Local service classes turn resilience into a testable contract

Offline continuity needs an explicit storage policy as well as an operating mode. Delay-tolerant networking describes persistent storage as a response to network interruption. Constrained-network terminology also recognises limited and unpredictable capacity. These sources support planning for retained work; they do not establish the necessary storage capacity or acceptable loss at a particular factory. GFT recommends specifying the required record interval and measuring the workload before choosing the device.[S08][S18]

Define retention dimensions separately. The design offline interval describes how long the service is expected to operate without its normal upstream acceptance. The byte budget describes how much local capacity that workload may consume. Maximum age describes whether a retained item remains useful for a decision or must still be kept for traceability. A planning recommendation may expire while the production event that informed it remains necessary. Expiry is therefore a business rule, not merely a storage setting.

The illustrative policy table in Exhibit 13 separates record categories and possible pressure responses. It leaves retention durations unset because no site workload, contractual requirement or approved policy has been supplied. An unset duration is a required design decision, not permission to delete. The entries are GFT's proposed discussion structure, not statutory retention guidance.

GFT recommends agreeing the pressure sequence before storage fills. Reduce optional diagnostic detail first only where that reduction is approved and counted. Preserve capacity for the records that explain the restriction itself. If a required production record can no longer be durably accepted, expose that failure and apply the authorised manual route or stop. Silently overwriting acknowledged history would contradict a contract that promised its survival. An alert is insufficient unless a role can act within the remaining operating interval.

Priority must not be confused with delivery order. A retained event may be low priority for transmission but essential to reconcile a later material movement. Conversely, an urgent alarm may need immediate local action even when its remote copy must wait. The proposed class card should state which actions need freshness, which records need completeness and what ordering relationships the receiver requires. Detailed queue-drain calculations belong to the later queue chapter; this chapter establishes the obligations those calculations must satisfy.

Deletion should leave evidence of the deletion rule even where the original payload is no longer required. GFT proposes retaining the category, covered interval, reason, approving policy revision and discarded count, with a clear distinction between intentional expiry and unexplained loss. A completeness display should then show which categories remain comparable across the interruption. If image detail was reduced under an approved policy, the later reviewer must see that qualification alongside the associated inspection record. Otherwise, a full event count could conceal a reduced evidential basis.

An offline envelope also needs an exit condition when interruption exceeds the design assumption. GFT proposes a visible reserve threshold, an accountable escalation and a permitted restricted duty. State whether the remaining capacity is estimated from current arrival rate and how changing image volume affects that estimate. Treat an unmeasured rate as unresolved. A nominal storage size cannot establish how much approved operation remains under the actual workload.

A manual fallback should preserve the meaning of the event, not imitate the appearance of the screen. GFT proposes a controlled paper form and a matching offline spreadsheet schema with bundle identifier, operation, shift, operator role, local sequence and reconciliation state. Add the original event time, its time basis and the physical material location. Retain the distinction between the production bundle and the event: a bundle can undergo different operations and corrections without becoming a different bundle.

Identifiers must be available without an online allocator. The UUID specification describes identifiers that require no central registration process, but correct generation remains an implementation responsibility. GFT recommends either a qualified local generator or pre-issued controlled form identifiers for manual use. A timestamp alone should not carry identity. An offline spreadsheet copied to another device must not silently create a new identifier namespace that can collide with earlier manual entries.[S31]

Record time in a format with an explicit relationship to UTC when that relationship is known. The timestamp specification addresses that interchange relationship; it does not prove that the operator's clock was correct. GFT proposes keeping an uncertain original time, a confidence flag and the later import time as separate fields. Do not manufacture precise production times from spreadsheet row order or overwrite the original observation with the time at which connectivity returned.[S32]

For an illustrative form entry, use bundle BUNDLE-A, operation INSPECT, shift SHIFT-A, role QUALITY, sequence SEQ-A and state PENDING-IMPORT. These symbolic values demonstrate the field relationships without suggesting a real factory transaction. A matching import candidate should carry the controlled form identity and its original line reference. Mark a correction as a linked correction with its reason and authority, rather than erasing the original entry.

