01 / PROBLEM

THREE QUESTIONS. ONE GREEN LIGHT.

A player buys a specific hour on a specific machine. Between that payment and a playable game sit four systems, three companies and one desk — answered by a single status.

PLAYER

“Is this PC actually mine?”

The booking names a number. It is printed on a case under the table, in a room numbered from the other end. Paid time runs either way.

Arbat hall · 52 seats · the app highlights 22

Observed on a real first visit

A GREEN STATUS IS NOT A FACT. IT IS FIVE FACTS AVERAGED INTO A LIE.

BASELINE

WHAT EXISTEDBEFORE THE WORK

A booking app already shipped. Gaming PCs on a third-party club system with its own client. One reference branch, 52 machines. No in-house developer, four hours of capacity a week.

No product spec for the machine side. No API contract I was ever given in full. The baseline and follow-up figures presented in this case study were supplied by Ayazbi, the TOP Game manager.

01

Session state

02

Machine · hall

03

Time remaining

04

Paid until

05

Safe actions

V2 · Session panel — the green dot, and the five facts it averaged away.

1 2 3 4

01

Price is visible

02

Player picks the pass

03

Discounts self-served

04

Player pays, no desk

V2 · Tariffs — the one step that always went through the desk, now finished by the player alone.

04 / STATE MODEL

The computer is not a screen. It is a promise with five signatures.

Once autonomy became the target, every comfortable simplification became a liability.

V2 · Lock screen — the machine names itself and grants nothing until someone is identified.

✦

paid ≠ booked

Money has arrived. It says nothing about which machine, or when.

✦

booked ≠ access granted

A reservation is a claim on time, not a door that opens.

✦

access granted ≠ unlocked

The door can open while the machine still refuses the person in front of it.

✦

unlocked ≠ playable

A desktop is not a game. Updates, launchers and accounts sit in between.

✦

playable ≠ clean

The previous session can still be signed in behind a finished-looking screen.

If no administrator stands between the player and the machine, the interface itself has to be honest about what it knows — including the moments when it knows nothing.

THE SPINE OF THE PRODUCT

Eight facts behind one plain sentence.

A locked PC can be ready for the next customer. An unlocked PC can be unusable. A disconnected PC may still be running a paid session — so the specification carries eight independent dimensions, and the player sees one sentence and one action.

A locked PC can be ready

Ready for whoever comes next, and granting nothing at all until someone is identified.

An unlocked PC can be unusable

Unlocked and busy: the wipe owns the machine until it can prove the last player is gone.

A paid session outlives the answer

The timer runs on facts the client keeps re-checking, never on one status it decided to trust.

05 / PRODUCT EXPERIENCE

SHORTEST PATH TO A PLAYABLE GAME.

One dominant action per screen, chosen by state: enter with the app code, pick a package, start the session, choose a game, continue CS2, confirm the added time, finish safely. Balance, loyalty and club offers never compete with it.

LOCK   The station number is the largest element on screen — larger than the logo, read from a metre away by someone who has just walked in. No number in configuration means no number on screen and no login offer at all.

HOME   Session status is persistent chrome, not a fifth destination. Player counts and star ratings were removed: the club has neither the source nor the right to show them.

LIBRARY   Installed and ready is a filter, not a badge. «Game clicked» is not «game ready» — launch carries nine states from requested to playable.

LAUNCH ROUTE   Own account or club account — the consequential difference. Credentials are never stored or shown in TOP Game, on a machine the next stranger will use in an hour.

TARIFF   Price and the resulting end time are both visible before payment. The client displays one authoritative offer; it never calculates a rate, a discount or a refund.

SESSION   Time is the product’s main object, not a status line. This is its full-screen form; in game, the same four actions live in a compact tray-and-hotkey panel. The always-on-top overlay was tested against anti-cheat, focus and exclusive-fullscreen behaviour on real titles before rollout.

06 / SYSTEM

THREE FORMS. ONE PRODUCT.

One writer per fact

The hardest part was not the interface. It was agreeing who owns each consequential fact once four systems disagree. «The backend decides» is not an answer: a backend cannot prove a physical action happened.

So requested state, last observed state, observation time and entitlement are stored as four different things. The client presents, executes, observes and reports honestly — including result unknown. It never creates an entitlement, adds time, prices anything or declares cleanup done.

