android: library covers load through Coil, keyed by cover_key

Comics, music and PDF cards name their cover as a DocumentCover; one Fetcher
reads it through the FFI (MuPDF renders a PDF's first page at the requested
size) and a Keyer caches it under the lib's cover_key, registered app-wide by
a new SynchronicityApplication. The per-screen thumbnail maps and decode loops
are gone, and a cover that changes through sync is no longer held stale for as
long as the screen is open.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WsxkM2ja42H2h5BPRexf2r

AGENTS.md

@@ -19,7 +19,10 @@ between arbitrary sets of nodes.
 # Project Status
 Experimental — no backwards-compatibility constraints. Breaking changes to
 serialization formats, database schemas, wire protocols, key derivation
-salts, and CLI interfaces are all acceptable.
+salts, and CLI interfaces are all acceptable. That includes not writing
+migrations: when a schema changes, an existing store is manually deleted and
+recreated, not converted in place, so no code rewrites old rows on open or
+keeps a reader for a retired column, table, or artifact kind.
 
 # Design Principles
 
@@ -46,11 +49,16 @@ finished, whatever else it does.
     chosen; a save that silently wins the conflict is the same bug wearing a
     different hat.
   - Worked examples, one per modality: `rust/gui-app/src/agents/notes/mod.rs`
-    (`watch_open_note`/`render_incoming_body_banner`),
+    (`check_open_note`/`render_incoming_body_banner`),
     `rust/tui-app/src/notes_screen.rs` (`on_documents_changed`, and the editor's
-    `:e`), and Android's `notes/NotesScreen.kt` (`IncomingBody.alertFor`, whose
-    doc comment is where the rule for telling *their* write from *ours* is
-    written down).
+    `:e`), and on Android `ui/IncomingBody.kt`, whose doc comment is where the
+    rule for telling *their* write from *ours* is written down.
+  - The two shared pieces to reach for rather than rebuild: the desktop's
+    `components::sync_guarded::SyncGuarded<T>` (ADR 0031) and Android's
+    `ui/IncomingBody` plus `ui/IncomingBodyStrip`, whose words come from
+    `copy::incoming_change::Subject` — a new subject is a variant there, not a
+    sentence on a screen. `agents/clippings` is the shortest end-to-end
+    reading of the whole shape on both.
 - **Absence is not an error.** A document whose
   content lives on another node is a state to render, not a failure and not a
   blank. See `docs/data-model.md` and ADR 0030 §4: offering an empty buffer for
@@ -65,7 +73,7 @@ finished, whatever else it does.
   - This holds for lists and collections on the form as much as for its plain
     fields, however the store happens to keep them. "Each row is its own
     artifact, so there's nothing to batch behind Save" is a fact about storage,
-    not a licence to write one — it makes Save mean two different things on one
+    not a license to write one — it makes Save mean two different things on one
     form, and it leaves the user unable to back out of a removal. Stage the
     edit and diff it against what is persisted when Save runs; the Humans
     screen's `diff_staged`/`diffStaged` is the shape.
@@ -73,11 +81,19 @@ finished, whatever else it does.
     they should be one code path. Watch for state that lives outside the
     screen's own struct — the desktop's text fields are `TextInput` entities,
     so a Cancel that only dropped the staged collections would leave a
-    cancelled rename on screen.
+    canceled rename on screen.
   - Not everything on a screen is part of its form. A thing that is its own
     document — Humans' interactions, shared with their other attendees — is
     written when the user says to write it, and lives outside the mode. The
     test is whether it is a *field of this record* or a record of its own.
+  - A preferences screen is not a record. Settings is a set of independent
+    choices — a theme, a zoom level, a timezone, a sync policy — each
+    meaningful on its own, and some only judgeable once seen applied. So a
+    control there applies the moment it is touched, the way every platform's
+    settings do, and a free-text field (a node name, a credential) commits on
+    its own Save or Enter rather than per keystroke. The test is whether the
+    values describe one thing the user would want to back out of together, or
+    are separate choices that only share a screen.
   - Worked examples: `rust/gui-app/src/agents/human.rs` (`DetailMode`,
     `reload_detail`, `save_current`) and Android's `HumanDetailScreen.kt`.
 - **The instant-feedback invariant**: anything that might not complete promptly
@@ -92,6 +108,28 @@ finished, whatever else it does.
   executor. Any lib function that reaches the network should be `async` rather
   than taking a `tokio::runtime::Handle` to block on. This is not per-agent:
   it holds for every agent that opens something living on another node.
+- **A result knows what it was for.** Anything a screen loads, saves or plays
+  in the background can finish after the user has moved on — another note
+  selected, the document closed, a different track started — and it must not
+  land on whatever is selected *now*.
+  - **A buffer carries the id of the record it belongs to.** A save takes its
+    destination and its text from the same value, never the destination from a
+    separate "selected" field. A stale apply can then at worst show the wrong
+    text for a moment; it can never write one record's text into another, which
+    then syncs everywhere. That is the bug Notes' `OpenNote` closed: a slow load
+    of note A installed A's body under B's title, and the next keystroke
+    autosaved it into B.
+  - **A load applied into a selection is held, not detached.** Keep its `Task`
+    in a field (`_load_task`): assigning the next one drops the old, and gpui
+    cancels a dropped `Task`, so the latest selection wins by construction
+    rather than by a "still selected?" check each async step has to remember.
+    Compose gets the same from `LaunchedEffect(key)`, which cancels the previous
+    coroutine when the key changes.
+  - Where the work can't be canceled because it has already handed something
+    off, check a generation at the point it applies — `player_controls`'
+    `play_seq`, compared under the audio lock. A result applied by id looks its
+    target up by that id (`detail_view`'s `detail_for`) rather than writing
+    into whatever is open.
 
 # Build Commands
 
@@ -137,11 +175,40 @@ developers build.
   carries its full reasoning and its escape hatch.
 
 # Code Style
+- Use American spelling in user-facing copy and documentation (color, not
+  colour; behavior, not behaviour; canceled, not cancelled; catalog, not
+  catalogue) — consistently, throughout the codebase. Leave alone any spelling
+  that comes from outside the project: a fixed external API/library name (e.g.
+  Kotlin's `kotlinx.coroutines.CancellationException`/`NonCancellable`,
+  Compose Material3's `labelLarge`), a URL, or a third-party wordlist
+  (`rust/lib/src/ensemble/eff_large_wordlist.txt`) — those aren't ours to
+  respell.
 - Errors: Use typed errors with meaningful messages. In rust, prefer `thiserror`. Avoid using .unwrap() or .expect() in non-test code, and fix uses of these or other panicking functions when you encounter them.
 - the justfile codifies recipes that run standard Rust and Kotlin formatters (just fmt-kotlin, just fmt-rust). Run these tools to keep code formatted on every commit.
 - don't generate code  that has fully-qualified type names (e.g. `documents::Artifacts::new()`); instead prefer to `use documents::Artifacts`, `Artifacts::new()`
 - GUI frameworks (GPUI or Jetpack Compose): Prefer to create components built out of functional subcomponents with meaningful names, instead of long components with no internal structure. Prefer to define named constants instead of using the same color, spacing, etc. values in-situ. Don't define default values for properties unless necessary. Prefer to create text elements that have copy-able text;
 - When displaying hex-encoded hashes or UUIDs, use standard UI components (depending on modality) which display a truncated hash but make the full hash available if the user requests it.
+- **A truncation of human-readable text cuts from the middle, never the end.**
+  What tells two long strings apart is as often at the end as at the start —
+  `Quarterly report - draft` against `- final`, an episode number, a file
+  extension — and an end ellipsis drops exactly that.
+  - A cut made by character count is `copy::elide_middle`. The TUI's
+    `notes_screen::elide` is the same rule in terminal columns, and the browser
+    extension's `src/elide.js` is it restated in JS, since the extension cannot
+    call the lib.
+  - **Ids and hashes are the exception: a shortened id keeps its prefix**
+    (`3fa9c1d2…`), the way git shortens a commit hash. An id is random, so its
+    end is no more distinguishing than its start, and the prefix is the
+    conventional handle — the part people read aloud, compare and type. The
+    full value stays one action away through the hash-chip component (see the
+    bullet above). The helpers are `copy::short_id`/`copy::truncate_id`.
+  - A cut made by layout uses the toolkit's middle ellipsis:
+    `components::truncate::TruncateMiddle::truncate_middle()` on gpui rather
+    than `.truncate()`, `TextOverflow.MiddleEllipsis` in Compose, and the
+    extension's `fitMiddle` where CSS would have said `text-overflow: ellipsis`.
+  - The one exception is a multi-line clamp (`maxLines = 2` and up): Compose
+    only supports a middle ellipsis on a single line and falls back to a hard
+    clip, so those keep `TextOverflow.Ellipsis`.
 - **gpui sizing: no raw `px()` in render code.** Font sizes, icon/control
   sizes, panel widths, and gaps come from `gui-app`'s `sizing` module
   (`font::`, `icon::`, `control::`, `layout::`), or `sizing::scaled(..)` for a
@@ -310,7 +377,8 @@ developers build.
     Android window, and it is worth doing for its own sake before it is worth
     doing for this.
   - Worked examples: `human.rs`'s `read_only_row`/`read_only_values` against
-    `HumanDetailScreen.kt`'s `ReadOnlyField`.
+    `HumanDetailScreen.kt`'s `ReadOnlyField`. Android's one stacked row is
+    `ui/LabeledValue`; reach for it rather than laying out another.
 
 # VCS Workflow
 - This project uses Jujutsu (jj) with a git backend. Prefer `jj` commands over

README.md

@@ -51,7 +51,7 @@ most widespread example of an overlay OS today.
 
 <!-- note: I would eventually like to be able to say Synchronicity is a computing stack, but that is not the case yet -->
 <!-- the overlay OS terminology comes from https://urbit.org/overview/urbit-explained among others -->
-<!-- note: "Ra is a single entity distributed across the whole solar system. No part of Ra is slaved to any other part of it. No shell-Earth's core node has a noticeably differing personality from the others, or from the megastructure inside the Sun. Opinions and behaviour and available information are continuously synchronising. Eventually, there is only one Ra." - qntm's Ra, Abstract War -->
+<!-- note: "Ra is a single entity distributed across the whole solar system. No part of Ra is slaved to any other part of it. No shell-Earth's core node has a noticeably differing personality from the others, or from the megastructure inside the Sun. Opinions and behavior and available information are continuously synchronising. Eventually, there is only one Ra." - qntm's Ra, Abstract War -->
 
 What can someone do with Synchronicity? Some examples:
 

TODO.md

@@ -1,5 +1,9 @@
 # TODO
 
+Unfinished work this project intends to get to. Work deliberately *not* being
+done now — sound idea, decision already taken to defer it — lives in
+`docs/long-term-todo.md` instead, with the trigger that would bring it back.
+
 ## Concepts
 
 ### Key Management & Identity
@@ -13,12 +17,41 @@
 - **Details**: Argon2id is the right primitive for that job. Design it as a separate module
   rather than re-introducing it to `Secret::to_keypair`. Pick parameters appropriate for
   mobile, and store a per-secret random salt with the ciphertext.
+- **No caller yet, on purpose.** The one that was written down — encrypting the node
+  secret at rest — is deferred to `docs/long-term-todo.md`, which carries the reasoning
+  and the triggers that would reopen it. Build the derivation when something needs it,
+  not before.
 
-#### Consider ideas from Plausibly Deniable DataBase
-- https://betrusted.io/xous-book/ch09-00-pddb-overview.html
-- this experimental OS project introduces a PDDB concept that has some similarities to Vaults; I want
-to make sure that I'm borrowing as many good ideas, potential security pitfalls to avoid, etc. from
-this project
+#### Act on the PDDB comparison for Vaults
+- **Description**: Xous' Plausibly Deniable DataBase has been mined for ideas and
+  pitfalls; the findings and the reasoning are in `docs/vault-pddb-research.md`.
+  Its headline conclusion is that a locked vault and a *hidden* one are different
+  products, and that sync makes the hidden one close to unreachable — so vaults
+  should be locked-but-visible, said so on purpose. What remains is the work that
+  conclusion implies, all of it cheapest now, before a second vault exists.
+- **Decide and write down** (`docs/vault-pddb-research.md` §7): that vaults conceal
+  content and not existence, in `docs/data-model.md`; which vault a new document
+  lands in, since `Document::new` currently assigns `DEFAULT_VAULT_ID` itself and
+  has no parameter; and whether a `Passphrase` vault stores its own salt, which is
+  the choice that forecloses deniability for that variant.
+- **Build**:
+  - A locked vault as a *state*, alongside `DocumentAvailability`'s three, reached
+    before render rather than as a `VaultKeyNotFound` at decrypt time — otherwise a
+    sealed document renders as fully present and then blanks, which is the bug
+    "Absence is not an error" exists to prevent. Words in a `copy::vault` module.
+  - Vault-awareness in `eviction.rs`, `content_ledger.rs` and the last-copy guard.
+    This one is data loss, not disclosure: both are vault-blind today, so eviction
+    would happily delete the only copy of a blob nobody present can read.
+  - Pin system-written documents (agent settings, ADR 0018, and anything else the
+    system writes rather than the user) to the default vault at the type level.
+    The PDDB shipped the bug where a setting written while a secret vault was open
+    silently reverts when it is locked.
+  - Property and Artifact `value` encryption under the vault key, which is the only
+    part of the boundary `docs/document-sync.md` claims and the code does not have.
+- **Also worth having**: an offline store verifier that walks documents → artifacts
+  → blob files and opens every sealed chunk, on the model of the PDDB's
+  `backalyzer.py`. Useful before vaults, and the only way to answer "what in this
+  store can I still open?" once blobs live under more than one key.
 
 #### Design a robust manifold key rotation scheme
 - **Description**: No mechanism exists for rotating the manifold (master) keypair if it is
@@ -61,60 +94,6 @@ this project
   until it has announced itself once. The error says so.
 - Consider ideas from FOKS, the Federated Open Key Service: https://foks.pub/#roadmap
 
-## Security
-
-Cross-cutting security work. Protocol-level authentication landed with
-`rust/lib/src/p2p/admission.rs`; `docs/NODE_REVOCATION.md` carries the audit
-that produced most of this list, and the phased plan for revocation itself.
-
-#### Scope what a linkage token may do
-- **Description**: A linkage token grants the whole command surface — ADR 0017 records that
-  as a deliberate v1 decision ("what a CLI session gets"), but the concrete capabilities
-  are worth naming now that the audit has: `ImportFiles { paths }` reads any file the
-  daemon user can read *into the store, where the client can read it back*;
-  `MaterializeDocument { path, write }` writes any file the daemon user can write;
-  `Shutdown` stops the node; `PurgeDocument` destroys data ensemble-wide.
-- **Why it deserves a second look**: the holder is a browser extension — a sandboxed
-  context with no filesystem access of its own. Pairing hands it more than the browser
-  ever gave it.
-- **Details**: the machinery now exists to do this cheaply — `Transport` is threaded into
-  `handle_command`, so a per-transport (or per-linkage) command allowlist has somewhere to
-  live. Pairing control is already refused over loopback for exactly this reason.
-- **An attempt at this is parked on the `linkage-security` branch** — read it before
-  starting, and read it sceptically: it introduces a capability model to make scopes work,
-  which may be more machinery than one minimal browser extension warrants and may still be
-  the wrong shape for the linkages that aren't designed yet.
-
-#### Encrypt the node secret at rest
-- **Description**: `secrets.value` is plain JSON (`{"version":1,"seed":[…]}`). File
-  permissions are now enforced (`stores::permissions`), so this is defence in depth rather
-  than an open hole — but anything that reads the file (a backup, a synced folder, a
-  misconfigured container mount, a stolen disk) still gets the node identity and, through
-  it, every blob.
-- **Relation to other items**: this is the concrete first use for the Argon2id derivation
-  path above — the wrapping key would come from a user passphrase, which means deciding
-  what unlocks a headless node at boot.
-
-#### Make synced provenance verifiable, not just displayed
-- **Description**: `origin_node` on synced rows is read out of the incoming record
-  (`p2p/doc_sync.rs`, in `apply_records` and the tombstone/edge paths) and never checked
-  against anything, so any member can attribute a write to any node key. This reads like
-  the amplifier it sounds like, but `docs/NODE_REVOCATION.md` §3a examined it and found
-  it isn't one: nothing in the merge rules (`modified_at`, `deleted_at`, set-element
-  add/remove stamps) reads `origin_node`, so a false claim can't win a comparison,
-  suppress a write, or resurrect anything. The one place that *did* treat it as evidence
-  — `node_status::artifact_presence_for_node` inferring content possession from it — has
-  been rewritten to derive possession only from the authenticated sender
-  (`NodeContentStore`). Taking it from the authenticated sender instead of the wire claim,
-  this item's original fix, is wrong, not just naive: doc-sync is transitive, so it would
-  attribute every relayed edit to whoever forwarded it rather than who wrote it.
-- **What's left**: `origin_node` stays a claim — safe to show, unsafe to decide with —
-  documented as such at each record's definition. Making it verifiable needs a signature
-  per record under the claimed origin's own key, which also needs that node's delegation
-  cert reachable at the receiver (carried alongside, for a node never met before). Real
-  work, not currently blocking anything. See `docs/NODE_REVOCATION.md` §3a and its Open
-  Questions entry "Per-record signatures for provenance."
-
 ## Media library
 
 The shared browser component is `docs/adr/0025-media-library-shared-browser.md`.
@@ -131,9 +110,6 @@ The shared browser component is `docs/adr/0025-media-library-shared-browser.md`.
 - **Mixed folders**: a directory holding loose page images *and* subdirectories
   imports the loose images as a chapter named after the parent folder, colliding
   cosmetically with the series `Collection`'s own name. Rare; disclosed.
-- **PDF secondary line shows "Added Xh/d ago", not a page count.** The count is
-  now read at import time (`agents::pdf::read_metadata`, ADR 0035); what is left
-  is persisting it as a property and rendering it on both platforms.
 
 #### Music metadata-driven library organization
 Remaining steps are in `docs/music-library.md`'s status section, which supersedes what
@@ -165,44 +141,57 @@ since it isn't worth taking before it shows up in a profile.
 - Notes has its own narrower version of this gap — see "Take cues from Obsidian's search"
   under Agents ▸ Notes.
 
+### Make Unicode text and case-insensitive matching uniform across modalities
+- **Description**: Case-insensitive matching is decided per call site, and the sites
+  disagree. The paged title search (`search_document_items`, which the desktop, Android
+  and daemon search use) is SQLite `LIKE`, which folds ASCII case only, so `É` doesn't
+  match `é`. `DocumentStore::search_documents` folds in Rust with `to_lowercase`, which
+  handles Unicode — at the price of one `get_title` per row (an N+1). Pick one rule for
+  case folding and normalization (NFC/NFD, and whether to fold accents at all), state it
+  once, and apply it everywhere a user's text is matched: title search, filters,
+  `fuzzy::rank`, the TUI and the browser extension.
+- **Includes**: `search_documents`' title filter. Moving it into the SQL the paged path
+  uses removes the N+1, but today that would make it ASCII-only. Settle the rule first,
+  then make both paths follow it — e.g. a Unicode-aware SQLite function or a
+  pre-folded title column, rather than `LIKE`.
+
 ### CLI document search UX
 - The CLI document search experience, especially by type, needs better UX — ideas: a fuzzy
   finder for `docs list`, a better search language.
 
 ## Build & Development
 
-### Build a user-editable color theming system for gui-app
-- **Description**: `rust/gui-app/src/theme.rs` now defines the role tokens (surfaces,
-  text, accent, semantic status colors) and resolves them for light/dark from a
-  `ThemeMode` setting. What's missing is the *user-facing* half: editing tokens, and a
-  small set of starter presets to pick between.
-- **Details**: Surfaced during `/plan-design-review` on the PDF-library MVP (2026-07-16)
-  — hand-picking one "final" palette is the wrong call for a personal tool, since tastes
-  differ and any single hardcoded scheme dates. The token module is the foundation this
-  builds on. Android now has the equivalent in `ui/theme/SynPalette.kt` — a `SynPalette`
-  role table with two instances — so a preset system should drive both from one set of
-  values rather than growing separately on each side.
-
-### Gossip each node's neighbour set, so the Ensemble screen can show reachability
-- **Description**: ADR 0032 settles the Ensemble screen as a roster of co-equal peers plus
-  an N×N reachability matrix — rows and columns the same nodes in the same order, so every
-  pair appears twice and reads the same, which is what co-equality looks like drawn
-  (`design/visual-design-review/DIRECTION.md` §8.5). The roster is built; the matrix is
-  not, because the data does not exist. A node knows only its own gossip neighbours
-  (`P2PNode::active_neighbor_ids_hex`), so a matrix drawn today would have one real row,
-  one real column, and (N-1)² unknown cells.
-- **Details**: The prerequisite is for each node to gossip its own neighbour set, which
-  every node then assembles into the full picture — small, useful independently of the UI
-  (it is also what would let the app say *why* a peer is unreachable rather than only
-  *that* it is), and cheap to carry on the existing gossip announcement. Worth deciding
-  whether a relayed connection is distinguishable from a direct one at the iroh layer
-  before designing the cell states; the specimen assumes direct / relayed / unreachable.
+### Ship one rustls crypto provider, not two
+- **Description**: Two rustls crypto providers are compiled in. iroh uses `ring` (its
+  default `tls-ring`, plus `p2p/mod.rs`'s Android DNS-over-HTTPS config), and reqwest
+  uses `aws-lc-rs` (its `rustls` feature, the default features of our own `rustls`
+  dependency, and `http.rs`'s explicit provider). `aws-lc-sys` is a large native build:
+  it lengthens every cold build, the Android one included, and adds to the `.so`.
+- **The blocker is pkarr.** Its `relays` feature, which `full-client` turns on, depends
+  on reqwest with `rustls` and therefore on aws-lc-rs, with no way to choose a provider.
+  The registry's `PkarrClient::builder()` uses both the DHT and those HTTPS relays, so
+  as long as relays are in, aws-lc-rs stays. Switching only our own code to ring would
+  save nothing and give up post-quantum key exchange on our HTTPS.
+- **Options**:
+  - **ring everywhere.** Build pkarr with `dht` only, set reqwest to
+    `rustls-no-provider`, and install ring as the process default; the desktop's
+    `http_client.rs` and stream-download build their own reqwest clients. The cost is
+    the relay fallback, on networks that block UDP to the DHT. ring has no ML-KEM, and
+    its "Add Kyber" issue was closed as not planned, so this means no post-quantum key
+    exchange for the foreseeable future.
+  - **aws-lc-rs everywhere.** Set iroh and iroh-relay to `default-features = false`
+    with `tls-aws-lc-rs`. This keeps post-quantum key exchange everywhere, including
+    iroh's QUIC, but keeps the heavy native library.
+  - Ask pkarr upstream for a `rustls-no-provider`-style option, which would make the
+    first option possible without losing the relays.
+- Verify any change with `cargo tree -i ring` and `cargo tree -i aws-lc-rs`, for
+  `--target aarch64-linux-android` as well as the host.
 
