chore: merge main into release/v1.1.0 (#42)

Brings the exact tag checks from #40 into the release branch. beta.yaml runs from the branch's own files, and the old prefix-matching lookup treated v1.1.0-beta.1 as a shipped v1.1.0, so the 1.1.0-beta.2 run was refused.

The one conflict was in publish_codeberg_release.sh: kept #40's stricter upload handling plus the offline APK assets from #41. scripts/release_gate.sh now reports cut=true for 1.1.0-beta.2.

Co-authored-by: Jean-Luc Makiola <business@jeanlucmakiola.de>
Reviewed-on: https://codeberg.org/jlmakiola/agendula/pulls/42

.forgejo/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,23 @@
+---
+name: Bug report
+about: Something doesn't work the way it should
+title: ""
+labels:
+  - bug
+---
+
+### What happened
+
+
+### What you expected
+
+
+### Steps to reproduce
+1.
+2.
+3.
+
+### Environment
+- Agendula version: <!-- Settings → bottom of the screen -->
+- Android version:
+- Device:

.forgejo/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,24 @@
+# Kept enabled so anything that doesn't fit the four templates still has a way
+# in.
+blank_issues_enabled: true
+
+contact_links:
+  - name: Translate Agendula
+    url: https://weblate.dev.jeanlucmakiola.de/engage/agendula/
+    about: >-
+      Translations are managed on Weblate, not here — it owns every values-*
+      file, so a hand-edited translation gets overwritten on the next sync.
+      No coding needed: pick or request a language and translate in the browser.
+
+  - name: Contributing guide
+    url: https://codeberg.org/jlmakiola/agendula/src/branch/main/CONTRIBUTING.md
+    about: >-
+      Before opening a pull request: how to build (there's a submodule), where
+      code goes, and the one architectural rule a change is reviewed against.
+
+  - name: Sync sources and scope
+    url: https://codeberg.org/jlmakiola/agendula/src/branch/main/README.md
+    about: >-
+      Agendula is a front-end over the OpenTasks provider, so it works with
+      DAVx5, SmoothSync, DecSync and friends. Google Tasks and Microsoft To Do
+      are out of scope by design — check here before requesting a backend.

.forgejo/ISSUE_TEMPLATE/crash_report.md

@@ -0,0 +1,27 @@
+---
+name: Crash report
+about: Report a crash. Agendula can capture this for you (Settings → Report a problem, or the prompt after a crash) — it copies the report to your clipboard and prefills this form.
+title: "Crash: "
+labels:
+  - bug
+  - crash
+  - priority:high
+---
+
+<!--
+Thanks for reporting a crash in Agendula!
+
+If the app prefilled this for you, the crash report is already below — just add
+what you were doing and submit. Otherwise, paste the report from your clipboard
+into the code block. The report contains only app/Android/device versions and the
+stack trace — no personal data or calendar content.
+-->
+
+### What happened
+
+
+### Crash report
+
+```
+(paste the crash report here)
+```

.forgejo/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,16 @@
+---
+name: Feature request
+about: Suggest an idea or improvement
+title: ""
+labels:
+  - feat
+---
+
+### What would you like Agendula to do?
+
+
+### Why — what problem does it solve?
+
+
+### Anything else
+<!-- mockups, examples from other apps, alternatives you considered -->

.forgejo/ISSUE_TEMPLATE/question.md

@@ -0,0 +1,19 @@
+---
+name: Question
+about: Ask how something works or get help using Agendula
+title: ""
+labels:
+  - question
+---
+
+### Your question
+
+
+### What you've tried
+<!-- so far, if anything -->
+
+
+### Context
+- Agendula version: <!-- Settings → bottom of the screen -->
+- Android version:
+- Device:

.forgejo/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,42 @@
+<!--
+Thanks for contributing to Agendula!
+
+Please skim CONTRIBUTING.md if you haven't:
+https://codeberg.org/jlmakiola/agendula/src/branch/main/CONTRIBUTING.md
+
+Two things it's easy to get wrong:
+  • The one architectural rule — provider column names, `TaskContract`,
+    `ContentResolver` and the authority string never leak above `data/tasks/`.
+  • Don't bump `versionName` / `versionCode`. That bump reaching `main` is what
+    cuts a release, so it belongs only in a release PR.
+-->
+
+### What this changes
+
+
+### Why
+
+<!-- Closes #123 — link the issue this implements or fixes. -->
+
+
+### How it was tested
+
+<!--
+Which of these ran green, and anything you exercised by hand. On-device notes
+are especially useful for UI changes, and for anything touching the provider
+read/write paths (OpenTasks / tasks.org installed).
+
+  ./gradlew lintFullDebug lintOfflineDebug :app:testFullDebugUnitTest :app:testOfflineDebugUnitTest :app:assembleDebug
+  python3 scripts/check_translations.py
+-->
+
+
+### Checklist
+
+- [ ] `./gradlew lintFullDebug lintOfflineDebug :app:testFullDebugUnitTest :app:testOfflineDebugUnitTest :app:assembleDebug` passes locally
+- [ ] New domain logic comes with JVM unit tests under `app/src/test/`
+- [ ] Provider details stay inside `data/tasks/`
+- [ ] No `values-*/strings.xml` touched (Weblate owns those; new English strings in `values/` are fine)
+- [ ] `CHANGELOG.md` updated under `## [Unreleased]`, if the change is user-visible
+- [ ] No `versionName` / `versionCode` bump
+- [ ] No planning or design documents committed

.forgejo/workflows/ci.yaml

@@ -0,0 +1,215 @@
+name: CI
+
+# One gate per pull request. Branch pushes no longer trigger CI on their own,
+# so a change is built once on its PR (covering feature -> release/* and
+# release/* -> main) instead of once per push and again on the merge to main.
+# The merge itself is handled by release.yaml, which only does heavy work when
+# the merge actually cuts a release.
+on:
+  pull_request:
+
+# Cancel superseded runs for the same PR.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Single job named `ci` so the required "CI" status check is always reported,
+  # even for docs-only PRs: those just skip the Android build and the job still
+  # succeeds (fast green check) instead of being filtered out and leaving the
+  # required check pending forever.
+  ci:
+    runs-on: docker
+    env:
+      ANDROID_HOME: /opt/android-sdk
+      ANDROID_SDK_ROOT: /opt/android-sdk
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # Full history so the base..HEAD diff below has a merge-base.
+          fetch-depth: 0
+          submodules: recursive
+
+      # Cheap, always-on guard: the release build must stay reproducible for the
+      # official F-Droid repo (no AGP VCS-info embedding). Runs regardless of
+      # change scope so a regression can't slip through on a "docs-only" PR.
+      - name: Reproducible-release invariant
+        run: bash scripts/check_reproducible_release.sh
+
+      # The committed versionName must parse (X.Y.Z or X.Y.Z-beta.N) and the
+      # committed versionCode must be the one it derives: the official F-Droid
+      # repo builds the tag as committed. And a beta must never reach main,
+      # where the release pipeline would ship it to F-Droid and Play; betas are
+      # cut from release/* branches (docs/RELEASING.md).
+      - name: Committed version is well-formed
+        env:
+          BASE: ${{ github.base_ref }}
+        run: |
+          set -e
+          bash scripts/version_info.sh --check
+          if [ "${BASE#refs/heads/}" = "main" ] && [ "$(bash scripts/version_info.sh channel)" = "beta" ]; then
+            echo "ERROR: versionName $(bash scripts/version_info.sh version) is a beta." >&2
+            echo "Set the stable version (and its versionCode) before merging into main." >&2
+            exit 1
+          fi
+
+      # Also cheap, also always-on. Two failures in one: the script exits
+      # non-zero if this version's changelog is over the 500-character limit,
+      # and the porcelain check below catches a version with no committed
+      # changelog, which would otherwise ship the CHANGELOG.md section instead
+      # of a hand-written summary. A beta version passes both: it ships no
+      # What's New, so the script writes nothing for it.
+      - name: Changelog fits the stores, and is committed
+        run: |
+          set -e
+          bash scripts/sync_changelog_to_fastlane.sh
+          DIRTY=$(git status --porcelain fastlane/metadata/android/en-US/changelogs)
+          if [ -n "$DIRTY" ]; then
+            echo "$DIRTY"
+            echo "ERROR: no committed What's New for this version." >&2
+            echo "Write fastlane/metadata/android/<locale>/changelogs/<versionCode>.txt" >&2
+            echo "(under 500 chars, every shipped locale) and commit it." >&2
+            exit 1
+          fi
+
+      # The fastlane tree feeds F-Droid and Play alike; Play rejects oversized
+      # text and off-spec graphics at upload time, so catch that on the PR.
+      - name: Store listing fits both stores
+        run: python3 scripts/check_store_listing.py
+
+      # Decide whether anything that affects the app build changed. Docs, store
+      # metadata, licence texts and forge housekeeping don't, so those PRs skip
+      # the SDK + Gradle work below but still report a green `ci`.
+      - name: Classify change scope
+        id: scope
+        env:
+          # Deliberately a skip-list, not a build-list: a path nobody thought
+          # about defaults to building. Only paths the Gradle build provably
+          # never reads belong here — note that the workflows themselves, the
+          # `.gitmodules` submodule pointer and `scripts/` are *not* in it.
+          SKIP_RE: '(\.md$|^docs/|^fastlane/|^fdroid-metadata/|^Gemfile$|^design/|^\.(forgejo|gitea)/ISSUE_TEMPLATE/|^\.editorconfig$|^\.gitattributes$|^\.gitignore$|^LICENSE$)'
+        run: |
+          set -e
+          BASE="${{ github.base_ref }}"
+          # Normally the bare branch name; tolerate a full ref, which would
+          # otherwise make the merge-base lookup fail and quietly degrade this
+          # guard into "always build".
+          BASE="${BASE#refs/heads/}"
+          if [ -z "$BASE" ]; then
+            echo "No base branch on this event — running the full build to be safe."
+            echo "code=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          # Full (not --depth=1) base fetch so the merge-base is present even when
+          # the PR branch forked several commits back; a shallow tip has no merge
+          # base with a divergent branch and `git diff base...HEAD` aborts.
+          git fetch --no-tags origin "$BASE"
+          MB=$(git merge-base "origin/$BASE" HEAD 2>/dev/null || true)
+          if [ -z "$MB" ]; then
+            # No common ancestor available — don't risk skipping the build.
+            echo "No merge base with origin/$BASE — running the full build to be safe."
+            echo "code=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          CHANGED=$(git diff --name-only "$MB" HEAD)
+          echo "Changed files:"; echo "$CHANGED"
+          RELEVANT=$(echo "$CHANGED" | grep -vE "$SKIP_RE" || true)
+          if [ -n "$RELEVANT" ]; then
+            # Naming them makes "why did my docs PR build for four minutes?"
+            # answerable from the log alone.
+            echo "Build-relevant changes:"; echo "$RELEVANT"
+            echo "code=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Docs/metadata-only change — skipping the Android build."
+            echo "code=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Setup Java
+        if: steps.scope.outputs.code == 'true'
+        # JetBrains 21 is what gradle-daemon-jvm.properties asks for; installing it
+        # here keeps Gradle from downloading it via foojay.
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'jetbrains'
+          java-version: '21'
+
+      # Fully qualified on purpose. Codeberg resolves bare `uses:` refs against
+      # data.forgejo.org, Forgejo's own action mirror — actions/checkout,
+      # setup-java and cache all exist there, but android-actions/setup-android
+      # does not, and the job dies with "repository not found". Gitea's instance
+      # defaults to GitHub, which is why this never surfaced before the split.
+      - name: Setup Android SDK
+        if: steps.scope.outputs.code == 'true'
+        uses: https://github.com/android-actions/setup-android@v3
+        with:
+          # Default ("tools platform-tools") drags in the Android Emulator
+          # (~300 MB) which the build never uses.
+          packages: ''
+
+      - name: Setup Android SDK cache
+        if: steps.scope.outputs.code == 'true'
+        uses: actions/cache@v4
+        with:
+          path: /opt/android-sdk
+          key: ${{ runner.os }}-android-sdk-37-36.0.0
+
+      - name: Install Android SDK packages
+        if: steps.scope.outputs.code == 'true'
+        run: |
+          yes | sdkmanager --licenses >/dev/null || true
+          sdkmanager \
+            "platform-tools" \
+            "platforms;android-37.0" \
+            "build-tools;36.0.0"
+
+      - name: Setup Gradle cache
+        if: steps.scope.outputs.code == 'true'
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'gradle/libs.versions.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-
+
+      - name: Grant execute permission for gradlew
+        if: steps.scope.outputs.code == 'true'
+        run: chmod +x ./gradlew
+
+      # No --no-daemon: the daemon lives only as long as this job container
+      # and lets the following steps skip JVM startup + reconfiguration.
+      - name: Lint (debug variants only)
+        if: steps.scope.outputs.code == 'true'
+        run: ./gradlew lintFullDebug lintOfflineDebug
+
+      # :dav is a plain JVM module, so it has no testDebugUnitTest — naming only
+      # that task would compile the vendored suite and run none of it, which is
+      # the whole safety argument in dav/PROVENANCE.md.
+      - name: Unit tests
+        if: steps.scope.outputs.code == 'true'
+        run: ./gradlew testFullDebugUnitTest testOfflineDebugUnitTest :dav:test :caldav:test
+
+      - name: Assemble debug APKs
+        if: steps.scope.outputs.code == 'true'
+        run: ./gradlew assembleDebug
+
+      - name: Trivy filesystem scan
+        if: steps.scope.outputs.code == 'true'
+        run: |
+          set -e
+          SUDO=""
+          if command -v sudo >/dev/null 2>&1; then
+            SUDO="sudo"
+          fi
+          if command -v apt-get >/dev/null 2>&1; then
+            $SUDO apt-get update
+            $SUDO apt-get install -y wget apt-transport-https gnupg lsb-release
+            wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | $SUDO tee /usr/share/keyrings/trivy.gpg > /dev/null
+            echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | $SUDO tee /etc/apt/sources.list.d/trivy.list
+            $SUDO apt-get update
+            $SUDO apt-get install -y trivy
+          fi
+          trivy filesystem --severity HIGH,CRITICAL --exit-code 0 .
+        continue-on-error: true

.forgejo/workflows/translations.yaml

@@ -0,0 +1,39 @@
+name: Translations
+
+# Fast, SDK-free parity check for translation resources, so Weblate PRs (which
+# only touch values-*/strings.xml) get quick feedback without the full Android
+# build. The deeper checks still run in CI via lintFullDebug (ExtraTranslation).
+#
+# Runs on every PR (no path filter) so the required "Translations / check"
+# status is always reported — like the `ci` job. A path-filtered workflow is
+# skipped on unrelated PRs and never posts its status, which leaves that
+# required check pending forever and blocks the merge of any code-only PR into a
+# release/* branch. The check itself is cheap and simply passes when the
+# committed translations are consistent, so always running it costs nothing.
+on:
+  pull_request:
+
+concurrency:
+  group: translations-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: docker
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Ensure python3
+        run: |
+          if ! command -v python3 >/dev/null 2>&1; then
+            if command -v apt-get >/dev/null 2>&1; then
+              apt-get update && apt-get install -y python3
+            elif command -v apk >/dev/null 2>&1; then
+              apk add --no-cache python3
+            fi
+          fi
+          python3 --version
+
+      - name: Check translation parity
+        run: python3 scripts/check_translations.py

.gitea/workflows/beta.yaml

@@ -0,0 +1,181 @@
+name: Beta — Codeberg pre-release
+
+# A beta is cut by pushing a release branch whose committed versionName is
+# X.Y.Z-beta.N (see docs/RELEASING.md). Same model as release.yaml: the
+# committed version is the trigger and the vX.Y.Z-beta.N tag is an output. If
+# its Codeberg pre-release doesn't carry the APK yet, this runs the unit tests, builds and
+# signs the APK with the app key, records a Gitea pre-release (with the R8
+# mapping) and publishes a Codeberg pre-release with the APK + SHA-256.
+#
+# Deliberately nothing else. A beta never reaches the F-Droid repos or Play:
+# Obtainium hides pre-releases unless a user opts in, the official F-Droid
+# recipe only picks up `^v[0-9.]+$` tags, and Codeberg's "latest release"
+# skips pre-releases. Pushes of a release branch carrying a stable version
+# (the usual state) fall through `detect` and do nothing.
+#
+# Lives in .gitea/workflows next to release.yaml for the same reason: it needs
+# the app signing key, which only the self-hosted Gitea instance holds.
+on:
+  push:
+    branches: ['release/**']
+
+concurrency:
+  group: beta
+  cancel-in-progress: false
+
+jobs:
+  detect:
+    # Gitea only; see the same guard in release.yaml.
+    if: github.repository_owner == 'makiolaj'
+    runs-on: docker
+    outputs:
+      is_beta: ${{ steps.v.outputs.is_beta }}
+      version: ${{ steps.v.outputs.version }}
+      version_code: ${{ steps.v.outputs.version_code }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Resolve version and whether it still needs publishing
+        id: v
+        run: |
+          set -e
+          INFO=$(bash scripts/version_info.sh)
+          echo "$INFO"
+          echo "$INFO" >> "$GITHUB_OUTPUT"
+          if [ "$(bash scripts/version_info.sh channel)" != beta ]; then
+            echo "Not a beta — nothing to do."
+            echo "is_beta=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          # Done only once its Codeberg pre-release carries the APK, so a failed
+          # publish is redone by the next push; refused unless newer than the
+          # latest stable release.
+          GATE=$(bash scripts/release_gate.sh)
+          echo "is_beta=${GATE#cut=}" >> "$GITHUB_OUTPUT"
+
+  beta:
+    needs: detect
+    if: needs.detect.outputs.is_beta == 'true'
+    runs-on: docker
+    env:
+      ANDROID_HOME: /opt/android-sdk
+      ANDROID_SDK_ROOT: /opt/android-sdk
+      VERSION: ${{ needs.detect.outputs.version }}
+      VERSION_CODE: ${{ needs.detect.outputs.version_code }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Setup Java
+        # JetBrains 21 is what gradle-daemon-jvm.properties asks for; installing it
+        # here keeps Gradle from downloading it via foojay.
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'jetbrains'
+          java-version: '21'
+
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@v3
+        with:
+          packages: ''
+
+      - name: Setup Android SDK cache
+        uses: actions/cache@v4
+        with:
+          path: /opt/android-sdk
+          key: ${{ runner.os }}-android-sdk-37-36.0.0
+
+      - name: Install Android SDK packages
+        run: |
+          yes | sdkmanager --licenses >/dev/null || true
+          sdkmanager \
+            "platform-tools" \
+            "platforms;android-37.0" \
+            "build-tools;36.0.0"
+
+      - name: Setup Gradle cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'gradle/libs.versions.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-
+
+      - name: Install jq
+        run: |
+          set -e
+          SUDO=""
+          if command -v sudo >/dev/null 2>&1; then SUDO="sudo"; fi
+          if command -v apt-get >/dev/null 2>&1; then
+            $SUDO apt-get update
+            $SUDO apt-get install -y jq
+          elif command -v apk >/dev/null 2>&1; then
+            $SUDO apk add --no-cache jq
+          fi
+
+      - name: Grant execute permission for gradlew
+        run: chmod +x ./gradlew
+
+      - name: Pin versionCode to versionName
+        run: |
+          set -e
+          sed -i "s/versionCode = .*/versionCode = $VERSION_CODE/" app/build.gradle.kts
+          grep -E 'versionName|versionCode' app/build.gradle.kts
+
+      - name: Unit tests
+        run: ./gradlew testFullDebugUnitTest
+
+      # The real app key, same as a stable release: a beta has to update in
+      # place to the next beta and to the stable version.
+      - name: Setup Android Keystore
+        env:
+          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+        run: |
+          mkdir -p app
+          echo "$KEYSTORE_BASE64" | base64 --decode > app/upload-keystore.jks
+          cat > key.properties <<EOF
+          storePassword=$KEY_PASSWORD
+          keyPassword=$KEY_PASSWORD
+          keyAlias=$KEY_ALIAS
+          storeFile=upload-keystore.jks
+          EOF
+
+      # Both flavors; the offline one goes to Codeberg only (issue #39).
+      - name: Build release APKs
+        run: ./gradlew assembleRelease
+
+      # Notes = a `## [X.Y.Z-beta.N]` section if there is one, else
+      # `## [Unreleased]`. Gitea creates the tag at this commit.
+      - name: Create tag + Gitea pre-release
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+          SHA: ${{ github.sha }}
+        run: |
+          set -e
+          bash scripts/release_notes.sh "$VERSION" > release-notes.md
+          cat release-notes.md
+          TAG="v$VERSION" PRERELEASE=true NOTES_FILE=release-notes.md \
+            MAPPING=app/build/outputs/mapping/fullRelease/mapping.txt \
+            MAPPING_OFFLINE=app/build/outputs/mapping/offlineRelease/mapping.txt \
+            bash scripts/publish_gitea_release.sh
+
+      # The point of the whole workflow, so NOT continue-on-error.
+      - name: Publish pre-release to Codeberg
+        env:
+          TOKEN: ${{ secrets.CODEBERG_RELEASE_TOKEN }}
+          API: https://codeberg.org/api/v1/repos/jlmakiola/agendula
+          SHA: ${{ github.sha }}
+        run: |
+          set -e
+          TAG="v$VERSION" PRERELEASE=true NOTES_FILE=release-notes.md \
+            APK=app/build/outputs/apk/full/release/app-full-release.apk \
+            APK_OFFLINE=app/build/outputs/apk/offline/release/app-offline-release.apk \
+            bash scripts/publish_codeberg_release.sh

.gitea/workflows/ci.yaml

@@ -1,93 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches:
-      - '**'
-    tags-ignore:
-      - '**'
-
-# Cancel superseded runs on the same branch.
-concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  ci:
-    runs-on: docker
-    env:
-      ANDROID_HOME: /opt/android-sdk
-      ANDROID_SDK_ROOT: /opt/android-sdk
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: 'zulu'
-          java-version: '17'
-
-      - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
-        with:
-          # Default ("tools platform-tools") drags in the Android Emulator
-          # (~300 MB) which the build never uses.
-          packages: ''
-
-      - name: Setup Android SDK cache
-        uses: actions/cache@v4
-        with:
-          path: /opt/android-sdk
-          key: ${{ runner.os }}-android-sdk-37-36.0.0
-
-      - name: Install Android SDK packages
-        run: |
-          yes | sdkmanager --licenses >/dev/null || true
-          sdkmanager \
-            "platform-tools" \
-            "platforms;android-37.0" \
-            "build-tools;36.0.0"
-
-      - name: Setup Gradle cache
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'gradle/libs.versions.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-gradle-
-
-      - name: Grant execute permission for gradlew
-        run: chmod +x ./gradlew
-
-      # No --no-daemon: the daemon lives only as long as this job container
-      # and lets the following steps skip JVM startup + reconfiguration.
-      - name: Lint (debug variant only)
-        run: ./gradlew lintDebug
-
-      - name: Unit tests
-        run: ./gradlew testDebugUnitTest
-
-      - name: Assemble debug APK
-        run: ./gradlew assembleDebug
-
-      - name: Trivy filesystem scan
-        if: github.ref == 'refs/heads/main'
-        run: |
-          set -e
-          SUDO=""
-          if command -v sudo >/dev/null 2>&1; then
-            SUDO="sudo"
-          fi
-          if command -v apt-get >/dev/null 2>&1; then
-            $SUDO apt-get update
-            $SUDO apt-get install -y wget apt-transport-https gnupg lsb-release
-            wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | $SUDO tee /usr/share/keyrings/trivy.gpg > /dev/null
-            echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | $SUDO tee /etc/apt/sources.list.d/trivy.list
-            $SUDO apt-get update
-            $SUDO apt-get install -y trivy
-          fi
-          trivy filesystem --severity HIGH,CRITICAL --exit-code 0 .
-        continue-on-error: true

.gitea/workflows/release.yaml

@@ -1,84 +1,131 @@
-name: Release — F-Droid repo + Gitea release
+name: Release — F-Droid repo + Gitea/Codeberg release + Play
 
+# A release is cut by merging a release branch into main with a bumped
+# versionName (see docs/RELEASING.md). This workflow reads that versionName and,
+# if no matching tag exists yet, runs tests, builds + signs the APK, publishes
+# it to the F-Droid repo, creates the vX.Y.Z tag + Gitea release, and publishes
+# the release on Codeberg with the signed APK + a SHA-256 checksum as a
+# direct-download channel — the tag is an output of the pipeline, not its
+# trigger. Ordinary merges (no version bump) fall through `detect` and do
+# nothing. Betas (X.Y.Z-beta.N) never come through here: beta.yaml cuts them
+# from release/* branches as Codeberg-only pre-releases, and `detect` refuses
+# one that reaches main.
+#
+# A trailing `play` job then uploads the App Bundle to Google Play. It is last
+# and separate because Play can reject a good build for reasons the pipeline
+# can't see, and that must not endanger a release which already shipped to
+# F-Droid and Codeberg. It skips cleanly until PLAY_SERVICE_ACCOUNT_JSON exists.
+#
+# This file lives in .gitea/workflows on purpose: Codeberg is canonical for git,
+# issues, PRs and releases, but every secret (app key, F-Droid repo key, Hetzner
+# credentials) lives on the self-hosted Gitea instance, and this is the only
+# directory Codeberg cannot see. Contributor-triggerable work lives in
+# .forgejo/workflows and references no secret. See docs/RELEASING.md.
+#
+# A manual workflow_dispatch (from a branch) runs the re-sign-only recovery
+# path: it re-signs the existing F-Droid index with the repo key and re-uploads,
+# without building an APK or creating a release. Used for key rotation / repo
+# recovery.
 on:
   push:
-    tags:
-      - '*'
+    branches: [main]
   workflow_dispatch:
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 jobs:
-  ci:
+  # Cheap gate: resolve the version from the committed build.gradle and decide
+  # whether this push actually cuts a new release (no tag for it yet). Keeps the
+  # heavy job from running on every merge to main.
+  detect:
+    # Gitea only. The workflow directory split already keeps this file invisible
+    # to Codeberg — Forgejo's lookup is first-match-wins, and .forgejo/workflows
+    # exists — but that only holds while .forgejo/ is non-empty. Move the last
+    # file out of it and Codeberg would fall back to .gitea/workflows and start
+    # running the release pipeline on the contributor-facing runner, with no
+    # secrets. repository_owner differs between the two forges regardless of
+    # URL, proxy or instance rename, so this closes it permanently.
+    if: github.repository_owner == 'makiolaj'
     runs-on: docker
-    env:
-      ANDROID_HOME: /opt/android-sdk
-      ANDROID_SDK_ROOT: /opt/android-sdk
+    outputs:
+      is_release: ${{ steps.v.outputs.is_release }}
+      version: ${{ steps.v.outputs.version }}
+      version_code: ${{ steps.v.outputs.version_code }}
+      prerelease: ${{ steps.v.outputs.prerelease }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-
-      - name: Setup Java
-        uses: actions/setup-java@v4
         with:
-          distribution: 'zulu'
-          java-version: '17'
+          submodules: recursive
 
-      - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
-        with:
-          packages: ''
-
-      - name: Setup Android SDK cache
-        uses: actions/cache@v4
-        with:
-          path: /opt/android-sdk
-          key: ${{ runner.os }}-android-sdk-37-36.0.0
-
-      - name: Install Android SDK packages
+      - name: Resolve version and whether it is a new release
+        id: v
         run: |
-          yes | sdkmanager --licenses >/dev/null || true
-          sdkmanager \
-            "platform-tools" \
-            "platforms;android-37.0" \
-            "build-tools;36.0.0"
+          set -e
+          # versionName -> versionCode, channel and the pre-release flag (set
+          # while MAJOR was 0) all come from the one script beta.yaml uses too.
+          INFO=$(bash scripts/version_info.sh)
+          echo "$INFO"
+          echo "$INFO" >> "$GITHUB_OUTPUT"
+          VERSION=$(echo "$INFO" | sed -n 's/^version=//p')
+          CHANNEL=$(echo "$INFO" | sed -n 's/^channel=//p')
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "Manual dispatch — re-sign path, not a release."
+            echo "is_release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          # Betas ship from release/* branches via beta.yaml and must never be
+          # cut here: this path publishes to F-Droid and Play. CI blocks such a
+          # PR into main; this is the backstop if one gets through anyway.
+          if [ "$CHANNEL" != "stable" ]; then
+            echo "versionName $VERSION on main is a beta. Set the stable version before merging to main." >&2
+            exit 1
+          fi
+          # Tags are read from Codeberg, the canonical forge, by exact name: its
+          # git/refs/tags API matches by prefix, so v1.1.0-beta.1 would read as
+          # v1.1.0. A lookup error is fatal rather than read as "no tag".
+          GATE=$(bash scripts/release_gate.sh)
+          echo "is_release=${GATE#cut=}" >> "$GITHUB_OUTPUT"
 
-      - name: Setup Gradle cache
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'gradle/libs.versions.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-gradle-
+      # Before a single Gradle task runs: F-Droid truncates the in-client
+      # changelog, so an over-long one would reach users cut off mid-sentence.
+      # The script exits non-zero past the limit. Cheap enough to sit in the
+      # gate job, where failing costs nothing and publishes nothing — the step
+      # further down that regenerates the file for the repo would otherwise be
+      # the first thing to notice, after the build and the signing.
+      - name: Changelog fits the stores
+        if: steps.v.outputs.is_release == 'true'
+        run: bash scripts/sync_changelog_to_fastlane.sh
 
-      - name: Grant execute permission for gradlew
-        run: chmod +x ./gradlew
-
-      # Lint already enforced on every push to main via ci.yaml.
-      # Release sanity only re-runs tests + a debug build to catch
-      # any tag-resolved drift (e.g. version code substitution issues).
-
-      - name: Unit tests
-        run: ./gradlew testDebugUnitTest
-
-      - name: Assemble debug APK (sanity)
-        run: ./gradlew assembleDebug
-
-  build-and-deploy:
-    needs: ci
+  # Releases: build + sign + publish, then mint the tag and Gitea release.
+  # Also runs on manual dispatch, where it skips the build and just re-signs and
+  # re-uploads the existing index (recovery path).
+  release:
+    needs: detect
+    if: needs.detect.outputs.is_release == 'true' || github.event_name == 'workflow_dispatch'
     runs-on: docker
     env:
       ANDROID_HOME: /opt/android-sdk
       ANDROID_SDK_ROOT: /opt/android-sdk
+      VERSION: ${{ needs.detect.outputs.version }}
+      VERSION_CODE: ${{ needs.detect.outputs.version_code }}
+      IS_RELEASE: ${{ needs.detect.outputs.is_release }}
+      PRERELEASE: ${{ needs.detect.outputs.prerelease }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - name: Setup Java
+        # JetBrains 21 is what gradle-daemon-jvm.properties asks for; installing it
+        # here keeps Gradle from downloading it via foojay.
         uses: actions/setup-java@v4
         with:
-          distribution: 'zulu'
-          java-version: '17'
+          distribution: 'jetbrains'
+          java-version: '21'
 
       - name: Setup Android SDK
         uses: android-actions/setup-android@v3
@@ -121,31 +168,26 @@ jobs:
             $SUDO apk add --no-cache jq
           fi
 
-      # Tag-only build steps. On a manual workflow_dispatch (ref = a branch,
-      # not a tag) these are skipped: the job then just re-signs the existing
-      # index with the configured repo key and re-uploads — used for key
-      # rotation / repo recovery without publishing a new APK.
-      - name: Set version from git tag
-        if: startsWith(github.ref, 'refs/tags/')
+      - name: Grant execute permission for gradlew
+        run: chmod +x ./gradlew
+
+      # The committed versionName is the source of truth. Pin versionCode to the
+      # value scripts/version_info.sh derives from it, so the published APK's
+      # code follows the scheme even if the committed code was forgotten.
+      - name: Pin versionCode to versionName
+        if: env.IS_RELEASE == 'true'
         run: |
           set -e
-          RAW_TAG="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
-          VERSION="${RAW_TAG#v}"
-          MAJOR=$(echo "$VERSION" | cut -d. -f1)
-          MINOR=$(echo "$VERSION" | cut -d. -f2)
-          PATCH=$(echo "$VERSION" | cut -d. -f3)
-          MAJOR=${MAJOR:-0}; MINOR=${MINOR:-0}; PATCH=${PATCH:-0}
-          VERSION_CODE=$(( MAJOR * 10000 + MINOR * 100 + PATCH ))
-          echo "Version: $VERSION, VersionCode: $VERSION_CODE"
-          sed -i "s/versionName = \".*\"/versionName = \"$VERSION\"/" app/build.gradle.kts
           sed -i "s/versionCode = .*/versionCode = $VERSION_CODE/" app/build.gradle.kts
           grep -E 'versionName|versionCode' app/build.gradle.kts
-          # Export for later steps (F-Droid changelog, mapping asset name).
-          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
-          echo "VERSION_CODE=$VERSION_CODE" >> "$GITHUB_ENV"
+
+      # Test the exact commit being shipped (only on a real release).
+      - name: Unit tests
+        if: env.IS_RELEASE == 'true'
+        run: ./gradlew testFullDebugUnitTest
 
       - name: Setup Android Keystore
-        if: startsWith(github.ref, 'refs/tags/')
+        if: env.IS_RELEASE == 'true'
         env:
           KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
           KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
@@ -160,11 +202,10 @@ jobs:
           storeFile=upload-keystore.jks
           EOF
 
-      - name: Grant execute permission for gradlew
-        run: chmod +x ./gradlew
-
-      - name: Build release APK
-        if: startsWith(github.ref, 'refs/tags/')
+      # Both flavors. Only full goes to F-Droid and Play; the offline one
+      # (issue #39) is a Codeberg release asset and nothing else.
+      - name: Build release APKs
+        if: env.IS_RELEASE == 'true'
         run: ./gradlew assembleRelease
 
       - name: Setup F-Droid Server Tools
@@ -202,8 +243,7 @@ jobs:
           set -euo pipefail
           # Fail loudly if the repo key is not configured. NEVER auto-generate
           # one: a fresh key changes the repo fingerprint and breaks every
-          # user's pinned repo. (Replaces the old `fdroid update --create-key`
-          # path, which silently rotated the key on a wiped server.)
+          # user's pinned repo.
           if [ -z "${FDROID_KEYSTORE_BASE64:-}" ] || [ -z "${FDROID_CONFIG_BASE64:-}" ]; then
             echo "ERROR: FDROID_KEYSTORE_BASE64 / FDROID_CONFIG_BASE64 secrets are not set." >&2
             echo "Refusing to continue — will not auto-generate a new repo key." >&2
@@ -216,42 +256,33 @@ jobs:
           mkdir -p fdroid/repo/icons
 
       - name: Copy new APK to repo
-        if: startsWith(github.ref, 'refs/tags/')
+        if: env.IS_RELEASE == 'true'
         run: |
           set -e
           mkdir -p fdroid/repo
-          REF_NAME="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
-          SAFE_REF_NAME="$(echo "$REF_NAME" | tr '/ ' '__' | tr -cd '[:alnum:]_.-')"
-          if [ -z "$SAFE_REF_NAME" ]; then
-            SAFE_REF_NAME="${GITHUB_SHA:-manual}"
-          fi
-          cp app/build/outputs/apk/release/app-release.apk "fdroid/repo/floret_${SAFE_REF_NAME}.apk"
+          cp app/build/outputs/apk/full/release/app-full-release.apk "fdroid/repo/agendula_v${VERSION}.apk"
 
-      - name: Copy metadata to F-Droid repo
+      # Per-version "What's New": ensure this version's changelog exists in the
+      # fastlane tree (committed at release-cut time for the official repo; this
+      # regenerates it from CHANGELOG.md so the self-hosted repo never depends on
+      # the commit having happened). The transform below then carries it across.
+      - name: Ensure this version's changelog is in the fastlane tree
+        if: env.IS_RELEASE == 'true'
+        run: bash scripts/sync_changelog_to_fastlane.sh
+
+      - name: Build F-Droid metadata from fastlane (single source of truth)
         run: |
           mkdir -p fdroid/metadata
-          cp -r fdroid-metadata/* fdroid/metadata/
-
-      # Per-version "What's New" for F-Droid clients: the tag's CHANGELOG
-      # section written to changelogs/<versionCode>.txt (same extraction as the
-      # Gitea release notes). en-US only — F-Droid falls back to it for locales
-      # without their own changelog. fdroid update bakes this into the index.
-      - name: Generate F-Droid changelog for this version
-        if: startsWith(github.ref, 'refs/tags/')
-        run: |
-          set -e
-          awk -v ver="$VERSION" '
-            $0 ~ "^## \\[" ver "\\]" { flag = 1; next }
-            /^## \[/ { flag = 0 }
-            flag' CHANGELOG.md > /tmp/changelog.txt
-          sed -i -e '/./,$!d' /tmp/changelog.txt
-          if [ ! -s /tmp/changelog.txt ]; then
-            echo "See CHANGELOG.md for $VERSION." > /tmp/changelog.txt
-          fi
-          CL_DIR="fdroid/metadata/de.jeanlucmakiola.floret/en-US/changelogs"
-          mkdir -p "$CL_DIR"
-          cp /tmp/changelog.txt "$CL_DIR/${VERSION_CODE}.txt"
-          echo "Wrote $CL_DIR/${VERSION_CODE}.txt"
+          # App-level control file (Categories/License/links) for the self-hosted
+          # repo's `fdroid update`.
+          cp fdroid-metadata/de.jeanlucmakiola.agendula.yml fdroid/metadata/
+          # Localized text + graphics + per-version changelogs come from the SAME
+          # fastlane tree the official F-Droid repo harvests from source,
+          # transformed into the F-Droid repo "localized" layout. One source of
+          # truth, both channels.
+          bash scripts/fastlane_to_fdroid_localized.sh \
+            fastlane/metadata/android \
+            fdroid/metadata/de.jeanlucmakiola.agendula
 
       - name: Generate F-Droid Index
         run: |
@@ -272,110 +303,182 @@ jobs:
           SFTP
           # Publish the signed repo/ plus metadata/ (descriptions, screenshots,
           # per-version changelogs) so changelog history survives across
-          # releases. keystore.p12 and config.yml are NEVER uploaded, so they
-          # can't re-enter the web-served tree; nginx serves only repo/ anyway.
+          # releases. keystore.p12 and config.yml are NEVER uploaded.
           sshpass -p "$PASS" scp $SSH_OPTS -r fdroid/repo fdroid/metadata "$USER@$HOST:dev/fdroid/"
 
-      # Archive the R8 mapping so user crash stacktraces stay deobfuscatable.
-      # Attached to the Gitea release (it's not an APK, so it fits the
-      # no-binaries rule). Best-effort: never fail a release over it.
-      - name: Attach R8 mapping to Gitea release
-        if: startsWith(github.ref, 'refs/tags/')
-        continue-on-error: true
+      # The APK is published and the index re-signed — now record the release.
+      # Creating it with target_commitish makes Gitea create the vX.Y.Z tag at
+      # this commit, so the tag only ever marks a fully-shipped release (and a
+      # failure before here leaves no tag, so re-running the workflow retries).
+      # Also attaches the R8 mapping (best-effort) so user crash stacktraces
+      # stay deobfuscatable. Notes = this version's CHANGELOG section.
+      - name: Create tag + Gitea release
+        if: env.IS_RELEASE == 'true'
         env:
           TOKEN: ${{ secrets.GITHUB_TOKEN }}
           API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+          SHA: ${{ github.sha }}
         run: |
           set -e
-          MAP="app/build/outputs/mapping/release/mapping.txt"
-          if [ ! -f "$MAP" ]; then echo "No mapping.txt (R8 off?) — skipping."; exit 0; fi
-          TAG="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
-          ASSET="mapping-${VERSION:-$TAG}.txt.gz"
-          gzip -c "$MAP" > "/tmp/$ASSET"
-          # The release is created by the gitea-release job; ensure it exists
-          # (idempotent) so this job doesn't race it to a 404.
-          ID=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" | jq -r '.id // empty')
-          if [ -z "$ID" ]; then
-            ID=$(curl -s -X POST -H "Authorization: token $TOKEN" \
-              -H "Content-Type: application/json" \
-              -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\"}" \
-              "$API/releases" | jq -r '.id // empty')
-          fi
-          if [ -z "$ID" ]; then echo "Could not resolve release id — skipping."; exit 0; fi
-          # Replace any prior asset of the same name (re-run safe).
-          OLD=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/$ID/assets" \
-            | jq -r --arg n "$ASSET" '.[] | select(.name==$n) | .id')
-          [ -n "$OLD" ] && curl -s -X DELETE -H "Authorization: token $TOKEN" "$API/releases/$ID/assets/$OLD" >/dev/null || true
-          curl -s -X POST -H "Authorization: token $TOKEN" \
-            -F "attachment=@/tmp/$ASSET" \
-            "$API/releases/$ID/assets?name=$ASSET" -o /dev/null -w "asset upload HTTP %{http_code}\n"
+          bash scripts/release_notes.sh "$VERSION" > release-notes.md
+          TAG="v$VERSION" NOTES_FILE=release-notes.md \
+            MAPPING=app/build/outputs/mapping/fullRelease/mapping.txt \
+            MAPPING_OFFLINE=app/build/outputs/mapping/offlineRelease/mapping.txt \
+            bash scripts/publish_gitea_release.sh
 
-  # A Gitea release per tag, carrying the tag's CHANGELOG section as its
-  # notes. Deliberately no APK assets — distribution stays with the F-Droid
-  # repo; the release is the human-readable record. Gated on the tests-only
-  # ci job (not the deploy) so notes appear even if the F-Droid upload has
-  # an infrastructure hiccup.
-  gitea-release:
-    needs: ci
-    if: startsWith(github.ref, 'refs/tags/')
+      # Publish the release on Codeberg, which is canonical for tags and
+      # releases (see docs/RELEASING.md): push the tag there and attach the
+      # signed APK plus a SHA-256 checksum as the direct-download channel for
+      # users who don't want F-Droid. The APK is identical to the F-Droid one
+      # (same app key), so this adds no trust surface. Needs the
+      # CODEBERG_RELEASE_TOKEN secret; skips cleanly if unset.
+      - name: Publish release to Codeberg
+        if: env.IS_RELEASE == 'true'
+        # NOT continue-on-error: this step reported green through 0.2.1, 0.2.2,
+        # 0.3.0, 0.3.1 and 0.3.2 while never once publishing, which is how a
+        # crash-fix release reached F-Droid but not the Codeberg/Obtainium
+        # users who needed it. A broken mirror must fail the release loudly.
+        env:
+          TOKEN: ${{ secrets.CODEBERG_RELEASE_TOKEN }}
+          API: https://codeberg.org/api/v1/repos/jlmakiola/agendula
+          SHA: ${{ github.sha }}
+        run: |
+          set -e
+          [ -s release-notes.md ] || bash scripts/release_notes.sh "$VERSION" > release-notes.md
+          TAG="v$VERSION" NOTES_FILE=release-notes.md \
+            APK=app/build/outputs/apk/full/release/app-full-release.apk \
+            APK_OFFLINE=app/build/outputs/apk/offline/release/app-offline-release.apk \
+            bash scripts/publish_codeberg_release.sh
+
+      # Play takes an App Bundle, not the APK: a second artifact from the same
+      # source and signing config. Play treats the release key only as the
+      # upload key and re-signs with its own (Play App Signing), so Play and
+      # F-Droid installs carry different signatures and can't update each other.
+      #
+      # Built last and continue-on-error: everything above has already shipped,
+      # and nothing Play-related may take it down. The AAB never touches the
+      # F-Droid repo or the releases. AGP embeds the R8 mapping in the bundle,
+      # so Play gets deobfuscated stacktraces without a separate upload.
+      - name: Build release AAB
+        if: env.IS_RELEASE == 'true'
+        continue-on-error: true
+        run: ./gradlew bundleFullRelease
+
+      # NOT actions/upload-artifact@v4: its client refuses any non-github.com
+      # server as unsupported GHES (go-gitea/gitea#36024). This fork drops that
+      # check. Pinned to a commit — a third-party action in the signing
+      # pipeline must not change under us.
+      - name: Hand the AAB to the Play job
+        if: env.IS_RELEASE == 'true'
+        continue-on-error: true
+        uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7 # v4
+        with:
+          name: release-aab-${{ needs.detect.outputs.version }}
+          path: app/build/outputs/bundle/fullRelease/app-full-release.aab
+          if-no-files-found: error
+          retention-days: 14
+
+  # Google Play channel. A separate job after the F-Droid publish and both forge
+  # releases, so a Play rejection (policy review, API outage, listing rules)
+  # shows up as one red job next to a release that already shipped.
+  #
+  # Not a `container:` job: act_runner provides no node inside custom job
+  # containers, so JavaScript actions (checkout, download-artifact) can't run.
+  play:
+    needs: [detect, release]
+    # workflow_dispatch is the F-Droid re-sign recovery path; never touch Play.
+    if: needs.detect.outputs.is_release == 'true'
     runs-on: docker
+    env:
+      VERSION: ${{ needs.detect.outputs.version }}
+      VERSION_CODE: ${{ needs.detect.outputs.version_code }}
+      # The release itself is the gate (a bumped versionName only reaches main
+      # after on-device review), so it goes straight to production. Override
+      # with repo variables to stage instead.
+      PLAY_TRACK: ${{ vars.PLAY_TRACK || 'production' }}
+      PLAY_RELEASE_STATUS: ${{ vars.PLAY_RELEASE_STATUS || 'completed' }}
+      # true validates the edit against the API and discards it.
+      PLAY_DRY_RUN: ${{ vars.PLAY_DRY_RUN || 'false' }}
+      BUNDLE_PATH: vendor/bundle
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Extract changelog section for this tag
-        run: |
-          set -e
-          TAG="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
-          VERSION="${TAG#v}"
-          # Everything between "## [<version>]" and the next "## [" heading.
-          awk -v ver="$VERSION" '
-            $0 ~ "^## \\[" ver "\\]" { flag = 1; next }
-            /^## \[/ { flag = 0 }
-            flag' CHANGELOG.md > release-notes.md
-          # Trim leading blank lines.
-          sed -i -e '/./,$!d' release-notes.md
-          if [ ! -s release-notes.md ]; then
-            echo "_No changelog entry for ${VERSION} — see CHANGELOG.md._" > release-notes.md
-          fi
-          echo "--- release notes ---"
-          cat release-notes.md
-
-      - name: Create Gitea release
+      # Skip cleanly when Play isn't configured yet, same contract as the
+      # Codeberg publish.
+      - name: Write the Play service-account key
+        id: key
         env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
         run: |
-          set -e
-          TAG="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
-          python3 - "$TAG" <<'PY' > payload.json
-          import json, sys
-          print(json.dumps({
-              "tag_name": sys.argv[1],
-              "name": sys.argv[1],
-              "body": open("release-notes.md").read(),
-              "draft": False,
-              "prerelease": False,
-          }))
-          PY
-          # Upsert: the build-and-deploy job may have created a bare release
-          # first (to attach the mapping asset), so PATCH the notes if it
-          # exists, otherwise POST a new one. Both paths are re-run safe.
-          curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" > existing.json
-          ID=$(python3 -c "import json,sys; d=json.load(open('existing.json')); print(d.get('id',''))" 2>/dev/null || true)
-          if [ -n "$ID" ]; then
-            CODE=$(curl -s -o response.json -w '%{http_code}' -X PATCH \
-              -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
-              -d @payload.json "$API/releases/$ID")
-            OK=200
-          else
-            CODE=$(curl -s -o response.json -w '%{http_code}' -X POST \
-              -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
-              -d @payload.json "$API/releases")
-            OK=201
-          fi
-          cat response.json
-          if [ "$CODE" != "$OK" ]; then
-            echo "Release upsert failed with HTTP $CODE (expected $OK)"
-            exit 1
+          set -euo pipefail
+          if [ -z "${PLAY_SERVICE_ACCOUNT_JSON:-}" ]; then
+            echo "PLAY_SERVICE_ACCOUNT_JSON not set — skipping the Play upload."
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+            exit 0
           fi
+          printf '%s' "$PLAY_SERVICE_ACCOUNT_JSON" > play-service-account.json
+          python3 -c "import json,sys; d=json.load(open('play-service-account.json')); sys.exit(0 if d.get('type')=='service_account' else 1)" \
+            || { echo "PLAY_SERVICE_ACCOUNT_JSON is not a valid service-account JSON." >&2; exit 1; }
+          echo "configured=true" >> "$GITHUB_OUTPUT"
+
+      # Same GHES-detection fix as the upload side.
+      - name: Download the AAB
+        if: steps.key.outputs.configured == 'true'
+        uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7 # v4
+        with:
+          name: release-aab-${{ needs.detect.outputs.version }}
+          path: dist
+
+      - name: Install Ruby
+        if: steps.key.outputs.configured == 'true'
+        run: |
+          set -euo pipefail
+          SUDO=""
+          if command -v sudo >/dev/null 2>&1; then SUDO="sudo"; fi
+          $SUDO apt-get update
+          # Several fastlane dependencies build native extensions.
+          $SUDO apt-get install -y ruby-full ruby-dev build-essential
+          ruby -v
+
+      - name: Cache bundled gems
+        if: steps.key.outputs.configured == 'true'
+        uses: actions/cache@v4
+        with:
+          path: vendor/bundle
+          key: ${{ runner.os }}-gems-${{ hashFiles('Gemfile') }}
+          restore-keys: |
+            ${{ runner.os }}-gems-
+
+      - name: Install fastlane
+        if: steps.key.outputs.configured == 'true'
+        run: |
+          set -euo pipefail
+          gem install bundler --no-document
+          bundle config set --local path vendor/bundle
+          bundle install --jobs 4
+          bundle exec fastlane --version
+
+      - name: Upload to Play
+        if: steps.key.outputs.configured == 'true'
+        env:
+          SUPPLY_JSON_KEY: play-service-account.json
+          FASTLANE_SKIP_UPDATE_CHECK: '1'
+          FASTLANE_HIDE_CHANGELOG: '1'
+        run: |
+          set -euo pipefail
+          # Absolute: a lane body runs from fastlane/, not the workspace root.
+          AAB="$GITHUB_WORKSPACE/dist/app-full-release.aab"
+          test -f "$AAB" || { echo "No AAB at $AAB — the artifact handoff failed." >&2; ls -la dist || true; exit 1; }
+          bundle exec fastlane deploy \
+            aab:"$AAB" \
+            track:"$PLAY_TRACK" \
+            release_status:"$PLAY_RELEASE_STATUS" \
+            dry_run:"$PLAY_DRY_RUN"
+          echo "Uploaded $VERSION (code $VERSION_CODE) to the '$PLAY_TRACK' track."
+
+      # The workspace is reused on a self-hosted runner; the key must not
+      # outlive the job.
+      - name: Shred the service-account key
+        if: always()
+        run: shred -u play-service-account.json 2>/dev/null || rm -f play-service-account.json

.gitea/workflows/renovate.yml

@@ -0,0 +1,70 @@
+name: Renovate
+
+on:
+  # Every merge to main. Mirror syncs from Codeberg fire push events here (the
+  # same trigger release.yaml relies on), so a merged Renovate PR is followed
+  # within minutes by a run that rebases the sibling PRs it just conflicted —
+  # most bumps touch gradle/libs.versions.toml. Outside renovate.json5's
+  # `schedule` window such a run only maintains existing branches
+  # (updateNotScheduled), it never opens new PRs. Renovate's own rebases push
+  # to renovate/* branches, not main, so this cannot loop.
+  push:
+    branches: [main]
+  # Weekly sweep for new updates. Mondays 05:00 UTC, inside the schedule window
+  # in renovate.json5 — keep the two in step.
+  schedule:
+    - cron: '0 5 * * 1'
+  # Manual run for an on-demand sweep from the Actions tab.
+  workflow_dispatch:
+
+# Never let two Renovate runs touch the repo at once.
+concurrency:
+  group: renovate
+  cancel-in-progress: false
+
+jobs:
+  renovate:
+    # Gitea only — same guard, and the same reason, as release.yaml's `detect`:
+    # this file is invisible to Codeberg only while .forgejo/ is non-empty, and
+    # a repo-write token must never run on the contributor-facing runner.
+    if: github.repository_owner == 'makiolaj'
+    runs-on: docker
+    # Run the Renovate image *as* the job container and invoke the `renovate`
+    # binary directly. The renovatebot/github-action wrapper is a thin Node
+    # action that shells out to `docker run …` — it needs a Docker CLI + socket
+    # inside the job, which the Gitea runner's plain node container has not, so
+    # it died on "Unable to locate executable file: docker". Running the image
+    # directly drops the docker-in-docker requirement entirely.
+    # Full tag pinned; Renovate's github-actions manager keeps it bumped.
+    container:
+      image: ghcr.io/renovatebot/renovate:43.232.0
+    steps:
+      - name: Run Renovate
+        run: renovate
+        env:
+          # Renovate targets Codeberg (canonical) while still RUNNING on the
+          # Gitea runner. Moving the job to Codeberg would put a repo-write
+          # token on the contributor-facing runner, which is exactly what the
+          # .forgejo/ vs .gitea/ split exists to prevent — so the token stays
+          # where the other secrets live and only the API calls cross over.
+          #
+          # Platform is `forgejo`, not `gitea`: Codeberg runs Forgejo, and the
+          # pinned image ships a distinct forgejo platform module.
+          RENOVATE_PLATFORM: forgejo
+          RENOVATE_ENDPOINT: https://codeberg.org/api/v1
+          # Codeberg bot-account token (Gitea secret). Needs repo read/write +
+          # PR scope on jlmakiola/agendula.
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          # Scope to this repo only — no org-wide autodiscovery.
+          RENOVATE_AUTODISCOVER: 'false'
+          RENOVATE_REPOSITORIES: '["jlmakiola/agendula"]'
+          # Commits/PRs authored as the bot, not a real maintainer. This address
+          # must be a verified email on the Codeberg bot account, otherwise the
+          # commits show up unattributed there.
+          RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovate@jeanlucmakiola.de>'
+          # Read-only github.com PAT (no scopes needed). Nearly every dependency
+          # is *released* on GitHub, and without this, changelog/release-note
+          # lookups hit the 60/h anonymous rate limit and PRs arrive with an
+          # empty "Release Notes" section.
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
+          LOG_LEVEL: info

.gitignore

@@ -53,5 +53,35 @@ Thumbs.db
 # F-Droid local artifacts (the pipeline generates them in CI)
 /fdroid/
 
+# Release-pipeline scratch files. release.yaml writes these into the workspace
+# while cutting a release; a self-hosted runner reuses that workspace, so they
+# must never end up committed (release-notes.md did, through 0.3.2).
+/release-notes.md
+/payload.json
+/existing.json
+/response.json
+/cb-payload.json
+/cb-response.json
+
 # KSP
 .ksp/
+
+# Local agent notes: machine-specific build setup and on-device rules, not
+# anything the project itself depends on.
+/CLAUDE.md
+
+# Scratch backlog. Says so in its own header — dumped items get turned into
+# real work, not committed as a list.
+/req_changes.md
+
+# Google Play service-account key (fastlane/Appfile). Never committed.
+/play-service-account.json
+# fastlane run output
+/fastlane/report.xml
+/fastlane/README.md
+/vendor/bundle/
+/.bundle/
+
+# Emulator captures (scripts/emulator_screenshot.sh); regenerate from design/store/sample.
+/design/store/raw/
+/design/store/framed/

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "floret-kit"]
+	path = floret-kit
+	url = https://codeberg.org/jlmakiola/floret-kit.git

CHANGELOG.md

@@ -1,11 +1,109 @@
 # Changelog
 
 All notable changes to this project are documented here. The format follows
-[Keep a Changelog](https://keepachangelog.com/); the latest released git tag is
-the source of truth for version codes (see Calendula's `docs/RELEASING.md`).
+[Keep a Changelog](https://keepachangelog.com/); the `versionName` committed in
+`app/build.gradle.kts` is the source of truth for a release (see
+`docs/RELEASING.md`), and the `vX.Y.Z` tag is minted by the pipeline.
 
