Structure-aware adaptive sampling for venue seat inventory verification

Prepared by

Loft Technologies Ltd, Kampala, Uganda

Status

Published for review and field validation. Thresholds, weights and switching rules are provisional until the validation programme in Section 11 is complete.

Case data

The Akii Bua figures were recomputed from Loft’s seat plan v2 for the venue, prepared from the venue’s seat placement drawing of August 2026. They illustrate the method and are not a certification of the venue.

Case study

Akii-Bua Olympic Stadium, Lira City, Uganda: 20,096 seat records in 93 blocks and 909 rows

Executive summary

SAVS lets an operator accept a venue’s digital seat inventory for sale on documented, reproducible evidence, at a stated confidence, without a seat-by-seat survey.

• Why random sampling alone fails. Detection depends on how many seats a defect touches. Small but serious defects (a missing chair, a shifted row, a misnumbered skybox) are rarely found, and seats missing from the digital list can never be found by sampling that list.
• The design principle: census the structure, sample the seats. For a first acceptance, every block and every row gets a blind structural test of its end labels and chair count. Seats are then sampled for the defects structural tests cannot see.
• A guarantee that holds wherever defects are. Seats are drawn at random within each block, and every seat’s chance of selection is at or above a floor set by the assurance target. Risk weighting can raise that chance, never lower it.
• Known problems are inspected, not sampled. Every exception found by digital validation or raised by the venue gets its own task.
• Escalation follows published rules. A finding triggers its neighbourhood, its row, a tightened block sample and, if needed, a full inspection of the block.
• “Sample Verified” is a precise claim. All blocks and rows passed their structural tests, all exceptions are closed, and a seat sample that finds no defect bounds the remaining seat-level error rate, for example to about 1% at 95% confidence. It never means that every seat was inspected.
• Akii Bua, illustrative plan. About 1,600 field tasks (103 exception tasks, 930 structural tests, 487 sampled seats and 72 independent re-inspections). A full survey would read every label in the same 909 rows; the field trial will show which costs less. The row census also yields a measured physical seat count for the open capacity question (19,996 sellable seats drawn against 20,009 in the drawing’s table).
• Status. All thresholds are provisional. Simulation and a field trial must calibrate them before certification claims are made.

§ 1Introduction

Digital reserved-seating systems rest on one assumption: every sellable digital seat corresponds to the correct physical seat in the venue.

That assumption is usually inherited from architectural drawings, CAD files, spreadsheets, contractor schedules, legacy ticketing databases or hand-made seating plans. A digital seat record does not by itself establish that the physical seat exists, and physical existence does not establish that the seat is represented correctly. A seat may:

• not exist;
• exist under a different number;
• appear more than once in the digital inventory;
• belong to a different row or section;
• be assigned to the wrong gate;
• be inaccessible, obstructed or unusable;
• carry an unreadable or incorrect label;
• be physically installed but absent from the inventory;
• sit in a numbering sequence that differs from the digital plan.

Each of these is an operational and commercial risk: duplicate sales, disputes at the gate, spectators routed through the wrong entrance, and capacity figures that do not match the venue. A systematic verification step is therefore needed between the import of a digital seating inventory and its acceptance as a production seat plan.

Complete physical verification of every seat gives the strongest assurance, but it is costly in venues of tens of thousands of seats and must be repeated whenever the inventory changes. Simple random sampling reduces the effort but, as Section 3 shows, misses exactly the errors that matter most. This paper proposes a middle path, Structure-Aware Adaptive Sampling (SAVS), and shows how it can be built into TKT, Loft’s ticketing platform.

§ 2The verification problem

Verification asks whether a digital inventory corresponds to the physical venue closely enough for reserved-seat sales and access control. It is a detection problem before it is an estimation problem.

A venue holds N digital seat records, each carrying attributes such as:

This paper uses the following definitions.

• Digital inventory: the seat records of one inventory version.
• Physical configuration: the chairs, labels and signage installed at the time of inspection.
• Correspondence: a one-to-one mapping between in-scope digital records and physical seats that preserves identity (block, row and seat label) and the attributes the operation relies on (usability, view, category and gate).
• Discrepancy: any departure from that mapping: a record with no seat, a seat with no record, two records on one seat, or a record mapped to a seat that carries a different label.
• Material discrepancy: one that can cause a duplicate or impossible sale, a wrong seat assignment, a wrong entry route or a wrong capacity figure.

Two populations are in play: the digital records and the physical seats. Verification must find records without seats and seats without records, and a sample drawn from the digital list can only ever see the first.

The principal question is therefore not only “what percentage of seats is wrong?” The operational questions are whether there is a material error anywhere in the venue; whether whole rows or sections are represented incorrectly; whether numbering sequences, row boundaries and numbering directions are correct; whether seats are assigned to the correct block and row; whether errors are concentrated in particular areas; and whether the remaining risk is low enough to sell reserved seats. A method must answer for individual defects and for structural defects, and state what it can claim about each.