 ### Finish harmonizing the Android visual style with ADR 0032
 - **Description**: The Android pass (ADR 0032 §10) landed the foundations, the whole
   structural half, and all but one of the five gaps against the desktop
   (`bgMediaCanvas`, the reading-surface story, the live-state slot's two wired
-  publishers, and selection icon/text colours). One remains, deliberately deferred:
+  publishers, and selection icon/text colors). One remains, deliberately deferred:
 - **A `Presence` tab** (§7). Still the one to hold longest. A nodes × documents grid is a
   desktop-shaped affordance that `design/visual-design-review/PRESENCE-AFFORDANCE.md`
   treats as unsettled even on the desktop, and a phone may want a different answer rather
@@ -264,23 +253,6 @@ since it isn't worth taking before it shows up in a profile.
   the error half; the data half is undocumented.
 - Consider lessons from https://docs.divio.com/documentation-system/
 
-### Make relay/DNS infrastructure configurable and self-hostable
-- The P2P layer relies entirely on n0's public infrastructure: relay servers
-  (`*.relay.n0.iroh.link`) for NAT traversal, and pkarr DNS (`dns.iroh.link`)
-  for publishing/resolving node addresses by public key. Both are open source
-  (`iroh-relay`, `iroh-dns-server`) and designed to be self-hosted.
-- Options to investigate:
-  - Configurable custom relay URLs and DNS server in `Settings`
-  - A bundled `iroh-relay` mode so a node can optionally relay for others
-  - The Mainline DHT path (`DhtAddressLookup`) as a fully decentralized fallback needing no
-    trusted server. It's the BitTorrent DHT — ~20M nodes since ~2005, maintained "for free"
-    by BitTorrent's existence. BEP 44 (~2014) added storage of arbitrary *signed* data.
-    pkarr builds on that: sign a packet of DNS-like records (IPs, relay URLs) with your
-    Ed25519 key, published indexed by your public key, self-authenticating. iroh's
-    `PkarrPublisher` uses `dns.iroh.link` as an HTTP relay to the DHT (convenient but
-    centralized); `DhtAddressLookup` participates directly with no intermediary.
-  - mDNS (`address_lookup::mdns`) for local-network discovery with no infrastructure
-
 ## Testing
 
 ### Android repository unit tests
@@ -311,8 +283,56 @@ since it isn't worth taking before it shows up in a profile.
   surfacing, and the general sync-status signal it's part of" for the design side.
 - There should be tests for the above
 
+### Model-check the sync protocols with Quint
+- **Description**: introduce [Quint](https://quint-lang.org) (TLA+'s logic, code-like
+  syntax, a simulator plus the Apalache model checker) for the protocols whose bugs only
+  show up in some interleaving of several nodes. Specs go in a new top-level `specs/`
+  (not `design/`, which is for visual explorations), checked by a `just check-specs`
+  recipe that gets the tooling from the flake. Model at protocol level — 3 nodes, 2
+  documents, bounded clocks — not the code.
+- **The first spec should find a known bug. Don't fix it before then.** It is left in on
+  purpose, as the proof of concept that a model checker finds this class systematically:
+  - The scheduler's unattended catalog pass (`scheduler::run_catalog_pass`) only ever
+    pulls with `since = peer.last_synced_at`, which is the *requester's* clock, read after
+    the sync completes (`record_sync`).
+  - The responder filters on `documents.modified_at >= since` (`SyncScope::predicate`), and
+    `modified_at` is the *original author's* stamp, carried unchanged through every relay
+    (`doc_sync::apply_records`).
+  - So: C edits a document at t=10; A pulls from B at t=20; B pulls from C at t=25. A's
+    next pull from B asks for "since 20", and the edit never reaches A through B. A write
+    landing on B *during* A's pull is missed the same way, and clock skew widens both.
+    Only a manual full sync (`scheduler::sync_with_peer`) recovers.
+  - The property to state is eventual convergence over a connected but not complete peer
+    graph. The likely fix — a responder-local change sequence as the watermark instead of
+    the author's timestamp — should be checked in the spec before it is written in Rust.
+- **Candidates after that**, in rough order of payoff:
+  - Node retirement and revocation delivery (`ensemble::retirement`,
+    `p2p::revocation_delivery`, plus the gossip and `MembershipBatch` channels and epoch
+    monotonicity). `docs/NODE_REVOCATION.md` ▸ "Retiring a node, and what the wipe
+    waits for" states the invariants: commit before ack, idempotent retries, wipe only
+    after an ack, a revoked cert is never re-admitted. Crash-at-any-step is what model
+    checking is good at.
+  - The last-copy eviction guard (ADRs 0013, 0029, 0048): "the last known copy is never
+    deletable" under two nodes evicting concurrently, each counting on the other's copy
+    from possession evidence that has gone stale.
+  - Not `SyncGuarded` (ADR 0031): three local states, a better fit for proptest.
+- **Keeping specs honest**: Quint can export ITF traces; replaying them against the real
+  stores in a Rust test (the `itf` crate) is what stops a spec from drifting into prose.
+
 ## Code Design
 
+### Consider starting the daemon by exec rather than fork
+- **Description**: `syn-daemon/src/proc_title.rs` is 270 lines, much of it unsafe
+  `/proc/self/stat` parsing and argv overwriting. It exists only because `daemonize`
+  forks without exec, so the daemon inherits the argv of the CLI, TUI or desktop app
+  that started it. Spawning it with
+  `Command::new(current_exe()).arg0("syn-daemon")` plus a hidden entry argument would
+  remove the file and the `daemonize` dependency.
+- **The cost**: each of `syn`, `syn-tui` and `syn-gui` needs that hidden entry point,
+  daemon startup takes a different path, and log-file handling may change with it. It
+  is a risky startup change with no user-visible gain, so it waits until something
+  else needs that startup path reworked.
+
 ### Redesign keyboard navigation across the TUI and GUI
 - **Description**: `gui-app` and `tui-app` grew keyboard navigation ad hoc, screen by
   screen, with no shared model for the two concerns that recur everywhere: (1) drilling
@@ -334,6 +354,39 @@ since it isn't worth taking before it shows up in a profile.
     with sub-tabs", so new agents get consistent navigation instead of copy-pasting a
     `Mode` enum.
 
+### Pluralize copy with a library, in every modality
+- **Description**: Counts in user-visible copy are pluralized three ways today: the
+  `"artifact(s)"` form (49 in `copy.rs`, plus cli-app and gui-app literals), hand-rolled
+  `if n == 1` branches, and Kotlin literals. Replace all of them with one mechanism built
+  on a library designed for plural rules. That way every count reads "1 artifact" or
+  "3 artifacts", and each rule is written once.
+- **Scope**: `copy.rs` first, since Android and the TUI/CLI get most of their words from it,
+  then any count still composed in gui-app, cli-app, tui-app or Kotlin. The browser
+  extension cannot call the lib, so it needs its own equivalent: JS `Intl.PluralRules`.
+- **Candidates**: ICU4X's `icu_plurals`, which only selects the plural category and so fits
+  `copy.rs`'s plain functions; or Project Fluent (`fluent-bundle`), which would also
+  move the strings into message files. Choose with localization in mind, even though
+  there's no second language yet.
+
+### Move the remaining user-visible strings into `copy.rs`
+- **Description**: About 170 strings that users read are still literals in gui-app screens,
+  alongside CLI-only sentences in cli-app and a table of strings Kotlin shares with the
+  desktop. CLAUDE.md says copy lives in `copy.rs`, grouped by subject, and is imported by
+  every modality.
+  - gui-app: Settings, linkages, menu labels such as "Pop Back In", import_trigger's
+    "Files…"/"Folder…", the command palette, the player, and PDF/comic info-row labels.
+  - cli-app: the keyphrase write-down block and the job/linkage/retire flows in `main.rs`.
+  - Kotlin: presence and eviction sentences, the scheduler run summary, the sync, About
+    and unverified explainers, theme names, Humans and Notes labels, and podcast and
+    comics strings.
+- **Watch for**: paraphrases, which are the same defect in a harder-to-spot form. Where two
+  modalities word one idea differently, pick one wording before moving it rather than
+  moving both. Known pairs:
+  - "Untitled Document" vs `document_display::UNTITLED`;
+  - desktop's "Name the protocol first" vs `humans::CONTACT_NEEDS_PROTOCOL`;
+  - the "Run now" summary's capitalization;
+  - desktop's "N new episodes." vs Android's "Episodes changed elsewhere.".
+
 ## Android/Kotlin Improvements
 
 ### Investigate whether mainline DHT lookups are silently blocked on the Android emulator
@@ -379,15 +432,15 @@ since it isn't worth taking before it shows up in a profile.
   bootstraps via DHT, the bug is emulator-specific and low priority.
 
 ### Android error surfacing, and the general sync-status signal it's part of
-- **The general gap**: per-peer gossip reachability is visible (Connected/Degraded badges
-  on the Ensemble screen), but there is still no user-facing "a sync is happening / just
-  failed / just succeeded" signal anywhere else. The whole premise is that sync won't
-  silently lose or desync data; a silent failure undermines that regardless of how
+- **The general gap**: there is no user-facing "a sync is happening / just failed / just
+  succeeded" signal anywhere. (There used to be per-peer Connected/Degraded badges on the
+  Ensemble screen; they claimed a reachability the gossip mesh cannot report, and were
+  removed rather than corrected — ADR 0032's amendment.) The whole premise is that sync
+  won't silently lose or desync data; a silent failure undermines that regardless of how
   reliable the protocol is. Needs to hook every sync-triggering codepath — manual "sync
-  now", background periodic sync, document import/receive — not one narrow case. Builds on
-  the existing reachability visibility rather than replacing it: this is per-operation
-  presence/success/failure, not per-peer connectivity. This is tier 2 of the taxonomy
-  below.
+  now", background periodic sync, document import/receive — not one narrow case. This is
+  per-operation presence/success/failure, not per-peer connectivity. This is tier 2 of the
+  taxonomy below.
 - **Android-specific taxonomy**: `docs/adr/0021-android-error-surfacing-tiers.md`.
   Follow-ups it left open:
   - gpui's Notes agent (which has its own shipped banner) and the TUI (no error-surfacing
@@ -408,13 +461,11 @@ since it isn't worth taking before it shows up in a profile.
 ### Keeping track of long-running jobs
 Model and dedup design: `docs/adr/0011-jobs-first-class-model.md`; product design:
 `docs/sync-management.md`'s "Jobs" section.
-- **Cancellation is still coarse for a single blocking P2P call.** Every surface is
-  runner-backed now, so a manual pull/push/eviction has a live token — but nothing reads it
-  mid-transfer: `asset_sync`'s functions take no cancellation signal, so the work runs to
-  the end and the row is only *recorded* as `Cancelled`. The imports and scheduler passes,
-  which check `is_cancelled` between units, do stop. Threading a signal into `asset_sync`
-  (probably a `&dyn ProgressReporter`, since that is what the byte counters would want
-  anyway) is the fix, and it would improve desktop as much as the FFI/daemon.
+- **An eviction does not stop on cancel.** It is local disk work with no cancel check at all.
+- **`syn docs import` doesn't say when it was canceled.** A `syn jobs cancel` stops the
+  batch, and the CLI prints the files that made it in and exits as if that were all of
+  them: `ImportOutcome` carries no stopped-early flag to print a note from. The sentence
+  belongs in `copy.rs`, next to `asset_sync::pushed`'s canceled reading.
 - **The TUI has no import affordance at all.** When it gains one it should start a job from
   the outset rather than being retrofitted the way the GUI's library screens were.
 - **A blob's plaintext is read whole before any of it is sealed.** `BlobStore::store` takes
@@ -437,18 +488,33 @@ Model and dedup design: `docs/adr/0011-jobs-first-class-model.md`; product desig
   Rust derives to be a label Kotlin can name before it calls, which it currently can't — or an
   `ImportsInProgress` that filters by kind alone, the way the desktop's does, which sidesteps
   the naming problem entirely and is probably the right first move.
-- **No widget offers to cancel the job it shows.** Every surface is runner-backed, so the token
-  exists — but the transfer paths don't read it mid-flight (see the cancellation bullet above),
-  so a Cancel on a bound widget would promise more than it delivers for exactly the widgets
-  that have one. Worth doing once `asset_sync` takes a cancellation signal: a bound widget is
-  the natural place to stop the work it started, rather than sending the user to Jobs to find
-  the row.
+- **No widget offers to cancel the job it shows.** The blocker is gone — a pull or push now
+  honors the token within a chunk — so a Cancel on a bound widget would deliver what it
+  promises. A bound widget is the natural place to stop the work it started, rather than
+  sending the user to Jobs to find the row.
+- **A recursive pull reports no progress, because its unit has no counter yet.** One transfer
+  now counts its bytes onto the job row, which is right for the single-artifact pull and the
+  push. The whole-subtree walk deliberately drops them (`asset_sync::CancelOnly`): its unit is
+  a *document*, and passing per-file bytes through restarts the row's counters at each one.
+  What it wants is documents-done over a subtree total, with the current file's bytes folded
+  in — `documents::import::ImportCounts` already does exactly that shape for imports and is
+  the thing to reach for. The subtree total is `list_subtree_ids`, already computed by the
+  catalog phase.
+- **Nothing outside the Jobs screen draws the byte counters a pull now reports.** The
+  document-detail controls that start these transfers still show a spinner.
+  `components::remote_fetch` and `ui/RemoteFetch.kt` are the shape to reuse.
+- **A peer's jobs can't be seen or stopped from here.** node-admin serves `ListJobs` and
+  `CancelJob` (`p2p::node_admin::{list_jobs, cancel_job}` are the client half), but nothing
+  calls them on either modality. Settings ▸ Sync's remote target can only say a triggered
+  pass *started* — `docs/sync-management.md` notes the gap — and watching it run, or
+  stopping it, means walking over to the other device. Polling `ListJobs` while a remote
+  pass runs, with a Cancel per row, would close it.
 
 ### The peer walk is serial, and the peer list is never pruned
 - **Description**: `scheduler::ensemble_peers_freshest_first` returns every node gossip has
   ever heard from for this ensemble — rows are never pruned, so a machine retired months
   ago is still in the list. Every pass walks it *in series* with a per-peer budget
-  (`PEER_CATALOGUE_TIMEOUT` is 180s), so an ensemble carrying a couple of dead nodes
+  (`PEER_CATALOG_TIMEOUT` is 180s), so an ensemble carrying a couple of dead nodes
   spends most of a pass dialling them. Symptom: a trivially small sync — one podcast and
   twenty episode documents — takes many minutes.
 - **What's already done**: the list is ordered most-recently-seen first, so the live peer
@@ -465,17 +531,24 @@ Model and dedup design: `docs/adr/0011-jobs-first-class-model.md`; product desig
   - Prune or archive peer rows that have not been seen in a long time, with a way to see
     and undo it. This is really "decommission a node", which is the revocation work.
 
-### Sequential vs. parallel peer fetch for asset sync
-- **Description**: `asset_sync::sync_document_assets` walks ensemble peers *sequentially*,
-  asking each for what's still missing. Each attempt is bounded by a connect timeout and a
-  total transfer timeout, so one dead peer can't block a healthy one — but the worst case
-  still pays each timeout in series, and multiple healthy peers go unused.
-- **Details**: Trade-offs to weigh —
-  - Racing the *same* large blob across peers wastes bandwidth; cancelling in-flight
-    transfers once one wins adds complexity.
-  - Better middle ground: shard *distinct* missing items across peers, and/or race only the
-    connect/handshake phase and commit the transfer to the first responder.
-  - Keep bounded-sequential as the simple fallback.
+### pkarr 8 drops compare-and-swap, which the membership registry leans on
+- **Description**: `pkarr` is held at 5 while everything else is current. The ensemble
+  registry is one signed packet that every node read-modify-writes
+  (`ensemble::publish_membership`): read the latest, add this node, publish with the
+  read packet's timestamp as CAS, so two nodes registering at once fail rather than one
+  silently evicting the other's entry. pkarr 8's `Client::publish` takes no CAS, and its
+  DHT client passes `None` to mainline's `put_mutable`.
+- **Porting the calls is trivial** (`resolve_most_recent` becomes `resolve(key,
+  ResolvePolicy::NetworkOnly)` returning a `Result`, whose `NotFound` is the old `None`);
+  what needs deciding is what replaces CAS. Options:
+  - Publish through `mainline` directly for this one packet, which still supports CAS.
+  - Drop CAS and make the race harmless: re-resolve after publishing and republish if our
+    entry, or a sibling's we saw, is missing. Converges, but only while someone keeps
+    retrying.
+  - Stop sharing one packet across writers, if the bootstrap design
+    (`docs/BOOTSTRAPPING.md`) can live without a single registry.
+- Also a candidate for the Quint work above: "no registered node is lost from the
+  registry" under concurrent registration is exactly its kind of property.
 
 ### Track per-node artifact content presence across the network
 Design in `docs/adr/0013-blob-possession-evidence-last-copy-guard.md` and
@@ -492,6 +565,24 @@ How it works: `rust/lib/src/stores/lock.rs` and
   whole batch completes** — events are collected daemon-side and replayed. Consider
   streaming progress over the socket if large imports feel unresponsive;
   `DaemonCommand::AwaitChange` is the precedent for pushing over that socket.
+- **A store whose path is long enough cannot run a daemon.** The socket is
+  `<store>/.daemon.sock`, and a Unix socket path has to fit `sun_path` — 108 bytes on
+  Linux, 104 on macOS — so a canonical store path much past 90 bytes fails to bind.
+  `syn daemon start` now says so rather than exiting 0, but the store is still unusable
+  through the daemon. Binding by a path relative to the store (the daemon already runs
+  with the store as its working directory) only moves the problem to every client, which
+  would have to `chdir` too; a socket under `$XDG_RUNTIME_DIR` named by a hash of the
+  store path doesn't have it.
+- **The daemon's local API refuses a request body over 2 MB** — axum's default
+  `DefaultBodyLimit`, never raised. A note body past that can arrive from a peer (an
+  artifact frame is far larger, see `wire::MAX_FRAME`) and then cannot be saved back
+  through the CLI or the TUI. The limit wants to be a named constant sized against what a
+  document can actually hold, on the Unix socket and the loopback listener alike.
+- **The daemon never closes its iroh endpoint on the way out.** `P2PNode::shutdown`
+  exists and the desktop's quit path calls it; `server::serve` drops the runtime
+  instead, so every stop logs iroh's "Endpoint dropped without calling
+  `Endpoint::close`" ERROR, and peers learn the connection is gone by timeout rather than
+  by a CONNECTION_CLOSE.
 
 ## Agents
 
@@ -513,6 +604,22 @@ How it works: `rust/lib/src/stores/lock.rs` and
   drops the other's, until someone makes a newer move. Converging it wants a
   move log with undo/redo by timestamp (Kleppmann et al., *A highly-available
   move operation for replicated trees*). See ADR 0049.
+- **The desktop document detail drops a property edit when it reloads.**
+  `detail_view.rs`'s `load_detail` sets `editing_properties = None` on every
+  load, and it runs not only on open and after Save but after a pull of the
+  whole document, a per-artifact pull, or a delete-locally finishes. So an
+  action the user started earlier, completing in the background, discards the
+  property edit they are now partway through — a sync disrupting what the user
+  is doing (AGENTS.md's first Design Principle). Two related gaps on the same
+  form:
+  - Save writes *every* editable field, not the ones the user changed. A
+    property another node changed after the form opened is overwritten with the
+    value the form was seeded with. Diff against what was loaded, as the Humans
+    screen's `diff_staged` does.
+  - The detail doesn't follow the store at all, so that other node's change is
+    never shown while the detail is open. Following it means alert-don't-apply
+    while editing (`components::sync_guarded::SyncGuarded`, ADR 0031), not a
+    reload.
 - Look at the Papra open-source project for document UI design ideas; also PdfDing
 - Some documents get misleading titles when imported naively (e.g. comics) — importers
   should produce sensible titles, since those are what the Documents view shows
@@ -530,12 +637,12 @@ How it works: `rust/lib/src/stores/lock.rs` and
   button is durable. This is `docs/sync-management.md`'s "push-assisted delivery", moved
   up; see `docs/content-placement-redesign.md` §5.
 - **Questions the queue exists to let us answer** (experiment, not argument — the right
-  behaviour against a real sleeping phone isn't knowable from here):
+  behavior against a real sleeping phone isn't knowable from here):
   - How long does a queued directive stay valid? A `Mirror` pressed a week ago may not be
     what the user still wants.
   - What happens if the target's own policy changes before it wakes — does the directive
     still apply, or has it been superseded by a more recent local decision?
-  - Should a pending directive be visible, and cancellable, or is that clutter for
+  - Should a pending directive be visible, and cancelable, or is that clutter for
     something that usually lands within seconds?
   - Delivery: gossip carries small frames (4 KiB, see the presence-announcement item) and
     reaches nodes as they appear; store-and-forward through a reachable third node is the
@@ -561,48 +668,38 @@ How it works: `rust/lib/src/stores/lock.rs` and
 - **Per-artifact sync controls on the document detail page.** Pulling one artifact works
   on every surface (`asset_sync::sync_document_asset`).
   - ~~**Nothing asks peers whether a newer version exists.**~~ Closed: the whole-document
-    pull (`asset_sync::sync_document_assets_recursive`) now runs a scoped catalogue refresh
+    pull (`asset_sync::sync_document_assets_recursive`) now runs a scoped catalog refresh
     against every ensemble peer before the content walk, so "up to date" is an answer about
     the ensemble rather than about this node's last scheduler pass. See
-    `docs/sync-management.md`'s "On-demand catalogue refresh for one document".
+    `docs/sync-management.md`'s "On-demand catalog refresh for one document".
   - **The per-row "Sync" control still doesn't.** `sync_document_asset` — the narrow
-    per-artifact affordance in the Artifacts section — deliberately skips the catalogue
+    per-artifact affordance in the Artifacts section — deliberately skips the catalog
     phase: it fetches the one `ContentKey` the caller named, against whatever the local
-    catalogue says. That's right for "fetch this blob I can see," and wrong if what the user
+    catalog says. That's right for "fetch this blob I can see," and wrong if what the user
     means is "get me the current version of this note." Decide whether the row control should
     refresh that one artifact's row first, or whether the whole-document button is the only
     place that question belongs.
   - Feeds into automatic sync policy eventually.
 - Document search (title, then body) lives in its own top-level section — see ## Search.
 
-### One derived-identity helper, and bring the podcast agent onto it
+### Canonical URIs for ADR 0050's captured posts
 - **Description**: ADR 0050 needs a post's id derived from `(platform, canonical_uri)` so
   two nodes saving the same post converge, and so a future Feeds agent ingesting the same
-  post reaches the same document rather than a second one. That helper should not be
-  written for posts alone: six UUIDv5-from-a-normalized-key derivations already exist
-  independently — `music::{artist_document_id, album_document_id, library_edge_id}`,
-  `agent_settings_document_id`, `anchor_document_id`, `documents::facts`' derived row ids,
-  `derived_edge_id`, and `podcast_queue`'s — each with its own namespace constant and its
-  own convention for joining key parts.
-- **The podcast agent is the counter-example, not a partial solution.** It derives
-  nothing: episodes get fresh v4 ids and `save_feed_episodes` dedups by scanning the
-  feed's existing children for a matching `PodcastEpisodeApiId`. That only dedups against
-  what *this* node already holds, so two nodes refreshing the same feed independently
-  create two documents per episode and sync delivers both — the exact failure
-  `docs/rss-reader.md` §3.3 rejects. Deriving an episode id from
-  `(feed, PodcastEpisodeApiId)` fixes it and deletes `existing_episode_api_ids` along with
-  the dedup scan.
-- **What to reuse from podcast**: the `api_id` plumbing is the canonical key it already
-  has; §3.3's `feed_item_document_id` sketch is the shape; and the feed→item document
-  layout is what Feeds mirrors. The dedup pass is what goes away.
-- **Canonicalization is part of the helper, not a caller's preparation** — two
-  derivations that agree on UUIDv5 and disagree on whether
-  `bsky.app/profile/<handle>/post/<rkey>` normalizes to its `at://` uri produce two ids
-  just as surely as two different algorithms would.
+  post reaches the same document rather than a second one. The derivation itself is done —
+  `documents::derived_id` is the one place a UUIDv5 identity is computed, and a new post id
+  is a `Domain` variant. What is missing is the canonicalization, which is part of the
+  helper and not a caller's preparation: two derivations that agree on UUIDv5 and disagree
+  on whether `bsky.app/profile/<handle>/post/<rkey>` normalizes to its `at://` uri produce
+  two ids just as surely as two different algorithms would.
+- Needs a per-platform rule (at minimum Bluesky, Mastodon, Twitter/X) and a decision about
+  what a *failed* canonicalization does — the raw uri is a defensible key as long as it is
+  never silently mixed with canonicalized ones under the same `Domain`.
+- **`podcast::episode_document_id` is the worked example** of the derived-id half:
+  `(feed document, publisher's episode id)`, `Provenance::Syndicated`, no dedup scan.
 
 ### Service credentials: what's left after the store
 The store is built (ADR 0051): a `ServiceCredential` document per service,
-sealed with the vault key, synced on the catalogue plane. Podcast Index reads
+sealed with the vault key, synced on the catalog plane. Podcast Index reads
 from it; a Settings ▸ Credentials tab on the desktop, the same section on
 Android, and `syn settings credentials{,-set,-clear}` enter and remove keys;
 and the tests provision the published test key themselves. Each service's
@@ -625,19 +722,14 @@ Open:
 ### Clippings: what's left after the first capture path
 Clipping works end to end (ADR 0039): a context menu in the extension, `syn
 clippings capture`, a `Clipping` document under an anchored root, and a
-read-only Clippings screen on the desktop and on Android, both reading their
-words from `copy::clippings`. Both page as they are scrolled, over
+Clippings screen on the desktop and on Android, both reading their words from
+`copy::clippings`. Both page as they are scrolled, over
 `DocumentStore::list_children_page`'s keyset cursor — the two open items ADR
 0039 left ("Load more, and what it forces" and an unpaginated `list_children`)
-were one problem and are closed together.
+were one problem and are closed together. Both also edit a clipping in place,
+behind the alert-don't-apply flow (ADR 0031) the last open item was waiting on.
 
