ICloud Storage
iCloud Drive transport: plain files under <ubiquity container>/<folder>/, OUTSIDE Documents/, so they stay private to the app and invisible in Files. Writes land locally through NSFileCoordinator and the iCloud daemon uploads on its own. Reads force a download and wait with a bounded poll (a not-yet-downloaded file is never coordinated directly: that blocks).
Requires the iCloud Documents capability and a ubiquity container in the app's entitlements (see docs/setup-ios.md). containerIdentifier null means the first container listed there.
Functions
Cheap. Never touches the network.
Downloads into toLocalPath, replacing it. Throws CloudError.NotFound when absent.
Apple's documented way to compare the token across launches is to ARCHIVE it. Its description may carry a per-process pointer, which would look like a new account on every start and force a full re-upload.