§ 3Why random sampling of seats is not enough

A simple random sample of seats gives an exact guarantee, but only about how many seats are wrong, never about where. For venue inventories, that guarantee misses the defects that matter most.

What a random seat sample guarantees. If D of N seat records are defective and n records are drawn at random, the chance of finding at least one defect, assuming that a check of any affected seat reveals it, is:

The formula depends on D alone. It does not matter whether the defective seats are scattered or packed into one row: clustering does not weaken a random sample. What clustering changes is how much one well-placed test can find, and many material defects involve very few seats.

Small defects are found rarely. At Akii Bua (N = 20,096), a 296-seat sample finds a missing chair 1.5% of the time, a misnumbered skybox (12 seats) 16% of the time and a numbering shift affecting 16 seats 21% of the time. Quadrupling the sample to 1,168 seats raises those figures only to 6%, 51% and 62% (Figure 1).

One observation can test a whole sequence. Suppose a row is recorded as A1 to A30 and physical seat A7 is missing, so every later label has shifted. Random checks of A2, A4 and A6 find nothing. One check of the row’s last seat, or one count of its chairs, finds the problem at once.

Seats missing from the list can never be drawn. A sample drawn from the digital inventory cannot select a physical seat that is not in it: a row extension, an unrecorded back row, a temporary stand. Only a physical walk of the venue’s structure finds them.

A venue-wide sample says little about any one block. 296 seats spread over 93 blocks is about three per block, and a 12-seat skybox expects 0.18 sampled seats. A clean venue-level result bounds the venue-wide error rate; it does not show that any particular block is correct.

Known ambiguity should not be left to chance. When digital validation or the venue has already flagged an uncertain row or area, inspecting it directly is cheaper and more certain than hoping the sample reaches it.

Random seat sampling stays the right tool for one job: bounding the rate of seat-level errors that structural tests cannot see, such as a wrong label in mid-row, a broken chair or a wrong category. SAVS keeps it for that job and adds the tests that do the rest.

§ 4Statistical foundations

SAVS introduces no new statistics. It combines established sampling methods in a way fitted to how venue errors behave.

Acceptance sampling. ISO 2859-1:2026 sets sampling schemes for a continuing series of lots, indexed by an acceptance quality limit, with switching rules between normal, tightened and reduced inspection as evidence accumulates. ISO 2859-2:2020 covers isolated lots, indexed by limiting quality. One inventory version resembles an isolated lot, so SAVS borrows limiting-quality thinking for a single acceptance and the switching idea across versions and venues (Section 7.4). Neither standard defines stadium seat verification; SAVS adopts their principles, not their tables.

Discovery sampling with zero acceptance. When any defect matters, the sample is sized to find at least one defect with high probability if the defect rate is at or above a stated level, and the lot is accepted only if none is found, an acceptance number of zero (Squeglia, 2008). Section 6.2 gives the calculation.

Bounds from zero findings. Finding no defects in n random seats does not show that there are none; it bounds the rate. The one-sided 95% upper bound is close to 3/n, the “rule of three” (Hanley and Lippman-Hand, 1983), and is computed exactly from the binomial (Clopper and Pearson, 1934) or the hypergeometric distribution.

Stratification. Dividing a population into strata and sampling each one guarantees coverage of every stratum and usually improves precision (Neyman, 1934; Cochran, 1977). SAVS stratifies by block.

Unequal probabilities. Units may be selected with different probabilities, provided each is known and greater than zero; estimates then weight each unit by the inverse of its probability (Horvitz and Thompson, 1952). Risk weighting in SAVS is unequal-probability sampling with a floor.

Adaptive sampling. In adaptive designs, what is observed changes what is selected next, which pays where the feature of interest is clustered (Thompson, 1990; Thompson and Seber, 1996). Adaptively added units are not a random sample, so an error rate computed naively over everything inspected overstates the true rate. SAVS therefore keeps adaptive additions out of its statistical statement (Section 5.1).

Rectifying inspection. When a lot fails its sample, classic schemes inspect it in full and correct it, which limits the quality that leaves inspection, the average outgoing quality of Dodge and Romig (1959). SAVS applies the same logic per block: a failing block is inspected and corrected, not merely rejected.

Sequential decisions. Deciding as evidence arrives can reach the same error rates with fewer observations than a fixed sample (Wald, 1945). The SAVS escalation ladder is a simple sequential rule; formal sequential designs are a candidate for a later version.

§ 5The SAVS framework

A SAVS inspection plan is the union of four samples, each allowed to support a different kind of claim, run in five layers.

