Problem
The airline-food operation needed a dependable handoff between the production floor and the aircraft-loading workflow. The pain was concentrated at the loading deadline: a cart's physical arrival did not by itself tell the receiving team which batches it carried, whether quality had released them, or whether dispatch and ramp agreed on custody. Gaps in that record meant status calls, rescans, and later re-entry across production, quality, dispatch, and ramp teams.
Solution
Offline Protocol was integrated around those existing responsibilities. The Offline Protocol Mesh SDK1 connects production terminals and dispatch and ramp handhelds over available qualified paths. Data Edge Sync2 shares cart manifests and checklist progress, while retained batch evidence, quality-release references, and receiving receipts preserve the history of each load. A handoff keeps the same identifier across retries, so a repeated scan returns the recorded acceptance. The facility gateway reconciles that evidence into existing enterprise systems.
Outcome
The result is a handoff the receiving team can resolve from the record it holds. Ramp staff can check the cart's contents and release evidence at receipt; dispatch can see whether custody has actually been accepted. This makes loading coordination more efficient under deadline pressure, reduces the need to chase another team for status, and carries a traceable batch-to-cart history through cold-room and airside coverage gaps.
Four zones, four different decisions
The facility is not treated as one uninterrupted wireless room. Production terminals create the batch context; quality devices record checks; dispatch associates released goods with a cart; ramp handhelds acknowledge receipt. A device can retain work while moving between zones and share it when a qualified path exists.
The Offline Protocol Mesh SDK1 supplies local discovery and exchange. Dynamic Offline Relay Switch (DORS) selects an available transport qualified for the terminals and handhelds. OfflineID3 identifies enrolled devices, and Messaging Layer Security (MLS)4 protects the operational records. The facility gateway retains the enterprise outbox; Relay forwards ciphertext to the authenticated ERP, QMS, or warehouse recipient adapter.
Each zone can retain its own accepted work between device encounters. Gateway reconciliation joins those records by batch, cart, and handoff identity.
Batch identity follows the physical load
A release record is useful only if it belongs to the goods being dispatched. Batch and cart identifiers connect production evidence to the loading manifest. Splitting a batch across carts does not duplicate its release authority; combining goods in a cart does not erase their separate histories.
The manifest links each cart and item allocation to its batch ID and quality-release reference. A custody event adds the handoff ID, sender or receiver identity, and capture time. Temperature observations and receipts remain immutable; corrections append evidence under the original source reference. Data Edge Sync2, Offline Protocol's replicated-data layer, synchronizes the compact manifest, checklist progress, and notes. The source event log supplies the audit history.
Quality rules stay in the existing quality system and approved operating procedures. A missing check, excursion, or hold remains an exception. Offline Protocol neither waives HACCP requirements nor infers release from a successful network transfer.
Custody changes when the receiving team accepts
Dispatch records an offer of custody with a stable handoff ID. The receiving team records acceptance against that same ID. If its device is isolated, the acceptance is retained locally and the sender continues to see an unresolved handoff until the receipt arrives.
A repeated scan or lost receipt cannot create another physical cart. The recipient commits its event ID, business transition, and receipt state together; retries return the existing outcome. Conflicting cart assignments or a late quality hold remain visible for resolution rather than being merged into an apparently successful dispatch.
This is where local coordination helps the operating team: a cart being prepared, released, offered, and received has four distinguishable states. Staff can act on the part of the process they own without asking another team to reconstruct it verbally.
The integration in the facility
Adapters connect through supported ERP, QMS, warehouse, and dispatch interfaces. PLCs, SCADA, airline planning, and equipment controls retain their roles. Sensor exports enter through existing gateways; a temperature probe does not need to become a full mesh peer.
The Rust gateway composition uses offline-protocol, offline-protocol-core, offline-protocol-transport, offline-protocol-router, offline-protocol-services, offline-protocol-reliability, and offline-protocol-mls. Mobile integrations use offline-protocol-uniffi or the supported Mesh SDK bridge. offline-protocol-data holds the replicated manifests and checklists in bounded dispatch spaces.
An accepted transition commits with its outbox entry. A recoverable projection queue crosses into the separate SDK store. Device qualification covers cold-room doors, metal carts, loading-bay movement, battery-saving behavior, and application restarts. Shadow comparisons precede activation of each supervised handoff path.
From cart movement to confirmed custody
Production, quality, dispatch, and ramp now contribute to one cart history while retaining their own authority. The receiving receipt closes the handoff; a network send or an additional scan does not. Staff have a shared way to identify the unresolved step, which removes the need to infer readiness or custody from physical movement alone.
Validation follows complete loads through production and ramp receipt. The operating measures capture both record correctness and the coordination work around it:
| Measure | What the operating run checks |
|---|---|
| Release-to-receipt time | Timestamp the actual dispatch release and receiving acceptance, separating transport time from waiting. |
| Evidence completeness | Account for every required committed quality observation and custody event. |
| Handoff correctness | Require one completed transfer per handoff ID despite repeated delivery. |
| Manual coordination | Count status calls, rescans, and later re-entry per cart in comparable dispatch windows. |
| Exception handling | Verify that missing checks, stale authority, and held batches remain unresolved until the proper owner acts. |
Managed services and expansion
The outward meal journey establishes a reusable custody record. The natural expansion is the return journey: empty carts, reusable containers, and catering equipment moving from ramp back to the facility, often through different teams and coverage conditions.
Visibility across dispatch waves. Hosted Relay returns retained release and receiving evidence to enterprise adapters. Managed Telemetry5 can collect queue age, delivery failures, and adapter status by facility and dispatch window. Joining those signals to application handoff IDs helps supervisors identify whether an unresolved transfer is waiting on a crew decision, a local connection, or enterprise ingestion. The local handoff continues while the reporting connection is unavailable.
Returnable equipment and contracted handoffs. The same offer-and-acceptance model supports cart returns, equipment loans, and transfers to an authorized ground-handling partner. Capability Exchange6 can expose a scoped manifest lookup or receiving service, so a partner accesses the assigned load without receiving unrestricted production records. Each partner still owns its acceptance decision.
Evidence at the loading point. Proof of Location7 can supplement a ramp check-in with witnessed presence during the handoff window. It does not establish cart contents, temperature compliance, or quality release. Combined with the existing custody record, this supports additional equipment-tracking, partner-reconciliation, and service-level reporting workflows across facilities and contracted teams.
