---
type: decision
tags: [parking, decisions, open]
sources: [parking-system-architecture]
updated: 2026-06-14
status: open
---

# Open Questions / Next Steps

**Not yet decided**, and they drive everything else — settle before procurement. (See
[[parking-system-architecture]] §10.)

1. **Lane topology.** One host per lane, or one central host driving networked devices in each
   lane? Decides how many controllers, printers, UPSs, and [[sqlite]] instances exist, and the
   failure blast radius. (A single central host is a single point of failure for *all* lanes.)
2. **Failure modes.** Define per direction what happens to barriers on host/power/network loss —
   particularly **fail-open on exit** for egress safety. Currently unaddressed. See
   [[fail-state-safety]].
3. **Payment subsystem.** Manned booth (P2PE terminal + cash drawer) vs unmanned pay station;
   confirm **PCI scope is kept out of the application** via a standalone certified terminal
   (see [[bom]]).
4. **Reconciliation channel.** Even if "offline," establish *some* periodic path (USB, hotspot,
   manager visit) to reconcile the signed log against an external authority — the real anti-fraud
   control. See [[reconciliation]].
5. **Durability / backup.** Backup strategy for the [[sqlite]] database + recovery plan; "sync
   later" currently leaves a disk failure as **total revenue-history loss**.
6. **Secure-element integration.** Confirm [[atecc608]] wiring/usage on both the host (event
   signing) and, if pursued, the custom controller (command authentication — see
   [[esp32-custom-controller]]).