· 9 min read
A Queue That Fails Safe
When software controls a physical queue of people, a failure has consequences that are not data consequences. Offline-first operation at the counter, where each terminal keeps issuing from a local ledger and reconciles when connectivity returns, matters more than any feature of the central system. The dangerous failure is the recovery surge, when everything queued during an outage releases at once.