Working the door of a basement venue with no phone signal

Why is an offline door a requirement rather than a feature?

Because the rooms this is built for are basements, railway arches and back bars with a metre of brick between the door staff and any signal. A door that needs a network call per scan does not degrade gracefully in those rooms — it degrades into a queue on the pavement, and then into somebody waving people through unchecked, which is worse than no scanning at all.

So it is built the other way round. Before the doors open, the device pulls a signed manifest: the credentials valid for that session, and nothing else. From that point the scanning path performs no input or output at all — a scan is a local check against the list. Signal is something the device needs before and after the show, not during it.

What happens to the scans while the venue is offline?

Each device keeps its own numbered log of what it admitted and when. When it reconnects it uploads that log, and the platform applies it once: a re-upload of the same shift, which happens whenever somebody taps the button twice on a flaky connection, is counted as duplicates rather than doubling the headcount.

Uploads are validated rather than trusted. A scan missing its attendee or its timestamp is named and refused rather than being defaulted into your numbers, and oversized, malformed or truncated uploads refuse at the edge. The rule behind all of it is that an approximate headcount is worse than a short one, because you cannot tell it is wrong.

If two devices both admitted the same code — the classic case being one person sent to the other queue after a failed scan — that surfaces as a conflict in the console for someone to review after the show, rather than silently inflating the night's figure.

How should I run two doors and a guest list?

Run one device per queue and let the conflict queue do the reconciling. Because each device keeps its own numbered log, two doors do not need to talk to each other during the show; they only need to agree afterwards, which is what the conflict review is for.

For a guest list, comp tickets are the right mechanism rather than a piece of paper. A comp consumes a place in the room and checks in exactly like a paid ticket — which is what you want, because the fire officer counts bodies, not revenue — but writes no revenue lines, so it never reaches your payout or an artist's percentage.

For walk-ups, the day-of page has a sale form showing live per-ticket availability, and it charges a card on your device through the same checkout an advance ticket uses. The credential it issues is a normal one, so the person who bought at 9pm scans like everybody else. Cash is not recordable here at all — if you take cash on the door, it lives entirely outside bindro and outside every split and report in it.

What does the ID confirmation on an 18+ night actually record?

It records that a named member of your staff said they checked. When a venue declares age verification, the console will not complete a check-in without an explicit confirmation, and it stores that confirmation against the scan and the operator who made it. A check-in attempted without it is refused and records nothing at all, so there is no half-state where somebody was admitted but the check was skipped.

Be exact about what that is and is not. Nothing scans a driving licence, nothing reads a chip and nothing calls a verification service. It is an audit trail for a human check, which on a licensed night is genuinely useful — it tells you who was on the door when — but it is not evidence that the document was real, and no licensing officer will read it as such.

The other half runs at checkout, where the booker's date of birth is checked against the age limit on the money path. Note the scope: that is the person buying, not each of the four people they bought for, plus a confirmation that everyone attending meets the limit. The door is still where a group is checked.

What should I do before doors on the night?

A short list, done in the office where there is signal, is the difference between a smooth door and a queue in the rain.

• Open the door app on every device you will use and let each one pull that session's manifest while you still have coverage.
• Check the live capacity figure on the day-of page against what you expect to sell on the door, and hold back a tier if you want walk-up availability.
• Confirm every device is signed in as a distinct device, so two queues produce two logs and any double scan becomes a reviewable conflict rather than a mystery.
• Brief the door on duplicates: a second scan of the same code is reported as a duplicate, and the answer is to look at the person, not to scan again.
• Agree the re-entry policy out loud. Bindro takes no part in it — a ticket admits once per date — so a stamp or a pass-out is a door decision.
• After the show, reconnect the devices, let the logs upload, and clear the conflict queue before you look at the numbers.