5.1Four samples, five layers

Three rules keep the claims honest:

1. 1Every inspected unit records why it was selected.
2. 2Only units drawn with known probabilities enter the statistical statement. Exception tasks and adaptive additions support closure statements, never the error-rate bound.
3. 3A statement is made only at the level its evidence supports: a census statement for what was tested in full, a bound for what was sampled.

5.2Venue hierarchy and inspection units

SAVS treats a venue as a hierarchy with a test at each level, not as a flat list of seats. A typical hierarchy runs venue, stand, tier, block (or section), row, seat; the levels are configurable because venues name them differently.

The sampling engine must know each seat’s row, each row’s block and each block’s stand, and also the order inside them: rows from front to back, seats along each row, the numbering direction, aisle positions and which blocks adjoin. That order is what makes blind tests possible, because a position can be described physically (“the third chair from the aisle on your left, facing the pitch”) without naming the expected label.

§ 6Building the inspection plan

A SAVS plan is built in a fixed order: validate the data, size the seat sample, allocate it across blocks, add the structural census, make every task blind, and weight the sample by risk.

6.1Pre-sampling digital validation

Physical inspection starts only after automated checks of the imported data, so that no field effort is spent finding what a computer can find. The checks below are the minimum.

• Unique identifiers. Every sellable seat has a unique canonical identifier, for example W101-H-17. A duplicate is an immediate exception, never left for the field to discover.
• Row sequences. Missing or duplicated numbers, unexpected resets, unusual starting numbers, discontinuities, and row lengths out of line with neighbouring rows.
• Hierarchy consistency. Every seat references a valid stand, tier, block, row and gate.
• Capacity reconciliation. Seat records are summed and compared with every capacity the sources declare: row, block, stand and venue, and by seat model or category where the drawing gives them.
• Spatial anomalies. Where coordinates exist: overlapping seats, unusual gaps, seats outside their block’s outline, abnormal spacing, and ordering that contradicts the numbering direction.
• Provenance. Which records come straight from the source, and which were inferred, joined or proposed during import.

Validation produces two outputs. The exception register holds one entry per finding, with its class (Section 7.1), the question it raises and who can answer it: the venue, the drawing’s author or a field inspection. The risk inputs per block feed the weighting in Section 6.6. Exceptions are never fixed silently: each is either corrected with a recorded decision or carried into physical verification as a task.

Loft’s drawing conversion toolkit already runs the first four checks. The Akii Bua v2 files pass the identifier, sequence and hierarchy checks with one documented exception (S233 row X), and the capacity check finds a 13-seat gap that is registered in Section 8.2.

6.2Sizing the seat sample

The seat sample is sized from an assurance target fixed before any seat is drawn: find at least one defect with probability 1 − β whenever the defect rate is p^∗ or more. Read the other way, a sample that finds nothing shows that the rate is below p^∗ at confidence 1 − β.

• The sample barely depends on venue size. It is close to 3/p^∗ seats, so a 40,000-seat venue needs almost the same sample as Akii Bua for the same target.
• Halving the target rate doubles the sample. Assurance at low defect rates is expensive, which is why SAVS does not rely on seat sampling for structural defects.
• No observed errors does not mean no errors. If 296 random seats are all correct, the 95% upper bound on the defect rate is 1.00%; at 592 seats it is 0.49%, and at 1,168 seats 0.24%.

The target applies to critical and major defects together; minor defects are recorded but do not fail a plan (Section 7.1). The calculation assumes the inspector recognises every defect seen. If an inspector catches a real defect with probability s, the effective sample is about s × n, so the sampling floor in Section 6.3 is divided by s. Re-inspection gives a lower bound for s (Section 6.5).

6.3Stratified allocation with a floor

SAVS samples seats block by block and sets a floor on every seat’s chance of selection, not only a minimum count per block. The floor is what lets the venue-level guarantee survive risk weighting. The usual allocation spreads a total sample n in proportion to block size N_h and risk weight w_h:

On its own, this lets heavy weights in some blocks starve others. SAVS instead fixes a base inclusion probability π₀ and allocates:

where m is a minimum per block (default 2) and D^∗ = p^∗ N is the number of defective seats the target must catch. With seats drawn by simple random sampling inside each block, independently between blocks, every seat’s chance of selection is at least π₀, and for any D^∗ defective seats, wherever they sit, the chance of missing them all is at most (1 − π₀)^D∗ = β (Appendix A). Risk weights can only add inspection; they can never weaken the guarantee or leave a block unvisited.

The guarantee depends on that design. A plan that selects seats in groups, such as whole rows, can keep every seat’s chance above the floor and still miss a defective row far more often, so systematic and spatially balanced selection are not used for the seat sample.

