An airplane should not make a good thought disappear. After this iPhone build has opened online once, a returning full member can reopen To-Do without a connection and keep capturing what matters.
Two safe offline paths
- When the cached Miracle shell is available, the ordinary To-Do view opens under the previously verified account and keeps the same Inbox, Today, Priority, and In Progress workflow.
- If the remote shell cannot load at all, the app opens a compact bundled Offline Inbox where a task can be saved, edited, moved between those four destinations, or deleted.
- Every capture is written on the iPhone before the interface reports success, and it survives a force-quit and relaunch.
- If iOS stops the app before its larger cache finishes, the next offline launch repairs that cache from the smaller write-ahead record before showing the list.
- Detecting a connection does not interrupt unfinished text. The member chooses when to reconnect.
Reconnect without duplicates
- Bundled captures retain one immutable task ID from the iPhone through the normal task model.
- The ordinary local cache and synchronous write-ahead journal are durable before the bundled draft is acknowledged.
- A recovery receipt protects the narrow crash window between import and acknowledgement, so retrying cannot recreate a task that was already imported and later deleted.
- Once authenticated, the standard Sync v3 queue delivers airplane work under the same ordering, retry, conflict, and recovery rules as every other To-Do edit.
Private by construction
- Offline access is available only after an eligible account has authenticated online in this build.
- The immutable account ID is held in device-only iOS Keychain storage. Cached content remains hidden unless that ID exactly matches the local state's owner.
- Fallback drafts use one atomically written file per capture with iOS complete file protection and remain bound to the same immutable account.
- If an older capture cannot be read, its bytes remain protected for recovery while healthy captures continue working.
- A different, signed-out, expired, or ineligible account cannot inherit the previous member's offline screen.
- Sign-out revokes offline access. If server sign-out fails, Miracle restores the verified device identity instead of stranding unsynced work.