Live play: the player page

The player page is what participants open on their own phone, tablet or laptop during a live exercise. It needs no install and no account: the facilitator shows a QR code (or hands out per-role cards), a player scans it, picks a seat, and sees what the exercise sends to that seat. This guide describes the page itself.

Joining

1. Scan the room’s QR code or open the link. The link carries the key to the exercise in the part after #, which never leaves the device: do not forward it. A per-role card preselects a seat; the controller still decides who sits where.
2. Pick your seat. The list shows each role with its team and, where the facilitator set one, how many seats are taken (“1 of 2 seats taken”). A full seat cannot be chosen. Evaluator needs the staff link the facilitator gives evaluators separately; on a players link it is shown but disabled, with that reason.
3. Display name is optional (up to 40 characters). Under the field the page says what happens to it: in a non-attributional exercise the name is shown to the room only while you are connected and is not recorded; in a named exercise, names are recorded.
4. Join exercise. If the seat was taken in the meantime the page says so and you pick another.

Small print on the join screen shows the page version and the protocol version; About repeats them.

The room

The header shows the exercise clock (it ticks on the device while the facilitator has it running and shows “paused” otherwise), the scenario title, your seat, and the connection state as a dot with text: Connected, Reconnecting… or Offline.

• Inbox holds what was addressed to your role, your team or this device, newest exercise time on top, with an unread marker and a count on the tab. A new inbox item is announced to screen readers; the device vibrates if it can and you left that on, and plays a short sound only if you turned sound on in Settings (off by default: rooms are loud enough).
• Feed holds what everyone saw: items sent to the whole room, controller notices (dismissible unless the facilitator marked them otherwise), clock changes (“Time jump to 2:00”) and announcements that a vote, survey or the hot wash opened or closed.
• Messages (to the SimCell) comes with a later update. The tab is shown disabled rather than hidden so the layout does not change when it opens.
• More holds Votes, Hot wash, Surveys and Evaluate (each shown disabled with a one-line reason when the exercise does not use it), Settings (theme: system, light or dark; text size; sound; vibration) and About (versions, which connection the page uses, what is and is not recorded, and Forget this device).

On phones the tabs are at the bottom; on wide screens they become a left rail.

Every inject’s exact text is on the card, including the image description, so nothing depends on reading pixels. Media and receipts for injects, and the other features, are added by their own updates.

Losing and regaining the connection

The page reconnects by itself. When the device sleeps, changes network or loses Wi-Fi:

• the header keeps saying Connected for two seconds (short drops are invisible), then says Reconnecting… or Offline with a banner;
• the page retries with growing pauses (half a second up to thirty seconds), and at once when the screen turns back on, the network comes back, or the tab is restored;
• after reconnecting it asks the server for what it missed and shows You’re back for three seconds; everything missed appears in the inbox and feed in order, once.

A reload keeps your seat and history. A late joiner gets the whole history for their seat and the room.

When the facilitator acts

• Moved to another seat: the header changes and the inbox rebuilds for the new seat from what the page already holds; a notice in the feed says so.
• Removed from the exercise: the page shows “The facilitator removed this device from the exercise” and stops reconnecting. The key was rotated, so the old link no longer opens anything; a new link from the facilitator does.
• Session ended: the end screen shows the facilitator’s closing message. The page drops its keys and material; it can be closed.
• Update needed: if the page is older than the server, it asks you to reload.
• This device id is in use: another browser connected with the id this page saved (for example the same link restored on another device). Join as a new device continues with a fresh id.

Injects on your device

• Inbox and feed. An inject for your seat (or your team) lands in the inbox; one for everyone lands in the feed. Open shows it in full.
• The artifact and its text. The picture, video or audio is the same one the facilitator has. Text version (collapsed) holds the exact text of the inject; screen readers read it as the image’s description. Open full size shows the larger image in a window you close with Close or Escape. Audio does not play by itself; it has a transcript, and video has captions when the inject has voice lines.
• Read and actioned. The facilitator sees that your device received the inject, that you read it (the detail was open for a second) and, if you press Mark as actioned, that you acted on it. Receipts are by seat, not by person, unless the session records names.
• Withdrawn. If the facilitator takes an inject back, it leaves your inbox and the feed says “Withdrawn by the facilitator”.
• Evaluators and observers see every inject, marked “Not addressed to you”.