Three ways to sign in

01 — A short-lived claim from the mobile app, bound to the visible identity of this machine.

02 — One-time phone verification, or assisted recovery.

03 — Reusable phone and password — parity only, approved by the shared-PC threat review. Its prominence on the lock screen was settled with the design system after the review.

A bank success is not an hour of play.

Recovery is the product, not an error state bolted onto it. An unknown result never resolves itself into success or failure, and a retry re-checks the original attempt instead of creating a second one that could charge a player twice or end the next player’s session.

◧

ENTRY

Three entry layouts were explored in the file. The QR-first layout was declared current after the threat review; the other two are kept as a record.

⏻

VOLUNTARY ENDING

The exact remaining time and the approved consequence of giving it up. If the financial consequence is unknown, the action is not offered as final.

◉

REMOTE ASSISTANCE

Who is asking, what for, and for how long — consent is bounded to ten minutes, the indicator persists, and a stop control stays on screen.

09 / ACCESSIBILITY & LANGUAGE

A PHONE IS HELD. THIS SCREEN IS READ STANDING UP.

The type scale, the contrast floor and the keyboard model all follow from one physical fact: the reader is a metre away, has just walked in, and may be looking for a machine rather than at the screen.

TYPE SCALE

14 · 16 · 18 · 20 · 24 · 32 · 48 · 64 · 232

STATION NUMBER

232

232 px — one per screen, read from a metre away

the same number, at the size it is actually drawn

10 / DESIGN LANGUAGE

Two oranges. No red.

Two audits turned a screen that looked strong into a screen that could be built. The rules below are what survived them — short enough to be remembered by whoever builds the next screen.

The 71.87% discovery

The lock screen carried 8.6 and 12.9 px text, three type families, and a left margin at five different values while the right was clean. Dividing the odd sizes by 0.71865 returned whole numbers: a block designed at another scale had been pasted in and squashed. That one act explained almost every geometric defect.

White text sat on a photograph of lava — 3.5:1 body, 1.4:1 for a highlight label, unfixable by colour. Scrim became a component with a defined gradient and a minimum height. A Kazakh greeting began with a Latin «C» instead of a Cyrillic one: identical to the eye, broken for search, spellcheck and font fallback.

Three surfaces, one palette

The home screen read well and lived in a different design system from the lock screen and the mobile app — cool blue-grey against warm. The audit counted twenty near-whites doing the job of three text roles, thirteen type sizes against nine, and twelve corner radii where four sat side by side, indistinguishable.

A «recently played» badge failed at 2.60:1; white reaches only 3.69 on that orange. The label became near-black at 5.40:1, and the rule generalised into the two-orange system above.

// Demonstration build: entry status model.
// This example does not grant a paid session.
enum EntryStatus
    NotPresented
    Checking
    RefusedWrongStation
    RefusedNotStarted
    RefusedExpired
    Unverifiable
    NeedsStaff
    ResultUnknown
    ServiceUnavailable
    Offline
// Integrated access depends on the incumbent
// system, not on a locally simulated approval.

Keep the boundary visible

A demo may show the interface without granting a paid session. The integrated product relies on the incumbent system for entitlement. Keeping these contexts distinct prevents a demonstration from being mistaken for real access.

The same discipline runs through the rest. Publisher artwork is absent by design, so a tile without a licensed file is drawn from the letters of its title and says so. Station identity splits into a machine id and a printed display number: when hardware is replaced, the sticker does not change.

Scope: the client owns the player-facing layer only. Windows lockdown, game launching, payments and the backend stay with the incumbent system and are reached through integration — the client never creates an entitlement. It is per-monitor DPI aware, and the legal wording carried over from iOS was reviewed by a lawyer before rollout.

12 / THE PAYOFF

WHAT IS BUILT, WHAT IS MEASURED,

WHAT COMES NEXT.

Ayazbi, the TOP Game manager, supplied the before-and-after figures below. They cover sessions without staff assistance, time to play, staff interventions and repeat payment attempts.

ANTI-GAMING RULE

Autonomy counts only when the session also ends cleanly. A metric you can improve by making the system harder to leave is not worth moving.