 ## [Unreleased]
 
+### Added
+- Four new home-screen widgets: Today, Up next, Lists and Week.
+- A widget can show tasks from several lists at once, optionally grouped by
+  list.
+- A setting under Settings → Task form pre-fills a new task's start with today.
+- An offline version of Agendula with no sync and no network access at all,
+  published as a separate APK on Codeberg (#39).
+
+### Changed
+- The Tasks widget has agenda-style rows, an optional row colour and an "All
+  caught up" state. Ticking a task in any widget shows it as done for a moment
+  before it disappears.
+- The "At a glance" widget is gone; the Tasks and Today widgets cover what it
+  showed.
+- Synced lists can be renamed and deleted, not only device-only ones. A
+  read-only share shows the edit button greyed out and explains why on tap.
+
+### Fixed
+- The list editor's Where and smart-lists rows no longer have double padding.
+
+## [1.0.0] - 2026-09-21
+
+### Added
+- CalDAV sync built in: Nextcloud, Radicale, Baïkal and more.
+- Agendula keeps your tasks itself, no other app needed. Copy them over from
+  OpenTasks or tasks.org in Settings → Storage.
+- Repeating tasks, several reminders per task, lists managed in the app,
+  iCalendar import and export, a home-screen widget and a Quick Settings tile.
+
+### Changed
+- New settings for all-day reminders, snooze length, sync interval, time format
+  and week start.
+
+## [0.4.0] - 2026-08-31
+
+### Added
+- Agendula now speaks **German** and **Brazilian Portuguese**, the first
+  community translations. Pick one under **Settings → App language**, or in
+  Android's own per-app language settings; leave it on *System default* and
+  Agendula follows your phone. Anything not yet translated falls back to
+  English.
+- Agendula can now be translated. Pick or request a language on Weblate and
+  translate in the browser — the link sits at the top of the language picker in
+  **Settings → App language**. Partial translations are fine; anything
+  untranslated falls back to English.
+
+### Changed
+- Agendula's home is now **Codeberg** (`jlmakiola/agendula`) — that's where the
+  source, issues, pull requests and releases live. The Source and License links
+  in Settings, the issue-reporting link and the F-Droid metadata all point there
+  now. The self-hosted Gitea instance stays as build infrastructure.
+
+## [0.3.2] - 2026-07-20
+
+### Fixed
+- Releases reach the Codeberg download channel again. 0.3.1 published to
+  F-Droid but never appeared on Codeberg, so if you install from there — or
+  through Obtainium — this is the release that finally carries 0.3.0's
+  launch-crash fix. The app itself is unchanged from 0.3.1.
+
+## [0.3.1] - 2026-07-20
+
+### Fixed
+- Agendula no longer crashes on launch. Every 0.3.0 install was affected: the
+  release build stripped a constructor that the background-work scheduler needs
+  to open its database, and that happens before the app draws anything.
+
+## [0.3.0] - 2026-07-19
+
+### Added
+- Reminders: Agendula now delivers your due reminders itself. A one-time setup
+  step explains this and asks for notification access, and a master switch in
+  Settings turns the whole thing off again.
+- A Settings screen, from the gear on the overview: appearance and theme, which
+  fields the task form shows, your default list, and reminder defaults.
+- The overview leads with Today — a progress ring showing how much of today
+  you've finished — followed by a live preview of what's coming up next.
+- Search across every task, open or completed, from the top bar.
+- A proper app icon.
+
+### Changed
+- A tidier top bar: no app title, with search and settings pinned to the right.
+
+## [0.2.2] - 2026-07-19
+
+### Fixed
+- Release automation now reliably mirrors each release to the Codeberg mirror
+  (signed APK + SHA-256 checksum). The 0.2.1 attempt failed when the release tag
+  had already been synced to Codeberg.
+
+## [0.2.1] - 2026-07-19
+
+### Added
+- Releases are now also published to the Codeberg mirror as a direct download:
+  each release carries the signed APK plus a SHA-256 checksum, for users who
+  don't use F-Droid.
+
 ## [0.2.0] - 2026-06-27
 
 ### Added

CONTRIBUTING.md

@@ -1,47 +1,72 @@
-# Contributing to Floret
+# Contributing to Agendula
 
-Thanks for your interest in Floret — a Material 3 Expressive task app that's a
-pure front-end over the OpenTasks `TaskContract` provider, with no own database
-or sync stack. Before diving in, skim [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md)
-(how it's built), [`docs/ROADMAP.md`](docs/ROADMAP.md) (what's next), and
-[`docs/PLAN.md`](docs/PLAN.md) (the design rationale). This file covers the
-practical how.
+Thanks for your interest in Agendula — a Material 3 Expressive task app with its
+own Room task store and its own CalDAV sync, which can also work on top of the
+OpenTasks `TaskContract` provider. This file covers the practical how.
 
 ## The one architectural rule
 
 Everything above the data layer talks to `TasksRepository` and sees only domain
-types and Flows. **Provider column names, `TaskContract`, `ContentResolver`, and
-the authority string never leak above `data/tasks/`.** This is what keeps
-"Posture B" (bundling the provider later) an additive change instead of a
-rewrite — see [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) §7. If a change
-would expose provider details to a ViewModel or the UI, it's in the wrong layer.
+types and Flows. **Room entities, provider column names, `TaskContract`,
+`ContentResolver` and the authority string never leak above `data/tasks/`.**
+That seam is what let the store move from the provider to Room without touching
+a screen, and what lets both stores sit behind one `TasksDataSource`. If a
+change would expose storage details to a ViewModel or the UI, it's in the wrong
+layer.
 
 ## Prerequisites
 
 - JDK 17
 - Android SDK: compileSdk 37, build-tools 36.0.0 (the Gradle wrapper handles AGP/Kotlin)
-- A device or emulator with **OpenTasks** or **tasks.org** installed for
-  anything touching the read/write paths (ideally with DAVx5 syncing a CalDAV
-  task list, so there's real data). Debug builds fall back to `DemoSeeder` for
-  sample data.
+- Any device or emulator for the default path — the store is Agendula's own.
+  Debug builds seed an "Agendula Demo" list via `DemoSeeder`. For External
+  mode, one with **OpenTasks** or **tasks.org** installed; for sync, a CalDAV
+  account (a local Radicale is the quickest).
+- Clone with `--recurse-submodules`: the `floret-kit` component library is a
+  submodule.
 
 ## Build, test, lint
 
 ```sh
-./gradlew :app:assembleDebug        # build the debug APK
-./gradlew :app:testDebugUnitTest    # JVM unit tests (JUnit5 + Truth + Turbine)
-./gradlew lintDebug                 # Android lint (CI runs this on every push)
+./gradlew :app:assembleDebug            # build the debug APKs (full + offline)
+./gradlew :app:testFullDebugUnitTest    # JVM unit tests (JUnit5 + Truth + Turbine)
+./gradlew lintFullDebug lintOfflineDebug  # Android lint (CI runs this on every PR)
 ```
 
-CI (`.gitea/workflows/ci.yaml`) runs lint → unit tests → debug build on every
-push, so run these locally before opening a PR. Keep CI green.
+CI (`.forgejo/workflows/ci.yaml`, on Codeberg) runs a reproducible-release invariant check,
+then lint → unit tests → debug build on every pull request, so run these locally
+before opening a PR. Keep CI green.
+
+## Translations
+
+**Never edit a `values-*/strings.xml` file in a pull request.** Translations are
+owned by a self-hosted Weblate that writes to this repository directly, and a
+hand-edit is overwritten on the next sync.
+
+→ **[Translate Agendula on Weblate](https://weblate.dev.jeanlucmakiola.de/engage/agendula/)**
+
+Adding a *new* English string to `values/strings.xml` is normal PR work; Weblate
+picks it up and offers it to translators. Partial translations are expected and
+fine — missing keys are informational. Stale and orphaned keys are not, so run
+
+```sh
+python3 scripts/check_translations.py
+```
+
+before pushing. It reports those more clearly than lint's `MissingTranslation`
+does, and it's what the `Translations` check runs on every PR.
+
+A new language also needs one `<locale>` line in
+`app/src/main/res/xml/locales_config.xml` — that file is the single source of
+truth for both the in-app picker and the Android 13+ per-app language setting.
 
 ## Where to put code
 
 | Layer | Lives in | Rule of thumb |
 |---|---|---|
 | Pure logic (models, filtering, sorting, form validation, date maths) | `domain/` | No Android imports — must be JVM-unit-testable. |
-| Provider access | `data/tasks/` | The only place that knows about the provider. New provider work goes through `TasksDataSource`. |
+| Task storage | `data/tasks/` (`room/` for our own store) | The only place that knows about Room or the provider. New storage work goes through `TasksDataSource`, for both stores. |
+| CalDAV sync | `data/sync/` | Accounts, the engine, scheduling and sync notices. |
 | Reminders, prefs, DI, demo data | `data/reminders/`, `data/prefs/`, `data/di/`, `data/demo/` | |
 | Screens | `ui/<area>/` | One ViewModel + immutable `UiState` per area; Compose for the screen. |
 
@@ -50,20 +75,20 @@ push, so run these locally before opening a PR. Keep CI green.
 - **Kotlin**, 4-space indent, LF line endings, final newline, no trailing
   whitespace — all enforced by `.editorconfig` (2-space for yaml/toml/json/md).
   Match the surrounding code.
-- **Material 3 Expressive** for all UI: use `MaterialExpressiveTheme`, the
-  colour-scheme tokens (never hardcoded colours), and canonical M3 components
-  (e.g. `ListItem` for rows). Consult the `material-3` skill before designing a
-  new screen or component.
-- Prefer the domain layer for anything testable; keep `AndroidTasksDataSource`
-  the only Android-coupled data implementation so the rest stays JVM-testable.
+- **Material 3 Expressive** for all UI, built from **floret-kit** components
+  first (`CollapsingScaffold`, `GroupedRow`, `InlineTextField`,
+  `FullScreenPicker` / `OptionPicker`, …) and colour-scheme tokens (never
+  hardcoded colours). If a floret-kit component is nearly right, add the
+  parameter there rather than dropping to raw Material 3.
+- Prefer the domain layer for anything testable.
 
 ## Tests
 
 - New domain logic (mappers, filters, sorting, forms, value mapping) **must**
   come with JVM unit tests under `app/src/test/`. The data source is the
   JVM-testable seam — mock or fake it rather than reaching for instrumentation.
-- Add an instrumented test only when a path genuinely needs a real
-  `ContentResolver`.
+- Add an instrumented test only when a path genuinely needs Android: the Room
+  data source, migrations and the import paths live under `app/src/androidTest/`.
 
 ## Commits & PRs
 
@@ -72,18 +97,16 @@ push, so run these locally before opening a PR. Keep CI green.
 - Update [`CHANGELOG.md`](CHANGELOG.md) under `[Unreleased]` for any
   user-visible change — its sections feed the release notes and F-Droid "What's
   New" (see [`docs/RELEASING.md`](docs/RELEASING.md)).
-- If your change shifts the architecture or completes a milestone, update
-  [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) / [`docs/ROADMAP.md`](docs/ROADMAP.md)
-  in the same PR.
-- Don't bump `versionName` / `versionCode` by hand — the git tag drives those at
-  release time.
+- Don't bump `versionName` / `versionCode` in a regular PR — the committed
+  `versionName` is bumped only when **cutting a release** (that bump reaching
+  `main` is what triggers the release; the pipeline then mints the tag). See
+  [`docs/RELEASING.md`](docs/RELEASING.md).
 
 ## Scope
 
-Floret stays true to its thesis: a front-end over **open** task backends
-(CalDAV / iCalendar / DecSync via the OpenTasks provider). Proprietary backends
-(Google Tasks, Microsoft To Do) are out of scope by design — they'd mean owning
-a sync stack. v1 targets the OpenTasks contract (OpenTasks + tasks.org); jtx's
+Agendula stays on **open** standards: CalDAV and iCalendar, through its own
+sync or through the OpenTasks provider (OpenTasks and tasks.org). Proprietary
+backends (Google Tasks, Microsoft To Do) are out of scope by design. jtx's
 richer contract is a possible later addition.
 
 ## License

Gemfile

@@ -0,0 +1,6 @@
+source "https://rubygems.org"
+
+# fastlane is used ONLY as the Google Play Developer API client (see
+# fastlane/Fastfile). It never builds and never signs. Pinned exactly, no
+# Gemfile.lock: it resolves an uploader's deps, not the app's.
+gem "fastlane", "2.237.0"

README.md

@@ -1,42 +1,175 @@
 <div align="center">
 
-<h1>Floret</h1>
+<h1>Agendula</h1>
 
 <p><strong>A modern Material 3 Expressive task app for Android.</strong><br>
-Reads, writes, and reminds — on top of an existing tasks provider, with no own
-sync stack.</p>
+Syncs over CalDAV, or keeps your tasks on the device. Open standards, no account
+required.</p>
 
+<p>
+<a href="https://codeberg.org/jlmakiola/agendula/actions"><img src="https://codeberg.org/jlmakiola/agendula/actions/workflows/ci.yaml/badge.svg?branch=main" alt="CI"></a>
 <img src="https://img.shields.io/badge/Android-10%2B-3DDC84?logo=android&logoColor=white" alt="Android 10+">
 <img src="https://img.shields.io/badge/Kotlin-Compose-7F52FF?logo=kotlin&logoColor=white" alt="Kotlin + Compose">
 <img src="https://img.shields.io/badge/Material%203-Expressive-4285F4" alt="Material 3 Expressive">
 <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-green" alt="MIT License"></a>
+</p>
+
+<p>
+<a href="https://apps.obtainium.imranr.dev/redirect?r=obtainium://add/https://codeberg.org/jlmakiola/agendula"><img src="https://github.com/ImranR98/Obtainium/blob/main/assets/graphics/badge_obtainium.png?raw=true" alt="Get it on Obtainium" height="56"></a>
+&nbsp;
+<a href="https://ko-fi.com/jeanlucmakiola"><img src="https://storage.ko-fi.com/cdn/brandasset/v2/support_me_on_kofi_badge_beige.png" alt="Support me on Ko-fi" height="56"></a>
+</p>
+
+<p>
+<img src="fastlane/metadata/android/en-US/images/phoneScreenshots/01.png" alt="Home screen: today's progress, overdue and upcoming tasks, and your lists" width="18%">
+<img src="fastlane/metadata/android/en-US/images/phoneScreenshots/02.png" alt="Onboarding: sync with your own CalDAV server" width="18%">
+<img src="fastlane/metadata/android/en-US/images/phoneScreenshots/03.png" alt="Upcoming list with a task expanded into its subtasks" width="18%">
+<img src="fastlane/metadata/android/en-US/images/phoneScreenshots/04.png" alt="Task detail: a monthly recurring task with a reminder and priority" width="18%">
+<img src="fastlane/metadata/android/en-US/images/phoneScreenshots/05.png" alt="Reminder notification with Done and Snooze actions" width="18%">
+</p>
 
 </div>
 
-Floret is the task-list sibling to [Calendula](https://gitea.jeanlucmakiola.de/makiolaj/calendula).
-Where Calendula is a pure front-end over Android's `CalendarContract`, Floret is
-a pure front-end over the **OpenTasks `TaskContract` provider** — the store that
-DAVx5 (and SmoothSync, DecSync, …) syncs your CalDAV `VTODO` tasks into. No own
-database, no reinvented sync.
+Agendula is the task-list sibling to [Calendula](https://codeberg.org/jlmakiola/calendula).
+It keeps its own task store, designed around RFC 5545's `VTODO`, and syncs it
+with any CalDAV server — Nextcloud, Radicale, Baïkal and the rest. No account is
+needed to use it: without one, your tasks simply stay on the phone.
 
-A Calendula flower head is botanically made of many small *florets* — the
-individual items that make up the bloom. Floret is those items: your tasks.
+The name rhymes with its sibling on purpose: **Agendula** is *agenda* — Latin for
+“things to be done” — given Calendula's `-ula` ending. Calendula keeps your days;
+Agendula keeps your to-dos. (A Calendula flower head is botanically a cluster of
+many small *florets* — so the two apps are florets of one bloom.)
 
-> **Status: data layer done, UI in progress.** The full non-visual stack over
-> the `TaskContract` provider — provider resolution, live-updating reads,
-> writes, smart-list filtering, and a self-scheduled reminder engine — is built
-> and unit-tested. The Material 3 Expressive screens are now being built on top,
-> one at a time. See [`docs/ROADMAP.md`](docs/ROADMAP.md) for status,
-> [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for how it's built, and
-> [`docs/PLAN.md`](docs/PLAN.md) for the A-now-B-later design rationale.
+## What it does
 
-## Sync sources (by design)
+- **Lists** you create, colour, reorder and delete in the app, plus smart lists:
+  Today, Upcoming, Overdue, No date, All and Completed.
+- **Tasks** with due and start dates, all-day tasks, subtasks, priorities,
+  progress, location and URL, and cancel/restore.
+- **Repeating tasks**, expanded per RFC 5545. Edit or delete one occurrence,
+  this and the following ones, or the whole series.
+- **Reminders** that fire at the exact time: several per task, separate defaults
+  for timed and all-day tasks (globally and per list), Done and Snooze right on
+  the notification, and they survive reboots.
+- **iCalendar import and export** — open an `.ics` or a zip of them, or write any
+  list out as standard `.ics` files.
+- A **home-screen widget**, launcher shortcuts, a Quick Settings tile, and
+  "share to Agendula" to turn text from another app into a task.
+- **Material 3 Expressive** throughout, with dynamic colour, expressive motion
+  and shapes.
 
-Floret works with anything that writes to the tasks provider — **DAVx5**
-(CalDAV), **SmoothSync**, **CalDAV-Sync**, **DecSync CC**, or any Android sync
-adapter — because it builds on the provider, not on any one sync app. Google
-Tasks / Microsoft To Do are out of scope by design (proprietary; they would mean
-owning a sync stack). Open standards — CalDAV / iCalendar / DecSync — are the lane.
+## Sync
+
+Add a CalDAV account under **Settings → Accounts** and choose which of its task
+lists to sync. Nextcloud signs in through its own login flow in the browser, so
+Agendula never sees your password; any other server takes an address, a user
+name and a password — ideally an app password, which you can revoke on its own.
+
+Edits you make are sent within about half a minute. Changes from the server
+arrive on a background interval you choose (15 minutes to a day, or only when
+you tap sync), and every time you open the app. Several accounts can sync side
+by side, and lists can be created, renamed and deleted on the server from the
+app.
+
+Sync uses `sync-collection` (RFC 6578) where the server supports it and falls
+back to a full comparison where it does not. Everything the store does not model
+is kept verbatim and sent back unchanged, so passing your tasks through Agendula
+does not quietly lose fields another client wrote.
+
+## Where your tasks live
+
+|  | Where | Sync | Needs |
+|---|---|---|---|
+| **In Agendula** *(default)* | Agendula's own database | Agendula's own CalDAV sync, if you add an account | nothing — no permissions, no other app |
+| **In a provider you already use** | OpenTasks or tasks.org | whatever syncs it for you — DAVx5 and friends | that app installed, and its read/write permission |
+
+Agendula's own store is an ordinary app database, so it **coexists with
+OpenTasks rather than replacing it**. If you already sync through a provider,
+Agendula can work on top of it exactly as before.
+
+Switching between the two moves nothing — each store keeps its own tasks — so
+**Settings → Storage** asks before it switches, and offers to **copy** a
+provider's tasks into Agendula's own store when you want to move over. The copy
+is taken once and the originals stay where they are.
+
+Google Tasks and Microsoft To Do are out of scope by design: they are
+proprietary, and open standards — CalDAV and iCalendar — are the lane.
+
+## Install
+
+### F-Droid repository
+
+Every release is built, signed and published to a self-hosted F-Droid
+repository. Add it once and your F-Droid client handles updates from then on:
+
+1. In your F-Droid client, open *Settings → Repositories → Add* (or open the
+   link below on your phone):
+
+   ```
+   https://apps.dev.jeanlucmakiola.de/dev/fdroid/repo?fingerprint=C2C0640402BF458FC0ED957AF0B37AA4C14022E72F89CE90B5965B458CF73425
+   ```
+
+2. Refresh, search for **Agendula**, install.
+
+### Codeberg release / Obtainium
+
+Every release is also published on
+**[Codeberg](https://codeberg.org/jlmakiola/agendula/releases)** with the signed
+APK and a `.sha256` checksum attached — the same APK the F-Droid repository
+serves. For automatic updates from there, use
+**[Obtainium](https://github.com/ImranR98/Obtainium)** and
+**[add Agendula in one tap](https://apps.obtainium.imranr.dev/redirect?r=obtainium://add/https://codeberg.org/jlmakiola/agendula)**.
+Each release carries two APKs (see [Offline version](#offline-version)), so set
+*Filter APKs by regular expression* to `^agendula_v` to always get the regular
+app.
+Betas of upcoming versions are published there too, as pre-releases; to test
+them, switch on *Include prereleases* for Agendula in Obtainium.
+
+### Offline version
+
+Each Codeberg release also carries `agendula-offline_v<version>.apk`: Agendula
+without CalDAV sync and **without the network permission**, so it cannot
+connect to anything. It installs alongside the regular app rather than replacing
+it; move tasks between the two with Settings → Storage → Export / Import. In
+Obtainium, pick it with *Filter APKs by regular expression* set to
+`^agendula-offline_v`.
+
+### Build from source
+
+```sh
+git clone --recurse-submodules https://codeberg.org/jlmakiola/agendula.git
+cd agendula
+./gradlew :app:assembleDebug
+```
+
+JDK 17 and the Android SDK are all it needs; see
+[`CONTRIBUTING.md`](CONTRIBUTING.md) for tests and lint.
+
+## Translations
+
+Translations are managed on a self-hosted **Weblate**, and partial ones are
+fine — an untranslated string simply falls back to English. Agendula ships in
+English, German and Brazilian Portuguese so far.
+
+**→ [Help translate Agendula](https://weblate.dev.jeanlucmakiola.de/engage/agendula/)**
+
+No coding needed: register on the Weblate server, pick (or request) a language,
+and translate the strings in your browser. You can also reach this link in the
+app from the top of **Settings → App language**.
+
+## Contributing
+
+Issues and pull requests live on
+**[Codeberg](https://codeberg.org/jlmakiola/agendula)**.
+[`CONTRIBUTING.md`](CONTRIBUTING.md) covers the practical how.
+
+## Privacy
+
+No analytics, no advertising, no tracking, no third-party SDK, and no server of
+the developer's. Your tasks stay on your device unless you add a CalDAV account
+yourself, and then they go only to the server you chose.
+
+**→ [Privacy policy](https://jeanlucmakiola.de/agendula/privacy)**
 
 ## License
 

app/build.gradle.kts

@@ -1,3 +1,4 @@
+import com.android.build.api.artifact.SingleArtifact
 import java.util.Properties
 import java.io.FileInputStream
 
@@ -16,22 +17,48 @@ val keystoreProperties = Properties().apply {
 }
 
 android {
-    namespace = "de.jeanlucmakiola.floret"
+    namespace = "de.jeanlucmakiola.agendula"
     compileSdk = 37
 
     defaultConfig {
-        applicationId = "de.jeanlucmakiola.floret"
+        applicationId = "de.jeanlucmakiola.agendula"
         minSdk = 29
         targetSdk = 36
-        // The git tag is the single source of truth for released builds: at
-        // release time .gitea/workflows/release.yaml derives both fields from
-        // the tag, with versionCode = MAJOR*10000 + MINOR*100 + PATCH
-        // (e.g. v2.0.0 -> 20000). These committed values are the dev/local
-        // default; keep them matching the latest released tag. See docs/RELEASING.md.
-        versionCode = 200
-        versionName = "0.2.0"
+        // These committed values ARE the source of truth for a release: merging
+        // a bumped versionName into main triggers .gitea/workflows/release.yaml,
+        // which builds this version and then creates the matching vX.Y.Z tag +
+        // release itself. A versionName of X.Y.Z-beta.N pushed to a release/*
+        // branch instead cuts a Codeberg-only pre-release (beta.yaml).
+        // versionCode is derived from versionName by scripts/version_info.sh
+        // (1.0.x: 1.0.0 -> 10000; from 1.1.0: 1.1.0-beta.1 -> 1010001,
+        // 1.1.0 -> 1010099), and CI fails if the committed one doesn't match.
+        // See docs/RELEASING.md.
+        versionCode = 1010002
+        versionName = "1.1.0-beta.2"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
+
+        // The sync-adapter and authenticator XML descriptors cannot read
+        // BuildConfig, so the two identifiers they need are generated here.
+        // Derived from applicationId so the debug and releaseTest builds get
+        // their own and can be installed alongside the real app without their
+        // accounts colliding. Must stay in step with SyncContract.
+        resValue("string", "account_type", "de.jeanlucmakiola.agendula.caldav")
+        resValue("string", "sync_authority", "de.jeanlucmakiola.agendula.sync")
+    }
+
+    // `offline` (#39): no sync code, network libraries or network permission.
+    flavorDimensions += "network"
+    productFlavors {
+        create("full") {
+            dimension = "network"
+            buildConfigField("boolean", "SYNC_ENABLED", "true")
+        }
+        create("offline") {
+            dimension = "network"
+            applicationIdSuffix = ".offline"
+            buildConfigField("boolean", "SYNC_ENABLED", "false")
+        }
     }
 
     signingConfigs {
@@ -47,6 +74,11 @@ android {
 
     buildTypes {
         release {
+            // Keep release builds reproducible for F-Droid: don't let AGP embed
+            // build-environment git metadata (META-INF/version-control-info.textproto),
+            // whose `revision`/path content varies by build machine and is the only
+            // thing that otherwise differs from a clean from-source rebuild.
+            vcsInfo { include = false }
             isMinifyEnabled = true
             isShrinkResources = true
             proguardFiles(
@@ -60,6 +92,26 @@ android {
         debug {
             applicationIdSuffix = ".debug"
             isMinifyEnabled = false
+            resValue("string", "account_type", "de.jeanlucmakiola.agendula.debug.caldav")
+            resValue("string", "sync_authority", "de.jeanlucmakiola.agendula.debug.sync")
+        }
+        // A locally-installable twin of `release`: same R8 shrinking + obfuscation
+        // and resource shrinking, but debug-signed and given its own applicationId
+        // suffix so it installs alongside both the production app (signed with the
+        // real key) and the debug build. Used to smoke-test a release candidate on
+        // a real device before merging to main — R8-only breakage and first-run/
+        // permission states don't surface in the unminified debug build, nor on a
+        // device that already holds the permission. Never published. See
+        // docs/RELEASING.md.
+        create("releaseTest") {
+            initWith(getByName("release"))
+            applicationIdSuffix = ".releasetest"
+            signingConfig = signingConfigs.getByName("debug")
+            isMinifyEnabled = true
+            isShrinkResources = true
+            matchingFallbacks += "release"
+            resValue("string", "account_type", "de.jeanlucmakiola.agendula.releasetest.caldav")
+            resValue("string", "sync_authority", "de.jeanlucmakiola.agendula.releasetest.sync")
         }
     }
 
@@ -71,12 +123,44 @@ android {
     buildFeatures {
         compose = true
         buildConfig = true
+        // The account type and sync authority are generated per variant so the
+        // debug and releaseTest builds do not fight the real app over ownership
+        // of an account type. AGP 9 requires opting in.
+        resValues = true
+    }
+
+    // Don't embed AGP's dependency-metadata block in the APK signing block. It's
+    // a Play-oriented blob, and F-Droid's reproducible-build scanner rejects any
+    // "extra signing block" — so leaving it in blocks publishing to the official
+    // repo. It lives in the signing block, not the zip entries, so disabling it
+    // doesn't change the build output (reproducibility is unaffected).
+    dependenciesInfo {
+        includeInApk = false
+        includeInBundle = false
     }
 
     packaging {
         resources {
             excludes += "/META-INF/{AL2.0,LGPL2.1}"
         }
+        // Ship the prebuilt .so files (datastore's shared counter) exactly as the
+        // AAR has them. AGP strips them only when an NDK happens to be installed,
+        // so CI and F-Droid's buildserver would otherwise disagree on the bytes.
+        jniLibs {
+            keepDebugSymbols += "**/*.so"
+        }
+    }
+
+    lint {
+        // Community translations are expected to be partial — a missing string
+        // falls back to the English base at runtime — so don't fail the build on
+        // it. Likewise a translated <plurals> may not fill every CLDR quantity
+        // form its locale defines (e.g. Arabic needs "zero"); the missing form
+        // falls back to "other" at runtime, so MissingQuantity is informational
+        // too. Stale/extra keys (ExtraTranslation) stay fatal; scripts/
+        // check_translations.py guards the same invariants with clearer,
+        // translator-facing messages.
+        informational += listOf("MissingTranslation", "MissingQuantity")
     }
 
     testOptions {
@@ -85,6 +169,10 @@ android {
             isReturnDefaultValues = true
         }
     }
+
+    // MigrationTestHelper reads the exported schemas out of the test APK's
+    // assets, so app/schemas/ has to ship with the instrumented tests.
+    sourceSets.getByName("androidTest").assets.srcDir("$projectDir/schemas")
 }
 
 kotlin {
@@ -93,11 +181,27 @@ kotlin {
     }
 }
 
+// Export each Room schema version to app/schemas/ and commit it. That JSON is
+// what MigrationTestHelper reads to build an old database and migrate it, so
+// without it a migration can only be tested by hand.
+ksp {
+    arg("room.schemaLocation", "$projectDir/schemas")
+}
+
 dependencies {
+    // Not a dependency we use directly — lifecycle already drags it in at 1.7.3.
+    // AGP's consistent resolution then pins androidTest to the app classpath, and
+    // room-testing's MigrationTestHelper needs 1.8+ to deserialize the exported
+    // schema; on 1.7.3 it dies with an AbstractMethodError. Raise it in one place.
+    constraints {
+        implementation(libs.kotlinx.serialization.json)
+    }
+
     implementation(libs.androidx.core.ktx)
     implementation(libs.androidx.appcompat)
     implementation(libs.androidx.lifecycle.runtime.ktx)
     implementation(libs.androidx.lifecycle.runtime.compose)
+    implementation(libs.androidx.lifecycle.process)
     implementation(libs.androidx.activity.compose)
 
     implementation(platform(libs.androidx.compose.bom))
@@ -110,16 +214,54 @@ dependencies {
 
     implementation(libs.hilt.android)
     implementation(libs.androidx.hilt.navigation.compose)
+    implementation(libs.androidx.hilt.lifecycle.viewmodel.compose)
     implementation(libs.androidx.navigation.compose)
     ksp(libs.hilt.compiler)
 
-    implementation(libs.androidx.datastore.preferences)
+    // Sync runs in WorkManager, triggered *through* the sync-adapter framework.
+    // hilt-work supplies the HiltWorkerFactory; its compiler generates the
+    // @HiltWorker plumbing.
+    implementation(libs.androidx.work.runtime.ktx)
+    // Custom Tabs: the Nextcloud login flow hands the browser an approval page.
+    "fullImplementation"(libs.androidx.browser)
+    implementation(libs.androidx.hilt.work)
+    ksp(libs.androidx.hilt.compiler)
 
+    // Push sync: a UnifiedPush distributor delivers the server's WebDAV-Push messages.
+    "fullImplementation"(libs.unifiedpush.connector)
+
+    // RFC 5545 recurrence expansion, in-process; see the catalog for the pin.
+    implementation(libs.dmfs.lib.recur)
+
+    // Vendored dav4jvm — the CalDAV protocol layer. See dav/PROVENANCE.md.
+    "fullImplementation"(project(":dav"))
+    // Discovery, auth and Nextcloud Login Flow v2.
+    "fullImplementation"(project(":caldav"))
+    // :dav gets org.xmlpull.v1 from the Android framework at runtime and declares
+    // xpp3 compileOnly, which is not transitive. Unit tests run on a plain JVM
+    // with no framework, and android.jar's stub factory returns null under
+    // isReturnDefaultValues — so anything touching XmlUtils would NPE without a
+    // real implementation here.
+    "testFullImplementation"(libs.xpp3)
+
+    implementation(libs.androidx.room.runtime)
+    implementation(libs.androidx.room.ktx)
+    ksp(libs.androidx.room.compiler)
+
+    implementation(libs.androidx.datastore.preferences)
     implementation(libs.androidx.glance.appwidget)
     implementation(libs.androidx.glance.material3)
+    implementation(libs.androidx.documentfile)
 
     implementation(libs.kotlinx.datetime)
     implementation(libs.kotlinx.coroutines.core)
+    implementation(libs.floret.core.time)
+    implementation(libs.floret.core.reminders)
+    implementation(libs.floret.core.locale)
+    implementation(libs.floret.core.crash)
+    implementation(libs.floret.identity)
+    implementation(libs.floret.components)
+    implementation(libs.floret.glance)
 
     debugImplementation(libs.androidx.ui.tooling)
     debugImplementation(libs.androidx.ui.test.manifest)
@@ -135,6 +277,38 @@ dependencies {
     androidTestImplementation(libs.androidx.espresso.core)
     androidTestImplementation(libs.androidx.test.rules)
     androidTestImplementation(libs.truth)
+    androidTestImplementation(libs.androidx.room.testing)
     androidTestImplementation(platform(libs.androidx.compose.bom))
     androidTestImplementation(libs.androidx.ui.test.junit4)
 }
+
+/** Fails the build if the offline flavor's merged manifest asks for the network. */
+abstract class VerifyNoNetworkPermissions : DefaultTask() {
+    @get:InputFile
+    @get:PathSensitive(PathSensitivity.NONE)
+    abstract val manifest: RegularFileProperty
+
+    @TaskAction
+    fun verify() {
+        val text = manifest.get().asFile.readText()
+        val found = listOf("INTERNET", "ACCESS_NETWORK_STATE", "ACCESS_WIFI_STATE", "CHANGE_NETWORK_STATE")
+            .filter { "\"android.permission.$it\"" in text }
+        if (found.isNotEmpty()) {
+            throw GradleException(
+                "The offline flavor's merged manifest declares ${found.joinToString()}. " +
+                    "Remove it in app/src/offline/AndroidManifest.xml with tools:node=\"remove\".",
+            )
+        }
+    }
+}
+
+androidComponents {
+    onVariants(selector().withFlavor("network" to "offline")) { variant ->
+        val name = variant.name.replaceFirstChar { it.uppercase() }
+        val verify = tasks.register<VerifyNoNetworkPermissions>("verify${name}Manifest") {
+            manifest.set(variant.artifacts.get(SingleArtifact.MERGED_MANIFEST))
+        }
+        tasks.matching { it.name in setOf("package$name", "package${name}Bundle", "check") }
+            .configureEach { dependsOn(verify) }
+    }
+}

app/proguard-rules.pro

@@ -2,5 +2,21 @@
 -keep class dagger.hilt.** { *; }
 -keep @dagger.hilt.android.HiltAndroidApp class *
 
+# Room instantiates its generated <Database>_Impl reflectively through a no-arg
+# constructor. R8 under AGP 9 keeps the class but prunes that constructor, since
+# nothing calls it directly — Room then throws InstantiationException, reported
+# as "Failed to create an instance of ...". This first bit us through a
+# transitive Room (Glance -> WorkManager -> WorkDatabase, built at startup:
+# issue #1); Glance is gone and Room is now our own task store, so the rule
+# matters more, not less — TasksDatabase is built on the first store read.
+-keep class * extends androidx.room.RoomDatabase { <init>(); }
+
 # Compose Compiler may keep its own; defaults are fine
 -dontwarn org.jetbrains.annotations.**
+
+# dnsjava (CalDAV SRV/TXT discovery) references JNA, JNDI, Lombok and SLF4J
+# bindings that only exist on desktop JVMs; its Android resolver needs none.
+-dontwarn com.sun.jna.**
+-dontwarn javax.naming.**
+-dontwarn lombok.Generated
+-dontwarn org.slf4j.impl.StaticLoggerBinder

app/schemas/de.jeanlucmakiola.agendula.data.tasks.room.TasksDatabase/1.json

@@ -0,0 +1,522 @@
+{
+  "formatVersion": 1,
+  "database": {
+    "version": 1,
+    "identityHash": "c94852274d874fe255ee76e1e46a3003",
+    "entities": [
+      {
+        "tableName": "accounts",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, `display_name` TEXT NOT NULL, `principal_url` TEXT, `home_set_url` TEXT, `username` TEXT, `last_sync_at` INTEGER, `last_sync_error` TEXT)",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "displayName",
+            "columnName": "display_name",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "principalUrl",
+            "columnName": "principal_url",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "homeSetUrl",
+            "columnName": "home_set_url",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "username",
+            "columnName": "username",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "lastSyncAt",
+            "columnName": "last_sync_at",
+            "affinity": "INTEGER"
+          },
+          {
+            "fieldPath": "lastSyncError",
+            "columnName": "last_sync_error",
+            "affinity": "TEXT"
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": true,
+          "columnNames": [
+            "id"
+          ]
+        }
+      },
+      {
+        "tableName": "task_lists",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, `name` TEXT NOT NULL, `color` INTEGER NOT NULL, `account_id` INTEGER, `is_visible` INTEGER NOT NULL DEFAULT 1, `is_synced` INTEGER NOT NULL DEFAULT 1, `owner` TEXT, `is_read_only` INTEGER NOT NULL DEFAULT 0, `sort_order` INTEGER NOT NULL DEFAULT 0, `href` TEXT, `ctag` TEXT, `sync_token` TEXT, `is_dirty` INTEGER NOT NULL DEFAULT 0, FOREIGN KEY(`account_id`) REFERENCES `accounts`(`id`) ON UPDATE NO ACTION ON DELETE SET NULL )",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "name",
+            "columnName": "name",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "color",
+            "columnName": "color",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "accountId",
+            "columnName": "account_id",
+            "affinity": "INTEGER"
+          },
+          {
+            "fieldPath": "isVisible",
+            "columnName": "is_visible",
+            "affinity": "INTEGER",
+            "notNull": true,
+            "defaultValue": "1"
+          },
+          {
+            "fieldPath": "isSynced",
+            "columnName": "is_synced",
+            "affinity": "INTEGER",
+            "notNull": true,
+            "defaultValue": "1"
+          },
+          {
+            "fieldPath": "owner",
+            "columnName": "owner",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "isReadOnly",
+            "columnName": "is_read_only",
+            "affinity": "INTEGER",
+            "notNull": true,
+            "defaultValue": "0"
+          },
+          {
+            "fieldPath": "sortOrder",
+            "columnName": "sort_order",
+            "affinity": "INTEGER",
+            "notNull": true,
+            "defaultValue": "0"
+          },
+          {
+            "fieldPath": "href",
+            "columnName": "href",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "ctag",
+            "columnName": "ctag",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "syncToken",
+            "columnName": "sync_token",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "isDirty",
+            "columnName": "is_dirty",
+            "affinity": "INTEGER",
+            "notNull": true,
+            "defaultValue": "0"
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": true,
+          "columnNames": [
+            "id"
+          ]
+        },
+        "indices": [
+          {
+            "name": "index_task_lists_account_id",
+            "unique": false,
+            "columnNames": [
+              "account_id"
+            ],
+            "orders": [],
+            "createSql": "CREATE INDEX IF NOT EXISTS `index_task_lists_account_id` ON `${TABLE_NAME}` (`account_id`)"
+          }
+        ],
+        "foreignKeys": [
+          {
+            "table": "accounts",
+            "onDelete": "SET NULL",
+            "onUpdate": "NO ACTION",
+            "columns": [
+              "account_id"
+            ],
+            "referencedColumns": [
+              "id"
+            ]
+          }
+        ]
+      },
+      {
+        "tableName": "tasks",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, `list_id` INTEGER NOT NULL, `uid` TEXT NOT NULL, `href` TEXT, `etag` TEXT, `title` TEXT, `description` TEXT, `location` TEXT, `url` TEXT, `color` INTEGER, `status` INTEGER NOT NULL DEFAULT 0, `percent_complete` INTEGER, `completed_at` INTEGER, `priority` INTEGER NOT NULL DEFAULT 0, `classification` INTEGER, `dtstart` INTEGER, `due` INTEGER, `duration` TEXT, `is_all_day` INTEGER NOT NULL DEFAULT 0, `timezone` TEXT, `rrule` TEXT, `rdate` TEXT, `exdate` TEXT, `recurrence_id` INTEGER, `master_id` INTEGER, `parent_id` INTEGER, `sort_order` INTEGER NOT NULL DEFAULT 0, `created_at` INTEGER, `last_modified` INTEGER, `sequence` INTEGER NOT NULL DEFAULT 0, `is_dirty` INTEGER NOT NULL DEFAULT 0, `is_deleted` INTEGER NOT NULL DEFAULT 0, `unknown_properties` TEXT, FOREIGN KEY(`list_id`) REFERENCES `task_lists`(`id`) ON UPDATE NO ACTION ON DELETE CASCADE , FOREIGN KEY(`master_id`) REFERENCES `tasks`(`id`) ON UPDATE NO ACTION ON DELETE CASCADE , FOREIGN KEY(`parent_id`) REFERENCES `tasks`(`id`) ON UPDATE NO ACTION ON DELETE SET NULL )",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "listId",
+            "columnName": "list_id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "uid",
+            "columnName": "uid",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "href",
+            "columnName": "href",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "etag",
+            "columnName": "etag",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "title",
+            "columnName": "title",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "description",
+            "columnName": "description",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "location",
+            "columnName": "location",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "url",
+            "columnName": "url",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "color",
+            "columnName": "color",
+            "affinity": "INTEGER"
+          },
+          {
+            "fieldPath": "status",
+            "columnName": "status",
+            "affinity": "INTEGER",
+            "notNull": true,
+            "defaultValue": "0"
+          },
+          {
+            "fieldPath": "percentComplete",
+            "columnName": "percent_complete",
+            "affinity": "INTEGER"
+          },
+          {
+            "fieldPath": "completedAt",
+            "columnName": "completed_at",
+            "affinity": "INTEGER"
+          },
+          {
+            "fieldPath": "priority",
+            "columnName": "priority",
+            "affinity": "INTEGER",
+            "notNull": true,
+            "defaultValue": "0"
+          },
+          {
+            "fieldPath": "classification",
+            "columnName": "classification",
+            "affinity": "INTEGER"
+          },
+          {
+            "fieldPath": "dtstart",
+            "columnName": "dtstart",
+            "affinity": "INTEGER"
+          },
+          {
+            "fieldPath": "due",
+            "columnName": "due",
+            "affinity": "INTEGER"
+          },
+          {
+            "fieldPath": "duration",
+            "columnName": "duration",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "isAllDay",
+            "columnName": "is_all_day",
+            "affinity": "INTEGER",
+            "notNull": true,
+            "defaultValue": "0"
+          },
+          {
+            "fieldPath": "timezone",
+            "columnName": "timezone",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "rrule",
+            "columnName": "rrule",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "rdate",
+            "columnName": "rdate",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "exdate",
+            "columnName": "exdate",
+            "affinity": "TEXT"
+          },
+          {
+            "fieldPath": "recurrenceId",
+            "columnName": "recurrence_id",
+            "affinity": "INTEGER"
+          },
+          {
+            "fieldPath": "masterId",
+            "columnName": "master_id",
+            "affinity": "INTEGER"
+          },
+          {
+            "fieldPath": "parentId",
+            "columnName": "parent_id",
+            "affinity": "INTEGER"
+          },
+          {
+            "fieldPath": "sortOrder",
+            "columnName": "sort_order",
+            "affinity": "INTEGER",
+            "notNull": true,
+            "defaultValue": "0"
+          },
+          {
+            "fieldPath": "createdAt",
+            "columnName": "created_at",
+            "affinity": "INTEGER"
+          },
+          {
+            "fieldPath": "lastModified",
+            "columnName": "last_modified",
+            "affinity": "INTEGER"
+          },
+          {
+            "fieldPath": "sequence",
+            "columnName": "sequence",
+            "affinity": "INTEGER",
+            "notNull": true,
+            "defaultValue": "0"
+          },
+          {
+            "fieldPath": "isDirty",
+            "columnName": "is_dirty",
+            "affinity": "INTEGER",
+            "notNull": true,
+            "defaultValue": "0"
+          },
+          {
+            "fieldPath": "isDeleted",
+            "columnName": "is_deleted",
+            "affinity": "INTEGER",
+            "notNull": true,
+            "defaultValue": "0"
+          },
+          {
+            "fieldPath": "unknownProperties",
+            "columnName": "unknown_properties",
+            "affinity": "TEXT"
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": true,
+          "columnNames": [
+            "id"
+          ]
+        },
+        "indices": [
+          {
+            "name": "index_tasks_list_id_is_deleted",
+            "unique": false,
+            "columnNames": [
+              "list_id",
+              "is_deleted"
+            ],
+            "orders": [],
+            "createSql": "CREATE INDEX IF NOT EXISTS `index_tasks_list_id_is_deleted` ON `${TABLE_NAME}` (`list_id`, `is_deleted`)"
+          },
+          {
+            "name": "index_tasks_parent_id",
+            "unique": false,
+            "columnNames": [
+              "parent_id"
+            ],
+            "orders": [],
+            "createSql": "CREATE INDEX IF NOT EXISTS `index_tasks_parent_id` ON `${TABLE_NAME}` (`parent_id`)"
+          },
+          {
+            "name": "index_tasks_master_id_recurrence_id",
+            "unique": false,
+            "columnNames": [
+              "master_id",
+              "recurrence_id"
+            ],
+            "orders": [],
+            "createSql": "CREATE INDEX IF NOT EXISTS `index_tasks_master_id_recurrence_id` ON `${TABLE_NAME}` (`master_id`, `recurrence_id`)"
+          },
+          {
+            "name": "index_tasks_is_dirty",
+            "unique": false,
+            "columnNames": [
+              "is_dirty"
+            ],
+            "orders": [],
+            "createSql": "CREATE INDEX IF NOT EXISTS `index_tasks_is_dirty` ON `${TABLE_NAME}` (`is_dirty`)"
+          },
+          {
+            "name": "index_tasks_list_id_uid_recurrence_id",
+            "unique": true,
+            "columnNames": [
+              "list_id",
+              "uid",
+              "recurrence_id"
+            ],
+            "orders": [],
+            "createSql": "CREATE UNIQUE INDEX IF NOT EXISTS `index_tasks_list_id_uid_recurrence_id` ON `${TABLE_NAME}` (`list_id`, `uid`, `recurrence_id`)"
+          }
+        ],
+        "foreignKeys": [
+          {
+            "table": "task_lists",
+            "onDelete": "CASCADE",
+            "onUpdate": "NO ACTION",
+            "columns": [
+              "list_id"
+            ],
+            "referencedColumns": [
+              "id"
+            ]
+          },
+          {
+            "table": "tasks",
+            "onDelete": "CASCADE",
+            "onUpdate": "NO ACTION",
+            "columns": [
+              "master_id"
+            ],
+            "referencedColumns": [
+              "id"
+            ]
+          },
+          {
+            "table": "tasks",
+            "onDelete": "SET NULL",
+            "onUpdate": "NO ACTION",
+            "columns": [
+              "parent_id"
+            ],
+            "referencedColumns": [
+              "id"
+            ]
+          }
+        ]
+      },
+      {
+        "tableName": "task_alarms",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, `task_id` INTEGER NOT NULL, `minutes_before` INTEGER NOT NULL, `reference` TEXT NOT NULL DEFAULT 'DUE', `message` TEXT, FOREIGN KEY(`task_id`) REFERENCES `tasks`(`id`) ON UPDATE NO ACTION ON DELETE CASCADE )",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "taskId",
+            "columnName": "task_id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "minutesBefore",
+            "columnName": "minutes_before",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "reference",
+            "columnName": "reference",
+            "affinity": "TEXT",
+            "notNull": true,
+            "defaultValue": "'DUE'"
+          },
+          {
+            "fieldPath": "message",
+            "columnName": "message",
+            "affinity": "TEXT"
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": true,
+          "columnNames": [
+            "id"
+          ]
+        },
+        "indices": [
+          {
+            "name": "index_task_alarms_task_id",
+            "unique": false,
+            "columnNames": [
+              "task_id"
+            ],
+            "orders": [],
+            "createSql": "CREATE INDEX IF NOT EXISTS `index_task_alarms_task_id` ON `${TABLE_NAME}` (`task_id`)"
+          }
+        ],
+        "foreignKeys": [
+          {
+            "table": "tasks",
+            "onDelete": "CASCADE",
+            "onUpdate": "NO ACTION",
+            "columns": [
+              "task_id"
+            ],
+            "referencedColumns": [
+              "id"
+            ]
+          }
+        ]
+      }
+    ],
+    "setupQueries": [
+      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
+      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, 'c94852274d874fe255ee76e1e46a3003')"
+    ]
+  }
+}

app/src/androidTest/java/de/jeanlucmakiola/agendula/data/tasks/legacy/OneShotImportTest.kt

@@ -0,0 +1,290 @@
+package de.jeanlucmakiola.agendula.data.tasks.legacy
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.PreferenceDataStoreFactory
+import androidx.datastore.preferences.core.Preferences
+import androidx.room.Room
+import androidx.test.core.app.ApplicationProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import com.google.common.truth.Truth.assertThat
+import de.jeanlucmakiola.agendula.data.tasks.room.AlarmReference
+import de.jeanlucmakiola.agendula.data.tasks.room.TaskEntity
+import de.jeanlucmakiola.agendula.data.tasks.room.TasksDatabase
+import de.jeanlucmakiola.agendula.domain.TaskStatus
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.runBlocking
+import org.junit.After
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+import org.junit.rules.TemporaryFolder
+import org.junit.runner.RunWith
+import java.io.File
+import java.util.UUID
+import kotlin.time.Instant
+
+/**
+ * The one-shot import, against `assets/tasks-v23.db` — the dmfs v23 fixture
+ * `scripts/make_import_fixture.py` seeds. Instrumented because both halves need
+ * a real SQLite: the source file and Room.
+ */
+@RunWith(AndroidJUnit4::class)
+class OneShotImportTest {
+
+    @get:Rule
+    val temp = TemporaryFolder()
+
+    private val context: Context = ApplicationProvider.getApplicationContext()
+    private lateinit var scope: CoroutineScope
+    private lateinit var prefs: DataStore<Preferences>
+    private lateinit var db: TasksDatabase
+    private lateinit var importer: OneShotImport
+
+    @Before
+    fun setUp() {
+        scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+        prefs = PreferenceDataStoreFactory.create(scope = scope) {
+            temp.newFile("import-${counter++}.preferences_pb").also(File::delete)
+        }
+        db = Room.inMemoryDatabaseBuilder(context, TasksDatabase::class.java)
+            .allowMainThreadQueries()
+            .build()
+        importer = OneShotImport(context, db, prefs)
+        legacyFile().delete()
+        archiveFile().delete()
+    }
+
+    @After
+    fun tearDown() {
+        db.close()
+        scope.cancel()
+        legacyFile().delete()
+        archiveFile().delete()
+    }
+
+    private fun legacyFile() = context.getDatabasePath(OneShotImport.LEGACY_NAME)
+    private fun archiveFile() = context.getDatabasePath(OneShotImport.ARCHIVE_NAME)
+
+    /** The fixture, copied out of the test APK's assets. */
+    private fun fixture(target: File = temp.newFile("tasks-v23-copy.db")): File {
+        InstrumentationRegistry.getInstrumentation().context.assets.open(FIXTURE).use { source ->
+            target.outputStream().use(source::copyTo)
+        }
+        return target
+    }
+
+    private fun taskRows(): Map<String, TaskEntity> =
+        db.tasks().tasks(null, includeCompleted = true).associate { it.task.title!! to it.task }
+
+    // --- what lands -----------------------------------------------------------
+
+    @Test
+    fun importsEveryLiveTaskAndLeavesTheDeletedOneBehind() {
+        val counts = importer.importFrom(fixture())
+
+        assertThat(counts).isEqualTo(ImportCounts(lists = 3, tasks = 8, alarms = 2))
+        assertThat(taskRows().keys).containsExactly(
+            "Buy milk",
+            "Call the dentist",
+            "Gather receipts",
+            "Renew domain",
+            "Water the plants",
+            "Team offsite",
+            "Task in a hidden list",
+            "Ship the release",
+        )
+    }
+
+    @Test
+    fun importsEveryListAsADeviceOnlyListWithItsFlags() {
+        importer.importFrom(fixture())
+
+        val lists = db.taskLists().lists().associateBy { it.list.name }
+        assertThat(lists.keys).containsExactly("Personal", "Hidden list", "Work")
+        assertThat(lists.values.map { it.list.accountId }).containsExactly(null, null, null)
+        assertThat(lists.getValue("Personal").list.isVisible).isTrue()
+        assertThat(lists.getValue("Hidden list").list.isVisible).isFalse()
+        // The list that sat under a real account: still imported, owner kept.
+        assertThat(lists.getValue("Work").list.owner).isEqualTo("Me")
+        assertThat(lists.getValue("Work").list.color).isEqualTo(0xFF2244AA.toInt())
+    }
+
+    @Test
+    fun carriesTheTaskFieldsAcross() {
+        importer.importFrom(fixture())
+        val tasks = taskRows()
+
+        val milk = tasks.getValue("Buy milk")
+        assertThat(milk.due).isEqualTo(Instant.fromEpochMilliseconds(T0 + DAY))
+        assertThat(milk.status).isEqualTo(TaskStatus.NEEDS_ACTION)
+        assertThat(milk.createdAt).isEqualTo(Instant.fromEpochMilliseconds(T0))
+
+        val dentist = tasks.getValue("Call the dentist")
+        assertThat(dentist.status).isEqualTo(TaskStatus.IN_PROCESS)
+        assertThat(dentist.percentComplete).isEqualTo(40)
+
+        val domain = tasks.getValue("Renew domain")
+        assertThat(domain.status).isEqualTo(TaskStatus.COMPLETED)
+        assertThat(domain.completedAt).isEqualTo(Instant.fromEpochMilliseconds(T0 - DAY))
+
+        val plants = tasks.getValue("Water the plants")
+        assertThat(plants.rrule).isEqualTo("FREQ=WEEKLY;BYDAY=MO,TH")
+        assertThat(plants.timezone).isEqualTo("Europe/Berlin")
+        assertThat(plants.dtstart).isEqualTo(Instant.fromEpochMilliseconds(T0))
+
+        assertThat(tasks.getValue("Team offsite").isAllDay).isTrue()
+    }
+
+    // --- uids -----------------------------------------------------------------
+
+    @Test
+    fun keepsExistingUidsAndMintsOneWhereTheLegacyRowHadNone() {
+        importer.importFrom(fixture())
+        val tasks = taskRows()
+
+        assertThat(tasks.getValue("Buy milk").uid).isEqualTo("a1b2c3d4-0000-4000-8000-000000000001")
+        // The external-account row's uid is what lets it be re-attached later.
+        assertThat(tasks.getValue("Ship the release").uid)
+            .isEqualTo("a1b2c3d4-0000-4000-8000-000000000009")
+
+        val minted = tasks.getValue("Call the dentist").uid
+        assertThat(minted).isNotEmpty()
+        assertThat(UUID.fromString(minted).version()).isEqualTo(4)
+        assertThat(tasks.values.map { it.uid }.toSet()).hasSize(tasks.size)
+    }
+
+    // --- the id remap ---------------------------------------------------------
+
+    @Test
+    fun remapsListIdsOntoTheNewRowIds() {
+        importer.importFrom(fixture())
+
+        val lists = db.taskLists().lists().associateBy { it.list.name }
+        val byList = db.tasks().tasks(null, includeCompleted = true)
+            .groupBy { it.task.listId }
+            .mapValues { (_, rows) -> rows.size }
+
+        assertThat(byList[lists.getValue("Personal").list.id]).isEqualTo(6)
+        assertThat(byList[lists.getValue("Hidden list").list.id]).isEqualTo(1)
+        assertThat(byList[lists.getValue("Work").list.id]).isEqualTo(1)
+        // No task kept a dmfs row id that Room never handed out.
+        assertThat(byList.keys).containsExactlyElementsIn(lists.values.map { it.list.id })
+    }
+
+    @Test
+    fun remapsParentIdsOntoTheNewRowIds() {
+        importer.importFrom(fixture())
+        val tasks = taskRows()
+
+        val parent = tasks.getValue("Buy milk")
+        val child = tasks.getValue("Gather receipts")
+        assertThat(child.parentId).isEqualTo(parent.id)
+        assertThat(db.tasks().subtasks(parent.id).map { it.task.title }).containsExactly("Gather receipts")
+        assertThat(tasks.values.filter { it.parentId != null }).hasSize(1)
+    }
+
+    // --- alarms ---------------------------------------------------------------
+
+    @Test
+    fun importsAlarmsAndSkipsEveryOtherProperty() {
+        importer.importFrom(fixture())
+        val tasks = taskRows()
+
+        assertThat(db.alarms().all()).hasSize(2)
+
+        val milk = db.alarms().forTask(tasks.getValue("Buy milk").id).single()
+        assertThat(milk.minutesBefore).isEqualTo(30)
+        assertThat(milk.reference).isEqualTo(AlarmReference.DUE)
+        assertThat(milk.message).isNull()
+
+        val release = db.alarms().forTask(tasks.getValue("Ship the release").id).single()
+        assertThat(release.minutesBefore).isEqualTo(1440)
+        assertThat(release.reference).isEqualTo(AlarmReference.DUE)
+        assertThat(release.message).isEqualTo("Ship it")
+
+        // The category property on task 1 is not an alarm.
+        assertThat(db.alarms().all().map { it.message }).doesNotContain("Errands")
+    }
+
+    // --- running it -----------------------------------------------------------
+
+    @Test
+    fun runIfNeededImportsArchivesTheSourceAndThenDoesNothing() = runBlocking {
+        fixture(legacyFile())
+
+        val first = importer.runIfNeeded()
+
+        assertThat(first).isEqualTo(ImportResult.Imported(ImportCounts(3, 8, 2)))
+        assertThat(legacyFile().exists()).isFalse()
+        assertThat(archiveFile().exists()).isTrue()
+        assertThat(importer.isDone.first()).isTrue()
+
+        val second = importer.runIfNeeded()
+
+        assertThat(second).isEqualTo(ImportResult.AlreadyDone)
+        assertThat(taskRows()).hasSize(8)
+    }
+
+    @Test
+    fun anInterruptedImportResumesFromTheArchiveWithoutDoubling() = runBlocking {
+        // The process dying between the commit and the flag write is the one gap
+        // the DataStore flag cannot cover on its own. Because the rename happens
+        // first and the import always replaces, the next run finds the archive and
+        // redoes the same work rather than importing a second copy.
+        fixture(legacyFile())
+        importer.runIfNeeded()
+        importer.clearCompletion()
+
+        val resumed = importer.runIfNeeded()
+
+        assertThat(resumed).isEqualTo(ImportResult.Imported(ImportCounts(3, 8, 2)))
+        assertThat(taskRows()).hasSize(8)
+        assertThat(db.taskLists().lists()).hasSize(3)
+        assertThat(db.alarms().all()).hasSize(2)
+    }
+
+    @Test
+    fun runIfNeededMarksItselfDoneWhenThereIsNoLegacyDatabase() = runBlocking {
+        assertThat(importer.runIfNeeded()).isEqualTo(ImportResult.NothingToImport)
+        assertThat(importer.isDone.first()).isTrue()
+        assertThat(taskRows()).isEmpty()
+    }
+
+    @Test
+    fun reimportFromTheArchiveReplacesRatherThanMerges() = runBlocking {
+        fixture(legacyFile())
+        importer.runIfNeeded()
+
+        val again = importer.reimportFromArchive()
+
+        assertThat(again).isEqualTo(ImportResult.Imported(ImportCounts(3, 8, 2)))
+        assertThat(db.taskLists().lists()).hasSize(3)
+        assertThat(taskRows()).hasSize(8)
+        assertThat(db.alarms().all()).hasSize(2)
+        assertThat(archiveFile().exists()).isTrue()
+    }
+
+    @Test
+    fun replacingTwiceFromTheSameFileLeavesOneCopy() {
+        importer.importFrom(fixture())
+        val counts = importer.importFrom(fixture(temp.newFile("second.db")), replaceExisting = true)
+
+        assertThat(counts).isEqualTo(ImportCounts(3, 8, 2))
+        assertThat(taskRows()).hasSize(8)
+        assertThat(db.taskLists().lists()).hasSize(3)
+        assertThat(db.alarms().all()).hasSize(2)
+    }
+
+    private companion object {
+        const val FIXTURE = "tasks-v23.db"
+        const val T0 = 1_768_467_600_000L
+        const val DAY = 86_400_000L
+        var counter = 0
+    }
+}

app/src/androidTest/java/de/jeanlucmakiola/agendula/data/tasks/room/RoomTasksDataSourceTest.kt