 Open:
-- **Editing a clipping.** Both screens are read-only because an editable
-  buffer a sync can land on needs the `SyncGuarded` alert-don't-apply flow
-  around it (ADR 0031) — the body is `LastWriteWins`, so an unguarded editor
-  would silently lose one side. `NoteEditor` takes a `String` and a
-  `TextFormat` and is reusable as-is; what has to be built is the watch loop
-  and the banner, not the editor.
 - **No linkages on Android.** The Clippings screen landed; a phone still
   cannot show or revoke what it has granted to a program on its machine. See
   the browser-extension section below, which carries the same gap.
@@ -667,7 +759,27 @@ Open:
   loadable zip and the store icons are in place; what is left is Firefox
   signing, without which there is no permanent install there.
 
-### Music
+### Humans: interactions with more than one attendee
+- **Description**: The data model has group interactions — one `Interaction` document
+  with an `EdgeKind::Attendee` edge to everyone who was there, so one dinner covers four
+  people (`docs/humans-agent-research.md` §A) — and the lib has the whole API
+  (`HumansManager::log_interaction` takes attendees, `set_attendees` replaces them,
+  both over the FFI). No frontend uses it. Logging an interaction from a person's
+  History tab passes only that person (`human.rs`'s `std::slice::from_ref(&id)`,
+  `HumanDetailScreen.kt`'s `listOf(humanId)`), editing one changes title, date and
+  write-up only, and nothing calls `set_attendees`. So every interaction has exactly one
+  attendee, and the "other attendees" line both timelines already draw never shows
+  anything.
+- **The work**: an attendee picker in the interaction form on desktop and Android,
+  over the user's humans and prefilled with the person whose screen it is, written
+  with the form's Save — an interaction is its own document, so it lives outside the
+  person's edit mode (AGENTS.md, "Not everything on a screen is part of its form").
+  Whether the TUI and CLI get it too is part of the decision.
+- **Open questions**:
+  - Can the person whose screen this is be removed? Doing so moves the interaction
+    off their timeline, which the form should say rather than just do.
+  - What removing the last attendee means: an interaction with nobody at it, a
+    refusal, or a delete.
 - See ideas in https://unformeddelta.wiki/ihe0bEPXK5ip/metadata-patterns-not-accounted-for-by-music-apps
 - Also see UI ideas from Empeg, via the Cathode Ray Dude video (e.g. waveform seek tool)
 - Consider https://www.symfonium.app/ as an example
@@ -699,7 +811,7 @@ Open:
   entirely and drive Media3/ExoPlayer's `PlayerView` directly.
 - No poster-frame thumbnails — needs a decoded frame, so it's blocked on the
   above; `MediaLibrary` shows the placeholder glyph for every clip meanwhile.
-- Only MP4/MOV/M4V are recognised (`re_mp4`); MKV/WebM would need a second
+- Only MP4/MOV/M4V are recognized (`re_mp4`); MKV/WebM would need a second
   container parser.
 - Android has no folder import for video (desktop does, via
   `import_directory_tree`) — single-file picker only.
@@ -766,26 +878,24 @@ Open:
 https://unattributed.cc/2026/07/21/how-i-write-blog-posts/
 - consider something like this query language: https://docs.kiwifs.com/concepts/dql (Obsidian
 has a similar concept)
+- note tabs should have good ideas from opera web browser, such as slowly-fading lines indicating how recently it was
+used; also groups
 
 ### Podcast
 - **Rich episode experience**: a Rust data structure representing transcript, sections,
   chapters, and UI to display them. Linux Unplugged is a good model.
-- **No offline copy of an episode.** Playback streams the enclosure URL
-  (`AudioSource::Stream`), and listen position is a synced artifact — but nothing ever
-  puts the audio in the blob store, so an episode cannot be taken onto a plane, and the
-  content policy that governs every other kind of blob has nothing to govern here.
-  There was a `fetch_episode_audio` that pulled a whole enclosure into memory and had no
-  callers; it is deleted, and whatever does this should stream into a blob rather than
-  start from that shape.
-- **Nothing ever refreshes a subscribed feed's episodes.** Persisted episodes are served
-  from disk indefinitely, so new ones never appear — and note the trap in the affordance
-  that looks like it does: the desktop's "Refresh" re-runs `episodes_for_feed`, which
-  returns the *stored* episodes whenever there are any and only falls back to the API for
-  a feed with none. Needs a real refetch and/or a periodic job; `save_feed_episodes`
-  already dedups by `api_id`, so re-running it over a full fetch inserts only what's new.
-  Episodes another node fetched do arrive by sync now, which is the closest thing to a
-  refresh the ensemble has. The GUI also has no "load more" paging, where Android raises
-  its request cap as the user scrolls.
+- **A saved episode is not governed by content policy.** Saving one writes a
+  `PrimaryContent` blob like any other, but nothing has taught the scheduler's content
+  pass or the Sync policy tab that a `Mirror` policy on `PodcastEpisode` should fetch
+  saved episodes onto other nodes, or that a `Stream` policy should reclaim them. Today
+  saving and removing are per-node acts the user makes by hand on each device. Deciding
+  this needs an answer to a question the other types don't raise: the enclosure has a
+  public source, so "the ensemble should hold this" and "each node that wants it can
+  fetch it from the publisher" are both defensible.
+- **The desktop has no "load more" paging**, where Android raises its request cap as the
+  user scrolls. Both now fetch the episode list from the API on every open — a subscribed
+  feed no longer serves a stale copy from disk — so what is missing is only the second
+  page.
 - **Lightning boost support**: figure out how hard this would be.
 
 ### Comics
@@ -817,3 +927,7 @@ has a similar concept)
 - Something like https://github.com/RackulaLives/Rackula/
 - Ebook reader
 - Some kind of low-security bitcoin / other cryptocurrency functionality
+- password/secrets manager
+- rich dictionary functionality, like rikaichain/yomitan - maybe this should be part of an even more general app-wide
+text analysis tool that makes it possible to perform arbitrary analysis (incl. sending to a LLM) for any text in any document
+in synchronicity - it should also be capable of doing OCR for text in images

android/AGENTS.md

@@ -23,6 +23,11 @@ under `android/`. The root `CLAUDE.md` holds the project-wide rules.
     `aarch64-linux-android` the first time is ~15 min. Once `rust/target` has
     it, that step is a no-op and `unit-tests-kotlin`/`just lint-kotlin` take
     seconds — see "Two Kotlin lint recipes" below.
+  - **Which ABI**: the Rust library is built for one ABI per build —
+    arm64-v8a by default, whatever Android Studio's Run targets, or
+    `-PrustAbi=x86_64` (e.g. `just gradlew installDebug -PrustAbi=x86_64`).
+    Installing on an x86_64 emulator needs the x86_64 build; the arm64 one
+    runs there through the native bridge and every HTTPS connection fails.
   - **Neither**: Android/Kotlin changes can't be compiled or verified at all;
     say so explicitly rather than guessing whether a change compiles.
 - **Two Kotlin lint recipes, and the difference matters** (see ADR 0022):

android/app/build.gradle.kts

@@ -10,6 +10,33 @@ plugins {
     alias(libs.plugins.ktfmt)
 }
 
+// The one ABI the Rust library is built for, since cross-compiling it is the
+// expensive part of a build. An explicit `-PrustAbi=` wins; otherwise the ABI
+// Android Studio injects when it deploys to a device (its first entry is the
+// device's preferred ABI), so Run builds x86_64 for the emulator and arm64 for
+// a phone. A command-line build with neither gets arm64, which is what ships.
+//
+// Never run the arm64 library on an x86_64 emulator: the native bridge breaks
+// JNI `jboolean` returns — see `build-synchronicity-lib-android` in the
+// justfile.
+val supportedRustAbis = listOf("arm64-v8a", "x86_64")
+val rustAbi: String =
+    providers.gradleProperty("rustAbi").orNull
+        ?: providers.gradleProperty("android.injected.build.abi").orNull?.split(",")?.firstOrNull {
+            it in supportedRustAbis
+        }
+        ?: "arm64-v8a"
+
+require(rustAbi in supportedRustAbis) { "rustAbi=$rustAbi is not one of $supportedRustAbis" }
+
+val rustTriple = mapOf("arm64-v8a" to "aarch64-linux-android", "x86_64" to "x86_64-linux-android")
+val cargoTargetDir = System.getenv("CARGO_TARGET_DIR") ?: "${rootDir.parentFile}/rust/target"
+val rustLibraryPath = "$cargoTargetDir/${rustTriple.getValue(rustAbi)}/release/libsynchronicity.so"
+
+// buildRustLib syncs the .so here, under build/ so `clean` removes it and so
+// an ABI built earlier can't linger in the APK beside the current one.
+val rustJniLibsDir = layout.buildDirectory.dir("rustJniLibs")
+
 android {
     namespace = "com.gregshuflin.synchronicity"
     compileSdk = 37
@@ -23,7 +50,7 @@ android {
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 
-        ndk { abiFilters += listOf("arm64-v8a") }
+        ndk { abiFilters += listOf(rustAbi) }
     }
 
     buildTypes {
@@ -41,7 +68,7 @@ android {
     }
     buildFeatures { compose = true }
 
-    sourceSets { getByName("main") { jniLibs.directories += "src/main/jniLibs" } }
+    sourceSets { getByName("main") { jniLibs.directories += rustJniLibsDir.get().asFile.path } }
 
     // Explicitly set the NDK version to one that's installed
     ndkVersion = "28.0.13004108"
@@ -60,9 +87,8 @@ tasks.register<Exec>("buildRustLib") {
         "Builds the Rust library via `just build-synchronicity-lib-android` and copies it to the jniLibs directory"
 
     val repoRoot = project.rootDir.parentFile
-    val cargoTargetDir = System.getenv("CARGO_TARGET_DIR") ?: "$repoRoot/rust/target"
-    val builtLibrary = file("$cargoTargetDir/aarch64-linux-android/release/libsynchronicity.so")
-    val jniLibsDir = file("src/main/jniLibs/arm64-v8a")
+    val builtLibrary = file(rustLibraryPath)
+    val jniLibsDir = rustJniLibsDir.get().asFile
 
     // Everything that decides what ends up in the .so, so Gradle can skip this
     // task outright rather than shelling out to cargo on every single build —
@@ -81,15 +107,15 @@ tasks.register<Exec>("buildRustLib") {
     // The recipe this shells out to: it sets RUSTFLAGS and the NDK linker, and
     // pins ANDROID_NDK_VERSION, so a toolchain change lands here as an edit.
     inputs.file("$repoRoot/justfile")
-    outputs.file(File(jniLibsDir, "libsynchronicity.so"))
+    inputs.property("abi", rustAbi)
+    outputs.dir(jniLibsDir)
 
     workingDir = repoRoot
-    commandLine("just", "build-synchronicity-lib-android")
+    commandLine("just", "build-synchronicity-lib-android", rustAbi)
 
     doLast {
-        jniLibsDir.mkdirs()
-        copy {
-            from(builtLibrary)
+        sync {
+            from(builtLibrary) { into(rustAbi) }
             into(jniLibsDir)
         }
     }
@@ -162,6 +188,9 @@ abstract class GenerateUniffiBindings : DefaultTask() {
     @get:PathSensitive(PathSensitivity.NONE)
     abstract val rustLibrary: RegularFileProperty
 
+    // Which ABI's .so the recipe reads — and builds first, if it is stale.
+    @get:Input abstract val abi: Property<String>
+
     // Repo root: `just` is invoked from there, and the recipe's paths are
     // relative to it.
     @get:Internal abstract val repoRoot: DirectoryProperty
@@ -178,7 +207,7 @@ abstract class GenerateUniffiBindings : DefaultTask() {
         outDir.mkdirs()
         execOperations.exec {
             workingDir = repoRoot.get().asFile
-            commandLine("just", "uniffi-bindgen-generate", outDir.absolutePath)
+            commandLine("just", "uniffi-bindgen-generate", outDir.absolutePath, abi.get())
         }
     }
 }
@@ -195,11 +224,8 @@ androidComponents {
                 description = "Regenerates Kotlin uniffi bindings from the compiled Rust library"
                 dependsOn("buildRustLib")
 
-                val cargoTargetDir =
-                    System.getenv("CARGO_TARGET_DIR") ?: "${project.rootDir.parentFile}/rust/target"
-                rustLibrary.set(
-                    file("$cargoTargetDir/aarch64-linux-android/release/libsynchronicity.so")
-                )
+                rustLibrary.set(file(rustLibraryPath))
+                abi.set(rustAbi)
                 repoRoot.set(file("${project.rootDir.parentFile}"))
             }
         // Wiring the task rather than a path carries the dependency with it, so
@@ -211,6 +237,22 @@ androidComponents {
     }
 }
 
+// The AAR must be exactly the version of rustls-platform-verifier-android that
+// Cargo resolved: it is the JVM half of the same component, called over JNI,
+// and a mismatch fails at runtime rather than at build time.
+val rustlsPlatformVerifierVersion: String by lazy {
+    val crate = "rustls-platform-verifier-android"
+    val lines = rootDir.parentFile.resolve("rust/Cargo.lock").readLines()
+    val nameIdx = lines.indexOfFirst { it.trim() == "name = \"$crate\"" }
+    lines
+        .drop(nameIdx + 1)
+        .firstOrNull { it.trimStart().startsWith("version = ") }
+        ?.substringAfter('"')
+        ?.substringBefore('"')
+        .takeIf { nameIdx >= 0 && !it.isNullOrEmpty() }
+        ?: error("$crate not found in rust/Cargo.lock")
+}
+
 // Make the Rust build task run before Java compilation
 tasks.named("preBuild") { dependsOn("buildRustLib", "copySharedAssets", "copySharedFonts") }
 
@@ -219,7 +261,7 @@ dependencies {
     implementation("net.java.dev.jna:jna:5.18.1@aar")
 
     // JVM component for rustls-platform-verifier (TLS cert verification on Android)
-    implementation("rustls:rustls-platform-verifier:0.1.1")
+    implementation("org.rustls:rustls-platform-verifier:$rustlsPlatformVerifierVersion")
 
     implementation(libs.androidx.core.ktx)
     implementation(libs.androidx.lifecycle.runtime.ktx)
@@ -231,7 +273,6 @@ dependencies {
     implementation(libs.androidx.ui.tooling.preview)
     implementation(libs.androidx.material3)
     implementation("androidx.compose.material:material-icons-extended:1.6.3")
-    implementation("androidx.fragment:fragment-ktx:1.6.2")
     implementation("io.coil-kt:coil-compose:2.5.0")
     implementation(libs.androidx.navigation.compose)
     implementation(libs.androidx.work.runtime.ktx)
@@ -243,14 +284,8 @@ dependencies {
     debugImplementation(libs.androidx.ui.tooling)
     debugImplementation(libs.androidx.ui.test.manifest)
 
-    // Retrofit for API calls
-    implementation("com.squareup.retrofit2:retrofit:2.9.0")
-    // Using kotlinx.serialization instead of Gson for better type safety
-    implementation("com.squareup.okhttp3:logging-interceptor:4.9.0")
-
     // Kotlinx Serialization for JSON handling
     implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.6.0")
-    implementation("com.jakewharton.retrofit:retrofit2-kotlinx-serialization-converter:1.0.0")
 
     // Coroutines for async operations
     implementation("org.jetbrains.kotlinx:kotlinx-coroutines-android:1.6.4")
@@ -258,7 +293,6 @@ dependencies {
 
     // Media3 ExoPlayer for audio playback
     implementation("androidx.media3:media3-exoplayer:1.2.1")
-    implementation("androidx.media3:media3-ui:1.2.1")
     implementation("androidx.media3:media3-common:1.2.1")
     implementation("androidx.media3:media3-session:1.2.1")
 
@@ -279,7 +313,7 @@ detekt {
     config.setFrom("$projectDir/detekt.yml")
     buildUponDefaultConfig = true
     allRules = false
-    // Analyse files across threads. Off by default in detekt; the type-resolution
+    // Analyze files across threads. Off by default in detekt; the type-resolution
     // pass (`detektDebug`, the one that has to pass — ADR 0022) is the slowest
     // thing in the Kotlin lint path once the Rust build is out of the way.
     parallel = true

android/app/src/main/AndroidManifest.xml

@@ -12,6 +12,7 @@
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
 
     <application
+        android:name=".SynchronicityApplication"
         android:allowBackup="true"
         android:dataExtractionRules="@xml/data_extraction_rules"
         android:enableOnBackInvokedCallback="true"

android/app/src/main/java/com/gregshuflin/synchronicity/AppViewModel.kt

@@ -11,17 +11,16 @@ import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 import uniffi.synchronicity.AgentInfo
+import uniffi.synchronicity.getAgents
 
 /**
  * App-level state for the root composable: opening the shared native store, loading the agent
  * registry, and the initial node-initialized routing decision.
  *
- * This owns the process-wide [NativeLib] handle and runs the blocking store init off the main
- * thread in [viewModelScope], so the work survives configuration changes instead of restarting on
- * every recomposition.
+ * It runs the blocking [NativeLib] store init off the main thread in [viewModelScope], so the work
+ * survives configuration changes instead of restarting on every recomposition.
  */
 class AppViewModel(application: Application) : AndroidViewModel(application) {
-    val nativeLib = NativeLib()
 
     private val _uiState = MutableStateFlow<AppUiState>(AppUiState.Loading)
     val uiState: StateFlow<AppUiState> = _uiState.asStateFlow()
@@ -33,10 +32,10 @@ class AppViewModel(application: Application) : AndroidViewModel(application) {
             // must route to the Error screen rather than crash the process.
             @Suppress("TooGenericExceptionCaught")
             try {
-                withContext(Dispatchers.IO) { nativeLib.initialize(getApplication()) }
+                withContext(Dispatchers.IO) { NativeLib.initialize(getApplication()) }
             } catch (e: Throwable) {
                 Log.e(TAG, "Failed to initialize store", e)
-                _uiState.value = AppUiState.Error(e.message ?: e.toString())
+                _uiState.value = AppUiState.Error(e.userMessage)
                 return@launch
             }
 
@@ -46,7 +45,7 @@ class AppViewModel(application: Application) : AndroidViewModel(application) {
             @Suppress("TooGenericExceptionCaught")
             val agents =
                 try {
-                    nativeLib.getAgents()
+                    getAgents()
                 } catch (e: Throwable) {
                     Log.e(TAG, "Failed to load agents", e)
                     agentLoadError = e.toString()
@@ -54,10 +53,11 @@ class AppViewModel(application: Application) : AndroidViewModel(application) {
                 }
 
             val nodeInitialized =
-                nativeLib.nodeInitialized().getOrElse { e ->
-                    Log.e(TAG, "Failed to check node initialization status", e)
-                    false
-                }
+                NativeLib.ffi { nodeInitialized() }
+                    .getOrElse { e ->
+                        Log.e(TAG, "Failed to check node initialization status", e)
+                        false
+                    }
 
             _uiState.value =
                 AppUiState.Ready(

android/app/src/main/java/com/gregshuflin/synchronicity/BatchImport.kt

@@ -0,0 +1,130 @@
+package com.gregshuflin.synchronicity
+
+import android.content.Context
+import android.net.Uri
+import android.util.Log
+import java.io.File
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import uniffi.synchronicity.ImportBatch
+import uniffi.synchronicity.ImportBatchSummary
+import uniffi.synchronicity.SyncException
+
+private const val TAG = "BatchImport"
+
+/**
+ * Open a batch import: one tracked, cancelable job covering [totalFiles] files holding roughly
+ * [totalBytes] bytes, fed one file at a time through the returned [BatchImport]. Both totals are
+ * counted by the caller before it starts — see `DocumentDirectoryImport.kt`'s tree pass — and
+ * become the Jobs screen's denominators.
+ *
+ * [source] identifies the folder (its tree URI); [label] is the readable name the Jobs screen
+ * shows. Fails with `SyncException.Busy` when an import of the same [source] is already running:
+ * this is the one import path on this side that goes through the live `JobRunner`, so it dedups.
+ */
+fun NativeLib.beginImportBatch(
+    source: String,
+    label: String,
+    totalFiles: Int,
+    totalBytes: Long,
+): Result<BatchImport> = ffi {
+    BatchImport(import().beginBatch(source, label, totalFiles.toUInt(), totalBytes.toULong()))
+}
+
+/**
+ * Import one file the user picked, through the same dispatch a folder import uses (Rust's
+ * `SUPPORTED_FILE_TYPES`), as a one-file tracked job on the Jobs screen — the instant-feedback
+ * invariant. Succeeds with the picked file's display name. A file no supported type recognizes is a
+ * failure here rather than a skip, since the user asked for this one in particular.
+ *
+ * The file's MIME type rides along as the dispatch fallback for a name with no extension. A failure
+ * comes back as a failed [Result] for the caller to report through the snackbar (docs/adr/0021).
+ */
+suspend fun NativeLib.importPickedFile(context: Context, uri: Uri): Result<String> =
+    withContext(Dispatchers.IO) {
+        val name = getFileNameFromUri(context, uri) ?: "import"
+        val copy =
+            copyToImportCache(context, uri)
+                ?: return@withContext Result.failure(
+                    SyncException.InvalidInput("Could not read $name")
+                )
+        try {
+            result {
+                val batch = beginImportBatch(uri.toString(), name, 1, copy.length()).bind()
+                val imported =
+                    batch.importFile(name, context.contentResolver.getType(uri), copy, null).also {
+                        batch.finish()
+                    }
+                imported.bind()
+                    ?: return@withContext Result.failure(
+                        SyncException.InvalidInput("Unsupported file type: $name")
+                    )
+                name
+            }
+        } finally {
+            copy.delete()
+        }
+    }
+
+/**
+ * Stream [uri]'s content into a new file in the app's cache, for [BatchImport.importFile] to take
+ * over — rather than reading it into a `ByteArray`, which for a large video or PDF is the whole
+ * file in the heap. The caller deletes it afterwards; if the import got as far as moving it into
+ * Rust's staging, that delete finds nothing.
+ *
+ * Null, logged, when the content can't be opened or copied: a picker hands out URIs that fail to
+ * open for a dozen unrelated reasons, none of which should stop the rest of a folder import.
+ */
+@Suppress("TooGenericExceptionCaught")
+fun copyToImportCache(context: Context, uri: Uri): File? {
+    var copy: File? = null
+    return try {
+        context.contentResolver.openInputStream(uri)?.use { source ->
+            File.createTempFile("import-", null, context.cacheDir).also { file ->
+                copy = file
+                file.outputStream().use { source.copyTo(it) }
+            }
+        }
+    } catch (e: Exception) {
+        Log.i(TAG, "Could not read $uri", e)
+        copy?.delete()
+        null
+    }
+}
+
+/**
+ * One batch import in progress — the Kotlin half of `ffi.rs`'s `ImportBatch`, wrapping each call in
+ * [ffiCatching].
+ *
+ * The loop stays here because only Kotlin can read a Storage Access Framework tree; everything else
+ * about the import — dispatching each file to the right importer, counting files and bytes,
+ * reporting progress, and finalizing the job — is on the Rust side. [finish] must be reached on
+ * every path, including failures, or the job is only finalized when the object is eventually
+ * collected.
+ */
+class BatchImport internal constructor(private val batch: ImportBatch) {
+
+    /** Whether the Jobs screen's Cancel button has been pressed for this import. */
+    fun isCanceled(): Boolean = batch.isCanceled()
+
+    /**
+     * Import [file], a copy from [copyToImportCache], under the name the user knows it by. Succeeds
+     * with the new document id, or with null when no supported type recognized the file (a skip,
+     * not a failure). [mimeType] is only a fallback for dispatch, used when [fileName] has no
+     * extension a supported type claims.
+     */
+    fun importFile(
+        fileName: String,
+        mimeType: String?,
+        file: File,
+        parentId: String?,
+    ): Result<String?> = ffiCatching { batch.importFile(fileName, mimeType, file.path, parentId) }
+
+    /** Count a file the caller couldn't read, so the job's denominator still advances. */
+    fun skipFile(fileName: String, byteSize: Long, reason: String) {
+        batch.skipFile(fileName, byteSize.toULong(), reason)
+    }
+
+    /** Finalize the job and report what the batch did. Safe to call more than once. */
+    fun finish(): ImportBatchSummary = batch.finish()
+}

android/app/src/main/java/com/gregshuflin/synchronicity/ChangesAgent.kt

@@ -1,33 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import uniffi.synchronicity.ChangeCursor
-
-/**
- * Kotlin wrapper for the store-change signal's FFI surface — mirrors [JobsAgent]'s pattern: one
- * method per [uniffi.synchronicity.ChangesFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.changes]. Screens do not call this directly; they collect
- * [StoreChanges.cursor], which runs one wait for the whole process. See ADR 0041.
- */
-class ChangesAgent internal constructor(private val nativeLib: NativeLib) {
-
-    /**
-     * Where every channel's revision counter stands right now — the cursor to start a watch from,
-     * so the first [wait] waits for the *next* change rather than reporting what is already on
-     * screen.
-     */
-    fun cursor(): Result<ChangeCursor> = ffiCatching { nativeLib.node().changes().cursor() }
-
-    /**
-     * Blocks until something in the store changes past [since], or [timeoutMs] elapses, returning
-     * the cursor as of waking — pass it back as [since] next time so a change that lands while the
-     * caller is reloading isn't slept through.
-     *
-     * **Blocks the calling thread**, so call it off the main one. A cancelled coroutine can't
-     * interrupt the call, so [timeoutMs] is also what bounds how long a thread stays parked after
-     * whoever was waiting goes away.
-     */
-    fun wait(since: ChangeCursor, timeoutMs: Long): Result<ChangeCursor> = ffiCatching {
-        nativeLib.node().changes().wait(since, timeoutMs.toULong())
-    }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/ClippingsAgent.kt

