One application that replaced a decade of spreadsheets

The site was profitable and the operation worked, which is exactly why nobody had ever stopped to fix it. Every department had built its own workaround over the years. The warehouse system held inventory but couldn't answer operational questions, so the answers lived in spreadsheets on individual laptops.

That pattern has a predictable failure mode: the work is fine until the person who owns the spreadsheet takes a week off.

• Arrival reports arrived by email and were re-keyed by hand
• Equipment checkout was a clipboard at the cage
• Audit results lived in a survey tool nobody could report on
• Half the recurring work existed only in one person's routine

A single web application the whole site logs into, with role-based access down to the individual screen. Fifty- odd operational pages sit on top of a shared services layer, and a scheduler runs the recurring work that used to be somebody's morning routine.

The architectural decision that mattered most was making the platform extensible without redeployment planning. New capability is added as a self-contained module and registered in the database; it becomes callable and grantable immediately. That is why the system grew to cover the whole floor instead of stalling at version one — shipping the eightieth feature costs about what the eighth did.

• Role-based access control with delegated administration
• Administrators can only grant permissions they already hold
• Kiosk screens run unauthenticated on a narrow, explicit allowlist
• Supervisor approval verifies a second person without touching the session

An internal tool that everyone depends on is production software, whether or not anyone calls it that. It was built accordingly.

Background automations coordinate through database- level leader election, so exactly one process in the fleet runs each scheduled job no matter how many servers are online. Every request is timed and recorded. Console output from anywhere in the codebase is captured, levelled and streamed to an operator screen — which is the difference between diagnosing a floor problem in minutes and asking someone to reproduce it.

• Latency reported as median and 95th percentile, never as an average
• Human page views measured separately from background traffic
• Live worker-thread inspection with per-task stack traces
• Client errors separated from server errors so a 404 isn't an outage
• A safe mode that boots the app with every automation disabled

The operation runs on one system that its own users extend. Work that lived in individual routines is now scheduled, logged and visible. When something breaks, there is a screen that says so.

The honest lesson from this build is that the hard part was never any single feature. It was making the fortieth feature as cheap to add as the fourth.