THE GOLD STANDARD OF INTELLIGENCE · SPECIALIST STUDY
Prove that offline release controls protect participants and inference during ordinary fieldwork
Readiness approval says the offline design can work. Field surveillance asks whether it does work across real devices, languages, supervisors and connectivity patterns. It measures which devices report trustworthy version beacons, how often grace windows are used, whether overrides become workarounds, what delayed synchronisation conceals, and whether mixed modules recur. It keeps participant safeguards visible even when recruitment pauses, connects version exposure to estimator decisions, and retires heightened surveillance only after steady-state owners can detect and repair the same failures. Rare sites, languages and device states remain visible rather than disappearing inside a reassuring overall average.
This guide belongs to the Intelligence subject root, the Gold Standard of Education, and the How X Works hub. It begins with a concrete decision, then tests whether the method still holds when the context changes.
Choose a reading route
Define field surveillance · chapters 1, 2, 3
Measure beacons and synchronisation · chapters 4, 5
Review grace and overrides · chapters 6, 7, 8
Protect participants and estimates · chapters 9, 10, 11
Retire or reopen readiness · chapters 12, 13
The whole problem at a glance
| Field question | Required evidence | Unsafe shortcut |
|---|---|---|
| Which devices are known? | Beacon denominator | Connected devices |
| How is grace used? | Action-level receipt | Grace count |
| What is delayed? | Local and central sequence | Sync complete |
| Can surveillance retire? | Transferred control test | Quiet month |
Offline devices missing from central data remain part of the denominator.
CHAPTER 1 OF 13 · Define field surveillance
1. Write the surveillance contract
Name the readiness risks, device population, field actions, protocol modules, languages, observation period, evidence feeds and thresholds. Tie each metric to a failure the readiness controls should detect.
Evidence record: Readiness approval, risks, devices, sites, modules, actions, owners, metrics, duration, thresholds and reopen conditions. Preserve source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the claim rather than inherit confidence.
Decision rule: Reject generic uptime monitoring that cannot expose stale or mixed protocol state. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A new translation joins the release; add it to the surveillance contract before field use. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 1 check · what should survive an audit
- State the decision unit for “Write the surveillance contract”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 2 OF 13 · Define field surveillance
2. Define the eligible device denominator
Build the fleet from issued, spare, repair, shared, lost, retired and replacement devices. Include devices expected to be offline and distinguish unreachable from inactive.
Evidence record: Device identity, site, custodian, issue state, last contact, package state, offline plan, retirement and reconciliation. Preserve source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the claim rather than inherit confidence.
Decision rule: Do not calculate beacon coverage using only devices that reported. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A spare device activates during an outage; add it to eligibility from its issue time. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 2 check · what should survive an audit
- State the decision unit for “Define the eligible device denominator”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 3 OF 13 · Define field surveillance
3. Preserve case and action lineage
Join device and module versions to consent, eligibility, interview, coupon, payment and follow-up events. Central sync time is not the field-action time.
Evidence record: Case, action, local time, trusted clock state, device, package hash, module versions, user, override and later receipt. Preserve source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the claim rather than inherit confidence.
Decision rule: Quarantine analytical release when critical action lineage remains unknown. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A case syncs three days late; reconstruct the state at action time rather than applying today’s version. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 3 check · what should survive an audit
- State the decision unit for “Preserve case and action lineage”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 4 OF 13 · Measure beacons and synchronisation
4. Measure beacon coverage honestly
Report current, grace, expired, mixed, missing and unverifiable beacon states by site, device class, language and offline duration. Include last verification age and clock confidence.
Evidence record: Eligible fleet, beacon payload, component hashes, verification time, clock state, receipt path, exclusions and unknowns. Preserve source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the claim rather than inherit confidence.
Decision rule: Escalate missing beacons on active devices even when overall current coverage is high. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A rural site has all missing beacons; do not hide it inside a national percentage. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 4 check · what should survive an audit
- State the decision unit for “Measure beacon coverage honestly”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 5 OF 13 · Measure beacons and synchronisation
5. Reconcile delayed synchronisation
Compare local sequence numbers, queued actions, central receipts, duplicates, conflicts and retries. Distinguish delay from loss and record what decisions could not be monitored in real time.
Evidence record: Local logs, queue state, last server receipt, retries, duplicates, conflicts, dropped events, recovery and confidence. Preserve source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the claim rather than inherit confidence.