@@ -1,47 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import uniffi.synchronicity.ClippingItem
-import uniffi.synchronicity.ClippingPage
-import uniffi.synchronicity.DocumentCursor
-
-/**
- * Kotlin wrapper for the Clippings agent's FFI surface — mirrors [NotebookAgent]'s pattern: one
- * method per [uniffi.synchronicity.ClippingsFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.clippings], so call sites read `nativeLib.clippings.list()` instead of
- * `nativeLib.clippingsList()` string-prefix pseudo-namespacing.
- *
- * No `update`: a clipping's body is last-write-wins, so editing one needs the alert-don't-apply
- * flow around it, and the Rust side does not export a write without it. See `ffi/clippings.rs`.
- */
-class ClippingsAgent internal constructor(private val nativeLib: NativeLib) {
-
-    /**
-     * One page of clippings, newest first, with the cursor for the next.
-     *
-     * Pass `null` for the first page and the previous page's `nextCursor` for each one after it; a
-     * null cursor coming back is the end of the collection. The page size is the Rust side's, not
-     * this screen's — it is a property of the read underneath.
-     */
-    fun listPage(cursor: DocumentCursor?): Result<ClippingPage> = ffiCatching {
-        nativeLib.node().clippings().listPage(cursor)
-    }
-
-    fun get(id: String): Result<ClippingItem?> = ffiCatching {
-        nativeLib.node().clippings().get(id)
-    }
-
-    /**
-     * Keep [text] as a new clipping, and return its id.
-     *
-     * The caller names no destination — this node resolves where clippings are filed, the same way
-     * it does for the browser extension's captures (ADR 0039).
-     */
-    fun capture(text: String, sourceUrl: String?, pageTitle: String?): Result<String> =
-        ffiCatching {
-            nativeLib.node().clippings().capture(text, sourceUrl, pageTitle)
-        }
-
-    /** Delete a clipping on this node. */
-    fun delete(id: String): Result<Unit> = ffiCatching { nativeLib.node().clippings().delete(id) }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/ComicsAgent.kt

@@ -1,152 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import android.util.Log
-import uniffi.synchronicity.BookmarkInfo
-import uniffi.synchronicity.ComicMetadata
-import uniffi.synchronicity.ComicTreeItem
-import uniffi.synchronicity.ReadingDirection
-
-private const val TAG = "ComicsAgent"
-
-/**
- * Kotlin wrapper for the Comics agent's FFI surface — mirrors [NotebookAgent]'s pattern: one method
- * per [uniffi.synchronicity.ComicsFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.comics], so call sites read `nativeLib.comics.list()` instead of
- * `nativeLib.listComics()` string-prefix pseudo-namespacing.
- *
- * The comic library is a hierarchy of Collection groupings and Comic leaves ([ComicTreeItem]); a
- * comic's pages are Image child documents whose bytes are fetched with [getPageBytes] over the ids
- * from [listPageIds].
- */
-@Suppress("TooManyFunctions") // one method per ComicsFfi method — see NativeLib's own suppression
-class ComicsAgent internal constructor(private val nativeLib: NativeLib) {
-
-    /** The full comics library hierarchy (unsorted, flat — group by [ComicTreeItem.parentId]). */
-    fun list(): Result<List<ComicTreeItem>> = ffiCatching { nativeLib.node().comics().list() }
-
-    /** A comic's expected total page count; can exceed [listPageIds]'s size while syncing. */
-    fun pageCount(comicId: String): Result<UInt> = ffiCatching {
-        nativeLib.node().comics().pageCount(comicId)
-    }
-
-    /**
-     * Document ids of the comic's pages, in reading order; load each via [getPageBytes]. A listed
-     * page's *document* has synced here — its image blob may still be on another node.
-     */
-    fun listPageIds(comicId: String): Result<List<String>> = ffiCatching {
-        nativeLib.node().comics().listPageIds(comicId)
-    }
-
-    /**
-     * One page's raw (still-encoded) image bytes, from the local blob store or streamed from a peer
-     * that holds it (ADR 0016) — so a comic that hasn't synced here still reads. Blocking for as
-     * long as the peer takes; call it off the main thread.
-     *
-     * Null means the page is genuinely not obtainable right now (no reachable peer serves it, or
-     * P2P isn't running) — a state for the reader to render, not a crash. Compare
-     * [DocumentsAgent.getBlobBytes], which is the local half alone.
-     */
-    fun getPageBytes(pageId: String): ByteArray? =
-        ffiCatching { nativeLib.node().comics().getPageBytes(pageId) }
-            .onFailure { Log.w(TAG, "Page $pageId not available locally or from any peer", it) }
-            .getOrNull()
-
-    /**
-     * [getPageBytes] for the read-ahead — the pages [pagesNeedingPrefetch] named, which the user
-     * did not ask for and is not waiting on.
-     *
-     * Identical but for one thing: no job row. Three speculative rows per page turn would bury the
-     * one page the reader is actually blocked on, which is the row that matters.
-     */
-    fun prefetchPageBytes(pageId: String): ByteArray? =
-        ffiCatching { nativeLib.node().comics().prefetchPageBytes(pageId) }
-            .onFailure { Log.w(TAG, "Read-ahead of page $pageId did not land", it) }
-            .getOrNull()
-
-    /**
-     * Which of [pageIds] the reader should fetch ahead of itself while sitting on [currentIndex] —
-     * the pages in the read-ahead window whose blobs aren't stored here. Cheap and local (no
-     * network), so it's fine to call on every page turn; the caller walks the result through
-     * [prefetchPageBytes] and caches what lands.
-     */
-    fun pagesNeedingPrefetch(pageIds: List<String>, currentIndex: Int): List<String> =
-        ffiCatching {
-                nativeLib.node().comics().pagesNeedingPrefetch(pageIds, currentIndex.toUInt())
-            }
-            .onFailure { Log.w(TAG, "Failed to compute the prefetch window", it) }
-            .getOrDefault(emptyList())
-
-    // The cover (first page) may not be synced yet (NotFound), which is normal, so
-    // absence collapses to null just as [NativeLib.getDocumentBlobBytes] does.
-    fun getCoverBytes(comicId: String): ByteArray? =
-        ffiCatching { nativeLib.node().comics().getCoverBytes(comicId) }
-            .onFailure { Log.w(TAG, "Cover not available for comic $comicId", it) }
-            .getOrNull()
-
-    fun getMetadata(comicId: String): Result<ComicMetadata> = ffiCatching {
-        nativeLib.node().comics().getMetadata(comicId)
-    }
-
-    /**
-     * The reader's last-viewed page (0-based), or null when unread — mirrors
-     * [PdfAgent.getReadingProgress].
-     */
-    fun getReadingProgress(comicId: String): Result<UInt?> = ffiCatching {
-        nativeLib.node().comics().getReadingProgress(comicId)
-    }
-
-    fun setReadingProgress(comicId: String, page: UInt): Result<Unit> = ffiCatching {
-        nativeLib.node().comics().setReadingProgress(comicId, page)
-    }
-
-    /**
-     * [nodeId]'s own explicit reading-direction setting, if any — `null` means unset, not
-     * left-to-right. Callers resolve the effective direction for a chapter by walking up to its
-     * series root (see [ComicTreeItem.readingDirection]'s doc comment).
-     */
-    fun getReadingDirection(nodeId: String): Result<ReadingDirection?> = ffiCatching {
-        nativeLib.node().comics().getReadingDirection(nodeId)
-    }
-
-    /**
-     * Set [nodeId]'s explicit reading-direction setting — conventionally called on a series' root
-     * so the whole series shares one setting.
-     */
-    fun setReadingDirection(nodeId: String, direction: ReadingDirection): Result<Unit> =
-        ffiCatching {
-            nativeLib.node().comics().setReadingDirection(nodeId, direction)
-        }
-
-    /** The child issue last opened under a series collection, for "continue reading". */
-    fun getLatestReadChild(parentId: String): Result<String?> = ffiCatching {
-        nativeLib.node().comics().getLatestReadChild(parentId)
-    }
-
-    fun setLatestReadChild(parentId: String, childId: String): Result<Unit> = ffiCatching {
-        nativeLib.node().comics().setLatestReadChild(parentId, childId)
-    }
-
-    fun listBookmarks(comicId: String): Result<List<BookmarkInfo>> = ffiCatching {
-        nativeLib.node().comics().listBookmarks(comicId)
-    }
-
-    fun addBookmark(comicId: String, page: UInt): Result<Unit> = ffiCatching {
-        nativeLib.node().comics().addBookmark(comicId, page)
-    }
-
-    fun deleteBookmark(comicId: String, bookmarkId: String): Result<Unit> = ffiCatching {
-        nativeLib.node().comics().deleteBookmark(comicId, bookmarkId)
-    }
-
-    /**
-     * Import a `.cbz` archive's bytes as a new Comic under [parentId] (or root); returns its id.
-     */
-    fun importArchive(
-        fileName: String,
-        archiveBytes: ByteArray,
-        parentId: String? = null,
-    ): Result<String> = ffiCatching {
-        nativeLib.node().comics().importArchive(fileName, archiveBytes, parentId)
-    }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/CredentialsAgent.kt

@@ -1,35 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import uniffi.synchronicity.ServiceCredential
-import uniffi.synchronicity.ServiceId
-
-/**
- * Kotlin wrapper for the service-credential FFI surface — mirrors [NotebookAgent]'s pattern: one
- * method per [uniffi.synchronicity.CredentialsFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.credentials], so call sites read `nativeLib.credentials.services()`.
- *
- * There is no read-back of a stored secret, and there is not meant to be: see the Rust module's doc
- * comment. [services] answers whether a key is set, which is the only question a settings screen
- * has.
- */
-class CredentialsAgent internal constructor(private val nativeLib: NativeLib) {
-
-    /** Every service this app can hold a key for, and what is stored for each. */
-    fun services(): Result<List<ServiceCredential>> = ffiCatching {
-        nativeLib.node().credentials().services()
-    }
-
-    /**
-     * Seal one field of [service]'s credential. Callers skip blank inputs rather than sending them,
-     * so re-entering half a credential does not wipe the other half.
-     */
-    fun setField(service: ServiceId, field: String, value: String): Result<Unit> = ffiCatching {
-        nativeLib.node().credentials().setField(service, field, value)
-    }
-
-    /** Forget [service]'s key on every node in the ensemble. */
-    fun clear(service: ServiceId): Result<Unit> = ffiCatching {
-        nativeLib.node().credentials().clear(service)
-    }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/DocumentsAgent.kt

@@ -1,125 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import android.util.Log
-import uniffi.synchronicity.DocumentArtifactItem
-import uniffi.synchronicity.DocumentBlobRefItem
-import uniffi.synchronicity.DocumentCursor
-import uniffi.synchronicity.DocumentItem
-import uniffi.synchronicity.DocumentNodeStatusItem
-import uniffi.synchronicity.DocumentPage
-import uniffi.synchronicity.DocumentPlacementView
-import uniffi.synchronicity.DocumentPropertyItem
-
-private const val TAG = "DocumentsAgent"
-
-/**
- * Kotlin wrapper for the generic (agent-independent) document FFI surface — mirrors
- * [NotebookAgent]'s pattern: one method per [uniffi.synchronicity.DocumentsFfi] method, each
- * wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.documents], so call sites read `nativeLib.documents.search(...)` instead of
- * `nativeLib.searchDocuments(...)` string-prefix pseudo-namespacing.
- */
-@Suppress(
-    "TooManyFunctions"
-) // one method per DocumentsFfi method — see NativeLib's own suppression
-class DocumentsAgent internal constructor(private val nativeLib: NativeLib) {
-
-    // A lookup whose null result means "no such document" — a normal outcome.
-    fun get(documentId: String): DocumentItem? =
-        ffiCatching { nativeLib.node().documents().get(documentId) }
-            .onFailure { Log.w(TAG, "Failed to load document $documentId", it) }
-            .getOrNull()
-
-    fun listProperties(documentId: String): Result<List<DocumentPropertyItem>> = ffiCatching {
-        nativeLib.node().documents().listProperties(documentId)
-    }
-
-    fun listNodeStatuses(documentId: String): Result<List<DocumentNodeStatusItem>> = ffiCatching {
-        nativeLib.node().documents().listNodeStatuses(documentId)
-    }
-
-    /**
-     * Where this document's content sits across the ensemble — the Placement table. This node
-     * first, then every peer.
-     *
-     * One call rather than assembling ensemble members, this node's override, and per-node document
-     * status in Kotlin: doing that here is how the two modalities drift, and the desktop reads the
-     * same rows from the same place.
-     *
-     * Walks the subtree and stats a file per content artifact, so call it off the main thread.
-     */
-    fun documentPlacement(documentId: String): Result<DocumentPlacementView> = ffiCatching {
-        nativeLib.node().documents().documentPlacement(documentId)
-    }
-
-    fun listArtifacts(documentId: String): Result<List<DocumentArtifactItem>> = ffiCatching {
-        nativeLib.node().documents().listArtifacts(documentId)
-    }
-
-    fun listBlobRefs(documentId: String): Result<List<DocumentBlobRefItem>> = ffiCatching {
-        nativeLib.node().documents().listBlobRefs(documentId)
-    }
-
-    fun search(
-        searchQuery: String?,
-        documentTypes: Array<String>,
-        dateFilter: String?,
-    ): Result<List<DocumentItem>> = ffiCatching {
-        nativeLib.node().documents().search(searchQuery, documentTypes.toList(), dateFilter)
-    }
-
-    /**
-     * Keyset-paginated document search. Pass [cursor] = null for the first page. [onlyRoots]
-     * restricts the page to top-level documents (no parent); pass `false` to get every matching
-     * document flat (e.g. while searching). [includeHidden] overrides the default exclusion of
-     * hidden documents — agent-derived music artists/albums, and agents' own settings rows.
-     */
-    @Suppress("LongParameterList") // mirrors the Rust DocumentsFfi::search_page signature
-    fun searchPage(
-        searchQuery: String?,
-        documentTypes: Array<String>,
-        dateFilter: String?,
-        onlyRoots: Boolean,
-        includeHidden: Boolean,
-        cursor: DocumentCursor?,
-        limit: Int,
-    ): Result<DocumentPage> = ffiCatching {
-        nativeLib
-            .node()
-            .documents()
-            .searchPage(
-                searchQuery,
-                documentTypes.toList(),
-                dateFilter,
-                onlyRoots,
-                includeHidden,
-                cursor,
-                limit.toUInt(),
-            )
-    }
-
-    /** Direct children of [parentId], for expanding a turnstile in the documents list. */
-    fun listChildren(parentId: String): Result<List<DocumentItem>> = ffiCatching {
-        nativeLib.node().documents().listChildren(parentId)
-    }
-
-    // A blob that isn't present locally yet (NotFound) is normal — e.g. catalogue
-    // metadata synced ahead of the blob — so absence collapses to null.
-    fun getBlobBytes(documentId: String): ByteArray? =
-        ffiCatching { nativeLib.node().documents().getBlobBytes(documentId) }
-            .onFailure { Log.w(TAG, "Blob not available for document $documentId", it) }
-            .getOrNull()
-
-    fun isBlobLocal(documentId: String): Boolean =
-        ffiCatching { nativeLib.node().documents().isBlobLocal(documentId) }.getOrDefault(false)
-
-    // Streams the blob from a peer, decrypts it, and writes plaintext to outputPath.
-    // Does not store anything in the local blob store — the file is for temporary playback.
-    // Returns false (rather than a Result) since "couldn't fetch from any peer" is an
-    // expected outcome the caller handles by falling back.
-    fun fetchBlobToPath(documentId: String, outputPath: String): Boolean =
-        ffiCatching { nativeLib.node().documents().fetchBlobToPath(documentId, outputPath) }
-            .onFailure { Log.w(TAG, "Failed to stream blob from peers for $documentId", it) }
-            .isSuccess
-}

android/app/src/main/java/com/gregshuflin/synchronicity/EnsembleAgent.kt

@@ -1,113 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import uniffi.synchronicity.DocumentAssetRef
-import uniffi.synchronicity.DocumentPushResult
-import uniffi.synchronicity.DocumentSyncResult
-import uniffi.synchronicity.EnsembleStatus
-import uniffi.synchronicity.PurgeResult
-import uniffi.synchronicity.RetirementRound
-import uniffi.synchronicity.RetirementStart
-import uniffi.synchronicity.RevokedNodeInfo
-import uniffi.synchronicity.SyncDocumentsResult
-
-/**
- * Kotlin wrapper for the Ensemble/P2P FFI surface — mirrors [NotebookAgent]'s pattern: one method
- * per [uniffi.synchronicity.EnsembleFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.ensemble], so call sites read `nativeLib.ensemble.getEnsembleStatus()`
- * instead of `nativeLib.getEnsembleStatus()` string-prefix pseudo-namespacing.
- */
-@Suppress("TooManyFunctions") // one method per EnsembleFfi method — see NativeLib's own suppression
-class EnsembleAgent internal constructor(private val nativeLib: NativeLib) {
-
-    fun joinExistingEnsemble(keyphrase: String, nodeName: String?): Result<Unit> = ffiCatching {
-        nativeLib.node().ensemble().joinExistingEnsemble(keyphrase, nodeName)
-    }
-
-    fun getEnsembleStatus(): Result<EnsembleStatus> = ffiCatching {
-        nativeLib.node().ensemble().getEnsembleStatus()
-    }
-
-    // Infallible: returns 0 when the P2P node isn't running rather than erroring.
-    fun getGossipNeighborCount(): Int = nativeLib.node().ensemble().getGossipNeighborCount().toInt()
-
-    fun triggerGossipBootstrap(): Result<Unit> = ffiCatching {
-        nativeLib.node().ensemble().triggerGossipBootstrap()
-    }
-
-    fun startP2PNode(): Result<Unit> = ffiCatching { nativeLib.node().ensemble().startP2pNode() }
-
-    fun stopP2PNode(): Result<Unit> = ffiCatching { nativeLib.node().ensemble().stopP2pNode() }
-
-    // Revoke another node's credential with the ensemble key. The keyphrase is the whole
-    // authorization story, and is also what supplies the confirmation a destructive act needs —
-    // which is why the screen offering this has no separate "are you sure".
-    fun revokePeer(nodeIdHex: String, keyphrase: String): Result<RevokedNodeInfo> = ffiCatching {
-        nativeLib.node().ensemble().revokePeer(nodeIdHex, keyphrase)
-    }
-
-    // Take a revocation record carried here by hand — the repair path for a node retired with
-    // nobody listening. Verified exactly as one off the wire is.
-    fun importRevocation(blob: String): Result<RevokedNodeInfo> = ffiCatching {
-        nativeLib.node().ensemble().importRevocation(blob)
-    }
-
-    // Start retiring *this* node. One-way: from here it serves and dials nothing but revocation
-    // delivery. Nothing is deleted — the caller drives [pushRetirementRound] and then
-    // [NodeReset.perform].
-    fun beginRetirement(): Result<RetirementStart> = ffiCatching {
-        nativeLib.node().ensemble().beginRetirement()
-    }
-
-    // Offer the record to every known peer once, stopping at the first that commits it. One round
-    // per call, so the screen can stay in front of the user and say what it is trying.
-    fun pushRetirementRound(recordBlob: String): Result<RetirementRound> = ffiCatching {
-        nativeLib.node().ensemble().pushRetirementRound(recordBlob)
-    }
-
-    fun pingNode(nodeIdHex: String, timeoutSecs: Int): Result<Double> = ffiCatching {
-        nativeLib.node().ensemble().pingNode(nodeIdHex, timeoutSecs.toUInt())
-    }
-
-    fun syncDocuments(nodeIdHex: String): Result<SyncDocumentsResult> = ffiCatching {
-        nativeLib.node().ensemble().syncDocuments(nodeIdHex)
-    }
-
-    // Pull this document's missing artifacts, and those of every descendant
-    // document, from ensemble peers into the local node, persisting everything
-    // fetched. Backs the document-detail "Sync to this node" control, which
-    // recurses into the whole subtree.
-    fun syncDocumentAssets(documentId: String): Result<DocumentSyncResult> = ffiCatching {
-        nativeLib.node().ensemble().syncDocumentAssets(documentId)
-    }
-
-    // Pull one artifact of this document from ensemble peers — the per-row "Sync"
-    // button in the document-detail Artifacts section. The narrow counterpart to
-    // syncDocumentAssets, which stays the bulk action: this fetches exactly the
-    // named artifact and doesn't recurse into child documents.
-    fun syncDocumentAsset(documentId: String, asset: DocumentAssetRef): Result<DocumentSyncResult> =
-        ffiCatching {
-            nativeLib.node().ensemble().syncDocumentAsset(documentId, asset)
-        }
-
-    // Push this document (and every descendant) to one specific ensemble member:
-    // the write-side counterpart to syncDocumentAssets. Backs the document-detail
-    // "Push now" button on each "Sync to other node" row.
-    fun pushDocument(documentId: String, nodeIdHex: String): Result<DocumentPushResult> =
-        ffiCatching {
-            nativeLib.node().ensemble().pushDocument(documentId, nodeIdHex)
-        }
-
-    // Number of descendants a document has. Backs the "Purge" confirmation dialog's
-    // warning about how many child documents will also be purged.
-    fun countDocumentDescendants(documentId: String): Result<UInt> = ffiCatching {
-        nativeLib.node().ensemble().countDocumentDescendants(documentId)
-    }
-
-    // Permanently purges a document (and its descendants): deletes it locally and
-    // broadcasts a delete intent to the rest of the ensemble. Backs the document-detail
-    // "Purge" control.
-    fun purgeDocument(documentId: String): Result<PurgeResult> = ffiCatching {
-        nativeLib.node().ensemble().purgeDocument(documentId)
-    }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/EvictionAgent.kt

@@ -1,54 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import uniffi.synchronicity.DocumentType
-import uniffi.synchronicity.EvictionOutcomeItem
-import uniffi.synchronicity.EvictionPlanItem
-
-/**
- * Kotlin wrapper for the last-copy guard's FFI surface — mirrors [NotebookAgent]'s pattern: one
- * method per [uniffi.synchronicity.EvictionFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.eviction], so call sites read
- * `nativeLib.eviction.evaluateDeleteLocally(...)` instead of `nativeLib.evaluateDeleteLocally(...)`
- * string-prefix pseudo-namespacing.
- */
-class EvictionAgent internal constructor(private val nativeLib: NativeLib) {
-
-    // Gather evidence for deleting a document's subtree's locally-held blob bytes —
-    // read-only. Backs the document-detail "Delete Locally" confirmation dialog.
-    fun evaluateDeleteLocally(documentId: String): Result<EvictionPlanItem> = ffiCatching {
-        nativeLib.node().eviction().evaluateDeleteLocally(documentId)
-    }
-
-    // Deletes what evaluateDeleteLocally found safe to delete. allowUnverified is
-    // re-checked against the buried Settings override at execute time, not trusted
-    // from the caller.
-    fun executeDeleteLocally(
-        documentId: String,
-        allowUnverified: Boolean,
-    ): Result<EvictionOutcomeItem> = ffiCatching {
-        nativeLib.node().eviction().executeDeleteLocally(documentId, allowUnverified)
-    }
-
-    // Type-scoped counterpart to evaluateDeleteLocally, backing the Sync policy
-    // screen's per-type "N no longer wanted by policy — Reclaim…" affordance.
-    fun evaluateTypeReclaim(docType: DocumentType): Result<EvictionPlanItem> = ffiCatching {
-        nativeLib.node().eviction().evaluateTypeReclaim(docType)
-    }
-
-    fun executeTypeReclaim(
-        docType: DocumentType,
-        allowUnverified: Boolean,
-    ): Result<EvictionOutcomeItem> = ffiCatching {
-        nativeLib.node().eviction().executeTypeReclaim(docType, allowUnverified)
-    }
-
-    /** The buried "allow deleting unverified content" override — off by default. */
-    fun getAllowUnverifiedDeletion(): Result<Boolean> = ffiCatching {
-        nativeLib.node().eviction().getAllowUnverifiedDeletion()
-    }
-
-    fun setAllowUnverifiedDeletion(allow: Boolean): Result<Unit> = ffiCatching {
-        nativeLib.node().eviction().setAllowUnverifiedDeletion(allow)
-    }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/FfiResult.kt

