open Tickets fail over to the expo printer at once and print in queue-drain order rather than fire order. Per-Station ordering by fire time, plus a cap dialog — "40 backlogged Tickets — print all / print summary?" — is 0.2 of the 1.3 eng-months in the health/failover line.

#4.2 Discovery and addressing

The install wizard confirms identity by printing the Station name in 48 pt and asking the installer which physical printer produced it. There is no other reliable way to know which box is the grill.

#5. In-restaurant networking and the standard install kit

#5.1 The requirement, stated as a contract clause

~70% of SMB Sites have an ISP all-in-one with no VLAN support [estimate, r01]. That is why we ship the router. The alternative — accepting a flat network — is survivable for a single-station Site (device-level auth, mTLS everywhere, no LAN trust) and is not survivable at T2, because AP/client isolation blocks L2 between peers.

#5.2 Standard install kit (one flight case per installer)

The site-survey checklist is not optional and it is the cheapest churn prevention in the plan: socket count and position at the counter · run length from the router to each print point · listed/heritage building? · does the ISP CPE allow static leases? · does the existing AP have client isolation on? · is there a 4G signal in the cellar? A Site that fails the survey is quoted network remediation before the contract, not discovered on install day.

#6. Zero-touch provisioning and MDM

#6.1 The happy path: 4 Devices live in 25–35 minutes

1. Devices ship pre-registered: either the reseller enrols them in Android zero-touch (GMS/EDLA only), or we ship a printed QR provisioning card in the box. The QR carries PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME, the base64url SHA-256 signature checksum, the DPC download URL, the Site Wi-Fi SSID/PSK, and an admin extras bundle with { "site_claim": "K7M-4T2", "role": "TILL" } [known — key names stable across API 26+].
2. Installer powers on, taps the welcome screen 6×, scans the card. Device joins Wi-Fi, downloads the DPC, becomes Device Owner. ~4 min/Device, mostly download.
3. DPC applies policy: setLockTaskPackages + startLockTask, factory reset disabled, USB debugging disabled, setSystemUpdatePolicy(TYPE_INSTALL_WINDOWED, …) — window configured relative to the Site's Business Day close, never hard-coded to 03:00–05:00 (see §9, failure #4).
4. Our app launches, reads site_claim, calls home, self-assigns its Station role from the pre-built Site plan in back office.
5. Printer wizard: mDNS + Epson UDP 3289 + ARP sweep → 48 pt test print per printer → assign static IP, record MAC, stick the physical label. 6–10 min.
6. Menu Snapshot, staff, PINs, tax config, signed config bundle sync down. Site is live.

Device Owner can only be established at factory-reset time. A Device an installer "just set up normally" can never be silently updated again without a wipe. The 20-minute runbook is therefore a product requirement, not ops hygiene.

#6.2 The 20% that misses the happy path — the real budget

#6.3 MDM: buy the OS bits, build the product bits

Remote control does not exist on iOS and costs Esper money on Android. Therefore the product must be self-diagnosing: a Device Health screen on every Device (printers green/amber/red, last sync, unsynced Check count, WAN/LAN state, app version, free storage, thermal) plus a single "Send diagnostics to support" button returning a 6-character reference the staff member reads over the phone. This one screen removes an estimated 30–40% of support call time [estimate, r08] and is MVP scope.

Telemetry volume: 6 Devices × 1,440 heartbeats/day × ~200 B ≈ 1.7 MB/Site/day → ~50 MB/Site/month [r08]. Compress and batch on-device — CEE Sites run on metered LTE during outages.

#7. Support, RMA and spares: what it costs per 100 Sites

Assume a realistic P2 mix: 70 Tier A + 30 Tier B Sites, ~EUR 270,000 of hardware deployed (70 × the corrected Tier A mid-point of ~EUR 1,570 + 30 × the Tier B mid-point of ~EUR 5,350), ~450 devices in the field (130 tills, 90 printers, 30 KDS, 100 routers, 100 UPS).

Fixed costs allocated on top, not per 100 Sites: device lab EUR 8–12k capex (rig 1) + EUR 8–10k (CI rig 2 by M12); matrix re-certification 0.25 eng-months/quarter forever ≈ EUR 6,000/yr loaded [estimate at EUR 6k/eng-month]; hardware SKU rot 1–2 eng-months/yr [c03].

Working capital. At cost + 15% with 30–90 days between order and collection, each Site carries EUR 700–900 of float [r09]. At P2's 40–60 Sites that is EUR 28–54k standing; at 300 Sites and a Tier-B-heavy mix it is EUR 200k+ — a real reason to route hardware through the distributor's own financing or a leasing partner as soon as volume allows.

