· 6 min read · Samuel . E . Zih
Designing for the network being gone
A station agent standing in a yard with no signal and a queue of forty people is not an edge case. It is Tuesday. Nobody will ever thank you for getting it right.
- Engineering
- Zoomaa
- Offline-first
Zoomaa runs intercity bus operators' entire business from a phone: search, seat selection, mobile-money payment, live tracking, boarding, settlements. The feature I am proudest of is one no passenger will ever notice.
The actual operating environment
A boarding yard in Ghana, twenty minutes before departure. Forty people in a queue. A station agent with a phone. And, frequently, no usable signal — because bus yards are concrete, crowded, and not where anyone prioritises coverage.
If boarding requires the network, the agent falls back to paper, the manifest diverges from the system, and the reconciliation afterwards is somebody's whole evening. The offline case is not a degraded mode. It is the normal mode.
What that forces
The ticket boards offline. The QR carries enough to validate locally; the scan does not need a round trip.
Boarding state is local-first. The agent's device is authoritative for the duration of the boarding, and reconciles on reconnect.
Reconciliation is automatic and total. Not a prompt asking the agent to resolve conflicts. They are standing in a yard.
And the counterpart problem: two people, one seat
The mirror image of offline boarding is simultaneous booking. Two passengers tap the same seat at the same instant, on different phones, through different mobile-money providers.
The answer is not optimism. It is holds with expiry, atomic seat assignment, and idempotency keys on every payment path so that a retry — which mobile money will absolutely produce — does not sell the seat twice or charge twice for one.
Failure | What prevents it |
Two passengers, one seat | Atomic assignment against a held state, not a read-then-write. |
A retried payment charges twice | Idempotency key scoped to the booking attempt. |
Agent boards offline, system disagrees | Local-first boarding state with automatic reconciliation on reconnect. |
Gender-blocked seat sold anyway | Seat state is a set of distinct states, not a boolean. |
Why nobody thanks you
Passengers will not notice any of this. Correctly handled concurrency is indistinguishable from luck, and successful offline boarding is indistinguishable from there having been signal.
A station agent standing in a yard with no signal and a queue of forty people will have a day that works instead of a day that doesn't — and that's the whole point.
The same instinct shows up everywhere in what I build: an audit trail so any pin on the crisis map traces back to its original posts, a confidence threshold that asks a clarifying question instead of guessing. None of it demos well. All of it is the difference between a thing that works and a thing that works when it matters.
The rule
Design for the failure, not the demo. No network, simultaneous writes, a model that is confident and wrong — these are not edge cases. They are Tuesday.
