Scale the design only after continuity is demonstrated

The first deliverable is an operator-approved boundary statement, not a bill of materials. It should identify the tasks that must continue, those that may degrade and those that must stop under each declared failure. It should also distinguish physical production from the digital record. Protecting an edge computer and its network can preserve capture and supervisory visibility while machinery is stopped. It cannot make an unpowered motor turn. NIST operational technology guidance places performance, reliability and safety beside security, so these boundaries belong to the responsible operations and engineering authorities rather than to a software supplier alone.[S03]

The record boundary needs equal precision. For every included task, the site should agree the event identifier, source and sequence fields, operation and bundle context, quality disposition, clock-quality fields, acknowledgement meaning and reconciliation owner. The statement should say which acknowledgements mean validated, written, locally committed or remotely accepted. It should name the approved manual process, the authority to enter it and the evidence required to leave it. Contingency planning begins by evaluating operations to determine requirements and priorities, which is why these decisions precede technology selection.[S05]

A requirement register should carry each choice into later acceptance. Its rows need a failure stimulus, permitted service state, allowable record loss, recovery boundary, evidence owner and unresolved assumption. Where the site cannot yet choose a value, the register should record the missing observation and the decision date or condition. A blank field marked unknown is more useful than a plausible default copied from another factory. The same register should define who can change a requirement after a test result is known, preventing an inconvenient failure from becoming an informal relaxation.

Exhibit 55 expresses the proposed sequence as ordered positions rather than promised dates. Each transition depends on evidence from the preceding boundary.

The roadmap deliberately makes the manual performance-management record the starting capability. Structured point-of-work logs can establish identifiers, operating routines and supervisory review before automated capture is expanded. Bought inspection becomes a qualified addition to that record, with its own inputs, offline startup and human fallback. Forecasting belongs later still, because a forecast cannot repair an incomplete or untrusted event history. This order follows GFT's Cameroon textile programme as a design basis, not as evidence that the capabilities have already been commissioned.

This sequence does not prohibit remote services. It prohibits making them silent prerequisites for local duties. Non-urgent planning, central comparison and model development can proceed in parallel when their absence cannot interrupt local capture or quality authority. The boundary statement should make that independence testable. If a supposedly remote service can block a cold start, a licence check or an operator login, it belongs inside the continuity scope.

The baseline stage should replace general concern about unreliable supply with an observed site envelope. Recorders should capture power events at the intended digital circuits, while the network survey traces switching, naming, backhaul, shared supplies and upstream dependencies. Operator interviews should reconstruct recent failures, manual workarounds, restoration delays and record disputes. Their recollections are evidence about operating practice and investigative leads, not a substitute for instrumented durations. The resulting dossier should distinguish measurement, recollection and assumption.

National evidence establishes why this work matters but cannot set the equipment rating. In the World Bank's Cameroon 2024 country profile, 93.3 percent of surveyed firms reported experiencing electrical outages and the reported frequency was 10.4 outages in a typical month. These are firm-response indicators across the survey population, not a textile-only sample, a duration distribution or a prediction for the proposed site.[S01] The survey methodology also constructs population inference through sampling and weighting rather than measuring every factory circuit.[S02] Neither statistic can be inserted directly into a battery, queue or recovery calculation.

A useful baseline therefore needs its own measurement-quality controls. The recorder must remain alive through the events it is meant to observe, or its gaps must be visible. Its clock state must accompany event start and end. The team must know whether a communication test reached a modem, resolved a name, established an authenticated session or completed an application acceptance. Each of those observations answers a different question. A period without a valid recorder reading is unknown, not a period without an outage.

The baseline collection plan should include:

Tail events require an explicit decision rather than silent extrapolation. A short observation window may not contain the long outage that determines retention or protected energy. Extending measurement can reduce that uncertainty, but it cannot prove that the largest observed event is the largest possible event. The design freeze should therefore record the observed distribution, monitoring coverage, censored events and the additional allowance or stress case chosen for unobserved tails. The basis is a risk decision informed by contingency priorities, not a claimed statistical maximum.[S05]

Design freeze occurs only when the boundary statement and outage envelope have been reviewed together. At that point the team can size protected digital energy, storage, replay capacity and recovery targets against stated assumptions. If the evidence is insufficient, the choices are to collect more data, narrow the promised service or carry an explicitly accepted conservative assumption. Procuring first and describing the envelope afterwards would hide precisely the uncertainty the baseline is meant to resolve.

Inspection should join the accepted local record as a separately qualified function. Its camera, illumination, trigger, compute, model, licence, operator display and disposition record need to work within the declared power and connectivity envelope. The responsible quality authority must also approve the human fallback and the conditions for stopping or releasing work. NIST's operational technology guidance supports treating reliability and safety as part of the design context rather than as later security additions.[S03] A local model file by itself establishes none of these operating properties.

The entry test is an offline cold boot and recovery exercise against the already accepted local store. Inspection must start without relying on an external service that the boundary says is optional. Its events must use the established source identity, clock quality and acknowledgement semantics. If the new function saturates storage, competes for protected energy or delays the first durable capture after restart, the previous evidence no longer describes the assembled system. The affected tests must be repeated before the integrated state can be accepted.

Remote reporting should follow the same rule. HTTP defines particular methods as idempotent, but that specification does not make every factory ingestion endpoint or its downstream side effects idempotent.[S12] MQTT at-least-once delivery expressly permits duplicates.[S19] The remote receiver therefore needs an application-level identity, transactional deduplication and a durable acceptance response. Replaying a backlog must not repeat a business action or starve current local capture. These are integration requirements to demonstrate, not properties inherited automatically from a protocol name.

The remote path also needs a failure return to the local state. If name resolution, authentication, application acceptance or capacity fails, the local service should continue within its declared limits and expose the growing backlog. Restoration should prioritise current operating records and then replay under an agreed capacity policy. The central dashboard remains provisional until reconciliation closes. No remote alarm should be interpreted as proof that the corresponding local or downstream action completed.

This chapter supplies continuity acceptance inputs rather than a complete connected-factory architecture. The wider component design belongs to wp18, while model and data governance belong to wp14. Those workstreams can change an inspection model, broker or remote consumer, but they must inherit the local boundary and its regression obligations. A handover is complete only when the receiving design states which tested claims it preserves, which it invalidates and which new evidence it will produce.[S03][S06]

If integration fails, rollback should restore the last accepted operating boundary rather than remove the whole record. That may mean suspending the new inspection function, holding remote replay or returning to the approved manual disposition while local capture continues. The rollback path itself needs an operator instruction and a reconciliation check. A stage is reversible only when that return has been exercised.