@@ -0,0 +1,542 @@
+package de.jeanlucmakiola.agendula.data.tasks.room
+
+import androidx.room.Room
+import androidx.test.core.app.ApplicationProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.google.common.truth.Truth.assertThat
+import de.jeanlucmakiola.agendula.data.tasks.TaskQuery
+import de.jeanlucmakiola.agendula.data.tasks.TaskReminder
+import de.jeanlucmakiola.agendula.domain.TaskForm
+import de.jeanlucmakiola.agendula.domain.TaskStatus
+import org.junit.After
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import kotlin.time.Clock
+import kotlin.time.Duration.Companion.days
+import kotlin.time.Instant
+
+/**
+ * The seam over Room, exercised through [de.jeanlucmakiola.agendula.data.tasks
+ * .TasksDataSource] rather than the DAOs — recurrence expansion and override
+ * forking only exist at this level.
+ */
+@RunWith(AndroidJUnit4::class)
+class RoomTasksDataSourceTest {
+
+    private lateinit var db: TasksDatabase
+    private lateinit var source: RoomTasksDataSource
+    private var listId = 0L
+
+    /** Truncated to the store's granularity: instants are columns of epoch millis. */
+    private val now get() = Instant.fromEpochMilliseconds(Clock.System.now().toEpochMilliseconds())
+
+    @Before
+    fun setUp() {
+        db = Room.inMemoryDatabaseBuilder(
+            ApplicationProvider.getApplicationContext(),
+            TasksDatabase::class.java,
+        ).allowMainThreadQueries().build()
+        source = RoomTasksDataSource(db)
+        listId = source.createLocalList("Personal", 0xFF112233.toInt())
+    }
+
+    @After
+    fun tearDown() = db.close()
+
+    private fun form(
+        title: String = "task",
+        due: Instant? = null,
+        percentComplete: Int? = null,
+    ) = TaskForm(title = title, listId = listId, due = due, percentComplete = percentComplete)
+
+    /** A list that belongs to an account, so writes owe a server something. */
+    private fun syncedList(): Long {
+        val accountId = db.accounts().insert(
+            AccountEntity(displayName = "me@example.com", username = "me"),
+        )
+        return db.taskLists().insert(
+            TaskListEntity(name = "Work", color = 0, accountId = accountId, href = "https://s/w/"),
+        )
+    }
+
+    /** Turns [taskId] into a weekly series anchored at [anchor]. */
+    private fun makeRecurring(taskId: Long, anchor: Instant, rule: String = "FREQ=WEEKLY") {
+        val entity = db.tasks().entity(taskId)!!
+        db.tasks().update(entity.copy(dtstart = anchor, due = anchor + 1.days, rrule = rule))
+    }
+
+    @Test
+    fun aWriteNamesTheListsItTouched() {
+        val touched = mutableListOf<Set<Long>>()
+        val observed = RoomTasksDataSource(db) { touched += it }
+        val work = syncedList()
+        val id = observed.insertTask(form().copy(listId = work))
+
+        observed.updateTask(id, form().copy(listId = listId))
+
+        assertThat(touched).containsExactly(setOf(work), setOf(work, listId)).inOrder()
+    }
+
+    @Test
+    fun movingASyncedTaskLeavesATombstoneInTheOldList() {
+        val work = syncedList()
+        val id = source.insertTask(form().copy(listId = work))
+        db.tasks().markSynced(listOf(id), "https://s/w/a.ics", "e1")
+
+        source.updateTask(id, form().copy(listId = listId))
+
+        val moved = db.tasks().entity(id)!!
+        assertThat(moved.listId).isEqualTo(listId)
+        assertThat(moved.href).isNull()
+        val tombstone = db.tasks().allIn(work).single()
+        assertThat(tombstone.isDeleted).isTrue()
+        assertThat(tombstone.href).isEqualTo("https://s/w/a.ics")
+        assertThat(tombstone.etag).isEqualTo("e1")
+    }
+
+    @Test
+    fun createsAndReadsBackALocalList() {
+        val lists = source.taskLists()
+
+        assertThat(lists).hasSize(1)
+        assertThat(lists.single().name).isEqualTo("Personal")
+        // No account, so the list still has to report something the lists screen
+        // can group under.
+        assertThat(lists.single().isLocal).isTrue()
+        assertThat(lists.single().accountName).isEqualTo("Local")
+    }
+
+    @Test
+    fun renamesAndRecoloursAList() {
+        source.updateList(listId, "  Errands  ", 0xFF445566.toInt())
+
+        val list = source.taskLists().single()
+        assertThat(list.name).isEqualTo("Errands")
+        assertThat(list.color).isEqualTo(0xFF445566.toInt())
+        // Nothing to sync a device-only list to, so the edit leaves it clean.
+        assertThat(db.taskLists().entity(listId)!!.isDirty).isFalse()
+    }
+
+    @Test
+    fun deletingAListTakesItsTasksWithIt() {
+        source.insertTask(form(title = "Buy milk"))
+        source.insertTask(form(title = "Call the bank"))
+        val other = source.createLocalList("Work", 0xFF778899.toInt())
+        val keeper = source.insertTask(TaskForm(title = "Ship it", listId = other))
+
+        source.deleteList(listId)
+
+        assertThat(source.taskLists().map { it.id }).containsExactly(other)
+        assertThat(source.tasks(TaskQuery(includeCompleted = true)).map { it.taskId })
+            .containsExactly(keeper)
+    }
+
+    @Test
+    fun createsAndReadsBackANonRecurringTask() {
+        val due = now + 1.days
+        val id = source.insertTask(form(title = "Buy milk", due = due))
+
+        val task = source.task(id)!!
+
+        assertThat(task.taskId).isEqualTo(id)
+        assertThat(task.title).isEqualTo("Buy milk")
+        assertThat(task.due).isEqualTo(due)
+        assertThat(task.isRecurring).isFalse()
+        // A task that does not recur has no occurrence anchor, so it keys and edits
+        // by task id exactly as it did against the provider.
+        assertThat(task.occurrenceStart).isNull()
+        assertThat(task.occurrenceKey).isEqualTo("$id")
+    }
+
+    @Test
+    fun mintsAUidForEveryTask() {
+        val id = source.insertTask(form())
+
+        assertThat(db.tasks().entity(id)!!.uid).isNotEmpty()
+    }
+
+    @Test
+    fun expandsARecurringSeriesIntoManyOccurrences() {
+        val anchor = now
+        val id = source.insertTask(form(title = "Water the plants"))
+        makeRecurring(id, anchor)
+
+        val occurrences = source.tasks(TaskQuery(listId = listId)).filter { it.taskId == id }
+
+        // The provider materialised exactly one upcoming occurrence; we expand the
+        // whole window, so a weekly series yields well over a hundred.
+        assertThat(occurrences.size).isGreaterThan(100)
+        assertThat(occurrences.map { it.occurrenceStart }).containsNoDuplicates()
+        assertThat(occurrences.map { it.occurrenceKey }).containsNoDuplicates()
+        assertThat(occurrences.all { it.isRecurring }).isTrue()
+        // Each occurrence keeps the series' length rather than the master's dates.
+        val first = occurrences.minBy { it.occurrenceStart!! }
+        assertThat(first.due!! - first.start!!).isEqualTo(1.days)
+    }
+
+    @Test
+    fun exactlyOneOccurrenceIsTheCurrentOne() {
+        val id = source.insertTask(form())
+        makeRecurring(id, now - 30.days)
+
+        val occurrences = source.tasks(TaskQuery(listId = listId)).filter { it.taskId == id }
+
+        assertThat(occurrences.count { it.distanceFromCurrent == 0 }).isEqualTo(1)
+        assertThat(source.task(id)!!.distanceFromCurrent).isEqualTo(0)
+    }
+
+    @Test
+    fun editingOneOccurrenceForksARecurrenceIdOverride() {
+        val anchor = now
+        val id = source.insertTask(form(title = "Water the plants"))
+        makeRecurring(id, anchor)
+        val target = source.tasks(TaskQuery(listId = listId))
+            .filter { it.taskId == id }
+            .first { it.distanceFromCurrent == 1 }
+
+        source.updateInstance(id, target.occurrenceStart!!, form(title = "Water them twice"))
+
+        val override = db.tasks().override(id, target.occurrenceStart)!!
+        // RFC 5545's model: the override shares its master's UID — that is what
+        // makes it an override rather than a separate task. The dmfs provider
+        // detached the occurrence into a new task with its own UID instead.
+        assertThat(override.uid).isEqualTo(db.tasks().entity(id)!!.uid)
+        assertThat(override.masterId).isEqualTo(id)
+        assertThat(override.recurrenceId).isEqualTo(target.occurrenceStart)
+        assertThat(override.rrule).isNull()
+        assertThat(override.title).isEqualTo("Water them twice")
+    }
+
+    @Test
+    fun completingOneOccurrenceLeavesTheRestOfTheSeriesOpen() {
+        val id = source.insertTask(form(title = "Water the plants"))
+        makeRecurring(id, now)
+        val open = { source.tasks(TaskQuery(listId = listId)).filter { it.taskId == id } }
+        val before = open()
+        val target = before.first { it.distanceFromCurrent == 0 }
+
+        source.setCompletedInstance(id, target.occurrenceStart!!, completed = true)
+
+        // Writing the status onto the master would close the series: the master is
+        // the row the task query filters on, so every occurrence would vanish.
+        val after = open()
+        assertThat(after).hasSize(before.size - 1)
+        assertThat(after.map { it.occurrenceStart }).doesNotContain(target.occurrenceStart)
+        assertThat(db.tasks().entity(id)!!.status).isEqualTo(TaskStatus.NEEDS_ACTION)
+
+        val override = db.tasks().override(id, target.occurrenceStart)!!
+        assertThat(override.uid).isEqualTo(db.tasks().entity(id)!!.uid)
+        assertThat(override.status).isEqualTo(TaskStatus.COMPLETED)
+        assertThat(override.rrule).isNull()
+        // The override stands for *that* occurrence, so it carries the
+        // occurrence's resolved times, not the master's anchor.
+        assertThat(override.dtstart).isEqualTo(target.occurrenceStart)
+    }
+
+    @Test
+    fun reopeningACompletedOccurrenceReusesItsOverride() {
+        val id = source.insertTask(form(title = "Water the plants"))
+        makeRecurring(id, now)
+        val target = source.tasks(TaskQuery(listId = listId))
+            .first { it.taskId == id && it.distanceFromCurrent == 0 }
+
+        source.setCompletedInstance(id, target.occurrenceStart!!, completed = true)
+        source.setCompletedInstance(id, target.occurrenceStart, completed = false)
+
+        assertThat(db.tasks().overrides(id)).hasSize(1)
+        assertThat(db.tasks().override(id, target.occurrenceStart)!!.status)
+            .isEqualTo(TaskStatus.NEEDS_ACTION)
+        assertThat(source.tasks(TaskQuery(listId = listId)).map { it.occurrenceStart })
+            .contains(target.occurrenceStart)
+    }
+
+    @Test
+    fun cancellingOneOccurrenceLeavesTheRestOfTheSeriesOpen() {
+        val id = source.insertTask(form(title = "Water the plants"))
+        makeRecurring(id, now)
+        val target = source.tasks(TaskQuery(listId = listId))
+            .first { it.taskId == id && it.distanceFromCurrent == 0 }
+
+        source.setCancelledInstance(id, target.occurrenceStart!!, cancelled = true)
+
+        assertThat(db.tasks().entity(id)!!.status).isEqualTo(TaskStatus.NEEDS_ACTION)
+        assertThat(db.tasks().override(id, target.occurrenceStart)!!.status).isEqualTo(TaskStatus.CANCELLED)
+
+        source.setCancelledInstance(id, target.occurrenceStart, cancelled = false)
+
+        assertThat(db.tasks().overrides(id)).hasSize(1)
+        assertThat(db.tasks().override(id, target.occurrenceStart)!!.status).isEqualTo(TaskStatus.NEEDS_ACTION)
+    }
+
+    @Test
+    fun completingANonRecurringTaskThroughTheInstancePathWritesTheRowItself() {
+        val id = source.insertTask(form(title = "Buy milk", due = now + 1.days))
+
+        source.setCompletedInstance(id, now, completed = true)
+
+        assertThat(db.tasks().overrides(id)).isEmpty()
+        assertThat(db.tasks().entity(id)!!.status).isEqualTo(TaskStatus.COMPLETED)
+    }
+
+    @Test
+    fun anOverrideReplacesOnlyItsOwnOccurrence() {
+        val id = source.insertTask(form(title = "Water the plants"))
+        makeRecurring(id, now)
+        // The list holds this series alone, so no filter is needed — and none can
+        // be written on taskId, since the override reports its own row id.
+        val before = source.tasks(TaskQuery(listId = listId))
+        val target = before.first { it.distanceFromCurrent == 1 }
+
+        source.updateInstance(id, target.occurrenceStart!!, form(title = "Water them twice"))
+
+        val after = source.tasks(TaskQuery(listId = listId))
+        assertThat(after).hasSize(before.size)
+        val edited = after.single { it.title == "Water them twice" }
+        assertThat(edited.occurrenceStart).isEqualTo(target.occurrenceStart)
+        assertThat(after.filter { it.occurrenceStart == target.occurrenceStart }).hasSize(1)
+    }
+
+    /**
+     * An edited occurrence addresses its own row, not the master's. That is what
+     * sends the *next* edit down `updateTask` rather than forking a second time:
+     * an override carries no rule, so it reads back as non-recurring.
+     */
+    @Test
+    fun anEditedOccurrenceReportsTheOverridesOwnId() {
+        val id = source.insertTask(form(title = "Water the plants"))
+        makeRecurring(id, now)
+        val target = source.tasks(TaskQuery(listId = listId)).first { it.distanceFromCurrent == 1 }
+
+        source.updateInstance(id, target.occurrenceStart!!, form(title = "Water them twice"))
+
+        val edited = source.tasks(TaskQuery(listId = listId)).single { it.title == "Water them twice" }
+        val overrideId = db.tasks().override(id, target.occurrenceStart)!!.id
+        assertThat(edited.taskId).isEqualTo(overrideId)
+        assertThat(edited.taskId).isNotEqualTo(id)
+        assertThat(source.task(overrideId)!!.isRecurring).isFalse()
+    }
+
+    @Test
+    fun editingASeriesDoesNotReAnchorItWhenOneOccurrenceIsEdited() {
+        val anchor = now
+        val id = source.insertTask(form())
+        makeRecurring(id, anchor)
+        val target = source.tasks(TaskQuery(listId = listId))
+            .filter { it.taskId == id }
+            .first { it.distanceFromCurrent == 2 }
+
+        source.updateInstance(id, target.occurrenceStart!!, form(due = now + 99.days))
+
+        assertThat(db.tasks().entity(id)!!.dtstart).isEqualTo(anchor)
+    }
+
+    @Test
+    fun updatingANonRecurringTaskWritesThroughToItsRow() {
+        val id = source.insertTask(form(title = "old"))
+
+        source.updateTask(id, form(title = "new"))
+
+        assertThat(source.task(id)!!.title).isEqualTo("new")
+    }
+
+    @Test
+    fun completionTogglesTheWholeTriple() {
+        val id = source.insertTask(form())
+
+        source.setCompleted(id, completed = true)
+        val done = db.tasks().entity(id)!!
+        assertThat(done.status).isEqualTo(TaskStatus.COMPLETED)
+        assertThat(done.percentComplete).isEqualTo(100)
+        assertThat(done.completedAt).isNotNull()
+
+        source.setCompleted(id, completed = false)
+        assertThat(db.tasks().entity(id)!!.completedAt).isNull()
+    }
+
+    @Test
+    fun completedTasksAreExcludedUnlessAskedFor() {
+        val id = source.insertTask(form())
+        source.setCompleted(id, completed = true)
+
+        assertThat(source.tasks(TaskQuery(listId = listId, includeCompleted = false))).isEmpty()
+        assertThat(source.tasks(TaskQuery(listId = listId, includeCompleted = true))).hasSize(1)
+    }
+
+    @Test
+    fun alarmsRoundTripAndReplaceRatherThanAccumulate() {
+        val id = source.insertTask(form(due = now + 1.days))
+
+        // The whole reminder, not just the minute count: collapsing it to a bare
+        // Int is what fired an imported START-referenced alarm off DUE, and an
+        // alarm this seam sets from the UI is always due-referenced.
+        source.setAlarm(id, 30)
+        assertThat(source.alarms()[id]).isEqualTo(TaskReminder(minutesBefore = 30))
+
+        source.setAlarm(id, 60)
+        assertThat(db.alarms().forTask(id)).hasSize(1)
+        assertThat(source.alarms()[id]).isEqualTo(TaskReminder(minutesBefore = 60))
+
+        source.setAlarm(id, null)
+        assertThat(source.alarms()).doesNotContainKey(id)
+    }
+
+    @Test
+    fun settingTheEditableReminderLeavesTheOthersAlone() {
+        val id = source.insertTask(form(due = now + 1.days))
+        val start = TaskReminder(minutesBefore = 10, fromStart = true)
+        source.setReminders(id, listOf(start, TaskReminder(30), TaskReminder(120)))
+
+        source.setAlarm(id, 45)
+        assertThat(source.reminders()[id]).containsExactly(start, TaskReminder(30), TaskReminder(45)).inOrder()
+        assertThat(source.alarms()[id]).isEqualTo(TaskReminder(45))
+
+        source.setAlarm(id, null)
+        assertThat(source.reminders()[id]).containsExactly(start, TaskReminder(30)).inOrder()
+        assertThat(source.alarms()[id]).isEqualTo(TaskReminder(30))
+    }
+
+    @Test
+    fun forkingAnOccurrenceCarriesTheReminderOntoIt() {
+        val id = source.insertTask(form(due = now + 1.days))
+        makeRecurring(id, now)
+        source.setAlarm(id, 30)
+        val target = source.tasks(TaskQuery(listId = listId))
+            .filter { it.taskId == id }
+            .first { it.distanceFromCurrent == 1 }
+
+        source.updateInstance(id, target.occurrenceStart!!, form())
+
+        val override = db.tasks().override(id, target.occurrenceStart)!!
+        assertThat(db.alarms().forTask(override.id).single().minutesBefore).isEqualTo(30)
+    }
+
+    @Test
+    fun deletingATaskInALocalListRemovesItOutright() {
+        val id = source.insertTask(form())
+
+        source.deleteTask(id)
+
+        // No account knows about it, so there is nothing to tombstone for.
+        assertThat(db.tasks().entity(id)).isNull()
+    }
+
+    @Test
+    fun deletingASeriesTakesItsOverridesWithIt() {
+        val id = source.insertTask(form())
+        makeRecurring(id, now)
+        val target = source.tasks(TaskQuery(listId = listId))
+            .filter { it.taskId == id }
+            .first { it.distanceFromCurrent == 1 }
+        source.updateInstance(id, target.occurrenceStart!!, form(title = "moved"))
+
+        source.deleteTask(id)
+
+        assertThat(db.tasks().allOverrides(listId)).isEmpty()
+    }
+
+    @Test
+    fun aForkedOccurrenceCarriesTheSeriesReminder() {
+        val id = source.insertTask(form())
+        makeRecurring(id, now)
+        source.setAlarm(id, minutesBeforeDue = 30)
+        val target = source.tasks(TaskQuery(listId = listId))
+            .filter { it.taskId == id }
+            .first { it.distanceFromCurrent == 1 }
+
+        source.updateInstance(id, target.occurrenceStart!!, form(title = "moved"))
+
+        // The fork copies the master's properties, which is what carries the
+        // reminder across — the repository is what puts the series' own back.
+        val override = db.tasks().override(id, target.occurrenceStart)!!
+        assertThat(db.alarms().forTask(override.id).single().minutesBefore).isEqualTo(30)
+    }
+
+    @Test
+    fun anOccurrenceCannotBeMovedOutOfItsSeriesList() {
+        val other = source.createLocalList("Work", 0)
+        val id = source.insertTask(form())
+        makeRecurring(id, now)
+        val target = source.tasks(TaskQuery(listId = listId))
+            .filter { it.taskId == id }
+            .first { it.distanceFromCurrent == 1 }
+        source.updateInstance(id, target.occurrenceStart!!, form(title = "moved"))
+        val override = db.tasks().override(id, target.occurrenceStart)!!
+
+        source.updateTask(override.id, TaskForm(title = "moved", listId = other))
+
+        // ⚠️ list_id = B with master_id in list A is invisible in both — the task
+        // query skips non-null master_id, and the override query finds no master
+        // in B — while still uploading as part of A's resource.
+        assertThat(db.tasks().entity(override.id)!!.listId).isEqualTo(listId)
+        assertThat(db.tasks().entity(override.id)!!.title).isEqualTo("moved")
+    }
+
+    @Test
+    fun deletingASyncedSeriesTombstonesItsOverridesToo() {
+        val syncedList = syncedList()
+        val id = source.insertTask(TaskForm(title = "Standup", listId = syncedList))
+        makeRecurring(id, now)
+        val target = source.tasks(TaskQuery(listId = syncedList))
+            .filter { it.taskId == id }
+            .first { it.distanceFromCurrent == 1 }
+        source.updateInstance(id, target.occurrenceStart!!, TaskForm(title = "moved", listId = syncedList))
+
+        source.deleteTask(id)
+
+        // ⚠️ master_id cascades on delete, and a tombstone deletes nothing — so
+        // a master marked alone left the resource reading as partly deleted, the
+        // DELETE was never sent, and the task stayed on the server for ever.
+        val rows = db.tasks().allIn(syncedList)
+        assertThat(rows).hasSize(2)
+        assertThat(rows.all { it.isDeleted && it.isDirty }).isTrue()
+    }
+
+    @Test
+    fun deletingOneOccurrenceExceptsItOnTheMaster() {
+        val id = source.insertTask(form())
+        makeRecurring(id, now)
+        val target = source.tasks(TaskQuery(listId = listId))
+            .filter { it.taskId == id }
+            .first { it.distanceFromCurrent == 1 }
+        source.updateInstance(id, target.occurrenceStart!!, form(title = "moved"))
+        val override = db.tasks().override(id, target.occurrenceStart)!!
+
+        source.deleteTask(override.id)
+
+        // ⚠️ Dropping the override row un-overrides the occurrence, and the
+        // master's RRULE regenerates it. The EXDATE is the deletion.
+        assertThat(db.tasks().entity(override.id)).isNull()
+        assertThat(db.tasks().entity(id)!!.exdate).isNotEmpty()
+        assertThat(source.tasks(TaskQuery(listId = listId)).map { it.occurrenceStart })
+            .doesNotContain(target.occurrenceStart)
+    }
+
+    @Test
+    fun subtasksReadBackUnderTheirParent() {
+        val parent = source.insertTask(form(title = "Prepare invoice"))
+        val child = source.insertTask(form(title = "Gather receipts").copy(parentId = parent))
+
+        assertThat(source.subtasks(parent).map { it.taskId }).containsExactly(child)
+    }
+
+    @Test
+    fun exportReadsMastersNotOccurrences() {
+        val id = source.insertTask(form(title = "Water the plants"))
+        makeRecurring(id, now)
+
+        val exported = source.exportTasks(listId)
+
+        // One row carrying the rule, not one row per occurrence with the rule lost.
+        assertThat(exported).hasSize(1)
+        assertThat(exported.single().rrule).isEqualTo("FREQ=WEEKLY")
+        assertThat(exported.single().uid).isNotEmpty()
+    }
+
+    @Test
+    fun insertingIntoAMissingListFails() {
+        val thrown = runCatching { source.insertTask(form().copy(listId = 9_999)) }.exceptionOrNull()
+
+        assertThat(thrown).isNotNull()
+    }
+}

app/src/androidTest/java/de/jeanlucmakiola/agendula/data/tasks/room/TasksDatabaseMigrationTest.kt

@@ -0,0 +1,68 @@
+package de.jeanlucmakiola.agendula.data.tasks.room
+
+import androidx.room.testing.MigrationTestHelper
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import com.google.common.truth.Truth.assertThat
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/**
+ * The migration harness, proven against the committed schema in `app/schemas/`.
+ *
+ * There is one schema version today, so all there is to assert is that the helper
+ * can build v1 from the exported JSON, seed it, and validate it back — i.e. the
+ * export, the assets wiring and the identity hash all line up. That is the point:
+ * the first real migration only has to add its own case.
+ *
+ * **Adding a v1 → v2 case.** When sync adds columns, bump [TasksDatabase]'s
+ * `version`, let KSP export `2.json`, declare the `Migration(1, 2)` next to the
+ * database, and add a test here shaped like this:
+ *
+ * ```
+ * helper.createDatabase(TEST_DB, 1).use { db ->
+ *     db.execSQL("INSERT INTO task_lists (name, color) VALUES ('Groceries', 0)")
+ * }
+ * helper.runMigrationsAndValidate(TEST_DB, 2, true, MIGRATION_1_2).use { db ->
+ *     // read the seeded rows back — validation proves the shape, not the data
+ * }
+ * ```
+ */
+@RunWith(AndroidJUnit4::class)
+class TasksDatabaseMigrationTest {
+
+    @get:Rule
+    val helper = MigrationTestHelper(
+        InstrumentationRegistry.getInstrumentation(),
+        TasksDatabase::class.java,
+    )
+
+    @Test
+    fun buildsV1FromTheExportedSchema() {
+        helper.createDatabase(TEST_DB, 1).use { db ->
+            db.execSQL("INSERT INTO task_lists (id, name, color) VALUES (1, 'Groceries', 0)")
+            db.execSQL("INSERT INTO tasks (id, list_id, uid, title) VALUES (1, 1, 'uid-1', 'Buy milk')")
+
+            db.query("SELECT title FROM tasks").use { cursor ->
+                assertThat(cursor.moveToFirst()).isTrue()
+                assertThat(cursor.getString(0)).isEqualTo("Buy milk")
+            }
+        }
+    }
+
+    @Test
+    fun validatesV1AgainstTheExportedSchema() {
+        helper.createDatabase(TEST_DB, 1).close()
+
+        // No migrations to run: v1 is opened and checked against 1.json, which is
+        // what proves the harness rather than the schema.
+        helper.runMigrationsAndValidate(TEST_DB, 1, true).use { db ->
+            assertThat(db.version).isEqualTo(1)
+        }
+    }
+
+    private companion object {
+        const val TEST_DB = "migration-test.db"
+    }
+}

app/src/androidTest/java/de/jeanlucmakiola/agendula/data/tasks/room/TasksDatabasePerformanceTest.kt

@@ -0,0 +1,107 @@
+package de.jeanlucmakiola.agendula.data.tasks.room
+
+import android.content.Context
+import androidx.room.Room
+import androidx.test.core.app.ApplicationProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.google.common.truth.Truth.assertThat
+import de.jeanlucmakiola.agendula.data.tasks.TaskQuery
+import de.jeanlucmakiola.agendula.domain.TaskForm
+import org.junit.After
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import java.io.File
+import kotlin.time.Clock
+import kotlin.time.Duration.Companion.days
+import kotlin.time.measureTime
+import kotlin.time.measureTimedValue
+
+/**
+ * The plan's shape at scale: 5,000 tasks with 20 recurring series, read the way a
+ * smart list reads them — one `tasks(TaskQuery(includeCompleted = true))`, which
+ * includes expanding every series in memory.
+ *
+ * The assertion is a deliberately loose ceiling, so it catches a real regression
+ * rather than CI jitter; the printed numbers are what the check is actually for.
+ */
+@RunWith(AndroidJUnit4::class)
+class TasksDatabasePerformanceTest {
+
+    private val context: Context = ApplicationProvider.getApplicationContext()
+
+    private lateinit var db: TasksDatabase
+    private lateinit var source: RoomTasksDataSource
+    private var listId = 0L
+
+    @Before
+    fun setUp() {
+        delete()
+        db = Room.databaseBuilder(context, TasksDatabase::class.java, DB)
+            .allowMainThreadQueries()
+            .build()
+        source = RoomTasksDataSource(db)
+        listId = source.createLocalList("Everything", 0xFF112233.toInt())
+    }
+
+    @After
+    fun tearDown() {
+        db.close()
+        delete()
+    }
+
+    @Test
+    fun readsFiveThousandTasksWithTwentySeriesInsideTheBudget() {
+        val seeded = measureTime { seed() }
+
+        // Discard the first read: it pays for statement compilation and page cache
+        // warming, which a running app has already paid.
+        source.tasks(TaskQuery(includeCompleted = true))
+        val (tasks, elapsed) = measureTimedValue {
+            source.tasks(TaskQuery(includeCompleted = true))
+        }
+
+        println(
+            "[perf] $TASK_COUNT tasks / $SERIES_COUNT series -> ${tasks.size} occurrences " +
+                "in $elapsed (seed $seeded)",
+        )
+        // Expansion is bounded twice over: the read window is 1 year back and 2
+        // forward, and each series stops at ExpansionWindow.maxOccurrences (500),
+        // so the occurrence count cannot grow with the age of the series.
+        assertThat(tasks.size).isAtLeast(TASK_COUNT)
+        assertThat(elapsed.inWholeMilliseconds).isLessThan(CEILING_MILLIS)
+    }
+
+    private fun seed() {
+        val anchor = Clock.System.now() - 30.days
+        val ids = ArrayList<Long>(TASK_COUNT)
+        db.runInTransaction {
+            repeat(TASK_COUNT) { index ->
+                ids += source.insertTask(
+                    TaskForm(title = "Task $index", listId = listId, due = anchor + index.days),
+                )
+            }
+        }
+        db.runInTransaction {
+            ids.take(SERIES_COUNT).forEach { id ->
+                val entity = db.tasks().entity(id)!!
+                db.tasks().update(
+                    entity.copy(dtstart = anchor, due = anchor + 1.days, rrule = "FREQ=DAILY"),
+                )
+            }
+        }
+    }
+
+    private fun delete() {
+        val base = context.getDatabasePath(DB)
+        base.delete()
+        listOf("-wal", "-shm").forEach { File(base.path + it).delete() }
+    }
+
+    private companion object {
+        const val DB = "performance-test.db"
+        const val TASK_COUNT = 5_000
+        const val SERIES_COUNT = 20
+        const val CEILING_MILLIS = 8_000L
+    }
+}

app/src/androidTest/java/de/jeanlucmakiola/agendula/data/tasks/room/TasksDatabaseRestoreTest.kt

@@ -0,0 +1,155 @@
+package de.jeanlucmakiola.agendula.data.tasks.room
+
+import android.content.Context
+import androidx.room.Room
+import androidx.test.core.app.ApplicationProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.google.common.truth.Truth.assertThat
+import de.jeanlucmakiola.agendula.data.tasks.TaskQuery
+import de.jeanlucmakiola.agendula.domain.TaskForm
+import org.junit.After
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import java.io.File
+
+/**
+ * The Auto Backup restore path, on disk.
+ *
+ * Auto Backup copies database files without checkpointing, and Room runs in WAL
+ * mode — so `.db` alone can be a *stale* copy of a database whose recent writes
+ * are still in the `-wal` sidecar. `res/xml/backup_rules.xml` carries all three
+ * files and [DatabaseCheckpoint] truncates the log on `ON_STOP`; this asserts
+ * that both of those actually do what they claim, and that neither alone is an
+ * assumption.
+ *
+ * A file copy of a live database stands in for the backup transport — the
+ * transport is what Auto Backup does to these files, and it is not what is under
+ * test here.
+ */
+@RunWith(AndroidJUnit4::class)
+class TasksDatabaseRestoreTest {
+
+    private val context: Context = ApplicationProvider.getApplicationContext()
+
+    private lateinit var db: TasksDatabase
+    private lateinit var source: RoomTasksDataSource
+    private var listId = 0L
+    private var restored: TasksDatabase? = null
+
+    @Before
+    fun setUp() {
+        delete(LIVE)
+        delete(BACKUP)
+        db = open(LIVE)
+        source = RoomTasksDataSource(db)
+        listId = source.createLocalList("Personal", 0xFF112233.toInt())
+    }
+
+    @After
+    fun tearDown() {
+        restored?.close()
+        db.close()
+        delete(LIVE)
+        delete(BACKUP)
+    }
+
+    @Test
+    fun roomRunsInWalMode() {
+        // Everything below is only interesting because of this.
+        assertThat(journalMode()).isEqualTo("wal")
+    }
+
+    @Test
+    fun aBackupOfTheDbFileAloneLosesWhateverIsStillInTheWal() {
+        write("checkpointed")
+        checkpoint()
+        write("only in the wal")
+
+        backUp(withSidecars = false)
+
+        assertThat(restore()).containsExactly("checkpointed")
+    }
+
+    @Test
+    fun aBackupThatCarriesTheSidecarsKeepsTheLastWrite() {
+        write("checkpointed")
+        checkpoint()
+        write("only in the wal")
+
+        backUp(withSidecars = true)
+
+        assertThat(restore()).containsExactly("checkpointed", "only in the wal")
+    }
+
+    @Test
+    fun checkpointingFirstMakesTheDbFileAloneEnough() {
+        write("checkpointed")
+        checkpoint()
+        write("last write")
+
+        // What DatabaseCheckpoint runs on ON_STOP — the fallback for a restore
+        // that arrives without the sidecars.
+        checkpoint()
+        backUp(withSidecars = false)
+
+        assertThat(restore()).containsExactly("checkpointed", "last write")
+    }
+
+    // --- the moving parts -----------------------------------------------------
+
+    private fun open(name: String): TasksDatabase =
+        Room.databaseBuilder(context, TasksDatabase::class.java, name)
+            .allowMainThreadQueries()
+            .build()
+
+    private fun write(title: String) {
+        source.insertTask(TaskForm(title = title, listId = listId))
+    }
+
+    private fun journalMode(): String =
+        db.openHelper.writableDatabase.query("PRAGMA journal_mode").use { cursor ->
+            cursor.moveToFirst()
+            cursor.getString(0).lowercase()
+        }
+
+    /** [DatabaseCheckpoint]'s pragma, asserting it was not blocked by a reader. */
+    private fun checkpoint() {
+        db.openHelper.writableDatabase.query("PRAGMA wal_checkpoint(TRUNCATE)").use { cursor ->
+            cursor.moveToFirst()
+            assertThat(cursor.getInt(0)).isEqualTo(0)
+        }
+    }
+
+    /** Copies the live database the way Auto Backup would: no checkpoint, files as they lie. */
+    private fun backUp(withSidecars: Boolean) {
+        delete(BACKUP)
+        val live = context.getDatabasePath(LIVE)
+        val backup = context.getDatabasePath(BACKUP)
+        live.copyTo(backup, overwrite = true)
+        if (!withSidecars) return
+        SIDECARS.forEach { suffix ->
+            val from = File(live.path + suffix)
+            if (from.exists()) from.copyTo(File(backup.path + suffix), overwrite = true)
+        }
+    }
+
+    /** Opens the copy as a fresh install would and reports the task titles that survived. */
+    private fun restore(): List<String> {
+        restored?.close()
+        val database = open(BACKUP).also { restored = it }
+        return RoomTasksDataSource(database).tasks(TaskQuery(includeCompleted = true)).map { it.title }
+    }
+
+    private fun delete(name: String) {
+        val base = context.getDatabasePath(name)
+        base.delete()
+        SIDECARS.forEach { File(base.path + it).delete() }
+    }
+
+    private companion object {
+        const val LIVE = "restore-live.db"
+        const val BACKUP = "restore-backup.db"
+        val SIDECARS = listOf("-wal", "-shm")
+    }
+}

app/src/androidTest/java/de/jeanlucmakiola/agendula/data/tasks/room/TasksDatabaseTest.kt

@@ -0,0 +1,274 @@
+package de.jeanlucmakiola.agendula.data.tasks.room
+
+import androidx.room.Room
+import androidx.test.core.app.ApplicationProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.google.common.truth.Truth.assertThat
+import de.jeanlucmakiola.agendula.domain.TaskStatus
+import org.junit.After
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import kotlin.time.Instant
+
+/**
+ * The schema, exercised through the DAOs. Instrumented rather than JVM because
+ * the app's unit tests are plain JUnit 5 with no Robolectric, and Room needs a
+ * real SQLite.
+ */
+@RunWith(AndroidJUnit4::class)
+class TasksDatabaseTest {
+
+    private lateinit var db: TasksDatabase
+    private lateinit var lists: TaskListDao
+    private lateinit var tasks: TaskDao
+    private lateinit var alarms: TaskAlarmDao
+    private lateinit var accounts: AccountDao
+
+    @Before
+    fun setUp() {
+        db = Room.inMemoryDatabaseBuilder(
+            ApplicationProvider.getApplicationContext(),
+            TasksDatabase::class.java,
+        ).allowMainThreadQueries().build()
+        lists = db.taskLists()
+        tasks = db.tasks()
+        alarms = db.alarms()
+        accounts = db.accounts()
+    }
+
+    @After
+    fun tearDown() = db.close()
+
+    private fun newList(name: String = "Groceries", accountId: Long? = null): Long =
+        lists.insert(TaskListEntity(name = name, color = 0xFF00FF00.toInt(), accountId = accountId))
+
+    private fun newTask(
+        listId: Long,
+        uid: String = "uid-${counter++}",
+        title: String? = "Buy milk",
+        status: TaskStatus = TaskStatus.NEEDS_ACTION,
+        parentId: Long? = null,
+        masterId: Long? = null,
+        recurrenceId: Instant? = null,
+    ): Long = tasks.insert(
+        TaskEntity(
+            listId = listId,
+            uid = uid,
+            title = title,
+            status = status,
+            parentId = parentId,
+            masterId = masterId,
+            recurrenceId = recurrenceId,
+        ),
+    )
+
+    @Test
+    fun writesAndReadsAListWithItsTasks() {
+        val accountId = accounts.insert(AccountEntity(displayName = "Fastmail"))
+        val listId = newList(accountId = accountId)
+        val due = Instant.fromEpochMilliseconds(1_700_000_000_000)
+        val taskId = tasks.insert(
+            TaskEntity(
+                listId = listId,
+                uid = "uid-1",
+                title = "Buy milk",
+                description = "2%",
+                due = due,
+                priority = 3,
+                status = TaskStatus.IN_PROCESS,
+                percentComplete = 40,
+            ),
+        )
+
+        val list = lists.lists().single()
+        assertThat(list.list.id).isEqualTo(listId)
+        assertThat(list.list.name).isEqualTo("Groceries")
+        assertThat(list.accountDisplayName).isEqualTo("Fastmail")
+
+        val row = tasks.task(taskId)!!
+        assertThat(row.task.title).isEqualTo("Buy milk")
+        assertThat(row.task.due).isEqualTo(due)
+        // Stored raw: an off-bucket PRIORITY must come back as it went in.
+        assertThat(row.task.priority).isEqualTo(3)
+        assertThat(row.task.status).isEqualTo(TaskStatus.IN_PROCESS)
+        assertThat(row.task.percentComplete).isEqualTo(40)
+        assertThat(row.listName).isEqualTo("Groceries")
+        assertThat(row.accountDisplayName).isEqualTo("Fastmail")
+    }
+
+    @Test
+    fun readsTasksOfOneListAndHidesClosedOnesUnlessAsked() {
+        val a = newList("A")
+        val b = newList("B")
+        newTask(a, title = "open")
+        newTask(a, title = "done", status = TaskStatus.COMPLETED)
+        newTask(a, title = "cancelled", status = TaskStatus.CANCELLED)
+        newTask(b, title = "elsewhere")
+
+        assertThat(tasks.tasks(a, includeCompleted = false).map { it.task.title })
+            .containsExactly("open")
+        assertThat(tasks.tasks(a, includeCompleted = true)).hasSize(3)
+        assertThat(tasks.tasks(null, includeCompleted = true)).hasSize(4)
+    }
+
+    @Test
+    fun readsSubtasksByParent() {
+        val listId = newList()
+        val parent = newTask(listId, title = "parent")
+        newTask(listId, title = "child", parentId = parent)
+
+        assertThat(tasks.subtasks(parent).map { it.task.title }).containsExactly("child")
+    }
+
+    @Test
+    fun hidesTombstonesFromReadsAndExports() {
+        val listId = newList()
+        val taskId = newTask(listId)
+        tasks.markDeleted(taskId, Instant.fromEpochMilliseconds(1))
+
+        assertThat(tasks.tasks(listId, includeCompleted = true)).isEmpty()
+        assertThat(tasks.task(taskId)).isNull()
+        assertThat(tasks.exportTasks(listId)).isEmpty()
+        assertThat(tasks.entity(taskId)).isNotNull()
+    }
+
+    @Test
+    fun keepsOverridesOutOfTheMasterReads() {
+        val listId = newList()
+        val master = newTask(listId, uid = "series")
+        val override = newTask(
+            listId,
+            uid = "series",
+            masterId = master,
+            recurrenceId = Instant.fromEpochMilliseconds(5_000),
+        )
+
+        assertThat(tasks.tasks(listId, includeCompleted = true).map { it.task.id })
+            .containsExactly(master)
+        assertThat(tasks.overrides(master).map { it.id }).containsExactly(override)
+        assertThat(tasks.allOverrides(listId).map { it.id }).containsExactly(override)
+        assertThat(tasks.override(master, Instant.fromEpochMilliseconds(5_000))?.id)
+            .isEqualTo(override)
+        assertThat(tasks.exportTasks(listId).map { it.id }).containsExactly(master)
+    }
+
+    // --- cascades -------------------------------------------------------------
+
+    @Test
+    fun deletingAListDeletesItsTasks() {
+        val listId = newList()
+        val taskId = newTask(listId)
+
+        lists.delete(listId)
+
+        assertThat(tasks.entity(taskId)).isNull()
+    }
+
+    @Test
+    fun deletingASeriesDeletesItsOverrides() {
+        val listId = newList()
+        val master = newTask(listId, uid = "series")
+        val override = newTask(
+            listId,
+            uid = "series",
+            masterId = master,
+            recurrenceId = Instant.fromEpochMilliseconds(5_000),
+        )
+
+        tasks.delete(master)
+
+        assertThat(tasks.entity(override)).isNull()
+    }
+
+    @Test
+    fun deletingAParentPromotesItsSubtasks() {
+        val listId = newList()
+        val parent = newTask(listId, title = "parent")
+        val child = newTask(listId, title = "child", parentId = parent)
+
+        tasks.delete(parent)
+
+        val promoted = tasks.entity(child)
+        assertThat(promoted).isNotNull()
+        assertThat(promoted!!.parentId).isNull()
+    }
+
+    @Test
+    fun deletingATaskDeletesItsAlarms() {
+        val listId = newList()
+        val taskId = newTask(listId)
+        alarms.replaceForTask(taskId, TaskAlarmEntity(taskId = taskId, minutesBefore = 15))
+        assertThat(alarms.all()).hasSize(1)
+
+        tasks.delete(taskId)
+
+        assertThat(alarms.all()).isEmpty()
+    }
+
+    @Test
+    fun deletingAnAccountDetachesItsListsInsteadOfDeletingThem() {
+        val accountId = accounts.insert(AccountEntity(displayName = "Fastmail"))
+        val listId = newList(accountId = accountId)
+
+        accounts.delete(accountId)
+
+        assertThat(lists.entity(listId)!!.accountId).isNull()
+    }
+
+    @Test
+    fun replacingAnAlarmLeavesOnlyTheNewOne() {
+        val listId = newList()
+        val taskId = newTask(listId)
+        alarms.replaceForTask(taskId, TaskAlarmEntity(taskId = taskId, minutesBefore = 15))
+        alarms.replaceForTask(taskId, TaskAlarmEntity(taskId = taskId, minutesBefore = 30))
+
+        assertThat(alarms.forTask(taskId).map { it.minutesBefore }).containsExactly(30)
+        assertThat(alarms.forTask(taskId).single().reference).isEqualTo(AlarmReference.DUE)
+
+        alarms.replaceForTask(taskId, null)
+        assertThat(alarms.forTask(taskId)).isEmpty()
+    }
+
+    // --- the unique index -----------------------------------------------------
+
+    @Test
+    fun anOverrideMayShareItsMastersUid() {
+        val listId = newList()
+        val master = newTask(listId, uid = "series")
+        newTask(listId, uid = "series", masterId = master, recurrenceId = Instant.fromEpochMilliseconds(1))
+        newTask(listId, uid = "series", masterId = master, recurrenceId = Instant.fromEpochMilliseconds(2))
+
+        assertThat(tasks.overrides(master)).hasSize(2)
+    }
+
+    @Test
+    fun rejectsTwoOverridesOfTheSameOccurrence() {
+        val listId = newList()
+        val master = newTask(listId, uid = "series")
+        val at = Instant.fromEpochMilliseconds(1)
+        newTask(listId, uid = "series", masterId = master, recurrenceId = at)
+
+        val failure = runCatching {
+            newTask(listId, uid = "series", masterId = master, recurrenceId = at)
+        }.exceptionOrNull()
+
+        assertThat(failure).isNotNull()
+        assertThat(failure!!.message).contains("UNIQUE")
+    }
+
+    @Test
+    fun theSameUidMayExistInAnotherList() {
+        val a = newList("A")
+        val b = newList("B")
+        newTask(a, uid = "shared")
+        newTask(b, uid = "shared")
+
+        assertThat(tasks.byUid(a, "shared")).isNotNull()
+        assertThat(tasks.byUid(b, "shared")).isNotNull()
+    }
+
+    private companion object {
+        var counter = 0
+    }
+}

app/src/androidTest/java/de/jeanlucmakiola/agendula/data/tasks/transfer/ExternalImportTest.kt

@@ -0,0 +1,324 @@
+package de.jeanlucmakiola.agendula.data.tasks.transfer
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.PreferenceDataStoreFactory
+import androidx.datastore.preferences.core.Preferences
+import androidx.room.Room
+import androidx.test.core.app.ApplicationProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.google.common.truth.Truth.assertThat
+import de.jeanlucmakiola.agendula.data.tasks.ProviderEnvironment
+import de.jeanlucmakiola.agendula.data.tasks.ProviderResolver
+import de.jeanlucmakiola.agendula.data.tasks.TaskQuery
+import de.jeanlucmakiola.agendula.data.tasks.TaskReminder
+import de.jeanlucmakiola.agendula.data.tasks.TasksDataSource
+import de.jeanlucmakiola.agendula.data.tasks.room.AlarmReference
+import de.jeanlucmakiola.agendula.data.tasks.room.TasksDatabase
+import de.jeanlucmakiola.agendula.domain.Priority
+import de.jeanlucmakiola.agendula.domain.Task
+import de.jeanlucmakiola.agendula.domain.TaskForm
+import de.jeanlucmakiola.agendula.domain.TaskList
+import de.jeanlucmakiola.agendula.domain.TaskStatus
+import de.jeanlucmakiola.agendula.domain.export.ExportTask
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.runBlocking
+import org.junit.After
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+import org.junit.rules.TemporaryFolder
+import org.junit.runner.RunWith
+import java.io.File
+import javax.inject.Provider
+import kotlin.time.Instant
+
+/**
+ * The copy out of an external provider and into Room — the upgrade path every
+ * released install actually needs, since no release ever bundled the provider
+ * `OneShotImport` reads.
+ *
+ * The source is a fake [TasksDataSource] rather than a live OpenTasks: what is
+ * worth testing is the write half — id remapping, uid collisions, verified
+ * counts, the once-only guard — and pinning that to a device with a third-party
+ * app installed would mean it never ran. Instrumented all the same, because the
+ * destination is a real Room database in a real transaction.
+ */
+@RunWith(AndroidJUnit4::class)
+class ExternalImportTest {
+
+    @get:Rule
+    val temp = TemporaryFolder()
+
+    private val context: Context = ApplicationProvider.getApplicationContext()
+    private lateinit var scope: CoroutineScope
+    private lateinit var prefs: DataStore<Preferences>
+    private lateinit var db: TasksDatabase
+    private lateinit var source: FakeExternalStore
+    private lateinit var importer: ExternalImport
+
+    @Before
+    fun setUp() {
+        scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+        prefs = PreferenceDataStoreFactory.create(scope = scope) {
+            temp.newFile("transfer-${counter++}.preferences_pb").also(File::delete)
+        }
+        db = Room.inMemoryDatabaseBuilder(context, TasksDatabase::class.java)
+            .allowMainThreadQueries()
+            .build()
+        source = FakeExternalStore()
+        importer = ExternalImport(
+            external = Provider { source },
+            resolver = ProviderResolver(NoProviderInstalled),
+            database = db,
+            dataStore = prefs,
+            io = Dispatchers.IO,
+        )
+    }
+
+    @After
+    fun tearDown() {
+        db.close()
+        scope.cancel()
+    }
+
+    @Test
+    fun copiesListsTasksAndAlarms() = runBlocking {
+        source.lists = listOf(list(7, "Errands"), list(9, "Work"))
+        source.tasks = mapOf(
+            7L to listOf(task(100, "Milk"), task(101, "Bread")),
+            9L to listOf(task(200, "Invoice")),
+        )
+        source.alarms = mapOf(100L to TaskReminder(minutesBefore = 30))
+
+        val result = importer.run()
+
+        assertThat(result).isEqualTo(
+            TransferResult.Copied(TransferCounts(lists = 2, tasks = 3, alarms = 1)),
+        )
+        assertThat(db.taskLists().lists().map { it.list.name })
+            .containsExactly("Errands", "Work")
+        assertThat(db.tasks().tasks(listId = null, includeCompleted = true).map { it.task.title })
+            .containsExactly("Milk", "Bread", "Invoice")
+        assertThat(importer.hasRun.first()).isTrue()
+    }
+
+    /** Every list arrives device-only: the account belongs to the sync app. */
+    @Test
+    fun importedListsAreDeviceOnly() = runBlocking {
+        source.lists = listOf(list(7, "Shared", accountName = "me@example.org"))
+        source.tasks = mapOf(7L to listOf(task(100, "Milk")))
+
+        importer.run()
+
+        assertThat(db.taskLists().lists().single().list.accountId).isNull()
+    }
+
+    /** Provider row ids are the source's; Room mints its own and the link follows. */
+    @Test
+    fun remapsParentIdsOntoTheNewRowIds() = runBlocking {
+        source.lists = listOf(list(7, "Errands"))
+        // Child before parent, so a naive single pass would not find the parent.
+        source.tasks = mapOf(
+            7L to listOf(task(100, "Subtask", parentId = 200), task(200, "Parent")),
+        )
+
+        importer.run()
+
+        val rows = db.tasks().tasks(listId = null, includeCompleted = true).map { it.task }
+        val parent = rows.single { it.title == "Parent" }
+        val child = rows.single { it.title == "Subtask" }
+        assertThat(child.parentId).isEqualTo(parent.id)
+        assertThat(child.parentId).isNotEqualTo(200L)
+    }
+
+    /**
+     * A `RECURRENCE-ID` override reaches the read seam as another master-shaped row
+     * sharing its series' uid. The unique index on (list, uid, recurrence_id)
+     * would reject it and take the whole copy down, so it gets a fresh uid.
+     */
+    @Test
+    fun aDuplicateUidDoesNotAbortTheCopy() = runBlocking {
+        source.lists = listOf(list(7, "Errands"))
+        source.tasks = mapOf(
+            7L to listOf(
+                task(100, "Weekly", uid = "shared-uid"),
+                task(101, "Weekly, that one week", uid = "shared-uid"),
+            ),
+        )
+
+        val result = importer.run()
+
+        assertThat(result).isInstanceOf(TransferResult.Copied::class.java)
+        val uids = db.tasks().tasks(listId = null, includeCompleted = true).map { it.task.uid }
+        assertThat(uids).hasSize(2)
+        assertThat(uids.toSet()).hasSize(2)
+        assertThat(uids).contains("shared-uid")
+    }
+
+    /** A START-referenced reminder must not come across as a before-due one. */
+    @Test
+    fun preservesTheAlarmReference() = runBlocking {
+        source.lists = listOf(list(7, "Errands"))
+        source.tasks = mapOf(7L to listOf(task(100, "Standup")))
+        source.alarms = mapOf(100L to TaskReminder(minutesBefore = 10, fromStart = true))
+
+        importer.run()
+
+        val alarm = db.alarms().all().single()
+        assertThat(alarm.reference).isEqualTo(AlarmReference.START)
+        assertThat(alarm.minutesBefore).isEqualTo(10)
+    }
+
+    @Test
+    fun anEmptySourceWritesNothingAndIsNotMarkedDone() = runBlocking {
+        val result = importer.run()
+
+        assertThat(result).isEqualTo(TransferResult.NothingToCopy)
+        assertThat(db.taskLists().lists()).isEmpty()
+        // Still on offer: there was nothing to copy, not a copy that happened.
+        assertThat(importer.hasRun.first()).isFalse()
+    }
+
+    /** A read that blows up must leave Room exactly as it was. */
+    @Test
+    fun aFailedReadRollsBackAndLeavesTheGuardOpen() = runBlocking {
+        source.lists = listOf(list(7, "Errands"))
+        source.failOnExport = true
+
+        val result = importer.run()
+
+        assertThat(result).isInstanceOf(TransferResult.Failed::class.java)
+        assertThat(db.taskLists().lists()).isEmpty()
+        assertThat(importer.hasRun.first()).isFalse()
+    }
+
+    @Test
+    fun previewCountsWhatARunWouldWrite() = runBlocking {
+        source.lists = listOf(list(7, "Errands"), list(9, "Work"))
+        source.tasks = mapOf(
+            7L to listOf(task(100, "Milk"), task(101, "Bread")),
+            9L to listOf(task(200, "Invoice")),
+        )
+        source.alarms = mapOf(100L to TaskReminder(minutesBefore = 30))
+        // preview() resolves the provider itself, so it needs one to be installed.
+        val withProvider = ExternalImport(
+            external = Provider { source },
+            resolver = ProviderResolver(OpenTasksInstalledAndGranted),
+            database = db,
+            dataStore = prefs,
+            io = Dispatchers.IO,
+        )
+
+        assertThat(withProvider.preview())
+            .isEqualTo(TransferCounts(lists = 2, tasks = 3, alarms = 1))
+    }
+
+    @Test
+    fun previewIsNullWithoutAReadableProvider() = runBlocking {
+        assertThat(importer.preview()).isNull()
+    }
+
+    // --- fixtures --------------------------------------------------------------
+
+    private fun list(id: Long, name: String, accountName: String = "Device") = TaskList(
+        id = id,
+        name = name,
+        color = 0xFF7E57C2.toInt(),
+        accountName = accountName,
+        accountType = "org.dmfs.account.LOCAL",
+        isSynced = true,
+        isVisible = true,
+        owner = null,
+    )
+
+    private fun task(
+        id: Long,
+        title: String,
+        uid: String? = "uid-$id",
+        parentId: Long? = null,
+    ) = ExportTask(
+        taskId = id,
+        uid = uid,
+        title = title,
+        description = null,
+        location = null,
+        url = null,
+        priority = Priority.NONE,
+        status = TaskStatus.NEEDS_ACTION,
+        percentComplete = null,
+        start = null,
+        due = Instant.fromEpochMilliseconds(1_800_000_000_000),
+        isAllDay = false,
+        completedAt = null,
+        created = null,
+        lastModified = null,
+        rrule = null,
+        rdate = null,
+        parentId = parentId,
+    )
+
+    private companion object {
+        var counter = 0
+    }
+}
+
+/** Only the three reads the copy makes; everything else is out of scope. */
+private class FakeExternalStore : TasksDataSource {
+    var lists: List<TaskList> = emptyList()
+    var tasks: Map<Long, List<ExportTask>> = emptyMap()
+    var alarms: Map<Long, TaskReminder> = emptyMap()
+    var failOnExport = false
+
+    override fun taskLists(): List<TaskList> = lists
+
+    override fun exportTasks(listId: Long): List<ExportTask> {
+        if (failOnExport) error("provider went away mid-read")
+        return tasks[listId].orEmpty()
+    }
+
+    override fun alarms(): Map<Long, TaskReminder> = alarms
+
+    override fun tasks(query: TaskQuery): List<Task> = unused()
+    override fun task(taskId: Long): Task? = unused()
+    override fun subtasks(parentTaskId: Long): List<Task> = unused()
+    override fun insertTask(form: TaskForm): Long = unused()
+    override fun updateTask(taskId: Long, form: TaskForm) = unused()
+    override fun updateInstance(taskId: Long, occurrenceStart: Instant, form: TaskForm) = unused()
+    override fun setAlarm(taskId: Long, minutesBeforeDue: Int?) = unused()
+    override fun setReminders(taskId: Long, reminders: List<TaskReminder>) = unused()
+    override fun setCompleted(taskId: Long, completed: Boolean) = unused()
+    override fun setCompletedInstance(taskId: Long, occurrenceStart: Instant, completed: Boolean) = unused()
+    override fun deleteTask(taskId: Long) = unused()
+    override fun setCancelled(taskId: Long, cancelled: Boolean) = unused()
+    override fun setCancelledInstance(taskId: Long, occurrenceStart: Instant, cancelled: Boolean) = unused()
+    override fun updateSeries(seriesId: Long, occurrenceStart: Instant, form: TaskForm) = unused()
+    override fun splitSeries(seriesId: Long, occurrenceStart: Instant, form: TaskForm): Long = unused()
+    override fun deleteOccurrence(seriesId: Long, occurrenceStart: Instant) = unused()
+    override fun deleteFollowing(seriesId: Long, occurrenceStart: Instant) = unused()
+    override fun createLocalList(name: String, color: Int): Long = unused()
+    override fun updateList(listId: Long, name: String, color: Int) = unused()
+    override fun deleteList(listId: Long) = unused()
+    override fun registerObserver(onChange: () -> Unit): AutoCloseable = unused()
+
+    private fun unused(): Nothing = error("the copy does not call this")
+}
+
+/** No tasks provider on the device: `preview()` has nothing to read. */
+private object NoProviderInstalled : ProviderEnvironment {
+    override fun packageDeclaring(authority: String): String? = null
+    override fun isGranted(permission: String): Boolean = false
+    override fun appLabel(packageName: String): String? = null
+}
+
+private object OpenTasksInstalledAndGranted : ProviderEnvironment {
+    override fun packageDeclaring(authority: String): String? =
+        "org.dmfs.tasks".takeIf { authority == "org.dmfs.tasks" }
+
+    override fun isGranted(permission: String): Boolean = permission.startsWith("org.dmfs.permission.")
+    override fun appLabel(packageName: String): String = "OpenTasks"
+}

app/src/androidTestFull/java/de/jeanlucmakiola/agendula/data/sync/CredentialStoreTest.kt

