Offline data is a separate capability

The PWA kit lets an installed worker answer failed navigations with a public offline page. It does not make server-rendered screens usable offline.

An offline app needs a local model, durable pending operations, and a server protocol that can reconcile them. Extract those mechanisms from an existing application only after a second, different application can adopt them. Eleven and Ocho share ancestry, so their duplicate code alone does not prove a general data or conflict model.

Before calling an offline kit reusable, prove these behaviours:

• Pending operations survive app/worker termination and restart.
• Retrying after a lost response cannot duplicate the server operation.
• Account switching and sign-out cannot reveal or submit another account's data.
• Local schema upgrades and server protocol changes preserve queued work.
• Conflicts, deletes and revoked access have explicit, tested outcomes.
• Synchronisation resumes when the app opens; background execution is optional.

Encrypted offline storage adds a separate key lifecycle. Define what can be read while locked, how keys are recovered or revoked, how account removal clears local material, and what notifications can reveal. Ciphertext beside an accessible decryption key is not equivalent to a locked vault.

Reuse Rastrillo's crypto/keyring contracts where compatible and test bytes across implementations. Do not copy Eleven's thread-key or message policy into a general storage package. Keep browser and native storage adapters separate even when their protocol and test vectors are shared.

No offline sync engine or encrypted vault is shipped by this first kit.