One platform, three moving parts: voting, ticketing, and nominations.

Signature verification runs in the gate scanner before it touches the server. A tampered QR fails client-side and never produces a network call. A valid signature proceeds to server-side validation: status (issued / used / void / refunded / transferred), event timing, and a status transition to used inside a Firestore transaction so two scanners at two gates cannot both claim the same ticket simultaneously.

The signing version on the event's ticketing settings is the rotation primitive. Bump the version and all newly-issued tickets sign with the new key; outstanding tickets remain valid because the validator checks every known version. Rotate without invalidating sold tickets — something most ticketing systems cannot do without a migration.

Successful scans flip the ticket status in a Firestore transaction and write an immutable TicketScan audit row. Failed scans also write a row with the result code — valid, already_used, void, invalid, wrong_event, not_started, ended, refunded — so attendance analytics are grounded in every attempted scan, not just successful ones.

When network drops mid-event, scans queue in IndexedDB with a tentative valid verdict. When the device regains connectivity, the queue flushes and audit rows land on the server. Any offline scan that turns out to be a duplicate is flagged in the audit feed for organizer review.