Mobile capture & the outbox
Capture built for the person standing in the building: shell-free phone surfaces, three doors that need no account at all, and a durable outbox that holds a report on the device until the signal comes back.
The hazard is seen by whoever is standing next to it, and that person is rarely at a desk. So the capture surfaces are built for the worst plausible conditions rather than the best: one-handed, in a hurry, with no GPS fix, no photograph and one bar of signal. Degradation is deliberate and lossless of intent — a report submitted without a location is still a report, not a form that refuses. That contract is the mobile capture pattern (mobile-capture-pattern).
Three doors that need no account
Most of what SimOps holds is behind a login. Three capture doors deliberately are not, because requiring an invitation is the same as not being told:
- A poster on the hoarding. An Observation capture link is a revocable per-site token encoded in a printed QR code. Scanning it opens the mobile capture form — photograph, the tap grid, a device fix with a required "where exactly?" description. The token in the address is the only credential, and the reporter is genuinely unrecorded: an Anonymous observation carries no user, only its provenance.
- One address, every site. The geofenced door needs no poster at all. One universal address takes a single GPS fix and resolves it against every Site boundary — buffered by the fix's own accuracy — and serves the matched site's form. One match goes straight in; several show a picker of matched names only. Standing somewhere is the credential, and near-miss site names are never returned, so the address enumerates nothing.
- The briefing QR. A briefer runs the RAMS briefing from their own phone and shows a QR code — with an opt-in rotating presence code beside it where the site wants proof the signer was in the room. Each attendee scans and signs on their own device, producing a RAMS briefing signature frozen against the revision's content hash. There is deliberately no signer surface: signing on is link-and-QR only.
Everything else is an ordinary signed-in phone surface, reached from the mobile home's launcher grid rather than the map: quick observation, report an incident, record completed work, raise a blocker, run an inspection, run a briefing, my actions, my permits.
The outbox — what happens when the signal is gone
A capture that fails on connectivity is not lost and is not silently retried into the void. It is written into a durable outbox on the device — words, photographs and all — and the phone says so plainly: "Saved on this device." The queue then walks itself in, retrying on a backing-off schedule with jitter until the site has it, and the sheet that owns the entry flips to sent in place when it lands.
Three properties are worth knowing because they are what stop a queue from doing harm:
- A replay never duplicates. Each queued submission carries a client reference that the server keeps in an idempotency ledger, so a replay of a request that did land returns the original record instead of writing a second one.
- Re-editing replaces, it does not stack. A queued entry is addressed by what it is about, so a second edit to the same thing folds into the pending one.
- Giving up is visible, not silent. After a few failed attempts an entry parks as stuck and says so — it stays on the device, and it can be pushed again by hand.
What it deliberately does not do
SimOps is not an offline app. The outbox is an explicit, per-surface capability, adopted where it was specified and sized — incident capture, inspection-walk answers, action close-out, and desktop entity edits. Every other surface guarantees degraded-input parity, not offline queueing, and reading "works in the field" as "works fully offline" is exactly the mistake mobile-capture-pattern D8 was written to prevent. Notably, the observation capture forms — QR, geofenced and signed-in alike — do not queue.
There is also no service worker and no background sync, by decision rather than by omission: the sign-in token lives in page memory, so a background context could not authenticate a replay anyway. On iOS the honest semantics are replay when the page is reopened, and that is the design. Nor is there a global "you have unsent work" indicator — queued, stuck and sent are surfaced by the capture surface that owns the entry, where the person can actually do something about it.
Where to find it
The phone surfaces live at their own shell-free addresses and are launched from the mobile home, not the dashboard. The public doors are reached by QR poster, by standing on the site, or by the briefer's screen. Signed-in capture answers to the ordinary verbs — observation_create, incident_create, rams_briefing_run — while the three public doors answer to a token or a minted capture session and to nothing else.