Decision rule: Keep the exposure window open until every critical queued action is reconciled or bounded. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A reconnect replays duplicates; deduplicate by event identity without discarding the original local chronology. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 5 check · what should survive an audit
- State the decision unit for “Reconcile delayed synchronisation”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
Worked field-surveillance register
| Device | Beacon state | Grace use | Route |
|---|---|---|---|
| D-14 | Current | None | Monitor |
| D-22 | Late | Consent blocked | Supervisor review |
| D-31 | Mixed modules | Coupon issued | Quarantine |
| D-40 | Missing | Unknown | Locate |
Actual actions require approved participant and ethics procedures.
CHAPTER 6 OF 13 · Review grace and overrides
6. Monitor grace-window use by action
Track why grace activated, which protocol modules were involved, what actions continued, duration, supervisor knowledge and later verification. A low aggregate count can hide inappropriate critical use.
Evidence record: Grace rule, device, case, action, start, expiry, reason, evidence, supervisor, outcome and follow-up. Preserve source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the claim rather than inherit confidence.
Decision rule: Stop expansion when grace repeatedly covers actions meant to be blocked. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Consent is blocked but contact viewing continues; record the permitted and prohibited actions separately. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 6 check · what should survive an audit
- State the decision unit for “Monitor grace-window use by action”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 7 OF 13 · Review grace and overrides
7. Review supervisor overrides for workarounds
Compare overrides with the approved offline matrix, authority, duration and case consequence. Repeated extensions may indicate poor release distribution or an unrealistic field process.
Evidence record: Override receipt, base state, requested action, authority, rationale, duration, affected cases, recurrence and review. Preserve source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the claim rather than inherit confidence.
Decision rule: Reopen readiness when override patterns bypass expiry or lineage controls. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: One region repeatedly extends coupon issuance; investigate the distribution mechanism, not only the supervisors. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 7 check · what should survive an audit
- State the decision unit for “Review supervisor overrides for workarounds”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 8 OF 13 · Review grace and overrides
8. Detect mixed-module recurrence
Look for devices with current applications but stale consent, translation, questionnaire or coupon modules. Trace whether packaging, partial download, activation or cache behaviour caused the mix.
Evidence record: Component manifest, package verification, activation logs, storage state, failed downloads, cases, containment, cause and retest. Preserve source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the claim rather than inherit confidence.
Decision rule: Treat a mixed critical module as a release incident even if the app reports current. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A consent module lags while help text updates; classify consequence by the affected action. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 8 check · what should survive an audit
- State the decision unit for “Detect mixed-module recurrence”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 9 OF 13 · Protect participants and estimates
9. Verify participant safeguards
Check that privacy, consent, withdrawal, reimbursement, support and remedy obligations continue during pauses, lockouts and delayed sync. Research continuation is secondary to participant protection.
Evidence record: Safeguard action, responsible role, local materials, contact route, timing, evidence, failures, remedy and participant communication. Preserve source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the claim rather than inherit confidence.
Decision rule: Do not withhold an authorised obligation merely because recruitment is paused. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A payment is due while the interview module is expired; complete the safeguarded obligation and log escalation. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 9 check · what should survive an audit
- State the decision unit for “Verify participant safeguards”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
Readiness-retirement gate
| Gate | Pass evidence | Remain open when |
|---|---|---|
| Coverage | Offline fleet bounded | Missing devices |
| Fallback | Allowed actions obeyed | Local workaround |
| Safeguards | Obligations continue | Participant delay |
| Analysis | Exposure resolved | Unknown lineage |
Low incident volume is not evidence when beacon coverage is poor.
CHAPTER 10 OF 13 · Protect participants and estimates
10. Route exposed cases proportionately
Use action-level version evidence to separate unaffected, review, participant-remedy and analytical-quarantine cases. Preserve raw data and avoid blanket exclusion.
Evidence record: Exposure interval, critical action, version delta, participant consequence, data consequence, reviewer, state and release conditions. Preserve source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the claim rather than inherit confidence.
Decision rule: Do not infer invalidity or safety from device status alone. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A stale help page did not affect recruitment; document it without quarantining valid measurements. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 10 check · what should survive an audit
- State the decision unit for “Route exposed cases proportionately”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 11 OF 13 · Protect participants and estimates
11. Protect estimators during surveillance
Assess whether offline exposure changed recruitment chains, coupon counts, network size, eligibility, nonresponse or site composition. Use sensitivity and bounds before pooling.
Evidence record: Affected cases, mechanisms, chain positions, weights, missingness, comparison, bounds, estimator decision and reporting text. Preserve source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the claim rather than inherit confidence.
