Offline, integrity and fallback

Startup and recovery

Compiled baseline content is synchronous. Native platforms then load an application-support cache; Web uses IndexedDB. A compatible cached generation is reverified before activation. The optional single startup check follows cache loading. A closed application does not poll.

Native caches use immutable hash-named blobs, an OS lock and two recoverable metadata slots. IndexedDB keeps blob references and revision guards in one transaction, including across tabs. Active and previous usable generations are retained. A failed write, interrupted download or invalid cache leaves the application baseline available. Storage denial or quota exhaustion is reported with persisted: false; memory updates may still work. The native budget includes staging space. An update that would exceed the budget while preserving the active and previous generations stays in memory; increase the configured budget when those three generations cannot coexist. Unreferenced interrupted staging files are reclaimed before a later commit. No verified generation is discarded to make a partial update fit.

A Web application must itself be loaded before the SDK can run. Translation persistence does not install a service worker or make a first-ever offline visit load the application’s HTML. Offline app-shell behavior belongs to the hosting application’s deployment.

Verification and failover

Delivery protocol 1 uses signed JOSE Ed25519 catalogs/manifests and SHA-256 artifact hashes. The SDK checks scope, protocol, byte counts, inventory, compatibility and explicit fallback integrity before exposing content. Unknown trust-key IDs are rejected. HTTP redirects are not followed and Web requests omit cookies. HTTPS is mandatory outside explicit development.

The durable scope includes project, distribution, channel and delivery origins. Rotating a read key does not reset that scope or its revision floor. A lower verified catalog revision, or a different catalog at the same revision, is rejected. Legitimate rollback advances the channel revision even when it selects an older release.

The second address is attempted after failure or a stale first node. All files still belong to the selected immutable release; content from two release IDs is never combined. ETag/304 is used only with the corresponding verified catalog. Retries stop when the bounded cycle ends.

Missing and fallback

The release’s explicit locale chain determines content fallback. Regional names never imply fr-CA → fr. The formatter uses the locale that supplied the value. null means Missing. If remote content cannot resolve a key, the application baseline is tried, then an explicit defaultValue, then the key. resolve() reports the source and resolved locale.

ICU is prepared before activation and supports named arguments, select, cardinal/ordinal plural, integer offsets/exact matches, nesting, apostrophe escaping and # in plural submessages. Nested select submessages follow the server’s FormatJS parsing behavior. CLDR 48.2.1 supplies plural predicates. Date/number format expressions and rich markup are outside OTA scope. Argument names and types must match; non-finite numbers are rejected.

Trust rotation and revocation

Ship the next public verification key in an application update before switching server signing. Retain the previous verification key while supported installations/cache generations need it. Do not learn a new trust anchor from an untrusted delivery response. Read keys identify public application scope and cannot be treated as confidential inside a distributed app.

Revocation blocks new downloads once applied to each delivery node. It cannot erase previously cached translations from offline devices. Report partial revocation accurately in the panel.

Operational diagnostics

Monitoring and error references explains safe request references, private logs/traces and failure recovery. Optional SDK diagnostics remain off unless the application explicitly configures a write-only diagnostic key. A reporting outage does not change verified translations or the publication commit boundary.