Practical software guides
A fallback admission tool must survive the failure that stopped ticketing. Hosting a second page in the same unavailable service is not an independent fallback.
| Failure | Check |
|---|---|
| Provider unavailable | Approved protected roster remains accessible |
| Same ticket presented twice | Local admission marker prevents a second entry on that device |
| Two offline gates | Use pre-agreed partition/coordination or stop; no assumed global sync |
| Payment outcome unknown | Check provider reference before sale or refund |
| Recovery | Match admission events and resolve conflicts before reopening normal flow |
An offline roster becomes stale. Record when it was produced and limit the personal data it contains. If gates cannot coordinate, the organiser must choose a safe operating policy rather than pretending the app can guarantee unique admission everywhere.
Use synthetic tickets and disable live charging during the drill. Measure observed availability, conflicting admissions and recovery work. Keep refund authority separate from front-gate scanning. The general outage playbook covers communications and re-entry. No local incident date or successful drill result is asserted here; organisers and safety specialists must approve actual event operations.