A system with no second chance

The situation

A ticketed retail event, run more than once, at more than one venue. Guests register ahead or walk up on the day. They need a pass. That pass needs to be scannable at a door by a volunteer who has never seen the system before. And once inside, purchases across multiple vendors need capturing against each guest for a prize draw.

Ordinary requirements. What makes an event different from most software is the failure profile: there is no maintenance window, no "we'll fix it Monday," and no way to ask a hundred people in a queue to wait while someone redeploys.

The question the build was shaped around

What happens when a piece of this fails while a hundred guests are waiting?

Every architectural choice traces back to that. Nothing self-hosted, because nobody should be SSH-ing into a server on event night. Managed database with a live dashboard, so a problem can be seen and fixed from a phone. One codebase configured per event, rather than a fork per event that quietly drifts.

The fallback ladder

The real design work was deciding what happens at each level of failure. Every rung still gets the guest through the door:

1. 1Scan the QR
2. 2Type the ticket code
3. 3Search by name or phone
4. 4Live spreadsheet mirror
5. 5Printed CSV, exported hourly

Camera won't focus in bad lighting? Type the code. Phone has no signal? The desk has a spreadsheet mirror. Internet down entirely? There's a printed list from an hour ago, and an hour-old list is dramatically better than no list.

Three desks, three sets of permissions

Registration, door check-in and the raffle desk are separate interfaces with separate access, because they're run by different people with different levels of trust and training. A volunteer scanning wristbands should not be one wrong tap away from the admin export.

Where the humans stayed in charge

The raffle desk guards against duplicate bill numbers, but lets a staff member override with intent, because sometimes a duplicate is genuinely correct and the person standing there knows that and the software doesn't. Re-registration returns the existing pass rather than minting a second one. The same instinct as everywhere else we work: enforce what's certain, and leave a door open where judgment is required.

What we'd point at

Nobody asks for graceful degradation and it never demos well, but it's what decides whether the evening works. Two events, two venues, one codebase, and no night spent restarting a server.