Limits and checks are switches, not code. Every change is logged with who, when and why.
Customers selling prizes back for CM Points.
A supervisor (a different person) must approve a buy-back worth more than this many CM Points. Pilot: ON at 3,000 CM Points.
At least 1
A supervisor must approve once one customer's buy-backs today would add up to more than this many CM Points, so splitting a big buy-back doesn't skip the check.
At least 1
The same check per staff member: a supervisor approves once the buy-backs they handled today pass this many CM Points. OFF at launch.
The most CM Points one customer can get from buy-backs in a day. OFF at launch (no limits).
A buy-back value can be at most this % of the item's CM Points price. OFF at launch; the value is always below the CM Points price anyway.
When an outlet buys back more of an item than its machines recorded as won.
How many days of machine wins the buy-back check looks back over.
Allowed: 1 – 365
Staff must photograph the prizes before a buy-back is saved.
When ON, the prize still goes to quarantine at once, but the customer's CM Points wait until a second person checks the prize and releases them. OFF at launch: points can be spent at once.
The customer CM Points wallet.
Hours a wallet can't spend after its password, email or PIN changes, to protect stolen accounts. 0 = off. The wallet terms say 24 hours: if you change this, the terms and their version must change too (src/lib/points/terms.ts).
Allowed: 0 – 168
Customers must give a mobile number to open a wallet. Email is always required.
How many times one login may be told "this mobile already has a wallet" in an hour (signing up or changing the number). After that it must wait, so nobody can test number after number to find out who has a wallet. Empty = no limit.
Allowed: 1 – 100
Wrong wallet PINs (and wrong My QR codes per phone) before a lock.
Allowed: 3 – 10
How long a locked wallet PIN or My QR stays locked.
Allowed: 1 – 1440
How long a scanned My QR stays usable on the kiosk that scanned it, so staff can finish the exchange.
Allowed: 1 – 15
How many phones can show a customer's My QR at the same time.
Allowed: 1 – 10
How many times the kiosks may check one customer's balance for a yes/no answer in a day. Stops staff fishing for a balance.
Allowed: 1 – 100
Pause wallet spending (for the security pause time) when a new My QR phone is added to a wallet that holds points.
A wallet correction can't be approved by someone whose access the proposer gave (or who gave the proposer's), within this many days.
Allowed: 1 – 365
When ON, the prize catalogue on the points site shows how many pieces each outlet has and lets customers pick an outlet. OFF at launch: customers see the prizes with their CM Points and KB Points only.
How long points last.
CM Points expire after this many months. OFF: points never expire.
KB Points tickets at the counter.
Alert the office when a ticket worth more than this many KB Points is used at the counter.
At least 1
Alert every time staff type a ticket number by hand instead of scanning it.
When a kiosk asks the office to approve a big buy-back or a void, the request waits this long for an answer, and an approval stays usable this long.
Allowed: 1 – 120
At the daily points-machine check, a difference between the machine's day report and the ticket exchanges larger than this many points is a mismatch and alerts the office. Office only: it is never shown on the tablet. Launch: 0.
Allowed: 0 – 1000000
If an outlet that took tickets (or issued refund slips) yesterday has not done yesterday's check by this hour the next morning (0–23, Malaysia time), the office is alerted. Empty = no reminder. Launch: 11 (11:00).
Allowed: 0 – 23
Whether staff photograph the slip the points machine prints when they deduct a ticket exchange. The server decides for each basket when it is quoted, so staff know before they deduct.
With "Above a number of points", a ticket exchange worth more than this needs the deduction-slip photo. Launch: 2,000.
Allowed: 1 – 100000000
With "1 in N, at random", on average one ticket exchange in this many needs the deduction-slip photo. Launch: 10.
Allowed: 2 – 1000
A ticket-exchange quote (the basket total and whether the slip photo is needed) can be used for this long, on the same day. After that the tablet quotes the basket again, so an old quote can't skip a photo. Launch: 30 minutes.
Allowed: 1 – 720
Photo: staff scan the prize and take one photo of the ticket machine's receipt with the prize; no ticket is scanned in KODOMO (D-285). Ticket scan: the older flow (scan the ticket QR, type its value and the invoice number). Launch: Photo.
The daily points-machine check (Close the day). Off: the tablet hides it and its reminder, and the office gets no reminder (open reminders are closed on the next hourly run). Launch: off (D-288).
Google Gemini reads the receipt in each KB Points ticket exchange photo and checks that its amount matches the prizes' KB Points, the date, the outlet and the receipt number. It only flags; the office decides. The key is set on the server. Launch: Gemini (D-284).
