Seven layers, from anonymous sensing to transparent escalation. Everything visible in the control room can be explained to the person waiting in the hall.
Two interchangeable modes. Token mode records only an opaque code, service type and a coarse priority class. Anonymous mode uses Wi-Fi/BLE probe counts, depth-sensor headcounts or turnstile deltas — aggregate integers per zone, never images or identifiers. Counts older than the operating day are discarded; nothing is joinable back to a person.
A per-service-point time-series model blends a seasonal profile (hour-of-day, day-of-week, holiday and event calendar) with a short-horizon residual correction from the last 90 minutes of live arrivals. Output is a 3-hour arrival forecast in 15-minute buckets with an uncertainty band.
Each desk is a multi-server queue: predicted wait = backlog / effective service rate, where the rate is counters open × measured service rate, adjusted for priority pre-emption. A guaranteed 25% capacity reservation for the general lane means priority traffic can never starve ordinary visitors.
Counters, appointment slots and physical space are allocated to minimise a weighted objective: average waiting time plus a fairness penalty on the gap between vulnerable and general users, subject to staffing limits. Recommendations are advisory — a human supervisor approves each change and every approval is logged.
Priority classes are declared, not inferred: time-critical (medical/emergency), accessible priority (senior citizen, disability, pregnancy, infant), and general. Rules are published in the visitor app so anyone can see why one token was called before another.
The fairness score penalises two things: the equity gap (priority wait minus general wait) and the spread of average waits across desks. It is reported alongside average wait so operators can never optimise throughput at the cost of the people who can least afford to stand.
Unusual crowding moves the facility from Normal to Watch to Surge. Each level lists the exact triggers, the actions taken and who approved them, and pushes a multilingual notice to waiting tokens instead of leaving people guessing.
minimise J = w1 · avgWait
+ w2 · max(0, priorityWait − generalWait)
+ w3 · spread(waitByDesk)
subject to openCounters(d) ≤ staffAvailable(d)
generalCapacityShare ≥ 25%
zoneOccupancy(z) ≤ safeCapacity(z)