Local data includes metadata (timestamp, source)
Why it matters
Stored records without timestamps or source markers make it impossible for the app to determine whether cached data is fresh, which copy won a conflict, or whether a local edit has been synced. ISO 25010:2011 reliability.recoverability requires that the system can determine the state of data after a failure — impossible without creation and modification timestamps. Without a source marker, merge logic cannot distinguish local-only edits from server-authoritative records. This undermines every higher-order pattern in this bundle: cache invalidation, conflict resolution, and sync-on-reconnect all require metadata to make correct decisions.
Severity rationale
Low because missing metadata degrades offline correctness and merge reliability rather than enabling direct exploitation, but it undermines every other sync-safety pattern.
Remediation
Add createdAt, updatedAt, source, and version fields to every data model written to local storage. Populate them at the point of save, not at the point of display.
interface StoredRecord {
id: string;
// ... domain fields ...
createdAt: number; // Unix ms
updatedAt: number; // Unix ms
source: 'local' | 'remote'; // origin of last write
version: number; // schema version for migrations
}
export async function saveRecord(
record: Omit<StoredRecord, 'createdAt' | 'updatedAt' | 'source' | 'version'>
) {
const now = Date.now();
const stored: StoredRecord = { ...record, createdAt: now, updatedAt: now, source: 'local', version: 1 };
await AsyncStorage.setItem(`record_${record.id}`, JSON.stringify(stored));
}
export async function updateRecord(id: string, patch: Partial<StoredRecord>) {
const existing = await loadRecord(id);
if (!existing) return;
await AsyncStorage.setItem(
`record_${id}`,
JSON.stringify({ ...existing, ...patch, updatedAt: Date.now() })
);
}
Review all existing AsyncStorage.setItem call sites and add the four metadata fields to any schema that stores mutable domain data.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Mobile Offline & Storage Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · reliability.recoverability — Recoverability
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mobile-offline-storage·automated