Twinlite Services · hospitality systems, written in-house
Three systems that take the running of a hotel off paper and out of people’s heads. Halo minds the building. Lark minds the guest. Clocky minds the shift.
Built for The Bolton — an 84-room hotel in Dublin 1 opening Q1 2027 — and written so the next property is a configuration file, not a rebuild.
Mews knows the rooms. Entra knows the people. Everything our systems do is derived from those two — nothing is re-keyed, nothing is kept twice.
Reads Mews
Reads the room. Opens the clean. Conditions the air.
Drives
Reads Mews + Entra
The tablet that replaced the in-room phone.
Drives
Reads Entra
Three-signal clock-in on the worker’s own phone.
Drives
Every wire is a live integration — an API call or a webhook, never a nightly file drop. Lark is the only one that reads both: it needs the reservation from Mews and the device policy from Intune to know whose room it is sitting in.
Three products only earn the word “suite” at the points where they touch. There are three, and each one is a join rather than an export.
Halo opens the make-up-room assignment the moment presence drops on a checkout day. Lark drops the guest’s own switches — do-not-disturb, make up the room now — onto the same Flexkeeping board, and holds them pending until housekeeping completes. The housekeeper works one list, and neither system knows or cares which of them filled it.
Halo maps every room to its Mews resource and reads occupancy from the reservation. Lark writes the guest’s DND state and make-up-room note straight back to Mews, and reads the folio live rather than caching it. Two products, one reservation — there is no second copy to go stale.
Lark’s room tablets and Clocky’s handsets sit in the same Entra tenant and the same Intune estate, provisioned by policy. A new room, or a new starter’s phone, is a configuration entry — not a visit from someone with a cable.
Separate codebases, one operating philosophy. Every number below is a real setting in a running repository — thresholds, not aspirations.
Minds the building.
A ceiling sensor in every room reports presence over MQTT. Halo joins that to the Mews reservation, then decides three things without anyone asking it to: whether the room is empty enough to clean, whether the air needs conditioning, and whether something has gone wrong. Housekeeping gets a task the moment a departure is confirmed; the BMS gets the guest’s state immediately, not on a timer.
| Presence | Steinel True Presence | PoE, ceiling-mounted, one per room |
|---|---|---|
| Transport | MQTT / TLS 8883 | QoS 1, broker on-premise |
| Checkout debounce | 15 min | before a departure is called |
| Housekeeper debounce | 5 min | before the clean is closed off |
| HVAC vacant guard | 60 s | occupied writes go immediately |
| Pre-conditioning | 60 min | ahead of check-in |
| Environment alerts | 1400 ppm · 28 °C · 70 %RH | CO₂, overheat, humidity — with hysteresis |
| Frozen-sensor watch | 3 h | catches a wedged head that keeps talking |
| Alert routing | 7 event groups | Teams Adaptive Cards, self-serve subscriptions |
| Failure mode | persistent outbox | exponential backoff — a cleaning task is never lost |
Minds the guest.
The in-room phone is a line rental, a handset, and a reason to call reception about something reception can’t see. Lark is the tablet that replaces it: reception on one tap over the room’s own SIP registration, requests that land in Flexkeeping as tasks, the live folio straight from Mews, and express checkout that doesn’t need a queue at the desk. Unconfigured, it still runs — every screen works on canned fixtures.
| Device | Android tablet, per room | Intune dedicated-device lock task |
|---|---|---|
| Client | Flutter, Android-first | one store package serves every room |
| Voice | in-app SIP → UniFi Talk | no gateway server at the property |
| Dialable | 1 extension | reception, deliberately — nothing else |
| Languages | 4 | English · Français · Español · Deutsch |
| API surface | 11 handlers | POST JSON, per-device key auth |
| Refresh | 30 s poll | no realtime transport, by decision |
| Offline | queued on device | requests replay on reconnect |
| Guest actions | requests · info · folio · checkout | folio read live from Mews, never cached |
| Device guard | BLE exit beacon | a tablet leaving the building says so |
Minds the shift.
Hours are the largest controllable line in a hotel and the least instrumented. Clocky verifies every clock-in three ways at once — GPS geofence, the site’s own WiFi BSSIDs, and a live photo — and still never blocks the worker: anything unverifiable goes to a manager queue with a timestamp and a face attached. Because the roster and the clock share a table, planned-versus-actual is a join rather than a second version of the truth.
| Verification | 3 independent signals | GPS geofence · WiFi BSSID · live photo |
|---|---|---|
| Identity | Microsoft Entra ID SSO | no separate accounts, no passwords |
| Backend | Cloudflare Workers · D1 · R2 | no servers to patch |
| Clients | iOS & Android, native | SwiftUI and Jetpack Compose, one API |
| Directory sync | daily, 05:00 UTC | an Entra group is the roster |
| Payroll | weekly, Mon 06:00 UTC | CSV to R2, plus export for any range |
| Photo retention | 90 days | pruned by the same cron that exports |
| Offline | queued clock-ins | a dead spot is not the worker’s problem |
| Test suite | 150 passing | API + verification logic, CI-gated |
We don’t have a headline savings figure yet — the property opens in 2027. What we can name precisely is the work each system removes, and where it used to sit.
Lark registers as the room’s own extension on UniFi Talk. No handset, no per-room line, no PBX hardware in a cupboard.
Halo opens the Flexkeeping assignment the moment presence is lost on a checkout day, and closes it when the housekeeper leaves. Nobody walks the corridor to find out.
The BMS gets presence and reservation context as it changes, with a 60-second flap guard and a 60-minute pre-conditioning lead. Comfort on arrival; nothing running behind a closed door.
The folio is on the tablet, read live from Mews, and express checkout is two taps. The desk keeps the conversations worth having.
Clocky verifies the clock-in at the moment it happens. Payroll becomes an export; the manager reviews exceptions, not everything.
Mews stays the source of truth for the property, Entra for the people. Our databases hold only what those two don’t.
The interesting engineering in a hotel is not the happy path. It is what the building does at 3 a.m. when an API is down, a sensor has wedged, or the Wi-Fi has dropped in a stairwell. These are the rules all three codebases keep.
Halo runs the whole lifecycle with no cloud credentials — every outbound call is logged instead of sent. A new property is exercised end to end before it is ever connected.
Failed writes land in a persistent outbox and retry with exponential backoff. Sensor and HVAC paths carry on regardless.
Lark serves canned fixtures with no backend at all. Clocky queues clock-ins offline and replays them. Connectivity is our problem, never the guest’s or the worker’s.
A wedged sensor that keeps republishing identical readings is invisible to silence-based health checks. Halo flags it frozen after three hours — and refuses to invent vacancy from it.
Boot, session, request, call, checkout, error — all audited. A failure to write the audit line never stops the thing the person was doing.
Nothing here is welded to one building. Room maps, debounce thresholds, extensions, sites and languages are configuration. The second property is a config file.
We will walk you through a live room — sensor to BMS, tablet to reception, clock-in to payroll — and show you the code underneath it.
Arrange a walkthrough