"The save happens on your phone. The network is a courier you can fire and rehire — it is never the thing that decides whether your thought survives."
The Save Is Local
Here is the invariant that makes field capture trustworthy: a breadcrumb commits locally, on the device, before any network sync is attempted. The moment you tap save, the thought is durable in a local outbox — and only then does the engine try to push it to Office. This means a dead hotel network, airplane mode, or an unreachable Pippa can never cost you a memory. Neither the Office connection nor Pippa is ever on the critical save path. The network's job is to deliver what is already safely saved, not to be the thing that saves it.
The Outbox State Machine
Each captured breadcrumb moves through an explicit set of states: LOCAL_ONLY, QUEUED, SYNCING, SYNCED, and FAILED_NEEDS_ATTENTION. The crucial rule is that the local payload is never deleted before an idempotent server acknowledgement. A crumb that failed to sync does not vanish and does not silently retry into a duplicate — it sits in a visible failed state until it is resolved. And because the stream always surfaces an unsynced count, you can see at a glance that your PWA storage is a staging area, not the final archive. Nothing is quietly dropped; nothing is quietly duplicated.
Why Idempotency Matters in the Field
Field networks are not just slow — they are ambiguous. A request goes out, the connection dies, and you genuinely do not know whether the server received it. The naive fix, blind retry, produces duplicates: two copies of the same crumb because the first one actually landed. Waystone gives each crumb a stable device-generated identity, so a retry is idempotent — the server recognizes it as the same crumb and does not create a second. This is the difference between an outbox that heals after a bad connection and one that quietly multiplies your memories every time the signal drops.