One stub. One entry. Every time.

The double-scan guard is not a check in our code, it is a unique constraint in the database. The first scan wins and a second raises a conflict the scanner shows as ALREADY USED. It cannot be talked around by a race, a retry, or two phones on the same door in the same second.

Door staff see who is admitted and nothing else. The scan payload carries a name, an email and an event, with no price and no total on it at all. The money gate is the shape of the data, not a permission somebody can flip.