@@ -1,5 +1,6 @@
 package com.gregshuflin.synchronicity
 
+import android.util.Log
 import kotlinx.coroutines.CancellationException
 import uniffi.synchronicity.SyncException
 
@@ -19,9 +20,8 @@ import uniffi.synchronicity.SyncException
  * `launchReportingFailure`). [CancellationException] is rethrown, never captured: coroutine
  * cancellation depends on it propagating.
  *
- * Shared by [NativeLib] and its per-agent handles (e.g. [NotebookAgent]) so every uniffi call
- * anywhere in the app goes through the same totality guarantee, rather than each handle
- * reimplementing it.
+ * [NativeLib.ffi] wraps every call on the node in this, so every uniffi call anywhere in the app
+ * goes through the same totality guarantee.
  */
 @Suppress("TooGenericExceptionCaught")
 internal inline fun <T> ffiCatching(block: () -> T): Result<T> =
@@ -34,3 +34,11 @@ internal inline fun <T> ffiCatching(block: () -> T): Result<T> =
     } catch (e: Exception) {
         Result.failure(SyncException.Internal("internal error: $e"))
     }
+
+/**
+ * A best-effort read: the value, or null once the failure is logged. For optional resources — a
+ * cover, a page that hasn't synced here — where absence is normal and the caller draws a
+ * placeholder rather than an error.
+ */
+fun <T> Result<T>.getOrLog(tag: String, what: String): T? =
+    onFailure { Log.w(tag, what, it) }.getOrNull()

android/app/src/main/java/com/gregshuflin/synchronicity/HumansAgent.kt

@@ -1,87 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import uniffi.synchronicity.BacklinkItem
-import uniffi.synchronicity.ContactProtocolItem
-import uniffi.synchronicity.HumanListItem
-import uniffi.synchronicity.HumanProfile
-
-/**
- * Kotlin wrapper for the Humans agent's FFI surface — mirrors [NotebookAgent]'s pattern: one method
- * per [uniffi.synchronicity.HumansFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.humans], so call sites read `nativeLib.humans.list()` instead of
- * `nativeLib.humansList()` string-prefix pseudo-namespacing.
- */
-@Suppress("TooManyFunctions") // one method per HumansFfi method — see NativeLib's own suppression
-class HumansAgent internal constructor(private val nativeLib: NativeLib) {
-
-    /** Interactions — the same Rust object, split off so each vocabulary reads on its own. */
-    val interactions: InteractionsAgent = InteractionsAgent(nativeLib)
-
-    fun list(): Result<List<HumanListItem>> = ffiCatching { nativeLib.node().humans().list() }
-
-    fun create(fullName: String): Result<String> = ffiCatching {
-        nativeLib.node().humans().create(fullName)
-    }
-
-    fun get(id: String): Result<HumanProfile> = ffiCatching { nativeLib.node().humans().get(id) }
-
-    @Suppress("LongParameterList") // mirrors the Rust HumansFfi::update signature
-    fun update(
-        id: String,
-        fullName: String,
-        nickname: String,
-        birthDate: String,
-        gender: String,
-        genderOther: String,
-        notes: String,
-    ): Result<Unit> = ffiCatching {
-        nativeLib
-            .node()
-            .humans()
-            .update(id, fullName, nickname, birthDate, gender, genderOther, notes)
-    }
-
-    /**
-     * Record a value under [key]. A second, different value under a key that already has one makes
-     * that key multi-valued; re-adding the same value is a no-op.
-     */
-    fun addFact(id: String, key: String, value: String): Result<Unit> = ffiCatching {
-        nativeLib.node().humans().addFact(id, key, value)
-    }
-
-    /** Remove one value under [key]; returns whether it was there. */
-    fun removeFact(id: String, key: String, value: String): Result<Boolean> = ffiCatching {
-        nativeLib.node().humans().removeFact(id, key, value)
-    }
-
-    /** Every protocol the contact-method picker offers, in display order. */
-    fun contactProtocols(): Result<List<ContactProtocolItem>> = ffiCatching {
-        nativeLib.node().humans().contactProtocols()
-    }
-
-    /**
-     * Record a way of reaching this person. [protocol] is a slug from [contactProtocols], or
-     * `other:<name>`; [value] is what the user typed, canonicalized on the Rust side.
-     */
-    fun addContactMethod(id: String, protocol: String, value: String, label: String): Result<Unit> =
-        ffiCatching {
-            nativeLib.node().humans().addContactMethod(id, protocol, value, label)
-        }
-
-    /** Remove a contact method, keyed on the canonical [value] the profile carries. */
-    fun removeContactMethod(id: String, protocol: String, value: String): Result<Boolean> =
-        ffiCatching {
-            nativeLib.node().humans().removeContactMethod(id, protocol, value)
-        }
-
-    fun delete(id: String): Result<Unit> = ffiCatching { nativeLib.node().humans().delete(id) }
-
-    /**
-     * Every document that `[[wikilinks]]` to this one — where their name has been written down, as
-     * opposed to [InteractionsAgent.forHuman]'s record of having actually seen them.
-     */
-    fun backlinks(id: String): Result<List<BacklinkItem>> = ffiCatching {
-        nativeLib.node().humans().backlinks(id)
-    }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/ImportAgent.kt

@@ -1,111 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import uniffi.synchronicity.ImportBatchSummary
-
-/**
- * Kotlin wrapper for the generic (agent-independent) import FFI surface — mirrors [NotebookAgent]'s
- * pattern: one method per [uniffi.synchronicity.ImportFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.import], so call sites read `nativeLib.import.image(...)` instead of
- * `nativeLib.importImageDocument(...)` string-prefix pseudo-namespacing. PDF- and comics-specific
- * import stays on [PdfAgent]/[ComicsAgent] instead — see those classes' doc comments.
- */
-class ImportAgent internal constructor(private val nativeLib: NativeLib) {
-
-    fun image(
-        fileName: String,
-        fileExt: String,
-        imageBytes: ByteArray,
-        parentId: String? = null,
-    ): Result<String> = ffiCatching {
-        nativeLib.node().import().image(fileName, fileExt, imageBytes, parentId)
-    }
-
-    fun musicTrack(
-        fileName: String,
-        musicBytes: ByteArray,
-        parentId: String? = null,
-    ): Result<String> = ffiCatching {
-        nativeLib.node().import().musicTrack(fileName, musicBytes, parentId)
-    }
-
-    /**
-     * Whether a file of this name (and MIME type, when the picker reports one) is a type any
-     * importer would take. Asked before reading a file's bytes, so a folder import doesn't pull a
-     * video into memory only for Rust to skip it. Infallible: it's a question about the
-     * supported-type table, not about this node.
-     */
-    fun supports(fileName: String, mimeType: String?): Boolean =
-        nativeLib.node().import().supports(fileName, mimeType)
-
-    // Create a Collection document for organising imported files. A null parentId
-    // creates a root-level collection; otherwise a sub-collection under parentId.
-    fun createCollection(parentId: String?, title: String): Result<String> = ffiCatching {
-        nativeLib.node().import().createCollection(parentId, title)
-    }
-
-    fun fromUrl(url: String): Result<String> = ffiCatching {
-        nativeLib.node().import().fromUrl(url)
-    }
-
-    /**
-     * Open a batch import: one tracked, cancellable job covering [totalFiles] files holding roughly
-     * [totalBytes] bytes, fed one file at a time through the returned [BatchImport]. Both totals
-     * are counted by the caller before it starts — see `DocumentDirectoryImport.kt`'s tree pass —
-     * and become the Jobs screen's denominators.
-     *
-     * [source] identifies the folder (its tree URI); [label] is the readable name the Jobs screen
-     * shows. Fails with `SyncException.Busy` when an import of the same [source] is already
-     * running: this is the one import path on this side that goes through the live `JobRunner`, so
-     * it dedups.
-     */
-    fun beginBatch(
-        source: String,
-        label: String,
-        totalFiles: Int,
-        totalBytes: Long,
-    ): Result<BatchImport> = ffiCatching {
-        BatchImport(
-            nativeLib
-                .node()
-                .import()
-                .beginBatch(source, label, totalFiles.toUInt(), totalBytes.toULong())
-        )
-    }
-}
-
-/**
- * One batch import in progress — the Kotlin half of `ffi.rs`'s `ImportBatch`, wrapping each call in
- * [ffiCatching] the way [ImportAgent] does.
- *
- * The loop stays here because only Kotlin can read a Storage Access Framework tree; everything else
- * about the import — dispatching each file to the right importer, counting files and bytes,
- * reporting progress, and finalizing the job — is on the Rust side. [finish] must be reached on
- * every path, including failures, or the job is only finalized when the object is eventually
- * collected.
- */
-class BatchImport internal constructor(private val batch: uniffi.synchronicity.ImportBatch) {
-
-    /** Whether the Jobs screen's Cancel button has been pressed for this import. */
-    fun isCancelled(): Boolean = batch.isCancelled()
-
-    /**
-     * Import one file's bytes. Succeeds with the new document id, or with null when no supported
-     * type recognised the file (a skip, not a failure). [mimeType] is only a fallback for dispatch,
-     * used when [fileName] has no extension a supported type claims.
-     */
-    fun importFile(
-        fileName: String,
-        mimeType: String?,
-        bytes: ByteArray,
-        parentId: String?,
-    ): Result<String?> = ffiCatching { batch.importFile(fileName, mimeType, bytes, parentId) }
-
-    /** Count a file the caller couldn't read, so the job's denominator still advances. */
-    fun skipFile(fileName: String, byteSize: Long, reason: String) {
-        batch.skipFile(fileName, byteSize.toULong(), reason)
-    }
-
-    /** Finalize the job and report what the batch did. Safe to call more than once. */
-    fun finish(): ImportBatchSummary = batch.finish()
-}

android/app/src/main/java/com/gregshuflin/synchronicity/InteractionsAgent.kt

@@ -1,65 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import uniffi.synchronicity.InteractionDetail
-import uniffi.synchronicity.InteractionItem
-
-/**
- * Kotlin wrapper for the interaction half of the Humans agent's FFI surface, reached as
- * `nativeLib.humans.interactions`.
- *
- * A separate class from [HumansAgent] rather than more methods on it: an interaction is its own
- * document shared by everyone who was there, not a field of one person, and keeping the two
- * vocabularies apart also keeps each file under detekt's function-count threshold. Both still land
- * on the same Rust `HumansFfi` object.
- */
-class InteractionsAgent internal constructor(private val nativeLib: NativeLib) {
-
-    /**
-     * Record an interaction, returning its id.
-     *
-     * [occurredOn] is required and must be a canonical partial date — `2026-03-14`, `--03-14`, or
-     * `2026`. Being dated is what makes this an interaction rather than a note about someone; a
-     * bare year is how you say you don't remember the day.
-     */
-    fun log(
-        title: String,
-        occurredOn: String,
-        body: String,
-        attendees: List<String>,
-    ): Result<String> = ffiCatching {
-        nativeLib.node().humans().logInteraction(title, occurredOn, body, attendees)
-    }
-
-    fun get(id: String): Result<InteractionDetail> = ffiCatching {
-        nativeLib.node().humans().getInteraction(id)
-    }
-
-    /** Replace an interaction's title, date, and write-up. The guest list is [setAttendees]. */
-    fun update(id: String, title: String, occurredOn: String, body: String): Result<Unit> =
-        ffiCatching {
-            nativeLib.node().humans().updateInteraction(id, title, occurredOn, body)
-        }
-
-    /** Replace the set of people who were there. */
-    fun setAttendees(id: String, attendees: List<String>): Result<Unit> = ffiCatching {
-        nativeLib.node().humans().setAttendees(id, attendees)
-    }
-
-    /**
-     * Delete an interaction. It is one shared document, so this removes it from every attendee's
-     * timeline, not only the one you are looking at.
-     */
-    fun delete(id: String): Result<Unit> = ffiCatching {
-        nativeLib.node().humans().deleteInteraction(id)
-    }
-
-    /** Every interaction a person attended, most recent first. */
-    fun forHuman(id: String): Result<List<InteractionItem>> = ffiCatching {
-        nativeLib.node().humans().interactionsWith(id)
-    }
-
-    /** Every interaction on this node, most recent first. */
-    fun list(): Result<List<InteractionItem>> = ffiCatching {
-        nativeLib.node().humans().listInteractions()
-    }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/JobsAgent.kt

@@ -1,35 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import uniffi.synchronicity.JobItem
-
-/**
- * Kotlin wrapper for the Jobs screen's FFI surface — mirrors [NotebookAgent]'s pattern: one method
- * per [uniffi.synchronicity.JobsFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.jobs], so call sites read `nativeLib.jobs.listActiveJobs()` instead of
- * `nativeLib.listActiveJobs()` string-prefix pseudo-namespacing.
- */
-class JobsAgent internal constructor(private val nativeLib: NativeLib) {
-
-    fun listActiveJobs(): Result<List<JobItem>> = ffiCatching {
-        nativeLib.node().jobs().listActiveJobs()
-    }
-
-    fun listJobHistory(limit: Int): Result<List<JobItem>> = ffiCatching {
-        nativeLib.node().jobs().listJobHistory(limit.toUInt())
-    }
-
-    fun clearJobHistory(): Result<Unit> = ffiCatching { nativeLib.node().jobs().clearJobHistory() }
-
-    /**
-     * Best-effort cancel: `true` only if `jobId` had a live cancellation token to flip. See
-     * `ffi.rs`'s `JobsFfi::cancel_job` doc comment -- only `BackgroundSync`, scheduler-originated
-     * `CatalogueSync`/`ContentFetch`, `ContentStream` (a reader opening something that lives on
-     * another node -- see `lib::content_fetch`), and a batch (folder) `Import` have one; a
-     * manually-triggered sync/fetch, a single-file `Import`, or any `Push`/`Eviction`/`Purge`,
-     * returns `false` with no error.
-     */
-    fun cancelJob(jobId: String): Result<Boolean> = ffiCatching {
-        nativeLib.node().jobs().cancelJob(jobId)
-    }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/MainActivity.kt

@@ -53,7 +53,7 @@ import com.gregshuflin.synchronicity.scheduler.SchedulerWorker
 import com.gregshuflin.synchronicity.settings.SettingsScreen
 import com.gregshuflin.synchronicity.settings.SettingsSection
 import com.gregshuflin.synchronicity.ui.AnimatedNavHost
-import com.gregshuflin.synchronicity.ui.IconButton
+import com.gregshuflin.synchronicity.ui.IconRowButton
 import com.gregshuflin.synchronicity.ui.NavSlot
 import com.gregshuflin.synchronicity.ui.NavSlotView
 import com.gregshuflin.synchronicity.ui.NavStatus
@@ -106,8 +106,7 @@ class MainActivity : ComponentActivity() {
         // normal init flow (AppScreen) will start the service once it is, so skip
         // quietly here rather than letting the FFI call throw.
         if (!NativeLib.isInitialized()) return
-        NativeLib()
-            .nodeInitialized()
+        NativeLib.ffi { nodeInitialized() }
             .onSuccess { initialized ->
                 if (initialized) startForegroundService(Intent(this, P2PService::class.java))
             }
@@ -128,7 +127,7 @@ fun AppScreen(modifier: Modifier = Modifier, viewModel: AppViewModel = viewModel
                 ) {}
             }
         is AppUiState.Error -> StoreInitErrorScreen(state.message, modifier = modifier)
-        is AppUiState.Ready -> AppContent(viewModel.nativeLib, state, modifier = modifier)
+        is AppUiState.Ready -> AppContent(state, modifier = modifier)
     }
 }
 
@@ -165,22 +164,17 @@ private fun StoreInitErrorScreen(message: String, modifier: Modifier = Modifier)
 }
 
 @Composable
-private fun AppContent(
-    nativeLib: NativeLib,
-    state: AppUiState.Ready,
-    modifier: Modifier = Modifier,
-) {
+private fun AppContent(state: AppUiState.Ready, modifier: Modifier = Modifier) {
     val context = LocalContext.current
     val navController = rememberNavController()
-    val themeState = rememberThemeState(nativeLib)
+    val themeState = rememberThemeState()
 
     // When the node already exists we boot straight into Main, so make sure the P2P
     // foreground service is running for that path. The init-complete and settings-reset
     // paths start/stop it themselves.
     LaunchedEffect(Unit) {
         if (state.nodeInitialized) {
-            context.startForegroundService(Intent(context, P2PService::class.java))
-            scheduleBackgroundSync(context, nativeLib)
+            startNodeServices(context)
         }
     }
 
@@ -220,7 +214,6 @@ private fun AppContent(
                     AppNavHost(
                         navController = navController,
                         startDestination = startDestination,
-                        nativeLib = nativeLib,
                         state = state,
                         themeState = themeState,
                     )
@@ -242,7 +235,6 @@ private fun AppContent(
 private fun AppNavHost(
     navController: NavHostController,
     startDestination: Any,
-    nativeLib: NativeLib,
     state: AppUiState.Ready,
     themeState: ThemeState,
 ) {
@@ -251,13 +243,11 @@ private fun AppNavHost(
         composable<InitializationRoute> {
             InitializationNavigation(
                 onInitializationComplete = {
-                    context.startForegroundService(Intent(context, P2PService::class.java))
-                    scheduleBackgroundSync(context, nativeLib)
+                    startNodeServices(context)
                     navController.navigate(MainRoute) {
                         popUpTo(InitializationRoute) { inclusive = true }
                     }
-                },
-                nativeLib = nativeLib,
+                }
             )
         }
         composable<MainRoute> {
@@ -271,7 +261,6 @@ private fun AppNavHost(
             val agentId = AgentId.valueOf(backStackEntry.toRoute<AgentRoute>().agentId)
             AgentDestination(
                 agentId = agentId,
-                nativeLib = nativeLib,
                 themeState = themeState,
                 onBack = { navController.popBackStack() },
                 onOpenHuman = { humanId -> navController.navigate(HumanDetailRoute(humanId)) },
@@ -293,9 +282,7 @@ private fun AppNavHost(
         }
         composable<RetirementRoute> {
             RetirementScreen(
-                nativeLib = nativeLib,
-                nodeName =
-                    remember { nativeLib.settings.getNodeName().orEmpty() }.ifEmpty { "this node" },
+                nodeName = remember { NativeLib.nodeName().orEmpty() }.ifEmpty { "this node" },
                 onFinish = {
                     navController.navigate(InitializationRoute) {
                         popUpTo(RetirementRoute) { inclusive = true }
@@ -306,7 +293,6 @@ private fun AppNavHost(
         composable<HumanDetailRoute> { backStackEntry ->
             HumanDetailScreen(
                 humanId = backStackEntry.toRoute<HumanDetailRoute>().humanId,
-                nativeLib = nativeLib,
                 onBack = { navController.popBackStack() },
             )
         }
@@ -320,7 +306,6 @@ private fun AppNavHost(
 @Composable
 private fun AgentDestination(
     agentId: AgentId,
-    nativeLib: NativeLib,
     themeState: ThemeState,
     onBack: () -> Unit,
     onOpenHuman: (String) -> Unit,
@@ -328,37 +313,30 @@ private fun AgentDestination(
     onRetire: () -> Unit,
 ) {
     when (agentId) {
-        AgentId.NOTES -> NotesScreen(nativeLib = nativeLib, onBack = onBack)
+        AgentId.NOTES -> NotesScreen(onBack = onBack)
         AgentId.PDF_VIEWER -> PdfScreen(onBackToMain = onBack)
-        AgentId.PODCASTS -> PodcastScreen(nativeLib = nativeLib, onBackToMain = onBack)
+        AgentId.PODCASTS -> PodcastScreen(onBackToMain = onBack)
         AgentId.DOCUMENTS -> DocumentsScreen(onBackToMain = onBack)
         AgentId.MUSIC -> MusicScreen(onBack = onBack)
-        AgentId.COMICS -> ComicsScreen(nativeLib = nativeLib, onBack = onBack)
+        AgentId.COMICS -> ComicsScreen(onBack = onBack)
         AgentId.CODE -> CodeScreen(onBack = onBack)
-        AgentId.PICTURES -> PicturesScreen(nativeLib = nativeLib, onBack = onBack)
+        AgentId.PICTURES -> PicturesScreen(onBack = onBack)
         AgentId.VIDEO -> VideoScreen(onBack = onBack)
         AgentId.POMODORO_TIMER -> PomodoroTimerScreen(onBack = onBack)
-        AgentId.HUMANS ->
-            HumansScreen(nativeLib = nativeLib, onOpenHuman = onOpenHuman, onBack = onBack)
-        AgentId.QR_CODE -> QrCodeScreen(nativeLib = nativeLib, onBack = onBack)
-        AgentId.JOBS -> JobsScreen(nativeLib = nativeLib, onBack = onBack)
-        AgentId.CLIPPINGS -> ClippingsScreen(nativeLib = nativeLib, onBack = onBack)
+        AgentId.HUMANS -> HumansScreen(onOpenHuman = onOpenHuman, onBack = onBack)
+        AgentId.QR_CODE -> QrCodeScreen(onBack = onBack)
+        AgentId.JOBS -> JobsScreen(onBack = onBack)
+        AgentId.CLIPPINGS -> ClippingsScreen(onBack = onBack)
         // The Ensemble and Settings buttons both open the settings screen; the Ensemble button
-        // just lands on the Ensemble section of its bottom navigation bar.
-        AgentId.ENSEMBLE ->
-            SettingsScreen(
-                themeState = themeState,
-                nativeLib = nativeLib,
-                initialSection = SettingsSection.ENSEMBLE,
-                onBackToMain = { backToMainAfterSettings(nativeLib, onBack, onNodeReset) },
-                onRetire = onRetire,
-            )
+        // just lands on its Ensemble section.
+        AgentId.ENSEMBLE,
         AgentId.SETTINGS ->
             SettingsScreen(
                 themeState = themeState,
-                nativeLib = nativeLib,
-                initialSection = SettingsSection.SYSTEM,
-                onBackToMain = { backToMainAfterSettings(nativeLib, onBack, onNodeReset) },
+                initialSection =
+                    if (agentId == AgentId.ENSEMBLE) SettingsSection.ENSEMBLE
+                    else SettingsSection.SYSTEM,
+                onBackToMain = { backToMainAfterSettings(onBack, onNodeReset) },
                 onRetire = onRetire,
             )
     }
@@ -368,27 +346,24 @@ private fun AgentDestination(
  * Routes back from the settings screen. The node may have been reset from the System section, so
  * re-check initialization status and fall back to the initialization flow when it's gone.
  */
-private fun backToMainAfterSettings(
-    nativeLib: NativeLib,
-    onBack: () -> Unit,
-    onNodeReset: () -> Unit,
-) {
+private fun backToMainAfterSettings(onBack: () -> Unit, onNodeReset: () -> Unit) {
     val initialized =
-        nativeLib.nodeInitialized().getOrElse { e ->
-            Log.e("AppContent", "Failed to check node initialization status after settings", e)
-            false
-        }
+        NativeLib.ffi { nodeInitialized() }
+            .getOrElse { e ->
+                Log.e("AppContent", "Failed to check node initialization status after settings", e)
+                false
+            }
     if (initialized) onBack() else onNodeReset()
 }
 