Also read the receipt number (Serial No) and flag "Receipt used twice" when a receipt was already photographed for another exchange at the same outlet. While on, a receipt whose number can't be read is flagged "Can't read the receipt". Launch: on (D-289).
The receipt amount may differ from the prizes' KB Points total by this many points before the exchange is flagged. Launch: 0.
Allowed: 0 – 1000000
A reading the AI is less sure of than this (0 to 1) is flagged "The AI isn't sure" for the office to look at. Launch: 0.7.
Allowed: 0 – 1
A check still waiting this many minutes after the exchange (or after a retry or the last request) is flagged "Never checked"; the office can check it again. Launch: 30 minutes.
Allowed: 5 – 1440
How many AI answers one exchange photo may get: the first one and the office's retries. A request that never got an answer doesn't count. Launch: 3.
Allowed: 1 – 10
Meter readings and counts at machine visits.
Staff must photograph the prize-out meter when they read it. Makes faking a reading much harder.
Staff read the token-IN meter with the prize meter at every reload or visit, and both as closing readings at a prize change, a move or a meter change.
When staff must count the prizes left inside a machine.
A normal visit where the meter went up by more than the prizes that could have been caught (a typing slip, or a meter changed without recording it). Block: staff must record the new meter first. Alert: save it and alert management; those wins never back buy-backs.
Alert when a machine visit pays out more than this % of what the machine's own recent prizes-per-token rate would give. Empty = off.
Allowed: 120 – 2000
The check runs only when the machine took at least this many tokens in the comparison period, so there is enough history to compare with.
Allowed: 1 – 1000000
Alert only when a visit paid out at least this many prizes more than expected. Small differences are normal luck.
Allowed: 1 – 10000
How many days of the machine's own visits make its normal payout rate.
Allowed: 7 – 365
Every morning, this many machine visits from the day before are picked at random in each region for the office to compare the meter photo with the typed readings. Empty = off. Launch: 3.
Allowed: 1 – 50
The refill planner works out each machine's wins per day from its visits in this many days. Launch: 14 days.
Allowed: 3 – 90
The refill planner suggests enough prizes to last this many days. Launch: 3 days.
Allowed: 1 – 30
Remind an outlet when its last collection was more than this many days ago, or it was never collected. Launch: 30 days. Empty = no reminder.
Allowed: 1 – 365
Tokens counted may differ from the IN meter by this many before the office is alerted. The difference is always shown in red (fewer) or green (more). Launch: 0.
Allowed: 0 – 1000000
Typed meter numbers get the same checks as the AI reader's. A jump bigger than the prizes that could have been won, or more tokens a day than the limit below, must be typed again or confirmed; a confirmed number is flagged for the office. Launch: ON.
Reads the IN and OUT numbers from the meter photo at the monthly collection. Off: staff type both meters. Demo: a practice reader that never reads a real number: every photo comes back as not read, so staff can practise the retake and typing steps (sample numbers appear only in demo mode). Gemini: Google Gemini Flash reads the photo (the key is set on the server). Launch: off.
How many meter photos the AI may fail to read for one machine in one collection before staff may type the numbers. Typed numbers are flagged for the office. Launch: 2.
Allowed: 1 – 10
A reading the AI is less sure of than this (0 to 1) counts as not read, and staff retake the photo. Launch: 0.8.
Allowed: 0 – 1
An AI reading can be saved to the collection for this many minutes after the photo was taken. Launch: 120 minutes.
Allowed: 5 – 1440
An IN reading more than this many tokens a day above the last known reading is treated as misread: the AI reading fails, and a typed one must be confirmed. Launch: 3,000. Empty = no check.
Allowed: 1 – 1000000
Deliveries, van self-picks, purchase orders and write-offs.
When a van crew picked stock themselves and nobody has checked it after this long, the office is alerted.
Allowed: 5 – 1440
When ON, a stock-in of more pieces than this waits until a different office person confirms it. OFF at launch: warehouse staff post deliveries themselves.
Show the purchase order screens. OFF at launch: stock-in is recorded when goods arrive, with the supplier's DO.
When the purchaser marks a low-stock alert “Already ordered”, they must type how many pieces were ordered, so the stock-in that arrives is compared with it. ON at launch.
While ON, office staff can enter the stock already in each warehouse, van, store room and machine on go-live day, and a second person approves it. Switch OFF after go-live.
Who must approve a write-off. Damaged goods in a warehouse quarantine can be posted by one person, unless this is set to always.
