Self check-in kiosk (scanner app, week 20)

A tablet on a stand at the entrance, paired to a check-in point of kind Kiosk, where people check themselves in. Beta: it appears only for an organization with the kiosk_mode feature flag on.

Who opens it: an attendee walking up to the tablet, alone, who has never seen the app and may not have their ticket to hand. An organizer or a member of staff sets it up and looks in on it now and then.

What they came to do: get checked in and on their way in under a minute — by scanning the QR code on their ticket, or by finding their own name — and see their badge.

What must be true when they leave: they are admitted exactly once for the day, as at a gate; the screen has gone back to the start and shows nothing about them or anyone else; nobody could have let anyone in by overriding, typing a code, or browsing a list of names.

Decided

• Setting one up: add a check-in point of kind Kiosk (offered with the flag on), then add a device on it in the event's Scanning devices panel and pair the tablet as usual. Pin a day, or give the kiosk one day, so it knows which day it is checking in. A kiosk point has no "who may override", "Search by name" or "Typed codes" settings — none of them exist at a kiosk.
• Start screen: "Welcome", Find my name, and Scan my ticket (the camera). The header carries the organization's name — its product name on a white-label plan — never ours.
• Find my name: first name, last name, and date of birth or phone number (the last four digits are enough). Both halves must match exactly; a near spelling finds nobody, and nobody is ever listed. A match asks "Is this you?" with a first name and last initial only; Yes, check me in admits that person and nobody else, even on a ticket that covers a family (they scan the family's QR code instead, and tick who is here).
• Not found is always the same words, whether the name is unknown, the date of birth is wrong, or two people share a name and birthday: "We could not find you. Check the spelling, or ask a member of staff." After five misses in five minutes the kiosk says to ask a member of staff until the five minutes are up.
• Finding a name needs a signal. The tablet holds no dates of birth and no phone digits. Without a signal it says so and a ticket's QR code still scans from the tablet's roster, as at any gate.
• The result fills the screen with the colour, icon and word a gate shows, the sentence ("Welcome, Amina."), and a badge: the person's first name and last initial, their type's badge label and colour, and the day.
• Back to the start by itself 20 seconds after a result, and 20 seconds after anybody last touched a half-finished search. Done goes back at once.
• Never: an override (not for anyone, not even an Owner's pairing, not from a rule), a typed code, a code search. The server refuses them at a kiosk point whatever the tablet sends.
• Staff screen: press and hold the top-left corner for three seconds, then type an unlock code from the device's row in Scanning devices (six digits, ten minutes, one use, five tries). The normal scanner screen shows with Back to self check-in; it goes back by itself after five minutes nobody touches it, and on every reload.

Open

• Printing the badge at the kiosk is not built: the badge is shown on screen. Printed badges come from Badge runs, or the help desk's one-badge print. A kiosk printer needs a print bridge the scanner app does not have.
• A hardware scanner reading only a Code128 barcode (no QR) is refused at a kiosk, since a bare code is what typing would send.
• Walk-up registration at a kiosk (registrations.source = kiosk) is not built.