Designing CloudKit Sync in a Rork Max Native App — Handling Conflicts and Deletes

Detect Conflicts with the changeTag

When two devices edit the same record separately, whichever saves last silently overwrites the earlier change. The key to preventing this is the recordChangeTag each CKRecord carries. CloudKit returns a serverRecordChanged error when the server's tag and the sender's tag disagree. The point is not to swallow this error but to route it into resolution logic.

func saveWithConflictResolution(_ favorite: FavoriteRecord) async throws {
    let db = CKContainer.default().privateCloudDatabase
    do {
        let record = CKRecord(recordType: "Favorite", recordID: favorite.id)
        record["title"] = favorite.title
        record["updatedAt"] = favorite.updatedAt
        _ = try await db.save(record)
    } catch let error as CKError where error.code == .serverRecordChanged {
        // Server is newer. Compare both updatedAt values to pick a winner.
        guard let server = error.serverRecord,
              let client = error.clientRecord else { throw error }
        let serverDate = server["updatedAt"] as? Date ?? .distantPast
        let clientDate = client["updatedAt"] as? Date ?? .distantPast
        if clientDate > serverDate {
            server["title"] = client["title"]
            server["updatedAt"] = clientDate
            _ = try await db.save(server)  // re-save the resolved record
        }
        // If the server is newer, do nothing (treat server as truth)
    }
}

Choosing "last-write-wins" works here precisely because a favorite is a simple value. If you need character-level merging like a collaboratively edited document, this strategy is not enough — you need field-level diffs or version vectors. Deciding how strict to be, based on the nature of your data, is the designer's job.

Stop "Zombie Resurrection" with Tombstones

Deletion was the trickiest. You delete a record on iPad, but an iPhone that has not synced yet still holds it locally. The next time the iPhone syncs, it re-uploads its "live" local record to the server, and the item you deleted reappears on every device. That is zombie resurrection.

The fix is to treat deletion not as physical removal but as recording a delete flag (a tombstone).

// Instead of physically deleting, mark as deleted and sync it
func softDelete(_ id: CKRecord.ID) async throws {
    let db = CKContainer.default().privateCloudDatabase
    let record = try await db.record(for: id)
    record["isDeleted"] = true
    record["updatedAt"] = Date()
    _ = try await db.save(record)
}

On sync, each device removes records with isDeleted == true from the UI. Keep the tombstone for a set period (I chose 30 days), then physically delete it with a server-side batch. Thirty days is my estimate for every device to sync at least once and pick up the flag. Too short, and resurrection happens on a device that was offline for a long stretch.

Fetch Only the Diff with a Change Token

Fetching every record each time wastes both bandwidth and time. Save CloudKit's CKServerChangeToken and fetch only the changes since last time with CKFetchRecordZoneChangesOperation.

let config = CKFetchRecordZoneChangesOperation.ZoneConfiguration()
config.previousServerChangeToken = savedToken  // last token
let op = CKFetchRecordZoneChangesOperation(
    recordZoneIDs: [zoneID],
    configurationsByRecordZoneID: [zoneID: config]
)

Persisting this token locally per device is essential. Lose it and you fall back to fetching everything, which makes the first sync visibly slow for a user with thousands of records. I accidentally cleared it early on and was pulling the full set on every sync, producing a multi-second wait for data-heavy users.

What to Try Before Shipping

Once CloudKit is in, edit the same item separately on two real devices in airplane mode, then bring both back online. Whether conflict resolution and delete propagation behave as intended — that is the most effective check. Sync is finished not when it "saves," but when two devices agree without contradiction. It is unglamorous, but passing it quietly changes how much users trust the app.