Field synchronization: conflicts, photos and validation
Design and test the return path before replacing the collection workflow.
Editorial review: 2026-09-23
The unit of work is a complete inspection
A synchronized point with a missing photograph is not a complete inspection. Define the minimum contract: stable identifier, geometry, required fields, authorized author, capture time, source revision and attachment references. Separate device time from receipt time; a misconfigured clock should not decide which edit wins.
Choose a conflict policy
When two people edit the same feature, determine whether a change can merge, must be rejected or needs human review. Do not use last-write-wins for property boundaries or critical results without an explicit decision. Cover geometry, attributes and deletion.
Create a lab with devices A and B and a fictional asset-1 record at revision 7. Both download that revision. A changes its status and B moves its location. Synchronize A then B; reverse the order in a fresh copy. Record whether the system merges, blocks or overwrites each field. That observation determines whether the mechanism fits the process.
Verify attachments and idempotency
Calculate a file digest to verify transfer integrity without publishing private photographs:
from pathlib import Path
from hashlib import sha256
source = Path('photo-original.jpg')
received = Path('photo-received.jpg')
assert source.is_file() and received.is_file()
assert sha256(source.read_bytes()).digest() == sha256(received.read_bytes()).digest()
print('attachment matches')
The filenames represent two copies of a test photograph you create. A system that recompresses images needs a different explicit policy; binary equality is no longer the criterion.
Resend an operation after interrupting connectivity. The result should be one logical inspection, with visible retries. Also test a full phone, large attachment, revoked permission and a record deleted during the shift.
Assign operational responsibility
Decide who resolves conflicts, how long originals are retained and how an undelivered package is recovered. Include photo storage, device support and human review in TCO. Retain the previous workflow while data loss could go unnoticed. Acceptance requires reconciling inspections and attachments; counting rows alone is insufficient.
Preserve three versions when resolving a conflict
A useful conflict review compares the version sent to the device, the returned edit and the current central record. Comparing only “phone versus server” can hide whether both changed the same field. Keep the package version and stable identifiers so that the original baseline remains identifiable.
| Baseline | Field return | Current central value | Proposed handling |
|---|---|---|---|
Condition good | critical | good | Candidate field update, subject to validation |
Condition good | critical | review | Conflicting condition; reviewer decides |
| Note empty | New note | Different new note | Preserve both observations until reviewed |
| Asset exists | Edited | Deleted or retired | Review lifecycle conflict before resurrection |
These are proposed operating rules, not guarantees of a particular synchronization engine. Record the chosen QFieldSync/QFieldCloud behavior and test it. A cable workflow must not be described as providing automatic conflict resolution when the official documentation assigns that responsibility to the operator.
Return a package without losing the evidence
- Preserve an untouched copy of the complete device package and its attachments before processing the return.
- Identify project version, crew, capture period and expected record count without exposing unnecessary personal data.
- Validate UUID uniqueness, parent references, allowed values and geometry before publication.
- Check every attachment reference against a present file and inspect a sample of contents.
- Reconcile changes with the correct central baseline using the selected mechanism.
- Keep unresolved conflicts visible and exclude them from accepted publication until decided.
- Record the return as processed so a repeated transfer is recognized.
Do not delete the device copy merely because upload started. Define when the office has verified recovery and the crew can safely clear storage.
Check attachment integrity independently
An attribute can synchronize while its photograph fails. Treat records and file bytes as separate parts of completeness. Check file existence, reasonable size, readable media and the correct owning inspection. Where useful, compare a checksum to distinguish a duplicate transfer from two different files with the same name.
Use relative paths within the permitted package or controlled storage references. Reject unexpected path traversal or references outside the intended location in custom import tooling. A user-supplied filename is not permission to read an arbitrary file. Preserve original evidence when transformations such as resizing are part of the workflow, according to the actual retention requirement.
Handle offline deletes and schema changes deliberately
Deleting a central asset while a crew edits its offline copy creates a lifecycle conflict. Decide whether retirement is safer than physical deletion for the operational model. A returned update should not silently recreate a record that was intentionally removed.
Changing field names or domains while packages are in the field can make legitimate returns incompatible. Prefer completing and reconciling the active round before issuing a new schema. If a change is urgent, build and test an explicit conversion path and communicate which packages it affects. Never ask crews to recreate a day's work just because the office changed a form without a return plan.
A six-case reconciliation rehearsal
Use two disposable crew packages and test: distinct inserts, duplicate return, conflicting parent edit, missing photo, unknown parent and a central retirement. For each, write the expected outcome before running synchronization. Count accepted, rejected and pending records; their total should reconcile with the submitted batch under the chosen definition.
Measure human review time as well as machine synchronization time. A transfer completed in seconds can still require hours of reconciliation. Feed that observed labor into the TCO calculator and the QField deployment guide.
Sources and documentation
Next step
Continue in the Open GIS collection. For a specific project, use the total-cost calculator and request an assessment.