A black screen is a bug you cannot explain to a customer. Offline playback is not a fallback mode bolted on afterwards; it is the normal state of a screen, and the network is the thing that occasionally shows up.
The offline mandate
Screens live where the network is least reliable: a basement food court, a delivery bay, a shopfront on a shared line. Any design that assumes a connection will fail exactly when somebody is looking at the screen.
The rule we build against is simple: everything a screen needs in order to keep playing is already on the device before the connection drops. If a playlist cannot survive a night offline, it was never really published.
What the screen keeps locally
Media is cached in the player's own storage and keyed by checksum. A download lands in a temporary file, is verified against the checksum the workspace published, and only then is moved into place — playback never points at a half-written file.
Alongside the media, the player keeps the schedule it last applied and the manifest that describes it, so a box that boots with no network can still work out what should be on screen right now.
Coming back online
Reconnecting is not a reset. The screen compares the manifest it holds with the one the workspace is publishing, downloads only what is missing or changed, and keeps playing throughout.
The first thing it fetches is whatever is on screen next, not whatever happens to be first in the playlist: a large video nobody will see for two hours must not hold up the schedule that starts in a minute.