A school census that survives a bad connection

An education management information system is, at bottom, a census that never stops. Enrolments, transfers, staff postings, attendance, results. The difficulty is not the data model. It is that a large share of the schools filing the data have electricity for part of the day and a mobile signal some of the time.

What breaks first

Systems designed online-first break in a specific order. First the submission times out and the user presses the button again, so you get duplicates. Then someone adds a client-side retry, so you get more duplicates. Then a school fills the form on paper and a district officer types it in a week later, so the record exists twice under slightly different spellings of the same child's name. By the second year the authoritative figure for how many children are enrolled is a judgement call.

The assumptions that have to go

That the server assigns identity. If the device cannot reach the server, the device must be able to mint an identifier that will never collide with another device's. That means identifiers generated locally, and a server that treats a repeated identifier as the same fact rather than a new one. Submission becomes idempotent by construction instead of by retry logic.

That time is a single clock. Two devices will record conflicting edits to the same pupil record while both are offline. Something has to decide which wins, and "the one that synced last" is not a policy. The resolution rule has to be written down per field — last-writer-wins for a phone number, never-overwrite for a date of birth, escalate-to-a-human for a transfer between schools.

That a sync is a moment. It is a long, interrupted, partial process. The unit of transfer has to be small enough that a dropped connection costs seconds of work, and the client has to be able to resume rather than restart.

What changes for the people using it

The visible consequence is that the form never blocks. A teacher completes an enrolment in a classroom with no signal, the device confirms it immediately, and the record reaches the district when the device next sees a network — from a market, from the officer's home, from anywhere. The teacher is not asked to understand any of this.

The second consequence is auditability. Because every change is an event with an origin device, a local timestamp and a server receipt, a disputed figure can be traced to the submission that produced it. "The system says 412" becomes "these 412 enrolments, filed by these schools, on these dates" — which is the only form in which a number can actually be defended in a budget meeting.

The part that is not technical

Offline-first buys correctness, not agreement. If two districts count a transferring pupil differently, no conflict-resolution rule fixes that; it only makes the disagreement visible and dated. Making it visible early, to the people who can settle it, is the realistic goal.