Sell the house without overselling it
A ticketed event carries named ticket tiers -- adult, student, reserved, general -- each at an exact-cents price and a finite capacity. The capacity never oversells: an order that would push the sold count past a tier's limit is rejected whole, so the house cannot be sold past the seats it has, not by one ticket, ever. What is honest-off is the live payment rail. Every charge routes through one shared rail that is not provisioned today, so no card is charged and an unpaid order is held, not sold. The engine that prices and counts the house is real; live checkout is founder-gated and not enabled yet.
Ticketing engine built -- live checkout honest-off
Reserved seating that never double-books
For a reserved house the box office holds a seat map, and every order is checked against it before it is admitted. An order clears only when every requested seat exists and is free; if any seat is already taken, or the same seat is requested twice in one order, the whole order is rejected. The guard is fail-closed by construction, not a setting an operator can switch off -- so two families can never end up holding the same seat. General-admission and reserved tiers live side by side in the same event.
Reserved seating built -- fails closed on a double booking
Will-call and delivery, sorted before the doors open
Each order carries a fulfillment method -- will-call pickup at the window or delivery to the buyer -- and the fulfillment engine routes and tracks it so nothing is lost between the sale and the door. Ticket transfer moves a seat from one holder to another cleanly, and the order-history view keeps a family's tickets straight across a season of events. These are pure engines: they route, transfer, and reconcile an order's tickets, and they move no money doing it.
Will-call, delivery, and transfers built
Scan each ticket once at the door
At the gate, the QR door scan admits each ticket exactly once -- a second scan of the same ticket is refused, so a screenshot passed down the line does not get a second person in. The scanner runs as an offline-capable PWA with its own queue, so a gate in a dead zone still admits ticket holders and reconciles the scans when it reconnects. An unpaid order is not admitted, because no card is charged today. The scan-once engine and the offline scanner are built and tested.
Gate scan built -- admits once, works offline
House management: concessions, settlement, and the box-office report
Behind the window, the concessions point-of-sale rings the stand's adjacent sales, and the reporting dashboard rolls up a settlement and the box-office numbers for the night. Access to both is RBAC-gated to box-office staff, so a volunteer sees the till they run and not the whole ledger. What is honest-off is live money: the shared payment rail is not provisioned, so no card is charged at the ticket window or the concession stand today, and the settlement reports on counts and prices, not on money that has actually moved.
House engines built -- live money honest-off