An engineer standing on B3 with a tablet is a fair test of any information system. The slab is wet, the lights are temporary, and the signal died somewhere around the first landing. She needs the current revision of one sheet. What the device will give her is whatever it held when she left the cabin twenty minutes ago, and nobody upstairs can say which moment that was.
Most field workflows are cabin workflows wearing a hard hat. They work beautifully within range of the site router, and the claim that the system "works on site" is true in the only place it was tested. Offline-first means something narrower and harder: the issued set, the RFI and the approval can be used down there, and reconciled later, with no radio at all. "Sync later" is a promise about a lift ride that may not happen until the pour is in.
No signal is the normal condition
Cores, lift shafts, plant rooms, steel decks, rural compounds and basements eat radios. This is not an outage to be reported; it is ordinary construction, and will still be ordinary in ten years.
Design for the place the work happens. Down there the device will not search the register, will not fetch the transmittal that landed at 10:40, and will not open a live approval seat. It will hold what somebody put on it before the gang walked, plus whatever they write while they are below. Everything else is optimism.
ISO 19650 treats issue as a bounded act — these containers, this purpose, this moment — and a live login is not that act. If the workface cannot open the issued identity without a mast, the project already has two records: the CDE upstairs, and whatever print or crop still opens downstairs. Offline-first is how you stop assuming those two will stay aligned by luck.
Cache the issued set, not last week's zip
The cache is the issued set for the work about to be done. Not a folder dump, and not whatever happened to be open last.
Before anyone goes down, pin a bounded package:
- the sheet numbers and revisions for today's activity
- the purpose or suitability as issued — for construction, for information, not a courtesy stamp
- the previous identity, marked dead, so two revisions do not both look live
- the transmittal or issue event those containers came from, if the project keeps one
A 400-page PDF that happened to be open in the cabin is not a cache. Neither is a zip named latest, nor a crop with no title block. The cache has to carry the same identity the register would: number, revision, purpose. If the device cannot show that identity without a network, what you have cached is a picture.
Staleness needs designing too, which is the part most teams skip. Write who refreshed the package, against which register pass, and at what time. A cache that is "probably Friday's" is how a gang builds from B while C sits in Published, and the first anyone knows of it is when the setting-out does not match. Offline-first does not mean frozen; it means the workface knows which issued moment it holds, and the office can say the same sentence when asked.
Withdrawal belongs in the cache as well. If C02 is what they took down, C01 must not remain an unmarked A1 on the same table. Two live instructions are two live instructions, mast or no mast. Signal only hides that until somebody comes back up.
Queue the RFI and the approval
Work does not pause because the portal is dark. Questions get asked, holds get placed, and a supervisor still authorises a pour, a penetration or a change against the sheet in their hands. Offline-first means those acts get written locally as queued events rather than spoken into the noise and reconstructed from memory at four in the afternoon.
A queued RFI is more than a chat message saved for later. It names the container it was asked against — sheet, revision, location — and it keeps a device time and an author. When the lift finds signal, that object should enter the record as the question asked at the workface, not as a tidier paraphrase typed upstairs. Cycle time quietly dies when the question is rewritten in the cabin against a different revision from the one the gang was looking at.
A cached approval is the dangerous one, because an approval looks like authority. If the device still shows yesterday's "approved for construction" after the office has withdrawn the sheet, the gang is holding a live-looking instruction the register no longer owns. The cache has to show what was approved, by whom, against which identity, and that the approval remains local until it is accepted back into the record. A green badge that cannot survive a sync is a screenshot with confidence.
Resist the urge to build a second inbox for any of this. Use the RFI and approval path the project already claims to run. The only new thing is the queue contract: write now, send when the radio returns, and never let the interface imply that send has already happened.
Conflict is a rule you write in advance
When the crew comes back up, two clocks meet. The office may have published C while the gang marked up B. Two RFIs may describe the same opening. An approval given downstairs may sit on a revision withdrawn at 11:15. None of that is a software glitch; it is the ordinary cost of a split record, and it happens on every job that sends people below grade.
Last-write-wins is usually the wrong rule, because the last device to find a mast is not the owner of the issued set. Before anyone merges, overwrites or "resolves", the rule has to ask four things:
- Which information container — number, revision, purpose — did each write touch?