At Akii Bua, for a 1% target at 95% confidence, π₀ = 1.479%. The sampling frame, the seats not already read in full under Layer A, holds 19,556 seats in 80 blocks. With m = 2 and a weight of 2 in the 43 elevated blocks, the sample is 487 seats, 2 to 14 per block; without weighting it would be 326. Placing 201 defective seats where they are least likely to be found still leaves a 96.0% chance of finding at least one, if inspectors miss nothing.

6.4The structural census

SAVS censuses the structure and samples the seats. Structural units are few (Akii Bua has 93 blocks and 909 rows against 20,096 seats, 22 seats to a row on average) and each structural test checks a whole sequence, so testing all of them is affordable and decisive.

Rows. The row test records the first label, the last label and the chair count, blind. One test catches a shift, a truncation, an extension, a missing or extra chair and a wrong row letter anywhere in the row. When the inspector also records which physical end carries the first label, it checks the numbering direction.

Why every row, not a sample of rows. A single defective row is material, and a random sample of rows finds one only in proportion to its size: catching one bad row among 909 with 95% probability takes 864 row tests. Testing all 909 costs little more and leaves no row untested, inspector error aside. A row sample is enough only when the target is a share of rows: 257 random rows find a problem affecting 1% of rows (9 rows) with 95% probability. SAVS therefore tests every row for a first acceptance and samples rows only for re-verification with a clean history (Section 7.4).

Blocks. Every block gets a block test: label and signage, the front and back row letters, the number of rows and the numbering direction. This catches block-level errors, such as a swapped label or an unrecorded back row, in one visit.

Coverage. A walk of each stand and tier matches every seating area seen against the block list and records any area the inventory lacks, such as press seating or a temporary stand.

Positions inside rows. Seat checks drawn in the sample cover interior positions, and registered exceptions cover numbering transitions, aisle crossings, unusual gaps and block boundaries. A row recorded as seats 1 to 35 is thus tested at both ends and, if it falls in the seat sample, at a random interior position, rather than at three arbitrary interior seats.

The field trial must time each kind of test. If reading every label proves little slower than counting chairs, full enumeration becomes the better plan for a first acceptance, and SAVS sampling applies to re-verification and to changed areas only.

6.5Blind verification and independent re-inspection

SAVS tasks are blind by default: the inspector records what is there before seeing what the inventory expects. A directed instruction such as “Confirm that Row H contains seats 1 to 34” hands the inspector the answer and invites confirmation bias. A blind task reads instead: Locate Block W101, Row H. Record the first visible seat number, the last visible seat number and the total physical seat count. The application compares the observation with the inventory only after it has been submitted.

• Blind by default: row ends and counts, block labels, numbering direction, unusual sequences, and seat checks, where the task names a position and the inspector reports the label found there.
• Directed only where a blind question is impossible, for example “Is the view from W101-H-27 obstructed? Photograph it.”
• Enforced by the application: expected values stay hidden, an observation locks on submission, and any later change is kept as a revision with its reason.

Independent re-inspection (Layer D). A random 5% of completed structural tests and seat checks are repeated blind by a second inspector who does not see the first result, and a disagreement is settled by a third observation or a photograph. Because both inspectors record values rather than verdicts, disagreements measure the recording error rate e whatever the defect rate. A real defect is missed only when an error happens to reproduce the inventory’s value, so the sensitivity s in Section 6.2 is at least 1 − e. Directed yes-or-no tasks are different: at low defect rates two inspectors agree even if neither notices anything, so their sensitivity is measured on known cases from the exception register. If agreement falls below a provisional 98%, that inspector’s work is re-inspected at a higher rate.

Separation of duties. Inspectors should not be the people who built or imported the digital inventory. The issued plan stays hidden from the venue and the import team until field work ends, so nobody can correct only the seats that will be checked.

6.6Risk weighting

Risk weighting sends more inspection where an error is more likely or would cost more, under rules fixed before sampling so that the plan cannot be steered after the fact. The likelihood of error in block h can be scored from the validation outputs:

where D_h counts detected digital anomalies, C_h measures capacity discrepancy, M_h marks manual modification or inferred data, H_h records past verification failures and U_h marks unresolved venue or drawing ambiguity. The coefficients are set by the verification policy. Consequence is scored separately, because an unlikely error in an accessible or VIP area can matter more than a likely one elsewhere. For auditability, SAVS turns scores into tiers rather than using raw scores.

Weights only raise selection probabilities above the floor π₀. At Akii Bua, the illustrative plan elevates 43 of the 80 drawn blocks: those holding registered exceptions, joined or renamed rows, restricted-view seats or possible companion seats. Elevating on consequence as well, for VIP and premium categories, would add more.

§ 7Findings, escalation and acceptance

Every finding is classified by consequence, the class decides how far inspection escalates, and fixed acceptance rules decide when an inventory may be published.