@@ -0,0 +1,123 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.preferencesDataStoreFile
+import androidx.datastore.preferences.core.PreferenceDataStoreFactory
+import androidx.test.core.app.ApplicationProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.google.common.truth.Truth.assertThat
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.test.runTest
+import org.junit.After
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+import org.junit.rules.TestName
+import org.junit.runner.RunWith
+
+/**
+ * The credential store, against a real Keystore.
+ *
+ * Instrumented rather than Robolectric because the thing under test *is* the
+ * platform: a shadowed Keystore would encrypt and decrypt happily and prove
+ * nothing about whether the key spec is usable for background sync.
+ *
+ * The case that matters most is the last one. A restored backup carries the
+ * ciphertext but not the key — Keystore keys are non-exportable — so the blob
+ * becomes permanently undecryptable. That must surface as "sign in again", never
+ * as a crash and never as a silently non-syncing account, which is why
+ * `backup_rules.xml` excludes this file in the first place.
+ */
+@RunWith(AndroidJUnit4::class)
+class CredentialStoreTest {
+
+    @get:Rule val testName = TestName()
+
+    private lateinit var scope: CoroutineScope
+    private lateinit var dataStore: DataStore<Preferences>
+    private lateinit var store: CredentialStore
+
+    private val context: Context get() = ApplicationProvider.getApplicationContext()
+
+    @Before
+    fun setUp() {
+        // ⚠️ A file per test, and a scope we can cancel. DataStore's FileStorage
+        // keeps a process-wide set of active files and refuses a second
+        // connection to one ("There are multiple DataStores active for the same
+        // file"); the entry is released only when the owning scope's job
+        // completes, and the factory's default scope is never cancelled. Sharing
+        // one file across methods therefore fails every test after the first.
+        scope = CoroutineScope(Dispatchers.IO + SupervisorJob())
+        dataStore = PreferenceDataStoreFactory.create(scope = scope) {
+            context.preferencesDataStoreFile("credential_store_test_${testName.methodName}")
+        }
+        store = CredentialStore(dataStore)
+    }
+
+    @After
+    fun tearDown() {
+        runTest { store.clearAll() }
+        scope.cancel()
+        context.preferencesDataStoreFile("credential_store_test_${testName.methodName}").delete()
+    }
+
+    @Test
+    fun anAppPasswordRoundTrips() = runTest {
+        assertThat(store.put(accountId = 1L, appPassword = "s3cret-app-pw")).isTrue()
+        assertThat(store.get(1L)).isEqualTo(CredentialStore.Secret.Present("s3cret-app-pw"))
+    }
+
+    @Test
+    fun aNonLatin1PasswordSurvives() = runTest {
+        // The same charset trap the Basic interceptor has: anything that silently
+        // mangles "ä" produces a 401 the user reads as a wrong password.
+        store.put(accountId = 1L, appPassword = "p䧧wörd-🔐")
+        assertThat(store.get(1L)).isEqualTo(CredentialStore.Secret.Present("p䧧wörd-🔐"))
+    }
+
+    @Test
+    fun accountsDoNotShareACredential() = runTest {
+        store.put(1L, "first")
+        store.put(2L, "second")
+        assertThat(store.get(1L)).isEqualTo(CredentialStore.Secret.Present("first"))
+        assertThat(store.get(2L)).isEqualTo(CredentialStore.Secret.Present("second"))
+    }
+
+    @Test
+    fun anUnknownAccountIsAbsentRatherThanAnError() = runTest {
+        assertThat(store.get(99L)).isEqualTo(CredentialStore.Secret.Absent)
+    }
+
+    @Test
+    fun clearingRemovesOnlyThatAccount() = runTest {
+        store.put(1L, "first")
+        store.put(2L, "second")
+        store.clear(1L)
+        assertThat(store.get(1L)).isEqualTo(CredentialStore.Secret.Absent)
+        assertThat(store.get(2L)).isEqualTo(CredentialStore.Secret.Present("second"))
+    }
+
+    @Test
+    fun aCiphertextThisDeviceCannotDecryptMeansReAuthenticate() = runTest {
+        // Stands in for the restored-backup case: the blob is present and
+        // well-formed Base64, but was not produced by this device's key.
+        dataStore.edit {
+            it[stringPreferencesKey("caldav_app_password_1")] =
+                "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        }
+        assertThat(store.get(1L)).isInstanceOf(CredentialStore.Secret.Unrecoverable::class.java)
+    }
+
+    @Test
+    fun aBlobThatIsNotBase64AtAllIsAlsoRecoverable() = runTest {
+        dataStore.edit { it[stringPreferencesKey("caldav_app_password_1")] = "not base64 !!" }
+        assertThat(store.get(1L)).isInstanceOf(CredentialStore.Secret.Unrecoverable::class.java)
+    }
+}

app/src/androidTestFull/java/de/jeanlucmakiola/agendula/data/sync/SyncContractTest.kt

@@ -0,0 +1,44 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import android.content.Context
+import androidx.test.core.app.ApplicationProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.google.common.truth.Truth.assertThat
+import de.jeanlucmakiola.agendula.R
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/**
+ * The account type and authority exist in two places that cannot see each other:
+ * `SyncContract`, derived from `BuildConfig.APPLICATION_ID`, and the `resValue`
+ * strings the XML descriptors read. Drift between them is invisible at build
+ * time and shows up as an account the sync framework will not trigger — the
+ * silent no-op, with nothing in the log.
+ */
+@RunWith(AndroidJUnit4::class)
+class SyncContractTest {
+
+    private val context: Context get() = ApplicationProvider.getApplicationContext()
+
+    @Test
+    fun theAccountTypeMatchesTheAuthenticatorDescriptor() {
+        assertThat(SyncContract.ACCOUNT_TYPE)
+            .isEqualTo(context.getString(R.string.account_type))
+    }
+
+    @Test
+    fun theAuthorityMatchesTheSyncAdapterDescriptor() {
+        assertThat(SyncContract.AUTHORITY)
+            .isEqualTo(context.getString(R.string.sync_authority))
+    }
+
+    @Test
+    fun theAuthorityMatchesTheStubProviderInTheManifest() {
+        // The provider is what makes the authority real; a mismatch here means
+        // requestSync addresses nothing.
+        val provider = context.packageManager
+            .resolveContentProvider(SyncContract.AUTHORITY, 0)
+        assertThat(provider).isNotNull()
+        assertThat(provider!!.name).isEqualTo(SyncStubProvider::class.java.name)
+    }
+}

app/src/debug/java/de/jeanlucmakiola/agendula/data/demo/DemoSeedModule.kt

@@ -0,0 +1,20 @@
+package de.jeanlucmakiola.agendula.data.demo
+
+import dagger.Module
+import dagger.Provides
+import dagger.hilt.InstallIn
+import dagger.hilt.components.SingletonComponent
+import dagger.multibindings.IntoSet
+import de.jeanlucmakiola.agendula.data.di.LaunchHook
+import javax.inject.Provider
+
+/** Sample data on `am start … --ez agendula_seed true`; debug builds only. */
+@Module
+@InstallIn(SingletonComponent::class)
+object DemoSeedModule {
+    @Provides
+    @IntoSet
+    fun demoSeedHook(seeder: Provider<DemoSeeder>): LaunchHook = LaunchHook { intent ->
+        if (intent.getBooleanExtra("agendula_seed", false)) seeder.get().seed()
+    }
+}

app/src/debug/java/de/jeanlucmakiola/agendula/data/demo/DemoSeeder.kt

@@ -1,10 +1,10 @@
-package de.jeanlucmakiola.floret.data.demo
+package de.jeanlucmakiola.agendula.data.demo
 
-import de.jeanlucmakiola.floret.data.di.IoDispatcher
-import de.jeanlucmakiola.floret.data.tasks.TasksRepository
-import de.jeanlucmakiola.floret.domain.DayWindow
-import de.jeanlucmakiola.floret.domain.Priority
-import de.jeanlucmakiola.floret.domain.TaskForm
+import de.jeanlucmakiola.agendula.data.di.IoDispatcher
+import de.jeanlucmakiola.agendula.data.tasks.TasksRepository
+import de.jeanlucmakiola.floret.time.DayWindow
+import de.jeanlucmakiola.agendula.domain.Priority
+import de.jeanlucmakiola.agendula.domain.TaskForm
 import kotlinx.coroutines.CoroutineDispatcher
 import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.withContext
@@ -16,10 +16,10 @@ import kotlin.time.Instant
 
 /**
  * Debug-only one-shot sample data. Creates a **local, device-only** list
- * ("Floret Demo") — so nothing syncs to a CalDAV server — and fills it with
+ * ("Agendula Demo") — so nothing syncs to a CalDAV server — and fills it with
  * tasks spread across overdue / today / upcoming / no-date / completed so every
  * smart list shows content. Idempotent: skips if the demo list already exists.
- * Triggered from [de.jeanlucmakiola.floret.MainActivity] only in debug builds.
+ * Triggered from [de.jeanlucmakiola.agendula.MainActivity] only in debug builds.
  */
 @Singleton
 class DemoSeeder @Inject constructor(
@@ -47,14 +47,14 @@ class DemoSeeder @Inject constructor(
         repository.createTask(TaskForm(title = "Gather receipts", listId = listId, parentId = invoiceId))
         repository.createTask(TaskForm(title = "Book train tickets", listId = listId, due = at(te + 6 * day), priority = Priority.LOW))
         repository.createTask(TaskForm(title = "Read Compose 1.5 release notes", listId = listId))
-        repository.createTask(TaskForm(title = "Sketch the Floret app icon", listId = listId))
+        repository.createTask(TaskForm(title = "Sketch the Agendula app icon", listId = listId))
 
         val done = repository.createTask(TaskForm(title = "Renew domain name", listId = listId, due = at(ts - 2 * day)))
-        repository.setCompleted(done, completed = true)
+        repository.setCompleted(done, occurrenceStart = null, completed = true)
     }
 
     private companion object {
-        const val DEMO_LIST = "Floret Demo"
+        const val DEMO_LIST = "Agendula Demo"
         const val DEMO_COLOR = 0xFF7A5C6B.toInt()
     }
 }

app/src/full/AndroidManifest.xml

@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- CalDAV sync and UnifiedPush; everything here needs the network. -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <!-- CalDAV sync. ACCESS_NETWORK_STATE is merged in by work-runtime anyway,
+         but it shows in F-Droid's permission diff, so declare it deliberately
+         rather than letting it appear from nowhere.
+
+         READ_SYNC_SETTINGS / WRITE_SYNC_SETTINGS are what the ContentResolver
+         sync APIs need. No FOREGROUND_SERVICE: sync is a plain worker, and the
+         dataSync FGS type would bring the Android 15 six-hours-per-24 budget
+         (whose failure mode is a fatal RemoteServiceException) and a Play
+         requirement for a video demo.
+
+         Two more permissions appear in the merged manifest without being
+         declared here, and both come from work-runtime: WAKE_LOCK, and
+         FOREGROUND_SERVICE. The latter is not us taking the FGS route — below
+         API 31 WorkManager implements expedited work with a foreground service,
+         and minSdk is 29, so it is load-bearing for the "Sync now" button.
+         Removing it with tools:node="remove" would break expedited work on
+         exactly the older devices that need it most. Noted because it shows in
+         F-Droid's permission diff and would otherwise look unexplained. -->
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.READ_SYNC_SETTINGS" />
+    <uses-permission android:name="android.permission.WRITE_SYNC_SETTINGS" />
+
+    <queries>
+        <!-- Custom Tabs provider detection. Without this entry it silently finds
+             nothing on API 30+, and the Nextcloud login flow falls back to an
+             external browser for no visible reason. -->
+        <intent>
+            <action android:name="android.support.customtabs.action.CustomTabsService" />
+        </intent>
+    </queries>
+
+    <application android:networkSecurityConfig="@xml/network_security_config">
+
+        <!-- Sync plumbing. The stub provider exists only to give the sync
+             adapter an authority to register against: Agendula publishes no real
+             ContentProvider since :provider was deleted, and without an authority
+             ContentService.hasAuthorityAccess() makes every ContentResolver sync
+             call a silent no-op at targetSdk >= 34. -->
+        <provider
+            android:name=".data.sync.SyncStubProvider"
+            android:authorities="${applicationId}.sync"
+            android:exported="false"
+            android:syncable="true" />
+
+        <!-- Exported and guarded by ACCOUNT_MANAGER. Note that
+             android.permission.ACCOUNT_AUTHENTICATOR does not exist. -->
+        <service
+            android:name=".data.sync.AuthenticatorService"
+            android:exported="true"
+            android:permission="android.permission.ACCOUNT_MANAGER">
+            <intent-filter>
+                <action android:name="android.accounts.AccountAuthenticator" />
+            </intent-filter>
+            <meta-data
+                android:name="android.accounts.AccountAuthenticator"
+                android:resource="@xml/authenticator" />
+        </service>
+
+        <service
+            android:name=".data.sync.SyncAdapterService"
+            android:exported="true"
+            android:permission="android.permission.BIND_SYNC_ADAPTER">
+            <intent-filter>
+                <action android:name="android.content.SyncAdapter" />
+            </intent-filter>
+            <meta-data
+                android:name="android.content.SyncAdapter"
+                android:resource="@xml/sync_adapter" />
+        </service>
+
+        <!-- UnifiedPush: the connector binds this to deliver endpoints and
+             WebDAV-Push messages. Not exported; the connector's own receiver is
+             what distributors talk to. -->
+        <service
+            android:name=".data.sync.push.AgendulaPushService"
+            android:exported="false">
+            <intent-filter>
+                <action android:name="org.unifiedpush.android.connector.PUSH_EVENT" />
+            </intent-filter>
+        </service>
+    </application>
+
+</manifest>

app/src/full/java/de/jeanlucmakiola/agendula/data/di/SyncModule.kt

@@ -0,0 +1,131 @@
+package de.jeanlucmakiola.agendula.data.di
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.preferencesDataStore
+import dagger.Binds
+import dagger.Module
+import dagger.Provides
+import dagger.hilt.InstallIn
+import dagger.hilt.android.qualifiers.ApplicationContext
+import dagger.hilt.components.SingletonComponent
+import dagger.multibindings.IntoSet
+import de.jeanlucmakiola.agendula.data.sync.AccountCreator
+import de.jeanlucmakiola.agendula.data.sync.AccountRepository
+import de.jeanlucmakiola.agendula.data.sync.CalDavGateway
+import de.jeanlucmakiola.agendula.data.sync.LoginFlowRecord
+import de.jeanlucmakiola.agendula.data.sync.OkHttpCalDavGateway
+import de.jeanlucmakiola.agendula.data.sync.PendingLoginFlowStore
+import de.jeanlucmakiola.agendula.data.sync.RemoteListRepository
+import de.jeanlucmakiola.agendula.data.sync.RemoteLists
+import de.jeanlucmakiola.agendula.data.sync.SyncNoticeNotifier
+import de.jeanlucmakiola.agendula.data.sync.SyncOnEdit
+import de.jeanlucmakiola.agendula.data.sync.SyncRequests
+import de.jeanlucmakiola.agendula.data.sync.SyncTrigger
+import de.jeanlucmakiola.agendula.data.sync.push.PushRegistrar
+import de.jeanlucmakiola.agendula.data.tasks.room.LocalWriteListener
+import javax.inject.Provider
+import javax.inject.Singleton
+
+/** See [CredentialsDataStore] for why this is a separate file. */
+private val Context.credentialsDataStore: DataStore<Preferences> by preferencesDataStore(
+    name = CREDENTIALS_DATASTORE,
+    corruptionHandler = replaceCorrupted(),
+)
+
+/** See [SyncStateDataStore] for why this is a separate file. */
+private val Context.syncStateDataStore: DataStore<Preferences> by preferencesDataStore(
+    name = SYNC_STATE_DATASTORE,
+    corruptionHandler = replaceCorrupted(),
+)
+
+/**
+ * Named here and in `backup_rules.xml` / `data_extraction_rules.xml`, which
+ * exclude `datastore/$CREDENTIALS_DATASTORE.preferences_pb` by this name.
+ */
+const val CREDENTIALS_DATASTORE = "agendula_credentials"
+
+/**
+ * Named here and in `backup_rules.xml` / `data_extraction_rules.xml`, which
+ * exclude `datastore/$SYNC_STATE_DATASTORE.preferences_pb` by this name.
+ */
+const val SYNC_STATE_DATASTORE = "agendula_sync_state"
+
+/** CalDAV sync: the `full` flavor's side of the seams `main` declares. */
+@Module
+@InstallIn(SingletonComponent::class)
+abstract class SyncBindModule {
+
+    @Binds
+    @Singleton
+    abstract fun bindCalDavGateway(impl: OkHttpCalDavGateway): CalDavGateway
+
+    @Binds
+    @Singleton
+    abstract fun bindAccountCreator(impl: AccountRepository): AccountCreator
+
+    @Binds
+    @Singleton
+    abstract fun bindLoginFlowRecord(impl: PendingLoginFlowStore): LoginFlowRecord
+
+    @Binds
+    @Singleton
+    abstract fun bindLocalWriteListener(impl: SyncOnEdit): LocalWriteListener
+
+    @Binds
+    @Singleton
+    abstract fun bindRemoteLists(impl: RemoteListRepository): RemoteLists
+
+    @Binds
+    @Singleton
+    abstract fun bindSyncRequests(impl: SyncTrigger): SyncRequests
+
+    @Binds
+    @IntoSet
+    abstract fun bindSyncNoticeChannel(impl: SyncNoticeNotifier): ChannelRefresher
+}
+
+@Module
+@InstallIn(SingletonComponent::class)
+object SyncProvideModule {
+
+    @Provides
+    @Singleton
+    @CredentialsDataStore
+    fun provideCredentialsDataStore(@ApplicationContext context: Context): DataStore<Preferences> =
+        context.credentialsDataStore
+
+    @Provides
+    @Singleton
+    @SyncStateDataStore
+    fun provideSyncStateDataStore(@ApplicationContext context: Context): DataStore<Preferences> =
+        context.syncStateDataStore
+
+    /**
+     * Sync hard on app open: the periodic worker's interval is a floor, and in
+     * the `rare` and `restricted` App Standby buckets it may not have run at
+     * all. `KEEP` makes rescheduling idempotent, so this also repairs a schedule
+     * lost to "clear app data" or to a restore.
+     */
+    @Provides
+    @IntoSet
+    fun syncOnOpenHook(
+        accounts: Provider<AccountRepository>,
+        syncTrigger: Provider<SyncTrigger>,
+        pendingLoginFlows: Provider<PendingLoginFlowStore>,
+        push: Provider<PushRegistrar>,
+    ): LaunchHook = LaunchHook {
+        runCatching {
+            accounts.get().rescheduleAll()
+            accounts.get().syncable().forEach { syncTrigger.get().enqueue(it.displayName) }
+            // A login flow the previous process died in the middle of.
+            // Its password, if the user approved, exists nowhere else.
+            pendingLoginFlows.get().reclaim()
+        }
+        // Last and on its own: it waits on the network, and must not hold up
+        // the reclaim above. Re-registering on open is what the connector
+        // recommends.
+        runCatching { push.get().updateAll() }
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/di/SyncQualifiers.kt

@@ -0,0 +1,34 @@
+package de.jeanlucmakiola.agendula.data.di
+
+import javax.inject.Qualifier
+
+/**
+ * Marks the DataStore holding **only** the Keystore-encrypted app passwords.
+ *
+ * A separate file from `agendula_prefs` on purpose: Auto Backup includes
+ * `datastore/`, and a restored ciphertext is permanently undecryptable because
+ * Keystore keys are non-exportable. Its own file is what lets the backup rules
+ * exclude the credentials and nothing else — excluding the whole database or
+ * all of DataStore would trade a latent bug for a live one.
+ */
+@Qualifier
+@Retention(AnnotationRetention.BINARY)
+annotation class CredentialsDataStore
+
+/**
+ * Marks the DataStore holding per-device **sync bookkeeping** — the quarantine
+ * counters and the full-reconciliation clock.
+ *
+ * Its own file for the same reason the credentials have one: Auto Backup
+ * includes `datastore/`, and every value in here is a statement about *this*
+ * device's conversation with a server. Restored onto a new install they are all
+ * lies, and two of them are dangerous — a restored "reconciled recently" makes
+ * the engine trust a sync token for another day, which is precisely the silently
+ * pruned change log the full path exists to catch, and a restored quarantine
+ * count silently skips resources that were never tried here.
+ *
+ * Not user data, so nothing is lost by excluding it.
+ */
+@Qualifier
+@Retention(AnnotationRetention.BINARY)
+annotation class SyncStateDataStore

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/AccountRepository.kt

@@ -0,0 +1,604 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import de.jeanlucmakiola.agendula.data.di.IoDispatcher
+import de.jeanlucmakiola.agendula.data.sync.push.PushRegistrar
+import de.jeanlucmakiola.agendula.data.prefs.SettingsPrefs
+import de.jeanlucmakiola.agendula.data.tasks.room.AccountEntity
+import de.jeanlucmakiola.agendula.data.tasks.room.TaskListEntity
+import de.jeanlucmakiola.agendula.data.tasks.room.TasksDatabase
+import de.jeanlucmakiola.caldav.CalDavDiscovery
+import de.jeanlucmakiola.caldav.TaskCollection
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.NonCancellable
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.withContext
+import okhttp3.HttpUrl
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * The one thing the sign-in flow needs from [AccountRepository].
+ *
+ * A seam, so the flow's state machine can be tested without a database, a
+ * Keystore or an `AccountManager` — the three things that make the rest of this
+ * class Android-only.
+ */
+interface AccountCreator {
+    suspend fun create(
+        displayName: String,
+        username: String,
+        appPassword: String,
+        found: CalDavDiscovery.Outcome.Found,
+        selected: Set<TaskCollection>,
+        /** An existing account to sign in again, instead of creating one. */
+        reauthenticating: Long? = null,
+    ): AccountRepository.Outcome
+}
+
+/**
+ * Turns a finished sign-in into an account that exists in all three places it
+ * has to: the Room `accounts` row, the encrypted credential, and the
+ * system-visible `AccountManager` entry.
+ *
+ * The order matters. The Room row comes first because its id keys the
+ * credential, and the system account comes last because it is the one thing a
+ * user can see — an entry in Settings for an account whose credential failed to
+ * store would be a sync that silently never works.
+ */
+@Singleton
+class AccountRepository @Inject constructor(
+    private val database: TasksDatabase,
+    private val credentials: CredentialStore,
+    private val accounts: CalDavAccounts,
+    private val syncTrigger: SyncTrigger,
+    private val cadence: SyncCadenceStore,
+    private val accountState: AccountStateStore,
+    private val quarantine: QuarantineStore,
+    private val notices: SyncNoticeStore,
+    private val collectionSupport: CollectionSupportStore,
+    private val gateway: CalDavGateway,
+    private val availability: SyncAvailability,
+    private val settings: SettingsPrefs,
+    private val push: PushRegistrar,
+    @IoDispatcher private val io: CoroutineDispatcher,
+) : AccountCreator {
+
+    private suspend fun syncInterval(): Int = settings.settings.first().syncIntervalMinutes
+
+    /** What went wrong, in words a user can act on. */
+    sealed interface Outcome {
+        data class Created(val accountId: Long) : Outcome
+        data object AlreadyExists : Outcome
+
+        /** External storage mode is on, and nothing would ever show what this account syncs. */
+        data object ExternalStorage : Outcome
+        data class CredentialFailed(val cause: Cause, val detail: String = "") : Outcome
+
+        /**
+         * Why an account could not be saved, in a form the UI can translate.
+         *
+         * ⚠️ The UI renders *this*, never [CredentialFailed.detail] — which is
+         * a `Throwable.message` and so an untranslated, often unreadable string.
+         */
+        enum class Cause {
+            /** The Keystore refused to hold the password. */
+            KEYSTORE_REFUSED,
+
+            /** Anything else that stopped the write. */
+            NOT_SAVED,
+        }
+    }
+
+    suspend fun all(): List<AccountEntity> = withContext(io) { database.accounts().all() }
+
+    /** The accounts, observed, so a sync landing updates a screen that is open. */
+    fun observeAll(): Flow<List<AccountEntity>> = database.accounts().observeAll()
+
+    /** Every account's synced lists. */
+    fun observeSyncedLists(): Flow<List<TaskListEntity>> = database.taskLists().observeSynced()
+
+    /**
+     * Creates an account and the task lists the user chose.
+     *
+     * [selected] is a subset of what discovery found; a collection the user did
+     * not tick is simply not created, and can be added later without touching
+     * anything else — `task_lists.account_id` is a nullable FK, so attaching is
+     * an `UPDATE`.
+     */
+    override suspend fun create(
+        displayName: String,
+        username: String,
+        appPassword: String,
+        found: CalDavDiscovery.Outcome.Found,
+        selected: Set<TaskCollection>,
+        reauthenticating: Long?,
+    ): Outcome = withContext(io) {
+        if (!availability.accountsUsable()) return@withContext Outcome.ExternalStorage
+        // "Sign in again" names its account, so a login name the server spells
+        // differently from last time still lands on it rather than beside it.
+        // Only on the same server: anything else is a different account.
+        val target = reauthenticating?.let { database.accounts().account(it) }
+        if (target != null && sameServer(target, found)) {
+            return@withContext reauthenticate(target, target.displayName, username, appPassword, found, selected)
+        }
+        // Both stores, not just one. There is no unique index on
+        // accounts.display_name and nothing prunes Room when the system account
+        // disappears, so "removed from system Settings, re-added here" would
+        // otherwise leave a second Room row and a duplicate of every list.
+        val systemAccount = accounts.find(displayName)
+        val existing = database.accounts().all().firstOrNull { it.displayName == displayName }
+
+        // ⚠️ Re-authentication, not a duplicate. An account stopped by a 401 has
+        // no other way back: `create` is the only path that writes a credential,
+        // and refusing it here left the user with "that account is already set
+        // up" and no option but to remove the account — discarding the choice to
+        // keep its lists attached. Narrow on purpose: a *healthy* account of the
+        // same name is still a duplicate, so this can never silently overwrite a
+        // working credential.
+        if (existing != null && accountState.needsSignIn(existing.id)) {
+            return@withContext reauthenticate(existing, displayName, username, appPassword, found, selected)
+        }
+
+        if (existing != null) return@withContext Outcome.AlreadyExists
+
+        // ⚠️ In the system, not in Room: an orphan, not a duplicate. `remove()`
+        // ignores whether the AccountManager entry actually went (and `find`
+        // returns null while the device is locked), so this state is reachable —
+        // and refusing here left the user with an account that cannot be removed
+        // from inside the app at all, since the accounts screen is driven off
+        // Room. Clearing it up is kinder than refusing for ever.
+        systemAccount?.let { accounts.remove(it) }
+
+        // ⚠️ Uncancellable as a whole. The row, its lists, the credential and
+        // the system entry are four stores that cannot share a transaction, and
+        // the caller is a viewModelScope tied to the Settings destination — a
+        // back gesture during "Adding the account" would otherwise leave the row
+        // and its lists with no credential and no system account: the rollback
+        // never runs, `needsSignIn` is false so re-auth will not fire, and every
+        // retry answers AlreadyExists. `remove()` documents the same hazard.
+        withContext(NonCancellable) {
+            val inserted = mutableListOf<Long>()
+            val accountId = database.runInTransaction<Long> {
+                val id = database.accounts().insert(
+                    AccountEntity(
+                        displayName = displayName,
+                        // Persist where a 301/308 actually put us — dav4jvm#209 exists
+                        // precisely so this is knowable, and re-following the redirect
+                        // on every sync is what not persisting it costs.
+                        principalUrl = (found.movedTo ?: found.principal).toString(),
+                        // The principal's own home set. `resolve("./")` on a collection
+                        // URL is a no-op — CalDAV hrefs already end in "/" — so the
+                        // old version stored the first collection's own URL, and that
+                        // collection may not even be from the account's own home set.
+                        homeSetUrl = found.homeSets.firstOrNull()?.toString(),
+                        username = username,
+                    ),
+                )
+                inserted += attach(id, selected)
+                id
+            }
+
+            if (!credentials.put(accountId, appPassword)) {
+                // Never leave a half-made account behind: without a credential it
+                // would sit in Settings failing to sync with nothing to explain it.
+                rollback(accountId, inserted)
+                return@withContext Outcome.CredentialFailed(
+                    Outcome.Cause.KEYSTORE_REFUSED,
+                    "the device keystore would not store the password",
+                )
+            }
+
+            if (!accounts.add(displayName, accountId)) {
+                credentials.clear(accountId)
+                rollback(accountId, inserted)
+                return@withContext Outcome.AlreadyExists
+            }
+
+            // On the schedule from the moment it exists, and syncing immediately —
+            // an account that shows up empty until the first periodic window looks
+            // broken.
+            syncTrigger.schedule(displayName, syncInterval())
+            syncTrigger.enqueue(displayName)
+
+            Outcome.Created(accountId)
+        }
+    }
+
+    /**
+     * Points [selected] at [accountId], re-attaching what a previous removal
+     * left behind rather than inserting a second copy.
+     *
+     * ⚠️ `remove()` leaves the lists as device-only ones on purpose, so a plain
+     * insert gives the user their old "Personal" full of tasks *and* a freshly
+     * synced "Personal" holding the same tasks from the server. The row keeps
+     * its name, colour, ordering and tasks — the user's, not the server's — and
+     * loses only its cursor, because the account it was reconciled against is
+     * gone.
+     *
+     * ⚠️ On a re-authentication this also has to see the account's *own* lists,
+     * not just detached ones — the re-auth path walks the same picker, so a
+     * lookup that missed them would insert a second copy of every list the
+     * account already syncs. On a create the id was minted a statement earlier,
+     * so nothing is attached to it yet and only detached rows can match.
+     *
+     * @return the ids of the lists this call *created*, which are the only ones
+     *   a rollback may delete.
+     */
+    private fun attach(accountId: Long, selected: Set<TaskCollection>): List<Long> {
+        val known = database.taskLists().attachable(accountId).associateBy { it.href }
+        val inserted = mutableListOf<Long>()
+        selected.forEach { collection ->
+            val href = collection.url.toString()
+            val current = known[href]
+            if (current == null) {
+                inserted += database.taskLists().insert(
+                    TaskListEntity(
+                        name = collection.displayName ?: collection.url.pathSegments
+                            .lastOrNull { it.isNotEmpty() }
+                            .orEmpty(),
+                        color = collection.color ?: DEFAULT_LIST_COLOR,
+                        accountId = accountId,
+                        isReadOnly = collection.readOnly,
+                        href = href,
+                    ),
+                )
+            } else {
+                // Changing hands, as opposed to re-authenticating the account
+                // that already owns it: a cursor from the previous owner says
+                // nothing about this one, while the current owner's is still
+                // good and throwing it away costs a full reconciliation.
+                val changingHands = current.accountId != accountId
+                database.taskLists().update(
+                    current.copy(
+                        accountId = accountId,
+                        isReadOnly = collection.readOnly,
+                        syncToken = current.syncToken.takeUnless { changingHands },
+                        ctag = current.ctag.takeUnless { changingHands },
+                    ),
+                )
+            }
+        }
+        return inserted
+    }
+
+    /** What the server offers an existing account, beside what it already syncs. */
+    sealed interface Collections {
+        data class Found(
+            val collections: List<TaskCollection>,
+            /** Hrefs of the collections this account already syncs. */
+            val attached: Set<String>,
+        ) : Collections
+
+        /** The account is stopped, or has no credential we can use. */
+        data object NeedsSignIn : Collections
+
+        data class Failed(val cause: CalDavDiscovery.Outcome.Cause?) : Collections
+    }
+
+    /**
+     * Re-runs discovery for [accountId], so lists added on the server after
+     * setup can be picked up and ones that are synced can be dropped.
+     */
+    suspend fun collections(accountId: Long): Collections = withContext(io) {
+        if (accountState.needsSignIn(accountId)) return@withContext Collections.NeedsSignIn
+        val account = database.accounts().account(accountId)
+            ?: return@withContext Collections.Failed(null)
+        val username = account.username ?: return@withContext Collections.NeedsSignIn
+        val principal = account.principalUrl?.toHttpUrlOrNull()
+            ?: return@withContext Collections.Failed(null)
+        val password = (credentials.get(accountId) as? CredentialStore.Secret.Present)?.value
+            ?: return@withContext Collections.NeedsSignIn
+        val attached = database.taskLists().syncedForAccount(accountId)
+            .mapNotNull { it.href }
+            .toSet()
+        when (
+            val outcome = gateway.discover(
+                principal.toString(),
+                CalDavGateway.Credentials(username, password, principal),
+            )
+        ) {
+            is CalDavDiscovery.Outcome.Found -> Collections.Found(outcome.collections, attached)
+            is CalDavDiscovery.Outcome.NeedsAuthentication,
+            CalDavDiscovery.Outcome.Unauthenticated,
+            -> Collections.NeedsSignIn
+            is CalDavDiscovery.Outcome.NotCalDav -> Collections.Failed(outcome.cause)
+            is CalDavDiscovery.Outcome.Failed -> Collections.Failed(outcome.cause)
+        }
+    }
+
+    /**
+     * Makes [selected] the synced subset of [offered] for [accountId].
+     *
+     * Newly ticked collections are attached and synced. Unticked ones that were
+     * synced go the way an account removal takes its lists: detached as
+     * device-only lists when [keepUnticked], deleted from this device otherwise.
+     * Nothing is deleted on the server either way.
+     */
+    suspend fun setSyncedCollections(
+        accountId: Long,
+        offered: List<TaskCollection>,
+        selected: Set<HttpUrl>,
+        keepUnticked: Boolean,
+    ) = withContext(io) {
+        val account = database.accounts().account(accountId) ?: return@withContext
+        withContext(NonCancellable) {
+            val change = collectionChange(
+                offered,
+                selected,
+                database.taskLists().syncedForAccount(accountId),
+            )
+            database.runInTransaction {
+                attach(accountId, change.attach)
+                change.drop.forEach { list ->
+                    if (keepUnticked) {
+                        database.taskLists().setAccount(list.id, null)
+                    } else {
+                        database.taskLists().delete(list.id)
+                    }
+                }
+            }
+            val dropped = change.drop.map { it.id }.toSet()
+            runCatching { push.forgetLists(accountId, dropped) }
+            cadence.forget(dropped)
+            quarantine.forget(dropped)
+            change.drop.forEach { notices.forgetList(accountId, it.name) }
+            if (change.attach.isNotEmpty()) syncTrigger.enqueue(account.displayName, expedited = true)
+        }
+    }
+
+    /**
+     * Gives a quarantined resource another go: its failure count is cleared and
+     * the account synced. If it fails again it is counted afresh, and the notice
+     * comes back once it reaches the threshold again.
+     */
+    suspend fun retryQuarantined(accountId: Long, key: String) = withContext(io) {
+        val account = database.accounts().account(accountId) ?: return@withContext
+        val listIds = database.taskLists().syncedForAccount(accountId).map { it.id }.toSet()
+        quarantine.release(listIds, key)
+        notices.forgetQuarantined(accountId, key)
+        syncTrigger.enqueue(account.displayName, expedited = true)
+    }
+
+    /**
+     * Replaces the credential of an account the server had stopped accepting.
+     *
+     * The tasks stay exactly as they are — the password was the only thing that
+     * went stale. Everything the user was asked for on the way here is applied
+     * all the same:
+     *
+     * ⚠️ This branch used to take [appPassword] and drop [found] and [selected]
+     * on the floor. The user walked the whole add flow, ticked collections, and
+     * was shown Done — while no newly-ticked list was created, no unticked one
+     * was detached, and a moved principal or a corrected username was discarded,
+     * so a relocated account could never be repaired. It also never called
+     * `accounts.add`, so an account the user had deleted in Android Settings —
+     * nothing listens for `LOGIN_ACCOUNTS_CHANGED` — stayed absent from Settings
+     * for ever while syncing happily via WorkManager, and every later add
+     * answered AlreadyExists.
+     */
+    private suspend fun reauthenticate(
+        existing: AccountEntity,
+        displayName: String,
+        username: String,
+        appPassword: String,
+        found: CalDavDiscovery.Outcome.Found,
+        selected: Set<TaskCollection>,
+    ): Outcome {
+        val accountId = existing.id
+        if (!credentials.put(accountId, appPassword)) {
+            return Outcome.CredentialFailed(
+                Outcome.Cause.KEYSTORE_REFUSED,
+                "the device keystore would not store the password",
+            )
+        }
+        withContext(NonCancellable) {
+            database.runInTransaction {
+                database.accounts().update(
+                    existing.copy(
+                        // Where discovery just found it, which is the only way a
+                        // principal that has moved can ever be corrected.
+                        principalUrl = (found.movedTo ?: found.principal).toString(),
+                        homeSetUrl = found.homeSets.firstOrNull()?.toString()
+                            ?: existing.homeSetUrl,
+                        username = username,
+                    ),
+                )
+                attach(accountId, selected)
+            }
+            // ⚠️ Ticked lists are attached; unticked ones are left alone. The
+            // picker pre-ticks everything *writable*, not everything already
+            // attached, so detaching what is unticked would silently stop
+            // syncing a read-only share the account has synced for months —
+            // over a default the user never chose. Detaching belongs here the
+            // day the picker knows what this account already holds.
+            // The Room row is the account as far as this app is concerned, so a
+            // missing system entry is re-registered rather than left behind.
+            if (accounts.find(displayName) == null) accounts.add(displayName, accountId)
+            accountState.setNeedsSignIn(accountId, false)
+            database.accounts().recordSync(accountId, at = null, error = null)
+            syncTrigger.schedule(displayName, syncInterval())
+            syncTrigger.enqueue(displayName)
+        }
+        return Outcome.Created(accountId)
+    }
+
+    /**
+     * Undoes a half-made account.
+     *
+     * ⚠️ The lists this attempt *created* have to go explicitly.
+     * `task_lists.account_id` is `ON DELETE SET NULL` — deliberately, so
+     * removing a working account never destroys tasks — which means deleting the
+     * account row alone would leave a set of empty device-only lists behind.
+     *
+     * ⚠️ And only those. A list [attach] re-attached was already on the device
+     * and holds the user's tasks; `SET NULL` returns it to being device-only,
+     * which is exactly where it came from.
+     */
+    private fun rollback(accountId: Long, inserted: List<Long>) = database.runInTransaction {
+        inserted.forEach { database.taskLists().delete(it) }
+        database.accounts().delete(accountId)
+    }
+
+    /**
+     * Puts every existing account back on the periodic schedule.
+     *
+     * Cheap and idempotent — `KEEP` means an already-scheduled account is left
+     * exactly as it is — so calling it on app open costs nothing and repairs the
+     * one case WorkManager cannot: a schedule lost to "clear app data" or to a
+     * restore onto a device that never ran the account-add flow.
+     */
+    suspend fun rescheduleAll(intervalChanged: Boolean = false) = withContext(io) {
+        val stopped = accountState.needingSignIn()
+        database.accounts().all().forEach { account ->
+            // ⚠️ A stopped account must not come back on the timer. `KEEP` only
+            // keeps work that is unfinished, and CANCELLED counts as finished —
+            // so rescheduling would re-enqueue the very request a 401 removed,
+            // and the next app open would put a dead app password back on a
+            // four-hour loop against a server that throttles by IP.
+            //
+            // This is also where the cancellation happens at all: the engine
+            // cannot cancel from inside the worker it is running in.
+            if (account.id in stopped) {
+                syncTrigger.cancel(account.displayName)
+            } else {
+                syncTrigger.schedule(account.displayName, syncInterval(), intervalChanged)
+            }
+        }
+    }
+
+    /** The accounts a caller may sync right now — stopped ones excluded. */
+    suspend fun syncable(): List<AccountEntity> = withContext(io) {
+        val stopped = accountState.needingSignIn()
+        database.accounts().all().filterNot { it.id in stopped }
+    }
+
+    /**
+     * Removes an account and everything that keys off it.
+     *
+     * The lists are **not** deleted: `task_lists.account_id` is `ON DELETE SET
+     * NULL`, so they become device-only lists. Removing an account is not an
+     * instruction to destroy the tasks it held.
+     */
+    suspend fun remove(accountId: Long, displayName: String, deleteLocalData: Boolean = false) =
+        withContext(io) {
+            syncTrigger.cancel(displayName)
+            // Before the revocation: the subscriptions can only be removed with
+            // the credential that is about to stop working.
+            withContext(NonCancellable) { runCatching { push.forgetAccount(accountId) } }
+            revokeAppPassword(accountId)
+
+            // ⚠️ Uncancellable from here. Everything below is destructive and
+            // spread over four stores that cannot share a transaction, and the
+            // caller is a viewModelScope tied to the Settings destination — the
+            // user taps Remove, the screen slides away, and a couple of back
+            // gestures kill the scope mid-sequence. Only the DataStore writes can
+            // observe cancellation (every Room DAO here is blocking), so the
+            // realistic landing point is `cadence.forget`: the app password is
+            // already revoked server-side while the row survives holding it, and
+            // the account reads "sign in again" for a credential we ourselves
+            // invalidated. Land further in and the tasks are gone with the row
+            // still there. The tail is three DataStore writes, two deletes and an
+            // AccountManager call — bounded and sub-second, so finishing it is
+            // strictly better than stopping anywhere inside it.
+            withContext(NonCancellable) {
+                // The lists survive as device-only lists, so their cursors must
+                // not: a re-added account would otherwise inherit a "reconciled
+                // recently" that was true of a different account's data.
+                val listIds = database.taskLists().syncedForAccount(accountId)
+                    .map { it.id }
+                    .toSet()
+                cadence.forget(listIds)
+                // ⚠️ And the quarantine counts, which are keyed the same way and
+                // are just as global. A list re-attached to a new account would
+                // otherwise inherit them, and a resource already at THRESHOLD is
+                // skipped for ever — it never succeeds, so it never clears.
+                quarantine.forget(listIds)
+                // Play's Account Deletion policy does not apply to us — there is
+                // no Agendula account to delete — but "I want it gone from this
+                // device too" is a reasonable thing to want, and it is the only
+                // way to get the tasks off the device without also uninstalling.
+                if (deleteLocalData) database.taskLists().deleteForAccount(accountId)
+
+                accountState.setNeedsSignIn(accountId, false)
+                // Keyed by account id, exactly like the flag above, and just as
+                // orphaned once the row goes: ids are AUTOINCREMENT so they are
+                // never reused, but nothing would ever read or clear these again.
+                notices.dismiss(accountId)
+                // The same reasoning, for what the server said it would let us
+                // create: keyed by an id nothing will ever mention again.
+                collectionSupport.forget(accountId)
+                credentials.clear(accountId)
+                database.accounts().delete(accountId)
+                accounts.find(displayName)?.let { accounts.remove(it) }
+            }
+        }
+
+    /**
+     * Best effort, and before the credential is cleared — it is the credential.
+     *
+     * A failure here is never allowed to stop the removal: the user asked for the
+     * account to go, and a server that is unreachable, or was never a Nextcloud,
+     * is not a reason to keep it.
+     */
+    private suspend fun revokeAppPassword(accountId: Long) {
+        val account = database.accounts().account(accountId) ?: return
+        val username = account.username ?: return
+        val origin = account.principalUrl?.toHttpUrlOrNull() ?: return
+        val password = (credentials.get(accountId) as? CredentialStore.Secret.Present)?.value
+            ?: return
+        // ⚠️ The budget lives on the request itself, in AppPassword.revoke.
+        // Wrapping this in withTimeoutOrNull only *looked* bounded: the call
+        // parks on a socket read that no cancellation can break, and withContext
+        // returns when its block does, so the deadline passed and we waited
+        // anyway — minutes, on a multi-homed host that stalls.
+        try {
+            gateway.revokeAppPassword(
+                CalDavGateway.Credentials(username, password, origin),
+            )
+        } catch (_: CancellationException) {
+            // Deliberately swallowed. If the caller went away mid-revoke we still
+            // want the removal to finish rather than stop half-done; the tail
+            // below runs uncancellable for the same reason.
+        }
+    }
+
+    /** What [setSyncedCollections] has to do: collections to attach, lists to let go. */
+    internal data class CollectionChange(
+        val attach: Set<TaskCollection>,
+        val drop: List<TaskListEntity>,
+    )
+
+    private fun sameServer(account: AccountEntity, found: CalDavDiscovery.Outcome.Found): Boolean {
+        val stored = account.principalUrl?.toHttpUrlOrNull() ?: return true
+        return stored.host.equals((found.movedTo ?: found.principal).host, ignoreCase = true)
+    }
+
+    internal companion object {
+        /** M3 primary-ish blue; the user recolours a list from its own screen. */
+        const val DEFAULT_LIST_COLOR = 0xFF4C6FFF.toInt()
+
+        /**
+         * Only collections the server still offers are judged. A synced list
+         * missing from [offered] — a share revoked a minute ago, a flaky listing —
+         * is not the user unticking it, and is left for sync to sort out.
+         */
+        fun collectionChange(
+            offered: List<TaskCollection>,
+            selected: Set<HttpUrl>,
+            synced: List<TaskListEntity>,
+        ): CollectionChange {
+            val syncedHrefs = synced.mapNotNull { it.href }.toSet()
+            val offeredHrefs = offered.map { it.url.toString() }.toSet()
+            val selectedHrefs = selected.map { it.toString() }.toSet()
+            return CollectionChange(
+                attach = offered.filter {
+                    it.url in selected && it.url.toString() !in syncedHrefs
+                }.toSet(),
+                drop = synced.filter { it.href in offeredHrefs && it.href !in selectedHrefs },
+            )
+        }
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/AccountStateStore.kt

@@ -0,0 +1,72 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringSetPreferencesKey
+import de.jeanlucmakiola.agendula.data.di.SyncStateDataStore
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.map
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * Which accounts the server has stopped accepting.
+ *
+ * Separate from `accounts.last_sync_error` because the two mean different
+ * things to the user and to the engine: an error is "this did not work, we will
+ * try again", while this is "**we have stopped trying** and only you can change
+ * that". Conflating them is how a client ends up retrying a revoked app password
+ * on a timer.
+ *
+ * Lives with the other per-device sync state, and is therefore excluded from
+ * backup — see [SyncStateDataStore]. That is also correct on its own terms: the
+ * credential does not survive a restore either, so a restored "needs sign-in" is
+ * at best redundant and at worst stale.
+ */
+@Singleton
+class AccountStateStore @Inject constructor(
+    @SyncStateDataStore private val dataStore: DataStore<Preferences>,
+) {
+
+    suspend fun needingSignIn(): Set<Long> = observeNeedingSignIn().first()
+
+    /** Observed, so a 401 during a background sync reaches an open screen. */
+    fun observeNeedingSignIn(): Flow<Set<Long>> = dataStore.data.map { prefs ->
+        prefs[KEY].orEmpty().mapNotNull { it.toLongOrNull() }.toSet()
+    }
+
+    suspend fun needsSignIn(accountId: Long): Boolean = accountId in needingSignIn()
+
+    suspend fun setNeedsSignIn(accountId: Long, needed: Boolean) {
+        dataStore.edit { prefs ->
+            val current = prefs[KEY].orEmpty().toMutableSet()
+            if (needed) current += accountId.toString() else current -= accountId.toString()
+            prefs[KEY] = current
+            // A later stop is news again.
+            if (!needed) prefs[NOTIFIED] = prefs[NOTIFIED].orEmpty() - accountId.toString()
+        }
+    }
+
+    /**
+     * Records that the user has been told [accountId] needs signing in to.
+     *
+     * @return true the first time per stop, so the notification is posted once
+     *   rather than on every run the stopped account refuses.
+     */
+    suspend fun markSignInNotified(accountId: Long): Boolean {
+        var fresh = false
+        dataStore.edit { prefs ->
+            val notified = prefs[NOTIFIED].orEmpty()
+            fresh = accountId.toString() !in notified
+            if (fresh) prefs[NOTIFIED] = notified + accountId.toString()
+        }
+        return fresh
+    }
+
+    private companion object {
+        val KEY = stringSetPreferencesKey("accounts_needing_sign_in")
+        val NOTIFIED = stringSetPreferencesKey("accounts_sign_in_notified")
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/CalDavAccounts.kt

@@ -0,0 +1,103 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import android.accounts.Account
+import android.accounts.AccountManager
+import android.content.ContentResolver
+import android.content.Context
+import android.os.Bundle
+import dagger.hilt.android.qualifiers.ApplicationContext
+import de.jeanlucmakiola.agendula.BuildConfig
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * Identifiers shared between Kotlin and the two XML descriptors.
+ *
+ * Derived from `applicationId`, so the debug and `releaseTest` builds get their
+ * own account type and authority and can be installed alongside the real app
+ * without their accounts colliding. ⚠️ `res/xml/authenticator.xml` and
+ * `res/xml/sync_adapter.xml` cannot read `BuildConfig`, so they use string
+ * resources generated by `resValue` in `app/build.gradle.kts` — the two must be
+ * changed together.
+ */
+object SyncContract {
+    val ACCOUNT_TYPE: String = BuildConfig.APPLICATION_ID + ".caldav"
+    val AUTHORITY: String = BuildConfig.APPLICATION_ID + ".sync"
+}
+
+/**
+ * Agendula's CalDAV accounts, as the system sees them.
+ *
+ * The Room `accounts` table is the source of truth for everything about an
+ * account; this is only the system-visible half — the entry in Settings, and the
+ * handle the sync framework needs to trigger us.
+ */
+@Singleton
+class CalDavAccounts @Inject constructor(
+    @ApplicationContext private val context: Context,
+) {
+
+    private val accountManager get() = AccountManager.get(context)
+
+    fun all(): List<Account> =
+        accountManager.getAccountsByType(SyncContract.ACCOUNT_TYPE).toList()
+
+    fun find(name: String): Account? = all().firstOrNull { it.name == name }
+
+    /**
+     * Registers [name] with the system and turns sync on for it.
+     *
+     * No password is handed to `AccountManager`: it stores them as plain `TEXT`.
+     * The app password goes to [CredentialStore], keyed by the Room account id.
+     *
+     * @return false if an account with this name already exists
+     */
+    fun add(name: String, roomAccountId: Long): Boolean {
+        val account = Account(name, SyncContract.ACCOUNT_TYPE)
+        val userData = Bundle().apply { putString(KEY_ROOM_ACCOUNT_ID, roomAccountId.toString()) }
+        if (!accountManager.addAccountExplicitly(account, null, userData)) return false
+
+        // All three are among the calls that return silently with no registered
+        // sync adapter — see SyncAdapterService. They work because we register one.
+        ContentResolver.setIsSyncable(account, SyncContract.AUTHORITY, 1)
+        ContentResolver.setSyncAutomatically(account, SyncContract.AUTHORITY, true)
+        return true
+    }
+
+    /**
+     * The Room account id for [account], or null.
+     *
+     * ⚠️ `getUserData` returns null while the device is locked, so a
+     * boot-triggered sync has to wait for unlock rather than treat this as
+     * "account gone".
+     */
+    fun roomAccountId(account: Account): Long? =
+        accountManager.getUserData(account, KEY_ROOM_ACCOUNT_ID)?.toLongOrNull()
+
+    /**
+     * Removes the system-visible account.
+     *
+     * `removeAccountExplicitly` works because we own the account type. The Room
+     * row and the credential are removed by [AccountRepository]; pruning must be
+     * driven by this call and by `AccountManager`'s account-removed broadcast,
+     * never by "absent from the visible set" — `getAccountsByType` returns
+     * nothing while the device is locked, and treating that as removal is how a
+     * restore silently deletes the user's lists.
+     */
+    fun remove(account: Account): Boolean = accountManager.removeAccountExplicitly(account)
+
+    fun requestSync(account: Account) {
+        ContentResolver.requestSync(
+            account,
+            SyncContract.AUTHORITY,
+            Bundle().apply {
+                putBoolean(ContentResolver.SYNC_EXTRAS_MANUAL, true)
+                putBoolean(ContentResolver.SYNC_EXTRAS_EXPEDITED, true)
+            },
+        )
+    }
+
+    private companion object {
+        const val KEY_ROOM_ACCOUNT_ID = "roomAccountId"
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/CalDavGateway.kt