 /**
- * (Re-)enqueue the background sync scheduler's periodic `WorkManager` tick with this node's current
- * scheduler settings — called wherever the P2P foreground service is started, since the scheduler
- * tick depends on P2P eventually coming up the same way.
+ * Start what an initialized node runs in the background: the P2P foreground service, and the
+ * background sync scheduler's periodic `WorkManager` tick (re-enqueued with this node's current
+ * scheduler settings, since that tick depends on P2P coming up the same way).
  */
-private fun scheduleBackgroundSync(context: Context, nativeLib: NativeLib) {
-    nativeLib.settings
-        .getSchedulerSettings()
+private fun startNodeServices(context: Context) {
+    context.startForegroundService(Intent(context, P2PService::class.java))
+    NativeLib.ffi { settings().getSchedulerSettings() }
         .onSuccess { settings -> SchedulerWorker.schedule(context, settings) }
         .onFailure { Log.w("AppContent", "Failed to load scheduler settings", it) }
 }
@@ -464,7 +439,7 @@ fun MainScreen(
                 )
                 for (agent in inGroup) {
                     val slot = playbackSlot(agent.id, playback) ?: NavStatus.get(agent.id)
-                    IconButton(
+                    IconRowButton(
                         onClick = { onAgentSelect(agent) },
                         icon = agent.icon,
                         text = agent.displayName,

android/app/src/main/java/com/gregshuflin/synchronicity/MusicAgent.kt

@@ -1,51 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import uniffi.synchronicity.LibraryBuildSummary
-import uniffi.synchronicity.LibraryEntry
-import uniffi.synchronicity.LibraryEntryKind
-import uniffi.synchronicity.MusicLibraryLevel
-import uniffi.synchronicity.MusicTreeItem
-
-/**
- * Kotlin wrapper for the Music agent's FFI surface — mirrors [ComicsAgent]'s pattern: one method
- * per [uniffi.synchronicity.MusicFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.music], so call sites read `nativeLib.music.listTree()` instead of
- * `nativeLib.listMusicTree()` string-prefix pseudo-namespacing.
- *
- * A track's audio bytes are not fetched through here: playback loads them with
- * [DocumentsAgent.getBlobBytes] (local) or [DocumentsAgent.fetchBlobToPath] (streamed from a peer),
- * the same way it did before the folder hierarchy existed.
- */
-class MusicAgent internal constructor(private val nativeLib: NativeLib) {
-
-    /** The full music folder hierarchy (unsorted, flat — group by [MusicTreeItem.parentId]). */
-    fun listTree(): Result<List<MusicTreeItem>> = ffiCatching {
-        nativeLib.node().music().listTree()
-    }
-
-    /**
-     * One level of the tag-derived Artist → Album → Track library, already in display order. An
-     * empty artist level means no library has been built on this node yet ([buildLibrary]).
-     */
-    fun listLibrary(level: MusicLibraryLevel): Result<List<LibraryEntry>> = ffiCatching {
-        nativeLib.node().music().listLibrary(level)
-    }
-
-    /**
-     * Cover bytes for a library row that reported [LibraryEntry.hasCover] — an album's own art, or
-     * an artist's derived portrait/mosaic. Null when there turned out to be none.
-     */
-    fun entryArt(entryId: String, kind: LibraryEntryKind): Result<ByteArray?> = ffiCatching {
-        nativeLib.node().music().entryArt(entryId, kind)
-    }
-
-    /**
-     * Rebuild the tag-derived library from the tracks held here. Long-running (it parses every
-     * not-yet-scanned audio blob) and tracked as a Job, so call it off the main thread; it fails
-     * with [uniffi.synchronicity.SyncException.Busy] if a build is already running.
-     */
-    fun buildLibrary(): Result<LibraryBuildSummary> = ffiCatching {
-        nativeLib.node().music().buildLibrary()
-    }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/NativeLib.kt

@@ -2,60 +2,50 @@ package com.gregshuflin.synchronicity
 
 import android.content.Context
 import android.util.Log
-import uniffi.synchronicity.AgentInfo
-import uniffi.synchronicity.DocumentSyncOverrideOption
-import uniffi.synchronicity.FontData
+import java.io.File
 import uniffi.synchronicity.LogVerbosity
-import uniffi.synchronicity.MarkupDoc
-import uniffi.synchronicity.MathDialect
-import uniffi.synchronicity.MathRender
 import uniffi.synchronicity.SyncException
 import uniffi.synchronicity.SyncNode
-import uniffi.synchronicity.SyncPolicyOption
-import uniffi.synchronicity.TypstPreviewOutcome
-import uniffi.synchronicity.WikilinkTitle
 
-// NativeLib is a deliberately flat 1:1 mirror of the uniffi FFI surface: one thin
-// wrapper per exported Rust function, with parameter lists that follow the Rust
-// signatures. Detekt's size/parameter-count heuristics aren't meaningful here —
-// splitting the class or bundling parameters would just diverge from the FFI.
-@Suppress("TooManyFunctions", "LongParameterList")
-class NativeLib {
-    companion object {
-        private const val TAG = "NativeLib"
+/**
+ * The app's handle on the shared Rust node. A per-agent call goes through [ffi] straight to the
+ * uniffi object — `nativeLib.ffi { podcast().queueAdd(id) }` — whose methods and docs uniffi
+ * generates from the Rust side, so there is no Kotlin layer restating them. Top-level uniffi
+ * functions that need no node (`parseMarkup`, `buildInfo`, …) are called directly, wrapped in
+ * [ffiCatching] where they can fail.
+ *
+ * One per process, because there is one node: every screen, the P2P service and the background
+ * workers share a single open store and P2P runtime.
+ */
+object NativeLib {
+    private const val TAG = "NativeLib"
 
-        // Store directory under the app's internal files dir. Holds `store.db`
-        // and a `blobs/` subdirectory — the same layout the CLI and desktop app
-        // use, so the FFI can share Store::open / Store::create with them.
-        private const val STORE_DIRNAME = "store"
+    // Store directory under the app's internal files dir. Holds `store.db`
+    // and a `blobs/` subdirectory — the same layout the CLI and desktop app
+    // use, so the FFI can share Store::open / Store::create with them.
+    private const val STORE_DIRNAME = "store"
 
-        // Process-wide handle to the Rust node. Every NativeLib instance (UI
-        // screens, the P2P service, repositories) constructs its own NativeLib but
-        // must share a single open store + P2P runtime, so the handle lives in the
-        // companion object rather than per-instance.
-        @Volatile private var syncNode: SyncNode? = null
-        private val initLock = Any()
+    @Volatile private var syncNode: SyncNode? = null
+    private val initLock = Any()
 
-        /**
-         * True once the shared node handle has been opened (the store is ready). Non-throwing, so
-         * callers can probe readiness without constructing a NativeLib or guarding against
-         * IllegalStateException.
-         */
-        fun isInitialized(): Boolean = syncNode != null
-
-        init {
-            try {
-                System.loadLibrary("synchronicity")
-                Log.d(TAG, "Successfully loaded native library")
-                uniffi.synchronicity.initAndroidLogging(LogVerbosity.NORMAL, false)
-                Log.d(TAG, "Successfully initialized Android logging")
-            } catch (e: UnsatisfiedLinkError) {
-                Log.e(TAG, "Failed to load native library", e)
-                throw e
-            }
+    init {
+        try {
+            System.loadLibrary("synchronicity")
+            Log.d(TAG, "Successfully loaded native library")
+            uniffi.synchronicity.initAndroidLogging(LogVerbosity.NORMAL, false)
+            Log.d(TAG, "Successfully initialized Android logging")
+        } catch (e: UnsatisfiedLinkError) {
+            Log.e(TAG, "Failed to load native library", e)
+            throw e
         }
     }
 
+    /**
+     * True once the shared node handle has been opened (the store is ready). Non-throwing, so
+     * callers can probe readiness without guarding against IllegalStateException.
+     */
+    fun isInitialized(): Boolean = syncNode != null
+
     /**
      * Open (or create on first launch) the shared native store. Throws if the store can't be
      * opened; callers are expected to surface that to the user rather than continuing with a null
@@ -66,7 +56,7 @@ class NativeLib {
             Log.d(TAG, "NativeLib already initialized")
             return
         }
-        // Guard against two instances/threads opening the store concurrently
+        // Guard against two threads opening the store concurrently
         // (e.g. the UI's LaunchedEffect and P2PService.onCreate both run on IO).
         synchronized(initLock) {
             if (syncNode != null) {
@@ -75,12 +65,12 @@ class NativeLib {
             }
             initAndroidContext(context)
             Log.d(TAG, "Successfully initialized Android context")
-            val storeDir = java.io.File(context.filesDir, STORE_DIRNAME).absolutePath
+            val storeDir = File(context.filesDir, STORE_DIRNAME).absolutePath
             val opened = SyncNode(storeDir)
             syncNode = opened
             Log.d(TAG, "Successfully opened store at $storeDir")
             // Apply stored log settings now that the store is open.
-            ffi { opened.settings().getLogConfig() }
+            ffi { settings().getLogConfig() }
                 .getOrNull()
                 ?.let { cfg ->
                     uniffi.synchronicity.updateAndroidLogFilter(cfg.verbosity, cfg.showIrohLogs)
@@ -94,12 +84,7 @@ class NativeLib {
 
     // Throws a typed SyncException rather than IllegalStateException so that
     // "the store isn't open yet" arrives at callers through the same channel as
-    // every other native failure — see the totality note on [ffi].
-    //
-    // internal rather than private: per-agent handles like [NotebookAgent] live in
-    // their own top-level class (real object structure instead of notebookXxx-style
-    // string prefixing — see that class's doc comment) and need this to reach their
-    // uniffi sub-object, e.g. `nativeLib.node().notebook()`.
+    // every other native failure — see the totality note on [ffiCatching].
     internal fun node(): SyncNode =
         syncNode ?: throw SyncException.NotInitialized("call initialize() first")
 
@@ -107,234 +92,25 @@ class NativeLib {
     // can access Android system APIs (certificate store, DNS, etc.).
     external fun initAndroidContext(context: Context)
 
-    // See [ffiCatching]'s doc comment for the totality guarantee this provides. Kept as a
-    // thin alias here so the ~130 call sites below don't need touching; per-agent handles
-    // (e.g. [NotebookAgent]) call [ffiCatching] directly.
-    private inline fun <T> ffi(block: () -> T): Result<T> = ffiCatching(block)
-
-    // ── Stateless helpers (top-level Rust functions) ────────────────────────────
-
-    fun generateEnsembleKey(): Result<List<String>> = ffi {
-        uniffi.synchronicity.generateEnsembleKey()
-    }
-
-    // Infallible: pure computation in Rust with no `Result` return.
-    fun listTimezones(): List<String> = uniffi.synchronicity.listTimezones()
-
-    /** Build/version metadata for the About section. Static, computed in Rust. */
-    fun buildInfo(): uniffi.synchronicity.BuildInfo = uniffi.synchronicity.buildInfo()
-
-    /** Ping timeout (seconds), sourced from shared Rust so it matches the GUI. */
-    fun pingTimeoutSecs(): Int = uniffi.synchronicity.pingTimeoutSecs().toInt()
-
-    /** Default Documents-list page size, sourced from shared Rust so it matches the GUI/CLI. */
-    fun defaultDocumentPageSize(): Int = uniffi.synchronicity.defaultDocumentPageSize().toInt()
-
     /**
-     * Check one partial-date field ("1990-06-15", "--06-15", "1990"), returning the reason it was
-     * rejected.
-     *
-     * Lets a form mark the offending field rather than showing a general "save failed": the save
-     * call itself rejects the whole record and its error names no field. Pass [required] = false
-     * where blank is allowed, as it is for a birth date.
+     * Run [block] against the open node, with every failure — including "the store isn't open yet"
+     * — in the [Result]. See [ffiCatching] for the totality guarantee. The block's receiver is the
+     * uniffi [SyncNode], so a call reads `ffi { notebook().createNote(parentId, title) }`.
      */
-    fun validatePartialDate(text: String, required: Boolean): Result<Unit> = ffi {
-        uniffi.synchronicity.validatePartialDate(text, required)
-    }
+    internal inline fun <T> ffi(block: SyncNode.() -> T): Result<T> = ffiCatching { node().block() }
 
-    /**
-     * Format an epoch-seconds timestamp using the shared "last seen" rule (within 24h → HH:mm:ss,
-     * otherwise Mon DD, HH:mm) in the given IANA [tz].
-     */
-    fun formatSeenTimestamp(epochSecs: Long, tz: String?): String =
-        uniffi.synchronicity.formatSeenTimestamp(epochSecs.toULong(), tz)
+    // ── Settings with behavior of their own ─────────────────────────────────
 
-    fun getAllDocumentTypes(): List<String> = uniffi.synchronicity.getAllDocumentTypes()
+    // Unset is a normal state for these, not an error; a native failure is logged and collapses to
+    // the same null, so the many synchronous call sites stay simple.
+    fun timezone(): String? =
+        ffi { settings().getTimezone() }.getOrLog(TAG, "Failed to read timezone")
 
-    fun getAllDocumentMimeTypes(): List<String> = uniffi.synchronicity.getAllDocumentMimeTypes()
+    fun nodeName(): String? =
+        ffi { settings().getNodeName() }.getOrLog(TAG, "Failed to read node name")
 
-    fun getAgents(): List<AgentInfo> = uniffi.synchronicity.getAgents()
-
-    /** Renders [text] as a QR code, PNG-encoded, decodable via [android.graphics.BitmapFactory]. */
-    fun generateQrCodePng(text: String): Result<ByteArray> = ffi {
-        uniffi.synchronicity.generateQrCodePng(text)
-    }
-
-    fun compileTypst(source: String): Result<ByteArray> = ffi {
-        uniffi.synchronicity.compileTypst(source)
-    }
-
-    fun compileTypstWithFonts(
-        source: String,
-        fontNames: Array<String>,
-        fontDataArrays: Array<ByteArray>,
-    ): Result<ByteArray> = ffi {
-        val fonts = fontNames.zip(fontDataArrays).map { (name, data) -> FontData(name, data) }
-        uniffi.synchronicity.compileTypstWithFonts(source, fonts)
-    }
-
-    // ── Podcasts ────────────────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [PodcastAgent]'s doc comment) instead of
-    // podcastXxx-prefixed methods here — mirrors the Rust-side PodcastFfi split.
-
-    val podcast: PodcastAgent = PodcastAgent(this)
-
-    // ── Node lifecycle ───────────────────────────────────────────────────────────
-
-    fun nodeInitialized(): Result<Boolean> = ffi { node().nodeInitialized() }
-
-    fun resetNode(): Result<Unit> = ffi { node().resetNode() }
-
-    // ── Settings ───────────────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [SettingsAgent]'s doc comment) instead of
-    // settings-flavored methods here — mirrors the Rust-side SettingsFfi split.
-
-    val settings: SettingsAgent = SettingsAgent(this)
-
-    /** The policies a document type can be set to, with their labels and descriptions. */
-    fun getSyncPolicyOptions(): List<SyncPolicyOption> = uniffi.synchronicity.getSyncPolicyOptions()
-
-    /** The overrides a document can be set to, with their labels and descriptions. */
-    fun getDocumentSyncOverrideOptions(): List<DocumentSyncOverrideOption> =
-        uniffi.synchronicity.getDocumentSyncOverrideOptions()
-
-    // ── Ensemble / P2P ──────────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [EnsembleAgent]'s doc comment) instead of
-    // living directly here — mirrors the Rust-side EnsembleFfi split.
-
-    val ensemble: EnsembleAgent = EnsembleAgent(this)
-
-    // ── Deleting content safely (the last-copy guard) ───────────────────────────
-    //
-    // Grouped as its own handle (see [EvictionAgent]'s doc comment) instead of
-    // living directly here — mirrors the Rust-side EvictionFfi split.
-
-    val eviction: EvictionAgent = EvictionAgent(this)
-
-    // ── Remote administration ────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [RemoteAdminAgent]'s doc comment) instead of
-    // remoteXxx-prefixed methods here — mirrors the Rust-side RemoteAdminFfi split.
-
-    val remoteAdmin: RemoteAdminAgent = RemoteAdminAgent(this)
-
-    // ── Documents ─────────────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [DocumentsAgent]'s doc comment) instead of
-    // documentXxx-prefixed methods here — mirrors the Rust-side DocumentsFfi split.
-
-    val documents: DocumentsAgent = DocumentsAgent(this)
-
-    // ── PDF agent ─────────────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [PdfAgent]'s doc comment) instead of
-    // pdfXxx-prefixed methods here — mirrors the Rust-side PdfFfi split.
-
-    val pdf: PdfAgent = PdfAgent(this)
-
-    // ── Comics ──────────────────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [ComicsAgent]'s doc comment) instead of
-    // comicXxx-prefixed methods here — mirrors the Rust-side ComicsFfi split.
-
-    val comics: ComicsAgent = ComicsAgent(this)
-
-    // ── Pictures ────────────────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [PicturesAgent]'s doc comment) instead of
-    // pictureXxx-prefixed methods here — mirrors the Rust-side PicturesFfi split.
-
-    val pictures: PicturesAgent = PicturesAgent(this)
-
-    // ── Music ───────────────────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [MusicAgent]'s doc comment) instead of
-    // musicXxx-prefixed methods here — mirrors the Rust-side MusicFfi split.
-
-    val music: MusicAgent = MusicAgent(this)
-
-    // ── Import ────────────────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [ImportAgent]'s doc comment) instead of
-    // importXxx-prefixed methods here — mirrors the Rust-side ImportFfi split.
-    // PDF/comics-specific import lives on [PdfAgent]/[ComicsAgent] instead.
-
-    val import: ImportAgent = ImportAgent(this)
-
-    // ── Notebook agent ────────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [NotebookAgent]'s doc comment) instead of
-    // notebookXxx-prefixed methods here — mirrors the Rust-side split of
-    // notebook_* SyncNode methods into their own NotebookFfi uniffi object.
-
-    val notebook: NotebookAgent = NotebookAgent(this)
-
-    /**
-     * Default title for a freshly created note/collection, sourced from shared Rust so the
-     * create-then-rename flow matches the GUI. Static, not tied to a running node — stays here
-     * rather than on [NotebookAgent] since it isn't a [uniffi.synchronicity.NotebookFfi] method.
-     */
-    fun notebookDefaultItemName(): String = uniffi.synchronicity.notebookDefaultItemName()
-
-    // ── Markup rendering (shared IR, docs/notes-markup-rendering.md) ────────────
-    //
-    // Stateless top-level Rust functions, like compileTypst/searchPodcasts above —
-    // no SyncNode needed since parsing/rendering doesn't touch the store.
-
-    fun parseMarkup(source: String): MarkupDoc = uniffi.synchronicity.parseMarkup(source)
-
-    fun resolveWikilinks(doc: MarkupDoc, titles: List<WikilinkTitle>): MarkupDoc =
-        uniffi.synchronicity.resolveWikilinks(doc, titles)
-
-    fun renderTypstPreview(source: String, pixelsPerPt: Float, gapPt: Float): TypstPreviewOutcome =
-        uniffi.synchronicity.renderTypstPreview(source, pixelsPerPt, gapPt)
-
-    fun renderMath(
-        dialect: MathDialect,
-        source: String,
-        display: Boolean,
-        fontSizePx: Float,
-        dpr: Float,
-    ): Result<MathRender> = ffi {
-        uniffi.synchronicity.renderMath(dialect, source, display, fontSizePx, dpr)
-    }
-
-    // ── Humans agent ──────────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [HumansAgent]'s doc comment) instead of
-    // humansXxx-prefixed methods here — mirrors the Rust-side HumansFfi split.
-
-    val humans: HumansAgent = HumansAgent(this)
-
-    // ── Clippings ─────────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [ClippingsAgent]'s doc comment) instead of
-    // clippingsXxx-prefixed methods here — mirrors the Rust-side ClippingsFfi split.
-
-    val clippings: ClippingsAgent = ClippingsAgent(this)
-
-    // ── Service credentials ───────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [CredentialsAgent]'s doc comment) instead of
-    // credentialXxx-prefixed methods here — mirrors the Rust-side CredentialsFfi split.
-
-    val credentials: CredentialsAgent = CredentialsAgent(this)
-
-    // ── Jobs ──────────────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [JobsAgent]'s doc comment) instead of
-    // living directly here — mirrors the Rust-side JobsFfi split.
-
-    val jobs: JobsAgent = JobsAgent(this)
-
-    // ── Store changes ─────────────────────────────────────────────────────
-    //
-    // Grouped as its own handle (see [ChangesAgent]) instead of living directly
-    // here — mirrors the Rust-side ChangesFfi split. Screens collect
-    // [StoreChanges.cursor] rather than calling this.
-
-    val changes: ChangesAgent = ChangesAgent(this)
+    /** Persist the log config and immediately apply it to the running logger. */
+    fun setLogConfig(verbosity: LogVerbosity, showIrohLogs: Boolean): Result<Unit> =
+        ffi { settings().setLogConfig(verbosity, showIrohLogs) }
+            .onSuccess { uniffi.synchronicity.updateAndroidLogFilter(verbosity, showIrohLogs) }
 }

android/app/src/main/java/com/gregshuflin/synchronicity/NodeReset.kt

@@ -55,19 +55,19 @@ object NodeReset {
      * Android settings is the way out.
      *
      * Runs under [NonCancellable], and picks its own dispatcher per step. The caller is a click
-     * handler on a screen this navigates away from, so a cancellable reset is one that could stop
+     * handler on a screen this navigates away from, so a cancelable reset is one that could stop
      * between destroying the store and clearing what was decrypted out of it. The wipe blocks its
      * thread for as long as it takes, so it goes to [Dispatchers.IO]; the audio transport is a
      * Media3 `MediaController`, which may only be touched from the main thread.
      */
-    suspend fun perform(context: Context, nativeLib: NativeLib): Result<Unit> =
+    suspend fun perform(context: Context): Result<Unit> =
         withContext(NonCancellable) {
             val app = context.applicationContext
 
             withContext(Dispatchers.Main) { AudioPlayerProvider.release(app) }
             SchedulerWorker.cancel(app)
 
-            val wiped = withContext(Dispatchers.IO) { nativeLib.resetNode() }
+            val wiped = withContext(Dispatchers.IO) { NativeLib.ffi { resetNode() } }
 
             app.stopService(Intent(app, P2PService::class.java))
             withContext(Dispatchers.IO) { clearCaches(app) }

android/app/src/main/java/com/gregshuflin/synchronicity/NotebookAgent.kt

@@ -1,127 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import uniffi.synchronicity.DocumentAvailability
-import uniffi.synchronicity.MathDialect
-import uniffi.synchronicity.NoteContent
-import uniffi.synchronicity.NoteTreeEntry
-import uniffi.synchronicity.NotebookItem
-import uniffi.synchronicity.NotesViewMode
-import uniffi.synchronicity.TextFormat
-
-/**
- * Kotlin wrapper for the Notes/Notebook agent's FFI surface.
- *
- * The Rust side groups these as their own uniffi object ([uniffi.synchronicity.NotebookFfi],
- * obtained fresh per call via [NativeLib.node]'s `notebook()` — cheap, just clones an `Arc`) rather
- * than `notebook_*`-prefixed methods on `SyncNode`. This class mirrors that: one small method per
- * [uniffi.synchronicity.NotebookFfi] method, each wrapped in [ffiCatching] the same way every other
- * [NativeLib] method is (see that function's doc comment for the `Result` totality guarantee).
- *
- * Exposed as [NativeLib.notebook], so call sites read `nativeLib.notebook.createNotebook(...)` —
- * real object structure for a per-agent FFI surface, instead of
- * `nativeLib.notebookCreateNotebook(...)` string-prefix pseudo-namespacing.
- */
-@Suppress("TooManyFunctions") // one method per NotebookFfi method — see NativeLib's own suppression
-class NotebookAgent internal constructor(private val nativeLib: NativeLib) {
-
-    fun listNotebooks(): Result<List<NotebookItem>> = ffiCatching {
-        nativeLib.node().notebook().listNotebooks()
-    }
-
-    fun createNotebook(title: String): Result<String> = ffiCatching {
-        nativeLib.node().notebook().createNotebook(title)
-    }
-
-    fun getTree(notebookId: String): Result<List<NoteTreeEntry>> = ffiCatching {
-        nativeLib.node().notebook().getTree(notebookId)
-    }
-
-    fun createNote(parentId: String, title: String): Result<String> = ffiCatching {
-        nativeLib.node().notebook().createNote(parentId, title)
-    }
-
-    fun createCollection(parentId: String, title: String): Result<String> = ffiCatching {
-        nativeLib.node().notebook().createCollection(parentId, title)
-    }
-
-    /** Null means this node doesn't hold the note's body yet (not-yet-synced note). */
-    fun getNote(noteId: String): Result<NoteContent?> = ffiCatching {
-        nativeLib.node().notebook().getNote(noteId)
-    }
-
-    /**
-     * Whether this node holds the note's body — [DocumentAvailability.LOCAL] is the only editable
-     * state. See [uniffi.synchronicity.NotebookFfi.noteBodyAvailability]: an editor opened on
-     * anything else must be read-only, because saving would fork the note into two CRDT documents
-     * that merge to the whole note twice (`docs/adr/0030-note-body-crdt-loro.md`).
-     */
-    fun noteBodyAvailability(noteId: String): Result<DocumentAvailability> = ffiCatching {
-        nativeLib.node().notebook().noteBodyAvailability(noteId)
-    }
-
-    /**
-     * Discard a body no node has claimed and start a fresh, empty one — the way out of
-     * [DocumentAvailability.UNAVAILABLE], where waiting may never end. Destructive: the absent text
-     * is tombstoned across the ensemble, not just here.
-     */
-    fun abandonAbsentBody(noteId: String): Result<Unit> = ffiCatching {
-        nativeLib.node().notebook().abandonAbsentBody(noteId)
-    }
-
-    /** Applies whether or not this node holds the body: the format is its own artifact. */
-    fun setNoteFormat(noteId: String, format: TextFormat): Result<Unit> = ffiCatching {
-        nativeLib.node().notebook().setNoteFormat(noteId, format)
-    }
-
-    fun updateNote(noteId: String, newTitle: String, newBody: String): Result<Unit> = ffiCatching {
-        nativeLib.node().notebook().updateNote(noteId, newTitle, newBody)
-    }
-
-    fun renameItem(id: String, newTitle: String): Result<Unit> = ffiCatching {
-        nativeLib.node().notebook().renameItem(id, newTitle)
-    }
-
-    fun deleteItem(id: String): Result<Unit> = ffiCatching {
-        nativeLib.node().notebook().deleteItem(id)
-    }
-
-    /**
-     * Which notebook/note the Notes agent should reopen to — synced across nodes (see
-     * `docs/adr/0018-agent-settings-documents.md`), not just remembered on this device.
-     */
-    fun getActiveNotebook(): Result<String?> = ffiCatching {
-        nativeLib.node().notebook().getActiveNotebook()
-    }
-
-    fun setActiveNotebook(notebookId: String): Result<Unit> = ffiCatching {
-        nativeLib.node().notebook().setActiveNotebook(notebookId)
-    }
-
-    fun getActiveNote(): Result<String?> = ffiCatching {
-        nativeLib.node().notebook().getActiveNote()
-    }
-
-    fun setActiveNote(noteId: String): Result<Unit> = ffiCatching {
-        nativeLib.node().notebook().setActiveNote(noteId)
-    }
-
-    /** Edit/Preview/Split — persisted per docs/adr/0018-agent-settings-documents.md. */
-    fun getViewMode(): Result<NotesViewMode> = ffiCatching {
-        nativeLib.node().notebook().getViewMode()
-    }
-
-    fun setViewMode(mode: NotesViewMode): Result<Unit> = ffiCatching {
-        nativeLib.node().notebook().setViewMode(mode)
-    }
-
-    /**
-     * Which notation `$...$`/`$$...$$` spans use in markdown notes — see NativeLib's math section.
-     */
-    fun getMathDialect(): Result<MathDialect> = ffiCatching {
-        nativeLib.node().notebook().getMathDialect()
-    }
-
-    fun setMathDialect(dialect: MathDialect): Result<Unit> = ffiCatching {
-        nativeLib.node().notebook().setMathDialect(dialect)
-    }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/PdfAgent.kt

