Your office can't see what the rig sees.

In plain terms: the connection to a rig drops all the time, so the system is built to keep every reading safe on site and catch up later — not to treat every outage as an emergency. Everything in this system follows from one fact: the connection between a rig site and everywhere else fails regularly, unpredictably, and for durations ranging from seconds to a day. A system that treats that as an error condition will spend most of its life in an error condition. So the link being down is designed as a normal operating state, not an incident.

That makes the rig-site component the real system and the cloud the consumer of it. Data is captured and durably buffered at the edge, at full resolution, whether or not anything can be sent. Transmission is a separate concern that drains the buffer when it can. This inversion matters more than it sounds: the common alternative — sending live and reconnecting on failure — quietly loses everything that happened while the link was down, and the loss is invisible, because the chart simply resumes. A geologist looking at that chart has no way to know they are looking at a hole.

Which is why backfill is marked rather than merged. When the link returns and hours of buffered data arrive, it lands at its correct depth and time — but the period is flagged as backfilled. The log tells you it was reconstructed. A system that invisibly heals its own gaps is a system that cannot tell you when it was blind, and on a well, when you were blind is exactly the question that gets asked afterwards.

The two indexes are the other structural decision. The same reading belongs at a depth and at a time, and the relationship between them is not fixed — during a connection, time passes and depth does not. Storing against one index and deriving the other is what produces logs where nothing lines up when drilling stops. Both indexes are first-class, which costs storage and complexity, and is the difference between a driller and a geologist reading the same well without arguing about the chart.

Alarms inherit all of it. A threshold trip that occurred during a link outage still occurred; it surfaces on reconciliation, timestamped when it happened rather than when it was received. And an alarm nobody acknowledged escalates, because in an operation spread across a rig site and a town office, the assumption that the right person is looking at the screen is the assumption that fails first.