7.1Defect classification

Condition is not correctness. A broken chair that is correctly represented in the inventory is not an inventory defect. It is recorded as a condition finding and the seat is made unavailable for that reason, without triggering escalation. Keeping the two apart stops maintenance issues from inflating the measured error rate, and stops inventory errors from hiding among maintenance issues.

7.2Adaptive escalation

Inspection grows where defects are found, by fixed rules, until the defect’s extent is known, it is corrected, and the block’s assurance is restored. This is the principal difference between SAVS and a static sample.

For example, if seat G17 in W101 fails, the inspector checks G16 and G18 and tests row G’s ends and count. If those are clean, G17 is corrected and the block takes a tightened re-sample. If G16 is also wrong, the whole of row G is read and rows F and H are tested. A failure in the tightened sample sends W101 to full inspection.

• An isolated finding still costs the block its clean result. After correction, a fresh sample at twice the block’s rate, plus row tests on any untested rows, must come back clean before the block is accepted.
• Block errors spill over. Full inspection of a block includes block tests on its neighbours, because a swapped label or an offset in row lettering tends to cross a boundary.
• Venue-level switching. If three or more blocks in one stand reach full inspection, or a tenth of all blocks reach the tightened sample, the plan for the rest of that stand, or the venue, is re-issued at the Tightened level (Section 7.4). The statistical statement stays at the issued target until the re-issued plan has been drawn and passed. This mirrors the switch from normal to tightened inspection in ISO 2859-1.
• No de-escalation inside a verification. An escalated block is accepted only after its corrections are re-verified.

Adaptive tasks establish the extent of defects; they never enter the error-rate bound (Section 5.1). All thresholds here are provisional until simulation and field trials calibrate them (Section 11).

7.3Error processes and the tests that find them

SAVS assumes that many seat-plan errors arrive in runs, an assumption that hypothesis H2 in Section 11 tests. If they do, finding one changes the odds for its neighbours, and each kind of run has a test that finds it directly.

Figure 1 gives the random sample’s chance for each defect size. Every clustered process has a structural signature, which is why the structural census does most of the detection work. The last row has none: isolated label errors inside a row are found only by sampling seats, which is the job SAVS keeps for the seat sample.

7.4Acceptance rules and assurance levels

An inventory passes when four conditions hold together; the assurance level decides how much evidence each must rest on.

1. 1Exceptions closed. Every registered exception is closed by a field result or by a recorded decision, for example seats withheld from sale until the venue answers. Reports count the two kinds of closure separately.
2. 2Structure passed. Every block test and row test in the plan has passed, or its failure was corrected and the escalated scope re-verified.
3. 3Seat sample clean. No critical or major defect remains unresolved, and every block accepted on its sample has a clean final sample, tightened where escalation required it.
4. 4Inspection reliable. Independent re-inspection agrees at or above the threshold, provisionally 98%.

The headline bound in Section 9.4 holds only if the probability sample found no critical or major defect at all. If it found some, they are corrected and escalated as usual, and the bound is recomputed from the sample as drawn with those findings counted (Appendix A). That bound is weaker, and the report says so.

Registered exceptions are inspected in full at every level. Movement between levels follows evidence, as in ISO 2859-1:

• Standard to Tightened: the venue-level switching rule in Section 7.2.
• Tightened to Standard: the next verification passes with no block escalated beyond the neighbourhood step.
• Standard to Reduced: two consecutive accepted verifications with no major or critical findings and no reported physical change.
• Reduced to Standard: any major or critical finding, a reported physical change, or a new version that changes structure.

§ 8Case study: Akii Bua

The worked example uses Loft’s seat plan v2 for the Akii-Bua Olympic Stadium, a 20,000-capacity stadium under construction in Lira City, Uganda (The Independent, 2024; Uganda Radio Network, 2026). The plan was built on 29 October 2026 from the venue’s seat placement drawing of August 2026.

8.1The inventory

The inventory holds 20,096 seat records in 93 blocks and 909 rows. Every figure in this section was recomputed from the v2 seat list for this paper.

• Tiers: 13,073 upper-tier and 7,023 lower-tier seats.
• Blocks: 80 drawn blocks plus 13 areas with proposed numbering (12 skyboxes and the VVIP box). Blocks hold 12 to 445 seats (median 222) in 2 to 16 rows (median 8).
• Rows: 871 drawn rows plus 38 in the proposed areas, holding 4 to 40 seats (median 22).
• Flags: 100 restricted-view seats in 23 runs across 11 blocks; 44 seats in 6 rows that look like wheelchair spaces with companion seats, to be confirmed; 173 seats whose numbering is proposed rather than drawn.

The gates need care. The drawing shows none, so the five gates are Loft’s proposed assignment by stand, and their positions are placeholders. Verification treats them as a planning attribute: the venue confirms its real gates first, and route checks from each gate to the blocks it serves follow. These characteristics show why Akii Bua is not a homogeneous population of 20,096 interchangeable seats.

