# Offline first: a cockpit with no network

> **Short version:** Cursors does not require a network to create a Self, inspect bundled guides, use the local curve, save local chat, or prepare signed work. It does require another reachable body or store to make that work survive loss of this browser profile or device.

## What “offline” means here

Offline is a condition, not an error mode. The cockpit distinguishes these cases instead of showing one vague disconnected lamp:

| condition | what can work | what cannot be claimed |
|---|---|---|
| page already loaded, network disappears | bundled guides, Open MCT objects, local encrypted identity, local curve, same-origin mailbox drafts | a fresh deployment can be fetched; another device has the data |
| saved page or future installed body | the saved release plus local state that body deliberately retained | that browser storage is a durable backup |
| no network and no saved release | only an independent resurrection carrier—file, QR capsule, removable media, or another local body—can start recovery | curso.rs can help while unreachable |

The current web cockpit is a network-delivered application. Once loaded, many controls are device-local, but it is not yet a complete installable offline body. A future signed release cache must verify a release head and expose rollback clearly before the UI calls itself recoverable.

## Things you can safely do now

1. Open **Pilot / Mailbox**.
2. Create a passphrase- or passkey-PRF-protected Ed25519 Self.
3. Export the encrypted identity backup. The export does not contain its passphrase.
4. Use local mailbox conversations and the address book. They are scoped to this deployment path and browser origin.
5. Inspect the constellation, cursor model, guides, and source metadata already in memory.

The unlocked signing key lives only in page memory. Locking the Self or leaving the page removes that session key. LocalStorage is convenience state, not a backup system.

## What the cockpit should say

- **LOCAL / AVAILABLE** means the operation stays in this body.
- **UNREACHABLE** means a configured endpoint failed.
- **UNCONFIGURED** means no endpoint was chosen.
- **UNKNOWN** means the observer cannot prove a condition.
- **STALE** means retained evidence is older than its declared freshness window.

Zero peers is not the same as no network. No native observer is not evidence that no LAN peers exist.

## Leaving the device

A cursor can leave only through an explicit carrier: an exported encrypted file, an invited LAN/native fabric, a WebRTC session, an admitted curso.rs mailbox, a signed swarm, or a resurrection capsule naming independent stores. Every outward step needs an inspectable destination and authority boundary.

Continue with [LAN without Internet](lan-without-internet.md), [Resurrection Capsules](resurrection-capsules.md), and [Local Identity Vault](local-identity-vault.md).


## On iPhone or without WebRTC

Use [Cursors on iPhone and iPad](ios-safari.md) for local notes, verified published HTTPS parts, HTTPS-only mode, and returning after the phone sleeps. This does not enable a paused cloud service, guarantee cold offline boot, or make cloud notes end-to-end encrypted.