@@ -1,69 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import uniffi.synchronicity.BookmarkInfo
-
-/**
- * Kotlin wrapper for the PDF agent's FFI surface — mirrors [NotebookAgent]'s pattern: one method
- * per [uniffi.synchronicity.PdfFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.pdf], so call sites read `nativeLib.pdf.getReadingProgress(...)` instead of
- * `nativeLib.getPdfReadingProgress(...)` string-prefix pseudo-namespacing.
- */
-class PdfAgent internal constructor(private val nativeLib: NativeLib) {
-
-    fun import(fileName: String, pdfBytes: ByteArray, parentId: String? = null): Result<String> =
-        ffiCatching {
-            nativeLib.node().pdf().import(fileName, pdfBytes, parentId)
-        }
-
-    /**
-     * Write a PDF's content to [outputPath], from the local blob store or streamed from a peer,
-     * **without ever holding the whole document in memory**. `true` on success.
-     *
-     * The only way to open a PDF from a document. mupdf's Java binding opens a *file*, and
-     * [com.gregshuflin.synchronicity.pdfs.MuPdfDocument.openFromBytes] gets there by writing the
-     * array to a temp file anyway — so carrying a PDF through a `ByteArray` buys nothing and costs
-     * a full copy of it on a heap typically capped near 200 MB. A 271 MB PDF cannot be opened that
-     * way at all; through here it opens with a 64 KiB buffer.
-     *
-     * A remote PDF reports progress as a `content_stream` job the caller should watch (see
-     * [JobsAgent.listActiveJobs], matching on `documentId`) and can cancel; a local one is a plain
-     * decrypt with no job row.
-     *
-     * [outputPath] is the caller's temporary file to place and delete. Blocking for as long as the
-     * peer takes; call it off the main thread.
-     *
-     * The failure is handed back rather than logged away: `Offline` (no node could be reached) and
-     * `NotFound` (there is no PDF content at all) call for different words and different
-     * affordances, and only the caller knows which of its surfaces should say them. Use
-     * [com.gregshuflin.synchronicity.detail] for the message and
-     * [com.gregshuflin.synchronicity.userRecourse] for whether to offer a retry (docs/adr/0023).
-     */
-    fun writeToPath(documentId: String, outputPath: String): Result<Unit> = ffiCatching {
-        nativeLib.node().pdf().writeToPath(documentId, outputPath)
-    }
-
-    fun getReadingProgress(documentId: String): Result<UInt?> = ffiCatching {
-        nativeLib.node().pdf().getReadingProgress(documentId)
-    }
-
-    fun setReadingProgress(documentId: String, currentPage: UInt): Result<Unit> = ffiCatching {
-        nativeLib.node().pdf().setReadingProgress(documentId, currentPage)
-    }
-
-    fun listBookmarks(documentId: String): Result<List<BookmarkInfo>> = ffiCatching {
-        nativeLib.node().pdf().listBookmarks(documentId)
-    }
-
-    fun addBookmark(documentId: String, page: UInt, label: String?): Result<String> = ffiCatching {
-        nativeLib.node().pdf().addBookmark(documentId, page, label)
-    }
-
-    fun deleteBookmark(documentId: String, bookmarkId: String): Result<Unit> = ffiCatching {
-        nativeLib.node().pdf().deleteBookmark(documentId, bookmarkId)
-    }
-
-    private companion object {
-        const val TAG = "PdfAgent"
-    }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/PicturesAgent.kt

@@ -1,43 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import android.util.Log
-import uniffi.synchronicity.PictureTreeItem
-
-private const val TAG = "PicturesAgent"
-
-/**
- * Kotlin wrapper for the Pictures agent's FFI surface — mirrors [ComicsAgent]'s pattern: one method
- * per [uniffi.synchronicity.PicturesFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.pictures], so call sites read `nativeLib.pictures.listTree()`.
- *
- * Before this existed, the Pictures screen listed image documents through [DocumentsAgent.search],
- * which answers a narrower question: it returns Image documents and nothing else, so the Collection
- * albums the desktop browses were invisible here, and a generic document row carries no
- * availability, so a picture on another node looked exactly like one on this one.
- */
-class PicturesAgent internal constructor(private val nativeLib: NativeLib) {
-
-    /**
-     * The full picture library: every Image and the Collection albums holding at least one, flat
-     * with parent links and already in display order. A consumer wanting the hierarchy groups by
-     * [PictureTreeItem.parentId]; one wanting a plain list of pictures keeps the leaves.
-     */
-    fun listTree(): Result<List<PictureTreeItem>> = ffiCatching {
-        nativeLib.node().pictures().listTree()
-    }
-
-    /**
-     * One picture's raw (still-encoded) image bytes, from the local blob store or streamed from a
-     * peer that holds it (ADR 0016) — so a picture that hasn't synced here still opens. Blocking
-     * for as long as the peer takes; call it off the main thread.
-     *
-     * Null means the image is genuinely not obtainable right now (no reachable peer serves it, or
-     * P2P isn't running) — a state for the viewer to render, not a crash. Compare
-     * [DocumentsAgent.getBlobBytes], which is the local half alone.
-     */
-    fun getImageBytes(imageId: String): ByteArray? =
-        ffiCatching { nativeLib.node().pictures().getImageBytes(imageId) }
-            .onFailure { Log.w(TAG, "Image $imageId not available locally or from any peer", it) }
-            .getOrNull()
-}

android/app/src/main/java/com/gregshuflin/synchronicity/PodcastAgent.kt

@@ -1,80 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import android.util.Log
-import uniffi.synchronicity.PodcastEpisodeInput
-import uniffi.synchronicity.PodcastEpisodeItem
-import uniffi.synchronicity.PodcastItem
-
-private const val TAG = "PodcastAgent"
-
-/**
- * Kotlin wrapper for the Podcasts agent's FFI surface — mirrors [NotebookAgent]'s pattern: one
- * method per [uniffi.synchronicity.PodcastFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.podcast], so call sites read `nativeLib.podcast.subscribe(...)` instead of
- * `nativeLib.subscribeToPodcast(...)` string-prefix pseudo-namespacing.
- */
-class PodcastAgent internal constructor(private val nativeLib: NativeLib) {
-
-    @Suppress("LongParameterList") // mirrors the Rust PodcastFfi::subscribe signature
-    fun subscribe(
-        id: String,
-        title: String,
-        description: String,
-        author: String,
-        coverArtUri: String?,
-        lastUpdated: String,
-    ): Result<String> = ffiCatching {
-        nativeLib
-            .node()
-            .podcast()
-            .subscribe(id, title, description, author, coverArtUri, lastUpdated)
-    }
-
-    /**
-     * Search the Podcast Index.
-     *
-     * A method on the agent rather than a top-level function since ADR 0051: the API credentials
-     * live in the store now, so a call needs a node to unseal them from.
-     */
-    fun search(query: String): Result<String> = ffiCatching {
-        nativeLib.node().podcast().search(query)
-    }
-
-    /** Episodes for one feed, from the Podcast Index. See [search]. */
-    fun fetchEpisodes(podcastId: Long, max: Long): Result<String> = ffiCatching {
-        nativeLib.node().podcast().fetchEpisodes(podcastId, max)
-    }
-
-    fun unsubscribe(documentId: String): Result<Unit> = ffiCatching {
-        nativeLib.node().podcast().unsubscribe(documentId)
-    }
-
-    fun storeCoverArt(documentId: String, imageBytes: ByteArray): Result<Unit> = ffiCatching {
-        nativeLib.node().podcast().storeCoverArt(documentId, imageBytes)
-    }
-
-    // Cover art is an optional, best-effort resource: a missing/unsynced thumbnail
-    // is normal, so failures collapse to null rather than a Result the UI must handle.
-    fun getCoverArtBytes(documentId: String): ByteArray? =
-        ffiCatching { nativeLib.node().podcast().getCoverArtBytes(documentId) }
-            .onFailure { Log.w(TAG, "Failed to load cover art for $documentId", it) }
-            .getOrNull()
-
-    fun saveCustomSpeed(documentId: String, speed: Float): Result<Unit> = ffiCatching {
-        nativeLib.node().podcast().saveCustomSpeed(documentId, speed)
-    }
-
-    fun listDocuments(): Result<List<PodcastItem>> = ffiCatching {
-        nativeLib.node().podcast().listDocuments()
-    }
-
-    fun listEpisodes(feedDocumentId: String): Result<List<PodcastEpisodeItem>> = ffiCatching {
-        nativeLib.node().podcast().listEpisodes(feedDocumentId)
-    }
-
-    fun saveEpisodes(feedDocumentId: String, episodes: List<PodcastEpisodeInput>): Result<UInt> =
-        ffiCatching {
-            nativeLib.node().podcast().saveEpisodes(feedDocumentId, episodes)
-        }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/RemoteAdminAgent.kt

@@ -1,40 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import uniffi.synchronicity.DocumentSyncOverride
-import uniffi.synchronicity.DocumentType
-import uniffi.synchronicity.RemoteDocumentSyncPolicy
-import uniffi.synchronicity.SyncPolicy
-
-/**
- * Kotlin wrapper for the remote-administration FFI surface — mirrors [NotebookAgent]'s pattern: one
- * method per [uniffi.synchronicity.RemoteAdminFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.remoteAdmin], so call sites read
- * `nativeLib.remoteAdmin.getSyncConfig(nodeIdHex)` instead of
- * `nativeLib.getRemoteSyncConfig(nodeIdHex)` string-prefix pseudo-namespacing.
- */
-class RemoteAdminAgent internal constructor(private val nativeLib: NativeLib) {
-
-    /** `nodeIdHex`'s sync policy for every content-bearing type, fetched over the ensemble. */
-    fun getSyncConfig(nodeIdHex: String): Result<List<RemoteDocumentSyncPolicy>> = ffiCatching {
-        nativeLib.node().remoteAdmin().getSyncConfig(nodeIdHex)
-    }
-
-    fun setSyncPolicy(
-        nodeIdHex: String,
-        docType: DocumentType,
-        policy: SyncPolicy,
-    ): Result<List<RemoteDocumentSyncPolicy>> = ffiCatching {
-        nativeLib.node().remoteAdmin().setSyncPolicy(nodeIdHex, docType, policy)
-    }
-
-    // Sets (or, if value is null, clears) nodeIdHex's override for documentId. Returns
-    // the confirmed value straight back rather than the whole remote config.
-    fun setDocumentOverride(
-        nodeIdHex: String,
-        documentId: String,
-        value: DocumentSyncOverride?,
-    ): Result<DocumentSyncOverride?> = ffiCatching {
-        nativeLib.node().remoteAdmin().setDocumentOverride(nodeIdHex, documentId, value)
-    }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/SettingsAgent.kt

@@ -1,138 +0,0 @@
-package com.gregshuflin.synchronicity
-
-import android.util.Log
-import uniffi.synchronicity.DocumentSyncOverride
-import uniffi.synchronicity.DocumentType
-import uniffi.synchronicity.LogConfig
-import uniffi.synchronicity.LogVerbosity
-import uniffi.synchronicity.ProseFont
-import uniffi.synchronicity.ReadingSurface
-import uniffi.synchronicity.SchedulerRunSummary
-import uniffi.synchronicity.SchedulerSettings
-import uniffi.synchronicity.SyncPolicy
-import uniffi.synchronicity.ThemeMode
-
-private const val TAG = "SettingsAgent"
-
-/**
- * Kotlin wrapper for this node's settings FFI surface — mirrors [NotebookAgent]'s pattern: one
- * method per [uniffi.synchronicity.SettingsFfi] method, each wrapped in [ffiCatching].
- *
- * Exposed as [NativeLib.settings], so call sites read `nativeLib.settings.getThemeMode()` instead
- * of `nativeLib.getThemeMode()` string-prefix pseudo-namespacing.
- */
-@Suppress("TooManyFunctions") // one method per SettingsFfi method — see NativeLib's own suppression
-class SettingsAgent internal constructor(private val nativeLib: NativeLib) {
-
-    fun getPublicKeyHex(): Result<String> = ffiCatching {
-        nativeLib.node().settings().getPublicKeyHex()
-    }
-
-    // Settings reads where a null result means "unset" — a normal state, not an
-    // error. A native failure is logged and also collapses to null/default so the
-    // many synchronous call sites stay simple.
-    // getNodeName() itself returns String?; Result<String?>.getOrNull() flattens a
-    // native failure and a genuine "unset" value to the same null.
-    fun getNodeName(): String? =
-        ffiCatching { nativeLib.node().settings().getNodeName() }
-            .onFailure { Log.w(TAG, "Failed to read node name", it) }
-            .getOrNull()
-
-    fun setNodeName(name: String?): Result<Unit> = ffiCatching {
-        nativeLib.node().settings().setNodeName(name)
-    }
-
-    fun getTimezone(): String? =
-        ffiCatching { nativeLib.node().settings().getTimezone() }
-            .onFailure { Log.w(TAG, "Failed to read timezone", it) }
-            .getOrNull()
-
-    fun setTimezone(tz: String?): Result<Unit> = ffiCatching {
-        nativeLib.node().settings().setTimezone(tz)
-    }
-
-    fun getThemeMode(): Result<ThemeMode> = ffiCatching {
-        nativeLib.node().settings().getThemeMode()
-    }
-
-    fun setThemeMode(themeMode: ThemeMode): Result<Unit> = ffiCatching {
-        nativeLib.node().settings().setThemeMode(themeMode)
-    }
-
-    // Typeface for note body copy in the notes preview (ADR 0024). Only the
-    // prose face is selectable; UI and monospace are fixed.
-    fun getProseFont(): Result<ProseFont> = ffiCatching {
-        nativeLib.node().settings().getProseFont()
-    }
-
-    fun setProseFont(proseFont: ProseFont): Result<Unit> = ffiCatching {
-        nativeLib.node().settings().setProseFont(proseFont)
-    }
-
-    // The ground documents are read on — paper, white, or dark — independent of
-    // the app's chrome theme (ADR 0032 §5).
-    fun getReadingSurface(): Result<ReadingSurface> = ffiCatching {
-        nativeLib.node().settings().getReadingSurface()
-    }
-
-    fun setReadingSurface(readingSurface: ReadingSurface): Result<Unit> = ffiCatching {
-        nativeLib.node().settings().setReadingSurface(readingSurface)
-    }
-
-    // This node's background sync scheduler settings (master on/off, interval, Wi-Fi-only/
-    // charging constraints). Read/written by scheduler/SchedulerWorker.kt.
-    fun getSchedulerSettings(): Result<SchedulerSettings> = ffiCatching {
-        nativeLib.node().settings().getSchedulerSettings()
-    }
-
-    fun setSchedulerSettings(settings: SchedulerSettings): Result<Unit> = ffiCatching {
-        nativeLib.node().settings().setSchedulerSettings(settings)
-    }
-
-    // Run one full scheduler tick (catalogue, catalogue-fetch, content passes) against
-    // every reachable ensemble peer. Backs scheduler/SchedulerWorker.kt; requires P2P to
-    // be running.
-    fun runSchedulerPasses(): Result<SchedulerRunSummary> = ffiCatching {
-        nativeLib.node().settings().runSchedulerPasses()
-    }
-
-    /** This node's sync policy for every document type, in `DocumentType` order. */
-    fun getSyncPolicies(): Result<List<uniffi.synchronicity.DocumentSyncPolicy>> = ffiCatching {
-        nativeLib.node().settings().getSyncPolicies()
-    }
-
-    fun setSyncPolicy(docType: DocumentType, policy: SyncPolicy): Result<Unit> = ffiCatching {
-        nativeLib.node().settings().setSyncPolicy(docType, policy)
-    }
-
-    /**
-     * This node's Pin/Exclude override for a document, or null if it follows this node's sync
-     * policy for the document's type. Backs the document-detail "Keep here" picker.
-     */
-    fun getDocumentSyncOverride(documentId: String): Result<DocumentSyncOverride?> = ffiCatching {
-        nativeLib.node().settings().getDocumentSyncOverride(documentId)
-    }
-
-    fun setDocumentSyncOverride(documentId: String, value: DocumentSyncOverride): Result<Unit> =
-        ffiCatching {
-            nativeLib.node().settings().setDocumentSyncOverride(documentId, value)
-        }
-
-    /** Clears a document's override, reverting it to following its type's sync policy. */
-    fun clearDocumentSyncOverride(documentId: String): Result<Unit> = ffiCatching {
-        nativeLib.node().settings().clearDocumentSyncOverride(documentId)
-    }
-
-    fun getLogConfig(): Result<LogConfig> = ffiCatching {
-        nativeLib.node().settings().getLogConfig()
-    }
-
-    /** Persist the log config and immediately apply it to the running logger. */
-    fun setLogConfig(verbosity: LogVerbosity, showIrohLogs: Boolean): Result<Unit> =
-        ffiCatching { nativeLib.node().settings().setLogConfig(verbosity, showIrohLogs) }
-            .also { result ->
-                if (result.isSuccess) {
-                    uniffi.synchronicity.updateAndroidLogFilter(verbosity, showIrohLogs)
-                }
-            }
-}

android/app/src/main/java/com/gregshuflin/synchronicity/StoreChanges.kt

@@ -2,8 +2,10 @@ package com.gregshuflin.synchronicity
 
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.MutableIntState
 import androidx.compose.runtime.collectAsState
 import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableIntStateOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberUpdatedState
@@ -31,7 +33,7 @@ private const val RETRY_DELAY_MS = 3_000L
 /**
  * How long a wake lets the rest of a burst land before it is reported.
  *
- * A catalogue sync commits a chunk of documents per transaction and does it repeatedly, so a screen
+ * A catalog sync commits a chunk of documents per transaction and does it repeatedly, so a screen
  * told about each one would spend the sync rebuilding itself. One report per window bounds that at
  * a handful a second while a sync runs, and costs nothing while one isn't: this is a settle
  * interval, not a poll — nothing wakes unless something already happened.
@@ -71,11 +73,11 @@ object StoreChanges {
      * The latest cursor, or `null` until the first one has been read. Screens collect this through
      * [OnStoreChange] rather than directly.
      */
-    fun cursor(nativeLib: NativeLib): StateFlow<ChangeCursor?> =
+    fun cursor(): StateFlow<ChangeCursor?> =
         shared
             ?: synchronized(lock) {
                 shared
-                    ?: watch(nativeLib)
+                    ?: watch()
                         .stateIn(scope, SharingStarted.WhileSubscribed(LINGER_MS), null)
                         .also { shared = it }
             }
@@ -86,18 +88,20 @@ object StoreChanges {
      * The first emission is the cursor as of starting, which is what the screens are already at —
      * so [OnStoreChange] never treats it as a change and nothing reloads what it just read.
      */
-    private fun watch(nativeLib: NativeLib): Flow<ChangeCursor> = flow {
-        var since = readCursor(nativeLib)
+    private fun watch(): Flow<ChangeCursor> = flow {
+        var since = readCursor()
         emit(since)
         while (currentCoroutineContext().isActive) {
             val woken =
-                withContext(Dispatchers.IO) { nativeLib.changes.wait(since, WAIT_TIMEOUT_MS) }
+                withContext(Dispatchers.IO) {
+                    NativeLib.ffi { changes().wait(since, WAIT_TIMEOUT_MS.toULong()) }
+                }
             val next = woken.getOrNull()
             if (next == null) {
                 delay(RETRY_DELAY_MS)
                 continue
             }
-            since = settle(nativeLib, next)
+            since = settle(next)
             emit(since)
         }
     }
@@ -109,9 +113,10 @@ object StoreChanges {
      * quiet, and a screen that stopped updating until it did would be worse than one updating a few
      * times a second. A read that fails here just reports what woke us.
      */
-    private suspend fun settle(nativeLib: NativeLib, woken: ChangeCursor): ChangeCursor {
+    private suspend fun settle(woken: ChangeCursor): ChangeCursor {
         delay(COALESCE_MS)
-        return withContext(Dispatchers.IO) { nativeLib.changes.cursor() }.getOrDefault(woken)
+        return withContext(Dispatchers.IO) { NativeLib.ffi { changes().cursor() } }
+            .getOrDefault(woken)
     }
 
     /**
@@ -120,9 +125,10 @@ object StoreChanges {
      * A screen can be composed before onboarding has opened a store, and the answer to that is to
      * wait for one rather than to leave this collector with no signal for as long as it lives.
      */
-    private suspend fun readCursor(nativeLib: NativeLib): ChangeCursor {
+    private suspend fun readCursor(): ChangeCursor {
         while (true) {
-            val cursor = withContext(Dispatchers.IO) { nativeLib.changes.cursor() }.getOrNull()
+            val cursor =
+                withContext(Dispatchers.IO) { NativeLib.ffi { changes().cursor() } }.getOrNull()
             if (cursor != null) return cursor
             delay(RETRY_DELAY_MS)
         }
@@ -142,12 +148,8 @@ object StoreChanges {
  * the user is pointing at is alerted, not rewritten underneath them.
  */
 @Composable
-fun OnStoreChange(
-    nativeLib: NativeLib,
-    vararg channels: ChangeChannel,
-    onChange: suspend () -> Unit,
-) {
-    val cursor by StoreChanges.cursor(nativeLib).collectAsState()
+fun OnStoreChange(vararg channels: ChangeChannel, onChange: suspend () -> Unit) {
+    val cursor by StoreChanges.cursor().collectAsState()
     val applied = remember { mutableStateOf<ChangeCursor?>(null) }
     // The effect restarts on a new cursor, not on a new lambda, so a screen whose reload closes
     // over state that has since moved — "is this list settled?" — would otherwise act on the
@@ -163,6 +165,21 @@ fun OnStoreChange(
     }
 }
 