Privacy

The page makes requests only to the computer or server that served it: no fonts, scripts, images or trackers from anywhere else, and the content security policy the page ships with forbids them. Exercise traffic is end-to-end encrypted; the servers hold no key. The browser keeps the device id and the position in the stream for this tab only (sessionStorage), the theme and cue preferences for this browser (localStorage), and the display name in memory. About → Forget this device clears the id and keys for the session from this browser.

Delivering injects to devices

With a session running, Deliver on a row also sends the inject to the devices of the people it is for, in the Inject panel’s Devices section:

• Targets. Computed from the MSEL row: the row’s roles (a whole team becomes the team), everyone for “All” or an inject shown on the main screen. Edit targets changes them before delivering, and lists each connected player device (Device: PIO) so you can send an inject to one phone only. Send to devices off keeps the inject off the devices (the rest of Deliver is unchanged).
• Expected actions. Show expected actions to evaluators adds the row’s expected action to the evaluators’ copy only, sealed with the staff key. Players never receive it, nor the instructor note.
• Receipts. The timeline shows “to 3 · 3 delivered · 2 read · 1 actioned” and the panel lists each seat with times. Resend sends the same inject to another role or team. Undo deliver also withdraws it from devices.
• Media. Files are sealed on this computer and staged when the session starts (“Staging media 14/26” in the Live tab). Template pages go as a phone-sized picture plus the full-size original. A file over the connection’s limit is left out and the device is told it is shown on the main screen.
• Not covered by Deliver. Printing and reading aloud are still done by you; players cannot send injects to each other.

Choosing the connection

Each live session starts by choosing how devices reach this computer. The Live tab shows three options and what each one sends where, side by side with the Start button. Nothing contacts a network until you press Test connection or Start session on a connection you chose. The choice is remembered per exercise; Settings > Live play sets the one a new exercise opens on.

This computer.

Your computer listens on the Wi-Fi at the address shown. Players' devices load the player page from it and exchange encrypted session messages with it. Nothing is sent to the internet. Stops when you end the session.

Action Stations relay.

Your computer connects to relay.actionstations.ai, run by the Action Stations project on Cloudflare. It sends the session id, encrypted messages and media, their sizes and timing, and your IP address. The relay cannot read session content and keeps encrypted messages only for late joiners, deleting them when you end the session or after 72 hours. Limits: 60 devices, 8 MB per media file, 100 sessions per day for everyone; when the daily limit is reached it stops with an error. Using it costs you nothing.

Your server.

Your computer connects to the server address you enter, run by your organization. It sends the same things as to the relay: session id, encrypted messages and media, sizes and timing, your IP address, plus the server key you were given. The server cannot read session content. Its retention and limits are set by whoever runs it.

• Test connection runs a checklist without starting a session: for This computer, your network addresses and whether the port is free (no traffic leaves the computer); for the relay and for a server, one health request, the protocol, the limits, and for a server the certificate and whether it accepts your server key. A failed line says what to do next.
• The first time an exercise uses the relay or a server, the Live tab repeats what is sent and asks you to continue. Test and Start stay off until you do. The answer is saved in the exercise’s folder.
• Your server needs its address (https), and the server key whoever runs it gave you. The key is stored encrypted on this computer, never in the exercise folder, and is entered again on each computer. A server with its own certificate shows a fingerprint after the first test: compare it with the one your IT team gave you and press Confirm this fingerprint. The app then accepts only that certificate and stops with “The server’s certificate changed” if it ever differs. This server has no TLS is for a reverse proxy or a trusted network and allows http only for this computer or a private address.
• Remembered servers (Settings > Live play) can be renamed, tested again or forgotten. Forgetting a server also deletes its stored key.

In the room: this computer

Your laptop serves the player page and relays the session’s encrypted messages to the devices on the room’s Wi-Fi. No internet, no account, no IT ticket. Nothing listens until you start a session, and nothing listens after you stop it or quit the app.