8.2Known exceptions

The v2 workbook and import guide already name twelve questions. Each becomes a direct task rather than something left for the sample to stumble on: known ambiguity is not randomised away.

The capacity difference is not hidden by the method. It stays a registered exception until a measured count and the venue’s answer close it.

8.3An illustrative inspection plan

An illustrative Standard-level plan for Akii Bua comes to 1,592 base field tasks before any escalation. It is computed from the v2 seat list with a 1% seat-level target at 95% confidence; a final plan follows approval of the verification policy.

In the field this means reading every label of 540 seats, reading both end labels of 851 more rows, checking 487 sampled seats, and counting the chairs in every one of the 909 rows. The counts add up to a measured physical capacity for the open question in Section 8.2. A full survey would read every label in the same 909 rows instead of the two end labels and the count; which costs less depends on task times the field trial must measure.

If the plan passes, Loft can state that every block and every row was verified structurally, every exception was closed, and, provided the seat sample finds no critical or major defect, that at most 200 of the frame’s 19,556 seats (about 1%) carry one, at 95% confidence.

A flat instruction such as “inspect 5% of Akii Bua” (1,005 random seats) would find a 16-seat numbering shift only 56% of the time, and could never find a chair missing from the list. The SAVS instruction is different: execute the base plan, then extend inspection wherever evidence of risk or discrepancy appears.

8.4Example field tasks

A field task names a place and asks what is there; it never states the expected answer. Two examples from the Akii Bua plan:

The expected values stay hidden until submission. The application then compares the observation with the canonical inventory and, if they differ, classifies the finding and raises the escalation tasks it requires.

§ 9Evidence, states and certification

Every observation is kept as evidence, every plan can be regenerated, and every result is reported at exactly the level its evidence supports.

9.1Verification evidence

Every observation keeps enough evidence for someone who was not there to review it. A verification record holds the inventory and sampling-plan versions; the unit inspected and why it was selected; the inspector and, for a re-inspection, the second inspector; the timestamp; the observation exactly as submitted, locked on submission; photographs where the task requires them; location evidence (GPS is unreliable inside a stadium bowl, so a photograph of the block and row signage is the default); the discrepancy classification; the escalation tasks it generated; and the resolution, with who made it.

Records are append-only. A correction adds a revision with its reason and nothing is overwritten, which gives a chain of evidence from the source inventory, through physical inspection, to acceptance. No customer, payment or contact data belongs in a verification record.

9.2Reproducibility

Once a plan is issued, its random selection is fixed and anyone with the inputs can regenerate it exactly. The plan stores the seed; the algorithm version and the named pseudo-random generator, with published test vectors so that other implementations draw the same sample; the inventory version, identified by a hash of the canonical seat list; the assurance target, the floor, the tiers, weights and minimum per block; the exception register as it stood at issue; and the selection rules and generation timestamp.

Given the same inventory, algorithm, parameters and seed, the initial sample comes out identical. The seed is fixed before the plan is issued and is not chosen by the team being verified, so that nobody can redraw until a convenient sample appears; committing to it in advance, for example by publishing its hash, makes that checkable. Adaptive additions are recorded separately, each with the finding that triggered it, because they depend on what inspectors observed.

9.3Verification states

An inventory version moves through seven states rather than a binary verified or unverified flag, and the two end states are never equivalent.

Sample Verified rests on structural tests, closed exceptions and a statistical bound; Fully Enumerated means that every in-scope seat was checked. Reports, the TKT interface and any marketing must keep them apart. Corrections made during verification produce a new inventory version, and the certificate is issued for that corrected version: unchanged units keep their evidence and the statistical bound, and changed units are re-verified (Section 10.2). Two administrative states sit outside this flow: Rejected, for a version that will not be accepted, and Superseded, for one replaced by a newer version.

9.4What “Sample Verified” means

Sample Verified means that the inventory satisfied a documented, reproducible sampling and acceptance protocol at a stated assurance level. It does not mean that every physical seat was inspected; no sampling method can show that without full enumeration, and every report must say so. For the illustrative Akii Bua plan, a passing result would read:

The bound holds wherever those defects might sit, because it rests on the floor probability rather than on the average (Section 6.3). It rests on four assumptions, which the report repeats:

1. 1seats were drawn by simple random sampling within each block, independently, at no less than the floor;
2. 2the sample found no critical or major defect (otherwise the weaker bound in Appendix A is reported);
3. 3the floor was adjusted for the measured lower bound on inspector sensitivity;
4. 4the version certified is the version sampled, or inherits its evidence under Section 10.2.

Every report also lists what the result does not cover: individual uninspected seats, defects that cannot be seen, changes after the inspection date, and anything beyond the correspondence between inventory and venue (Section 12).