@@ -0,0 +1,127 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import de.jeanlucmakiola.agendula.data.di.IoDispatcher
+import de.jeanlucmakiola.caldav.AppPassword
+import de.jeanlucmakiola.caldav.CalDavDiscovery
+import de.jeanlucmakiola.caldav.CalDavHttp
+import de.jeanlucmakiola.caldav.DnsJavaResolver
+import de.jeanlucmakiola.caldav.NextcloudLoginFlow
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.withContext
+import okhttp3.HttpUrl
+import java.util.concurrent.TimeUnit
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * The network side of adding an account, behind one interface.
+ *
+ * It exists so the sign-in state machine can be tested. That machine decides
+ * which of five outcomes leads where, when a one-shot app password is spent, and
+ * which host a credential is scoped to — all of which are exactly the sort of
+ * thing that goes wrong quietly, and none of which should require a server to
+ * exercise.
+ */
+interface CalDavGateway {
+
+    /** Discovery against [target], optionally carrying credentials. */
+    suspend fun discover(target: String, credentials: Credentials? = null): CalDavDiscovery.Outcome
+
+    /** Starts Nextcloud Login Flow v2, or returns null if this is not a Nextcloud. */
+    suspend fun startLoginFlow(server: HttpUrl): NextcloudLoginFlow.Flow?
+
+    suspend fun pollLoginFlow(flow: NextcloudLoginFlow.Flow): NextcloudLoginFlow.PollResult
+
+    /**
+     * Hands an app password back to the server, best effort.
+     *
+     * Without it, uninstalling never revokes anything — the credential we minted
+     * outlives the app in the user's device list.
+     */
+    suspend fun revokeAppPassword(credentials: Credentials): Boolean
+
+    /**
+     * The same, for a password the login flow just minted.
+     *
+     * ⚠️ Separate because [Credentials.origin] means something different here:
+     * the *server root* the flow reported, not a principal URL. Sending it
+     * through [revokeAppPassword] would derive the OCS root as though it were a
+     * principal, and a subpath install's `https://host/nextcloud/` would collapse
+     * to `https://host/` — a DELETE that 404s on every one of them.
+     */
+    suspend fun revokeIssuedAppPassword(credentials: Credentials): Boolean
+
+    /** Credentials, and the origin whose registrable domain they are scoped to. */
+    data class Credentials(val username: String, val password: String, val origin: HttpUrl)
+}
+
+@Singleton
+class OkHttpCalDavGateway @Inject constructor(
+    @IoDispatcher private val io: CoroutineDispatcher,
+) : CalDavGateway {
+
+    /**
+     * Becomes the app password's **name** in Nextcloud's Settings → Security →
+     * Devices & sessions. OkHttp's default would show `okhttp/4.12.0`, leaving
+     * the user unable to tell what to revoke — which defeats the whole point of
+     * using an app password.
+     */
+    private val userAgent = "Agendula (Android)"
+
+    override suspend fun discover(
+        target: String,
+        credentials: CalDavGateway.Credentials?,
+    ): CalDavDiscovery.Outcome = withContext(io) {
+        val client = credentials?.let {
+            CalDavHttp.authenticated(userAgent, it.username, it.password, it.origin)
+        } ?: CalDavHttp.anonymous(userAgent)
+        CalDavDiscovery(client, DnsJavaResolver()).discover(target)
+    }
+
+    override suspend fun startLoginFlow(server: HttpUrl): NextcloudLoginFlow.Flow? =
+        withContext(io) {
+            NextcloudLoginFlow(CalDavHttp.anonymous(userAgent), userAgent)
+                .start(server, now())
+                .getOrNull()
+        }
+
+    /**
+     * ⚠️ The budget lives on the request, as it does for the revocation.
+     * `execute()` parks on a socket read that no cancellation can break, so the
+     * four places that cancel the poll job only stop the *next* request — and
+     * the shared client's ceiling is sized for a multiget, not for a two-second
+     * poll loop against a server that answered a moment ago.
+     */
+    override suspend fun pollLoginFlow(flow: NextcloudLoginFlow.Flow): NextcloudLoginFlow.PollResult =
+        withContext(io) {
+            val client = CalDavHttp.anonymous(userAgent).newBuilder()
+                .callTimeout(POLL_TIMEOUT_SECONDS, TimeUnit.SECONDS)
+                .build()
+            NextcloudLoginFlow(client, userAgent).poll(flow, now())
+        }
+
+    override suspend fun revokeAppPassword(
+        credentials: CalDavGateway.Credentials,
+    ): Boolean = withContext(io) {
+        val client = CalDavHttp.authenticated(
+            userAgent, credentials.username, credentials.password, credentials.origin,
+        )
+        AppPassword.revoke(client, credentials.origin)
+    }
+
+    override suspend fun revokeIssuedAppPassword(
+        credentials: CalDavGateway.Credentials,
+    ): Boolean = withContext(io) {
+        val client = CalDavHttp.authenticated(
+            userAgent, credentials.username, credentials.password, credentials.origin,
+        )
+        AppPassword.revokeAt(client, credentials.origin)
+    }
+
+    private fun now() = System.currentTimeMillis() / 1000
+
+    private companion object {
+        /** One poll of a 2s loop. Long enough for a homelab, short enough to cancel. */
+        const val POLL_TIMEOUT_SECONDS = 15L
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/CollectionSupportStore.kt

@@ -0,0 +1,72 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringSetPreferencesKey
+import de.jeanlucmakiola.agendula.data.di.SyncStateDataStore
+import de.jeanlucmakiola.caldav.CollectionSupport
+import kotlinx.coroutines.flow.first
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * What each account's home set answered to OPTIONS, last time we asked.
+ *
+ * ⚠️ A cache, never the answer. The "new task list" affordance is *hidden*
+ * where neither MKCALENDAR nor extended
+ * MKCOL exists, and a picker that has to make a network round trip before it can
+ * draw a row is a picker that stutters — so the last answer is what it draws
+ * with, and [RemoteListRepository] re-asks before it actually writes. A server
+ * that gained the capability in an upgrade, or lost it in a config change, is
+ * then wrong for exactly one glance rather than for ever.
+ */
+@Singleton
+class CollectionSupportStore @Inject constructor(
+    @SyncStateDataStore private val dataStore: DataStore<Preferences>,
+) {
+
+    suspend fun get(accountId: Long): CollectionSupport =
+        decode(dataStore.data.first()[KEY].orEmpty())[accountId] ?: CollectionSupport.NONE
+
+    /** Asks [ask], records what it said, and hands it back. */
+    suspend fun refresh(accountId: Long, ask: () -> CollectionSupport): CollectionSupport {
+        val answer = ask()
+        dataStore.edit { prefs ->
+            // Re-read inside `edit`, which DataStore serialises: two accounts
+            // can be asked at once and a snapshot taken outside would drop one.
+            val current = decode(prefs[KEY].orEmpty()).toMutableMap()
+            current[accountId] = answer
+            prefs[KEY] = current.map { (id, support) -> encode(id, support) }.toSet()
+        }
+        return answer
+    }
+
+    suspend fun forget(accountId: Long) {
+        dataStore.edit { prefs ->
+            prefs[KEY] = decode(prefs[KEY].orEmpty())
+                .filterKeys { it != accountId }
+                .map { (id, support) -> encode(id, support) }
+                .toSet()
+        }
+    }
+
+    private fun encode(accountId: Long, support: CollectionSupport): String =
+        "$accountId|${support.mkCalendar}|${support.extendedMkCol}"
+
+    private fun decode(entries: Set<String>): Map<Long, CollectionSupport> =
+        entries.mapNotNull { entry ->
+            val parts = entry.split('|')
+            if (parts.size != FIELDS) return@mapNotNull null
+            val accountId = parts[0].toLongOrNull() ?: return@mapNotNull null
+            accountId to CollectionSupport(
+                mkCalendar = parts[1].toBooleanStrictOrNull() ?: return@mapNotNull null,
+                extendedMkCol = parts[2].toBooleanStrictOrNull() ?: return@mapNotNull null,
+            )
+        }.toMap()
+
+    private companion object {
+        val KEY = stringSetPreferencesKey("collection_support")
+        const val FIELDS = 3
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/CredentialStore.kt

@@ -0,0 +1,171 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyPermanentlyInvalidatedException
+import android.security.keystore.KeyProperties
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import de.jeanlucmakiola.agendula.data.di.CredentialsDataStore
+import kotlinx.coroutines.flow.first
+import java.io.IOException
+import java.security.GeneralSecurityException
+import java.security.ProviderException
+import java.security.KeyStore
+import java.util.Base64
+import javax.crypto.AEADBadTagException
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * App passwords, encrypted with a hardware-backed Keystore key.
+ *
+ * `androidx.security:security-crypto` is **formally deprecated and terminal** —
+ * deprecated at 1.1.0-alpha07, shipped deprecated in stable 1.1.0, with release
+ * notes saying there will be no further releases — and its successor
+ * `datastore-tink` is alpha. So: Keystore `AES/GCM/NoPadding` directly, blob in
+ * DataStore.
+ *
+ * Be honest about what this buys. `AccountManager` stores passwords as plain
+ * `TEXT` — there is no encryption or hashing anywhere in AOSP — so file-based
+ * encryption plus a same-signature check is the whole boundary there. That is
+ * DAVx5's posture and it is defensible, but it is not secure storage. This is
+ * better, and the difference is worth the ~80 lines.
+ *
+ * Three deliberate non-choices:
+ * - `setUserAuthenticationRequired` is left at its default of `false`. Requiring
+ *   a device unlock per decryption makes background sync impossible.
+ * - `setUnlockedDeviceRequired` is **not** set, for the same reason.
+ * - A failure to decrypt is *never* a crash. It means re-authenticate.
+ */
+@Singleton
+class CredentialStore @Inject constructor(
+    @CredentialsDataStore private val dataStore: DataStore<Preferences>,
+) {
+
+    /** What came back for an account. */
+    sealed interface Secret {
+        data class Present(val value: String) : Secret
+
+        data object Absent : Secret
+
+        /**
+         * The ciphertext exists but can no longer be decrypted, so the only
+         * recovery is to sign in again.
+         *
+         * Reached by a restored backup (Keystore keys are non-exportable, so a
+         * restored blob is permanently undecryptable — which is why the blob is
+         * excluded from backup), by the key being invalidated when the user
+         * changes their lock screen, or by corruption.
+         */
+        data class Unrecoverable(val reason: String) : Secret
+    }
+
+    /**
+     * Stores [appPassword] for [accountId].
+     *
+     * @return false when the Keystore could not be used at all. A wedged or
+     * degraded keystore throws [ProviderException], which is a `RuntimeException`
+     * and would otherwise take down the account-add flow — the same "never
+     * crash over this" rule [get] follows.
+     */
+    suspend fun put(accountId: Long, appPassword: String): Boolean = try {
+        val cipher = Cipher.getInstance(TRANSFORMATION).apply { init(Cipher.ENCRYPT_MODE, key()) }
+        // The IV travels with the ciphertext. GCM requires a unique IV per
+        // encryption under the same key; letting the provider generate it is the
+        // only way to be sure of that.
+        val payload = cipher.iv + cipher.doFinal(appPassword.toByteArray(Charsets.UTF_8))
+        dataStore.edit { it[keyFor(accountId)] = Base64.getEncoder().encodeToString(payload) }
+        true
+    } catch (e: GeneralSecurityException) {
+        false
+    } catch (e: ProviderException) {
+        false
+    } catch (e: IOException) {
+        false
+    }
+
+    suspend fun get(accountId: Long): Secret {
+        val stored = dataStore.data.first()[keyFor(accountId)] ?: return Secret.Absent
+        return try {
+            val payload = Base64.getDecoder().decode(stored)
+            val cipher = Cipher.getInstance(TRANSFORMATION).apply {
+                init(
+                    Cipher.DECRYPT_MODE,
+                    key(),
+                    GCMParameterSpec(TAG_BITS, payload, 0, IV_BYTES),
+                )
+            }
+            Secret.Present(
+                String(
+                    cipher.doFinal(payload, IV_BYTES, payload.size - IV_BYTES),
+                    Charsets.UTF_8,
+                ),
+            )
+        } catch (e: KeyPermanentlyInvalidatedException) {
+            // The lock screen changed, or the key was otherwise invalidated.
+            Secret.Unrecoverable(e.message ?: "the encryption key was invalidated")
+        } catch (e: AEADBadTagException) {
+            // Wrong key or tampered ciphertext — the restored-backup case.
+            Secret.Unrecoverable(e.message ?: "the stored credential could not be decrypted")
+        } catch (e: GeneralSecurityException) {
+            Secret.Unrecoverable(e.message ?: "the stored credential could not be read")
+        } catch (e: IllegalArgumentException) {
+            // Not valid Base64 at all — a truncated or hand-edited blob.
+            Secret.Unrecoverable(e.message ?: "the stored credential is malformed")
+        } catch (e: ProviderException) {
+            // ⚠️ AndroidKeyStore signals keystore-level failure ("Keystore
+            // operation failed", "Failed to load key") with this — a
+            // RuntimeException, so none of the catches above match it. On a
+            // device with a degraded keystore it would crash the sync worker
+            // instead of prompting a re-authentication.
+            Secret.Unrecoverable(e.message ?: "the device keystore is unavailable")
+        } catch (e: IOException) {
+            // KeyStore.load declares it.
+            Secret.Unrecoverable(e.message ?: "the device keystore could not be opened")
+        }
+    }
+
+    suspend fun clear(accountId: Long) {
+        dataStore.edit { it.remove(keyFor(accountId)) }
+    }
+
+    /** Every stored credential. Used when the last account goes away. */
+    suspend fun clearAll() {
+        dataStore.edit { it.clear() }
+    }
+
+    private fun keyFor(accountId: Long) = stringPreferencesKey("caldav_app_password_$accountId")
+
+    private fun key(): SecretKey {
+        val keyStore = KeyStore.getInstance(KEYSTORE).apply { load(null) }
+        (keyStore.getEntry(KEY_ALIAS, null) as? KeyStore.SecretKeyEntry)?.let { return it.secretKey }
+
+        return KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, KEYSTORE).apply {
+            init(
+                KeyGenParameterSpec.Builder(
+                    KEY_ALIAS,
+                    KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT,
+                )
+                    .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+                    .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+                    // Not calling setUserAuthenticationRequired /
+                    // setUnlockedDeviceRequired is the point — see the class doc.
+                    .build(),
+            )
+        }.generateKey()
+    }
+
+    private companion object {
+        const val KEYSTORE = "AndroidKeyStore"
+        const val KEY_ALIAS = "agendula.caldav.credentials"
+        const val TRANSFORMATION = "AES/GCM/NoPadding"
+        const val IV_BYTES = 12
+        const val TAG_BITS = 128
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/PendingLoginFlowStore.kt

@@ -0,0 +1,145 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.longPreferencesKey
+import androidx.datastore.preferences.core.stringPreferencesKey
+import de.jeanlucmakiola.agendula.data.di.SyncStateDataStore
+import de.jeanlucmakiola.caldav.NextcloudLoginFlow
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * Where a started login flow is written down, so it can outlive this process.
+ *
+ * A seam for the same reason [AccountCreator] and [CalDavGateway] are: the flow
+ * that decides *when* a one-shot password stops being ours has to be testable
+ * without a DataStore.
+ */
+interface LoginFlowRecord {
+
+    /** Called **before** the browser is handed the URL. */
+    suspend fun remember(flow: NextcloudLoginFlow.Flow)
+
+    /** The flow is over, however it ended. */
+    suspend fun forget()
+}
+
+/**
+ * The Nextcloud login flow that is currently out at a browser.
+ *
+ * ⚠️ [NextcloudLoginFlow.Flow]'s own doc says to persist it **before** launching
+ * the browser, because the flow outlives our process — and it did not. The
+ * browser is a separate task, so process death while the user is approving is
+ * ordinary rather than exotic, and it stranded a one-shot app password that
+ * nothing could then collect *or* revoke: the flow's poll token was the only way
+ * back to it, and it lived in a ViewModel field.
+ *
+ * The token is not a credential. It authorises exactly one poll of one flow the
+ * user is in the middle of approving, and it is useless past the twenty-minute
+ * window — so it belongs in the sync-state store rather than the Keystore.
+ *
+ * ⚠️ What this does **not** cover is the window *after* approval, where the
+ * password itself lives only in memory. That needs the wizard's own state to
+ * survive, which is a different piece of work.
+ */
+@Singleton
+class PendingLoginFlowStore @Inject constructor(
+    @SyncStateDataStore private val dataStore: DataStore<Preferences>,
+    private val gateway: CalDavGateway,
+) : LoginFlowRecord {
+
+    private val lock = Mutex()
+    private var reclaimed = false
+
+    /** Records [flow] so a process that dies mid-approval can still finish with it. */
+    override suspend fun remember(flow: NextcloudLoginFlow.Flow) {
+        dataStore.edit { prefs ->
+            prefs[LOGIN_URL] = flow.loginUrl.toString()
+            prefs[POLL_ENDPOINT] = flow.pollEndpoint.toString()
+            prefs[POLL_TOKEN] = flow.pollToken
+            prefs[DEADLINE] = flow.deadlineEpochSeconds
+        }
+    }
+
+    /** The flow is finished, one way or another. */
+    override suspend fun forget() {
+        dataStore.edit { prefs ->
+            prefs.remove(LOGIN_URL)
+            prefs.remove(POLL_ENDPOINT)
+            prefs.remove(POLL_TOKEN)
+            prefs.remove(DEADLINE)
+        }
+    }
+
+    /**
+     * Collects and hands back a password nobody is left to own.
+     *
+     * Revoked rather than used: the address the user typed, the collections they
+     * ticked and the account name are all gone with the process, so there is
+     * nothing to finish. What is left is a live app password in the user's
+     * device list, under the same name as every other attempt — which is exactly
+     * what they cannot tell apart, and so dare not prune.
+     *
+     * ⚠️ **Once per process.** This activity is recreated on every rotation,
+     * theme switch and locale change, and a second run against a flow the *live*
+     * wizard is still polling would consume its one-shot 200 and revoke the
+     * password it was about to be handed. A flow remembered after this has run
+     * belongs to a wizard that is alive to finish it.
+     */
+    suspend fun reclaim() {
+        lock.withLock {
+            if (reclaimed) return
+            reclaimed = true
+        }
+        val flow = pending() ?: return
+        when (val result = gateway.pollLoginFlow(flow)) {
+            is NextcloudLoginFlow.PollResult.Approved -> {
+                // Cleared first: a revocation that fails must not leave a token
+                // that would be polled again, and the 200 is already spent.
+                forget()
+                gateway.revokeIssuedAppPassword(
+                    CalDavGateway.Credentials(
+                        username = result.credentials.loginName,
+                        password = result.credentials.appPassword,
+                        origin = result.credentials.server,
+                    ),
+                )
+            }
+
+            is NextcloudLoginFlow.PollResult.Expired -> forget()
+
+            // Still inside the window, or the server had a moment. Either way
+            // the token is still worth something, so it is left for the next
+            // open; a poll past the deadline answers Expired and clears it.
+            NextcloudLoginFlow.PollResult.Pending,
+            is NextcloudLoginFlow.PollResult.Failed,
+            -> Unit
+        }
+    }
+
+    private suspend fun pending(): NextcloudLoginFlow.Flow? {
+        val prefs = dataStore.data.first()
+        val endpoint = prefs[POLL_ENDPOINT]?.toHttpUrlOrNull() ?: return null
+        val token = prefs[POLL_TOKEN] ?: return null
+        val deadline = prefs[DEADLINE] ?: return null
+        return NextcloudLoginFlow.Flow(
+            loginUrl = prefs[LOGIN_URL]?.toHttpUrlOrNull() ?: endpoint,
+            pollEndpoint = endpoint,
+            pollToken = token,
+            deadlineEpochSeconds = deadline,
+        )
+    }
+
+    private companion object {
+        val LOGIN_URL = stringPreferencesKey("login_flow_url")
+        val POLL_ENDPOINT = stringPreferencesKey("login_flow_poll_endpoint")
+        val POLL_TOKEN = stringPreferencesKey("login_flow_poll_token")
+        val DEADLINE = longPreferencesKey("login_flow_deadline")
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/QuarantineStore.kt

@@ -0,0 +1,116 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringSetPreferencesKey
+import de.jeanlucmakiola.agendula.data.di.SyncStateDataStore
+import kotlinx.coroutines.flow.first
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * How many times each resource has failed, and therefore which ones to skip.
+ *
+ * ⚠️ Deliberately **not** a backoff. A backoff assumes the failure is transient
+ * and asks "how long until I try again"; the failures that matter here are
+ * permanent — a body sabre answers 415 for, a contradictory `RRULE`/`EXDATE`
+ * pair Nextcloud answers 500 for forever, a 507 the spec forbids retrying at
+ * all. The question worth asking is "how many times before I leave this one
+ * alone and finish the collection", and the answer is [THRESHOLD].
+ *
+ * Counts are cleared the moment a resource succeeds, so a genuinely transient
+ * failure costs nothing beyond the runs it actually failed in.
+ */
+@Singleton
+class QuarantineStore @Inject constructor(
+    @SyncStateDataStore private val dataStore: DataStore<Preferences>,
+) {
+
+    /** Current failure counts, keyed by [key]. */
+    suspend fun counts(): Map<String, Int> = decode(dataStore.data.first()[KEY].orEmpty())
+
+    private fun decode(entries: Set<String>): Map<String, Int> = entries.mapNotNull { entry ->
+        val separator = entry.lastIndexOf(COUNT_SEPARATOR)
+        if (separator <= 0) return@mapNotNull null
+        val count = entry.substring(separator + 1).toIntOrNull() ?: return@mapNotNull null
+        entry.substring(0, separator) to count
+    }.toMap()
+
+    /**
+     * Applies one account's changes without disturbing anyone else's.
+     *
+     * ⚠️ Not a whole-map replace. The counts are global — keyed by list, not by
+     * account — while `SyncWorker`'s uniqueness is only *per account*, so two
+     * accounts can sync at once. Each would snapshot the same global map and the
+     * later writer would discard the other's increments and resurrect the
+     * counters it had cleared. Re-reading inside `edit`, which DataStore
+     * serialises, keeps the read-modify-write atomic.
+     *
+     * @param updates counts to set, replacing any current value for those keys.
+     * @param cleared keys to remove outright, whatever they currently hold.
+     */
+    suspend fun merge(updates: Map<String, Int>, cleared: Set<String>) {
+        dataStore.edit { prefs ->
+            val current = decode(prefs[KEY].orEmpty()).toMutableMap()
+            current -= cleared
+            current += updates.filterValues { it > 0 }
+            prefs[KEY] = current
+                .map { (key, count) -> "$key$COUNT_SEPARATOR$count" }
+                .toSet()
+        }
+    }
+
+    /**
+     * Forgets every count belonging to [listIds].
+     *
+     * ⚠️ The keys are global, exactly like the cadence cursors cleared beside
+     * them. A list detached from a removed account and re-attached to a new one
+     * would otherwise inherit its old counters — and a resource already at
+     * [THRESHOLD] is skipped for ever, since a quarantined resource never
+     * succeeds and so never clears.
+     */
+    suspend fun forget(listIds: Set<Long>) {
+        if (listIds.isEmpty()) return
+        val prefixes = listIds.map { "$it|" }
+        dataStore.edit { prefs ->
+            val current = decode(prefs[KEY].orEmpty())
+                .filterKeys { key -> prefixes.none(key::startsWith) }
+            prefs[KEY] = current
+                .map { (key, count) -> "$key$COUNT_SEPARATOR$count" }
+                .toSet()
+        }
+    }
+
+    /**
+     * Clears the count for one resource in any of [listIds], so the next sync
+     * tries it again — the user's "retry" on a quarantined task.
+     */
+    suspend fun release(listIds: Set<Long>, href: String) {
+        val keys = listIds.map { key(it, href) }.toSet()
+        dataStore.edit { prefs ->
+            val current = decode(prefs[KEY].orEmpty())
+            if (current.keys.none { it in keys }) return@edit
+            prefs[KEY] = (current - keys)
+                .map { (key, count) -> "$key$COUNT_SEPARATOR$count" }
+                .toSet()
+        }
+    }
+
+    companion object {
+        /**
+         * Attempts before a resource is left alone.
+         *
+         * Three rather than one: a 502 from a reverse proxy mid-restart and a
+         * permanently malformed body arrive as the same outcome, and burning two
+         * extra runs is cheaper than quarantining a resource that would have
+         * worked.
+         */
+        const val THRESHOLD = 3
+
+        fun key(listId: Long, href: String) = "$listId|$href"
+
+        private const val COUNT_SEPARATOR = '#'
+        private val KEY = stringSetPreferencesKey("sync_quarantine")
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/RemoteListRepository.kt

@@ -0,0 +1,282 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import de.jeanlucmakiola.agendula.data.di.IoDispatcher
+import de.jeanlucmakiola.agendula.data.sync.RemoteLists.Outcome
+import de.jeanlucmakiola.agendula.data.sync.push.PushStore
+import de.jeanlucmakiola.agendula.data.tasks.ProviderResolver
+import de.jeanlucmakiola.agendula.data.tasks.StorageMode
+import de.jeanlucmakiola.agendula.data.tasks.room.AccountEntity
+import de.jeanlucmakiola.agendula.data.tasks.room.TaskListEntity
+import de.jeanlucmakiola.agendula.data.tasks.room.TasksDatabase
+import de.jeanlucmakiola.caldav.CalDavHttp
+import de.jeanlucmakiola.caldav.CollectionAdmin
+import de.jeanlucmakiola.caldav.CollectionOutcome
+import de.jeanlucmakiola.caldav.CollectionSupport
+import de.jeanlucmakiola.caldav.DavCollectionAdmin
+import de.jeanlucmakiola.caldav.ResourceNames
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.NonCancellable
+import kotlinx.coroutines.async
+import kotlinx.coroutines.awaitAll
+import kotlinx.coroutines.coroutineScope
+import kotlinx.coroutines.withContext
+import okhttp3.HttpUrl
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
+import okhttp3.OkHttpClient
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * Task lists that live on a server: making them, renaming them, recolouring
+ * them and deleting them.
+ *
+ * ⚠️ Every write here is **server first, Room second**, and that ordering is the
+ * whole design. The other way round gives the user a list that exists on their
+ * phone and nowhere else, and nothing to tell them so — `task_lists.is_dirty`
+ * was already set by a rename and read by nobody, which is precisely that
+ * failure with the evidence discarded. A refused write leaves the local row
+ * exactly as it was, so what is on screen is what is on the server.
+ *
+ * Device-only lists are not this class's business: they have no href, no
+ * account and nothing to ask permission of. [de.jeanlucmakiola.agendula.data.tasks.TasksRepository]
+ * keeps them.
+ */
+@Singleton
+class RemoteListRepository @Inject constructor(
+    private val database: TasksDatabase,
+    private val credentials: CredentialStore,
+    private val support: CollectionSupportStore,
+    private val syncTrigger: SyncTrigger,
+    private val cadence: SyncCadenceStore,
+    private val notices: SyncNoticeStore,
+    private val quarantine: QuarantineStore,
+    private val accountState: AccountStateStore,
+    private val resolver: ProviderResolver,
+    private val push: PushStore,
+    @IoDispatcher private val io: CoroutineDispatcher,
+) : RemoteLists {
+
+    /**
+     * The accounts a new list may be created on, freshest answer first.
+     *
+     * ⚠️ Re-asked rather than cached for ever. `CollectionSupportStore` holds
+     * the last answer so a picker can draw immediately, but a server that gained
+     * the capability in an upgrade — or lost it in a config change — must be
+     * able to say so, and the only moment that costs nothing is while the user
+     * is looking at the picker.
+     */
+    override suspend fun creatableAccounts(): List<AccountEntity> = withContext(io) {
+        // ⚠️ Empty in External mode, whatever the accounts table holds. The
+        // lists on screen then come from a third-party provider, so a row
+        // inserted into ours would exist, sync, and be visible to nobody.
+        if (resolver.mode() != StorageMode.OWN) return@withContext emptyList()
+        val stopped = accountState.needingSignIn()
+        val candidates = database.accounts().all().filter {
+            it.homeSetUrl?.toHttpUrlOrNull() != null && it.id !in stopped
+        }
+        // ⚠️ Together, not one after another. Each probe is a blocking OPTIONS,
+        // so three accounts with one server on a slow link held the "Where" row
+        // off the sheet for the sum of all three — with the sheet already drawn.
+        coroutineScope {
+            candidates.map { account -> async { account to supportFor(account) } }
+                .awaitAll()
+                .filter { (_, support) -> support.canCreate }
+                .map { (account, _) -> account }
+        }
+    }
+
+    /**
+     * Makes a collection on [accountId]'s home set and a row pointing at it.
+     *
+     * @return the new list's local id, or why there is none.
+     */
+    override suspend fun create(
+        accountId: Long,
+        name: String,
+        color: Int,
+    ): Outcome = withContext(io) {
+        // ⚠️ Re-checked here, not only in `creatableAccounts`. The picker's list
+        // is a StateFlow that outlives one opening of the sheet, so a mode that
+        // flips between the list being built and Save being tapped would
+        // otherwise create the collection on the server and file the row in a
+        // store External mode never reads.
+        if (resolver.mode() != StorageMode.OWN) return@withContext Outcome.NoAccount
+        val account = database.accounts().account(accountId) ?: return@withContext Outcome.NoAccount
+        val homeSet = account.homeSetUrl?.toHttpUrlOrNull()
+            ?: return@withContext Outcome.NoAccount
+        val admin = adminFor(account) ?: return@withContext Outcome.NoAccount
+        val capabilities = support.refresh(accountId) { admin.support(homeSet) }
+        if (!capabilities.canCreate) return@withContext Outcome.Unsupported
+
+        // ⚠️ A second attempt, but only for the one refusal a different name
+        // can fix. Nextcloud's trashbin *renames* a deleted collection rather
+        // than removing it, so re-creating under a segment used before answers
+        // 403 for ever — and "Shopping" is exactly the name someone deletes and
+        // remakes. Retrying anything else spends a second authenticated write
+        // that will fail the same way, and worse: a 401 is a second hit on the
+        // brute-force counter, and a 507 retried reports the wrong code back,
+        // since the caller only ever sees the *last* attempt's.
+        val first = ResourceNames.forCollection(name)
+        var created = admin.create(homeSet, first, name, color, capabilities)
+        if (created is CollectionOutcome.Refused && created.code in NAME_REFUSALS) {
+            created = admin.create(homeSet, ResourceNames.randomCollection(), name, color, capabilities)
+        }
+
+        when (created) {
+            is CollectionOutcome.Created -> {
+                // ⚠️ Uncancellable. The collection exists on the server from
+                // here on, and a cancellation between that and the row would
+                // leave one the app has no record of and no way to reach —
+                // visible only on the next full account re-add.
+                withContext(NonCancellable) {
+                    database.taskLists().insert(
+                        TaskListEntity(
+                            name = name,
+                            color = color,
+                            accountId = accountId,
+                            href = created.url.toString(),
+                        ),
+                    )
+                }
+                // The server has it and we do not; a sync is how the two agree
+                // on a ctag and a token rather than reconciling in full later.
+                syncTrigger.enqueue(account.displayName, expedited = true)
+                Outcome.Done
+            }
+
+            is CollectionOutcome.Refused -> Outcome.Refused(created.code)
+            is CollectionOutcome.Failed -> Outcome.Unreachable
+            CollectionOutcome.Unsupported -> Outcome.Unsupported
+            CollectionOutcome.Updated -> Outcome.Unexpected
+        }
+    }
+
+    /**
+     * Renames and recolours [listId] on the server, then locally.
+     *
+     * ⚠️ Refuses a read-only collection rather than discovering it at write
+     * time. A share the owner has made read-only answers 403 to a PROPPATCH, and
+     * a row that has already been renamed locally by then reads as a rename that
+     * worked and then quietly reverted on the next sync.
+     */
+    override suspend fun rename(listId: Long, name: String, color: Int): Outcome = withContext(io) {
+        val list = database.taskLists().entity(listId) ?: return@withContext Outcome.NoAccount
+        if (list.isReadOnly) return@withContext Outcome.ReadOnly
+        val url = list.href?.toHttpUrlOrNull() ?: return@withContext Outcome.NoAccount
+        val account = list.accountId?.let { database.accounts().account(it) }
+            ?: return@withContext Outcome.NoAccount
+        val admin = adminFor(account) ?: return@withContext Outcome.NoAccount
+
+        when (val outcome = admin.updateProperties(url, displayName = name, color = color)) {
+            CollectionOutcome.Updated -> {
+                withContext(NonCancellable) {
+                    // Read again inside the write: a sync running alongside this
+                    // may have refreshed the ACL flag or the cursor, and writing
+                    // back the entity we read before the network call would
+                    // revert it.
+                    val current = database.taskLists().entity(listId) ?: return@withContext
+                    database.taskLists().update(
+                        // isDirty stays false: the server already has this. The
+                        // flag existed for a PROPPATCH that never happened.
+                        current.copy(name = name, color = color, isDirty = false),
+                    )
+                }
+                Outcome.Done
+            }
+
+            is CollectionOutcome.Refused -> Outcome.Refused(outcome.code)
+            is CollectionOutcome.Failed -> Outcome.Unreachable
+            is CollectionOutcome.Created, CollectionOutcome.Unsupported -> Outcome.Unexpected
+        }
+    }
+
+    /**
+     * Deletes [listId] on the server, then on the device.
+     *
+     * ⚠️ The one write where "already gone" is success — [CollectionAdmin.delete]
+     * grades 404 and 410 that way — because otherwise a collection someone
+     * removed from another client leaves a row here that nothing can get rid of.
+     */
+    override suspend fun delete(listId: Long): Outcome = withContext(io) {
+        val list = database.taskLists().entity(listId) ?: return@withContext Outcome.Done
+        if (list.isReadOnly) return@withContext Outcome.ReadOnly
+        val url = list.href?.toHttpUrlOrNull() ?: return@withContext Outcome.NoAccount
+        val account = list.accountId?.let { database.accounts().account(it) }
+            ?: return@withContext Outcome.NoAccount
+        val admin = adminFor(account) ?: return@withContext Outcome.NoAccount
+
+        when (val outcome = admin.delete(url)) {
+            CollectionOutcome.Updated -> {
+                withContext(NonCancellable) {
+                    // `tasks.list_id` is ON DELETE CASCADE, so the tasks go with
+                    // it — which is what was just done on the server.
+                    database.taskLists().delete(listId)
+                    // And the per-list state keyed off it, exactly as removing an
+                    // account clears its lists': the ids are AUTOINCREMENT so
+                    // nothing would ever read these again. The notices go by
+                    // *name*, which is how they are keyed — a discarded-edit
+                    // notice would otherwise name a list that no longer exists
+                    // until the user tapped "Got it".
+                    forgetPerListState(listId)
+                    list.accountId?.let { notices.forgetList(it, list.name) }
+                }
+                Outcome.Done
+            }
+
+            is CollectionOutcome.Refused -> Outcome.Refused(outcome.code)
+            is CollectionOutcome.Failed -> Outcome.Unreachable
+            is CollectionOutcome.Created, CollectionOutcome.Unsupported -> Outcome.Unexpected
+        }
+    }
+
+    private suspend fun supportFor(account: AccountEntity): CollectionSupport {
+        val homeSet = account.homeSetUrl?.toHttpUrlOrNull() ?: return CollectionSupport.NONE
+        val admin = adminFor(account) ?: return CollectionSupport.NONE
+        return support.refresh(account.id) { admin.support(homeSet) }
+    }
+
+    /**
+     * Null when the account has no credential we can use — a stopped account, or
+     * a restore.
+     *
+     * ⚠️ The stopped check is the same one `SyncEngine.sync` makes before it
+     * touches the network, and for the same reason: Nextcloud's brute-force
+     * protection throttles and then **429s per source IP**, so spending a
+     * request on a credential we already know the server rejects lands on the
+     * user's *other* clients. Opening the "new list" sheet must not do that any
+     * more than a timer may.
+     */
+    private suspend fun adminFor(account: AccountEntity): CollectionAdmin? {
+        if (accountState.needsSignIn(account.id)) return null
+        val username = account.username ?: return null
+        val origin = account.principalUrl?.toHttpUrlOrNull() ?: return null
+        val password = (credentials.get(account.id) as? CredentialStore.Secret.Present)?.value
+            ?: return null
+        return DavCollectionAdmin(client(username, password, origin))
+    }
+
+    private fun client(username: String, password: String, origin: HttpUrl): OkHttpClient =
+        CalDavHttp.authenticated(USER_AGENT, username, password, origin)
+
+    private suspend fun forgetPerListState(listId: Long) {
+        val ids = setOf(listId)
+        cadence.forget(ids)
+        quarantine.forget(ids)
+        // The subscription went with the collection on the server.
+        push.forget(ids)
+    }
+
+    private companion object {
+        /** The same agent the sync and the add flow use, so the server names us once. */
+        const val USER_AGENT = "Agendula (Android)"
+
+        /**
+         * Refusals a different path segment can get past, and only those.
+         *
+         * 403 is Nextcloud's trashbin still holding the name; 405 is a server
+         * answering "already a collection there". Everything else — 401, 409,
+         * 423, 507 — means the same thing under any name.
+         */
+        val NAME_REFUSALS = setOf(403, 405)
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncAdapterService.kt

@@ -0,0 +1,96 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import android.accounts.Account
+import android.app.Service
+import android.content.AbstractThreadedSyncAdapter
+import android.content.ContentProviderClient
+import android.content.Context
+import android.content.Intent
+import android.content.SyncResult
+import android.os.Bundle
+import android.os.IBinder
+import androidx.work.WorkInfo
+import androidx.work.WorkManager
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeoutOrNull
+import kotlin.time.Duration.Companion.minutes
+
+/**
+ * The sync adapter whose entire job is to start a WorkManager job and wait.
+ *
+ * DAVx5's own comment describes the same design: *"We use the sync adapter
+ * framework only for the trigger, actual syncing is implemented with
+ * WorkManager."*
+ *
+ * ⚠️ Registering this is **not optional decoration**.
+ * `ContentService.hasAuthorityAccess()` gates `requestSync`,
+ * `setSyncAutomatically`, `addPeriodicSync`, `setIsSyncable`, `getSyncStatus` and
+ * seven more behind a compat change that is on for targetSdk ≥ 34 — which we
+ * are. With no sync adapter registered for our authority, every one of those
+ * calls **returns silently**: no exception, no log, and it passes on a
+ * Robolectric shadow. The visible result is an account permanently reading "Sync
+ * off for all items" with a greyed-out "Sync now", and it is documented on no
+ * Android behaviour-changes page.
+ *
+ * The greying-out is why the app ships its own sync button regardless:
+ * `enabledSyncNowMenu()` needs at least one checked authority switch, and ours
+ * is `userVisible="false"`.
+ */
+class SyncAdapterService : Service() {
+
+    private val adapter by lazy { CalDavSyncAdapter(applicationContext) }
+
+    override fun onBind(intent: Intent?): IBinder = adapter.syncAdapterBinder
+}
+
+private class CalDavSyncAdapter(context: Context) :
+    AbstractThreadedSyncAdapter(context, /* autoInitialize = */ true) {
+
+    override fun onPerformSync(
+        account: Account,
+        extras: Bundle,
+        authority: String,
+        provider: ContentProviderClient,
+        syncResult: SyncResult,
+    ) {
+        val workManager = WorkManager.getInstance(context)
+        val uniqueName = SyncTrigger(context).enqueue(account.name)
+
+        // Block this thread until the work reaches a terminal state. The framework
+        // treats onPerformSync returning as "the sync is done", so returning early
+        // would make every sync look instantaneous and defeat the back-off it
+        // applies on failure. runBlocking is fine here: onPerformSync is already
+        // called on a background thread the framework owns.
+        //
+        // ⚠️ Watch the **unique work name**, not the request id. enqueueUniqueWork
+        // is asynchronous — the WorkSpec row is not written by the time the next
+        // line runs — so a flow keyed on the id emits null for an unknown id and
+        // the wait returns immediately, having waited for nothing. And under
+        // KEEP, when a run is already in flight, our request is never enqueued at
+        // all and its id stays unknown forever. Keying on the name handles both:
+        // it waits for whichever run is actually happening.
+        val infos = runCatching {
+            runBlocking {
+                withTimeoutOrNull(WORKER_TIMEOUT_MINUTES.minutes) {
+                    workManager.getWorkInfosForUniqueWorkFlow(uniqueName)
+                        .first { infos -> infos.isNotEmpty() && infos.all { it.state.isFinished } }
+                }
+            }
+        }.getOrNull()
+
+        // Counted as a soft error: the engine's own per-collection and
+        // per-resource isolation decides what is actually fatal, and telling the
+        // framework otherwise would have it back off the whole account. Being
+        // deduplicated by KEEP is *not* a failure — the sync is happening, this
+        // trigger simply joined the one already running.
+        val timedOut = infos == null
+        val failed = infos?.any { it.state == WorkInfo.State.FAILED } == true
+        if (timedOut || failed) syncResult.stats.numIoExceptions++
+    }
+
+    private companion object {
+        /** DAVx5 uses the same ceiling; an ordinary worker is documented for < 10 min. */
+        const val WORKER_TIMEOUT_MINUTES = 10L
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncAuthenticator.kt

@@ -0,0 +1,109 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import android.accounts.AbstractAccountAuthenticator
+import android.accounts.Account
+import android.accounts.AccountAuthenticatorResponse
+import android.accounts.AccountManager
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.os.Bundle
+import android.os.IBinder
+
+/**
+ * The account authenticator.
+ *
+ * Agendula holds no auth tokens — a CalDAV account is a username and an app
+ * password, and the password lives in [CredentialStore], not here.
+ * `AccountManager` stores passwords as plain `TEXT`; there is no encryption or
+ * hashing anywhere in AOSP, so nothing secret is handed to it.
+ *
+ * It is **not** required by any
+ * provider — that argument was circular. The real reasons: a stable account
+ * identity a third-party engine could address, presence in system Settings, and
+ * the sync framework as a change trigger.
+ */
+class SyncAuthenticator(private val context: Context) : AbstractAccountAuthenticator(context) {
+
+    /**
+     * ⚠️ Refuses until the account-add UI exists.
+     *
+     * The authenticator service is exported and registered, so Settings →
+     * Accounts → Add account lists Agendula **today**. Handing back an intent to
+     * a screen that does not yet handle [ACTION_ADD_ACCOUNT] would open the
+     * ordinary home screen while Settings waits forever on a response nothing
+     * answers. A refusal the user can read is strictly better than a hang; 2d
+     * replaces this with the real intent and answers [response].
+     */
+    override fun addAccount(
+        response: AccountAuthenticatorResponse?,
+        accountType: String?,
+        authTokenType: String?,
+        requiredFeatures: Array<out String>?,
+        options: Bundle?,
+    ): Bundle = unsupported("Add a CalDAV account from inside Agendula, under Settings")
+
+    override fun editProperties(
+        response: AccountAuthenticatorResponse?,
+        accountType: String?,
+    ): Bundle = Bundle()
+
+    /**
+     * ⚠️ Never `null`. `AbstractAccountAuthenticator.Transport` reads a null
+     * return as "I will answer asynchronously via the response", and nothing here
+     * ever does — the caller's `AccountManagerFuture` would never complete.
+     */
+    override fun confirmCredentials(
+        response: AccountAuthenticatorResponse?,
+        account: Account?,
+        options: Bundle?,
+    ): Bundle = unsupported("Agendula does not confirm credentials from the system UI")
+
+    /** No token type: this is Basic/Digest against a CalDAV server. */
+    override fun getAuthToken(
+        response: AccountAuthenticatorResponse?,
+        account: Account?,
+        authTokenType: String?,
+        options: Bundle?,
+    ): Bundle = unsupported("Agendula accounts do not use auth tokens")
+
+    override fun getAuthTokenLabel(authTokenType: String?): String? = null
+
+    /** Never `null`, for the reason given on [confirmCredentials]. */
+    override fun updateCredentials(
+        response: AccountAuthenticatorResponse?,
+        account: Account?,
+        authTokenType: String?,
+        options: Bundle?,
+    ): Bundle = unsupported("Re-authenticate from inside Agendula, under Settings")
+
+    override fun hasFeatures(
+        response: AccountAuthenticatorResponse?,
+        account: Account?,
+        features: Array<out String>?,
+    ): Bundle = Bundle().apply { putBoolean(AccountManager.KEY_BOOLEAN_RESULT, false) }
+
+    private fun unsupported(message: String) = Bundle().apply {
+        putInt(AccountManager.KEY_ERROR_CODE, AccountManager.ERROR_CODE_UNSUPPORTED_OPERATION)
+        putString(AccountManager.KEY_ERROR_MESSAGE, message)
+    }
+
+    companion object {
+        /** Sent to `MainActivity` when the system asks us to add an account (chunk 2d). */
+        const val ACTION_ADD_ACCOUNT = "de.jeanlucmakiola.agendula.ADD_ACCOUNT"
+    }
+}
+
+/**
+ * Binds [SyncAuthenticator] for the system.
+ *
+ * Exported and guarded by `android.permission.ACCOUNT_MANAGER` — note that
+ * `android.permission.ACCOUNT_AUTHENTICATOR`, which the obvious guess would
+ * reach for, **does not exist**.
+ */
+class AuthenticatorService : Service() {
+
+    private val authenticator by lazy { SyncAuthenticator(this) }
+
+    override fun onBind(intent: Intent?): IBinder? = authenticator.iBinder
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncAvailability.kt

@@ -0,0 +1,32 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import de.jeanlucmakiola.agendula.data.prefs.SettingsPrefs
+import de.jeanlucmakiola.agendula.data.tasks.ProviderResolver
+import de.jeanlucmakiola.agendula.data.tasks.StorageMode
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.map
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * Whether CalDAV accounts can do anything right now.
+ *
+ * Sync writes into Agendula's own store. In External mode the screens read a
+ * third-party provider instead, so an account would sync into rows nobody sees.
+ * Read from the stored preference rather than [ProviderResolver.mode], which is
+ * only current once `StorageModeHolder` has mirrored it — and a worker can start
+ * before that.
+ */
+@Singleton
+class SyncAvailability @Inject constructor(
+    private val prefs: SettingsPrefs,
+    private val resolver: ProviderResolver,
+) {
+
+    suspend fun accountsUsable(): Boolean = observe().first()
+
+    fun observe(): Flow<Boolean> = prefs.storageMode.map { stored ->
+        (stored ?: resolver.autoMode()) == StorageMode.OWN
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncCadenceStore.kt

@@ -0,0 +1,92 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringSetPreferencesKey
+import de.jeanlucmakiola.agendula.data.di.SyncStateDataStore
+import kotlinx.coroutines.flow.first
+import javax.inject.Inject
+import javax.inject.Singleton
+import kotlin.time.Duration
+import kotlin.time.Duration.Companion.hours
+import kotlin.time.Instant
+
+/**
+ * When each collection was last reconciled against a full listing.
+ *
+ * ⚠️ This is the mitigation for the one RFC 6578 failure that has no signal at
+ * all: a token the server still accepts, over a change log it has already
+ * pruned, answers `207` with zero changes and no error. Nothing in the protocol
+ * distinguishes that from "nothing happened". The only defence is to stop
+ * trusting the token periodically and diff a real listing — so the full path is
+ * a permanent safety net, not a fallback, and this is its clock.
+ *
+ * Kept out of Room deliberately: it is scheduling bookkeeping, not user data,
+ * and it must never be part of a backup that could restore a stale "we checked
+ * recently" into a fresh install.
+ */
+@Singleton
+class SyncCadenceStore @Inject constructor(
+    @SyncStateDataStore private val dataStore: DataStore<Preferences>,
+) {
+
+    /**
+     * Last *scheduled* full reconciliation per list id.
+     *
+     * ⚠️ Not "the last time a full listing was read". A collection whose server
+     * has no `sync-collection` support reads one on every run, and recording
+     * each would keep this permanently fresh — so nothing hung off the periodic
+     * mark would ever come due again.
+     */
+    suspend fun lastFullSync(): Map<Long, Instant> =
+        dataStore.data.first()[KEY].orEmpty().mapNotNull { entry ->
+            val separator = entry.lastIndexOf(SEPARATOR)
+            if (separator <= 0) return@mapNotNull null
+            val id = entry.substring(0, separator).toLongOrNull() ?: return@mapNotNull null
+            val at = entry.substring(separator + 1).toLongOrNull() ?: return@mapNotNull null
+            id to Instant.fromEpochSeconds(at)
+        }.toMap()
+
+    /** Merges, rather than replacing, so concurrent accounts do not erase each other. */
+    suspend fun record(reconciled: Map<Long, Instant>) {
+        if (reconciled.isEmpty()) return
+        dataStore.edit { prefs ->
+            val current = prefs[KEY].orEmpty()
+                .mapNotNull { entry ->
+                    val separator = entry.lastIndexOf(SEPARATOR)
+                    if (separator <= 0) null else entry.substring(0, separator) to entry
+                }
+                .toMap()
+                .toMutableMap()
+            reconciled.forEach { (id, at) ->
+                current["$id"] = "$id$SEPARATOR${at.epochSeconds}"
+            }
+            prefs[KEY] = current.values.toSet()
+        }
+    }
+
+    /** Forgets a list, so a re-added account starts from a full reconciliation. */
+    suspend fun forget(listIds: Set<Long>) {
+        if (listIds.isEmpty()) return
+        dataStore.edit { prefs ->
+            prefs[KEY] = prefs[KEY].orEmpty().filterNot { entry ->
+                entry.substringBefore(SEPARATOR).toLongOrNull() in listIds
+            }.toSet()
+        }
+    }
+
+    companion object {
+        /**
+         * How long a sync token is trusted before a full listing is diffed anyway.
+         *
+         * Long enough that the incremental path still carries almost every sync,
+         * short enough that a silently pruned change log is a day's divergence
+         * rather than an indefinite one.
+         */
+        val FULL_RECONCILIATION_INTERVAL: Duration = 24.hours
+
+        private const val SEPARATOR = '@'
+        private val KEY = stringSetPreferencesKey("sync_last_full")
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncEngine.kt

@@ -0,0 +1,257 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import de.jeanlucmakiola.agendula.data.di.IoDispatcher
+import de.jeanlucmakiola.agendula.data.sync.push.PushRegistrar
+import de.jeanlucmakiola.agendula.data.tasks.room.AccountEntity
+import de.jeanlucmakiola.agendula.data.tasks.room.TasksDatabase
+import de.jeanlucmakiola.caldav.CalDavHttp
+import de.jeanlucmakiola.caldav.CalendarCollection
+import de.jeanlucmakiola.caldav.RemoteCalendar
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.withContext
+import okhttp3.HttpUrl
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * Syncs one account: every list it owns, against the collection each points at.
+ *
+ * ⚠️ **A failed collection must not fail the account.** One revoked share, one
+ * calendar the server 500s on, must not stop the other four from syncing — so
+ * every collection's outcome is a [SyncReport] rather than an exception, and the
+ * account's own result is the list of them.
+ */
+@Singleton
+class SyncEngine @Inject constructor(
+    private val database: TasksDatabase,
+    private val store: RoomSyncStore,
+    private val credentials: CredentialStore,
+    private val quarantine: QuarantineStore,
+    private val cadence: SyncCadenceStore,
+    private val accountState: AccountStateStore,
+    private val notices: SyncNoticeStore,
+    private val availability: SyncAvailability,
+    private val push: PushRegistrar,
+    @IoDispatcher private val io: CoroutineDispatcher,
+) {
+
+    /** Why an account could not be synced at all, as opposed to one of its lists. */
+    sealed interface Result {
+        data class Synced(
+            val reports: List<SyncReport>,
+            /**
+             * What this run destroyed or gave up on that was not already on
+             * record — the caller's cue to say so out loud.
+             */
+            val notices: List<SyncNotice> = emptyList(),
+        ) : Result
+
+        /** The credential is gone or undecryptable: only re-authentication helps. */
+        data class NeedsSignIn(val accountId: Long, val reason: String) : Result
+
+        data class Misconfigured(val reason: String) : Result
+
+        /** External storage mode: nothing reads what a sync would write, so none runs. */
+        data object Paused : Result
+    }
+
+    suspend fun sync(accountName: String): Result = withContext(io) {
+        if (!availability.accountsUsable()) return@withContext Result.Paused
+        val account = database.accounts().all().firstOrNull { it.displayName == accountName }
+            ?: return@withContext Result.Misconfigured("no such account: $accountName")
+
+        // ⚠️ Before anything reaches the network. A periodic request that outlives
+        // the stop — or a manual trigger on a stopped account — must not spend a
+        // request on a credential we already know the server rejects: Nextcloud
+        // throttles then 429s per source IP, and that lands on the user's other
+        // clients rather than on us.
+        if (accountState.needsSignIn(account.id)) {
+            return@withContext Result.NeedsSignIn(account.id, "waiting for you to sign in again")
+        }
+
+        val username = account.username
+            ?: return@withContext fatal(account.id, Result.Misconfigured("account has no username"))
+        val origin = account.principalUrl?.toHttpUrlOrNull()
+            ?: return@withContext fatal(
+                account.id,
+                Result.Misconfigured("account has no principal URL"),
+            )
+
+        val password = when (val secret = credentials.get(account.id)) {
+            is CredentialStore.Secret.Present -> secret.value
+            CredentialStore.Secret.Absent -> {
+                stopForSignIn(account.id, "no stored password")
+                return@withContext Result.NeedsSignIn(account.id, "no stored password")
+            }
+            is CredentialStore.Secret.Unrecoverable -> {
+                stopForSignIn(account.id, secret.reason)
+                return@withContext Result.NeedsSignIn(account.id, secret.reason)
+            }
+        }
+
+        val client = CalDavHttp.authenticated(USER_AGENT, username, password, origin)
+        val subscriptions = push.subscriptionsByHref(account.id)
+        val reports = syncCollections(account) { url ->
+            CalendarCollection(client, url, pushRegistration = subscriptions[url.toString()])
+        }
+
+        // ⚠️ Before the auth check, not after it. A 401 on one collection does
+        // not un-discard an edit another collection already destroyed, and
+        // returning NeedsSignIn past this point would drop the record of it.
+        // Outside `syncCollections` because that is driven without a network by
+        // the reconciliation tests, which have nothing to say about notices.
+        val fresh = notices.record(
+            accountId = account.id,
+            at = kotlin.time.Clock.System.now(),
+            reports = reports,
+            titles = quarantinedTitles(reports),
+        )
+
+        if (reports.any { it.authFailure }) {
+            // ⚠️ Stop the account rather than let the schedule keep trying.
+            // Nextcloud throttles and then 429s **per source IP**, so a timer on a
+            // dead app password degrades every other Nextcloud client on the
+            // user's network — and there is nothing here to retry: the fix is a
+            // sign-in only the user can perform.
+            stopForSignIn(account.id, "the server rejected the credentials")
+            return@withContext Result.NeedsSignIn(account.id, "the server rejected the credentials")
+        }
+
+        accountState.setNeedsSignIn(account.id, false)
+        // Never fails the sync: push is an optimisation on top of the schedule.
+        runCatching { push.onSynced(account, reports) }
+        Result.Synced(reports, fresh)
+    }
+
+    /**
+     * The local title of each quarantined resource, by href.
+     *
+     * ⚠️ Resolved here rather than left to the store, which has no database.
+     * Without it the user is told "a task has stopped syncing" over a row
+     * reading `a1f9c3e2-….ics` — the opaque blob `SyncNoticeStore` refuses to
+     * show for a discarded edit, and unactionable for exactly the same reason.
+     * A resource we have never stored has no title to find, and its filename is
+     * then genuinely all there is.
+     */
+    private fun quarantinedTitles(reports: List<SyncReport>): Map<String, String> =
+        reports.filter { it.quarantined.isNotEmpty() }
+            .flatMap { report ->
+                val wanted = report.quarantined.mapTo(mutableSetOf()) { it.href }
+                store.rowsIn(report.listId)
+                    .filter { it.href in wanted && !it.title.isNullOrBlank() }
+                    .map { it.href!! to it.title!! }
+            }
+            .toMap()
+
+    /**
+     * Records why the account could not be synced at all.
+     *
+     * ⚠️ Without this the row keeps its old `lastSyncAt`, and the accounts screen
+     * goes on reporting "synced 5 minutes ago" for an account whose credential
+     * can no longer be decrypted — the silent failure the account layer exists to
+     * avoid.
+     */
+    /**
+     * Marks an account as stopped until the user signs in again.
+     *
+     * ⚠️ It does **not** cancel the work, even though stopping the timer is the
+     * whole point — because this runs *inside* `SyncWorker`, and one of the two
+     * unique names it would cancel is the WorkSpec currently executing us.
+     * WorkManager would interrupt the coroutine, so `Result.NeedsSignIn` would
+     * never be returned and the adapter would see CANCELLED rather than FAILED.
+     *
+     * The flag does the work instead: [sync] refuses before touching the network,
+     * so a firing that survives costs nothing, and [AccountRepository.rescheduleAll]
+     * cancels the schedule from outside any worker.
+     */
+    private suspend fun stopForSignIn(accountId: Long, reason: String) {
+        accountState.setNeedsSignIn(accountId, true)
+        database.accounts().recordSync(accountId, at = null, error = reason)
+    }
+
+    private fun fatal(accountId: Long, result: Result): Result {
+        val reason = when (result) {
+            is Result.NeedsSignIn -> result.reason
+            is Result.Misconfigured -> result.reason
+            is Result.Synced, Result.Paused -> return result
+        }
+        database.accounts().recordSync(accountId, at = null, error = reason)
+        return result
+    }
+
+    /** Split out from [sync] so the reconciliation can be driven without a network. */
+    internal suspend fun syncCollections(
+        account: AccountEntity,
+        remoteFor: (HttpUrl) -> RemoteCalendar,
+    ): List<SyncReport> {
+        // Lists owing a DELETE first: a task moved between two of this account's
+        // collections then leaves the old one before it arrives in the new one,
+        // which a server that keeps UIDs unique per account needs.
+        val owing = database.tasks().listsWithTombstones().toSet()
+        val lists = database.taskLists().syncedForAccount(account.id)
+            .sortedBy { it.id !in owing }
+        val listIds = lists.map { it.id }.toSet()
+
+        // ⚠️ Only this account's keys are written back. The counts are global
+        // while the worker's uniqueness is only per account, so replacing the
+        // whole map would discard a concurrently syncing account's increments and
+        // resurrect the counters it had cleared.
+        val before = quarantine.counts()
+        val counts = before.toMutableMap()
+        val syncer = CollectionSyncer(store)
+
+        val now = kotlin.time.Clock.System.now()
+        val lastFull = cadence.lastFullSync()
+
+        // Never reconciled, or the token has been trusted long enough.
+        val due = lists.associate { list ->
+            val since = lastFull[list.id]
+            list.id to (since == null || now - since >= SyncCadenceStore.FULL_RECONCILIATION_INTERVAL)
+        }
+
+        val reports = lists.map { list ->
+            val url = list.href?.toHttpUrlOrNull()
+                ?: return@map SyncReport(list.id, list.name, failure = "list has no collection URL")
+            syncer.sync(
+                list = list,
+                remote = remoteFor(url),
+                quarantine = counts,
+                fullReconciliationDue = due[list.id] == true,
+            )
+        }
+
+        // ⚠️ Only the runs that were *due*. A server without `sync-collection`
+        // reconciles in full every single time, so recording each one kept the
+        // clock permanently fresh and `fullReconciliationDue` permanently false
+        // — which costs nothing on that path, since the cursor is null anyway,
+        // but silently disables everything else hung off the periodic mark. The
+        // download-side quarantine probe is the one that matters: for exactly
+        // those servers it would never have fired.
+        cadence.record(
+            reports.filter { it.reconciledInFull && it.failure == null && due[it.listId] == true }
+                .associate { it.listId to now },
+        )
+
+        fun mine(key: String) = key.substringBefore('|').toLongOrNull() in listIds
+        quarantine.merge(
+            updates = counts.filterKeys(::mine),
+            cleared = before.keys.filter(::mine).filterNot { it in counts }.toSet(),
+        )
+        database.accounts().recordSync(
+            accountId = account.id,
+            at = now,
+            error = reports.mapNotNull { it.failure }.firstOrNull(),
+        )
+        return reports
+    }
+
+    private companion object {
+        /**
+         * Matches what the account-add flow signed in with, so Nextcloud's
+         * Settings → Security → Devices & sessions keeps naming the app password
+         * after the app rather than after OkHttp.
+         */
+        const val USER_AGENT = "Agendula (Android)"
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncFailure.kt

