Collect cash with zero signal — with zero risk of double-posting.

Picture an agent working a route with hours of zero connectivity, collecting cash from borrower after borrower. Without a reliable offline mechanism, two things go wrong: collections either aren't captured at all, or a naive retry-on-reconnect posts the same collection twice — a genuine cash-custody and audit failure, where the ledger shows money that was never collected twice over.

This is not a hypothetical. Double-posted collections are one of the classic ways field cash reconciliation breaks down. The Ustawi app is engineered specifically so it cannot happen.

Each collection is recorded against a specific loan and installment from the agent's worklist, and written to a local on-device queue with a unique idempotency key. The agent sees the payment captured immediately, whether or not there is signal.

When connectivity returns, the queue syncs to the server. The server deduplicates by idempotency key, so even if the same queued write is sent twice — after a dropped connection, say — it is only ever posted once.

An idempotency key is what makes 'try again' safe. The agent's phone can resend a queued collection as many times as the flaky network forces it to, and the server will still record exactly one posting. That single guarantee is the difference between a trustworthy field-cash trail and one that quietly drifts out of balance.

A genuine failure — a malformed payload or a mismatched loan reference — is not silently dropped. It lands in a recoverable exception queue and is resolved by an operations supervisor through the Collections & Delinquency app. Nothing disappears; a broken write stays visible until a human clears it.