9.5The certification report

A completed verification produces one report that states the target, the evidence and the limits together. It is generated from the evidence records, never typed by hand, so that every figure can be traced to the observations behind it.

§ 10Implementation in TKT

SAVS fits TKT as a verification stage between importing a venue and publishing it for sale, so that only an accepted revision can become the canonical source of event seat inventory.

10.1Workflow

1. 1Import. TKT’s venue import, or Loft’s drawing conversion toolkit, produces the venue structure (sections, rows, seats and gates) as a draft revision.
2. 2Validate. The checks in Section 6.1 run on TKT’s canonical seating model, and each finding opens an entry in the exception register.
3. 3Plan. The sampling engine issues a plan at the chosen assurance level, with its seed committed (Sections 6 and 9.2).
4. 4Verify. A field application gives inspectors blind tasks, works offline inside the bowl, captures observations, photographs and signage evidence, and synchronises when connected.
5. 5Escalate. Each finding is classified and its escalation tasks are generated automatically (Section 7.2).
6. 6Reconcile. Corrections and decisions are applied as a new revision. Seats with open questions are held or blocked with TKT’s existing seat actions until they are closed.
7. 7Accept and publish. A reviewer accepts the revision as Sample Verified or Fully Enumerated, and only then can it be published; events adopt it as they adopt any revision today.

What has to be built: the exception register and a verification state on each venue revision; a deterministic, versioned plan generator; the field application, with blind task flow, photo capture and re-inspection assignment; the comparison and classification engine; the report generator (Section 9.5); a publish gate that blocks or warns on an unverified revision, set by policy; and delta verification over TKT’s revision differences.

Roles. A verification lead approves the policy, issues the plan and commits the seed. Inspectors carry out tasks. A venue representative answers exceptions. A reviewer, independent of the import team, signs acceptance.

10.2Version control and delta verification

Verification belongs to one inventory version. When the inventory changes, only the evidence for unchanged units carries over:

TKT computes the difference between versions at seat, row and block level and applies these provisional rules:

• Unchanged units keep their evidence when their records (identities, labels, order and the attributes a test examined) are identical and no physical change has been reported.
• A changed seat reopens its row: the row test and any seat checks in that row are repeated.
• A changed block label, row list or numbering direction reopens the block: its block test and all its row tests.
• Added or removed seats change the sampling frame, so the seat sample is topped up until every seat in a changed block meets the floor again.
• Metadata-only changes (category, ticket type, colour) need a desk check, unless the attribute is physically marked in the venue.

Physical works reopen the areas they touch whatever the digital version shows, and evidence ages: a policy may require periodic re-verification at the Reduced level. The certification statement names the date of each piece of evidence it relies on. Delta verification means that a change to one section does not force a new inspection of the whole stadium: the affected section and anything that depends on it are re-verified, and the rest keeps its evidence.

§ 11Validation programme

SAVS should not be presented as better than simpler methods until simulation and a field trial show it. Both are designed here so that the claim can be tested rather than asserted.

11.1Simulation

• Venues: synthetic venues of 5,000, 20,000, 40,000 and 80,000 seats with realistic rows, blocks and aisles, plus the real Akii Bua structure.
• Injected defects: independent random errors; single missing seats; contiguous missing runs; numbering shifts; wrong row boundaries; wrong row and section assignments; duplicated records; unrecorded physical seats; and mixtures of these. A clustering parameter controls how strongly defects bunch.
• Inspectors: a sensitivity below 1 and a false-alarm rate, both varied.
• Methods compared: simple random sampling; fixed-percentage sampling; stratified random sampling; systematic row sampling; SAVS without adaptation; full SAVS; and complete enumeration as the benchmark.
• Equal effort: methods are compared at equal field time, using task times measured in the field trial, not at equal task counts, because a row test costs more than a seat check.
• Precision: about 10,000 runs per scenario and method, which keeps the 95% interval on each detection probability within about one percentage point.
• Sensitivity analysis: escalation thresholds, risk weights, the floor and the re-inspection rate.

11.2Field trial

Run the Standard plan at a venue and, as ground truth, fully enumerate a random subset of its blocks, so that what the plan missed can be measured. The trial also times each kind of task, measures inspector agreement, and tests whether blind tasks stay blind in practice. Its outputs (calibrated thresholds and weights, an effort model and an estimate of inspector sensitivity) replace the provisional values in this paper.

11.3Evaluation metrics

Each method is judged on assurance first and effort second: a method that inspects fewer seats but misses whole defective sections is not better because it is cheaper.