@@ -0,0 +1,81 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+/**
+ * Why a sync failed, in classes a user can act on.
+ *
+ * `accounts.last_sync_error` holds the engine's own words — a collection
+ * failure wrapping an exception's `toString()` — which are for logs and never
+ * for the screen. This reads the class back out of them.
+ */
+data class SyncFailure(val kind: Kind, val httpCode: Int? = null) {
+
+    enum class Kind {
+        /** The server refused the credentials. */
+        SIGN_IN,
+
+        /** DNS, a refused connection, a timeout: nothing answered. */
+        UNREACHABLE,
+
+        /** The TLS handshake failed — an untrusted or mismatched certificate. */
+        CERTIFICATE,
+
+        /** The server answered, with an error of its own. */
+        SERVER,
+
+        /** The account or a list is missing something the sync needs. */
+        MISCONFIGURED,
+
+        /** Anything else: the collection did not finish, for a reason we do not name. */
+        OTHER,
+    }
+
+    companion object {
+
+        fun of(error: String): SyncFailure {
+            val code = HTTP_CODE.find(error)?.groupValues?.get(1)?.toIntOrNull()
+            return when {
+                TLS.any { it in error } -> SyncFailure(Kind.CERTIFICATE)
+                AUTH.any { it in error } || code == 401 -> SyncFailure(Kind.SIGN_IN)
+                NETWORK.any { it in error } -> SyncFailure(Kind.UNREACHABLE)
+                CONFIG.any { it in error } -> SyncFailure(Kind.MISCONFIGURED)
+                "ServiceUnavailableException" in error -> SyncFailure(Kind.SERVER, code ?: 503)
+                code != null -> SyncFailure(Kind.SERVER, code)
+                else -> SyncFailure(Kind.OTHER)
+            }
+        }
+
+        private val HTTP_CODE = Regex("""\bHTTP (\d{3})\b""")
+
+        private val TLS = listOf(
+            "SSLHandshakeException",
+            "SSLPeerUnverifiedException",
+            "CertPathValidatorException",
+            "CertificateException",
+            "SSLException",
+        )
+
+        private val AUTH = listOf(
+            "UnauthorizedException",
+            "rejected the credentials",
+            "no stored password",
+        )
+
+        private val NETWORK = listOf(
+            "UnknownHostException",
+            "ConnectException",
+            "NoRouteToHostException",
+            "SocketTimeoutException",
+            "InterruptedIOException",
+            "SocketException",
+            "EOFException",
+            "timeout",
+        )
+
+        private val CONFIG = listOf(
+            "no such account",
+            "has no username",
+            "has no principal URL",
+            "has no collection URL",
+        )
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncNoticeNotifier.kt

@@ -0,0 +1,189 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import android.Manifest
+import android.annotation.SuppressLint
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.os.Build
+import androidx.core.app.NotificationCompat
+import androidx.core.app.NotificationManagerCompat
+import androidx.core.content.ContextCompat
+import dagger.hilt.android.qualifiers.ApplicationContext
+import de.jeanlucmakiola.agendula.MainActivity
+import de.jeanlucmakiola.agendula.data.di.ChannelRefresher
+import de.jeanlucmakiola.agendula.R
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * Tells the user what a background sync destroyed or gave up on.
+ *
+ * ⚠️ A notification, and not only a row on the accounts screen. Sync runs on a
+ * four-hour timer while the app is closed, so a surface the user has to go and
+ * look at means the discarded edit is discovered — if ever — days later, next to
+ * a task that quietly says something else than what they typed. The account
+ * screen keeps the detail; this is what makes them go there.
+ *
+ * Its own channel, at `IMPORTANCE_LOW`: it is a report rather than an alarm, and
+ * it must be silenceable without taking due-task reminders with it.
+ */
+@Singleton
+class SyncNoticeNotifier @Inject constructor(
+    @ApplicationContext private val context: Context,
+) : ChannelRefresher {
+
+    fun canPost(): Boolean {
+        val granted = Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU ||
+            ContextCompat.checkSelfPermission(context, Manifest.permission.POST_NOTIFICATIONS) ==
+            PackageManager.PERMISSION_GRANTED
+        return granted && NotificationManagerCompat.from(context).areNotificationsEnabled()
+    }
+
+    // canPost() checks POST_NOTIFICATIONS before we ever call notify().
+    @SuppressLint("MissingPermission")
+    fun post(accountName: String, notices: List<SyncNotice>) {
+        if (notices.isEmpty() || !canPost()) return
+        ensureChannel()
+
+        val discarded = notices.count { it.kind == SyncNotice.Kind.DISCARDED_EDIT }
+        val quarantined = notices.size - discarded
+        // ⚠️ A discarded edit outranks a quarantine even when there are more
+        // quarantines, and the collapsed line says so. They are not equivalent:
+        // an edit that lost is work already destroyed and unrecoverable, while a
+        // quarantined task is a condition that persists and clears itself. The
+        // big text below lists both, in full, whichever headline was chosen.
+        val title = if (discarded > 0) {
+            context.resources.getQuantityString(
+                R.plurals.sync_notice_discarded_title, discarded, discarded,
+            )
+        } else {
+            context.resources.getQuantityString(
+                R.plurals.sync_notice_quarantined_title, quarantined, quarantined,
+            )
+        }
+
+        val notification = NotificationCompat.Builder(context, CHANNEL_ID)
+            .setSmallIcon(R.drawable.ic_notification)
+            .setContentTitle(title)
+            .setContentText(context.getString(R.string.sync_notice_body, accountName))
+            .setStyle(NotificationCompat.BigTextStyle().bigText(summaryOf(notices)))
+            .setCategory(NotificationCompat.CATEGORY_STATUS)
+            .setPriority(NotificationCompat.PRIORITY_LOW)
+            .setAutoCancel(true)
+            .setContentIntent(
+                PendingIntent.getActivity(
+                    context,
+                    accountName.hashCode(),
+                    MainActivity.openIntent(context),
+                    PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+                ),
+            )
+            .build()
+
+        // Tagged by account, so a second account's news replaces nothing.
+        NotificationManagerCompat.from(context).notify(accountName, NOTIFICATION_ID, notification)
+    }
+
+    /** "Sign in to <account> again", for a background sync the server refused. */
+    // canPost() checks POST_NOTIFICATIONS before we ever call notify().
+    @SuppressLint("MissingPermission")
+    fun postSignIn(accountName: String, accountId: Long) {
+        if (!canPost()) return
+        ensureSignInChannel()
+        val body = context.getString(R.string.sync_sign_in_body)
+        val notification = NotificationCompat.Builder(context, SIGN_IN_CHANNEL_ID)
+            .setSmallIcon(R.drawable.ic_notification)
+            .setContentTitle(context.getString(R.string.sync_sign_in_title, accountName))
+            .setContentText(body)
+            .setStyle(NotificationCompat.BigTextStyle().bigText(body))
+            .setCategory(NotificationCompat.CATEGORY_ERROR)
+            .setAutoCancel(true)
+            .setContentIntent(
+                PendingIntent.getActivity(
+                    context,
+                    accountId.toInt(),
+                    signInIntent(accountId),
+                    PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+                ),
+            )
+            .build()
+        NotificationManagerCompat.from(context).notify(accountName, SIGN_IN_NOTIFICATION_ID, notification)
+    }
+
+    /** The account syncs again, so the prompt has done its job. */
+    fun cancelSignIn(accountName: String) {
+        NotificationManagerCompat.from(context).cancel(accountName, SIGN_IN_NOTIFICATION_ID)
+    }
+
+    /**
+     * Where tapping the sign-in prompt lands. Only opens the app for now; the
+     * extra names the account for routing to Settings → Accounts → it.
+     */
+    private fun signInIntent(accountId: Long): Intent =
+        MainActivity.openIntent(context).putExtra(MainActivity.EXTRA_SIGN_IN_ACCOUNT_ID, accountId)
+
+    private fun ensureSignInChannel() {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) return
+        val manager = context.getSystemService(NotificationManager::class.java)
+        if (manager.getNotificationChannel(SIGN_IN_CHANNEL_ID) != null) return
+        manager.createNotificationChannel(
+            NotificationChannel(
+                SIGN_IN_CHANNEL_ID,
+                context.getString(R.string.sync_sign_in_channel_name),
+                NotificationManager.IMPORTANCE_DEFAULT,
+            ).apply { description = context.getString(R.string.sync_sign_in_channel_desc) },
+        )
+    }
+
+    /**
+     * The first few, by name.
+     *
+     * ⚠️ A count on its own is unactionable — "3 edits were replaced" leaves the
+     * user to guess which three, across every list they own. The names are the
+     * only part that makes the account screen worth opening.
+     */
+    private fun summaryOf(notices: List<SyncNotice>): String {
+        val named = notices.take(SUMMARY_LIMIT).joinToString("\n") { notice ->
+            val subject = notice.subject.ifBlank { context.getString(R.string.task_untitled) }
+            context.getString(R.string.sync_notice_line, subject, notice.listName)
+        }
+        val rest = notices.size - SUMMARY_LIMIT
+        return if (rest > 0) {
+            named + "\n" + context.resources.getQuantityString(R.plurals.sync_notice_more, rest, rest)
+        } else {
+            named
+        }
+    }
+
+    private fun ensureChannel() {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) return
+        context.getSystemService(NotificationManager::class.java).createNotificationChannel(
+            NotificationChannel(
+                CHANNEL_ID,
+                context.getString(R.string.sync_notice_channel_name),
+                NotificationManager.IMPORTANCE_LOW,
+            ).apply { description = context.getString(R.string.sync_notice_channel_desc) },
+        )
+    }
+
+    /** Re-create the channel, if it exists, in the current language. */
+    override fun refreshChannel() {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) return
+        val manager = context.getSystemService(NotificationManager::class.java)
+        if (manager.getNotificationChannel(CHANNEL_ID) != null) ensureChannel()
+    }
+
+    companion object {
+        private const val CHANNEL_ID = "sync_notices"
+        private const val NOTIFICATION_ID = 2
+        private const val SIGN_IN_CHANNEL_ID = "account_sign_in"
+        private const val SIGN_IN_NOTIFICATION_ID = 3
+
+        /** Enough to recognise the work; the screen has the rest. */
+        private const val SUMMARY_LIMIT = 5
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncNoticeStore.kt

@@ -0,0 +1,279 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringSetPreferencesKey
+import de.jeanlucmakiola.agendula.data.di.SyncStateDataStore
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.map
+import java.util.Base64
+import javax.inject.Inject
+import javax.inject.Singleton
+import kotlin.time.Instant
+
+/**
+ * One thing a sync did that the user would not otherwise find out about.
+ *
+ * ⚠️ Conflict policy is **server wins, local edit discarded**, and
+ * [SyncReport]'s own doc says the report is "the other half of the decision, not
+ * a nice-to-have". Until this existed the other half was a `Log.i` — the edit was
+ * gone, nothing in `ui/` read `discardedEdits`, and from where the user sits that
+ * is indistinguishable from the app losing their work.
+ */
+data class SyncNotice(
+    val accountId: Long,
+    val listName: String,
+    val kind: Kind,
+    /** The task's title for a discarded edit, the resource's name for a quarantine. */
+    val subject: String,
+    /**
+     * What makes this notice distinct from another about a different task.
+     *
+     * ⚠️ Carried but never shown. These are stored as a `Set<String>`, and two
+     * discarded edits from one run share an account, a list, a cause and a
+     * timestamp — so two *untitled* tasks, or two both called "Milk", encoded
+     * identically and one of them silently vanished. The notification counted
+     * two and the screen listed one. The UID is the only thing that tells them
+     * apart, and it is exactly what must not reach the user: opaque text chosen
+     * by whoever created the task.
+     */
+    val key: String,
+    /** Why the edit lost. Null for a quarantine, which has no such choice behind it. */
+    val cause: DiscardedEdit.Cause?,
+    val at: Instant,
+) {
+    enum class Kind { DISCARDED_EDIT, QUARANTINED }
+}
+
+/**
+ * What the last syncs destroyed or gave up on, per account, until it is read.
+ *
+ * The two kinds keep different company, which is why they are written
+ * differently:
+ *
+ * - A **discarded edit** is news. It happened once, it cannot be undone, and a
+ *   later clean sync does not make it untrue — so it accumulates and is cleared
+ *   only by the user acknowledging it. Replacing the set every run would let a
+ *   quiet sync an hour later erase the one thing worth saying.
+ * - A **quarantined resource** is a standing condition: one task has stopped
+ *   syncing while the rest of its list is fine. It is re-reported on every run
+ *   for as long as it holds, so the account's set of them is *replaced* each
+ *   time — which is also how it clears itself the moment the resource starts
+ *   working again.
+ *
+ * Lives with the other per-device sync state, and is therefore excluded from
+ * backup — see [SyncStateDataStore]. Correct on its own terms too: a restored
+ * device has not discarded anything.
+ */
+@Singleton
+class SyncNoticeStore @Inject constructor(
+    @SyncStateDataStore private val dataStore: DataStore<Preferences>,
+) {
+
+    /** Observed, so a background sync's news reaches a screen that is already open. */
+    fun observeAll(): Flow<List<SyncNotice>> = dataStore.data.map { prefs ->
+        prefs[KEY].orEmpty().mapNotNull(::decode).sortedByDescending { it.at }
+    }
+
+    /**
+     * Folds one account's run into the store.
+     *
+     * @return only what is **new**, which is what a notification may be posted
+     *   for. A quarantine already on record is a condition the user has already
+     *   been told about, and re-announcing it on every four-hour run would train
+     *   them to ignore the one that matters.
+     */
+    /**
+     * @param titles the local title of each quarantined resource, by href.
+     *   ⚠️ Not optional decoration. Without it the row read
+     *   `a1f9c3e2-….ics`, which is the opaque blob this file refuses to show
+     *   for a discarded edit — and "a task has stopped syncing" that does not
+     *   say which task is the very failure the feature exists to fix. Absent
+     *   only for a resource we never stored, where the filename is genuinely
+     *   all there is.
+     */
+    suspend fun record(
+        accountId: Long,
+        at: Instant,
+        reports: List<SyncReport>,
+        titles: Map<String, String> = emptyMap(),
+    ): List<SyncNotice> {
+        val discarded = reports.flatMap { report ->
+            report.discardedEdits.map { edit ->
+                SyncNotice(
+                    accountId = accountId,
+                    listName = report.listName,
+                    kind = SyncNotice.Kind.DISCARDED_EDIT,
+                    // The UID is not shown to anyone: it is opaque text chosen by
+                    // whoever created the task, routinely a bare hex blob.
+                    subject = edit.title.orEmpty(),
+                    key = edit.uid,
+                    cause = edit.cause,
+                    at = at,
+                )
+            }
+        }
+        // ⚠️ Only the ones that have actually stopped. Below the threshold the
+        // resource is still being retried, and "one of your tasks has stopped
+        // syncing" would be untrue of a single 502 from a proxy mid-restart.
+        val quarantined = reports.flatMap { report ->
+            report.quarantined
+                .filter { it.failures >= QuarantineStore.THRESHOLD }
+                .map { resource ->
+                    SyncNotice(
+                        accountId = accountId,
+                        listName = report.listName,
+                        kind = SyncNotice.Kind.QUARANTINED,
+                        subject = titles[resource.href] ?: resource.href.substringAfterLast('/'),
+                        key = resource.href,
+                        cause = null,
+                        at = at,
+                    )
+                }
+        }
+
+        // ⚠️ Nothing to say is the overwhelmingly common case — most syncs
+        // discard nothing and quarantine nothing — and a DataStore edit rewrites
+        // and fsyncs the whole file. Skipped only when there is also nothing on
+        // record to clear, or a recovered resource would keep its notice for ever.
+        if (discarded.isEmpty() && quarantined.isEmpty() && !hasRecord(accountId)) {
+            return emptyList()
+        }
+
+        var added = emptyList<SyncNotice>()
+        dataStore.edit { prefs ->
+            // ⚠️ Re-read inside `edit`, which DataStore serialises. The set is
+            // global while `SyncWorker`'s uniqueness is only per account, so two
+            // accounts can be folding in at once and a snapshot taken outside
+            // would discard the other's.
+            val current = prefs[KEY].orEmpty().mapNotNull(::decode)
+            val others = current.filter { it.accountId != accountId }
+            val keptDiscards = current.filter {
+                it.accountId == accountId && it.kind == SyncNotice.Kind.DISCARDED_EDIT
+            }
+            val standing = current.filter {
+                it.accountId == accountId && it.kind == SyncNotice.Kind.QUARANTINED
+            }
+            added = discarded + quarantined.filterNot { fresh ->
+                standing.any { it.key == fresh.key }
+            }
+            // Newest first, then capped: an account that has been failing for a
+            // week must not grow this without bound, and the oldest news is the
+            // least actionable.
+            val kept = (discarded + keptDiscards).sortedByDescending { it.at }.take(MAX_PER_ACCOUNT)
+            // ⚠️ Capped as well, and the class doc used to claim it did not need
+            // to be. "Bounded by the collection" is only true of a healthy one:
+            // a server answering 415 to four hundred resources puts four hundred
+            // entries in one preference key, rewritten on every run — and the
+            // account screen renders them into a plain scrolling column.
+            val standingNow = quarantined.take(MAX_PER_ACCOUNT)
+            val updated = (others + kept + standingNow).map(::encode).toSet()
+            // ⚠️ Only when it differs. A DataStore edit rewrites and fsyncs the
+            // whole file, and an account holding one un-dismissed notice would
+            // otherwise pay that on every four-hour sync until the user tapped
+            // "Got it" — which is the cost the fast path above claims to avoid.
+            if (updated != prefs[KEY]) prefs[KEY] = updated
+        }
+        return added
+    }
+
+    private suspend fun hasRecord(accountId: Long): Boolean =
+        dataStore.data.first().let { prefs ->
+            prefs[KEY].orEmpty().mapNotNull(::decode).any { it.accountId == accountId }
+        }
+
+    /**
+     * Forgets one list's notices, for a list that has just been deleted.
+     *
+     * By name, because that is how they are keyed — there is no list id in a
+     * notice, and by the time this is called the row it would have named is
+     * already gone.
+     */
+    suspend fun forgetList(accountId: Long, listName: String) {
+        dataStore.edit { prefs ->
+            val kept = prefs[KEY].orEmpty()
+                .mapNotNull(::decode)
+                .filterNot { it.accountId == accountId && it.listName == listName }
+                .map(::encode)
+                .toSet()
+            if (kept != prefs[KEY]) prefs[KEY] = kept
+        }
+    }
+
+    /** Drops one quarantine notice, for a resource the user has asked to retry. */
+    suspend fun forgetQuarantined(accountId: Long, key: String) {
+        dataStore.edit { prefs ->
+            val kept = prefs[KEY].orEmpty()
+                .mapNotNull(::decode)
+                .filterNot {
+                    it.accountId == accountId && it.kind == SyncNotice.Kind.QUARANTINED && it.key == key
+                }
+                .map(::encode)
+                .toSet()
+            if (kept != prefs[KEY]) prefs[KEY] = kept
+        }
+    }
+
+    /** The user has read them. */
+    suspend fun dismiss(accountId: Long) {
+        dataStore.edit { prefs ->
+            prefs[KEY] = prefs[KEY].orEmpty()
+                .mapNotNull(::decode)
+                .filterNot { it.accountId == accountId }
+                .map(::encode)
+                .toSet()
+        }
+    }
+
+    /**
+     * ⚠️ Base64 around the free text, not a delimiter and a hope. A list is
+     * named by its owner and a task is titled by its author, so both can hold
+     * any character at all — including whatever separator looked safe.
+     */
+    private fun encode(notice: SyncNotice): String = listOf(
+        notice.accountId.toString(),
+        notice.kind.name,
+        notice.cause?.name.orEmpty(),
+        notice.at.toEpochMilliseconds().toString(),
+        base64(notice.listName),
+        base64(notice.subject),
+        base64(notice.key),
+    ).joinToString(SEPARATOR)
+
+    private fun decode(entry: String): SyncNotice? {
+        val parts = entry.split(SEPARATOR)
+        if (parts.size != FIELDS) return null
+        val accountId = parts[0].toLongOrNull() ?: return null
+        val kind = SyncNotice.Kind.entries.firstOrNull { it.name == parts[1] } ?: return null
+        val at = parts[3].toLongOrNull() ?: return null
+        return SyncNotice(
+            accountId = accountId,
+            listName = unBase64(parts[4]) ?: return null,
+            kind = kind,
+            subject = unBase64(parts[5]) ?: return null,
+            key = unBase64(parts[6]) ?: return null,
+            cause = DiscardedEdit.Cause.entries.firstOrNull { it.name == parts[2] },
+            at = Instant.fromEpochMilliseconds(at),
+        )
+    }
+
+    private fun base64(value: String): String =
+        Base64.getUrlEncoder().encodeToString(value.toByteArray(Charsets.UTF_8))
+
+    private fun unBase64(value: String): String? = runCatching {
+        String(Base64.getUrlDecoder().decode(value), Charsets.UTF_8)
+    }.getOrNull()
+
+    private companion object {
+        val KEY = stringSetPreferencesKey("sync_notices")
+
+        /** Not present in URL-safe Base64, nor in a decimal or an enum name. */
+        const val SEPARATOR = "|"
+        const val FIELDS = 7
+
+        /** Discarded edits, per account. Quarantines are bounded by the collection. */
+        const val MAX_PER_ACCOUNT = 50
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncOnEdit.kt

@@ -0,0 +1,37 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import android.util.Log
+import de.jeanlucmakiola.agendula.data.tasks.room.LocalWriteListener
+import de.jeanlucmakiola.agendula.data.tasks.room.TasksDatabase
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * Pushes a local edit to its account soon after it is made.
+ *
+ * Hooked into the store's own write paths rather than Room's invalidation
+ * tracker: sync writes the same tables, and an observer cannot tell its own
+ * downloads from the user's edits.
+ */
+@Singleton
+class SyncOnEdit @Inject constructor(
+    private val database: TasksDatabase,
+    private val trigger: SyncTrigger,
+) : LocalWriteListener {
+
+    override fun onWritten(listIds: Set<Long>) {
+        try {
+            listIds.mapNotNull { database.taskLists().entity(it)?.accountId }
+                .toSet()
+                .mapNotNull { database.accounts().account(it)?.displayName }
+                .forEach(trigger::pushSoon)
+        } catch (e: Exception) {
+            // The edit is saved either way; the schedule picks it up later.
+            Log.w(TAG, "could not schedule a push", e)
+        }
+    }
+
+    private companion object {
+        const val TAG = "SyncOnEdit"
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncPushWorker.kt

@@ -0,0 +1,27 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import android.content.Context
+import androidx.hilt.work.HiltWorker
+import androidx.work.CoroutineWorker
+import androidx.work.WorkerParameters
+import dagger.assisted.Assisted
+import dagger.assisted.AssistedInject
+
+/**
+ * The end of [SyncTrigger.pushSoon]'s debounce: hands the account to a real
+ * sync. Instant, so the REPLACE that restarts the debounce only ever cancels a
+ * timer.
+ */
+@HiltWorker
+class SyncPushWorker @AssistedInject constructor(
+    @Assisted context: Context,
+    @Assisted parameters: WorkerParameters,
+    private val trigger: SyncTrigger,
+) : CoroutineWorker(context, parameters) {
+
+    override suspend fun doWork(): Result {
+        val accountName = inputData.getString(SyncWorker.KEY_ACCOUNT_NAME) ?: return Result.failure()
+        trigger.enqueueAfterRunning(accountName)
+        return Result.success()
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncReport.kt

@@ -0,0 +1,105 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import de.jeanlucmakiola.caldav.PushSupport
+
+/**
+ * What a sync did, and — the part that matters — what it destroyed.
+ *
+ * ⚠️ Conflict policy is **server wins, local edit discarded**.
+ * That policy terminates, which is why it was chosen over forking under a new
+ * UID, but on its own it is indistinguishable from data loss: the user's edit is
+ * gone and nothing said so. The report is the other half of the decision, not a
+ * nice-to-have — [discardedEdits] is why this type exists.
+ */
+data class SyncReport(
+    val listId: Long,
+    val listName: String,
+    val downloaded: Int = 0,
+    val uploaded: Int = 0,
+    val deletedRemotely: Int = 0,
+    val deletedLocally: Int = 0,
+    /** Local edits thrown away because the server's copy was newer. */
+    val discardedEdits: List<DiscardedEdit> = emptyList(),
+    /** Resources the collection gave up on, so the rest of it could finish. */
+    val quarantined: List<QuarantinedResource> = emptyList(),
+    /**
+     * Writes sent without `If-Match` because the server offers no usable
+     * validator. Not an error, but the one case where a concurrent edit can be
+     * overwritten without us noticing, so it is said out loud.
+     */
+    val unconditionalWrites: Int = 0,
+    /**
+     * Whether this run reconciled against a full listing rather than a change log.
+     *
+     * ⚠️ Tracked because a token the server accepts over a change log it has
+     * already pruned returns 207, zero changes and no error — RFC 6578 gives no
+     * signal for it at all. The only mitigation is to reconcile in full on a slow
+     * cadence regardless of the token, which means knowing when we last did.
+     */
+    val reconciledInFull: Boolean = false,
+    /**
+     * Why the change-log path was abandoned, on a run the full path then
+     * completed.
+     *
+     * Not a [failure]: the collection is reconciled and the user has nothing to
+     * act on. Kept because a server that rejects `sync-collection` every time
+     * will do it again, and that is worth seeing in a log without it becoming an
+     * error in the UI.
+     */
+    val incrementalNote: String? = null,
+    /**
+     * The server refused our credentials.
+     *
+     * ⚠️ Escalates to the whole account and stops it, unlike every other failure
+     * here. Nextcloud's brute-force protection throttles and then **429s per
+     * source IP**, so a client that keeps retrying a dead app password on a timer
+     * takes the user's *other* Nextcloud clients down with it, on that network,
+     * and looks from the outside like we broke their server. There is nothing to
+     * retry anyway: only the user can fix it.
+     */
+    val authFailure: Boolean = false,
+    /** Set when the collection failed as a whole. The account keeps going. */
+    val failure: String? = null,
+    /**
+     * The collection's own properties were read this run, so [pushSupport] is
+     * the server's answer rather than the absence of one.
+     */
+    val collectionRead: Boolean = false,
+    /** WebDAV-Push, as the collection offered it this run. */
+    val pushSupport: PushSupport? = null,
+) {
+    val hadWork: Boolean
+        get() = downloaded > 0 || uploaded > 0 || deletedRemotely > 0 || deletedLocally > 0
+}
+
+/** One local edit that lost to the server. */
+data class DiscardedEdit(
+    val uid: String,
+    val title: String?,
+    val cause: Cause,
+) {
+    enum class Cause {
+        /** The server's copy changed after we last read it. */
+        SERVER_NEWER,
+
+        /** The task was deleted on the server while it was edited here. */
+        DELETED_ON_SERVER,
+
+        /** Deleted here, but changed on the server after that. The delete lost. */
+        DELETE_LOST,
+    }
+}
+
+/**
+ * A resource the collection stopped trying.
+ *
+ * ⚠️ Quarantine is a **counter, not a backoff**. A single HTTP 400 on one
+ * resource has halted all of a user's calendar sync in DAVx5 for weeks; the
+ * failure has to be contained to the resource that caused it, and the rest of
+ * the collection has to complete.
+ */
+data class QuarantinedResource(
+    val href: String,
+    val reason: String,
+    val failures: Int,
+)

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncStore.kt

@@ -0,0 +1,88 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import de.jeanlucmakiola.agendula.data.tasks.room.TaskEntity
+import de.jeanlucmakiola.agendula.data.tasks.room.TasksDatabase
+import javax.inject.Inject
+
+/**
+ * The database, as [CollectionSyncer] needs it.
+ *
+ * A seam, and the reason is the same one that put [CalDavGateway] in front of
+ * discovery: the reconciliation above this interface is where local edits are
+ * discarded, tombstones swept and conflicts resolved, and every one of those is
+ * a decision that should be provable without a device. Room's test double is
+ * Robolectric plus an in-memory database; this is eight methods.
+ */
+interface SyncStore {
+
+    /** Every row in a list, **tombstones included**. */
+    fun rowsIn(listId: Long): List<TaskEntity>
+
+    fun insert(row: TaskEntity): Long
+
+    fun update(row: TaskEntity)
+
+    fun deleteAll(taskIds: List<Long>)
+
+    /**
+     * Records href and ETag on a resource's rows, clearing `is_dirty`.
+     *
+     * The caller excludes any row it left out of the body — that row is deleted,
+     * not marked synced.
+     */
+    fun markSynced(taskIds: List<Long>, href: String?, eTag: String?)
+
+    fun setParent(taskId: Long, parentId: Long?)
+
+    /** The master row for a UID — the one with no `RECURRENCE-ID`. */
+    fun masterByUid(listId: Long, uid: String): TaskEntity?
+
+    fun row(taskId: Long): TaskEntity?
+
+    /**
+     * One column, deliberately. A whole-entity update would carry the row as it
+     * looked when the sync started and revert anything the user changed while it
+     * ran.
+     */
+    fun setListReadOnly(listId: Long, readOnly: Boolean)
+
+    /** The RFC 6578 cursor. Null resets the collection to a full reconciliation. */
+    fun setSyncToken(listId: Long, token: String?)
+}
+
+class RoomSyncStore @Inject constructor(
+    private val database: TasksDatabase,
+) : SyncStore {
+
+    override fun rowsIn(listId: Long) = database.tasks().allIn(listId)
+
+    override fun insert(row: TaskEntity) = database.tasks().insert(row)
+
+    override fun update(row: TaskEntity) {
+        database.tasks().update(row)
+    }
+
+    override fun deleteAll(taskIds: List<Long>) {
+        if (taskIds.isNotEmpty()) database.tasks().deleteAll(taskIds)
+    }
+
+    override fun markSynced(taskIds: List<Long>, href: String?, eTag: String?) {
+        if (taskIds.isNotEmpty()) database.tasks().markSynced(taskIds, href, eTag)
+    }
+
+    override fun setParent(taskId: Long, parentId: Long?) {
+        database.tasks().setParent(taskId, parentId)
+    }
+
+    override fun masterByUid(listId: Long, uid: String) = database.tasks().byUid(listId, uid)
+
+    override fun row(taskId: Long) = database.tasks().entity(taskId)
+
+    override fun setListReadOnly(listId: Long, readOnly: Boolean) {
+        database.taskLists().setReadOnly(listId, readOnly)
+    }
+
+    override fun setSyncToken(listId: Long, token: String?) {
+        database.taskLists().setSyncToken(listId, token)
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncStubProvider.kt

@@ -0,0 +1,52 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import android.content.ContentProvider
+import android.content.ContentValues
+import android.database.Cursor
+import android.net.Uri
+
+/**
+ * A `ContentProvider` that stores nothing.
+ *
+ * It exists because **a sync adapter is registered against a content
+ * authority**, and Agendula publishes no provider — `:provider` was deleted when
+ * we took our own Room store. Without an authority there
+ * is nothing for `<sync-adapter android:contentAuthority>` to name, nothing for
+ * `ContentResolver.requestSync` to address, and nothing for system Settings to
+ * render a sync switch against.
+ *
+ * The sync-adapter registration is not optional:
+ * `ContentService.hasAuthorityAccess()` gates `requestSync`,
+ * `setSyncAutomatically`, `addPeriodicSync`, `setIsSyncable` and seven more
+ * behind a compat change that is **on for targetSdk ≥ 34**, and with nothing
+ * registered every one of those calls returns silently — no exception, no log,
+ * and it passes on a Robolectric shadow. This provider is the cheapest way to
+ * hold up the other end of that requirement.
+ *
+ * Not exported, and every method is a no-op. Real data lives in Room.
+ */
+class SyncStubProvider : ContentProvider() {
+
+    override fun onCreate() = true
+
+    override fun query(
+        uri: Uri,
+        projection: Array<out String>?,
+        selection: String?,
+        selectionArgs: Array<out String>?,
+        sortOrder: String?,
+    ): Cursor? = null
+
+    override fun getType(uri: Uri): String? = null
+
+    override fun insert(uri: Uri, values: ContentValues?): Uri? = null
+
+    override fun delete(uri: Uri, selection: String?, selectionArgs: Array<out String>?) = 0
+
+    override fun update(
+        uri: Uri,
+        values: ContentValues?,
+        selection: String?,
+        selectionArgs: Array<out String>?,
+    ) = 0
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncTrigger.kt

@@ -0,0 +1,205 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import android.content.Context
+import androidx.work.Constraints
+import androidx.work.Data
+import androidx.work.ExistingPeriodicWorkPolicy
+import androidx.work.ExistingWorkPolicy
+import androidx.work.NetworkType
+import androidx.work.OneTimeWorkRequestBuilder
+import androidx.work.OutOfQuotaPolicy
+import androidx.work.PeriodicWorkRequestBuilder
+import androidx.work.WorkInfo
+import androidx.work.WorkManager
+import dagger.hilt.android.qualifiers.ApplicationContext
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import java.util.concurrent.TimeUnit
+import javax.inject.Inject
+import javax.inject.Singleton
+import kotlin.time.Duration
+import kotlin.time.Duration.Companion.hours
+import kotlin.time.Duration.Companion.minutes
+import kotlin.time.Duration.Companion.seconds
+
+/**
+ * Starts a sync for one account.
+ *
+ * Shared by the sync adapter and by the app's own "sync now", because the app
+ * cannot rely on the system trigger: ⚠️ `ContentService.hasAuthorityAccess()`
+ * gates `requestSync` behind a compat change that is on at targetSdk ≥ 34, and
+ * our authority is `userVisible="false"`, so Settings greys "Sync now" out. The
+ * in-app button enqueues the work directly and is unaffected.
+ */
+@Singleton
+class SyncTrigger @Inject constructor(
+    @ApplicationContext private val context: Context,
+) : SyncRequests {
+
+    override fun syncNow(accountName: String) {
+        enqueue(accountName)
+    }
+
+    /**
+     * Starts a sync now.
+     *
+     * @param expedited for a trigger the user is looking at. ⚠️ Paired with
+     *   `RUN_AS_NON_EXPEDITED_WORK_REQUEST`, which is not optional: the expedited
+     *   quota is per-app and exhaustible, and the alternative policy
+     *   (`DROP_WORK_REQUEST`) silently discards the sync the user just asked for.
+     *   Never set from a background trigger — a boot receiver spending the quota
+     *   leaves none for the button.
+     * @return the unique work name, which the caller may wait on.
+     */
+    fun enqueue(accountName: String, expedited: Boolean = false): String {
+        val uniqueName = SyncWorker.uniqueNameFor(accountName)
+        val request = OneTimeWorkRequestBuilder<SyncWorker>()
+            .setInputData(inputFor(accountName))
+            .setConstraints(NETWORK)
+            .apply {
+                if (expedited) setExpedited(OutOfQuotaPolicy.RUN_AS_NON_EXPEDITED_WORK_REQUEST)
+            }
+            .build()
+
+        WorkManager.getInstance(context).enqueueUniqueWork(
+            uniqueName,
+            // KEEP, not REPLACE: a periodic trigger arriving while a manual sync
+            // is mid-flight must not cancel it and lose the cursor.
+            ExistingWorkPolicy.KEEP,
+            request,
+        )
+        return uniqueName
+    }
+
+    /**
+     * Pushes a local edit soon, rather than on the next periodic window.
+     *
+     * Debounced: each call restarts [PUSH_DELAY], so a burst of edits costs one
+     * sync. What waits out the delay is a [SyncPushWorker], which hands over to
+     * [enqueueAfterRunning] — so the replace can only ever cancel a timer, never
+     * a sync that is mid-flight.
+     */
+    fun pushSoon(accountName: String) {
+        val request = OneTimeWorkRequestBuilder<SyncPushWorker>()
+            .setInputData(inputFor(accountName))
+            .setInitialDelay(PUSH_DELAY.inWholeSeconds, TimeUnit.SECONDS)
+            .build()
+        WorkManager.getInstance(context).enqueueUniqueWork(
+            pushNameFor(accountName),
+            ExistingWorkPolicy.REPLACE,
+            request,
+        )
+    }
+
+    /**
+     * A sync that runs after any one already running for [accountName].
+     *
+     * Not [enqueue]'s KEEP: a sync already past its upload phase would swallow
+     * this request and leave the edit that prompted it for the next window.
+     */
+    fun enqueueAfterRunning(accountName: String) {
+        val request = OneTimeWorkRequestBuilder<SyncWorker>()
+            .setInputData(inputFor(accountName))
+            .setConstraints(NETWORK)
+            .build()
+        WorkManager.getInstance(context).enqueueUniqueWork(
+            SyncWorker.uniqueNameFor(accountName),
+            ExistingWorkPolicy.APPEND_OR_REPLACE,
+            request,
+        )
+    }
+
+    /**
+     * A sync for a push message: the server says something changed.
+     *
+     * Appended like [enqueueAfterRunning], since a sync already past its
+     * download would miss the change — but only once. A burst of pushes during
+     * one sync must cost one more sync, not one each.
+     */
+    suspend fun enqueueFromPush(accountName: String) = pushEnqueue.withLock {
+        val waiting = WorkManager.getInstance(context)
+            .getWorkInfosForUniqueWorkFlow(SyncWorker.uniqueNameFor(accountName))
+            .first()
+            .any { it.state == WorkInfo.State.ENQUEUED || it.state == WorkInfo.State.BLOCKED }
+        if (!waiting) enqueueAfterRunning(accountName)
+    }
+
+    /** Serialises [enqueueFromPush]'s check and its enqueue across concurrent messages. */
+    private val pushEnqueue = Mutex()
+
+    /**
+     * Puts the account on the periodic schedule.
+     *
+     * A plain `PeriodicWorkRequest` and no foreground service, deliberately —
+     * see [SyncWorker]. WorkManager restores its own schedule after a reboot, so
+     * nothing has to re-arm this from `BOOT_COMPLETED`; that matters because
+     * Android 15 forbids starting a `dataSync` foreground service from boot, and
+     * a design that needed one would have no way to run at all.
+     *
+     * ⚠️ Be honest about the cadence in the UI. The interval setting is a
+     * floor, not a promise: in the `rare` and `restricted` App Standby buckets
+     * network access is off entirely, and the genuine worst case is once overnight.
+     *
+     * @param intervalMinutes the sync-interval setting; 0 (manual only) takes
+     *   the account off the schedule.
+     * @param intervalChanged the user just picked a new interval, so a schedule
+     *   already in place is replaced rather than kept.
+     */
+    fun schedule(accountName: String, intervalMinutes: Int, intervalChanged: Boolean = false) {
+        val minutes = intervalMinutes
+        if (minutes <= 0) {
+            WorkManager.getInstance(context).cancelUniqueWork(periodicNameFor(accountName))
+            return
+        }
+        val request = PeriodicWorkRequestBuilder<SyncWorker>(
+            minutes.toLong(), TimeUnit.MINUTES,
+            flexFor(minutes).inWholeMinutes, TimeUnit.MINUTES,
+        )
+            .setInputData(inputFor(accountName))
+            .setConstraints(NETWORK)
+            .build()
+
+        WorkManager.getInstance(context).enqueueUniquePeriodicWork(
+            periodicNameFor(accountName),
+            // UPDATE on every call would restart the interval on every app
+            // launch, so a device that is opened often would never reach the
+            // end of one. Only a changed interval replaces it.
+            if (intervalChanged) ExistingPeriodicWorkPolicy.UPDATE else ExistingPeriodicWorkPolicy.KEEP,
+            request,
+        )
+    }
+
+    /** Takes a removed account off the schedule. */
+    fun cancel(accountName: String) {
+        WorkManager.getInstance(context).apply {
+            cancelUniqueWork(periodicNameFor(accountName))
+            cancelUniqueWork(pushNameFor(accountName))
+            cancelUniqueWork(SyncWorker.uniqueNameFor(accountName))
+        }
+    }
+
+    private fun inputFor(accountName: String) =
+        Data.Builder().putString(SyncWorker.KEY_ACCOUNT_NAME, accountName).build()
+
+    private companion object {
+        /** How long a local edit waits for more before it is pushed. */
+        val PUSH_DELAY: Duration = 30.seconds
+
+        /** The tail of each interval the system may run us in: a quarter of it, at most an hour. */
+        fun flexFor(intervalMinutes: Int): Duration =
+            (intervalMinutes / 4).minutes.coerceIn(5.minutes, 1.hours)
+
+        /**
+         * Sync needs a network, and saying so lets WorkManager run us the moment
+         * connectivity returns rather than on the next interval.
+         */
+        val NETWORK: Constraints = Constraints.Builder()
+            .setRequiredNetworkType(NetworkType.CONNECTED)
+            .build()
+
+        fun periodicNameFor(accountName: String) = "caldav-sync-periodic:$accountName"
+
+        fun pushNameFor(accountName: String) = "caldav-sync-push:$accountName"
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/SyncWorker.kt

@@ -0,0 +1,133 @@
+package de.jeanlucmakiola.agendula.data.sync
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.content.Context
+import android.util.Log
+import androidx.core.app.NotificationCompat
+import androidx.hilt.work.HiltWorker
+import androidx.work.CoroutineWorker
+import androidx.work.ForegroundInfo
+import androidx.work.WorkerParameters
+import dagger.assisted.Assisted
+import dagger.assisted.AssistedInject
+import de.jeanlucmakiola.agendula.R
+import de.jeanlucmakiola.agendula.data.reminders.ReminderScheduler
+
+/**
+ * Where sync actually happens.
+ *
+ * Two things about this worker are decided already. It is a
+ * **`CoroutineWorker` with no foreground service**: an ordinary
+ * worker is documented for under 10 minutes, and escalating to `setForeground`
+ * pulls in `FOREGROUND_SERVICE_DATA_SYNC`, the Android 15 six-hours-per-24
+ * `dataSync` budget whose failure mode is a fatal `RemoteServiceException`, and
+ * a Play requirement for a video demo per declared FGS type. And it must be
+ * **chunked and resumable** — the sync cursor is persisted per collection so a
+ * killed worker resumes rather than restarts, because under WorkManager process
+ * death mid-sync is routine rather than exotic.
+ */
+@HiltWorker
+class SyncWorker @AssistedInject constructor(
+    @Assisted context: Context,
+    @Assisted parameters: WorkerParameters,
+    private val engine: SyncEngine,
+    private val noticeNotifier: SyncNoticeNotifier,
+    private val reminderScheduler: ReminderScheduler,
+    private val accountState: AccountStateStore,
+) : CoroutineWorker(context, parameters) {
+
+    override suspend fun doWork(): Result {
+        val accountName = inputData.getString(KEY_ACCOUNT_NAME) ?: return Result.failure()
+
+        return when (val outcome = engine.sync(accountName)) {
+            is SyncEngine.Result.Synced -> {
+                // ⚠️ Success even when collections failed. A retry re-runs the
+                // whole account, and WorkManager's backoff would then punish the
+                // four healthy collections for the one that 500s — while the
+                // failing one is already contained by its own quarantine counter.
+                outcome.reports.forEach { report ->
+                    if (report.failure != null || report.hadWork) Log.i(TAG, report.toString())
+                }
+                // ⚠️ Said out loud, not only logged. `SyncReport`'s own doc
+                // calls the report "the other half" of server-wins, and this
+                // worker runs on a four-hour timer with the app closed — so a
+                // log line is the same as saying nothing. Only what is new: the
+                // store has already dropped whatever the user has been told.
+                noticeNotifier.post(accountName, outcome.notices)
+                // Nothing else re-arms reminders for what a sync pulled in: in our
+                // own store no provider broadcast fires.
+                if (outcome.reports.any { it.hadWork || it.discardedEdits.isNotEmpty() }) {
+                    runCatching { reminderScheduler.sync() }
+                }
+                noticeNotifier.cancelSignIn(accountName)
+                Result.success()
+            }
+
+            // Only the user can fix this, and retrying costs them Nextcloud's
+            // per-IP brute-force throttle — which takes their *other* clients
+            // down with it. Said once per stop, since this runs with the app closed.
+            is SyncEngine.Result.NeedsSignIn -> {
+                if (accountState.markSignInNotified(outcome.accountId)) {
+                    noticeNotifier.postSignIn(accountName, outcome.accountId)
+                }
+                Result.failure()
+            }
+
+            is SyncEngine.Result.Misconfigured -> Result.failure()
+
+            // Not a failure: the account is kept, and syncs again once the user
+            // switches back to Agendula's own storage.
+            SyncEngine.Result.Paused -> Result.success()
+        }
+    }
+
+    /**
+     * ⚠️ Implemented **unconditionally**, even though this worker never asks to
+     * run in the foreground.
+     *
+     * `setExpedited` falls back to a foreground service below API 31, and
+     * WorkManager calls this to build it. The default implementation throws
+     * `IllegalStateException`, so a worker that only ever runs expedited on
+     * modern devices crashes on every device running API 29 or 30 — which we
+     * support. It is never actually shown above API 30.
+     */
+    override suspend fun getForegroundInfo(): ForegroundInfo {
+        val manager = applicationContext.getSystemService(NotificationManager::class.java)
+        manager?.createNotificationChannel(
+            NotificationChannel(
+                CHANNEL_ID,
+                applicationContext.getString(R.string.sync_notification_channel),
+                NotificationManager.IMPORTANCE_LOW,
+            ),
+        )
+
+        val notification: Notification = NotificationCompat.Builder(applicationContext, CHANNEL_ID)
+            .setContentTitle(applicationContext.getString(R.string.sync_notification_title))
+            .setSmallIcon(R.drawable.ic_notification)
+            .setOngoing(true)
+            .setPriority(NotificationCompat.PRIORITY_LOW)
+            .build()
+
+        // ⚠️ **No `foregroundServiceType`.** Declaring `dataSync` is what drags in
+        // `FOREGROUND_SERVICE_DATA_SYNC`, the Android 15 six-hours-per-24 budget
+        // whose failure mode is a fatal `RemoteServiceException`, and a Play
+        // requirement for a video demo per declared type — the whole tail this
+        // worker exists to avoid. It is not needed either: above API 30
+        // `setExpedited` uses an expedited job and never calls this at all, and
+        // types only became mandatory at API 34.
+        return ForegroundInfo(NOTIFICATION_ID, notification)
+    }
+
+    companion object {
+        /** One in-flight sync per account, so a manual trigger cannot pile up. */
+        fun uniqueNameFor(accountName: String) = "caldav-sync:$accountName"
+
+        const val KEY_ACCOUNT_NAME = "accountName"
+
+        private const val TAG = "SyncWorker"
+        private const val CHANNEL_ID = "sync"
+        private const val NOTIFICATION_ID = 4001
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/push/AgendulaPushService.kt

@@ -0,0 +1,60 @@
+package de.jeanlucmakiola.agendula.data.sync.push
+
+import android.util.Log
+import dagger.hilt.android.AndroidEntryPoint
+import de.jeanlucmakiola.agendula.data.di.ApplicationScope
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.launch
+import org.unifiedpush.android.connector.FailedReason
+import org.unifiedpush.android.connector.PushService
+import org.unifiedpush.android.connector.data.PushEndpoint
+import org.unifiedpush.android.connector.data.PushMessage
+import javax.inject.Inject
+
+/**
+ * Where the UnifiedPush distributor reaches us; the instance is the account id.
+ * Work runs in the application scope, since the connector unbinds after a second.
+ */
+@AndroidEntryPoint
+class AgendulaPushService : PushService() {
+
+    @Inject @ApplicationScope lateinit var scope: CoroutineScope
+
+    @Inject lateinit var registrar: PushRegistrar
+
+    @Inject lateinit var messages: PushMessageHandler
+
+    override fun onNewEndpoint(endpoint: PushEndpoint, instance: String) {
+        val accountId = instance.toLongOrNull() ?: return
+        scope.launch { runCatching { registrar.onNewEndpoint(accountId, endpoint) }.onFailure(::log) }
+    }
+
+    override fun onMessage(message: PushMessage, instance: String) {
+        // Encryption is mandatory in the draft.
+        if (!message.decrypted) {
+            Log.w(TAG, "dropped a push message that did not decrypt")
+            return
+        }
+        val content = message.content.toString(Charsets.UTF_8)
+        scope.launch { runCatching { messages.handle(content, instance) }.onFailure(::log) }
+    }
+
+    override fun onRegistrationFailed(reason: FailedReason, instance: String) {
+        Log.w(TAG, "distributor refused registration for $instance: $reason")
+        // A transient failure leaves the last endpoint valid; the next renewal retries.
+        if (reason == FailedReason.NETWORK || reason == FailedReason.INTERNAL_ERROR) return
+        val accountId = instance.toLongOrNull() ?: return
+        scope.launch { runCatching { registrar.onUnregistered(accountId) }.onFailure(::log) }
+    }
+
+    override fun onUnregistered(instance: String) {
+        val accountId = instance.toLongOrNull() ?: return
+        scope.launch { runCatching { registrar.onUnregistered(accountId) }.onFailure(::log) }
+    }
+
+    private fun log(error: Throwable) = Log.w(TAG, "push handling failed", error)
+
+    private companion object {
+        const val TAG = "AgendulaPushService"
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/push/PushDistributors.kt

@@ -0,0 +1,79 @@
+package de.jeanlucmakiola.agendula.data.sync.push
+
+import android.content.Context
+import android.content.pm.PackageManager
+import de.jeanlucmakiola.agendula.data.prefs.SettingsPrefs
+import dagger.hilt.android.qualifiers.ApplicationContext
+import kotlinx.coroutines.flow.first
+import org.unifiedpush.android.connector.UnifiedPush
+import org.unifiedpush.android.connector.data.ResolvedDistributor
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * Which UnifiedPush distributor delivers our pushes, and whether push is on. The
+ * connector keeps the choice; the on/off switch lives in [SettingsPrefs].
+ */
+@Singleton
+class PushDistributors @Inject constructor(
+    @ApplicationContext private val context: Context,
+    private val settings: SettingsPrefs,
+) {
+
+    data class Distributor(val packageName: String, val label: String)
+
+    /** The distributor apps installed right now. */
+    fun installed(): List<Distributor> =
+        UnifiedPush.getDistributors(context)
+            .filter { it != context.packageName }
+            .map { Distributor(it, labelOf(it)) }
+            .sortedBy { it.label.lowercase() }
+
+    /**
+     * The distributor to register with, or null when push is off or none is
+     * usable. With no choice saved, a default or sole distributor is adopted.
+     */
+    suspend fun toUse(): String? {
+        if (!settings.settings.first().pushEnabled) return null
+        UnifiedPush.getSavedDistributor(context)?.let { return it }
+        return when (val resolved = UnifiedPush.resolveDefaultDistributor(context)) {
+            is ResolvedDistributor.Found -> resolved.packageName
+                .takeIf { it != context.packageName }
+                ?.also { UnifiedPush.saveDistributor(context, it) }
+            ResolvedDistributor.ToSelect, ResolvedDistributor.NoneAvailable -> null
+        }
+    }
+
+    /** The saved choice, without resolving a default. For display. */
+    fun saved(): String? = UnifiedPush.getSavedDistributor(context)
+
+    suspend fun select(packageName: String) {
+        UnifiedPush.saveDistributor(context, packageName)
+        settings.setPushEnabled(true)
+    }
+
+    /** Turns push off. Every registration with the distributor goes with it. */
+    suspend fun disable() {
+        settings.setPushEnabled(false)
+        UnifiedPush.removeDistributor(context)
+    }
+
+    /**
+     * Unregisters one instance without losing the user's choice, which the
+     * connector drops along with its last instance.
+     */
+    fun unregister(instance: String) {
+        val chosen = UnifiedPush.getSavedDistributor(context)
+        UnifiedPush.unregister(context, instance)
+        if (chosen != null && UnifiedPush.getSavedDistributor(context) == null) {
+            UnifiedPush.saveDistributor(context, chosen)
+        }
+    }
+
+    fun labelOf(packageName: String): String = try {
+        val info = context.packageManager.getApplicationInfo(packageName, 0)
+        context.packageManager.getApplicationLabel(info).toString()
+    } catch (_: PackageManager.NameNotFoundException) {
+        packageName
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/push/PushMessageHandler.kt

@@ -0,0 +1,53 @@
+package de.jeanlucmakiola.agendula.data.sync.push
+
+import android.util.Log
+import de.jeanlucmakiola.agendula.data.di.IoDispatcher
+import de.jeanlucmakiola.agendula.data.sync.SyncTrigger
+import de.jeanlucmakiola.agendula.data.tasks.room.TasksDatabase
+import de.jeanlucmakiola.caldav.WebDavPush
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.withContext
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/** Turns a WebDAV-Push message into a sync of the account it is about. */
+@Singleton
+class PushMessageHandler @Inject constructor(
+    private val database: TasksDatabase,
+    private val store: PushStore,
+    private val trigger: SyncTrigger,
+    @IoDispatcher private val io: CoroutineDispatcher,
+) {
+
+    /**
+     * @param content the decrypted message body.
+     * @param instance the UnifiedPush instance, which is the account id.
+     */
+    suspend fun handle(content: String, instance: String) = withContext(io) {
+        val accountId = instance.toLongOrNull() ?: return@withContext
+        val account = database.accounts().account(accountId) ?: return@withContext
+        val message = WebDavPush.parse(content)
+
+        val topic = message?.topic
+        if (topic != null) {
+            // Within this account: a shared calendar has one topic across accounts.
+            val list = store.all().values
+                .filter { it.support?.topic == topic }
+                .firstNotNullOfOrNull { push ->
+                    database.taskLists().entity(push.listId)?.takeIf { it.accountId == accountId }
+                }
+            if (list == null) {
+                Log.i(TAG, "push for a topic no synced list has")
+                return@withContext
+            }
+            // Already at that state, e.g. our own write echoed back.
+            if (message.syncToken != null && message.syncToken == list.syncToken) return@withContext
+        }
+        // Without a topic (key rotation, unreadable): a sync re-reads the VAPID key.
+        trigger.enqueueFromPush(account.displayName)
+    }
+
+    private companion object {
+        const val TAG = "PushMessageHandler"
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/push/PushRegistrar.kt

