How offline works

What keeps running when the internet drops, what waits, how the on-premises node uploads in order, and why the browser app is not the offline layer.

"Works offline" means different things in different products. Here is exactly what it means in ChowChirp.

Two different things

The browser app (what you open on a laptop or phone) installs its shell so it opens instantly, and it queues invoice captures and kiosk clock-ins when the connection is poor. Live screens, uploads and commands need a connection. The offline page says so rather than pretending.

The on-premises node (a small computer installed in the outlet with the kitchen and counter) is the real offline layer. It holds a local copy of the outlet's kitchen state and keeps working when the internet is down.

What keeps running on the node

Ticket routing to stations, bump, recall, void and remake.
86 changes and the service-day phases.
Unit safety limits, loaded from the node's local cache before any cloud attempt.
Station unlock, through an offline delegation that was staged while the connection was up: a signed record with an offline PIN and a clock check.

What waits for the connection

Anything that needs a cloud-issued operational session.
Recipe consumption evidence sync, unit limit refresh, outlet authority refresh.
Uploads, live dashboards and most commands in the browser app.

Why the node can refuse

The node must be sure of the time before it lets anyone unlock a station offline, because time is what makes signed delegations safe. If it cannot prove the clock is trustworthy, for example after a restart with no connection, it shows blocked, manual and the kitchen falls back to numbered paper tickets. That is a deliberate choice: a controlled paper process beats two systems both believing they are in charge.

How it catches up

The node keeps an outbox. Every event has a sequence number per stream and a record of what it depends on. When the connection returns, events upload in dependency order, and the cloud rejects anything out of sequence rather than accepting a duplicate. A privileged action carries a signed receipt. The result is one copy of what happened, in order, with no double-counting.

What this is not

The node is not a second server you manage, and the browser app is not an offline POS. Card and e-wallet acceptance offline is deny-by-default. If you need the kitchen and counter to survive an outage, that is the installation with the node; if you only use the back-of-house modules, the browser app is enough.

Updated 2026-09-16