Wave 5 — reach: installable, offline-capable, shareable, printable

[Randolin]

The last scheduled wave of docs/feature-plan.md. D2 ships in full; D1 ships in half, and the missing half is a product decision rather than an unfinished task — details below.

D2 · Sharing and printing

The share sheet where there is one, so a phrase reaches someone as a message rather than a clipboard entry they still have to paste somewhere. Copy stays either way — sharing is an upgrade on it, never a replacement — and a cancelled sheet counts as done, since falling through to a surprise clipboard write would undo a deliberate choice.

The compare view now prints: the picker hides (a screen affordance is a dead form on paper), the panels are the document. A printout is the one form of a comparison that doesn't need both people holding a phone.

D1 · The PWA, and where it stops

Shipped: the app installs, and its shell survives losing the network.

The service worker caches this origin's static files and nothing else. The profile server is a different origin and every request to it falls through untouched, so no ciphertext, locator or phrase is ever written — which is why logging out has nothing to clear. Config is network-first, so an app update can always move the server address. Nothing is precached: filenames are content-hashed, so the first visit caches exactly what this build used and there's no manifest to keep in step. No new dependency.

The About page's honest ledger now says all of this, and the e2e proves both halves: the shell comes back offline, and the cache contains no foreign origin.

Not shipped, deliberately: "the survey fillable offline".

DraftStore states the invariant it would break, in its own words — answers are in memory only, "so a shared computer holds no plaintext answers after the tab closes." Filling the survey offline means writing plaintext intimate answers to disk, on a possibly shared device, for an audience that partly chose this app because it doesn't do that. That's a trade for whoever owns the threat model, not a caching detail to slip in behind a service worker.

The plan now records it as an open decision with two honest shapes: an explicit per-device opt-in, mirroring how the edit phrase is already remembered only on request; or a draft encrypted under an in-memory key, which protects a closed tab but not a running one. Happy to build either once the call is made.

One e2e fix the service worker forced

The menagerie-seen step waited on networkidle as a proxy for the baseline write landing. A service worker serves cached assets without touching the network, so idle can now arrive before the PUT is even sent — and the step failed. It now waits for that response directly, which is the signal it always meant. The plan predicted this class of interaction ("the suite will need to account for it").

Verification

Full ladder green: format:check, both typechecks, all four unit suites, build, and e2e — including the new offline scenario.

---

Generated by Claude Code