Consumer activation engineering — receipt-scan entry at national scale.

A national consumer promotion is not a marketing website. It is a distributed data-ingestion system with strong correctness requirements: every submission must be deduplicated, every submission must be auditable, every prize draw must be defensible under public scrutiny. The failure mode is not slow — it is a contested winner, a duplicate entry, or a lost submission during a traffic burst.

The engineering discipline here is data integrity under bursty load with three heterogeneous clients writing into the same domain. A responsive consumer web reaches submissions from any device at any time. An in-store tablet reaches submissions from supermarket floors where the operator has no IT staff and the session must self-recover from abandonment. A brand operations console reaches submissions from moderators who must make binding decisions under time pressure.

Symloop's position from day one: one domain model, one write path, one audit log — three render targets, each engineered for the physical reality of where it runs.

Consumer entry surface — a responsive single-page application with form-factor-specific layouts. The design principle: responsive CSS stretches the same UI across breakpoints, which is the wrong architecture when touch targets, input modality, and viewport context differ. We treat desktop, tablet, and mobile as three distinct render targets sharing the same form model, input validation, and submission pipeline — swapping the layout tree at runtime based on device class and orientation.

In-store tablet surface — a kiosk-hardened client engineered for unattended operation on supermarket floors. Self-recovering session state after idle timeout, attract-mode that prevents dead-screen failure, touch targets sized for gloved or hurried consumers, and a narrow deployment target that eliminates the class of bugs that come from running general-purpose software in a kiosk context.

Operations console — a brand-side console with strict separation between ingestion and review. The team reviewing entries never shares a code path with the team submitting them. Role-scoped access, immutable audit log per decision, and an export pipeline that produces a prize-draw manifest with a defensible provenance trail — so the draw itself is verifiable end-to-end.

Write-path isolation. Consumer ingestion and operator review run on separate read/write planes. When a TV spot spikes consumer writes by an order of magnitude, the review console stays responsive because it reads from a path that does not contend with the ingestion firehose.

Deterministic deduplication at the write boundary. Duplicate detection runs at submission time, not in batch post-facto. Perceptual hashing on receipt imagery, stable identity hashing across submission fields, and idempotent write keys so a retry never creates a ghost entry.

Immutable audit log. Every state transition — submission, validation flag, moderator decision, export event — is appended to an audit log that is readable by the operations team and not mutable by anyone, including engineers. This is how a prize draw remains defensible.

Burst-aware static delivery. The consumer surface is delivered as static assets from an edge network so a TV-driven traffic burst never touches origin infrastructure for the first paint. Dynamic state — submissions, validation — scales horizontally on managed primitives so we pay for capacity at the second, not the hour.