Start a session

1. Open a scenario and choose Facilitate.
2. In the side panel, open the Live tab.
3. Network address: the list shows this computer’s IPv4 addresses with the interface each one belongs to. The Wi-Fi address is marked recommended; pick another if the phones are on a different network (an Ethernet segment, for example). VPN and virtual adapters are listed last and never recommended. If the list is empty, the computer is not on a network; if it shows only a self-assigned address (169.254.x.x), the network did not hand out an address and phones will not reach it.
4. Connection security: keep HTTPS with a certificate made for this session unless you have a reason not to. Each phone shows one certificate warning the first time it opens the page; the fingerprint shown under the QR code lets a player compare. Plain HTTP shows no warning, but anyone on the same network can change the page players load and, through that page, read and impersonate everything in the session; the app asks you to confirm before starting on HTTP and shows a warning for as long as the session runs. Use it only on a network where you trust every device. The address list marks a public address (one that is not a local network address) with a warning and asks before starting on it: devices beyond the room could reach the session.
5. Attribution: By role (the HSEEP default) keeps roles and never names in the record. Named also records the display name each player typed.
6. Read the firewall note (below) and press Start session.

The status line shows the address and port, HTTPS or HTTP, and how many devices are connected; it updates as devices join and leave. The computer is kept awake while the session runs.

Join links and QR codes

Two links exist per session, each with its QR code:

• Players link: show it on the main screen. Every player scans it.
• Staff link: for controllers, evaluators and SimCell helpers only. It opens expected actions and evaluator material, so never show it on the main screen; use Show staff link and hand it over directly.

The key that decrypts the session travels only in the part of the link after #, which browsers never send to any server. Copy link puts the full link on the clipboard.

Switch address restarts the listener on another address with a new certificate and new QR codes; devices reconnect by scanning again.

Firewall prompts

The first time the app listens, your operating system asks:

• macOS: “Do you want the application Action Stations to accept incoming network connections?” Choose Allow. If you chose Deny, open System Settings → Network → Firewall → Options, find Action Stations and set it to “Allow incoming connections”, then start the session again. Unsigned builds may ask on every launch.
• Windows: “Windows Defender Firewall has blocked some features of this app.” Tick Private networks and choose Allow access. If the room’s Wi-Fi is set to Public, Windows blocks incoming connections regardless: Settings → Network & Internet → Wi-Fi → the network → Network profile → Private, or ask IT.
• Linux: most desktops ask nothing. With ufw enabled, allow the port shown in the status line (sudo ufw allow 8485/tcp).

When no device has connected a minute after the QR code went up, the Live tab shows these recovery steps again. The usual causes: the phones are on a different network (guest networks often keep devices apart; a phone hotspot from the laptop or the relay are the workarounds), the firewall prompt was denied, or the QR code shows an address this computer no longer has.

Certificate warnings per phone

• Android, Chrome: “Your connection is not private” → Advanced → Proceed to 192.168.x.x (unsafe). Certificate details shows the fingerprint to compare.
• iPhone, Safari: “This Connection Is Not Private” → Show Details → visit this website → Visit Website. Safari shows no fingerprint. Safari also refuses the page’s live connection on a certificate it has not trusted, so the page falls back to a fetch-based connection automatically; nothing to do.
• Desktop browsers: as Chrome on Android; Firefox has Advanced → Accept the Risk and Continue.

What is served, to whom

The listener is bound to the one address you chose, on port 8485 (or the next free port up to 8495, else one the system assigns; the QR code always carries the real one). It serves: the player page and its files, /v1/health (server kind, version, protocol, caps; nothing about the session), and the session endpoints, which need the join token from the invite (sent in a header or the WebSocket handshake, never in the address, so it cannot land in a log). Requests that name another host, or WebSocket connections opened by a page from another origin, are refused. Anything else is a 404. Every response carries a strict content security policy and no-store caching. The server makes no outbound connection. Session messages are ciphertext to the server; it stores them in memory for late joiners and drops them at the end. Each device is limited to 60 messages a minute and 8 MiB of uploads per session, an address to four devices, and uploads that never finish are dropped after two minutes; the session holds at most 512 MiB of media.

Logs

• scenarios/<scenario>/live/<session>/log.jsonl in the project folder: the session record (who joined by role, what happened), written by the app. It never contains client ids, join tokens, keys, IP addresses or, in a By role session, names. session.json beside it describes the session.
• userData/live/lan.log (rotated at 5 MB × 3): connection events with time, remote address, client id and close code; never a message.
• userData/live/sessions/<session>.json: the session’s keys, encrypted with the operating system’s keychain, deleted when the session ends.

