XQKqueue/.project-docs/40-domain/business-rules.md

Business Rules

Durable Rules

• A queue ticket belongs to one project and one queue session and binds a fixed party size chosen at creation.
• Ticket-number calling selects up to the first contiguous N waiting tickets in FIFO order.
• People-count calling selects the longest contiguous FIFO prefix whose total party size does not exceed the target; tickets are never split or skipped, and the request fails if the first waiting ticket alone exceeds the target.
• Same-phone duplicate protection in a project/session applies only while an existing ticket is WAITING. Once it has been called, that phone may take another ticket in the same session. A still-waiting duplicate requires explicit confirmation.
• Login attempts remain allowed through the ninth failure in a ten-minute window. The tenth failure locks that limiter key for ten minutes; successful login clears the attempt state.
• A project's current queue session is selected for the project's local business date and must be in RUNNING or PAUSED where read flows allow both; write operations apply their stricter project/session status rules.
• Public phone lookup is an operational-test path only and is disabled with a 404 response in production; internal phone lookup is private-network-only.
• Terminal ticket personal fields are scheduled for purge after 30 days; records older than 90 days are anonymized as a backstop. Maintenance runs in bounded transactions under a PostgreSQL advisory lock, and audit/session/idempotency retention is enforced from stored expiry fields.
• Public display responses are read-only allowlisted projections and must not expose phone, name ciphertext/nonces, HMACs, private status tokens, or other personal fields.
• /admin/display is an overview surface and never announces. Only /display/{project-code-or-token} may announce a new call.
• Android establishes the first project snapshot as a silent baseline; only a subsequently changed call batch is announced.
• Android announcements speak the called ticket number or first-to-last range, never the project name, and repeat the complete announcement three times in FIFO batch order.
• A multi-ticket current batch displays its first and last number as a complete range such as 00010 至 00011; it must not ellipsize or silently clip the endpoint.
• Leaving a project screen or pausing the Android activity stops project polling and clears/stops current and queued announcements.
• Ticket transition and missed-ticket reissue logic exists in the service source, including one-time tail reissue with revision/idempotency checks, but is not currently registered as an HTTP route or wired into the web UI; do not treat it as an active user-facing capability until that integration is implemented and tested.

Open Questions

• Confirm whether the legacy Mandarin WAV assets are cleared for redistribution outside the current project's authorized deployment.
• Confirm whether a future production APK will remain fixed to one service origin or needs managed environment configuration.

Last Reviewed

2026-08-12