Safety and commissioning

Reference lab status: A physical CM5 and T600 DevKit have completed Stripe test-card authorisation, simulated vend and automatic capture against a production-hosted application. Real-machine actuation and live unattended payments require separate qualification. Follow the test checkout walkthrough for the exercised setup.

Use purchasable gateway and interface hardware first. Pi 5 or CM5 industrial carriers are candidate hosts; a final BOM requires measured I/O capacity, electrical envelopes, enclosure/PSU suitability and physical deployment evidence. The initial software package does not freeze or certify a hardware BOM.

Machine interfaces must be galvanically isolated and protected as appropriate. Never wire unprotected Linux GPIO directly to commercial-machine signalling. Qualified installers must use the exact verified controller instructions before connecting a live machine. No supported machine wiring page is currently included.

Software commissioning

Start with the explicit simulators and recorded profile fixtures. Check capability discovery, supported actions, unknown/stale state, immutable correlation IDs and raw observations. Confirm one gateway can handle multiple machine simulators and instrumentation together. A missing serial adapter must produce disconnected readings while other equipment remains usable.

Issue a test service, duplicate its invocation, then submit the same service ID through a different invocation. Verify the physical adapter is called only once. Interrupt dispatch and restart the workload; its outcome must remain unknown and require reconciliation. Disconnect the agent or network after dispatch and verify that recovery reports the result without another vend.

Perform a lab OS update and RAUC rollback with state on dpdata. Verify the command journal and profile evidence survive. These host tests must be recorded on the actual Pi 5/CM5 image before declaring it a qualified reference.

Operator review and monitoring

When an operation result is unknown, retain its original identity and input. Reconcile the service outcome before requesting another physical action. An HTTP error alone cannot establish that no effect occurred.

Configure bounded observation history and monitoring policies for each monitoring point. History must identify the configured gateway and instrument, measurement, profile and version. Retain raw observations and profile/calibration evidence alongside derived results.

Set the point's Monitoring thresholds JSON explicitly, for example:

{
  "absolute_high": 80,
  "sustained_high": 70,
  "sustained_seconds": 300,
  "rate_high_per_minute": 5,
  "peer_margin": 10
}

Choose thresholds for the verified sensor and installation. Absolute, sustained, rising-rate and peer warnings support maintenance decisions; they do not replace machine protection. A Comparable equipment group must explicitly identify comparable equipment. Peer warnings require at least 20 fresh readings with matching quantity, scope, source, profile, version, point and unit. Missing, invalid or stale evidence cannot produce current warnings.

For a cumulative water-volume point, use {"counter": true}. Today defaults to local midnight through now; the history panel also accepts a selected period up to 31 days. Results name the actual observed interval. Gaps, counter resets, invalid readings and changed profile/calibration identity prevent a reliable consumption claim. Large histories require a shorter period; the UI retains only the latest bounded raw evidence rather than silently returning a full history.

A dedicated machine meter can report an observed-interval average per completed cycle only with continuous, supported, good-quality controller completion counts and idle states bracketing both meter boundaries. The count cannot reset or change provenance. The average includes any idle consumption and is not an individual transaction allocation. Shared site, branch and enclosure meters never receive individual cycle allocations. Unsupported completion counters remain unknown. Qualify these measurements and controller completion signals on the exact installed hardware before using them for operational decisions.

Troubleshooting and removal

Symptom	Inspect
Kiosk payments unavailable	Terminal/provider readiness and Site impact; gateway events alone do not prove payment readiness
Machine outcome unknown	Order/vend/Process/Operation and invocation evidence; reconcile before any new physical action
Instrument disconnected	Approved device mapping, host permissions, isolated interface and power
Instrument timeout or CRC error	Address, common serial settings, bus wiring and termination using the verified device instructions
Stale reading	Observation timestamp, poll interval and equipment connectivity
Journal full	Capacity and evidence retention; stop new physical commands and archive safely

Stop the workload through Software management. Revoke approved resource grants and remove device/configuration bindings. Preserve the journal and evidence for reconciliation and audit. Machine electrical removal follows the verified controller's rollback procedure; a simulator cleanup is not a machine wiring instruction.