Group relay
One member with a signal synchronizes the party.
Platform · Synchronization
Consistency without a connection.
Four transports, one durable operation log, and a merge that resolves at the granularity of a field rather than a record. This page is the summary; the full mechanism, including the failure model we designed against, is written up in the technology section.
01 / By the numbers
4TransportsCellular, mesh, LoRa relay, satellite
0Writes lost to a process killThe queue is on disk before the UI acknowledges
1Idempotency keyDevice and sequence — a retry is never a duplicate
5Merge rulesIn a defined order, identical on every device
02 / How it works
The mechanism, not the promise.
- Operations, not state
- The queue holds the operation that produced a change, with an explicit causal parent, so a deletion can never arrive before the creation it refers to.
- Durability
- Written to SQLite on mobile and IndexedDB on web before acknowledgment. Queue depth is shown, so nine unsynced days is a number rather than a silent condition.
- Channel selection
- Per attempt, not per session. The cheapest channel that is actually up, with satellite deliberately last and restricted to a digest.
- Field-level merge
- Disjoint fields merge with no conflict. Same-field conflicts resolve by Lamport pair, deterministically. Safety-critical fields never auto-resolve.
- Tombstones
- A delete concurrent with an edit keeps the record, marks it deleted and surfaces it for review. Nothing is destroyed by a race.
03 / Capabilities
What you actually get.
Air-gapped bundles
The same queue exports to removable media and imports through the identical ingest and resolver path.
Visible queue
Depth, age and per-item state. Not a spinner.
Causal replay
Operations apply in dependency order, held until their parent lands.
Safety-critical review
Check-in schedules, emergency contacts and medical notes raise an explicit review rather than merging silently.
One code path
Cellular, mesh, satellite and sneaker-net all converge on the same resolver, so the guarantees do not vary by channel.
04 / Process
Traced, node by node.
Every node in this graph names the file it came from, so the diagram can be audited against the codebase rather than taken on trust.
Read the whole mechanism.
The full write-up, including the four failure modes this design exists to prevent, is in the technology section.