Context
A long static HTML guide cannot hold trainee state, cannot require a captain verify, and cannot travel on a phone with no signal. Putting a JavaScript password in front of hosted training is not access control — it is a suggestion. The procedures themselves are licensed internal-use material and cannot be treated as a marketing site.
Architecture
Content is data, not a second copy of the master. Lessons, operations, snorkel, checklists, and sign-off live in versioned data modules. Emergency procedures (fire, MOB, unresponsive, EPIRB) keep their original operational HTML. A Python build concatenates the phone file so crew can save progress inside one document.
Progress is local to the device: lesson acknowledgements, terminology answers, five-question emergency quizzes (100% required per procedure), knot practice, four captain verifies, daily checklists, and sign-off items. Home is a computed count of those checks — not a separate LMS database.
The hosted copy is a static site. Authentication is Vercel Routing Middleware reading TRAINING_GATE_PASSWORD before any training asset is served. License identity, vessel label, version, and fingerprint live in a single license module so the footer cannot drift from the executed agreement.
Implementation
Immutable master, mutable delivery
master/ stays frozen. Updates go through data modules or emergency HTML, then a version bump. The phone file is rebuilt; it is not edited by hand in the field.
Assessment, not a checkbox wall
Each emergency procedure has a five-question quiz. Captains must verify the trainee understands every emergency. That is a different object from “I read it.”
Offline as a first-class artifact
The AirDrop file is a licensed offline runtime. Progress persists in that copy. It is intentionally not protected by the website password — the gate is for the hosted corpus.
Server-side gate, not a login page
Client-side password pages are treated as insecure. Middleware runs before HTML or PDFs. noindex is a header, not an access-control story.
Non-negotiables
No public training content
This case describes architecture. It does not republish procedures, radio scripts, knot steps, or the signed license PDF.
Not an HR system of record
On-device checks are training progress, not a legal e-signature or employee database. Captain sign-off is operational, not counsel’s substitute.
Licensed to Oahu Ocean Activities LLC DBA Honolulu Snorkel Company (License ID II-HSC-LOLA-2026-001). Hosting and the lifetime internal-use license are separate contracts.