Agriculture and development programmes · Rural and remote delivery areas

Low-connectivity field operations

A field data system designed around intermittent links, shared devices and evidence capture rather than assuming continuous connectivity.

Offline-first application deliveryIllustrative scenario

Field teams collected enrolment, visit and distribution records in locations where a mobile session could disappear between one form step and the next. Earlier tools treated failed submission as a user error. Staff responded by keeping parallel paper notes or postponing data entry until they reached better coverage, which weakened timeliness and made duplicate records difficult to resolve.

The product boundary moved validation and workflow state onto the device. A completed action entered an encrypted local queue first. Synchronisation became a separate process with visible states, bounded retries and conflict handling. Users could finish a visit without waiting for the server, yet supervisors could still see which device held unsent work.

Operating constraints

Conditions the architecture had to respect

The delivery boundary was selected around external dependencies, data authority and the consequences of failure.

Devices could be shared, replaced or offline for extended periods.

Photographs and documents were much larger than structured form data.

Records could be edited on more than one device before either device synchronised.

Local storage had to protect personal data if a device was lost.

Architecture

System boundary and operating flow

The architecture is described through ownership, state and recovery behaviour rather than a vendor diagram.

The client application stored commands, not just partially completed screens. Each command carried an identifier, actor, device, local sequence and expected record version. The server accepted idempotent commands and returned a receipt that the device could retain. Read models were downloaded as compact, scoped snapshots with delta updates, allowing the client to rebuild its local view after a long offline interval.

Conflicts were classified by business rule. Independent additions could merge automatically. Competing edits to an identity or approval field entered a supervisor queue with both versions and their evidence. The design did not use silent last-write-wins for decisions that affected eligibility, quantities or consent. Attachments synchronised separately in resumable chunks so one failed photograph did not block the structured visit record.

Device security combined application authentication, encrypted local storage, short-lived access material and remote session revocation. Shared-device handover cleared user-scoped caches after queued work was transferred. Telemetry reported queue depth, oldest unsent command and last successful sync when connectivity returned, giving support teams a useful signal without continuous device tracking.

Decisions and trade-offs

Choices made explicit

Each decision solved one operating risk while accepting a cost that the delivery team had to own.

Persist domain commands before network submission.

ReasonA visit had to survive process termination and link loss after the user pressed save.

Accepted trade-offCommands required versioning because a newer server might receive work created by an older client.

Synchronise attachments outside the command acknowledgement path.

ReasonLarge media should not block small structured records on weak links.

Accepted trade-offThe user interface needed a distinct evidence-pending state until required files arrived.

Escalate policy-sensitive conflicts to a human.

ReasonAutomatic resolution could hide changes to eligibility, identity or consent.

Accepted trade-offSupervisors needed a conflict queue and clear turnaround ownership.

Outcome and handover

Changed operating behaviour and ownership material

These are intended operating effects for the illustrative scenario, not measured results from a completed engagement.

Operating outcome

Field work could be completed and reviewed locally without an active data session.

Users saw whether each record was local, queued, accepted, conflicted or waiting for evidence.

Duplicate submissions were safe to retry because commands retained stable identifiers.

Supervisors received explicit conflict cases instead of silent overwrites.

Handover package

Offline state model and command compatibility policy

Conflict decision matrix and supervisor procedure

Device replacement, queue transfer and remote revocation runbooks

Sync telemetry and support guidance for long-offline devices