How we keep data in sync across the fleet

A ship at sea is not always a ship online. Satellite links drop, ports throttle bandwidth, and for hours at a stretch the vessel is on its own. Yet the work never stops: rosters change, certificates get signed, appraisals get filed. The question that shaped this part of CruiseControl was blunt. What happens when ship and shore both edit the same record while the connection is gone?

Offline-first, not offline-tolerant

Most systems treat the network as normal and the outage as an error. We inverted that. In CruiseControl the ship owns a full working copy of its own data, and every action a crew member or officer takes is written locally first. The interface never freezes waiting for a server on the other side of an ocean. Work continues at full speed whether the link is up, degraded, or dark.

When connectivity returns, the ship and shore reconcile. That reconciliation is where the hard engineering lives, because both sides may have changed the same thing in the meantime.

"The connection is the exception, not the rule. So we built for the outage and treated the signal as a bonus."

Resolving conflicts without losing work

Every change in CruiseControl carries a timestamp, an origin, and the version of the record it was made against. When two edits collide, we do not blindly pick the newest write and discard the rest. Instead the model resolves at the field level: if shore updated a crew member's contact detail and the ship updated their duty assignment, both survive, because they never touched the same field.

Genuine conflicts, where the same field changed on both sides, follow clear rules:

• Field-level merging so unrelated edits on the same record both persist.
• Authority rules that let the side responsible for a field win a true tie.
• A full history of every version, so nothing is ever silently overwritten.
• Flagging of the rare unresolved case for a human to confirm, rather than guessing.

You cannot fully trust a shipboard clock

Ordering changes by timestamp assumes every clock agrees, and shipboard clocks are exactly where that assumption is weakest. Vessels cross time zones, systems are restarted, and a device that has been offline for days can drift by more than the interval between two edits. Resolve a conflict purely on wall-clock time and you eventually resolve one backwards, which is worse than not resolving it, because the outcome looks authoritative.

So the ordering that matters is causal rather than chronological. Each change records the version of the record it was made against, which establishes what the author could actually have seen at the time. Two edits made against the same version genuinely conflict, regardless of what either clock claims. An edit made against a version that already contains the other is a continuation, not a collision. Wall-clock time stays useful for showing a human when something happened; it is not what decides who wins.

A vessel that has been dark for a week

The other fleet-scale case is the long gap. A ship out of contact for days rejoins holding a substantial backlog, and the naive behaviour is to push all of it at once, over the worst link in the fleet, while the crew wait. Catch-up has to be bounded and resumable: move the highest-value changes first, survive an interruption without starting over, and stay usable throughout rather than locking the vessel into a sync it cannot cancel.

It also has to be ordered so the shore picture is never briefly nonsense. Reconciling a fleet means assembling many partial, out-of-order streams into something coherent at every intermediate point, not only once the last vessel finishes. A shore team looking at readiness halfway through a catch-up should see a picture that is incomplete but never contradictory.

Why it holds up across a fleet

Scaling this from one ship to a whole fleet means each vessel syncs independently and never waits on another. Shore assembles a coherent picture from many partial, out-of-order streams, and any ship can go dark for a day and rejoin without a painful catch-up. The result is a single source of truth that does not depend on everyone being online at once.

Crew rarely notice any of this, and that is the point. They log their hours, sign their forms, and update their records, and CruiseControl quietly makes sure that when the fleet comes back together, every edit is accounted for and nothing was lost to the gap in the signal.