@@ -0,0 +1,271 @@
+package de.jeanlucmakiola.agendula.data.sync.push
+
+import android.content.Context
+import android.util.Log
+import androidx.work.BackoffPolicy
+import androidx.work.Constraints
+import androidx.work.ExistingPeriodicWorkPolicy
+import androidx.work.NetworkType
+import androidx.work.PeriodicWorkRequestBuilder
+import androidx.work.WorkManager
+import dagger.hilt.android.qualifiers.ApplicationContext
+import de.jeanlucmakiola.agendula.data.di.IoDispatcher
+import de.jeanlucmakiola.agendula.data.sync.AccountStateStore
+import de.jeanlucmakiola.agendula.data.sync.CredentialStore
+import de.jeanlucmakiola.agendula.data.sync.SyncAvailability
+import de.jeanlucmakiola.agendula.data.sync.SyncReport
+import de.jeanlucmakiola.agendula.data.tasks.room.AccountEntity
+import de.jeanlucmakiola.agendula.data.tasks.room.TasksDatabase
+import de.jeanlucmakiola.caldav.CalDavHttp
+import de.jeanlucmakiola.caldav.WebDavPush
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import kotlinx.coroutines.withContext
+import okhttp3.HttpUrl
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
+import okhttp3.OkHttpClient
+import org.unifiedpush.android.connector.UnifiedPush
+import org.unifiedpush.android.connector.data.PushEndpoint
+import java.util.concurrent.TimeUnit
+import javax.inject.Inject
+import javax.inject.Singleton
+import kotlin.time.Clock
+import kotlin.time.Duration.Companion.days
+
+/**
+ * Keeps WebDAV-Push subscriptions in step with the synced lists, modelled on
+ * DAVx5's `PushRegistrationManager`. [update] registers each account with the
+ * distributor; [onNewEndpoint] subscribes the endpoint it answers with. The
+ * daily [PushRenewalWorker] re-registers, which is what renews subscriptions.
+ */
+@Singleton
+class PushRegistrar @Inject constructor(
+    @ApplicationContext private val context: Context,
+    private val database: TasksDatabase,
+    private val store: PushStore,
+    private val distributors: PushDistributors,
+    private val credentials: CredentialStore,
+    private val accountState: AccountStateStore,
+    private val availability: SyncAvailability,
+    @IoDispatcher private val io: CoroutineDispatcher,
+) {
+
+    /** One subscribe/unsubscribe pass at a time, across every entry point. */
+    private val mutex = Mutex()
+
+    /** Records what a sync read about push support, and registers if that changed. */
+    suspend fun onSynced(account: AccountEntity, reports: List<SyncReport>) {
+        val read = reports.filter { it.collectionRead }.associate { it.listId to it.pushSupport }
+        if (store.recordSupport(read)) update(account.id)
+    }
+
+    suspend fun updateAll() = mutex.withLock {
+        withContext(io) {
+            database.accounts().all().forEach { updateAccount(it) }
+            scheduleRenewal()
+        }
+    }
+
+    suspend fun update(accountId: Long) = mutex.withLock {
+        withContext(io) {
+            database.accounts().account(accountId)?.let { updateAccount(it) }
+            scheduleRenewal()
+        }
+    }
+
+    /** Our subscription per collection URL, for `Push-Dont-Notify` on the account's writes. */
+    suspend fun subscriptionsByHref(accountId: Long): Map<String, HttpUrl> = withContext(io) {
+        val pushes = store.all()
+        database.taskLists().syncedForAccount(accountId).mapNotNull { list ->
+            // Normalised the way SyncEngine spells the URL it looks up.
+            val href = list.href?.toHttpUrlOrNull()?.toString() ?: return@mapNotNull null
+            val subscription = pushes[list.id]?.subscription?.toHttpUrlOrNull() ?: return@mapNotNull null
+            href to subscription
+        }.toMap()
+    }
+
+    /** The distributor's endpoint for [accountId] is ready: subscribe the account's lists to it. */
+    suspend fun onNewEndpoint(accountId: Long, endpoint: PushEndpoint) = mutex.withLock {
+        withContext(io) {
+            val account = database.accounts().account(accountId) ?: return@withContext
+            if (!pushAllowed(account)) return@withContext
+            val client = clientFor(account) ?: return@withContext
+
+            val pushes = store.all()
+            val lists = database.taskLists().syncedForAccount(account.id)
+            val wanted = lists.filter { it.href != null && pushes[it.id]?.support != null }
+            val renewBefore = Clock.System.now() + RENEW_MARGIN
+
+            for (list in wanted) {
+                val push = pushes.getValue(list.id)
+                val current = push.subscription != null &&
+                    push.endpoint == endpoint.url &&
+                    push.expires?.let { it > renewBefore } == true
+                if (current) continue
+
+                // A changed endpoint means a new subscription, not an update.
+                if (push.endpoint != null && push.endpoint != endpoint.url) {
+                    push.subscription?.toHttpUrlOrNull()?.let { WebDavPush.unregister(client, it) }
+                }
+                val collection = list.href!!.toHttpUrlOrNull() ?: continue
+                when (
+                    val outcome = WebDavPush.register(
+                        client = client,
+                        collection = collection,
+                        endpoint = endpoint.url,
+                        publicKey = endpoint.pubKeySet?.pubKey,
+                        authSecret = endpoint.pubKeySet?.auth,
+                        expires = Clock.System.now() + REQUESTED_LIFETIME,
+                    )
+                ) {
+                    is WebDavPush.Registration.Registered -> store.recordSubscription(
+                        listId = list.id,
+                        subscription = outcome.url?.toString(),
+                        endpoint = endpoint.url,
+                        expires = outcome.expires,
+                    )
+                    is WebDavPush.Registration.Refused -> {
+                        Log.w(TAG, "push refused for ${list.id}: HTTP ${outcome.code}")
+                        store.clearSubscription(list.id)
+                        // Stop the account as a sync would; Nextcloud throttles per IP.
+                        if (outcome.code == UNAUTHORIZED) {
+                            accountState.setNeedsSignIn(account.id, true)
+                            return@withContext
+                        }
+                    }
+                    // Retried by the next renewal.
+                    is WebDavPush.Registration.Failed -> Log.w(TAG, "push registration failed for ${list.id}: ${outcome.reason}")
+                }
+            }
+
+            // A list that lost push support still holds a subscription nobody wants.
+            val wantedIds = wanted.map { it.id }.toSet()
+            val stale = lists.filter { it.id !in wantedIds && pushes[it.id]?.subscription != null }
+            unsubscribe(client, stale.map { it.id }, pushes)
+        }
+    }
+
+    /** The distributor dropped [accountId]'s registration: its subscriptions lead nowhere. */
+    suspend fun onUnregistered(accountId: Long) = mutex.withLock {
+        withContext(io) {
+            database.accounts().account(accountId)?.let { unsubscribeAll(it) }
+        }
+    }
+
+    /** Before an account is removed, while its credential still works. */
+    suspend fun forgetAccount(accountId: Long) = mutex.withLock {
+        withContext(io) {
+            val account = database.accounts().account(accountId) ?: return@withContext
+            unsubscribeAll(account)
+            distributors.unregister(accountId.toString())
+            store.forget(database.taskLists().syncedForAccount(accountId).map { it.id }.toSet())
+        }
+    }
+
+    /** Before lists stop syncing with [accountId]. */
+    suspend fun forgetLists(accountId: Long, listIds: Set<Long>) = mutex.withLock {
+        withContext(io) {
+            if (listIds.isEmpty()) return@withContext
+            val account = database.accounts().account(accountId)
+            val client = account?.let { clientFor(it) }
+            val pushes = store.all()
+            if (client != null) unsubscribe(client, listIds.toList(), pushes)
+            store.forget(listIds)
+        }
+    }
+
+    private suspend fun updateAccount(account: AccountEntity) {
+        val instance = account.id.toString()
+        val distributor = if (pushAllowed(account)) distributors.toUse() else null
+        val pushes = store.all()
+        val capable = database.taskLists().syncedForAccount(account.id)
+            .mapNotNull { pushes[it.id]?.support }
+
+        if (distributor == null || capable.isEmpty()) {
+            // Not unregistered: the connector would forget the user's distributor.
+            unsubscribeAll(account)
+            return
+        }
+
+        val vapid = capable.firstNotNullOfOrNull { it.vapidPublicKey }
+        try {
+            UnifiedPush.register(context, instance, account.displayName, vapid)
+        } catch (_: UnifiedPush.VapidNotValidException) {
+            Log.w(TAG, "server VAPID key for ${account.id} is not usable")
+            UnifiedPush.register(context, instance, account.displayName, null)
+        }
+    }
+
+    private suspend fun unsubscribeAll(account: AccountEntity) {
+        val pushes = store.all()
+        val held = database.taskLists().syncedForAccount(account.id)
+            .filter { pushes[it.id]?.subscription != null }
+            .map { it.id }
+        if (held.isEmpty()) return
+        val client = clientFor(account)
+        if (client != null) {
+            unsubscribe(client, held, pushes)
+        } else {
+            // Without a credential they are left to expire.
+            held.forEach { store.clearSubscription(it) }
+        }
+    }
+
+    /** Tells the server, then forgets locally; after the first failure only forgets. */
+    private suspend fun unsubscribe(client: OkHttpClient, listIds: List<Long>, pushes: Map<Long, PushStore.ListPush>) {
+        var reachable = true
+        listIds.forEach { listId ->
+            val subscription = pushes[listId]?.subscription?.toHttpUrlOrNull()
+            if (reachable && subscription != null) reachable = WebDavPush.unregister(client, subscription)
+            store.clearSubscription(listId)
+        }
+    }
+
+    private suspend fun pushAllowed(account: AccountEntity): Boolean =
+        availability.accountsUsable() && !accountState.needsSignIn(account.id)
+
+    /** Null for an account waiting on sign-in, as in `SyncEngine.sync`. */
+    private suspend fun clientFor(account: AccountEntity): OkHttpClient? {
+        if (accountState.needsSignIn(account.id)) return null
+        val username = account.username ?: return null
+        val origin = account.principalUrl?.toHttpUrlOrNull() ?: return null
+        val password = (credentials.get(account.id) as? CredentialStore.Secret.Present)?.value ?: return null
+        return CalDavHttp.authenticated(USER_AGENT, username, password, origin)
+            .newBuilder()
+            .callTimeout(CALL_TIMEOUT_SECONDS, TimeUnit.SECONDS)
+            .build()
+    }
+
+    /** Only while some list could be pushed; nothing to renew otherwise. */
+    private suspend fun scheduleRenewal() {
+        val work = WorkManager.getInstance(context)
+        val needed = distributors.toUse() != null && store.all().values.any { it.support != null }
+        if (!needed) {
+            work.cancelUniqueWork(PushRenewalWorker.NAME)
+            return
+        }
+        val request = PeriodicWorkRequestBuilder<PushRenewalWorker>(RENEWAL_INTERVAL_DAYS, TimeUnit.DAYS)
+            .setConstraints(Constraints.Builder().setRequiredNetworkType(NetworkType.CONNECTED).build())
+            .setBackoffCriteria(BackoffPolicy.EXPONENTIAL, 1, TimeUnit.MINUTES)
+            .build()
+        work.enqueueUniquePeriodicWork(PushRenewalWorker.NAME, ExistingPeriodicWorkPolicy.KEEP, request)
+    }
+
+    private companion object {
+        const val TAG = "PushRegistrar"
+        const val USER_AGENT = "Agendula (Android)"
+        const val UNAUTHORIZED = 401
+
+        /** A registration is one small request; removal waits on it. */
+        const val CALL_TIMEOUT_SECONDS = 15L
+
+        /** What we ask for; the draft recommends at least three days. */
+        val REQUESTED_LIFETIME = 3.days
+
+        const val RENEWAL_INTERVAL_DAYS = 1L
+
+        /** Two renewal intervals, since periodic work is not punctual. */
+        val RENEW_MARGIN = (2 * RENEWAL_INTERVAL_DAYS).days
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/push/PushRenewalWorker.kt

@@ -0,0 +1,26 @@
+package de.jeanlucmakiola.agendula.data.sync.push
+
+import android.content.Context
+import androidx.hilt.work.HiltWorker
+import androidx.work.CoroutineWorker
+import androidx.work.WorkerParameters
+import dagger.assisted.Assisted
+import dagger.assisted.AssistedInject
+
+/** Re-registers every account daily, which renews the subscriptions; see [PushRegistrar]. */
+@HiltWorker
+class PushRenewalWorker @AssistedInject constructor(
+    @Assisted context: Context,
+    @Assisted parameters: WorkerParameters,
+    private val registrar: PushRegistrar,
+) : CoroutineWorker(context, parameters) {
+
+    override suspend fun doWork(): Result {
+        registrar.updateAll()
+        return Result.success()
+    }
+
+    companion object {
+        const val NAME = "push-renewal"
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/data/sync/push/PushStore.kt

@@ -0,0 +1,120 @@
+package de.jeanlucmakiola.agendula.data.sync.push
+
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringSetPreferencesKey
+import de.jeanlucmakiola.agendula.data.di.SyncStateDataStore
+import de.jeanlucmakiola.caldav.PushSupport
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.map
+import java.net.URLDecoder
+import java.net.URLEncoder
+import javax.inject.Inject
+import javax.inject.Singleton
+import kotlin.time.Instant
+
+/**
+ * Per synced list: what its server offers for push, and our subscription there.
+ * Kept out of Room and backups, since a subscription names this device's endpoint.
+ */
+@Singleton
+class PushStore @Inject constructor(
+    @SyncStateDataStore private val dataStore: DataStore<Preferences>,
+) {
+
+    data class ListPush(
+        val listId: Long,
+        /** Null when the server offers no push for the list. */
+        val support: PushSupport? = null,
+        /** Where our subscription lives on the server; null when there is none. */
+        val subscription: String? = null,
+        /** The push endpoint [subscription] was registered for. */
+        val endpoint: String? = null,
+        val expires: Instant? = null,
+    )
+
+    suspend fun all(): Map<Long, ListPush> = decode(dataStore.data.first()[KEY].orEmpty())
+
+    fun observe(): Flow<Map<Long, ListPush>> = dataStore.data.map { decode(it[KEY].orEmpty()) }
+
+    /**
+     * Records what the last sync read about each list's push support.
+     *
+     * @return whether anything changed, which is what makes a registration due.
+     */
+    suspend fun recordSupport(support: Map<Long, PushSupport?>): Boolean {
+        if (support.isEmpty()) return false
+        var changed = false
+        update { current ->
+            support.forEach { (listId, found) ->
+                val before = current[listId] ?: ListPush(listId)
+                if (before.support != found) {
+                    changed = true
+                    current[listId] = before.copy(support = found)
+                }
+            }
+        }
+        return changed
+    }
+
+    suspend fun recordSubscription(listId: Long, subscription: String?, endpoint: String?, expires: Instant?) =
+        update { current ->
+            val before = current[listId] ?: ListPush(listId)
+            current[listId] = before.copy(subscription = subscription, endpoint = endpoint, expires = expires)
+        }
+
+    suspend fun clearSubscription(listId: Long) = recordSubscription(listId, null, null, null)
+
+    suspend fun forget(listIds: Set<Long>) {
+        if (listIds.isEmpty()) return
+        update { current -> listIds.forEach(current::remove) }
+    }
+
+    private suspend fun update(change: (MutableMap<Long, ListPush>) -> Unit) {
+        dataStore.edit { prefs ->
+            // Re-read inside `edit`, which DataStore serialises.
+            val current = decode(prefs[KEY].orEmpty()).toMutableMap()
+            change(current)
+            prefs[KEY] = current.values
+                .filter { it.support != null || it.subscription != null }
+                .map(::encode)
+                .toSet()
+        }
+    }
+
+    private fun encode(push: ListPush): String = listOf(
+        push.listId.toString(),
+        push.support?.topic,
+        push.support?.vapidPublicKey,
+        push.subscription,
+        push.endpoint,
+        push.expires?.epochSeconds?.toString(),
+    ).joinToString(SEPARATOR) { it?.let(::escape).orEmpty() }
+
+    private fun decode(entries: Set<String>): Map<Long, ListPush> =
+        entries.mapNotNull { entry ->
+            val parts = entry.split(SEPARATOR).map { part -> part.takeIf { it.isNotEmpty() }?.let(::unescape) }
+            if (parts.size != FIELDS) return@mapNotNull null
+            val listId = parts[0]?.toLongOrNull() ?: return@mapNotNull null
+            listId to ListPush(
+                listId = listId,
+                support = parts[1]?.let { PushSupport(topic = it, vapidPublicKey = parts[2]) },
+                subscription = parts[3],
+                endpoint = parts[4],
+                expires = parts[5]?.toLongOrNull()?.let(Instant::fromEpochSeconds),
+            )
+        }.toMap()
+
+    // Server-chosen strings, escaped so none contains the separator.
+    private fun escape(value: String): String = URLEncoder.encode(value, "UTF-8")
+
+    private fun unescape(value: String): String = URLDecoder.decode(value, "UTF-8")
+
+    private companion object {
+        val KEY = stringSetPreferencesKey("push_lists")
+        const val SEPARATOR = "|"
+        const val FIELDS = 6
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/ui/accounts/AccountDetailScreen.kt

@@ -0,0 +1,481 @@
+package de.jeanlucmakiola.agendula.ui.accounts
+
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.automirrored.rounded.List
+import androidx.compose.material.icons.automirrored.rounded.Login
+import androidx.compose.material.icons.rounded.Check
+import androidx.compose.material.icons.rounded.Bolt
+import androidx.compose.material.icons.rounded.CloudSync
+import androidx.compose.material.icons.rounded.DeleteOutline
+import androidx.compose.material.icons.rounded.History
+import androidx.compose.material.icons.rounded.HistoryToggleOff
+import androidx.compose.material.icons.rounded.Inventory2
+import androidx.compose.material.icons.rounded.Refresh
+import androidx.compose.material.icons.rounded.SyncProblem
+import androidx.compose.material3.Button
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.AnnotatedString
+import androidx.compose.ui.text.SpanStyle
+import androidx.compose.ui.text.buildAnnotatedString
+import androidx.compose.ui.text.withStyle
+import androidx.compose.ui.unit.dp
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import de.jeanlucmakiola.agendula.R
+import de.jeanlucmakiola.agendula.data.sync.DiscardedEdit
+import de.jeanlucmakiola.agendula.data.sync.SyncNotice
+import de.jeanlucmakiola.agendula.data.tasks.room.AccountEntity
+import de.jeanlucmakiola.agendula.ui.accounts.add.message
+import de.jeanlucmakiola.agendula.ui.common.OnResume
+import de.jeanlucmakiola.floret.components.CollapsingScaffold
+import de.jeanlucmakiola.floret.components.FullScreenPicker
+import de.jeanlucmakiola.floret.components.GroupedListInset
+import de.jeanlucmakiola.floret.components.GroupedRow
+import de.jeanlucmakiola.floret.components.Position
+import de.jeanlucmakiola.floret.components.SelectedCheck
+import de.jeanlucmakiola.floret.components.positionOf
+
+/**
+ * One account: who it is, how its last sync went, and what can be done to it.
+ *
+ * Tapping a row in the list opens this rather than a destructive prompt — a list
+ * row leads somewhere, it does not fire an irreversible action — so removing an
+ * account is a button on the account's own screen.
+ */
+@Composable
+internal fun AccountDetailScreen(
+    accountId: Long,
+    onBack: () -> Unit,
+    onRemoved: () -> Unit,
+    onSignInAgain: (AccountEntity) -> Unit,
+    onOpenStorage: () -> Unit,
+    viewModel: AccountsViewModel,
+) {
+    val accounts by viewModel.accounts.collectAsStateWithLifecycle()
+    val usable by viewModel.accountsUsable.collectAsStateWithLifecycle()
+    val push by viewModel.push.collectAsStateWithLifecycle()
+    OnResume(viewModel::refreshPush)
+    val row = accounts?.firstOrNull { it.account.id == accountId }
+
+    // The row is gone the instant it is removed, while this screen is still
+    // sliding away. Keeping the last one it had stops that exit animating an
+    // empty screen.
+    var lastKnown by remember(accountId) { mutableStateOf(row) }
+    LaunchedEffect(row) { if (row != null) lastKnown = row }
+    val shown = row ?: lastKnown ?: return
+
+    val account = shown.account
+    val identity = account.identity()
+    // The confirmation sheet. The removal it starts outlives this screen, and is
+    // shown on the accounts list rather than here.
+    var confirming by remember { mutableStateOf(false) }
+
+    CollapsingScaffold(title = identity.title, onBack = onBack) {
+        AccountHero(identity)
+        Spacer(Modifier.height(24.dp))
+
+        val actions = buildList<@Composable (Position) -> Unit> {
+            add { position ->
+                GroupedRow(
+                    title = stringResource(R.string.accounts_last_sync),
+                    summary = syncState(shown),
+                    position = position,
+                    leading = { Icon(Icons.Rounded.History, contentDescription = null) },
+                )
+            }
+            if (!usable) return@buildList
+            push?.let { pushState ->
+                add { position ->
+                    GroupedRow(
+                        title = stringResource(R.string.accounts_push),
+                        summary = accountPushSummary(pushState, shown.lists),
+                        position = position,
+                        leading = { Icon(Icons.Rounded.Bolt, contentDescription = null) },
+                    )
+                }
+            }
+            if (shown.needsSignIn) {
+                add { position ->
+                    GroupedRow(
+                        title = stringResource(R.string.accounts_sign_in_again),
+                        position = position,
+                        leading = { Icon(Icons.AutoMirrored.Rounded.Login, contentDescription = null) },
+                        onClick = { onSignInAgain(account) },
+                    )
+                }
+            } else {
+                add { position ->
+                    GroupedRow(
+                        title = stringResource(R.string.accounts_sync_now),
+                        position = position,
+                        leading = { Icon(Icons.Rounded.CloudSync, contentDescription = null) },
+                        onClick = { viewModel.syncNow(account) },
+                    )
+                }
+                add { position ->
+                    GroupedRow(
+                        title = stringResource(R.string.accounts_lists),
+                        summary = stringResource(R.string.accounts_lists_summary),
+                        position = position,
+                        leading = { Icon(Icons.AutoMirrored.Rounded.List, contentDescription = null) },
+                        onClick = { viewModel.openLists(account.id) },
+                    )
+                }
+            }
+        }
+        actions.forEachIndexed { index, action -> action(positionOf(index, actions.size)) }
+
+        if (!usable) {
+            Spacer(Modifier.height(24.dp))
+            ExternalStorageNotice(onOpenStorage)
+        }
+
+        // ⚠️ Above the removal, below the state — because it is the one thing on
+        // this screen the user did not already know. Conflicts are server-wins,
+        // and this group is the other half of it:
+        // without it a discarded edit is indistinguishable from lost work.
+        if (shown.notices.isNotEmpty()) {
+            Spacer(Modifier.height(24.dp))
+            SyncNotices(
+                notices = shown.notices,
+                onDismiss = { viewModel.dismissNotices(account) },
+                onRetry = viewModel::retry,
+            )
+        }
+
+        Spacer(Modifier.height(24.dp))
+
+        // Its own group, away from the things that are safe to press twice.
+        //
+        // ⚠️ Nothing here shows the removal in flight, deliberately. Confirming
+        // hands off to `onRemoved`, which puts this screen away in the same
+        // frame — so a pending state drawn here could never appear, and the
+        // dimming and spinner that were written for it were dead code claiming
+        // to prevent a second tap that cannot happen. The wait is visible where
+        // the user actually ends up: the row on `AccountsScreen`.
+        GroupedRow(
+            title = errorTitle(stringResource(R.string.accounts_remove)),
+            position = Position.Alone,
+            leading = {
+                Icon(
+                    Icons.Rounded.DeleteOutline,
+                    contentDescription = null,
+                    tint = MaterialTheme.colorScheme.error,
+                )
+            },
+            onClick = { confirming = true },
+        )
+        Spacer(Modifier.height(24.dp))
+    }
+
+    val lists by viewModel.lists.collectAsStateWithLifecycle()
+    lists?.let { state ->
+        SyncedListsPicker(state = state, viewModel = viewModel)
+    }
+
+    if (confirming) {
+        RemoveAccountPicker(
+            identity = identity,
+            onDismiss = { confirming = false },
+            onRemove = { deleteLocalData ->
+                viewModel.remove(account, deleteLocalData)
+                confirming = false
+                onRemoved()
+            },
+        )
+    }
+}
+
+/**
+ * What the last syncs replaced or gave up on, one row each.
+ *
+ * Named, never counted. "3 edits were replaced" leaves the user to work out
+ * which three across every list they own, which is the same as not telling them
+ * — so each row carries the task's own title, the list it lives in, and the
+ * reason, and "Got it" is what clears them.
+ */
+@Composable
+private fun SyncNotices(
+    notices: List<SyncNotice>,
+    onDismiss: () -> Unit,
+    onRetry: (SyncNotice) -> Unit,
+) {
+    Text(
+        stringResource(R.string.sync_notices_title),
+        style = MaterialTheme.typography.labelMedium,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+        modifier = Modifier.padding(horizontal = GroupedListInset, vertical = 8.dp),
+    )
+    // The dismissal is a row of the same group: it is the last thing you do to
+    // this list, and a floating button beside it would read as belonging to the
+    // screen rather than to these notices.
+    val rows = notices.size + 1
+    notices.forEachIndexed { index, notice ->
+        GroupedRow(
+            title = notice.subject.ifBlank { stringResource(R.string.task_untitled) },
+            summary = stringResource(
+                R.string.accounts_summary,
+                notice.listName,
+                stringResource(notice.cause.message),
+            ),
+            position = positionOf(index, rows),
+            leading = {
+                Icon(
+                    if (notice.kind == SyncNotice.Kind.QUARANTINED) {
+                        Icons.Rounded.SyncProblem
+                    } else {
+                        Icons.Rounded.HistoryToggleOff
+                    },
+                    contentDescription = null,
+                )
+            },
+            trailing = if (notice.kind == SyncNotice.Kind.QUARANTINED) {
+                {
+                    IconButton(onClick = { onRetry(notice) }) {
+                        Icon(
+                            Icons.Rounded.Refresh,
+                            contentDescription = stringResource(R.string.sync_notice_retry),
+                        )
+                    }
+                }
+            } else {
+                null
+            },
+        )
+    }
+    GroupedRow(
+        title = stringResource(R.string.sync_notices_dismiss),
+        position = positionOf(notices.size, rows),
+        leading = { Icon(Icons.Rounded.Check, contentDescription = null) },
+        onClick = onDismiss,
+    )
+}
+
+/**
+ * Why an edit is gone, in words rather than an enum name.
+ *
+ * A quarantine has no cause of its own — nothing chose it, a resource simply
+ * kept failing — so the null branch is the sentence for that, not a fallback.
+ */
+private val DiscardedEdit.Cause?.message: Int
+    get() = when (this) {
+        DiscardedEdit.Cause.SERVER_NEWER -> R.string.sync_notice_cause_server_newer
+        DiscardedEdit.Cause.DELETED_ON_SERVER -> R.string.sync_notice_cause_deleted_on_server
+        DiscardedEdit.Cause.DELETE_LOST -> R.string.sync_notice_cause_delete_lost
+        null -> R.string.sync_notice_cause_quarantined
+    }
+
+/** The account's logo at full size, over the two things the title bar left out. */
+@Composable
+private fun AccountHero(identity: AccountIdentity) {
+    Column(
+        modifier = Modifier
+            .fillMaxWidth()
+            .padding(horizontal = GroupedListInset),
+        horizontalAlignment = Alignment.CenterHorizontally,
+    ) {
+        ProviderLogo(identity.provider, size = 72.dp)
+        Spacer(Modifier.height(12.dp))
+        identity.user?.let {
+            Text(it, style = MaterialTheme.typography.titleMedium)
+        }
+        Text(
+            identity.secondary ?: stringResource(R.string.accounts_generic_provider),
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+    }
+}
+
+/**
+ * Removing an account is two different things — the lists stay behind as
+ * device-only lists, or they go with it — so it is a browse-style choice, and
+ * those are full-screen. Each row says what it does and does it; leaving without
+ * choosing is back.
+ */
+@Composable
+private fun RemoveAccountPicker(
+    identity: AccountIdentity,
+    onDismiss: () -> Unit,
+    onRemove: (deleteLocalData: Boolean) -> Unit,
+) {
+    FullScreenPicker(
+        title = stringResource(R.string.accounts_remove),
+        onDismiss = onDismiss,
+        predictiveBack = true,
+    ) {
+        Text(
+            stringResource(R.string.accounts_remove_body, identity.title),
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+            modifier = Modifier.padding(horizontal = GroupedListInset),
+        )
+        Spacer(Modifier.height(16.dp))
+        GroupedRow(
+            title = stringResource(R.string.accounts_remove_keep),
+            summary = stringResource(R.string.accounts_remove_keep_body),
+            position = Position.Top,
+            leading = { Icon(Icons.Rounded.Inventory2, contentDescription = null) },
+            onClick = { onRemove(false) },
+        )
+        GroupedRow(
+            title = errorTitle(stringResource(R.string.accounts_remove_wipe)),
+            summary = AnnotatedString(stringResource(R.string.accounts_remove_wipe_body)),
+            position = Position.Bottom,
+            leading = {
+                Icon(
+                    Icons.Rounded.DeleteOutline,
+                    contentDescription = null,
+                    tint = MaterialTheme.colorScheme.error,
+                )
+            },
+            onClick = { onRemove(true) },
+        )
+    }
+}
+
+/**
+ * Which of the account's collections sync, re-read from the server — so lists
+ * made there after setup can be added, and synced ones dropped.
+ */
+@Composable
+private fun SyncedListsPicker(state: AccountsViewModel.ListsState, viewModel: AccountsViewModel) {
+    var confirmingDrop by remember { mutableStateOf(false) }
+    val ready = state as? AccountsViewModel.ListsState.Ready
+
+    FullScreenPicker(
+        title = stringResource(R.string.accounts_lists),
+        onDismiss = viewModel::closeLists,
+        predictiveBack = true,
+        actions = {
+            if (ready != null) {
+                Button(
+                    onClick = {
+                        if (ready.dropping) confirmingDrop = true else viewModel.saveLists(keepUnticked = true)
+                    },
+                    modifier = Modifier.padding(end = 12.dp),
+                ) { Text(stringResource(R.string.save)) }
+            }
+        },
+    ) {
+        when (state) {
+            AccountsViewModel.ListsState.Loading -> Row(
+                modifier = Modifier.padding(horizontal = GroupedListInset),
+                verticalAlignment = Alignment.CenterVertically,
+            ) {
+                CircularProgressIndicator(Modifier.size(20.dp))
+                Spacer(Modifier.width(12.dp))
+                Text(
+                    stringResource(R.string.accounts_lists_loading),
+                    style = MaterialTheme.typography.bodyMedium,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+
+            AccountsViewModel.ListsState.NeedsSignIn -> PickerNote(stringResource(R.string.accounts_needs_sign_in))
+
+            is AccountsViewModel.ListsState.Failed -> PickerNote(
+                stringResource(state.cause?.message ?: R.string.add_account_error_server),
+            )
+
+            is AccountsViewModel.ListsState.Ready -> state.collections.forEachIndexed { index, collection ->
+                val checked = collection.url in state.selected
+                GroupedRow(
+                    title = collection.displayName ?: collection.url.encodedPath,
+                    summary = when {
+                        collection.readOnly -> stringResource(R.string.add_account_lists_read_only)
+                        collection.isShared -> stringResource(R.string.add_account_lists_shared)
+                        else -> null
+                    },
+                    position = positionOf(index, state.collections.size),
+                    selected = checked,
+                    trailing = { if (checked) SelectedCheck() },
+                    onClick = { viewModel.toggleList(collection.url) },
+                )
+            }
+        }
+        Spacer(Modifier.height(16.dp))
+    }
+
+    if (confirmingDrop) {
+        DropListsPicker(
+            onDismiss = { confirmingDrop = false },
+            onChoose = { keep ->
+                confirmingDrop = false
+                viewModel.saveLists(keepUnticked = keep)
+            },
+        )
+    }
+}
+
+@Composable
+private fun PickerNote(text: String) {
+    Text(
+        text,
+        style = MaterialTheme.typography.bodyMedium,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+        modifier = Modifier.padding(horizontal = GroupedListInset),
+    )
+}
+
+/** What happens to the tasks of lists that stop syncing — the same two ways removing an account offers. */
+@Composable
+private fun DropListsPicker(onDismiss: () -> Unit, onChoose: (keep: Boolean) -> Unit) {
+    FullScreenPicker(
+        title = stringResource(R.string.accounts_lists_drop_title),
+        onDismiss = onDismiss,
+        predictiveBack = true,
+    ) {
+        PickerNote(stringResource(R.string.accounts_lists_drop_body))
+        Spacer(Modifier.height(16.dp))
+        GroupedRow(
+            title = stringResource(R.string.accounts_lists_drop_keep),
+            summary = stringResource(R.string.accounts_lists_drop_keep_body),
+            position = Position.Top,
+            leading = { Icon(Icons.Rounded.Inventory2, contentDescription = null) },
+            onClick = { onChoose(true) },
+        )
+        GroupedRow(
+            title = errorTitle(stringResource(R.string.accounts_lists_drop_wipe)),
+            summary = AnnotatedString(stringResource(R.string.accounts_lists_drop_wipe_body)),
+            position = Position.Bottom,
+            leading = {
+                Icon(
+                    Icons.Rounded.DeleteOutline,
+                    contentDescription = null,
+                    tint = MaterialTheme.colorScheme.error,
+                )
+            },
+            onClick = { onChoose(false) },
+        )
+    }
+}
+
+/** A destructive row's title, in the error colour the row itself cannot take. */
+@Composable
+private fun errorTitle(text: String): AnnotatedString {
+    val error = MaterialTheme.colorScheme.error
+    return remember(text, error) {
+        buildAnnotatedString { withStyle(SpanStyle(color = error)) { append(text) } }
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/ui/accounts/AccountIdentity.kt

@@ -0,0 +1,225 @@
+package de.jeanlucmakiola.agendula.ui.accounts
+
+import androidx.compose.foundation.Image
+import androidx.compose.foundation.background
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.rounded.CloudSync
+import androidx.compose.material3.Icon
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.platform.LocalDensity
+import androidx.compose.ui.semantics.clearAndSetSemantics
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.res.painterResource
+import androidx.compose.ui.unit.Dp
+import androidx.compose.ui.unit.dp
+import de.jeanlucmakiola.agendula.R
+import de.jeanlucmakiola.agendula.data.tasks.room.AccountEntity
+import de.jeanlucmakiola.caldav.CalDavProvider
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
+
+/**
+ * What an account is called on screen, and by what mark.
+ *
+ * `display_name` is `user@host` — the right identity for the system account and
+ * for the sync trigger that keys off it, and far too long for a row title. Both
+ * halves are stored separately anyway, so the screen shows the one that
+ * identifies the account and demotes the other to the supporting line.
+ */
+internal data class AccountIdentity(
+    val provider: CalDavProvider?,
+    /** The name: a hosted service's brand, or the host of a server the user runs. */
+    val title: String,
+    /** The half [title] left out — the host under a brand, the software under a host. */
+    val secondary: String?,
+    /** Who, on that server. */
+    val user: String?,
+)
+
+internal fun AccountEntity.identity(): AccountIdentity {
+    val url = principalUrl?.toHttpUrlOrNull()
+    val provider = url?.let { CalDavProvider.forPrincipal(it) }
+    val host = url?.host?.removePrefix("www.")
+    val hosted = provider?.hosted == true
+    return AccountIdentity(
+        provider = provider,
+        // The fallback is the stored name: an account with no principal URL
+        // never got past discovery, so there is nothing better to call it.
+        title = if (hosted) provider.label else host ?: displayName,
+        secondary = if (hosted) host else provider?.label,
+        user = username?.takeIf { it.isNotBlank() },
+    )
+}
+
+/**
+ * The provider's logo: its mark, in white, on a disc of its own brand colour —
+ * the 40dp leading avatar Calendula gives a synced calendar, in colour, so a
+ * list of accounts is scannable by mark rather than by reading hostnames.
+ *
+ * White-on-brand rather than a brand-tinted glyph on a neutral chip, because it
+ * is the shape the marks are actually drawn in and it is the one treatment that
+ * needs no second colour for dark mode. Providers with no brand colour of their
+ * own take the app's [MaterialTheme] accent.
+ *
+ * There are three treatments, and which one a provider gets is decided by how
+ * that provider actually draws itself:
+ *
+ * 1. **A badge** — [CalDavProvider.badge] — fills the circle edge to edge in its
+ *    own colours. Fastmail's icon *is* a ring, so a disc behind it would be a
+ *    ring inside a circle, and knocking it back to white would throw away the
+ *    logo's larger half.
+ * 2. **A mark** — [CalDavProvider.mark] — is tinted white on the brand's disc,
+ *    which is how Nextcloud, Apple and Posteo draw these marks themselves.
+ * 3. **A lettermark** for everything else. Material's `AlternateEmail` was doing
+ *    duty for six providers at once, so a list meant to be read by mark showed
+ *    one glyph six times; the brand's own initial tells them apart and claims
+ *    nothing. The case comes from [CalDavProvider.label], which is why iCloud
+ *    and mailbox.org keep their lowercase letterforms.
+ *
+ * A real logo beats a letter; an *approximated* logo beats neither, which is why
+ * the rest wait for their own art rather than for a good guess at it — and why
+ * every mark here is generated from the vendor's own file, not traced by eye.
+ */
+@Composable
+internal fun ProviderLogo(provider: CalDavProvider?, size: Dp = 40.dp) {
+    val badge = provider?.badge
+    if (badge != null) {
+        // ⚠️ On white, not on nothing. The badge is a ring with a transparent
+        // middle, drawn for a white page — dropped straight onto the row it lets
+        // the surface through, and in dark mode the navy envelope inside it goes
+        // very nearly invisible. White is the background the art is drawn for, so
+        // it is the background it gets, in both themes.
+        Box(
+            modifier = Modifier
+                .size(size)
+                .clip(CircleShape)
+                .background(Color.White),
+            contentAlignment = Alignment.Center,
+        ) {
+            Image(
+                painter = painterResource(badge),
+                contentDescription = null,
+                modifier = Modifier.size(size),
+            )
+        }
+        return
+    }
+
+    val accent = provider?.accent
+    Box(
+        modifier = Modifier
+            .size(size)
+            .clip(CircleShape)
+            .background(accent ?: MaterialTheme.colorScheme.primary),
+        contentAlignment = Alignment.Center,
+    ) {
+        val tint = if (accent != null) Color.White else MaterialTheme.colorScheme.onPrimary
+        val mark = provider?.mark
+        when {
+            mark != null -> Icon(
+                painter = painterResource(mark.res),
+                contentDescription = null,
+                tint = tint,
+                modifier = Modifier.size(size * mark.fraction),
+            )
+
+            // A server we know nothing about has no initial to wear.
+            provider == null -> Icon(
+                imageVector = Icons.Rounded.CloudSync,
+                contentDescription = null,
+                tint = tint,
+                modifier = Modifier.size(size * GLYPH_FRACTION),
+            )
+
+            else -> Text(
+                text = provider.letter,
+                color = tint,
+                style = MaterialTheme.typography.titleMedium,
+                fontWeight = FontWeight.SemiBold,
+                fontSize = with(LocalDensity.current) { (size * LETTER_FRACTION).toSp() },
+                // The name is on the row beside it. A screen reader announcing a
+                // bare "F" before "Fastmail" is noise, not information.
+                modifier = Modifier.clearAndSetSemantics { },
+            )
+        }
+    }
+}
+
+/** A provider whose official icon is a finished badge, colours and all. */
+private val CalDavProvider.badge: Int?
+    get() = when (this) {
+        CalDavProvider.FASTMAIL -> R.drawable.ic_provider_fastmail
+        CalDavProvider.MAILBOX_ORG -> R.drawable.ic_provider_mailbox
+        else -> null
+    }
+
+/**
+ * The letter a service is known by.
+ *
+ * Its own initial, except where the service's actual mark *is* a different
+ * letter: Yandex's is a Cyrillic Я, which is something we can set rather than
+ * art we would have to trace — the only vector they publish is a 64px raster.
+ */
+private val CalDavProvider.letter: String
+    get() = when (this) {
+        CalDavProvider.YANDEX -> "Я"
+        else -> label.take(1)
+    }
+
+/**
+ * A monochrome mark and how much of the disc it is given.
+ *
+ * The fraction is not one number because the marks are not one shape: a wide
+ * mark squared off into the same box reads smaller than a compact one, so it is
+ * given more room to land on the same optical weight.
+ */
+private data class Mark(val res: Int, val fraction: Float)
+
+private val CalDavProvider.mark: Mark?
+    get() = when (this) {
+        CalDavProvider.NEXTCLOUD -> Mark(R.drawable.ic_provider_nextcloud, WIDE_MARK_FRACTION)
+        CalDavProvider.ICLOUD -> Mark(R.drawable.ic_provider_icloud, WIDE_MARK_FRACTION)
+        CalDavProvider.POSTEO -> Mark(R.drawable.ic_provider_posteo, GLYPH_FRACTION)
+        else -> null
+    }
+
+/**
+ * The provider's own brand colour, where it publishes one recognisable enough to
+ * be worth carrying. Null means "we would be inventing it" — Baïkal, DAViCal and
+ * SOGo have no colour anyone would recognise, so they take the theme's accent
+ * instead of a made-up one.
+ *
+ * Each is dark enough to carry a white mark, which is the whole treatment: no
+ * dark-mode variant is needed because neither colour in the pair moves.
+ */
+private val CalDavProvider.accent: Color?
+    get() = when (this) {
+        CalDavProvider.NEXTCLOUD -> Color(0xFF0082C9)
+        CalDavProvider.ICLOUD -> Color(0xFF007AFF)
+        CalDavProvider.GOOGLE -> Color(0xFF1A73E8)
+        CalDavProvider.FASTMAIL -> Color(0xFF2B6CB0)
+        CalDavProvider.MAILBOX_ORG -> Color(0xFF0069B4)
+        // Their own, off their app icon — not the darker green that was
+        // guessed at before the art arrived.
+        CalDavProvider.POSTEO -> Color(0xFFA9D158)
+        CalDavProvider.ZOHO -> Color(0xFFE42527)
+        CalDavProvider.YANDEX -> Color(0xFFFF2500)
+        CalDavProvider.BAIKAL, CalDavProvider.DAVICAL, CalDavProvider.SOGO -> null
+    }
+
+/** The mark sits on the disc the way a launcher icon does — a little over half. */
+private const val GLYPH_FRACTION = 0.55f
+
+/** A letter reads smaller than a glyph of the same box, so it is given less. */
+private const val LETTER_FRACTION = 0.44f
+
+/** A wide mark squared off into the same box has to be given more to match. */
+private const val WIDE_MARK_FRACTION = 0.72f

app/src/full/java/de/jeanlucmakiola/agendula/ui/accounts/AccountsScreen.kt

@@ -0,0 +1,318 @@
+package de.jeanlucmakiola.agendula.ui.accounts
+
+import android.text.format.DateUtils
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.automirrored.rounded.Login
+import androidx.compose.material.icons.rounded.Add
+import androidx.compose.material.icons.rounded.CloudSync
+import androidx.compose.material.icons.rounded.Storage
+import androidx.compose.material.icons.rounded.Sync
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.pluralStringResource
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.unit.dp
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import de.jeanlucmakiola.agendula.R
+import de.jeanlucmakiola.agendula.data.prefs.SYNC_INTERVAL_PRESETS
+import de.jeanlucmakiola.agendula.data.sync.SyncFailure
+import de.jeanlucmakiola.agendula.data.tasks.room.AccountEntity
+import de.jeanlucmakiola.agendula.ui.common.OnResume
+import de.jeanlucmakiola.agendula.ui.settings.SettingsHint
+import de.jeanlucmakiola.floret.components.CollapsingScaffold
+import de.jeanlucmakiola.floret.components.GroupedListInset
+import de.jeanlucmakiola.floret.components.GroupedRow
+import de.jeanlucmakiola.floret.components.OptionPicker
+import de.jeanlucmakiola.floret.components.Position
+import de.jeanlucmakiola.floret.components.positionOf
+
+/** The CalDAV accounts this device syncs with. */
+@Composable
+internal fun AccountsScreen(
+    onAddAccount: () -> Unit,
+    onSignInAgain: (AccountEntity) -> Unit,
+    onOpenAccount: (Long) -> Unit,
+    onOpenStorage: () -> Unit,
+    onBack: () -> Unit,
+    viewModel: AccountsViewModel,
+) {
+    val accounts by viewModel.accounts.collectAsStateWithLifecycle()
+    val usable by viewModel.accountsUsable.collectAsStateWithLifecycle()
+    val syncInterval by viewModel.syncIntervalMinutes.collectAsStateWithLifecycle()
+    val push by viewModel.push.collectAsStateWithLifecycle()
+    var showInterval by remember { mutableStateOf(false) }
+    var showPush by remember { mutableStateOf(false) }
+    OnResume(viewModel::refreshPush)
+
+    CollapsingScaffold(
+        title = stringResource(R.string.settings_section_accounts),
+        onBack = onBack,
+    ) {
+        val loaded = accounts ?: return@CollapsingScaffold
+
+        if (loaded.isEmpty()) {
+            Icon(
+                Icons.Rounded.CloudSync,
+                contentDescription = null,
+                modifier = Modifier.padding(horizontal = GroupedListInset),
+            )
+            Spacer(Modifier.height(12.dp))
+            Text(
+                stringResource(R.string.accounts_empty_title),
+                style = MaterialTheme.typography.titleMedium,
+                modifier = Modifier.padding(horizontal = GroupedListInset),
+            )
+            Spacer(Modifier.height(4.dp))
+            Text(
+                stringResource(R.string.accounts_empty_body),
+                style = MaterialTheme.typography.bodyMedium,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                modifier = Modifier.padding(horizontal = GroupedListInset),
+            )
+            Spacer(Modifier.height(24.dp))
+        } else {
+            loaded.forEachIndexed { index, row ->
+                val account = row.account
+                val identity = account.identity()
+                GroupedRow(
+                    title = identity.title,
+                    // One line, so it says the most useful thing it can. A row
+                    // on its way out has one piece of news; an account holding
+                    // unread sync reports has another, and either outranks
+                    // "synced 5 minutes ago" — but neither outranks a sign-in
+                    // that has stopped, which `syncState` already puts first.
+                    summary = when {
+                        row.removing -> stringResource(R.string.accounts_removing)
+                        row.notices.isNotEmpty() && !row.needsSignIn -> accountSummary(
+                            identity.user,
+                            pluralStringResource(
+                                R.plurals.accounts_notices,
+                                row.notices.size,
+                                row.notices.size,
+                            ),
+                        )
+                        else -> accountSummary(identity.user, syncState(row))
+                    },
+                    position = positionOf(index, loaded.size),
+                    // A row whose account is on its way out is not a row you can
+                    // act on, so it stops looking like one: dimmed, its action
+                    // replaced by the progress, and nothing to tap.
+                    dimmed = row.removing,
+                    leading = { ProviderLogo(identity.provider) },
+                    trailing = {
+                        when {
+                            row.removing -> CircularProgressIndicator(Modifier.size(20.dp))
+                            !usable -> Unit
+                            row.needsSignIn -> IconButton(onClick = { onSignInAgain(account) }) {
+                                Icon(
+                                    Icons.AutoMirrored.Rounded.Login,
+                                    contentDescription = stringResource(R.string.accounts_sign_in_again),
+                                )
+                            }
+                            else -> IconButton(onClick = { viewModel.syncNow(account) }) {
+                                Icon(
+                                    Icons.Rounded.Sync,
+                                    contentDescription = stringResource(R.string.accounts_sync_now),
+                                )
+                            }
+                        }
+                    },
+                    onClick = { onOpenAccount(account.id) }.takeUnless { row.removing },
+                )
+            }
+            Spacer(Modifier.height(24.dp))
+            if (usable) {
+                val pushState = push
+                GroupedRow(
+                    title = stringResource(R.string.accounts_sync_interval),
+                    summary = syncIntervalLabel(syncInterval),
+                    position = if (pushState == null) Position.Alone else Position.Top,
+                    onClick = { showInterval = true },
+                )
+                if (pushState != null) {
+                    GroupedRow(
+                        title = stringResource(R.string.accounts_push),
+                        summary = pushSummary(pushState),
+                        position = Position.Bottom,
+                        onClick = { showPush = true },
+                    )
+                }
+                Spacer(Modifier.height(24.dp))
+            }
+        }
+
+        if (usable) {
+            GroupedRow(
+                title = stringResource(R.string.accounts_add),
+                position = Position.Alone,
+                leading = { Icon(Icons.Rounded.Add, contentDescription = null) },
+                onClick = onAddAccount,
+            )
+        } else {
+            ExternalStorageNotice(onOpenStorage)
+        }
+    }
+
+    if (showInterval) {
+        OptionPicker(
+            title = stringResource(R.string.accounts_sync_interval),
+            options = SYNC_INTERVAL_PRESETS,
+            selected = syncInterval,
+            label = { syncIntervalLabel(it) },
+            header = {
+                SettingsHint(stringResource(R.string.accounts_sync_interval_hint))
+                Spacer(Modifier.height(8.dp))
+            },
+            onSelect = viewModel::setSyncInterval,
+            onDismiss = { showInterval = false },
+        )
+    }
+
+    val pushState = push
+    if (showPush && pushState != null) {
+        PushPicker(
+            push = pushState,
+            onSelect = viewModel::choosePushDistributor,
+            onDismiss = { showPush = false },
+        )
+    }
+}
+
+@Composable
+private fun PushPicker(
+    push: AccountsViewModel.PushUi,
+    onSelect: (String?) -> Unit,
+    onDismiss: () -> Unit,
+) {
+    OptionPicker(
+        title = stringResource(R.string.accounts_push),
+        options = listOf(PUSH_OFF) + push.installed.map { it.packageName },
+        // Nothing is ticked while push is on but no distributor is chosen yet.
+        selected = if (push.enabled) push.current?.packageName else PUSH_OFF,
+        label = { option ->
+            if (option == PUSH_OFF) {
+                stringResource(R.string.accounts_push_off)
+            } else {
+                push.installed.first { it.packageName == option }.label
+            }
+        },
+        header = {
+            SettingsHint(stringResource(R.string.accounts_push_hint))
+            if (push.installed.isEmpty()) SettingsHint(stringResource(R.string.accounts_push_none_installed))
+            Spacer(Modifier.height(8.dp))
+        },
+        onSelect = { option -> onSelect(option.takeUnless { it == PUSH_OFF }) },
+        onDismiss = onDismiss,
+    )
+}
+
+/** The picker's "Off" row, which no package can be named. */
+private const val PUSH_OFF = ""
+
+@Composable
+internal fun pushSummary(push: AccountsViewModel.PushUi): String {
+    val current = push.current
+    val lists = push.lists
+    return when {
+        !push.enabled -> stringResource(R.string.accounts_push_off)
+        push.needsChoice -> stringResource(R.string.accounts_push_choose)
+        current == null -> stringResource(R.string.accounts_push_no_distributor)
+        lists.capable == 0 -> stringResource(R.string.accounts_push_unsupported)
+        lists.subscribed == 0 -> stringResource(R.string.accounts_push_pending)
+        lists.subscribed < lists.synced -> pluralStringResource(
+            R.plurals.accounts_push_partial,
+            lists.synced,
+            lists.subscribed,
+            lists.synced,
+            current.label,
+        )
+        else -> stringResource(R.string.accounts_push_via, current.label)
+    }
+}
+
+/** The same, for one account's lists. */
+@Composable
+internal fun accountPushSummary(push: AccountsViewModel.PushUi, lists: AccountsViewModel.ListPush): String =
+    when {
+        !push.enabled -> stringResource(R.string.accounts_push_off)
+        push.needsChoice -> stringResource(R.string.accounts_push_choose)
+        push.current == null -> stringResource(R.string.accounts_push_no_distributor)
+        lists.capable == 0 -> stringResource(R.string.accounts_push_account_unsupported)
+        lists.subscribed == 0 -> stringResource(R.string.accounts_push_pending)
+        lists.subscribed < lists.synced -> pluralStringResource(
+            R.plurals.accounts_push_account_partial,
+            lists.synced,
+            lists.subscribed,
+            lists.synced,
+        )
+        else -> stringResource(R.string.accounts_push_account_on)
+    }
+
+@Composable
+private fun syncIntervalLabel(minutes: Int): String = when {
+    minutes <= 0 -> stringResource(R.string.accounts_sync_interval_manual)
+    minutes % 60 == 0 -> pluralStringResource(R.plurals.accounts_sync_every_hours, minutes / 60, minutes / 60)
+    else -> pluralStringResource(R.plurals.accounts_sync_every_minutes, minutes, minutes)
+}
+
+/** In External mode accounts stay, but sync into a store nothing is showing. */
+@Composable
+internal fun ExternalStorageNotice(onOpenStorage: () -> Unit) {
+    GroupedRow(
+        title = stringResource(R.string.accounts_external_storage_title),
+        summary = stringResource(R.string.accounts_external_storage),
+        position = Position.Alone,
+        leading = { Icon(Icons.Rounded.Storage, contentDescription = null) },
+        onClick = onOpenStorage,
+    )
+}
+
+/**
+ * Never the raw values: `lastSyncError` is an exception string and `lastSyncAt`
+ * renders as an ISO-8601 UTC instant, and both bypass `strings.xml` entirely.
+ */
+@Composable
+internal fun syncState(row: AccountsViewModel.AccountRow): String = when {
+    // Distinct from a failed sync on purpose: this one has stopped retrying, and
+    // only the user can restart it.
+    row.needsSignIn -> stringResource(R.string.accounts_needs_sign_in)
+    row.account.lastSyncError != null -> failureText(SyncFailure.of(row.account.lastSyncError))
+    row.account.lastSyncAt != null -> DateUtils.getRelativeTimeSpanString(
+        row.account.lastSyncAt.toEpochMilliseconds(),
+        System.currentTimeMillis(),
+        DateUtils.MINUTE_IN_MILLIS,
+    ).toString()
+
+    else -> stringResource(R.string.accounts_never_synced)
+}
+
+/** Why the last sync failed, by class — never the engine's own words. */
+@Composable
+private fun failureText(failure: SyncFailure): String = when (failure.kind) {
+    SyncFailure.Kind.SIGN_IN -> stringResource(R.string.accounts_failed_sign_in)
+    SyncFailure.Kind.UNREACHABLE -> stringResource(R.string.accounts_failed_unreachable)
+    SyncFailure.Kind.CERTIFICATE -> stringResource(R.string.accounts_failed_certificate)
+    SyncFailure.Kind.SERVER -> failure.httpCode
+        ?.let { stringResource(R.string.accounts_failed_server_code, it) }
+        ?: stringResource(R.string.accounts_failed_server)
+    SyncFailure.Kind.MISCONFIGURED -> stringResource(R.string.accounts_failed_misconfigured)
+    SyncFailure.Kind.OTHER -> stringResource(R.string.accounts_sync_failed)
+}
+
+/** Who, then how it last went — the two things the title does not already say. */
+@Composable
+private fun accountSummary(user: String?, state: String): String =
+    if (user == null) state else stringResource(R.string.accounts_summary, user, state)

