Event day

Event day is the highest-traffic, lowest-patience part of the admin portal. Every screen is a separate page so a staff device can be locked to one job and one role.

Signing scanners

Page	Job	Permission
/admin/scanner/entry	Scan a customer into a signing session	use_scanner
/admin/scanner/exit	Scan them out	use_scanner
/admin/scanner/slip	Print the signing slip	use_scanner
/admin/scanner/payment	Payment checker	manage_payments
/admin/scanner/stamp-rally-prize	Prize handover	claim_stamp_rally_prize

Signing queue

/admin/signing-queue runs the queue; /admin/signing-queue/queue-display is the customer-facing screen (put it on the venue display, not a staff device). /admin/scanning-monitor shows live scan activity across stations.

Queue internals — QR generation and verification, booking item metadata, markers, languages, orientations — are in the signing-queue skill.

Entry tickets

Page	Job	Permission
/admin/entry-counter	Walk-in sale: customer details, payment, wristband	manage_entry_tickets
/admin/scanner/entrance	Entrance gate admission and re-entry	use_entry_scanner
/admin/scanner/ticket-payment	Ticket check-in with payment	manage_entry_tickets

Wristband issuing is restricted to admin, entry_counter and entry_staff via canIssueEntryWristband — a separate check from the page permission, because the physical wristband is the thing that cannot be un-issued.

Before the doors open

• Confirm staff hold the right roles. Roles are granted on /admin/users through the audited users.updateRoles procedure — there is no OTP shortcut in production any more.
• Check /admin/scanning-monitor reads from every station.
• Remember the health endpoints are liveness-only by design: web /api/health, API /health. A green healthcheck does not prove the database is reachable — that is deliberate, so a Neon blip cannot restart every container mid-event.