+/**
+ * A counter that ticks whenever one of [channels] changes while this screen is composed — the key a
+ * screen's load effect restarts on. The screen may bump it too, after a write of its own.
+ *
+ * A document arriving from another node, or an import finishing here, belongs in the list on screen
+ * — not in the one the user will see next time they open this. Being [OnStoreChange] underneath,
+ * the watch is scoped to composition, so a screen off the back stack re-reads nothing.
+ */
+@Composable
+fun rememberReloadKey(vararg channels: ChangeChannel): MutableIntState {
+    val key = remember { mutableIntStateOf(0) }
+    OnStoreChange(*channels) { key.intValue++ }
+    return key
+}
+
 /**
  * Whether [channel]'s counter moved between [previous] and this cursor.
  *

android/app/src/main/java/com/gregshuflin/synchronicity/SyncFailures.kt

@@ -2,7 +2,6 @@ package com.gregshuflin.synchronicity
 
 import uniffi.synchronicity.Recourse
 import uniffi.synchronicity.SyncException
-import uniffi.synchronicity.recourse
 
 /**
  * The failure text to show a user or write to a log, without uniffi's generated `message` prefix.
@@ -14,7 +13,7 @@ import uniffi.synchronicity.recourse
  * The `when` is exhaustive with no `else` because [SyncException] is a sealed hierarchy — this is
  * the part of Rust's `Result<T, SyncError>` that survives the trip through `kotlin.Result`, whose
  * error slot is statically only `Throwable`. When the Rust `SyncError` enum grows a variant, uniffi
- * regenerates the sealed class and this stops compiling, which is the intended behaviour: see
+ * regenerates the sealed class and this stops compiling, which is the intended behavior: see
  * docs/adr/0022 and docs/adr/0023.
  */
 val SyncException.detail: String
@@ -26,20 +25,23 @@ val SyncException.detail: String
             is SyncException.Offline -> msg
             is SyncException.InvalidInput -> msg
             is SyncException.PreconditionUnmet -> msg
-            is SyncException.Cancelled -> msg
+            is SyncException.Canceled -> msg
             is SyncException.Internal -> msg
         }
 
+/**
+ * The text to show a user for any failure: [detail] for a [SyncException], else the throwable's own
+ * message. Use this rather than `message`, which carries uniffi's `msg=` prefix (see [detail]).
+ */
+val Throwable.userMessage: String
+    get() = (this as? SyncException)?.detail ?: message ?: toString()
+
 /**
  * What the user can do about this failure — the shared Rust-side policy (docs/adr/0023), not a
  * per-frontend guess. `gui-app` and the TUI resolve the same failure the same way.
- *
- * Delegates to the exported free function rather than a method: uniffi generates error enums as
- * plain classes with no methods, so the classification round-trips through the FFI. That costs one
- * small buffer, at error frequency.
  */
 val SyncException.userRecourse: Recourse
-    get() = recourse(this)
+    get() = recourse()
 
 /**
  * Whether a frontend should offer an immediate "Try again" affordance.
@@ -50,12 +52,3 @@ val SyncException.userRecourse: Recourse
  */
 val SyncException.isRetryableNow: Boolean
     get() = userRecourse == Recourse.RETRY_NOW
-
-/**
- * Whether the thing being acted on is simply gone (deleted here or on another node).
- *
- * Callers should refresh the offending view and drop the stale item rather than reporting an error
- * at all — the operation failed, but nothing is wrong.
- */
-val SyncException.isVanished: Boolean
-    get() = userRecourse == Recourse.VANISHED

android/app/src/main/java/com/gregshuflin/synchronicity/SynchronicityApplication.kt

@@ -0,0 +1,22 @@
+package com.gregshuflin.synchronicity
+
+import android.app.Application
+import coil.ImageLoader
+import coil.ImageLoaderFactory
+import com.gregshuflin.synchronicity.covers.DocumentCover
+import com.gregshuflin.synchronicity.covers.DocumentCoverFetcher
+import com.gregshuflin.synchronicity.covers.DocumentCoverKeyer
+
+/**
+ * Exists to give Coil one app-wide [ImageLoader] that knows how to load a [DocumentCover], so the
+ * library screens' covers share one memory cache with each other and with the podcast art.
+ */
+class SynchronicityApplication : Application(), ImageLoaderFactory {
+    override fun newImageLoader(): ImageLoader =
+        ImageLoader.Builder(this)
+            .components {
+                add(DocumentCoverKeyer())
+                add(DocumentCoverFetcher.Factory())
+            }
+            .build()
+}

android/app/src/main/java/com/gregshuflin/synchronicity/clippings/ClippingEditSession.kt

@@ -0,0 +1,85 @@
+package com.gregshuflin.synchronicity.clippings
+
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.setValue
+import androidx.lifecycle.ViewModel
+import com.gregshuflin.synchronicity.ui.IncomingBody
+import com.gregshuflin.synchronicity.ui.IncomingBodyBuffer
+
+/**
+ * The clipping the user has open in an editor, and everything unsaved about it.
+ *
+ * A clipping's text is a whole-buffer, last-write-wins artifact, so an editable buffer over one is
+ * exactly the case AGENTS.md's first design principle is about: a version arriving from another
+ * node is announced and held — the buffer is left exactly as the user left it — and nothing is
+ * written until they say which version they want. [IncomingBody.alertFor] is the rule that decides
+ * which reads are news and which are this node's own save coming back; this type is the state that
+ * rule runs against.
+ *
+ * A ViewModel rather than `remember`, for the reason `NotesEditorSession` is one: a decision that
+ * vanishes when the user glances at another screen — or turns the phone — is not a decision they
+ * were really given. Everything else on the Clippings screen (the loaded page, the composer, what
+ * is expanded) stays in `remember`, because it is cheap to rebuild and means nothing once you have
+ * left.
+ *
+ * One clipping at a time. Two open buffers would be two unresolved decisions sharing one strip.
+ */
+class ClippingEditSession : ViewModel() {
+
+    /** The clipping open in the editor, or `null` when none is. */
+    var clippingId by mutableStateOf<String?>(null)
+        private set
+
+    /** The editor's text, its store baseline, and any version held from another node. */
+    val buffer = IncomingBodyBuffer()
+
+    /** What is in the editor — this node's unsaved work, and the thing being protected. */
+    var text by buffer::text
+
+    /** Text for this clipping that this node did not write. Held, never applied. */
+    val incoming: String?
+        get() = buffer.incoming
+
+    /**
+     * What went wrong with the last attempt to save, shown on the editor. A save that failed must
+     * not also lose what it was given, so the buffer is left alone and this says why.
+     */
+    var error by mutableStateOf<String?>(null)
+
+    /** Whether the editor is open on `id`. */
+    fun isEditing(id: String): Boolean = clippingId == id
+
+    /** Open an editor over `stored`, which is what the store holds for `id` right now. */
+    fun open(id: String, stored: String) {
+        clippingId = id
+        buffer.reset(stored)
+        error = null
+    }
+
+    /** Close the editor, discarding whatever is in it. */
+    fun close() {
+        clippingId = null
+        buffer.reset("")
+        error = null
+    }
+
+    /**
+     * A fresh read of the store, for whichever clipping is open; see [IncomingBodyBuffer.observe].
+     */
+    fun observe(stored: String) = buffer.observe(stored)
+
+    /** Show the version that arrived; see [IncomingBodyBuffer.loadIncoming]. */
+    fun loadIncoming() {
+        if (buffer.loadIncoming()) error = null
+    }
+
+    /** Keep this node's text over theirs; see [IncomingBodyBuffer.keepLocal] for the ordering. */
+    fun keepLocal(): String? = buffer.keepLocal()
+
+    /** The store now holds `written`, so a re-read finding it is the write completing, not news. */
+    fun saved(written: String) {
+        buffer.saved(written)
+        error = null
+    }
+}

android/app/src/main/java/com/gregshuflin/synchronicity/clippings/ClippingsScreen.kt

@@ -1,6 +1,7 @@
 package com.gregshuflin.synchronicity.clippings
 
 import android.content.ClipData
+import android.util.Log
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
@@ -40,8 +41,11 @@ import com.gregshuflin.synchronicity.NativeLib
 import com.gregshuflin.synchronicity.OnStoreChange
 import com.gregshuflin.synchronicity.documents.ui.formatDate
 import com.gregshuflin.synchronicity.ui.ChangedElsewhereStrip
+import com.gregshuflin.synchronicity.ui.IncomingBodyStrip
+import com.gregshuflin.synchronicity.ui.SharedCopy
 import com.gregshuflin.synchronicity.ui.SubAppScreen
-import com.gregshuflin.synchronicity.ui.actions
+import com.gregshuflin.synchronicity.ui.activityViewModel
+import com.gregshuflin.synchronicity.userMessage
 import kotlinx.coroutines.launch
 import uniffi.synchronicity.ChangeChannel
 import uniffi.synchronicity.ClippingItem
@@ -52,7 +56,11 @@ import uniffi.synchronicity.clippingBodyElsewhere
 import uniffi.synchronicity.clippingDeleteFailed
 import uniffi.synchronicity.clippingPending
 import uniffi.synchronicity.clippingReadFailed
+import uniffi.synchronicity.clippingUpdateFailed
 import uniffi.synchronicity.clippingsCopy
+import uniffi.synchronicity.incomingClippingChangeCopy
+
+private const val TAG = "ClippingsScreen"
 
 private val SCREEN_PADDING = 16.dp
 
@@ -74,10 +82,15 @@ private const val PREFETCH_ROWS = 10
  * title of it — the title *is* its first line), same read-only stance, and its words come from
  * `copy::clippings` so the two cannot drift apart.
  *
- * **Existing clippings are read-only here too.** Editing one needs the alert-don't-apply flow
- * around an editable buffer (CLAUDE.md; ADR 0031), because the body is last-write-wins and an
- * unguarded editor would silently lose one side. The composer has no such problem: nothing can
- * arrive for a clipping that does not exist yet.
+ * **A clipping can be edited in place**, one at a time, and the buffer carries the whole
+ * alert-don't-apply flow around it (AGENTS.md; ADR 0031): the body is last-write-wins, so a version
+ * arriving from another node is announced on the card and held, and nothing is written until the
+ * user says which one they want. [ClippingEditSession] is that state, and it outlives a navigation
+ * and a rotation on purpose. The composer has no such problem: nothing can arrive for a clipping
+ * that does not exist yet.
+ *
+ * Only the text is editable — `source_url` is written `Immutable` (ADR 0039), and the title is the
+ * first line of the text — so there is no second field and nothing for Save to batch.
  *
  * Clippings arrive while the screen is open — from a browser on a desktop node, or from any node's
  * sync — so it watches the store rather than only reading on navigation. What it does with an
@@ -88,10 +101,11 @@ private const val PREFETCH_ROWS = 10
  * is appended, never spliced in at the top, so nothing under the user's finger moves.
  */
 @Composable
-fun ClippingsScreen(nativeLib: NativeLib, onBack: () -> Unit, modifier: Modifier = Modifier) {
+fun ClippingsScreen(onBack: () -> Unit, modifier: Modifier = Modifier) {
     val copy = remember { clippingsCopy() }
-    val timezone = remember { nativeLib.settings.getTimezone() }
+    val timezone = remember { NativeLib.timezone() }
     val listState = rememberLazyListState()
+    val session = activityViewModel<ClippingEditSession>()
 
     var clippings by remember { mutableStateOf<List<ClippingItem>>(emptyList()) }
     // What a watch has read but not shown, when showing it would have disrupted something. The
@@ -108,11 +122,13 @@ fun ClippingsScreen(nativeLib: NativeLib, onBack: () -> Unit, modifier: Modifier
     var loadingMore by remember { mutableStateOf(false) }
 
     // Whether the user is plainly not in the middle of reading something. Prepending to a list is
-    // disruptive while they are: every row below shifts by one. The desktop asks the same three
-    // questions (`ClippingsView::settled`).
+    // disruptive while they are: every row below shifts by one. The desktop asks the same
+    // questions (`ClippingsView::settled`), and an open editor is the strongest of them — a card
+    // being typed into is the one thing on this screen that must not move.
     val settled =
         expandedId == null &&
             !composing &&
+            session.clippingId == null &&
             listState.firstVisibleItemIndex == 0 &&
             listState.firstVisibleItemScrollOffset == 0
 
@@ -120,8 +136,7 @@ fun ClippingsScreen(nativeLib: NativeLib, onBack: () -> Unit, modifier: Modifier
     // settled, so the rows they can see are the rows they get) or is held aside; either way the
     // list re-anchors at the top and pages down again from there.
     fun load(intoView: Boolean) {
-        nativeLib.clippings
-            .listPage(null)
+        NativeLib.ffi { clippings().listPage(null) }
             .onSuccess { page ->
                 error = null
                 if (intoView) {
@@ -132,27 +147,66 @@ fun ClippingsScreen(nativeLib: NativeLib, onBack: () -> Unit, modifier: Modifier
                     held = page
                 }
             }
-            .onFailure { error = clippingReadFailed(it.message ?: "unknown error") }
+            .onFailure { error = clippingReadFailed(it.userMessage) }
     }
 
     fun loadMore() {
         val cursor = nextCursor ?: return
         if (loadingMore) return
         loadingMore = true
-        nativeLib.clippings
-            .listPage(cursor)
+        NativeLib.ffi { clippings().listPage(cursor) }
             .onSuccess { page ->
                 clippings = clippings + page.items
                 nextCursor = page.nextCursor
                 error = null
             }
-            .onFailure { error = clippingReadFailed(it.message ?: "unknown error") }
+            .onFailure { error = clippingReadFailed(it.userMessage) }
         loadingMore = false
     }
 
+    // Put one row back from the store without disturbing the rows around it — the answer to a
+    // save, where reloading the whole list would re-anchor it under an editor that is still open.
+    // Re-read rather than assembled here: `update` derives the title from the text, so a row built
+    // locally would disagree with the store about it.
+    //
+    // A failure here is logged and no more: the write it follows has already landed, and the
+    // change signal that write set off re-reads the list anyway, so the worst case is one stale
+    // card for a coalescing interval.
+    fun refreshRow(id: String) {
+        NativeLib.ffi { clippings().get(id) }
+            .onSuccess { updated ->
+                if (updated != null) {
+                    clippings = clippings.map { if (it.id == id) updated else it }
+                }
+            }
+            .onFailure { Log.w(TAG, "Failed to re-read clipping $id after saving it", it) }
+    }
+
+    // Write the buffer, and report a failure on the editor rather than losing what it holds.
+    fun write(id: String, text: String, thenClose: Boolean) {
+        NativeLib.ffi { clippings().update(id, text) }
+            .onSuccess {
+                if (thenClose) session.close() else session.saved(text)
+                refreshRow(id)
+            }
+            .onFailure { session.error = clippingUpdateFailed(it.userMessage) }
+    }
+
     // Navigating to the screen is an explicit act, so the first read applies outright.
     LaunchedEffect(reloadToken) { load(intoView = true) }
-    OnStoreChange(nativeLib, ChangeChannel.DOCUMENTS) { load(intoView = settled) }
+    OnStoreChange(ChangeChannel.DOCUMENTS) {
+        // The open editor first: it is what the user is actually in, and the list's own answer to
+        // the same signal may hold rows back on account of it.
+        val openId = session.clippingId
+        if (openId != null) {
+            val stored = NativeLib.ffi { clippings().get(openId) }.getOrNull()?.text
+            // Gone, unreadable, or its body is no longer held here: none of those is a version to
+            // offer the user a choice between. Nor is an answer about a clipping the editor has
+            // since moved off.
+            if (stored != null && session.clippingId == openId) session.observe(stored)
+        }
+        load(intoView = settled)
+    }
 
     // Fetch ahead of the edge rather than at it: asking when the last row appears means the user
     // watches a gap while the read runs. Keyed on the last visible index so it fires once per
@@ -172,7 +226,8 @@ fun ClippingsScreen(nativeLib: NativeLib, onBack: () -> Unit, modifier: Modifier
             IconButton(onClick = { composing = !composing }) {
                 Icon(
                     imageVector = if (composing) Icons.Default.Close else Icons.Default.Add,
-                    contentDescription = if (composing) actions().cancel else copy.newClipping,
+                    contentDescription =
+                        if (composing) SharedCopy.actions.cancel else copy.newClipping,
                 )
             }
         },
@@ -207,20 +262,36 @@ fun ClippingsScreen(nativeLib: NativeLib, onBack: () -> Unit, modifier: Modifier
             Composer(
                 copy = copy,
                 onKeep = { text, sourceUrl ->
-                    nativeLib.clippings
-                        .capture(text, sourceUrl, null)
+                    NativeLib.ffi { clippings().capture(text, sourceUrl, null) }
                         .onSuccess {
                             composing = false
                             reloadToken++
                         }
                         // Left open, with the text still in it: a capture that failed must not
                         // also lose what it was given.
-                        .onFailure { error = it.message }
+                        .onFailure { error = it.userMessage }
                 },
                 onDiscard = { composing = false },
             )
         }
 
+        // The open editor, when the clipping it belongs to is not among the loaded rows — deleted
+        // on another node, or pushed off the first page by arrivals the user asked to see. An
+        // editor with unsaved text in it, or an unanswered version held against it, must not
+        // become invisible because the list moved: the decision would still be outstanding and
+        // there would be nowhere to make it. The desktop keeps the same invariant.
+        val detached = session.clippingId?.takeIf { open -> clippings.none { it.id == open } }
+        if (detached != null) {
+            ClippingEditor(
+                session = session,
+                copy = copy,
+                onSave = { write(detached, session.text, thenClose = true) },
+                onKeepMine = {
+                    session.keepLocal()?.let { mine -> write(detached, mine, thenClose = false) }
+                },
+            )
+        }
+
         if (clippings.isEmpty()) {
             Text(
                 text = copy.empty,
@@ -235,23 +306,40 @@ fun ClippingsScreen(nativeLib: NativeLib, onBack: () -> Unit, modifier: Modifier
                 verticalArrangement = Arrangement.spacedBy(GAP),
             ) {
                 items(clippings, key = { it.id }) { clipping ->
-                    ClippingCard(
-                        clipping = clipping,
-                        copy = copy,
-                        timezone = timezone,
-                        expanded = expandedId == clipping.id,
-                        onToggle = {
-                            expandedId = if (expandedId == clipping.id) null else clipping.id
-                        },
-                        onDelete = {
-                            nativeLib.clippings
-                                .delete(clipping.id)
-                                .onSuccess { reloadToken++ }
-                                .onFailure {
-                                    error = clippingDeleteFailed(it.message ?: "unknown error")
+                    if (session.isEditing(clipping.id)) {
+                        ClippingEditor(
+                            session = session,
+                            copy = copy,
+                            onSave = { write(clipping.id, session.text, thenClose = true) },
+                            onKeepMine = {
+                                session.keepLocal()?.let { mine ->
+                                    write(clipping.id, mine, thenClose = false)
                                 }
-                        },
-                    )
+                            },
+                        )
+                    } else {
+                        ClippingCard(
+                            clipping = clipping,
+                            copy = copy,
+                            timezone = timezone,
+                            expanded = expandedId == clipping.id,
+                            // Offered only on a clipping whose text this node holds: editing a
+                            // body that lives elsewhere would write a second version of text this
+                            // node has never seen. One at a time, so the rest go inert.
+                            onEdit =
+                                clipping.text
+                                    ?.takeIf { session.clippingId == null }
+                                    ?.let { body -> { session.open(clipping.id, body) } },
+                            onToggle = {
+                                expandedId = if (expandedId == clipping.id) null else clipping.id
+                            },
+                            onDelete = {
+                                NativeLib.ffi { clippings().delete(clipping.id) }
+                                    .onSuccess { reloadToken++ }
+                                    .onFailure { error = clippingDeleteFailed(it.userMessage) }
+                            },
+                        )
+                    }
                 }
             }
         }
@@ -273,7 +361,7 @@ private fun Composer(
 ) {
     var text by remember { mutableStateOf("") }
     var sourceUrl by remember { mutableStateOf("") }
-    val labels = actions()
+    val labels = SharedCopy.actions
 
     Card(modifier = Modifier.fillMaxWidth().padding(SCREEN_PADDING)) {
         Column(
@@ -307,6 +395,68 @@ private fun Composer(
     }
 }
 
+/**
+ * A clipping's text, open for editing: the box, whatever a sync is holding against it, and the way
+ * out.
+ *
+ * Only the text, because only the text is a field of this record that a later edit revises — the
+ * source URL is `Immutable` and the title is the first line of the text. So AGENTS.md's "the mode
+ * is the whole screen" rule has nothing here to batch behind Save, and Cancel has nothing to back
+ * out of but the buffer.
+ *
+ * Cancel is also the answer to a version that arrived and was never resolved: the store holds
+ * theirs, this node wrote nothing, so backing out takes theirs — which is what the strip said would
+ * happen.
+ */
+@Composable
+private fun ClippingEditor(
+    session: ClippingEditSession,
+    copy: ClippingsCopy,
+    onSave: () -> Unit,
+    onKeepMine: () -> Unit,
+) {
+    val labels = SharedCopy.actions
+    val pending = session.incoming != null
+
+    Card(modifier = Modifier.fillMaxWidth()) {
+        Column(
+            modifier = Modifier.padding(CARD_PADDING),
+            verticalArrangement = Arrangement.spacedBy(GAP),
+        ) {
+            OutlinedTextField(
+                value = session.text,
+                onValueChange = { session.text = it },
+                placeholder = { Text(copy.editPlaceholder) },
+                minLines = COLLAPSED_LINES,
+                modifier = Modifier.fillMaxWidth(),
+            )
+            if (pending) {
+                IncomingBodyStrip(
+                    copy = remember { incomingClippingChangeCopy() },
+                    onLoadTheirs = { session.loadIncoming() },
+                    onKeepMine = onKeepMine,
+                )
+            }
+            session.error?.let { message ->
+                Text(
+                    text = message,
+                    color = MaterialTheme.colorScheme.error,
+                    style = MaterialTheme.typography.bodySmall,
+                )
+            }
+            Row(horizontalArrangement = Arrangement.spacedBy(GAP)) {
+                // Inert while a version from another node is unresolved: saving through it would
+                // overwrite their edit without ever saying so. The strip directly above is where
+                // that write is offered, with what it costs written on it.
+                TextButton(onClick = onSave, enabled = session.text.isNotBlank() && !pending) {
+                    Text(labels.save)
+                }
+                TextButton(onClick = { session.close() }) { Text(labels.cancel) }
+            }
+        }
+    }
+}
+
 /** One clipping: the text itself, where it came from, when it was kept, and what can be done. */
 @Composable
 private fun ClippingCard(
@@ -314,12 +464,14 @@ private fun ClippingCard(
     copy: ClippingsCopy,
     timezone: String?,
     expanded: Boolean,
+    /** `null` when this clipping cannot be edited here, or another one already is. */
+    onEdit: (() -> Unit)?,
     onToggle: () -> Unit,
     onDelete: () -> Unit,
 ) {
     val clipboard = LocalClipboard.current
     val scope = rememberCoroutineScope()
-    val labels = actions()
+    val labels = SharedCopy.actions
     val body = clipping.text
 
     Card(modifier = Modifier.fillMaxWidth()) {
@@ -373,6 +525,9 @@ private fun ClippingCard(
                             Text(copy.copyAction)
                         }
                     }
+                    if (onEdit != null) {
+                        TextButton(onClick = onEdit) { Text(labels.edit) }
+                    }
                     TextButton(onClick = onDelete) {
                         Text(labels.delete, color = MaterialTheme.colorScheme.error)
                     }

android/app/src/main/java/com/gregshuflin/synchronicity/comics/ComicFilePicker.kt

@@ -1,35 +0,0 @@
-package com.gregshuflin.synchronicity.comics
-
-import android.net.Uri
-import androidx.activity.compose.rememberLauncherForActivityResult
-import androidx.activity.result.contract.ActivityResultContracts
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Modifier
-import com.gregshuflin.synchronicity.ui.IMPORT_ICON
-import com.gregshuflin.synchronicity.ui.IconButton
-
-/**
- * Import button for a `.cbz` comic archive. A `.cbz` is a ZIP under the hood and Android's picker
- * has no reliable MIME type for it, so this opens the generic any-file document picker and leaves
- * validation to the importer, which surfaces a clear error if the pick isn't a real comic archive.
- */
-@Composable
-fun ComicFilePicker(
-    onFileSelect: (Uri) -> Unit,
-    modifier: Modifier = Modifier,
-    text: String = "Import comic (.cbz)",
-) {
-    val filePickerLauncher =
-        rememberLauncherForActivityResult(contract = ActivityResultContracts.GetContent()) {
-            uri: Uri? ->
-            uri?.let { onFileSelect(it) }
-        }
-
-    IconButton(
-        modifier = modifier,
-        onClick = { filePickerLauncher.launch("*/*") },
-        icon = IMPORT_ICON,
-        text = text,
-        iconContentDescription = text,
-    )
-}