ParkSense

A dropped link must never double-charge, and never lose a session.

A gate is not a data centre. The link to it fails — a router reboots, an ISP drops, someone unplugs the switch to vacuum. Meanwhile cars keep arriving and leaving, and each one is a payment.

So the on-site agent owns the lane rather than asking permission for it. It writes locally first, in a mode that survives an abrupt power cut mid-write, and replays upstream when the link returns. Replay is the dangerous half: a naive retry loop bills a driver twice for one exit, and a duplicate charge is a refund, an apology and a phone call from an operator who now trusts the system less than the paper tickets it replaced.

Each pending item is therefore claimed under a lease before it is sent, so exactly one replay attempt owns it at a time and a crash mid-flight resumes rather than duplicates. That property is worth more than throughput here: this system handles tens of vehicles a minute at its busiest, and correctness under failure is the only thing anyone will remember.

A wrong read must never charge a stranger.

Plate recognition is probabilistic. Rain, headlight glare, a bent plate, a lens someone smeared while reversing — all of it degrades a read, and the system cannot tell a poor read from a good one by looking at the result.

The naive design trusts whatever the camera returns. That means a misread on exit charges a person who was never in the car park, which is not a bug you get to fix quietly. It is a bug the driver tells other drivers about.

So reads are not single events. Several frames vote, weighted by confidence, and the result is corrected against the plate formats that are actually legal in the region rather than accepted as free text. Below a confidence bar the exit still calculates the fee but withholds the payment prompt entirely and queues the session for a human.

The asymmetry is the whole point, and it is worth stating plainly because it is the kind of thing that separates a system built by an engineer from one built to a spec: a bad entry read costs the operator one session of revenue. A bad exit read charges a stranger. Those are not the same mistake and they must not have the same failure mode.

The barrier opens on exit. Always.

Including when the plate is flagged. Including when the fee is unpaid. Including when the platform itself is down.

A barrier that refuses to lift is not a payment control, it is a person detained in a concrete box, possibly at night, possibly alone, because a piece of software formed an opinion about their number plate. The cost of a trapped driver — to the operator, to the driver, and to anyone who hears about it — is larger than any fee that could have been collected.

So enforcement happens after the fact, through records and human decisions, and never through the physical gate. This closed off a whole category of feature requests, and it is written down with its reasoning so that a future engineer under deadline pressure has to argue with the decision rather than quietly discover the constraint and route around it.

Money never rests with the platform.

The obvious design routes payments through the platform and takes a cut. It is also the design that turns a software company into something a central bank has an opinion about — holding other people’s money, even briefly, is a regulated activity in most jurisdictions and certainly in this one.

Payment instead moves from the driver directly to the operator’s own till, authorised with the operator’s own provider credentials. The platform observes the settlement and records it; it never custodies it. Revenue is a subscription rather than a percentage.

That decision costs real money — fees cannot be netted out of the flow, so they have to be invoiced and chased separately. It is still obviously correct. The alternative buys a slightly better revenue mechanic in exchange for a licensing question, and a licensing question is not a thing a pre-revenue product survives.

One operator must never see another operator’s cars.

Multi-tenancy is where the severe bugs live, and they are almost never at the login. They are one query deep, in the handler nobody reviewed, where an identifier arrives from a request and is looked up without also being scoped to the tenant it belongs to.

The scoping here is enforced on every write rather than checked at the edge, because an edge check protects the routes that existed when it was written and nothing added afterwards. Operator staff are bound to the specific sites they work at, not merely to an operator, so a franchise cannot read across its own branches by accident either.

This is the same bug class the published Semgrep rule catches, which is not a coincidence. Writing the rule came out of finding the shape repeatedly by hand and deciding a snapshot was worth less than a ratchet.