PHONE
Alex’s device
SWMSFictional staging document
Ready to sign
CWI RELIABILITY LAB
Two devices.
One honest result.
Sign together, go offline, retry, and reload. The server ledger must keep every valid action exactly once.
ConnectingChecking isolated staging
0 / 2signatures
0Drive jobs
Not runload proof
TABLET
Blair’s device
SWMSFictional staging document
Ready to sign
AUTHORITATIVE SERVER STATE
Commit ledger
No committed operations yet.
Integration outboxNo Drive job yet
Immutable queue
A refresh never deletes an operation that the server has not accepted.
Idempotent retry
The same operation ID can be sent repeatedly and still creates one signature.
Server ordering
Sequence numbers come from Supabase, never from a phone or tablet clock.
Separate side effects
Drive filing is one deduplicated job, not a rewrite of signature evidence.