Decision rule: Block final analysis when the sampling-process effect is material and unresolved. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Delayed coupon sync changes apparent order but not issue time; reconstruct the graph from local receipts. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 11 check · what should survive an audit
- State the decision unit for “Protect estimators during surveillance”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 12 OF 13 · Retire or reopen readiness
12. Transfer surveillance into field quality
Move durable beacon review, sync reconciliation, override trend, mixed-module alerts and safeguard checks to named operational owners. Exercise each route before heightened monitoring ends.
Evidence record: Control mapping, owners, schedules, dashboards, evidence access, escalation, training, exercise and acceptance. Preserve source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the claim rather than inherit confidence.
Decision rule: Retain heightened surveillance where the steady-state route has not handled a test case. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A quality team receives the dashboard but lacks local-log access; complete access and test first. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 12 check · what should survive an audit
- State the decision unit for “Transfer surveillance into field quality”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 13 OF 13 · Retire or reopen readiness
13. Retire or reopen readiness deliberately
Summarise field coverage, grace and override patterns, sync delay, recurrence, safeguards, estimator decisions and residual risk. Remove temporary access and intensive sampling with receipts; reopen after material change or failure.
Evidence record: Closure snapshot, denominators, findings, remedies, transferred controls, access retirement, authority, expiry and triggers. Preserve source, time, version, scope, exclusions, failed checks and unresolved cases so a later reviewer can reconstruct the claim rather than inherit confidence.
Decision rule: Do not retire based on elapsed time when rare sites or modules remain untested. Name the authorised owner, trigger, deadline, stop condition, remedy and verification window. Closure requires a changed-context test of the mechanism being protected.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A new device operating system changes background sync; reopen the affected readiness controls. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 13 check · what should survive an audit
- State the decision unit for “Retire or reopen readiness deliberately”.
- Bind every claim to scope, version, denominator and time.
- Connect evidence to an owner, bounded action and later verification.
Contents · Previous chapter · Return to the Intelligence guide
Verification lab: work the decision twice
Build a fleet denominator that includes active, spare, repair and offline devices, then calculate beacon coverage without excluding silence.
Reconcile a three-day delayed sync containing duplicates, one conflict and a mixed-module case while preserving action-time lineage.
Review ten grace and override receipts, identify one recurring workaround, and route participant and estimator consequences.
Limits and misconceptions
Connected-device coverage is not fleet coverage
Silent offline devices remain in scope.
Central receipt time is not action time
Preserve local chronology and clock confidence.
A grace window is not a shadow protocol
Limit it by action, authority and time.
Readiness retirement is not the end of control
Transfer and exercise durable field-quality routes.
Questions readers ask
What is beacon coverage?
- The measured state of eligible devices and their critical protocol modules, including missing and unverifiable devices.
How should delayed sync be handled?
- Reconcile local and central sequences, duplicates, conflicts, loss and the period when monitoring was incomplete.
Are all grace-window cases quarantined?
- No. Review the action, version difference and participant or estimator consequence.
When is an override a problem?
- When it exceeds authority, hides release failure or becomes a recurring workaround.
What participant safeguards remain offline?
- Approved privacy, consent, withdrawal, support, reimbursement and remedy obligations.
When can heightened surveillance retire?
- After coverage, fallback, safeguards and analysis gates pass and steady-state controls are exercised.
Practise, verify and continue
Surveil an approved RDS offline release across fleet beacons, delayed sync, grace use, overrides, mixed modules, participant safeguards and estimator protection.
Apply the method to an offline mobile health study. Preserve fleet denominators, action lineage, safeguard continuity, exposure review and control transfer.
Practical evidence check
Before implementation, write a one-page evidence map with the decision, unit of analysis, version or time boundary, inputs, outcomes, uncertainty, authority and stop rule. Attach one worked case that passes and one that fails. A reviewer should be able to reproduce the reasoning without relying on the memory of the person who built the system.
Run one changed-context rehearsal before approval. Alter a mechanism rather than a cosmetic detail, then identify which calculation, safeguard or governance gate must change. Record any conclusion that does not transfer. This short rehearsal is often the fastest way to expose a hidden assumption before it becomes an operational dependency.
Related eduKate reading
RDS offline-readiness and protocol-release assurance
RDS stale-protocol incident response
RDS protocol-control library versioning
RDS protocol-deviation trend review
Authoritative sources and scope
US Census Statistical Quality Standard B1
CDC NHANES 2025–2027 procedure manuals
CDC NHANES interviewer procedures manual record
CDC Global Tobacco Surveillance System survey documents
Census and CDC sources support controlled data collection, current procedure manuals and documented field operations. They do not prescribe this surveillance design. Devices and cases are fictional; ethics, consent, privacy, participant remedy and estimator decisions require authorised review.