Stop

Stop session sends “Session ended” to every device, closes the port and writes the end time into the session folder. Quitting the app does the same first.

Troubleshooting

Symptom	Check
“This computer is not on a network”	Join a Wi-Fi network or plug in Ethernet, then reopen the Live tab.
Phones cannot open the page	Same Wi-Fi? Firewall allowed (above)? Does the address in the QR code match the computer’s current one (use Switch address)?
The page opens but never connects	On Safari the fetch fallback should take over by itself. Elsewhere, the certificate warning must be accepted on the page first. Try reloading.
“A live session is already running”	One session per app. Stop it from the scenario where it runs, or quit and reopen the app.
Port 8485 is busy	The app moves to the next free port automatically; the status line and the QR code show it. Firewall rules written for 8485 need the new port.
“could not store the session keys” in the app log	The operating system keychain is unavailable (common on Linux without a keyring). The session runs; it cannot be resumed after a crash.

Remote and hybrid: the Action Stations relay

The relay is a small service the project runs on Cloudflare. It forwards encrypted messages between your app and the players’ browsers, keeps them only so a player who joins late or reconnects can catch up, and deletes them when you end the session or after 72 hours at the latest.

What the relay sees: session ids, device ids, connection times and IP addresses, the size and timing of messages, and opaque destinations. What it cannot see: any content: inject text or media, messages, votes, notes, names, or the keys. Its source is in this repository under relay/.

Limits, in plain numbers

Using it costs you nothing. Every session is capped so the shared relay stays available:

• 60 devices in a session.
• Messages up to 64 KiB; media files up to 8 MiB each (1 MiB for a player’s photo) and 64 MiB per session. The app tells you which injects are too large for the relay and offers to show them on the main screen instead.
• 30 messages a minute per participant (short bursts are fine); 7,500 stored messages kept for players who join late or reconnect, up to 24 MiB stored, and 15,000 row writes in all.
• 10 sessions a day from one address, and 100 a day across everyone who uses the relay (the day resets at 00:00 UTC).

If you see “The Action Stations relay has reached today’s limit”

The shared daily allowance is used up. Nothing is wrong with your exercise and nothing is billed to anyone. You can:

1. Switch the session to This computer if everyone is in the room, or to Your server if your organization runs one.
2. Try again after 00:00 UTC.

Other messages you may see: Session is full (60 devices): a device must leave before another can join. Too many messages; slow down: a device sent more than its share; it continues after a short pause.

Privacy

The relay never contacts your computer on its own, and the app never contacts the relay unless you chose it for a session. Cloudflare, like any internet host, sees the TLS connection and IP addresses. Players’ browsers load the player page from the relay; the app checks the page’s published hash when you press Test and warns if it differs from the one this version shipped with.

Your own server

For networks without internet or where no third party is acceptable, the same server runs on your hardware. Your IT team installs it with Docker, a systemd unit or a Windows startup task and gives you its address and a server key; see the install guide.

Decision-point votes

On your device, a Vote now bar appears under the header when the facilitator opens a vote for your seat. Open it, pick one option (the options are a radio group with large targets) and press Cast vote. You can change your vote with Change vote until it closes, unless the facilitator turned that off. If the facilitator asked for a reason, a box takes up to 280 characters; it is anonymous like the vote. When the vote closes you see the result, with your own choice marked, or a line saying the facilitator will show it on the main screen. If you were offline when it closed, the page says the vote closed before your ballot arrived and that it was not counted. A countdown, when there is one, is read out at 30 and 10 seconds. Evaluators, observers and players the vote is not for see “Vote in progress” and no ballot.

