# Business Rules

## Durable Rules

- A queue ticket belongs to one project and one queue session and binds a fixed party size chosen at creation.
- Ticket-number calling selects up to the first contiguous N waiting tickets in FIFO order.
- People-count calling selects the longest contiguous FIFO prefix whose total party size does not exceed the target; tickets are never split or skipped, and the request fails if the first waiting ticket alone exceeds the target.
- Same-phone duplicate protection in a project/session applies only while an existing ticket is `WAITING`. Once it has been called, that phone may take another ticket in the same session. A still-waiting duplicate requires explicit confirmation.
- Login attempts remain allowed through the ninth failure in a ten-minute window. The tenth failure locks that limiter key for ten minutes; successful login clears the attempt state.
- A project's current queue session is selected for the project's local business date and must be in `RUNNING` or `PAUSED` where read flows allow both; write operations apply their stricter project/session status rules.
- Public phone lookup is an operational-test path only and is disabled with a 404 response in production; internal phone lookup is private-network-only.
- Terminal ticket personal fields are scheduled for purge after 30 days; records older than 90 days are anonymized as a backstop. Maintenance runs in bounded transactions under a PostgreSQL advisory lock, and audit/session/idempotency retention is enforced from stored expiry fields.
- Public display responses are read-only allowlisted projections and must not expose phone, name ciphertext/nonces, HMACs, private status tokens, or other personal fields.
- `/admin/display` is an overview surface and never announces. Only `/display/{project-code-or-token}` may announce a new call.
- Android establishes the first project snapshot as a silent baseline; only a subsequently changed call batch is announced.
- Android announcements speak the called ticket number or first-to-last range, never the project name, and repeat the complete announcement three times in FIFO batch order.
- A multi-ticket current batch displays its first and last number as a complete range such as `00010 至 00011`; it must not ellipsize or silently clip the endpoint.
- Leaving a project screen or pausing the Android activity stops project polling and clears/stops current and queued announcements.
- Ticket transition and missed-ticket reissue logic exists in the service source, including one-time tail reissue with revision/idempotency checks, but is not currently registered as an HTTP route or wired into the web UI; do not treat it as an active user-facing capability until that integration is implemented and tested.

## Open Questions

- Confirm whether the legacy Mandarin WAV assets are cleared for redistribution outside the current project's authorized deployment.
- Confirm whether a future production APK will remain fixed to one service origin or needs managed environment configuration.

## Last Reviewed

2026-08-12