• The false certification probability P_FC is the primary measure: it is the risk the method exists to control.
• Structural unit recall R_U shows whether a method finds every affected row and block, not just many defective seats.
• The average outgoing quality AOQ measures what the venue is left with after correction, which is what spectators experience.
• E[T] and C_D measure cost, and are compared only between methods with acceptable P_FC. The false alarm rate is tracked alongside, because false alarms waste escalation effort.

11.4Hypotheses

The programme tests three propositions, chosen so that the results can count against SAVS as well as for it.

1. 1H1. For venue inventories with spatially or structurally correlated errors, SAVS has a lower probability of false certification than simple random sampling at equal field time.
2. 2H2. That advantage grows as defect clustering increases.
3. 3H3. When errors are independent and confined to labels inside rows, the advantage disappears: stratified seat sampling of equal field time performs at least as well.

H1 is supported only if SAVS’s false certification probability is lower in every clustered scenario, with non-overlapping 95% Monte Carlo intervals at equal expected field time. One result needs no test because it holds by construction: a sample drawn from the digital list can never find a seat missing from it, so for that defect any structural census beats any seat sample. Until simulation and field validation are complete, these are propositions to test, not conclusions to cite.

§ 12Limitations

SAVS reduces the risk of accepting a wrong inventory; it does not remove it, and its reports must say where it stops.

1. 1Sampling cannot prove that any individual uninspected seat is correct.
2. 2Results depend on inspectors’ competence and independence. Blind tasks and re-inspection reduce that dependence; they do not remove it.
3. 3Some defects cannot be seen, such as a wrong digital category or wrong map coordinates.
4. 4The method needs a structured inventory, with rows, blocks and their order. A flat list must be structured before it can be verified.
5. 5Risk weights, escalation thresholds and assurance levels need empirical calibration.
6. 6The statistical bound holds only if the plan is executed as issued, against the inventory version it was drawn from.
7. 7The structural census assumes that every row can be reached and its labels read. Poor labelling raises the cost and may force full reads.
8. 8Venues change after verification, and evidence ages.

Finally, SAVS verifies the correspondence between a defined digital inventory and a physical configuration at a point in time. It does not certify structural engineering, fire safety, crowd capacity or regulatory compliance.

§ 13Conclusion

Digital seat inventories are operating infrastructure: they drive ticket sales, spectator routing, capacity management and access control. Verifying them as a spreadsheet reconciliation is not enough, and inspecting every seat for every revision spends effort on areas that are already right.

SAVS takes the middle path by being explicit about what is known, what is uncertain, what is sampled, what must be inspected, and what needs more inspection once a defect is found. Its central move is simple: census the structure, sample the seats, inspect known questions directly, and escalate by rule.

Akii Bua shows why this matters. Its 20,096 seat records in 93 blocks and 909 rows come with a 13-seat capacity question, a row whose first ten numbers have no chairs, joined corner rows, proposed numbering for 173 seats and 44 possible accessibility positions. A random percentage would leave most of these to chance; SAVS turns each into a task.

The next stage is empirical. Simulation, sensitivity analysis and a field trial will set the thresholds and show whether SAVS meets its objective: lowering the probability that a materially wrong seat inventory is accepted for use, without inspecting areas that are already right.

Appendix AFormulas

The figures in this paper come from the formulas below, computed exactly for Akii Bua’s 20,096 seat records.

Detection by a simple random sample of n from N seats, D of them defective:

Sample size for a target (p^∗, β): the smallest n with detection of at least 1 − β when D^∗ = p^∗ N, rounded. For large N:

Upper bound after zero findings: the largest D whose miss probability is above β. In binomial form:

Bound after one or more findings (x ≥ 1): the largest D for which a binomial count with D trials and success probability π₀ would show x or fewer findings with probability above β. Sampling every seat at exactly the floor makes this exact; for stratified sampling without replacement it is a close approximation, and it is always weaker than the zero-finding bound. At Akii Bua’s floor, one finding gives at most 318 defective seats in the frame, and two give at most 423.

The floor guarantee. Sampling without replacement inside block h, each factor in the product above is at most 1 − n_h/N_h, and blocks are sampled independently. If every block’s sampling fraction is at least π₀, then for any D defective seats, wherever they are:

and with π₀ = 1 − β^1/D∗, (1 − π₀)^D∗ = β.

Rows use the same hypergeometric formula, with R rows of which D_r are defective: at Akii Bua (R = 909), finding one defective row with 95% probability takes 864 random row tests, and finding 9 defective rows takes 257.

Inspector sensitivity s lowers detection to about:

so the floor that keeps the target is π₀ = (1 − β^1/D∗)/s. At Akii Bua, a measured s of 0.9 would raise the floor from 1.479% to 1.644%.

Estimating the number of defective seats from a probability sample with inclusion probabilities π_i (Horvitz and Thompson, 1952):

Monte Carlo precision: the runs needed for a 95% interval of ±h on a probability near 0.5:

Appendix BGlossary