GFT recommends importing through a staging area that validates identifiers, required fields, permitted operations and material references before posting to the performance-management system of record. Compare the candidate against digital events created before the failure and against earlier imports. If the same event identity has a different payload, hold the conflict for a responsible reviewer. A duplicate candidate is not a second production action merely because it arrived through a different channel.

The import contract should make repeating an approved import harmless to the intended business result. HTTP defines idempotent method semantics, but a method name alone cannot establish factory-level duplicate handling. GFT proposes retaining a durable import receipt with the accepted identity and outcome, using a transaction where related local records must change together. The application must demonstrate that retrying a timed-out import does not duplicate the business action.[S12][S13]

Close manual continuity by reconciling issued forms, used forms, cancelled forms and posted entries. Record unresolved gaps explicitly. Keep the original evidence available for the approved retention period and record who authorised closure. This chapter defines the continuity interface; detailed access policy and governance belong in the governance paper. Manual capture is a qualified substitute only when the team can both use it during the interruption and reconcile it afterwards.

GFT proposes translating every service card into a failure experiment. Name the stimulus, starting mode, workload, accepted-event ledger, permitted loss, readiness condition, restart owner and retained proof. Link each observed result to the exact requirement revision. Recovery guidance supports realistic scenarios and improvement through testing; a planned test is nevertheless different from a completed test, and neither should be reported as a deployed factory result.[S06]

The proposed acceptance set should distinguish loss of external connectivity, application termination, local storage exhaustion and a controlled loss of device power. Select combined cases where dependencies plausibly coincide, including offline cold boot and recovery while a queue remains occupied. Electrical interruption work requires the responsible site engineer and the equipment's permitted test method. A software restart cannot establish the behaviour of the power and storage path during abrupt supply loss.

SQLite documents simulated crash testing and compound failure testing. That is useful implementation evidence, but GFT recommends project tests on the selected configuration as well. Compare the identified input ledger, acknowledgements and recovered ledger; inspect missing, duplicated and conflicting outcomes. Retain the actual trace rather than a summary that merely says the application restarted. This is a proposed acceptance method, not a claim that the chapter author has performed hardware fault tests.[S28]

For each experiment, report availability, recovery time, record survival and permitted production mode separately. An unresolved record gap should fail a completeness requirement even if the interface meets its recovery time. If power returns but inspection remains restricted, distinguish technical readiness from authorised process release. Include the time spent waiting for local authority where the contract promises an operable duty, rather than measuring only the application's start time.

Procurement acceptance should require a signed site-specific requirement record and a matching evidence index. GFT proposes recording the software versions, hardware configuration, tested failure envelope, exclusions and residual issues. The Cybersecurity Framework provides outcomes without prescribing their implementation. A reference to that framework is therefore not a certificate, a substitute for this evidence or proof that a supplier's continuity claim applies to the selected installation.[S26]

Before signing, the owner should be able to follow a requirement through the stimulus, raw observation, calculation and acceptance decision without asking the supplier to reconstruct the story. GFT proposes preserving failed attempts and the change that preceded a successful repeat. Keep unresolved exclusions attached to the accepted duty, including any missing measurement of the site envelope. A laboratory success can qualify the tested configuration within its stated conditions while still leaving deployment approval pending. The final decision should say which boundary has been proved and which further observation would justify extending it.

Use the resulting cards as inputs to the edge-architecture and maturity tools. A planning duty can be accepted while inspection remains unqualified, provided the distinction stays visible. Protected-load engineering should inherit the duties and dependencies approved here. The performance-management system should report unresolved gaps alongside successful tests, so management can see which production decisions the evidence actually supports. GFT's practical recommendation is to expand the promised boundary only after its new dependencies and recovery obligations have been demonstrated.