1
Policy
Central decision: this business may, or may not, complete sales while disconnected.
Offline policy
How offline work is allowed.
Not every shop should complete sales in the dark. The platform panel decides. Devices receive a signed policy with an expiry — default up to 72 hours.
2
Lease
The device holds a signed lease. When it expires, offline completion stops being allowed.
3
Outage
If the lease is valid, sale, tenders, and local stock movement are saved together, then printed.
4
Sync
When the network returns, pending work uploads. Nothing is wiped just because the policy changed.
When offline is off
Checkout waits for the server.
The cashier can still start the sale. A draft is stored. It is not a completed sale until the server accepts it. That is slower during an outage, and it is honest.
When offline is on, the counter keeps moving: the sale, the tender split, and the local stock movement are one unit of work.
What a lease carries
Whether offline completion is allowed for that business.
An expiry — default up to 72 hours, not an open-ended promise.
A signature so a device cannot invent a more generous policy for itself.
Lost devices can lose never-uploaded records
Pending work is never deleted just because the policy changed. That is a different sentence from “nothing can be lost.” A lost, wiped, or stolen device can still lose records that never uploaded. The Sync screen shows that risk in plain language.
Policy changed while drafts sit
Drafts and pending uploads stay. The new lease changes what you may complete next, not the work already captured on the device.
No theatre about immortality
Local records live on that device until they upload. If the device never comes back, those records do not either. Plan backups and device custody accordingly.
Ready when the counter is
Open a shift. Take the next sale.
Pricing is still being validated, so we will not invent a number. Open the app if you already have access, or talk to Catalyst Digital about Core, modules, and onboarding.