The office ticks each stock-in's DO photo within this many days of the delivery. A daily alert counts the ones past it. 0 = the same day. Launch: 1 day.
Allowed: 0 – 30
An item marked "Already ordered" with no expected date counts as late this many days after it was ordered, when its supplier has no lead time. Also the lead time reorder suggestions use when the supplier has none. Launch: 14 days.
Allowed: 1 – 365
Reorder-level suggestions add this % on top of what the warehouse is expected to use during the supplier's lead time. Suggestions only: a person applies them. Launch: 25%.
Allowed: 0 – 500
How many days after the day of a scan staff may still ask to undo it, and the office may still approve the undo. 0 = the same day only (launch).
Allowed: 0 – 7
Who can start a hand-over between warehouses, vans and outlets.
Choose whether staff send stock themselves, the office asks them with a “to send” task, or both. Every change is logged.
Random blind counts of vans and outlets by office staff.
How many random vans and outlets the Spot checks page suggests each period. 0 = no suggestions (checks stay possible).
Allowed: 0 – 50
How often the random suggestions change. Places not checked for a while come first.
Allowed: 1 – 90
OFF (recommended): each line's system quantity stays hidden until that line's count is typed, so checkers really count.
How many days of shortages, count differences, write-offs and old van stock make a place more likely to be picked for a spot check. Launch: 30 days.
Allowed: 1 – 365
How much each recent hand-over shortage at a place raises its chance of being picked. 0 = ignore. Launch: 3.
Allowed: 0 – 100
How much each recent count difference at a place raises its chance of being picked. 0 = ignore. Launch: 2.
Allowed: 0 – 100
How much each recent write-off at a place raises its chance of being picked. 0 = ignore. Launch: 1.
Allowed: 0 – 100
How much a van holding stock longer than the van stock-ageing alert raises its chance of being picked. 0 = ignore. Launch: 1.
Allowed: 0 – 100
When the office and management get an alert.
Alert when a hand-over stays in transit (not counted) longer than this.
Allowed: 1 – 720
Alert when stock stays in a van longer than this.
Allowed: 1 – 720
Alert when an active machine has no visit (meter reading) for this many days. OFF: no alert.
Allowed: 1 – 60
Alert when one customer sells back more than this many times at one outlet in one day.
Allowed: 1 – 100
Alert when one staff member credits the same customer more than this many times (in the window below).
Allowed: 1 – 100
The number of days the same-staff check looks back over.
Allowed: 1 – 90
Alert when a new wallet has been credited this many CM Points or more.
At least 1
A wallet counts as new for this many days after sign-up.
Allowed: 1 – 90
Alert when a customer pays with the wallet within this many minutes of a buy-back at the same outlet.
Allowed: 1 – 1440
A hand-over shortage still open after this long reminds the office (again at most once a day) until it is resolved. Launch: 48 hours.
Allowed: 1 – 720
Sign-ins and pairing on the outlet tablets.
Wrong PINs before the kiosk PIN is locked. The account itself stays active.
Allowed: 3 – 10
How long a locked PIN stays locked. An admin can unlock it sooner.
Allowed: 1 – 1440
After this many PIN locks within the lock window, the PIN stays locked until an admin unlocks it.
Allowed: 1 – 20
PIN locks within this many hours count towards the admin-unlock rule.
Allowed: 1 – 720
Alert when one tablet has this many failed staff sign-ins within an hour.
Allowed: 3 – 1000
Staff are signed out of a kiosk after this many idle minutes.
Allowed: 1 – 30
A kiosk sign-in ends after this many hours, however busy it is.
Allowed: 1 – 24
A supervisor approving at the kiosk must have signed in within this many minutes.
Allowed: 1 – 60
An idle task screen on the kiosk goes back to the home screen after this many seconds (the half-done task is dropped).
Allowed: 10 – 600
The kiosk sends the total the customer saw. If prices changed in between, the exchange is refused and nothing is taken.
Wrong tablet pairing codes before pairing locks.
Allowed: 3 – 50
How long pairing stays locked after too many wrong codes.
Allowed: 1 – 1440
Checks that protect evidence and staff logins.
Every meter, ticket, buy-back and delivery photo must really be uploaded, by that person or tablet, and used only once.
Only logins created by the dashboard's staff invite can become staff accounts. Switch on once the invite step is live.
The monthly access review flags active staff accounts not used for this many days, so management can switch them off. Launch: 30 days.
Allowed: 7 – 365
Who changed which rule, from what to what, and why.