Offline inspections.
Keep the work. Explain the sync.

Bootstrap online: authenticate, download the assignment and checklist version, and cache the application shell. A first-ever offline visit cannot download missing application code or private records.

Commit the draft and pending sync intent in one local transaction. Display “Saved on this device” after completion, and report an aborted write as unsaved. IndexedDB supports transactional structured storage, including files and blobs; see the IndexedDB overview.

Local storage is not a backup. Browser eviction, user-cleared data, or a lost device can remove unsynchronized work. Handle quota errors and explain any persistence request’s actual outcome. MDN documents the storage limits and eviction behavior.

Give each operation a stable ID, inspection ID, expected server revision, payload schema version, and immutable body, scoped to an account and workspace. Once an attempt starts, retries keep that identity and body, including after an unknown network outcome.

Send one operation per inspection at a time. Keep later edits in a separately saved draft until the pending result is reconciled. Applying an old acknowledgement must preserve that newer intent. Coordinate sending tabs with an expiring ownership claim; server deduplication still handles overlapping attempts.

On the server, authorize first. Then atomically check for an existing receipt, compare the expected revision, and commit the change, receipt, and change-log entry. The same operation returns its recorded result; the same ID with different content is an error. Keep receipts for a declared offline retry window. Outside it, require reconciliation instead of silently treating an old operation as new.

Begin with inspection-level optimistic concurrency. A mutation based on revision 7 cannot overwrite revision 8. Preserve the original base and local draft, fetch the authorized current version, and let the user review the disagreement. Even edits to different fields require review in this first version.

This rule is deliberately coarser than the one in Local-first and sync, which follows an inspection too. There the device sends changes rather than whole records, each field carries the version it was edited from, fields such as notes merge, and a conflicting field keeps the server’s value and is marked for review. Here one revision covers the whole inspection, so the first build has a single conflict rule to prove and never merges on the inspector’s behalf. Field-level merging is the extension once that rule holds.

A resolution is new intent with a new operation ID against the current revision. If that revision changes during review, conflict again. Device timestamps can help tell the story, but they do not decide whose work wins. HTTP’s If-Match precondition is a standard way to express a conditional write when using strong entity tags.

Pull bounded pages from an authorized, ordered server change stream. Apply each page and its cursor in the same local transaction. Use server ordering, not device clocks; a crash before commit should replay the page rather than skip it.

Keep pending drafts as an overlay on accepted records. Remote updates do not replace them. Carry deletion markers, and reject stale mutations to deleted or submitted inspections. An expired cursor needs a fresh authorized snapshot while local intent remains available for reconciliation. Membership changes also require revalidating the local set of assigned records.

Persist the bounded-size local blob and a stable attachment ID. Make upload initiation and finalization idempotent, and validate that repeated use of an ID refers to the same bytes. Start by retrying the entire small upload; resumable chunks are a later extension.

Finalize only after the server has durable, validated bytes and has rechecked access to the parent inspection. Incomplete uploads are never ready. Recoverably enqueue a thumbnail job at finalization, and clean abandoned uploads after a declared retention period. Keep originals private and authorize reads as well as writes.

Submission is its own conditional, idempotent operation. It requires accepted checklist answers and finalized required photos, and freezes that inspection for review. Thumbnail readiness remains a separate processing state.

Run foreground sync on launch, explicit retry, and reconnection attempts. Use actual request results to determine reachability. Bound concurrency and retry duration, add jitter, and honor server retry guidance. Conflicts, invalid data, expired sessions, and revoked access need distinct recovery paths.

Offline use only covers previously downloaded work. Recheck permissions on reconnect, including receipt reads. Stop sending on sign-out, and make the handling of unsynced data explicit before switching accounts. Revoking access cannot erase an already cached record on a disconnected device.

Version local storage, server data, and operation payloads separately. Preserve queued work during upgrades, close old database connections on version changes, and show when another tab blocks migration. Reconcile attempted requests before converting their intent into a new operation. The IndexedDB usage guide covers transaction completion and upgrades with multiple tabs open.

Select a device and fault: disconnect, delay, drop one acknowledgement, interrupt an upload, reject a local save, or deny a server operation. Show each device’s base revision, pending operation, retry reason, and last observed acknowledgement beside server state.

Use two profiles with independent storage, not just two tabs sharing one IndexedDB. Reserve the two-tab case for sender coordination and upgrade tests. Provide stop and fixture-reset actions with a run ID, and preserve the previous run’s evidence. Label injected storage errors separately from experiments against the real browser.