- Who wrote it, and on which clock: device time at the workface, or server time in the cabin?
- Was the local write an observation, a question, or an approval? Approvals do not lose to a later upload of the same sheet.
- Has the upstairs identity moved since the cache was pinned? If it has, the local write sits against a dead revision until somebody says otherwise.
Resolve before the next shift goes down. An unresolved conflict papered over as "sync complete" is how the unofficial set in the trailer gets started: the site keeps the mark-up that still makes sense, the office keeps the published container, and neither is lying. They were simply never given a rule.
Partial sync is a conflict wearing a progress bar. A photo that arrived without its caption, an RFI without its revision, an approval without its author — treat all three as failed queues rather than nearly done. A record that looks eighty per cent synced is one you cannot defend when someone asks about it eighteen months later.
Where the design usually breaks
Five things fail, and usually in this order. Name them before the demonstration rather than after the claim.
Search. If finding the sheet needs a live index, the cache is theatre. The package has to open from a list the device already holds.
Identity. If the file on the tablet is export (3).pdf, you have minted a second container. The register identity must survive the download, and naming conventions die in the basement the moment a system appends a username or a timestamp.
Approval seats. If approving needs a live licence or a round trip to a server, there is no cached approval — only a button that fails quietly. Quiet failure is how work proceeds from the print.
Clocks. Device time drifts. A queued event without a trusted time is evidence that a screen was tapped, not an approval event. Where the device cannot be believed, write the time on something you still trust: the attendance sheet, the permit, the marked print.
The last metre. A cached PDF that cannot be read in dust, gloves and temporary light will lose to the A1 every time. Offline-first that ignores the hand is still a cabin design, and an unusable cache is precisely why a second set appears in the trailer.
Designing it as though the lift has no signal
Run this on the next package going in below grade, or out of radio range. You do not need a new platform to start.
-
Name the activity, then pin the set. Write the work, the drawing numbers and the revisions before anyone walks. If you cannot fill those fields from the register, there is nothing to cache and that is your first finding.
-
Put identity on the device, not a crop. Title block, revision, purpose. If the plot stamp and the title block disagree, stop — that is a defect, not a connectivity problem.
-
Write the queue contract on one line. RFIs and approvals drafted downstairs keep their author, device time and the container they were raised against, and they stay unsent until the radio returns. Unsent is a state, not a mood.
-
Write the conflict contract on one line. Local observation yields to a newer published identity; local approval does not. Two questions about the same opening are duplicates to be joined, not a vote. Say it out loud so the cabin and the workface are holding the same rule.
-
Test it in the stair core. Walk the package to where the mast dies. Open the issued set. Draft an RFI. Try to approve something. Come back up and reconcile. Whatever failed is the design, and a vendor's cabin demo is not a substitute for that walk.
-
Withdraw on return. Sync is not finished when the files arrive. It is finished when the dead revision is marked, the accepted RFI sits on the live identity, and the next cache is pinned from the register as it now stands.
Six steps, one package, an afternoon. Longer if the register turns out to be fiction — and that delay is itself the finding.
What the standards leave to you
CDM 2015 and the project's own information standard carry the duty to provide the right information at the point of work. Both assume somebody can say which issued identity the workface is holding when the radio is dead. Neither specifies a sync engine. ISO 19650, NEC, FIDIC and JCT each have their owners, and all of them describe the obligation rather than the mechanism.
That gap is where the money sits, and it is worth being honest about who can close it. The principal contractor can make the stair-core walk part of mobilisation, before the first tablet is issued and before anyone signs a subscription. Clients and appointing parties can add two lines to the exchange information requirements: the issued set must be openable and identifiable with no network, and queued approvals must carry author, time and container when they arrive. Both are testable at tender, and a supplier who cannot show them in a stairwell cannot do them at all.
Expect a cost. Somebody has to pin and refresh packages every morning, which is a named job rather than a spare half hour, and older devices with unreliable clocks may need replacing sooner than the depreciation schedule assumes. Set against one wrong pour it is cheap, but it will not come out of nowhere — and the engineer on B3 will go on working from the paper in her pouch until somebody funds it.
Read next: Monthly Register — August 2025, Halving RFI cycle time without buying anything, The site team has the truth. The office has the system. Neither talks..