Before heading out, staff cache a signed verifier for the day's sessions. Out of range the scanner validates tickets against that cache and queues each redemption locally. Back in range the queue posts in order, append only, and anything that conflicts, such as a ticket scanned twice in two places, surfaces for a person to settle.
What does a scanner see?
Enough to work the gate and no more. An authorized scanner redeems tickets without receiving full guest records or any payment record. The person holding the phone at the trailhead is checking admission, not reading a customer file.
That's a permission boundary, not a promise. Session manifests and participant details sit behind their own permission, so a seasonal hire with a scanner can't page through your guest list.
What happens in a dead zone?
The verifier is cached before the walk starts. It's signed, so the scanner can confirm a ticket is genuine without asking a server whether it exists.
Each scan goes into a local queue with its time. The guide keeps working. Fourteen paddlers scan in at a put-in with no bars, and the phone never shows a spinner.
What happens when it syncs?
The queue posts append only, in the order it was collected. Nothing is overwritten, so a late sync can't quietly erase a redemption someone else recorded.
Conflicts surface instead of resolving themselves. A ticket scanned at the trailhead and again at the office is two facts, and a person decides which one counts. That's the part worth having in writing when an insurer asks who was actually on the water.
Can a ticket move to someone else?
Transfers are supported, and pass photo controls are there when custody matters more, such as a season pass that shouldn't circulate through a parking lot. Both are choices you make per experience rather than a behavior you inherit.
Wristbands ride on the same rails. Bind a pre-printed band to a ticket at check-in and the guest scans a wrist instead of a phone. Every offline and re-entry flow behaves the same way, which matters at a pool where phones stay in the locker.
Worth checking.
- That staff cache the verifier before leaving the office, not after they lose signal
- Who holds scanner permission, and who separately holds manifest permission
- Whether ticket transfer should be on for a given experience
- That someone reviews sync conflicts the same day, while the guide still remembers