A door at a real event doesn't wait for a network request. Someone is standing there, a line is forming behind them, and a phone or a tablet has to decide, in about a second, whether that person gets in.
Venue wifi is exactly the thing you can't count on in that moment. Bad signal, a packed room full of other phones, a venue with no real internet at all. Design admission around "the device can always ask the source of truth" and the system works perfectly in every rehearsal and then fails in front of a line of paying guests on the one night it actually matters.
So the starting assumption had to be the opposite one: assume the device is on its own, and design for what "correct" means when nobody can be asked.
The real risk isn't "no service." It's two people agreeing by accident.
Losing connectivity is not the dangerous part. A device that simply can't scan anyone is an inconvenience, loud and obvious, fixed by walking to a better spot. The dangerous failure is quieter: two devices at two doors, both cut off from each other, both looking at the same ticket, and both deciding independently to let it through. Neither device did anything wrong on its own. The problem only exists because they never got to compare notes.
That's the actual design problem: not "how do we keep scanning without a connection," but "how do we make sure a decision made without asking anyone still turns out to be the right one once everyone can talk again."
Choosing which mistake is recoverable
Every offline decision is a bet on which kind of mistake you can live with, because you have to make some decision before you have all the information.
Turning someone away who was actually allowed in is a bad experience, but it's recoverable. A human can sort it out in thirty seconds, and nothing about the event itself is damaged. Letting the same ticket into a venue twice is not recoverable in the same way. Once two people are inside on one ticket, there's no clean undo.
So the design leans toward the mistake that can be fixed with a conversation, and treats the unrecoverable one as the thing worth extra caution to avoid. Even at the cost of an occasional "let me just check" moment at the door.
What that looks like in practice
- Every device is honest about what it, personally, has already decided, so a scan never sits waiting on an answer that might not arrive in time. The decision gets made with what's actually known at that moment, not with what's hoped to be true elsewhere.
- Nothing is treated as settled until devices get a chance to compare what they each decided. The moment connectivity comes back, decisions made apart get reconciled. And if two devices disagree about the same ticket, that disagreement surfaces as something to look at, not something that quietly resolves itself in whichever direction happened to sync last.
- Door staff get a clear signal when a decision needs a human, instead of a confident-looking success screen for a situation the system isn't actually sure about. A system that hides its own uncertainty behind a green checkmark is more dangerous than one that admits it's guessing.
Why this matters more than it looks like it should
None of this is visible to a guest walking through the door on a good night. Which is exactly the point. The entire goal of this design is that the failure mode nobody wants. The same ticket working twice. Gets caught automatically when devices reconcile, instead of becoming a story a promoter tells about the one show where it went wrong.
Good offline design isn't the part people notice. It's the part that makes sure there's nothing to notice.