For the facilitator, in the Votes tab beside Live (a session must be running):

• Open a vote. Start from an MSEL row that has a decision, or write a new question with two to eight options (one per line). Choose who votes (everyone, or roles and teams), whether people may change their vote, whether to ask why, whether devices show the running tally (off by default: seeing the tally before voting changes votes), and a countdown. On a row with a decision, Open vote in the Inject panel opens it with one click. Only one vote is open at a time.
• Show on screen opens the presentation window on the vote: the question, a bar per option with its count and percent as text, “N of M voted” and the status. Close freezes the tally and sends the result to devices. Reopen is offered for two minutes after closing.
• Record as decision adds the result to the decision log on the vote’s row, so the hot wash and the AAR can use it without reading the session log.
• Decisions that fork the exercise (branching) open as votes from here too: the vote uses the decision’s own options, its anonymous or by-role mode and its voting roles, and the Decisions tab reads the tally from it when it closes the decision by its rule.

Anonymity and the group-size guard

• Anonymous (default). The session log has the final tally and one line per ballot with the option and the time: no device, no seat, no role. To let people change their vote, the app keeps a list of which device voted what in memory only; it is dropped two minutes after the vote closes (the reopen window) and is never written to disk. A changed ballot is a second line that names the option it replaced.
• By role shows the result split by role. Before it opens, the form warns when a role in scope has fewer devices than the group size; a role under that size is shown and logged as Other (so a principal and a deputy cannot be told apart from a larger group). The group size is 3 by default and never below 2. If the people folded into Other would be a single device, that row is left out of the split (their vote still counts in the totals).
• Reasons are logged as separate lines with the option and the text, never with who wrote them.
• A vote that is still open when the session ends is closed as ended early with the tally so far.

Messages with the SimCell

The SimCell assistant can draft these replies for you to approve, and a persona can phone a player. See the SimCell assistant guide.

On your device:

• Messages tab. Write to the SimCell to call the vendor, answer the reporter or ask for something. Enter sends; Shift+Enter starts a new line. Reply to SimCell on an inject quotes it above your message.
• Photos. Add up to three. Each is shrunk on your device to fit the connection and loses its location data before it is sent. Describe it in the box that appears (optional).
• Answers come from whoever the facilitator is playing (“Channel 5 newsroom”), with “played by SimCell” under them unless the facilitator turned it off. A ✓ means the controller has your message. If you are offline, text waits and goes when you are back; a message with a photo shows Not sent and Try again.
• You only see your own conversations (your role, your team, or a call to your device).

For the facilitator, in the Messages tab beside Live:

• Threads are listed by last activity with how long the oldest unanswered message has waited. Message a role, team or device starts one.
• Reply as picks who is speaking: the SimCell scripts’ roles, the senders in the MSEL, SimCell, Controller, or any name. The scripts for that persona appear under the thread; Insert puts a question or concession in the box without sending it.
• Mark handled clears the waiting time for a message that needs no answer. Star marks it for the AAR. Pin to hot wash records it in the session log for the hot wash. Players never see these marks.
• The log keeps each message with the role (never the name at attribution by role) and exercise time; the controller is always recorded as the sender of an answer.

The Room and the session log

The Room tab in Facilitate is the one place to see how a live session is going. It follows the session as it happens and also opens for a past one (View in the Live tab).

• Seats shows how many devices are connected in each seat, how many are Away (gone for more than a minute and not back) and how many were removed. A player seat nobody has joined is marked Empty.
• Released injects lists each inject you released with how many devices have it delivered, read and acted on, how long the median device took to read it, and what answered it.
• Unanswered injects lists a release that expects a response and has had none after 10 minutes. Flag after (minutes) changes that for this session; a row’s own window in the MSEL wins. The row also shows No response in the Facilitate timeline. It counts as answered when a targeted seat marks it acted on, when a player in a targeted seat sends a message after the release, or when you press Mark answered. Each newly unanswered inject is announced once by the screen reader’s status region.
• Messages, Votes, Hot wash and Evaluation give one line each. The line at the top shows connected devices, dropped frames by reason and the size of the log.

Log opens the newest 200 entries of the session log with a kind filter and a search box. Load earlier adds older entries. Star marks a message for the after-action report.

Past sessions

The Live tab lists the scenario’s earlier sessions with their length and counts. A session that was never ended (the app closed or the computer lost power) is marked Interrupted; Close as ended ends it at the time of its last entry. Resume reopens a session on this computer’s network on the same address and port, so the links already shared still work and devices rejoin by themselves. It needs the session keys the app stored in the operating system’s keychain; without them only Close as ended is offered. A session on the relay or your own server resumes the same way, as long as the server still holds it (a relay session expires after a few hours without the controller); if it does not, resume fails with the server’s answer and Close as ended remains. What was in memory is not rebuilt: messages, open votes, hot wash items and delivery receipts start again from empty, devices that were connected show as gone until they rejoin, and a vote that was open is recorded as interrupted. The log keeps everything that was written before the restart.

