Each QR admits once. A second scan answers DUPLICATE with the first entry time — it never silently re-admits. Works with any keyboard-wedge scanner. With no signal, signed tokens verify against this device’s last sync and queue to confirm once signal returns; unsigned tokens never scan offline.
build atlas-00178-ls2