Case study
Downtown Auto Sales, a used-car dealership in Anchorage, Alaska, buys damaged cars, repairs them and sells them. This is the system it runs on — and the product it became.
The dealership had a website full of vehicles and a set of spreadsheets full of money, and no connection between them. Every car was typed twice: once into the office record with what it cost to buy and repair, and once into the website with what it was being sold for. A car that sold on Tuesday was still on the website on Friday.
The obvious fix — put everything in one online system — was the wrong one, for a reason that decided the whole architecture. The office record holds what each car cost, what was spent fixing it, and what the margin is. Some of that must never be visible to the staff selling the cars, and none of it should sit on a shared server because it was convenient.
Two halves that meet at exactly one point. A Windows application on the office machine holds everything. A website shows only what a customer should see. The seam between them is a one-way push of a fixed list of public fields.
The decisions
Purchase price, parts, labour, margin and the negotiated sale price stay in an encrypted database on the dealership’s own machine. What goes to the website is built from a list of allowed fields — so a column added next year cannot leak by being forgotten. It is enforced in three places and the build fails if the test that proves it does.
A car is marked sold on the lot, and the record is written and committed before anything is sent anywhere. If the website is unreachable, the sale still happened and the push is retried later. A dealership’s till must not wait on somebody else’s server.
The sales manager sees every car and no cost. That is not a hidden column in the interface — the rows he receives have never contained the figures, so there is nothing on his screen to reveal.
Every failure says which link broke and what to do about it: the site did not answer, the certificate is not trusted, the password was refused, this account may not publish. “Connection failed” is not usable by anybody standing on a lot in Anchorage.
In the office
On the lot’s website
The application is in daily use. Vehicles publish and unpublish by themselves, the documents print from the record, and the whole thing opens on a morning when the internet does not.
The website is finished and waiting on one thing that is not code: the day the domain is pointed at it. That is a decision for the owner, taken on a quiet day with a backup in hand — not something to slip in beside a release.
The system started as one dealership’s office tool and is now a product. Nothing about that dealership — no name, no address, no logo — exists anywhere in the code; it all lives in a profile the owner fills in on first run. That is what lets the same application run for the next dealership without a line being changed.
Also built
Typed twice, or held in a spreadsheet nobody else can open. Tell us what it is.