• Export JSON and Export CSV write the log to a file you choose. The CSV opens in a spreadsheet. Names are left out unless the session was run with display names and you tick Include display names.
• Delete session data removes the session’s log, attachments and staged media from the project folder. It cannot be undone. The facilitator notes and the evaluation for the scenario are not touched.

The log is a plain file in the project folder (scenarios/<id>/live/<sessionId>/log.jsonl). It holds the exercise content in the clear, like the rest of the project; protect the folder as you protect the scenario.

Removing a device and replacing the keys

While a session runs, the Live tab lists the devices by seat. Remove disconnects one device and moves everyone else to a new key, so the removed device cannot read anything sent afterwards or join again with its link. Replace keys does the same with no one removed: use it when a join link was shared too widely. Links you shared before stop working for new devices, devices already connected carry on, and the QR codes on the Live tab show the new links. Both are recorded in the log.

Calls, rosters and exports

• Ring as a call. For a phone, radio or voicemail inject, Ring players as a call in the Devices section rings the devices it is for with the inject’s words, from the row’s sender. The players’ answers go to the SimCell as for any call.
• Co-controllers. In a regional exercise you host, the Live tab lists the partner organizations that may release their own rows and roles, and sends that list to every device (again on Send roster to devices, after you pin a partner’s key).
• Export. Tick Live session logs (JSON) on the Export page to write one file per live session into live-sessions/, and into facilitator/live-sessions/ of the ZIP. Display names are left out and nothing goes to players/.

Showing a decision on the screen

Show on screen beside a branch decision opens it in the presentation window: the question and the options while the room decides, then the chosen option and how it was chosen (“Chosen by majority: 7 of 11”). The screen follows the decision when you close it.

Map on devices

With a session running, tick Map on devices on the Facilitate Map tab (see Maps). Each phone shows the places of the messages that reached its seat and nothing else; the frame is addressed to that device alone.

What the Facilitate page sends to devices

The exercise clock on every device follows the clock in Facilitate: starting, pausing, moving it or changing its rate is sent once. The Tracker tab reads the live session too: a release that no device has opened after three minutes is flagged, a message or an acted-on receipt from a targeted seat, or a closed vote on the row, counts as the answer, and promises in device messages are offered as suggestions like those from notes. Prompt the table gains Send to evaluator devices during a session; players never get a tracker notice. Branch decisions and proposal verdicts are written to the session log.

Evaluators

Evaluators join with the staff link (Live tab, Show staff link) and choose the Evaluator seat. A player’s link cannot open it, and a player’s device never receives the evaluators’ material.

On the evaluator’s device. Open More > Evaluate. The form lists the critical tasks from the exercise’s Exercise Evaluation Guides, grouped by Core Capability, each with the plan section it comes from, the role expected to do it, the timing and the inject rows to watch. If expected actions are shown (the default), each inject’s own expected action is also listed. Rate each task Met, Partial, Not met or Not observed, add a note, check the exercise time (filled from the clock) and the linked inject. Write about roles and procedures, never names.

• Watch for appears when an inject is released and lists the tasks it should trigger, until you rate them or dismiss the entry.
• My watch list shows the roles and capabilities the facilitator gave you; All tasks, Unrated and Due now change the view.
• Add an observation not tied to a task records something the guides did not expect.
• A line at the bottom says how many observations are waiting to send.

Offline. Keep rating with no signal. Observations are kept on the device and sent, once each and in order, when it reconnects. Editing a rating sends a new revision; the controller keeps the latest and logs every one.

Fixing a note. Under Other observations, Edit reopens a general observation you saved; saving sends it as a new revision of the same observation, so the controller keeps one entry. Task ratings are changed the same way as before, by rating again.

After the exercise. The page shows your observations, read-only. Copy what you need: a later visit to the link does not keep them. Without a device, use the printed EEG packet and type the results into the Evaluation tab afterwards.

