how does the wallet lookup Ring member offsets without downloading at least the one time addresses from the daemon? does it use something like bloom filter to anonymize the process.

It asks for the one time addresses. No.

so by tracking which addresses the wallet got from the daemon, i can eliminate those from the rings inside the transactions generated by the wallet

Maybe. It'd help if you were clear.

so lets say NSA starts recording all communication between wallets and daemons. it sees the wallets get one time addresses K1, K2, ... from the daemon over the internet. NSA can now safely assuming that the in the transactions generated by said wallet, any mention of K1, K2... can be thought of as decoy members in the ring.

When making a tx, the wallet also requests the real output's key (for just this reason).

i didnt know!

thanks

what if real output's key was never in the blockchain

Then the daemon would return an error I think.

hmm ok

monero doesn't have a UTXO correct? as long as key image doesn't show up twice there is no double spend. so instead of UTXO i am guessing monero keeps a set of key images to check every new key image against.

Right.