What happens if the funeral guestbook iPad fails in the middle of a service?

A service is a two-hour event in a building nobody controls, and the funeral guestbook is running on a battery. So the question isn’t whether the iPad will ever have a bad afternoon. It’s what happens to the signatures when it does — and that answer is worth asking every vendor you talk to, including us.

What actually goes wrong at the stand

Four things, and none of them is exotic:

• There’s no usable wifi. Church halls, lodge rooms, graveside tents. The venue’s guest network needs a captive-portal login nobody has, or it just doesn’t reach the room the guests are in.
• The battery is flat three hours in. The stand was set up at nine for an eleven o’clock service, and nobody plugged it back in after the visitation.
• A guest signs and walks away immediately. They finish, hand the stylus to the next person, and are out the door before anything has left the building.
• The device is asleep or locked between arrivals. Guests come in waves. Between waves the screen goes dark, and the next person doesn’t know whether to touch it.

These are ordinary. A funeral home that’s run a hundred services has seen all four. They’re also separate from the question of whether every guest can sign in the first place, which is its own set of problems at the stand.

A screen fails differently from a book, and that’s the real thing you’re weighing

A paper register degrades gracefully. Spill coffee on it and you have a stained page with legible names around the stain. Write in the dark and you get a bad scrawl that’s still an entry. The failure is partial and it’s visible — you can see the mess.

A device fails discretely. The signature exists, or it does not. There’s no smudged-but-readable version of a record that was never written. And the failure is usually invisible at the moment it happens: the guest saw their name appear on the screen and walked away satisfied either way.

That asymmetry — not reliability in the abstract — is what an owner is actually deciding about. The right question isn’t “will it work?” It’s “when it doesn’t, do I find out while I can still fix it?”

What a careful setup does about it

The design answer is that the network must not be in the path of the save. In FuneralGuestbook.app, a signature is written to the iPad itself the instant the guest taps Submit — before any attempt to reach a server. That write can’t fail and doesn’t wait on anything, so the guest who signs and immediately walks away is already recorded. Sending it onward happens afterward, in the background, and the person at the stand never waits for it.

Which means the four failures above land differently than you’d expect:

No wifi at all. The signings queue on the device and go up when the network comes back — at the office that evening, if that’s when it comes back. We learned how much this matters by testing it badly first: an early version gave up on a stalled network after a handful of tries, and a simulated forty-five-minute dead zone lost the whole stretch of signings about four minutes in. It now distinguishes between “the server answered and rejected this” and “we couldn’t reach anyone.” The second one isn’t the signature’s fault, so it never counts against giving up. A dead zone that outlasts the entire service doesn’t cost you an entry.

A flat battery, or the app closed. The queue is written to the device’s storage rather than held in memory, and it’s reloaded before anything else at the next launch. Signings captured while the iPad was offline survive the battery dying and the app being killed.

Something genuinely goes wrong. Some failures are real — a malformed capture, a credential the server refuses. Those stop retrying, because retrying an identical thing forever just hides it. They surface instead: the status bar shows a count of failed signings and a retry button, and it will not display an all-clear label while any capture is sitting unsent. That last part is a deliberate rule rather than an accident of the layout. We put it in after finding the opposite failure elsewhere in the app — a screen that told a person their signature was saved when the write had failed. One reassuring message covering two opposite states is worse than no message, and it’s the specific bug we now test against.

The re-send doesn’t duplicate anyone. Each queued signing carries its own id, so if the app dies between a successful send and recording that success, the second attempt is recognized and you get one guestbook line, not two.

What this doesn’t fix, and the paper question

None of that helps if the iPad is dead, dropped, or in the wrong room. Software can protect a signature that was captured; it can’t capture one from a device that’s asleep when the family walks in. The real single point of failure at most services isn’t the network — it’s that there’s one device and one table, and someone has to be paying attention to it.

So: should you still put a paper book out?

If it costs you nothing, yes — and not because the digital one is untrustworthy. Any single point of capture wants a fallback, and a $30 register book sitting beside the stand is the cheapest insurance in the building. A vendor telling you to throw away the paper is selling you confidence, not equipment.

Just be honest with yourself about what the paper book is for. It’s a backup for the afternoon, not a system of record — what usually happens to it afterward is a drawer. If part of why you went digital was so the names could still be used a week later, the paper copy doesn’t do that job, and what you’re actually required to keep is a different question again.

The genuinely useful setup habits are duller than the technology: plug it in, wake it before each wave of arrivals, and give one person the job of glancing at the stand every twenty minutes. That person is the actual failure detection system, and no software replaces them.

The question to ask any vendor

Not “is it reliable.” Everyone says yes.

Ask instead: if the venue has no wifi for the entire service, what happens to the signatures — and how would I know? The answer tells you whether the network is in the path of the save, and whether the product will tell you the truth when something didn’t land. Those two things are most of the difference between a guestbook you can leave on a table and one you have to supervise.

You’ve already imagined the failure. A vendor who’s willing to describe it with you is giving you more than one who insists it can’t happen.