For the facilitator. In the Live tab, Evaluators lists who has joined, lets you set each one’s watch list (empty means everything) and turns Show expected actions to evaluators on or off. In the Facilitate Evaluation tab, Live observations shows a coverage matrix (task by evaluator), the latest observations with filters, Ask to watch (a notice to one evaluator’s device) and every recorded observation with its source. Live observations are saved in scenarios/<id>/evaluation.json as source: 'live', labelled “Evaluator 1”, “Evaluator 2” in join order.

Hot wash from devices

• Open it. In the Hot wash board tab (or the On devices section of the Hot wash tab) press Open on devices. Every device gets a notice, and More, Hot wash lets players and evaluators add an item: a strength, an improvement, or an answer to one of the scenario’s hot wash questions, optionally about an inject. Observers can read the board but not post.
• Anonymity. The composer says what is shown. By default the post carries the poster’s role (and, in a named session, the facilitator also sees the name). Post without my role removes it: no role or name is shown, logged or exported for that item. One device’s items are counted by an anonymous reference, never identified.
• Moderation. Items show on every device at once. Tick Review before showing to hold them until you press Accept. Hide removes an item from devices and the board without deleting it from the log; Restore brings it back. A player may withdraw their own item for two minutes.
• Agree. Players tap the ▲ count on another item once. The board sorts by count.
• Group and promote. Tick items (keyboard or touch), then Group selected, Name group, Promote. A promoted group is one finding (“name (3 contributions)”) in the Hot wash tab under From devices and in the AAR/IP draft. Edit text fixes a typo; the original stays in the log. Tag links items to an objective, capability or inject. A promoted item is locked until you Unpromote it.
• Projector. Show on screen shows the promoted items only, large, with no roles, names or counts.
• Close. Close on devices makes the board read-only.
• Past sessions. Hot wash on a row of the Past sessions list shows that session’s board, rebuilt from its log, read only. Your own items keep their “yours” mark if you reload the page.

Surveys on devices

• Send. On a survey’s Deliver dialog (Surveys page) or in the Live tab under Surveys on devices, press Send to devices. Everyone in the session gets a banner, Answer the survey, and the survey is under More, Surveys. Each row shows how many devices have answered, not who.
• Answer. Scales are rows of numbers 1 to 5 (the ends are named in the question), choices are radio buttons or check boxes, free text is a box. Required questions are checked before sending. Answers go out at once or when the connection returns, and can be changed until the survey closes.
• Anonymous. Nothing an answer carries, and nothing the app stores with it, says which person, seat or device sent it. Results appear on the survey’s Results tab with the same minimum of responses as paper forms.
• After a crash. Resuming a session, or closing it as ended, puts back any survey answer that reached the log but not the results file.
• After ENDEX. Once you deliver the ENDEX row, a short “After the exercise” list shows whether the hot wash and participant feedback are done.
• Close. Close survey stops answers and tells devices; a closed survey stays readable. Send again opens a new round whose answers are added to the same results.
• After the exercise, on phones. With no session running, Start a survey session and send opens a session on this computer for surveys only. Show the join code (Join with a phone); participants scan it and see surveys and nothing else. End survey session stops the listener. Your computer and the phones must be on the same network, as for live play.

Partners and SimCell helpers

Partner organizations. In a regional exercise on the relay or your own server, the Live tab lists each partner with what it may send. Press Invite next to a partner and send them the invite text over a channel you trust; it is shown once and not saved. The partner pastes it under “Join another organization’s exercise” on their own Live tab, sees the rows they own, and releases them to their own roles. They see how many of their roles have read each inject; you see their releases in your log. A partner cannot end the session, move the clock or release another organization’s rows.

SimCell helper devices. Turn on “Let SimCell helper devices approve replies” on the Live tab. A colleague opens the staff link on a phone, takes the SimCell helper seat, and gets each drafted reply to send as written, change, or discard. You can still send or discard from this computer. Turn it off and no draft leaves your computer.

Staff seats and partner invites. A partner invite holds the staff key. When you make one, new evaluator and SimCell helper seats close, and helper decisions are ignored, until you tick “Open evaluator and SimCell helper seats again”. Devices that were already seated keep their seats. Share an invite only with the partner it is for.