How picture day runs, from roster to gallery

The pipeline has a clear, roster-first sequence. Nothing is guessed, and nothing is shown to a family whose consent was not recorded.

1. The center imports its roster once. Enrolled children, their class or room, and their guardian contact become the one record the rest of the pipeline reads from. There is no second roster assembled later for a different product.
2. Guardians are asked to opt in before picture day. Consent is off by default. A guardian opts a specific child in through the center’s own communication channel; nothing is assumed from enrollment alone.
3. Only opted-in children are photographed as part of the platform session. A child whose guardian has not opted in is not included in the platform’s picture-day capture, directory, or composite output.
4. Portraits are captured and bound to the roster. Each portrait is associated with a child through the roster record — name and class — not through a face scan or any biometric process.
5. A private gallery link is generated per family. The guardian reaches only their own child’s photos, through a tenant-isolated link that is never public and never indexed.
6. Directory pages, class composites, and memory mates are assembled. Each is built from the one consented portrait, with fail-closed print preflight: a missing portrait or a consent gap blocks the page from printing rather than shipping with a gap.
7. Output routes to the center’s own lab, with delivery tracked. Press-ready files go to the center’s pro lab of choice; delivery status is tracked so the center and family both know where an order stands. The parent order rail itself is early access — no card is charged today.