The one operational rule that decides whether this scales. One support FTE covers roughly 400–700 Sites on hardware tickets alone at 0.6–1.2 hardware tickets/Site/month and 15 min AHT [estimate, r01]. That is only true if remote diagnostics ship before Site #100. Build the printer status page, the "send test print" button, the network self-test and the one-tap log upload during P1, or gross margin evaporates into a phone queue — and canon's hard stop ("two consecutive quarters in which support headcount grows faster than Site count") fires.

#8. Build our own hardware? No — and the reason is not the BOM

#8.1 What "build your own" costs at each tier

Indicative BOM for a 15.6" Android AIO with printer: USD 217–355, ODM invoice at ×1.4–1.6 = USD 310–520 [estimate, r01]. Against a Sunmi D3 Pro GMS at EUR 639 retail / ~EUR 400 at distributor pricing, T1 saves nothing and T2/T3 recover their NRE only after 3,000–8,000 units. S1 will not ship 3,000 units inside the plan; S2 might, in year 4.

#8.2 The regulatory bill you inherit the moment your logo is on the box

#8.3 The sting: reselling does not exempt us from the CRA

R4 keeps CE/GPSR/WEEE/Battery with the OEM. It does not obviously keep the CRA there. Pure browser-consumed SaaS is out of scope, but downloadable/installable software with a data connection is a product with digital elements, and a remote data-processing service that the product needs to function correctly is pulled into scope with it [verified — DLA Piper and EC CRA guidance, Aug 2026]. Our Android APK is installed on Devices and our backend is necessary for it to function correctly. The conservative planning assumption is therefore:

We owe SBOM, coordinated vulnerability disclosure, a documented support period and vulnerability/incident reporting to ENISA + national CSIRT (24 h early warning / 72 h notification / 14-day final report) from 11 Sep 2026, whether or not we ever brand a device. [verified on the dates and the reporting clock; [estimate] on our own scoping — this needs a counsel opinion, and it is the same EUR 3–5k conversation as A4]

That reframes the build-vs-buy verdict honestly: reselling saves us the device compliance stack (worth EUR 100k+ per SKU and per-country WEEE admin) but not the software one. Budget the CRA work as a platform line in 08 — Pros, cons, difficulties and risks, not as a hardware line.

#8.4 Verdict

Resell OEM-branded devices in our own bundle: our box, our quick-start card, our pre-provisioned config, our SIM, our support number. The Customer gets the perceived integration of own hardware; we get none of the producer liability. Square/SumUp/Toast build hardware because they are payments-led and subsidise the device against interchange at 100k+ unit volumes; Lightspeed, Revel, Storyous and Dotypos do not, because they are software-led and hardware is a channel cost. We are software-led with a payments residual, not an acquirer.

Reconsider only when all three are simultaneously true: (a) >3,000 terminals/yr, (b) we are merchant-of-record on payments so hardware can be subsidised, (c) a dedicated hardware/ops hire exists. Any one alone is a trap. The T3 hub SKU is cancelled permanently — canon, and correct: correctness must never depend on a box in a 45 °C cabinet.

#9. Top 10 things that break in production

Twelve rows for a "top 10" table, because #8 and #12 are the two that are invisible until they are expensive.

#10. Engineering effort — Domain D, reconciled

This is the canonical Domain D roll-up. It excludes the KDS/CFD/POS applications (Domain C), payment terminal integration (Domain E), and the offline/Coordinator core (Domain A).

Each column shows new work in that tier; the total row is cumulative and matches the canonical Domain D figures (5.0 / 10.0 / 13.0 / +4.0).

The canonical +4.0 v2 delta is unchanged, but it now straddles the v2-core/v3 split: 3.0 is v2 core (KDS SKUs 2–3 + bump-bar remapping, the UA/PL printer matrix incl. the GUM-homologated kasa-online printer, scales, matrix re-certification) and 1.0 is v3 (handheld SKU certification), because the handheld waiter app moved out of the P3 build. Domain D's contribution to the P3 build is therefore 3.0 eng-months, not 4.0.

AI assistance is already baked in at ≈1.25× for this domain [canon]. It helps with ESC/POS and ZPL emission and the layout DSL; it helps not at all with "the Sunmi AIDL service unbinds after 4 h idle", a TM-U220II needing ESC @ after a cutter jam, an Elo panel reporting the wrong Configuration.orientation on a landscape-locked screen, or anything requiring a physical Device on a desk. Certification queues, physical install and RMA logistics compress by 0%.

#11. Open items this document cannot close