Offline is not an edge case

The clinicians using Orbital work hours from a cell tower. The previous tooling treated that as an exception: it showed a spinner, then an error, then — worst of all — silently dropped the record on the floor.

In a patient chart, silent data loss is the most dangerous failure mode there is. It is worse than a crash, because a crash tells you something happened.

So we inverted the default. The local store is the source of truth. Sync is an optimisation that happens when the network shows up. A CRDT handles the merge, deterministically, without asking a clinician to resolve a conflict between two versions of a vital sign — which is not a question a human should ever be asked at the point of care.

Eleven months, six thousand clinicians, not one record lost. The architecture is more complex than a REST client. The user experience is dramatically simpler: the app just works, and nobody thinks about sync at all. That trade is almost always worth making.