Security & reliability
Guarantees, not marketing promises.
These are architectural invariants enforced at the database and application level. Not policies, not intentions: properties of the system that hold under load, offline and mid-incident.
ATOMIC RESERVATION
Optimistic locking prevents oversells
Every inventory item carries a version field. A reservation attempt atomically updates that version; if another request got there first, the operation fails safely and retries. The guarantee is enforced at the database level, so oversells are prevented by construction.
- All-or-nothing seat selection, no partial reservations
- Concurrent requests either succeed fully or fail safely
- Automatic retry with exponential backoff on conflicts
- Version tracking prevents lost-update anomalies
IDEMPOTENCY
Every mutation protected by keys
Network failures and retries are inevitable. Every mutation accepts an idempotency key; a duplicate request returns the cached result instead of executing again. That prevents duplicate charges, duplicate tickets and duplicate refunds.
- Duplicate checkout attempts return the cached result, not a second charge
- Idempotency keys stored with a TTL for automatic cleanup
- Atomic insert-or-get pattern gives exactly-once semantics
- All mutation endpoints support idempotency
STATE MACHINES
Type-safe transitions
Fixtures, orders, tickets and transfers all follow defined state machines. Invalid transitions are rejected at the application layer: you cannot cancel a settled fixture or transfer a voided ticket. Every state change is explicit and audited.
- Only valid state transitions are permitted
- Terminal states (settled, voided) cannot be modified
- State machines defined in code, not configuration
- Clear error messages explain the valid transitions
AUDIT TRAILS
Before and after snapshots
Every state change creates an audit entry with the previous state, the new state, the actor (fan, admin or system) and a timestamp. Rule evaluations are logged separately with predicate-level results and explanations.
- All state changes recorded with before and after snapshots
- Actor tracking: who made each change
- Rule evaluations logged with predicate-level detail
- Audit logs are append-only, never modified or deleted
OFFLINE SCANNING
Signed allowlists and reconciliation
Stadium connectivity is unpredictable. Scanning devices generate cryptographically signed allowlists before matchday. Offline scans are recorded locally and reconciled when connectivity returns; the earlier scan wins in conflict resolution.
- Allowlists signed with device keys, so they cannot be tampered with
- Offline mode works with no network connectivity at all
- Automatic batch reconciliation on reconnection
- The earlier scan wins in online/offline conflicts
KILL-SWITCH PHILOSOPHY
Incident mode controls
When operations go wrong you need emergency controls. Incident mode provides bulk admit, zone close, device revoke and emergency evacuate. Every action requires authorisation and creates an audit trail.
- Incident actions require authorisation and a reason
- All actions audited with performer and authoriser
- Reversible actions (zone close, device revoke) can be undone
- Manual headcount override for emergency situations
WHAT AN INCIDENT LOOKS LIKE
Every action, authorised and on the record
This is the shape of the audit trail incident mode leaves behind: who acted, who authorised it, what changed and when it was reversed. Append-only, so the record for the safety report is the record of what happened.
[15:07:41] incident.raised gate=EAST-2 severity=HIGH actor=steward:d-114
[15:07:58]incident.zone_close zone=EAST actor=ops:s.kaur authorised_by=safety:j.mensah reason="crowd build-up"
[15:08:02] ✓ state EAST: OPEN → CLOSED snapshot=before/after
[15:12:33] incident.device_revoke device=scan-07 actor=ops:s.kaur authorised_by=safety:j.mensah
[15:26:10] incident.zone_reopen zone=EAST actor=ops:s.kaur authorised_by=safety:j.mensah
[15:26:11] ✓ state EAST: CLOSED → OPEN · log is append-only · 5 entries retained
See these guarantees running, not slideware
Bring your worst concurrency story to a working session and watch the engine refuse to oversell.
Book a working session