app/src/full/java/de/jeanlucmakiola/agendula/ui/accounts/AccountsViewModel.kt

@@ -0,0 +1,356 @@
+package de.jeanlucmakiola.agendula.ui.accounts
+
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.viewModelScope
+import dagger.hilt.android.lifecycle.HiltViewModel
+import de.jeanlucmakiola.agendula.data.di.IoDispatcher
+import de.jeanlucmakiola.agendula.data.prefs.DEFAULT_SYNC_INTERVAL_MINUTES
+import de.jeanlucmakiola.agendula.data.prefs.SettingsPrefs
+import de.jeanlucmakiola.agendula.data.sync.AccountRepository
+import de.jeanlucmakiola.agendula.data.sync.AccountStateStore
+import de.jeanlucmakiola.agendula.data.sync.SyncAvailability
+import de.jeanlucmakiola.agendula.data.sync.SyncNotice
+import de.jeanlucmakiola.agendula.data.sync.SyncNoticeStore
+import de.jeanlucmakiola.agendula.data.sync.SyncTrigger
+import de.jeanlucmakiola.agendula.data.sync.push.PushDistributors
+import de.jeanlucmakiola.agendula.data.sync.push.PushRegistrar
+import de.jeanlucmakiola.agendula.data.sync.push.PushStore
+import de.jeanlucmakiola.agendula.data.tasks.room.AccountEntity
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.combine
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.flowOn
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.flow.stateIn
+import kotlinx.coroutines.flow.update
+import kotlinx.coroutines.launch
+import de.jeanlucmakiola.caldav.CalDavDiscovery
+import de.jeanlucmakiola.caldav.TaskCollection
+import okhttp3.HttpUrl
+import javax.inject.Inject
+
+@HiltViewModel
+class AccountsViewModel @Inject constructor(
+    private val repository: AccountRepository,
+    private val syncTrigger: SyncTrigger,
+    private val accountState: AccountStateStore,
+    private val notices: SyncNoticeStore,
+    private val settings: SettingsPrefs,
+    private val distributors: PushDistributors,
+    private val pushRegistrar: PushRegistrar,
+    pushStore: PushStore,
+    availability: SyncAvailability,
+    @IoDispatcher io: CoroutineDispatcher,
+) : ViewModel() {
+
+    /** Minutes between background syncs; 0 = manual only. */
+    val syncIntervalMinutes: StateFlow<Int> = settings.settings.map { it.syncIntervalMinutes }.stateIn(
+        scope = viewModelScope,
+        started = SharingStarted.WhileSubscribed(STOP_TIMEOUT_MILLIS),
+        initialValue = DEFAULT_SYNC_INTERVAL_MINUTES,
+    )
+
+    /** Store the new interval and put every account on it. */
+    fun setSyncInterval(minutes: Int) {
+        viewModelScope.launch {
+            settings.setSyncIntervalMinutes(minutes)
+            repository.rescheduleAll(intervalChanged = true)
+        }
+    }
+
+    /**
+     * An account's synced lists, how many its server offers push for, and how
+     * many actually hold a subscription.
+     */
+    data class ListPush(val synced: Int, val capable: Int, val subscribed: Int) {
+        companion object {
+            val NONE = ListPush(synced = 0, capable = 0, subscribed = 0)
+        }
+    }
+
+    private val listPush: Flow<Map<Long, ListPush>> =
+        combine(repository.observeSyncedLists(), pushStore.observe()) { lists, pushes ->
+            lists.groupBy { it.accountId!! }.mapValues { (_, synced) ->
+                ListPush(
+                    synced = synced.size,
+                    capable = synced.count { pushes[it.id]?.support != null },
+                    subscribed = synced.count { pushes[it.id]?.subscription != null },
+                )
+            }
+        }.distinctUntilChanged()
+
+    /** Push as the Accounts screen shows it. */
+    data class PushUi(
+        val enabled: Boolean,
+        val installed: List<PushDistributors.Distributor>,
+        /** The distributor in use; null when push is off or none is chosen. */
+        val current: PushDistributors.Distributor?,
+        val lists: ListPush,
+    ) {
+        /** On, distributors installed, and none chosen or set as default. */
+        val needsChoice: Boolean get() = enabled && current == null && installed.isNotEmpty()
+    }
+
+    private data class DistributorState(
+        val enabled: Boolean,
+        val installed: List<PushDistributors.Distributor>,
+        val current: PushDistributors.Distributor?,
+    )
+
+    /** Distributors are installed and removed outside the app; bumped on resume. */
+    private val pushRefresh = MutableStateFlow(0)
+
+    /** Package queries only on a setting change or a refresh, and off the main thread. */
+    private val distributorState: Flow<DistributorState> = combine(
+        settings.settings.map { it.pushEnabled }.distinctUntilChanged(),
+        pushRefresh,
+    ) { enabled, _ ->
+        val installed = distributors.installed()
+        val current = distributors.saved().takeIf { enabled }?.let { chosen ->
+            installed.firstOrNull { it.packageName == chosen }
+                ?: PushDistributors.Distributor(chosen, distributors.labelOf(chosen))
+        }
+        DistributorState(enabled, installed, current)
+    }.flowOn(io)
+
+    val push: StateFlow<PushUi?> = combine(distributorState, listPush) { state, perAccount ->
+        PushUi(
+            enabled = state.enabled,
+            installed = state.installed,
+            current = state.current,
+            lists = ListPush(
+                synced = perAccount.values.sumOf { it.synced },
+                capable = perAccount.values.sumOf { it.capable },
+                subscribed = perAccount.values.sumOf { it.subscribed },
+            ),
+        )
+    }.stateIn(
+        scope = viewModelScope,
+        started = SharingStarted.WhileSubscribed(STOP_TIMEOUT_MILLIS),
+        initialValue = null,
+    )
+
+    /**
+     * Re-reads the installed distributors. With push on and none chosen yet, a
+     * newly installed one is adopted and registered first, so the row never
+     * names a distributor nothing has registered with.
+     */
+    fun refreshPush() {
+        viewModelScope.launch {
+            if (settings.settings.first().pushEnabled && distributors.saved() == null) {
+                runCatching { pushRegistrar.updateAll() }
+            }
+            pushRefresh.update { it + 1 }
+        }
+    }
+
+    /** @param packageName the distributor to use, or null to turn push off. */
+    fun choosePushDistributor(packageName: String?) {
+        viewModelScope.launch {
+            if (packageName == null) distributors.disable() else distributors.select(packageName)
+            runCatching { pushRegistrar.updateAll() }
+            pushRefresh.update { it + 1 }
+        }
+    }
+
+    /** False in External storage mode, where accounts are kept but neither added nor synced. */
+    val accountsUsable: StateFlow<Boolean> = availability.observe().stateIn(
+        scope = viewModelScope,
+        started = SharingStarted.WhileSubscribed(STOP_TIMEOUT_MILLIS),
+        initialValue = true,
+    )
+
+    /** An account row, plus the two things the row cannot read from the entity. */
+    data class AccountRow(
+        val account: AccountEntity,
+        val needsSignIn: Boolean,
+        /**
+         * A removal is under way for this account.
+         *
+         * The row survives it: `remove()` revokes the app password over the
+         * network before it touches any store, so several seconds pass — on a
+         * server that stalls, longer — during which the row sat there looking
+         * completely untouched.
+         */
+        val removing: Boolean = false,
+        /**
+         * What the last syncs destroyed or gave up on, newest first.
+         *
+         * ⚠️ On the row rather than in a flow of its own, because it has to
+         * survive the account it belongs to going away: an account is removed
+         * by id, and a notice keyed to an id nothing lists any more is a line
+         * of text about nothing.
+         */
+        val notices: List<SyncNotice> = emptyList(),
+        val lists: ListPush = ListPush.NONE,
+    )
+
+    /**
+     * Accounts whose removal has started and not finished.
+     *
+     * ⚠️ Also the double-tap guard. Nothing else stops a second Remove from
+     * starting a second revocation of a credential the first one is already
+     * handing back — harmless since `c2166b9`, because the sequence is
+     * idempotent either way, but it spends a second network round trip and
+     * leaves the user watching two things happen to one account.
+     */
+    private val _removing = MutableStateFlow<Set<Long>>(emptySet())
+
+    /**
+     * `null` until the first load, so the empty state does not flash.
+     *
+     * ⚠️ Observed, not fetched. The sync that a tap on this screen starts
+     * finishes on a background thread some seconds later, and a snapshot taken
+     * when the screen opened cannot show it — the row went on saying "never
+     * synced" until the user left and came back. This also carries a *background*
+     * sync, and a 401 that stops an account, onto a screen already open.
+     */
+    val accounts: StateFlow<List<AccountRow>?> =
+        combine(
+            repository.observeAll(),
+            accountState.observeNeedingSignIn(),
+            _removing,
+            notices.observeAll(),
+            listPush,
+        ) { accounts, stopped, removing, allNotices, perAccount ->
+            val byAccount = allNotices.groupBy { it.accountId }
+            accounts.map {
+                AccountRow(
+                    account = it,
+                    needsSignIn = it.id in stopped,
+                    removing = it.id in removing,
+                    notices = byAccount[it.id].orEmpty(),
+                    lists = perAccount[it.id] ?: ListPush.NONE,
+                )
+            }
+        }.stateIn(
+            scope = viewModelScope,
+            started = SharingStarted.WhileSubscribed(STOP_TIMEOUT_MILLIS),
+            initialValue = null,
+        )
+
+    /**
+     * The app's own sync trigger.
+     *
+     * Not `ContentResolver.requestSync`: that is gated behind
+     * `hasAuthorityAccess()` at our targetSdk and returns silently when it
+     * refuses, which would leave the user pressing a button that does nothing.
+     */
+    fun syncNow(account: AccountEntity) {
+        // Expedited: the user is looking at the button. Every other trigger is
+        // ordinary work, so the exhaustible per-app quota is spent here or not
+        // at all.
+        syncTrigger.enqueue(account.displayName, expedited = true)
+    }
+
+    /** The user has read what the last sync changed. */
+    fun dismissNotices(account: AccountEntity) {
+        viewModelScope.launch { notices.dismiss(account.id) }
+    }
+
+    /** Clears a quarantined task's failure count and syncs, so it is tried again. */
+    fun retry(notice: SyncNotice) {
+        viewModelScope.launch { repository.retryQuarantined(notice.accountId, notice.key) }
+    }
+
+    fun remove(account: AccountEntity, deleteLocalData: Boolean) {
+        if (account.id in _removing.value) return
+        _removing.update { it + account.id }
+        // No refresh: the row disappears because the query behind `accounts`
+        // re-emits.
+        viewModelScope.launch {
+            try {
+                repository.remove(account.id, account.displayName, deleteLocalData)
+            } finally {
+                // ⚠️ In a `finally`, and not only on the happy path. `remove()`
+                // finishes its destructive tail uncancellable, so the id would
+                // otherwise be stranded in the set by the one case that reaches
+                // here without completing normally — leaving a row that is gone
+                // from Room but pending for ever if it ever came back.
+                _removing.update { it - account.id }
+            }
+        }
+    }
+
+    /** The account's collections, re-read from the server for the lists picker. */
+    sealed interface ListsState {
+        data object Loading : ListsState
+
+        data class Ready(
+            val accountId: Long,
+            val collections: List<TaskCollection>,
+            val attached: Set<String>,
+            val selected: Set<HttpUrl>,
+        ) : ListsState {
+            /** Synced lists this selection would stop syncing — the ones worth asking about. */
+            val dropping: Boolean
+                get() = collections.any { it.url.toString() in attached && it.url !in selected }
+        }
+
+        data object NeedsSignIn : ListsState
+
+        data class Failed(val cause: CalDavDiscovery.Outcome.Cause?) : ListsState
+    }
+
+    private val _lists = MutableStateFlow<ListsState?>(null)
+
+    /** Null while the picker is closed. */
+    val lists: StateFlow<ListsState?> = _lists
+
+    fun openLists(accountId: Long) {
+        _lists.value = ListsState.Loading
+        viewModelScope.launch {
+            val loaded = when (val found = repository.collections(accountId)) {
+                is AccountRepository.Collections.Found -> ListsState.Ready(
+                    accountId = accountId,
+                    collections = found.collections,
+                    attached = found.attached,
+                    selected = found.collections
+                        .filter { it.url.toString() in found.attached }
+                        .map { it.url }
+                        .toSet(),
+                )
+                AccountRepository.Collections.NeedsSignIn -> ListsState.NeedsSignIn
+                is AccountRepository.Collections.Failed -> ListsState.Failed(found.cause)
+            }
+            // Closed while it loaded: stay closed.
+            if (_lists.value == ListsState.Loading) _lists.value = loaded
+        }
+    }
+
+    fun toggleList(url: HttpUrl) {
+        _lists.update { state ->
+            if (state !is ListsState.Ready) return@update state
+            val selected = if (url in state.selected) state.selected - url else state.selected + url
+            state.copy(selected = selected)
+        }
+    }
+
+    fun closeLists() {
+        _lists.value = null
+    }
+
+    /** @param keepUnticked what happens to the tasks of lists that stop syncing. */
+    fun saveLists(keepUnticked: Boolean) {
+        val state = _lists.value as? ListsState.Ready ?: return
+        _lists.value = null
+        viewModelScope.launch {
+            repository.setSyncedCollections(
+                accountId = state.accountId,
+                offered = state.collections,
+                selected = state.selected,
+                keepUnticked = keepUnticked,
+            )
+        }
+    }
+
+    private companion object {
+        /** Survives a configuration change without re-subscribing. */
+        const val STOP_TIMEOUT_MILLIS = 5_000L
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/ui/accounts/add/AddAccountMessage.kt

@@ -0,0 +1,59 @@
+package de.jeanlucmakiola.agendula.ui.accounts.add
+
+import de.jeanlucmakiola.caldav.ServerQuirk
+
+/**
+ * Something the add-account flow has to tell the user, in a form the UI can
+ * translate.
+ *
+ * ⚠️ A type, not a `String`, and not a `@StringRes Int` either. The flow used to
+ * build its sentences in the ViewModel, so a dozen of them shipped in English to
+ * every locale — the same defect `CalDavDiscovery.Outcome.Cause` was introduced
+ * to fix, which it only ever fixed for the address step. Nothing lints for it:
+ * `HardcodedText` reads XML layout attributes, and this app has none. Making the
+ * state fields carry this makes a literal a compile error, which is the only
+ * guard available.
+ *
+ * A resource id would work too, but two of these need a format argument and an
+ * `Int` accepts any other `Int` — this way the argument travels with the message
+ * that needs it, and a test can assert on meaning rather than on prose.
+ */
+sealed interface AddAccountMessage {
+
+    /** Something is happening, and the step says which. */
+    sealed interface Progress : AddAccountMessage {
+        data object Discovering : Progress
+        data object SigningIn : Progress
+        data object ReadingLists : Progress
+        data object Saving : Progress
+    }
+
+    /** Something went wrong, and the step says what. */
+    sealed interface Problem : AddAccountMessage
+
+    data object GoogleUnsupported : Problem
+    data object AlreadyExists : Problem
+    data object ExternalStorage : Problem
+    data object NoUsableLists : Problem
+    data object NotSaved : Problem
+    data object KeystoreRefused : Problem
+    data object CredentialsRejected : Problem
+    data object BrowserApprovalExpired : Problem
+    data object BrowserRateLimited : Problem
+    data object BrowserMaintenance : Problem
+    data object BrowserFailed : Problem
+
+    /** No browser could be opened at all — AOSP, GrapheneOS, a locked-down profile. */
+    data object BrowserUnavailable : Problem
+
+    /**
+     * A home set on a host the credential is not scoped to.
+     *
+     * The host travels with the message rather than being baked into a sentence,
+     * so the translation decides where it goes.
+     */
+    data class OutsideCredentialScope(val host: String) : Problem
+
+    /** A provider whose real requirement is not "wrong password". */
+    data class Quirk(val quirk: ServerQuirk) : Problem
+}

app/src/full/java/de/jeanlucmakiola/agendula/ui/accounts/add/AddAccountParts.kt

@@ -0,0 +1,172 @@
+package de.jeanlucmakiola.agendula.ui.accounts.add
+
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.material3.Button
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringArrayResource
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.input.ImeAction
+import androidx.compose.ui.text.input.KeyboardCapitalization
+import androidx.compose.ui.text.input.KeyboardType
+import androidx.compose.ui.text.input.PasswordVisualTransformation
+import androidx.compose.ui.text.input.VisualTransformation
+import androidx.compose.ui.unit.dp
+import de.jeanlucmakiola.agendula.R
+import de.jeanlucmakiola.caldav.ServerQuirk
+import de.jeanlucmakiola.floret.components.GroupedListInset
+import de.jeanlucmakiola.floret.components.GroupedSurface
+import de.jeanlucmakiola.floret.components.InstructionSteps
+import de.jeanlucmakiola.floret.components.InlineTextField
+import de.jeanlucmakiola.floret.components.Position
+
+/**
+ * The family's text input: a tonal grouped surface with a borderless field in
+ * it, never Material's outlined box.
+ *
+ * The label sits above the value rather than floating into a notch, because a
+ * `GroupedSurface` has no outline for a notch to interrupt.
+ */
+@Composable
+internal fun FieldRow(
+    label: String,
+    value: String,
+    onValueChange: (String) -> Unit,
+    modifier: Modifier = Modifier,
+    position: Position = Position.Alone,
+    placeholder: String = "",
+    error: String? = null,
+    hint: String? = null,
+    keyboardType: KeyboardType = KeyboardType.Text,
+    onImeAction: (() -> Unit)? = null,
+) {
+    // ⚠️ KeyboardType.Password only tells the IME to drop suggestions; it does
+    // not mask anything. Without the transformation the app password renders in
+    // the clear on screen.
+    val masked = keyboardType == KeyboardType.Password
+    Column(modifier) {
+        GroupedSurface(position = position) {
+            Column(Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 12.dp)) {
+                Text(
+                    label,
+                    style = MaterialTheme.typography.labelMedium,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+                InlineTextField(
+                    value = value,
+                    onValueChange = onValueChange,
+                    placeholder = placeholder,
+                    keyboardType = keyboardType,
+                    // A server address and a password are both case-sensitive,
+                    // and sentence-casing either is a support ticket.
+                    capitalization = KeyboardCapitalization.None,
+                    imeAction = ImeAction.Go,
+                    onImeAction = onImeAction,
+                    visualTransformation = if (masked) {
+                        PasswordVisualTransformation()
+                    } else {
+                        VisualTransformation.None
+                    },
+                )
+            }
+        }
+        // ⚠️ Outside the surface, not inside it. An error rendered within the
+        // field's own card reads as part of the value the user typed.
+        (error ?: hint)?.let {
+            Text(
+                it,
+                style = MaterialTheme.typography.bodySmall,
+                color = if (error != null) {
+                    MaterialTheme.colorScheme.error
+                } else {
+                    MaterialTheme.colorScheme.onSurfaceVariant
+                },
+                modifier = Modifier.padding(start = 16.dp, end = 16.dp, top = 6.dp),
+            )
+        }
+    }
+}
+
+/** The shell's primary action shape, so every step ends identically. */
+@Composable
+internal fun PrimaryAction(label: String, enabled: Boolean, onClick: () -> Unit) {
+    Button(
+        onClick = onClick,
+        enabled = enabled,
+        modifier = Modifier.fillMaxWidth().height(56.dp),
+    ) {
+        Text(label, style = MaterialTheme.typography.titleMedium)
+    }
+}
+
+/**
+ * What the chosen service requires, before it is required.
+ *
+ * ⚠️ Steps, not a paragraph. Fastmail and iCloud both reject the account
+ * password with a plain 401, and the fix is a four-action errand in someone
+ * else's web app — the exact shape of instruction that gets skimmed and missed
+ * when it is written as prose. Google is the odd one out and stays a sentence:
+ * there is no procedure, because there is nothing the user can do.
+ *
+ * ⚠️ Collapsed. By the time this draws, the errand has had a whole screen of its
+ * own — [SetupStep] — so what is left to do here is let someone re-read it
+ * without going back, not print it a second time under the field they are
+ * trying to fill in.
+ */
+@Composable
+internal fun QuirkGuidance(quirk: ServerQuirk) {
+    when (quirk) {
+        ServerQuirk.FASTMAIL_APP_PASSWORD -> InstructionSteps(
+            title = stringResource(R.string.add_account_setup_fastmail_title),
+            steps = stringArrayResource(R.array.add_account_setup_fastmail_steps).asList(),
+            footnote = stringResource(R.string.add_account_setup_fastmail_footnote),
+            collapsible = true,
+        )
+
+        ServerQuirk.ICLOUD_APP_SPECIFIC_PASSWORD -> InstructionSteps(
+            title = stringResource(R.string.add_account_setup_icloud_title),
+            steps = stringArrayResource(R.array.add_account_setup_icloud_steps).asList(),
+            footnote = stringResource(R.string.add_account_setup_icloud_footnote),
+            collapsible = true,
+        )
+
+        ServerQuirk.GOOGLE_UNSUPPORTED ->
+            QuirkNote(stringResource(R.string.add_account_quirk_google))
+
+        // A pre-flight warning for the engine, never something to read.
+        ServerQuirk.NEXTCLOUD_BRUTE_FORCE_PROTECTED -> Unit
+    }
+}
+
+/**
+ * A single fact the user has to read — one that is not a procedure, so it is a
+ * card rather than an [InstructionSteps] list of one.
+ *
+ * ⚠️ Inset to `GroupedListInset`, like a grouped row. Without it the note ran to
+ * the screen edge while every row above it stopped 16dp short, so a caller that
+ * is already inside a padded column must not add its own — see [BrowserStep].
+ */
+@Composable
+internal fun QuirkNote(text: String) {
+    GroupedSurface(
+        position = Position.Alone,
+        modifier = Modifier.padding(horizontal = GroupedListInset),
+        // Not tertiaryContainer: under dynamic colour that is the low-chroma
+        // role, and against a light wallpaper-derived surface the card's own
+        // edge disappears even though its text pairing is fine.
+        color = MaterialTheme.colorScheme.secondaryContainer,
+        gapBelow = false,
+    ) {
+        Text(
+            text,
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSecondaryContainer,
+            modifier = Modifier.padding(GroupedListInset),
+        )
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/ui/accounts/add/AddAccountScreen.kt

@@ -0,0 +1,460 @@
+package de.jeanlucmakiola.agendula.ui.accounts.add
+
+import android.content.Intent
+import androidx.activity.compose.BackHandler
+import androidx.browser.customtabs.CustomTabsIntent
+import androidx.compose.foundation.background
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.ColumnScope
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.automirrored.rounded.ArrowBack
+import androidx.compose.material.icons.rounded.Checklist
+import androidx.compose.material.icons.rounded.CloudOff
+import androidx.compose.material.icons.rounded.CloudSync
+import androidx.compose.material.icons.rounded.Lock
+import androidx.compose.material.icons.rounded.OpenInBrowser
+import androidx.compose.material.icons.rounded.Warning
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.core.net.toUri
+import androidx.hilt.lifecycle.viewmodel.compose.hiltViewModel
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import de.jeanlucmakiola.agendula.R
+import de.jeanlucmakiola.agendula.ui.accounts.ProviderLogo
+import de.jeanlucmakiola.floret.components.OnboardingProgress
+import de.jeanlucmakiola.floret.components.OnboardingScaffold
+import de.jeanlucmakiola.floret.components.OnboardingSpace
+
+/**
+ * Adding a CalDAV account: one flow, one back-stack entry.
+ *
+ * A stepper rather than several destinations, because the steps are not
+ * independently reachable — you cannot pick lists before signing in, and going
+ * "back" from the browser step means abandoning a server-side flow rather than
+ * popping a screen. The steps that *have* written nothing do step back, in the
+ * flow rather than out of it; [AddAccountViewModel.onBackWithin] decides which,
+ * and the shell falls out only when it says there is nowhere left to go. The
+ * back arrow and the system back gesture are the same action and run the same
+ * code — a stepper whose gesture skips the steps is a stepper with one way in
+ * and no way back.
+ *
+ * [stepOffset] and [totalSteps] let a longer flow host this one inline — first
+ * run offers the account before it has finished onboarding — so the wizard's
+ * four steps report their place in the *outer* progress rather than restarting
+ * the count at one. Left at their defaults it stands alone.
+ */
+@Composable
+internal fun AddAccountScreen(
+    onDone: () -> Unit,
+    onBack: () -> Unit,
+    stepOffset: Int = 0,
+    // Null when the wizard stands alone: it then counts its own steps, which
+    // vary by provider. A host that draws one bar for a longer flow passes the
+    // whole denominator, having already asked the wizard how long it is.
+    totalSteps: Int? = null,
+    viewModel: AddAccountViewModel = hiltViewModel(),
+) {
+    val state by viewModel.state.collectAsStateWithLifecycle()
+    val context = LocalContext.current
+
+    LaunchedEffect(state.step) {
+        if (state.step !is AddAccountStep.Done) return@LaunchedEffect
+        onDone()
+        // The ViewModel is scoped to the Settings back-stack entry and survives
+        // this section being hidden, so a finished flow left at Done would bounce
+        // the next "Add account" straight back out — and would reuse this
+        // account's username and app password for the next one.
+        viewModel.onStartOver()
+    }
+
+    // Custom Tabs needs three things beyond launchUrl: the <queries> entry in the
+    // manifest (or provider detection silently finds nothing on API 30+), a
+    // fallback for devices with no Custom Tabs browser at all — realistic on
+    // GrapheneOS, CalyxOS and plain AOSP, which is disproportionately this app's
+    // audience — and an explicit way back, since a dismissed tab returns nothing.
+    LaunchedEffect(state.openInBrowser) {
+        val url = state.openInBrowser ?: return@LaunchedEffect
+        val uri = url.toString().toUri()
+        // ⚠️ Neither failure may escape, and neither may be ignored. An
+        // exception out of a LaunchedEffect takes the app down — and the outer
+        // catch named only ActivityNotFoundException, so a SecurityException
+        // from a locked-down profile did exactly that. Reporting the failure is
+        // the other half: clearing openInBrowser regardless left the user on
+        // "waiting for your browser" with a spinner and no browser, on the very
+        // devices this fallback exists for.
+        val launched = runCatching {
+            CustomTabsIntent.Builder().build().launchUrl(context, uri)
+        }.recoverCatching {
+            context.startActivity(Intent(Intent.ACTION_VIEW, uri))
+        }.isSuccess
+        if (launched) viewModel.onBrowserLaunched() else viewModel.onBrowserUnavailable()
+    }
+
+    // Backing out abandons a flow that may still be polling the server every two
+    // seconds for the rest of its twenty-minute window.
+    val abandon = {
+        viewModel.onStartOver()
+        onBack()
+    }
+
+    // One action, two ways to ask for it: step back inside the flow, and fall
+    // out of it only when there is nowhere left to go.
+    val goBack = { if (!viewModel.onBackWithin()) abandon() }
+
+    // ⚠️ The system gesture has to be caught here, not left to the host. The
+    // hosts only put the section away — `SettingsScreen` sets `section = parent`
+    // — while this ViewModel is scoped to the Settings back-stack entry and
+    // outlives that. So a gesture that fell through left the flow *loaded*:
+    // reopening "Add account" landed back on the previous server's list picker,
+    // still holding its username, password and collections. Worse in
+    // `WaitingForBrowser`, where the two-second poll kept running with no screen
+    // attached for the rest of the twenty-minute window, and a password minted
+    // after that point was held unrevoked until Settings itself was left.
+    // Consuming it means [AddAccountViewModel.onStartOver] runs on every exit.
+    BackHandler(onBack = goBack)
+
+    OnboardingScaffold(
+        hero = { StepHero(state) },
+        // Grouped rows and fields carry their own inset, so the column adds none.
+        contentPadding = 0.dp,
+        topSpacing = OnboardingSpace.md,
+        progress = {
+            val position = state.step.position(state.hasSetupStep)?.plus(stepOffset)
+            val total = totalSteps ?: state.totalSteps
+            if (position != null) {
+                OnboardingProgress(
+                    step = position,
+                    total = total,
+                    label = stringResource(R.string.add_account_step_of, position, total),
+                )
+            }
+        },
+        navigationIcon = {
+            IconButton(onClick = goBack) {
+                Icon(
+                    Icons.AutoMirrored.Rounded.ArrowBack,
+                    contentDescription = stringResource(R.string.back),
+                )
+            }
+        },
+        actions = { StepActions(state, viewModel) },
+    ) {
+        val fatal = state.fatal
+        if (fatal != null) {
+            Text(
+                fatal.text(),
+                style = MaterialTheme.typography.bodyLarge,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                textAlign = TextAlign.Center,
+                modifier = Modifier.padding(horizontal = 24.dp),
+            )
+            return@OnboardingScaffold
+        }
+
+        StepTitle(state.step)
+
+        when (val step = state.step) {
+            is AddAccountStep.ChooseProvider -> ProviderStep(step, viewModel)
+            is AddAccountStep.PrepareAccess -> SetupStep(step)
+            is AddAccountStep.EnterAddress -> AddressStep(step, viewModel)
+            is AddAccountStep.Working -> WorkingStep(step)
+            is AddAccountStep.EnterCredentials -> CredentialsStep(step, viewModel)
+            is AddAccountStep.ConfirmBrowser -> ConfirmBrowserStep(step)
+            is AddAccountStep.WaitingForBrowser -> BrowserStep(step)
+            is AddAccountStep.ChooseLists -> ListsStep(step, viewModel)
+            is AddAccountStep.Summary -> SummaryStep(step)
+            AddAccountStep.Done -> Unit
+        }
+
+        // What is known about the chosen service, named before the attempt rather
+        // than after a 401 the user cannot act on.
+        //
+        // ⚠️ Not on the errand step — that step *is* this, and drawing it again
+        // underneath would print the same instructions twice. On the address step
+        // it is the fallback for the one route that skips the errand: picking
+        // "Other server" and then typing an address that turns out to be a
+        // Fastmail or iCloud one.
+        val note = when (state.step) {
+            is AddAccountStep.ChooseProvider, is AddAccountStep.EnterAddress -> state.quirk
+            else -> null
+        }
+        note?.let {
+            Spacer(Modifier.height(OnboardingSpace.md))
+            QuirkGuidance(it)
+        }
+
+        // Learned during the browser step and shown from there on, whichever
+        // step follows: the address it blames is one the user has to go and
+        // correct on the server, and it is just as true once the lists load.
+        state.originMismatch?.let { mismatch ->
+            QuirkNote(
+                text = stringResource(
+                    R.string.add_account_origin_mismatch,
+                    mismatch.actual,
+                    mismatch.expected,
+                ),
+            )
+        }
+    }
+}
+
+/**
+ * Which of the flow's visible steps this is, or null for one that has no place.
+ *
+ * [hasSetup] shifts everything after the errand down by one, because the errand
+ * is a step of its own rather than a screen borrowing the address's number.
+ */
+private fun AddAccountStep.position(hasSetup: Boolean): Int? {
+    val errand = if (hasSetup) 1 else 0
+    return when (this) {
+        is AddAccountStep.ChooseProvider -> 1
+        is AddAccountStep.PrepareAccess -> 2
+        is AddAccountStep.EnterAddress -> 2 + errand
+        // One slot, because only one of the three ever happens: a server either
+        // hands the sign-in to a browser — asking first, where the URL needs
+        // confirming — or asks for a password.
+        is AddAccountStep.EnterCredentials,
+        is AddAccountStep.ConfirmBrowser,
+        is AddAccountStep.WaitingForBrowser,
+        -> 3 + errand
+        is AddAccountStep.ChooseLists -> 4 + errand
+        // The receipt keeps the bar full rather than dropping it: the flow is
+        // finished, and a chrome that vanishes on the last screen reads as a
+        // step lost rather than a step done.
+        is AddAccountStep.Summary -> ADD_ACCOUNT_STEPS + errand
+        // Working is a moment inside whichever step spawned it, and Done is gone
+        // before it draws — neither is a place the user can be.
+        is AddAccountStep.Working, AddAccountStep.Done -> null
+    }
+}
+
+/**
+ * The mark for the step, in the family's tonal circle.
+ *
+ * Once a service has been chosen it wears *that service's* logo instead — the
+ * same mark the accounts list will show — so the flow keeps saying what is being
+ * set up rather than restating that an account is being added.
+ */
+@Composable
+private fun StepHero(state: AddAccountUiState) {
+    if (state.step is AddAccountStep.Summary) {
+        ProviderLogo(state.step.provider, size = 72.dp)
+        return
+    }
+    val chosen = (state.step as? AddAccountStep.EnterAddress)?.choice?.provider
+        ?: (state.step as? AddAccountStep.PrepareAccess)?.choice?.provider
+    if (chosen != null && state.fatal == null) {
+        ProviderLogo(chosen, size = 72.dp)
+        return
+    }
+    val icon = when {
+        state.fatal != null -> Icons.Rounded.CloudOff
+        state.step is AddAccountStep.EnterCredentials -> Icons.Rounded.Lock
+        // The warning is the screen, so it is the mark too — the browser icon
+        // would say "this is going fine", which is the opposite of the point.
+        state.step is AddAccountStep.ConfirmBrowser -> Icons.Rounded.Warning
+        state.step is AddAccountStep.WaitingForBrowser -> Icons.Rounded.OpenInBrowser
+        state.step is AddAccountStep.ChooseLists -> Icons.Rounded.Checklist
+        else -> Icons.Rounded.CloudSync
+    }
+    Box(
+        modifier = Modifier
+            .size(72.dp)
+            .clip(CircleShape)
+            .background(MaterialTheme.colorScheme.secondaryContainer),
+        contentAlignment = Alignment.Center,
+    ) {
+        Icon(
+            icon,
+            contentDescription = null,
+            tint = MaterialTheme.colorScheme.onSecondaryContainer,
+            modifier = Modifier.size(34.dp),
+        )
+    }
+}
+
+/** Title and one line of explanation, centred above whatever the step asks for. */
+@Composable
+private fun StepTitle(step: AddAccountStep) {
+    val (title, body) = when (step) {
+        is AddAccountStep.ChooseProvider ->
+            R.string.add_account_provider_title to R.string.add_account_provider_body
+        is AddAccountStep.PrepareAccess ->
+            step.quirk.setupTitle to R.string.add_account_setup_body
+        is AddAccountStep.EnterAddress -> if (step.choice.provider?.hosted == true) {
+            R.string.add_account_email_title to R.string.add_account_email_body
+        } else {
+            R.string.add_account_server_title to R.string.add_account_server_body
+        }
+        is AddAccountStep.EnterCredentials ->
+            R.string.add_account_credentials_title to R.string.add_account_credentials_body
+        is AddAccountStep.ConfirmBrowser ->
+            R.string.add_account_browser_confirm_title to R.string.add_account_browser_confirm_body
+        is AddAccountStep.ChooseLists ->
+            R.string.add_account_lists_title to R.string.add_account_lists_body
+        is AddAccountStep.Summary ->
+            R.string.add_account_summary_title to R.string.add_account_summary_body
+        else -> return
+    }
+    Text(
+        stringResource(title),
+        style = MaterialTheme.typography.headlineSmall,
+        textAlign = TextAlign.Center,
+        modifier = Modifier.padding(horizontal = 24.dp),
+    )
+    Spacer(Modifier.height(8.dp))
+    Text(
+        stringResource(body),
+        style = MaterialTheme.typography.bodyMedium,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+        textAlign = TextAlign.Center,
+        modifier = Modifier.padding(horizontal = 24.dp),
+    )
+    Spacer(Modifier.height(OnboardingSpace.lg))
+}
+
+/**
+ * The step's call to action, pinned at the bottom the way the onboarding shell
+ * puts it.
+ *
+ * One primary action per step, always in the same place, so the flow reads as
+ * one screen advancing rather than five different ones. A step that commits
+ * nothing renders no button rather than a disabled one.
+ */
+@Composable
+private fun ColumnScope.StepActions(state: AddAccountUiState, viewModel: AddAccountViewModel) {
+    if (state.fatal != null) {
+        PrimaryAction(
+            label = stringResource(R.string.add_account_start_over),
+            enabled = true,
+            onClick = viewModel::onStartOver,
+        )
+        return
+    }
+
+    when (val step = state.step) {
+        // ⚠️ No action at all. Tapping a row *is* the choice and advances on the
+        // spot, so a Continue here would be a second press for the same decision
+        // — and a disabled one, before anything is picked, that looks like the
+        // screen is broken.
+        is AddAccountStep.ChooseProvider -> Unit
+
+        is AddAccountStep.PrepareAccess -> PrimaryAction(
+            label = stringResource(R.string.add_account_continue),
+            enabled = true,
+            onClick = viewModel::onSetupAcknowledged,
+        )
+
+        is AddAccountStep.EnterAddress -> PrimaryAction(
+            label = stringResource(R.string.add_account_continue),
+            enabled = step.input.isNotBlank(),
+            onClick = viewModel::onAddressSubmitted,
+        )
+
+        is AddAccountStep.EnterCredentials -> PrimaryAction(
+            label = stringResource(R.string.add_account_sign_in),
+            enabled = step.username.isNotBlank() && step.password.isNotEmpty(),
+            onClick = viewModel::onCredentialsSubmitted,
+        )
+
+        is AddAccountStep.ChooseLists -> PrimaryAction(
+            // The count is the feedback: a disabled button with no explanation
+            // is the commonest way a picker looks broken.
+            label = if (step.selected.isEmpty()) {
+                stringResource(R.string.add_account_no_lists_selected)
+            } else {
+                stringResource(R.string.add_account_save)
+            },
+            enabled = step.selected.isNotEmpty(),
+            onClick = viewModel::onSave,
+        )
+
+        is AddAccountStep.Summary -> PrimaryAction(
+            label = stringResource(R.string.add_account_summary_done),
+            enabled = true,
+            onClick = viewModel::onSummaryDone,
+        )
+
+        // The way forward stays primary: both causes are legitimate behind a
+        // reverse proxy, and refusing outright would make Login Flow v2 unusable
+        // for a large share of self-hosted installs. The password route is the
+        // secondary, exactly as it is one step later.
+        is AddAccountStep.ConfirmBrowser -> {
+            PrimaryAction(
+                label = stringResource(R.string.add_account_browser_open),
+                enabled = true,
+                onClick = viewModel::onBrowserConfirmed,
+            )
+            TextButton(
+                onClick = viewModel::onBrowserCancelled,
+                modifier = Modifier.fillMaxWidth(),
+            ) { Text(stringResource(R.string.add_account_browser_use_password)) }
+        }
+
+        is AddAccountStep.WaitingForBrowser -> {
+            // A failed flow is retried by default. With no browser a retry
+            // cannot help; while the server throttles or is in maintenance an
+            // immediate one only adds to it, so a password comes first.
+            val usePassword = @Composable { primary: Boolean ->
+                if (primary) {
+                    PrimaryAction(
+                        label = stringResource(R.string.add_account_browser_use_password),
+                        enabled = true,
+                        onClick = viewModel::onBrowserCancelled,
+                    )
+                } else {
+                    TextButton(onClick = viewModel::onBrowserCancelled, modifier = Modifier.fillMaxWidth()) {
+                        Text(stringResource(R.string.add_account_browser_use_password))
+                    }
+                }
+            }
+            val retry = @Composable { primary: Boolean ->
+                if (primary) {
+                    PrimaryAction(
+                        label = stringResource(R.string.add_account_browser_retry),
+                        enabled = true,
+                        onClick = viewModel::onBrowserRetry,
+                    )
+                } else {
+                    TextButton(onClick = viewModel::onBrowserRetry, modifier = Modifier.fillMaxWidth()) {
+                        Text(stringResource(R.string.add_account_browser_retry))
+                    }
+                }
+            }
+            when (step.error) {
+                null -> usePassword(false)
+                AddAccountMessage.BrowserUnavailable -> usePassword(true)
+                AddAccountMessage.BrowserRateLimited, AddAccountMessage.BrowserMaintenance -> {
+                    usePassword(true)
+                    retry(false)
+                }
+                else -> {
+                    retry(true)
+                    usePassword(false)
+                }
+            }
+        }
+
+        is AddAccountStep.Working, AddAccountStep.Done -> Unit
+    }
+}
+

app/src/full/java/de/jeanlucmakiola/agendula/ui/accounts/add/AddAccountText.kt

@@ -0,0 +1,78 @@
+package de.jeanlucmakiola.agendula.ui.accounts.add
+
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.res.stringResource
+import de.jeanlucmakiola.agendula.R
+import de.jeanlucmakiola.caldav.CalDavDiscovery
+import de.jeanlucmakiola.caldav.ServerQuirk
+
+/**
+ * A discovery failure, in words rather than a status code.
+ *
+ * ⚠️ The server's own message never reaches the screen. The most common failure
+ * here is a **405** — what an ordinary web server answers to `PROPFIND`, and so
+ * what someone typing their *website* instead of their CalDAV address gets — and
+ * "HTTP 405 Method Not Allowed" tells them nothing they can act on. It is also
+ * untranslatable, and frequently not in a language they read.
+ */
+internal val CalDavDiscovery.Outcome.Cause.message: Int
+    get() = when (this) {
+        CalDavDiscovery.Outcome.Cause.NOT_AN_ADDRESS -> R.string.add_account_error_not_an_address
+        CalDavDiscovery.Outcome.Cause.NOT_A_DAV_SERVER -> R.string.add_account_error_not_dav
+        CalDavDiscovery.Outcome.Cause.NO_CALENDAR_SUPPORT -> R.string.add_account_error_no_calendar
+        CalDavDiscovery.Outcome.Cause.UNREACHABLE -> R.string.add_account_error_unreachable
+        CalDavDiscovery.Outcome.Cause.INSECURE -> R.string.add_account_error_insecure
+        CalDavDiscovery.Outcome.Cause.NO_CALENDARS -> R.string.add_account_error_no_calendars
+        CalDavDiscovery.Outcome.Cause.SERVER_ERROR -> R.string.add_account_error_server
+    }
+
+/**
+ * The same rule as [message], for the messages the flow itself produces.
+ *
+ * Kept here rather than on [AddAccountMessage] so the type stays a plain Kotlin
+ * one and the resource ids stay where the resources are.
+ */
+@Composable
+internal fun AddAccountMessage.text(): String = when (this) {
+    AddAccountMessage.Progress.Discovering ->
+        stringResource(R.string.add_account_working_discovering)
+    AddAccountMessage.Progress.SigningIn ->
+        stringResource(R.string.add_account_working_signing_in)
+    AddAccountMessage.Progress.ReadingLists ->
+        stringResource(R.string.add_account_working_reading_lists)
+    AddAccountMessage.Progress.Saving ->
+        stringResource(R.string.add_account_working_saving)
+    AddAccountMessage.GoogleUnsupported ->
+        stringResource(R.string.add_account_error_google_unsupported)
+    AddAccountMessage.AlreadyExists ->
+        stringResource(R.string.add_account_error_already_exists)
+    AddAccountMessage.ExternalStorage ->
+        stringResource(R.string.accounts_external_storage)
+    AddAccountMessage.NoUsableLists ->
+        stringResource(R.string.add_account_error_no_usable_lists)
+    AddAccountMessage.NotSaved -> stringResource(R.string.add_account_error_not_saved)
+    AddAccountMessage.KeystoreRefused -> stringResource(R.string.add_account_error_keystore)
+    AddAccountMessage.CredentialsRejected ->
+        stringResource(R.string.add_account_error_credentials_rejected)
+    AddAccountMessage.BrowserApprovalExpired ->
+        stringResource(R.string.add_account_browser_error_expired)
+    AddAccountMessage.BrowserRateLimited ->
+        stringResource(R.string.add_account_browser_error_rate_limited)
+    AddAccountMessage.BrowserMaintenance ->
+        stringResource(R.string.add_account_browser_error_maintenance)
+    AddAccountMessage.BrowserFailed ->
+        stringResource(R.string.add_account_browser_error_failed)
+    AddAccountMessage.BrowserUnavailable ->
+        stringResource(R.string.add_account_browser_error_unavailable)
+    is AddAccountMessage.OutsideCredentialScope ->
+        stringResource(R.string.add_account_error_cross_domain, host)
+    is AddAccountMessage.Quirk -> when (quirk) {
+        ServerQuirk.FASTMAIL_APP_PASSWORD ->
+            stringResource(R.string.add_account_quirk_hint_fastmail)
+        ServerQuirk.ICLOUD_APP_SPECIFIC_PASSWORD ->
+            stringResource(R.string.add_account_quirk_hint_icloud)
+        // Neither reaches a credentials step: Google is refused before it, and
+        // the brute-force note is a pre-flight warning.
+        else -> ""
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/ui/accounts/add/AddressStep.kt

@@ -0,0 +1,43 @@
+package de.jeanlucmakiola.agendula.ui.accounts.add
+
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.padding
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.input.KeyboardType
+import androidx.compose.ui.unit.dp
+import de.jeanlucmakiola.agendula.R
+
+/**
+ * Step 2: the one address the chosen service actually needs.
+ *
+ * A hosted service is reached by the email address the user already knows, so it
+ * asks for that and nothing else; a server they run is reached by a URL only
+ * they have. The old single field had to ask for either, which is why its hint
+ * had to show both.
+ */
+@Composable
+internal fun AddressStep(step: AddAccountStep.EnterAddress, viewModel: AddAccountViewModel) {
+    val hosted = step.choice.provider?.hosted == true
+    Column(Modifier.padding(horizontal = 16.dp), verticalArrangement = Arrangement.spacedBy(16.dp)) {
+        FieldRow(
+            label = if (hosted) {
+                stringResource(R.string.add_account_email_label)
+            } else {
+                stringResource(R.string.add_account_server_label)
+            },
+            value = step.input,
+            onValueChange = viewModel::onAddressChanged,
+            placeholder = step.choice.provider?.primaryDomain?.let { "you@$it" }
+                ?: stringResource(R.string.add_account_server_hint),
+            error = step.error?.let { stringResource(it.message) },
+            // An email address is still typed with the URI keyboard: it is the
+            // one that carries "@" and "." without a shift, and the field takes
+            // a URL too whenever a hosted service is reached by one.
+            keyboardType = KeyboardType.Uri,
+            onImeAction = viewModel::onAddressSubmitted,
+        )
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/ui/accounts/add/ListsStep.kt

@@ -0,0 +1,36 @@
+package de.jeanlucmakiola.agendula.ui.accounts.add
+
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.height
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.unit.dp
+import de.jeanlucmakiola.agendula.R
+import de.jeanlucmakiola.floret.components.GroupedRow
+import de.jeanlucmakiola.floret.components.SelectedCheck
+import de.jeanlucmakiola.floret.components.positionOf
+
+/** Step 4: which of the account's collections to keep in sync. */
+@Composable
+internal fun ListsStep(step: AddAccountStep.ChooseLists, viewModel: AddAccountViewModel) {
+    // The heading is the shell's; this step only lists.
+    step.collections.forEachIndexed { index, collection ->
+        val checked = collection.url in step.selected
+        GroupedRow(
+            title = collection.displayName ?: collection.url.encodedPath,
+            summary = when {
+                collection.readOnly -> stringResource(R.string.add_account_lists_read_only)
+                collection.isShared -> stringResource(R.string.add_account_lists_shared)
+                else -> null
+            },
+            position = positionOf(index, step.collections.size),
+            selected = checked,
+            // The family marks a chosen row with a check, not a Material
+            // checkbox — same affordance every picker in the app uses.
+            trailing = { if (checked) SelectedCheck() },
+            onClick = { viewModel.onListToggled(collection.url) },
+        )
+    }
+    Spacer(Modifier.height(16.dp))
+}

app/src/full/java/de/jeanlucmakiola/agendula/ui/accounts/add/ProviderStep.kt

@@ -0,0 +1,73 @@
+package de.jeanlucmakiola.agendula.ui.accounts.add
+
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.height
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.unit.dp
+import de.jeanlucmakiola.agendula.R
+import de.jeanlucmakiola.agendula.ui.accounts.ProviderLogo
+import de.jeanlucmakiola.caldav.CalDavProvider
+import de.jeanlucmakiola.caldav.ServerQuirk
+import de.jeanlucmakiola.floret.components.GroupedRow
+import de.jeanlucmakiola.floret.components.GroupedSectionHeader
+import de.jeanlucmakiola.floret.components.Position
+import de.jeanlucmakiola.floret.components.SelectedCheck
+import de.jeanlucmakiola.floret.components.positionOf
+
+/**
+ * Step 1: which service the tasks live on.
+ *
+ * The services we know by name, each by its own mark, and then the escape hatch
+ * for everything else. Choosing here is what lets step 2 ask one clear question
+ * instead of "an email address, or a server address, whichever you have" — and
+ * it is what puts a provider's app-password rule in front of the user *before*
+ * the 401 rather than after it.
+ */
+@Composable
+internal fun ProviderStep(step: AddAccountStep.ChooseProvider, viewModel: AddAccountViewModel) {
+    val services = CalDavProvider.selectable
+    services.forEachIndexed { index, provider ->
+        val choice = ProviderChoice.Service(provider)
+        val chosen = step.choice == choice
+        // ⚠️ On the row, not behind a tap. Google is listed because people come
+        // looking for it — an absent row reads as the app being unfinished
+        // rather than as Google's own limitation — but a row that only reveals
+        // why it cannot be used *after* being selected is the worst of both: it
+        // looks available, then quietly refuses.
+        val unusable = ServerQuirk.forProvider(provider)?.isFatal == true
+        GroupedRow(
+            title = provider.label,
+            summary = when {
+                unusable -> stringResource(R.string.add_account_provider_unsupported)
+                else -> provider.primaryDomain
+                    ?: stringResource(R.string.add_account_provider_self_hosted)
+            },
+            position = positionOf(index, services.size),
+            selected = chosen && !unusable,
+            dimmed = unusable,
+            leading = { ProviderLogo(provider) },
+            trailing = { if (chosen && !unusable) SelectedCheck() },
+            // Still tappable: the summary is the short reason, and the note the
+            // tap brings up is the long one.
+            onClick = { viewModel.onProviderChosen(choice) },
+        )
+    }
+
+    GroupedSectionHeader(stringResource(R.string.add_account_provider_other_header))
+    val other = ProviderChoice.OtherServer
+    val otherChosen = step.choice == other
+    GroupedRow(
+        title = stringResource(R.string.add_account_provider_other),
+        summary = stringResource(R.string.add_account_provider_other_summary),
+        position = Position.Alone,
+        selected = otherChosen,
+        // Null is the family's "a server, unnamed" mark — exactly what this row
+        // is choosing.
+        leading = { ProviderLogo(provider = null) },
+        trailing = { if (otherChosen) SelectedCheck() },
+        onClick = { viewModel.onProviderChosen(other) },
+    )
+    Spacer(Modifier.height(16.dp))
+}

app/src/full/java/de/jeanlucmakiola/agendula/ui/accounts/add/SetupStep.kt

@@ -0,0 +1,56 @@
+package de.jeanlucmakiola.agendula.ui.accounts.add
+
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.height
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringArrayResource
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.unit.dp
+import de.jeanlucmakiola.agendula.R
+import de.jeanlucmakiola.caldav.ServerQuirk
+import de.jeanlucmakiola.floret.components.InstructionSteps
+
+/**
+ * Step 2, first half: the errand the chosen service requires, before anything is
+ * typed.
+ *
+ * A screen of its own rather than a note under the address field. What it asks
+ * for happens somewhere else entirely — open a browser, sign in to the provider,
+ * mint an app password, come back — so it has to be read *before* the fields it
+ * makes answerable, and it needs the room to be four numbered actions rather
+ * than a paragraph. Underneath an input, it was neither.
+ *
+ * The list carries no header of its own: the step's headline already names the
+ * requirement, and repeating it above the rows says it twice.
+ */
+@Composable
+internal fun SetupStep(step: AddAccountStep.PrepareAccess) {
+    InstructionSteps(
+        steps = stringArrayResource(step.quirk.steps).asList(),
+        footnote = stringResource(step.quirk.footnote),
+    )
+    Spacer(Modifier.height(16.dp))
+}
+
+/** The headline for the errand — what the service requires, in one line. */
+internal val ServerQuirk.setupTitle: Int
+    get() = when (this) {
+        ServerQuirk.FASTMAIL_APP_PASSWORD -> R.string.add_account_setup_fastmail_title
+        else -> R.string.add_account_setup_icloud_title
+    }
+
+private val ServerQuirk.steps: Int
+    get() = when (this) {
+        ServerQuirk.FASTMAIL_APP_PASSWORD -> R.array.add_account_setup_fastmail_steps
+        // Only two quirks reach this screen — ServerQuirk.hasSetupSteps is what
+        // decides — so the branch that cannot happen takes the other one rather
+        // than inventing a third set of instructions to be wrong with.
+        else -> R.array.add_account_setup_icloud_steps
+    }
+
+private val ServerQuirk.footnote: Int
+    get() = when (this) {
+        ServerQuirk.FASTMAIL_APP_PASSWORD -> R.string.add_account_setup_fastmail_footnote
+        else -> R.string.add_account_setup_icloud_footnote
+    }

app/src/full/java/de/jeanlucmakiola/agendula/ui/accounts/add/SignInStep.kt

@@ -0,0 +1,167 @@
+package de.jeanlucmakiola.agendula.ui.accounts.add
+
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.ColumnScope
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.rounded.CloudOff
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.Icon
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.input.KeyboardType
+import androidx.compose.ui.unit.dp
+import de.jeanlucmakiola.agendula.R
+import de.jeanlucmakiola.floret.components.Position
+
+/**
+ * Step 3a: a username and a password.
+ *
+ * The generic CalDAV route, taken whenever the server has no browser sign-in to
+ * hand off to.
+ */
+@Composable
+internal fun CredentialsStep(
+    step: AddAccountStep.EnterCredentials,
+    viewModel: AddAccountViewModel,
+) {
+    Column(Modifier.padding(horizontal = 16.dp), verticalArrangement = Arrangement.spacedBy(16.dp)) {
+        // Two fields in one connected group, which is what the family does with
+        // a pair that is filled in together.
+        Column {
+            FieldRow(
+                label = stringResource(R.string.add_account_username_label),
+                value = step.username,
+                onValueChange = viewModel::onUsernameChanged,
+                position = Position.Top,
+            )
+            FieldRow(
+                label = stringResource(R.string.add_account_password_label),
+                value = step.password,
+                onValueChange = viewModel::onPasswordChanged,
+                position = Position.Bottom,
+                error = step.error?.text(),
+                hint = stringResource(R.string.add_account_password_hint),
+                keyboardType = KeyboardType.Password,
+                onImeAction = viewModel::onCredentialsSubmitted,
+            )
+        }
+    }
+}
+
+/**
+ * Step 3b, first half: what is wrong with the page we are about to open.
+ *
+ * ⚠️ A screen of its own, drawn *before* the Custom Tab rather than behind it.
+ * The login URL is where the account password is typed, so a warning about it
+ * has to be readable at the moment it still means something — and the primary
+ * action stays the way forward, because both causes are legitimate on real
+ * deployments and refusing outright would make Login Flow v2 unusable behind an
+ * ordinary reverse proxy.
+ */
+@Composable
+internal fun ColumnScope.ConfirmBrowserStep(step: AddAccountStep.ConfirmBrowser) {
+    // Title and body come from StepTitle like every other fixed step's do; what
+    // is left here is the cause, which is the whole reason the step exists.
+    step.hostMismatch?.let { mismatch ->
+        QuirkNote(
+            text = stringResource(
+                R.string.add_account_browser_host_mismatch,
+                mismatch.actual,
+                mismatch.expected,
+            ),
+        )
+    }
+
+    // Both can be true at once — a proxy that rewrites the host and drops TLS
+    // is one misconfiguration, not two — and each is worth its own sentence.
+    if (step.insecure) {
+        Spacer(Modifier.height(16.dp))
+        QuirkNote(text = stringResource(R.string.add_account_browser_insecure))
+    }
+}
+
+/**
+ * Step 3b: the server is signing the user in, in a browser we do not own.
+ *
+ * The same slot as [CredentialsStep] because only one of the two ever happens —
+ * but its own title, mark and body, since "approve this in your browser" and
+ * "type your password" have nothing in common but their place in the flow.
+ */
+@Composable
+internal fun ColumnScope.BrowserStep(step: AddAccountStep.WaitingForBrowser) {
+    // ⚠️ The title changes too. Swapping only the body left every failure in
+    // this phase — a burnt credential, a 429, a maintenance page — sitting
+    // under the heading "Waiting for your browser", which reads as "still
+    // working" when nothing is working and nothing else will happen.
+    Message(
+        icon = {
+            if (step.error == null) {
+                CircularProgressIndicator(Modifier.size(24.dp))
+            } else {
+                Icon(Icons.Rounded.CloudOff, contentDescription = null)
+            }
+        },
+        title = if (step.error == null) {
+            stringResource(R.string.add_account_browser_title)
+        } else {
+            stringResource(R.string.add_account_browser_failed_title)
+        },
+        text = step.error?.text() ?: stringResource(R.string.add_account_browser_body),
+    )
+
+    // ⚠️ A sibling of the message, not a child of its padded column: QuirkNote
+    // carries the grouped-list inset itself, and nesting it inside one that
+    // already pads by the same amount insets it twice.
+    step.hostMismatch?.let { mismatch ->
+        Spacer(Modifier.height(16.dp))
+        QuirkNote(
+            text = stringResource(
+                R.string.add_account_browser_host_mismatch,
+                mismatch.actual,
+                mismatch.expected,
+            ),
+        )
+    }
+}
+
+@Composable
+internal fun WorkingStep(step: AddAccountStep.Working) {
+    Column(
+        Modifier.fillMaxWidth().padding(32.dp),
+        horizontalAlignment = Alignment.CenterHorizontally,
+        verticalArrangement = Arrangement.spacedBy(16.dp),
+    ) {
+        CircularProgressIndicator()
+        Text(step.message.text(), style = MaterialTheme.typography.bodyLarge)
+    }
+}
+
+@Composable
+private fun Message(
+    icon: @Composable () -> Unit,
+    text: String,
+    title: String? = null,
+) {
+    Column(
+        Modifier.fillMaxWidth().padding(horizontal = 16.dp),
+        verticalArrangement = Arrangement.spacedBy(12.dp),
+    ) {
+        icon()
+        title?.let { Text(it, style = MaterialTheme.typography.titleMedium) }
+        Text(
+            text,
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+    }
+}

app/src/full/java/de/jeanlucmakiola/agendula/ui/accounts/add/SummaryStep.kt

@@ -0,0 +1,81 @@
+package de.jeanlucmakiola.agendula.ui.accounts.add
+
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.width
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.rounded.Check
+import androidx.compose.material3.Icon
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.pluralStringResource
+import androidx.compose.ui.unit.dp
+import de.jeanlucmakiola.agendula.R
+import de.jeanlucmakiola.agendula.ui.accounts.ProviderLogo
+import de.jeanlucmakiola.floret.components.GroupedRow
+import de.jeanlucmakiola.floret.components.GroupedSectionHeader
+import de.jeanlucmakiola.floret.components.positionOf
+
+/**
+ * The receipt: what the flow just set up, under the name the accounts list will
+ * use for it.
+ *
+ * Not a confirmation — the account is already saved, and there is nothing here
+ * to undo. It exists because the wizard used to vanish on success, leaving "did
+ * it take the right lists, and under which name?" answerable only by going and
+ * finding the account again.
+ */
+@Composable
+internal fun SummaryStep(step: AddAccountStep.Summary) {
+    Row(
+        modifier = Modifier.fillMaxWidth().padding(horizontal = 16.dp),
+        verticalAlignment = Alignment.CenterVertically,
+    ) {
+        ProviderLogo(step.provider, size = 48.dp)
+        Spacer(Modifier.width(16.dp))
+        Column {
+            Text(step.title, style = MaterialTheme.typography.titleMedium)
+            // The account's own two supporting facts, in the order the accounts
+            // list gives them: what it is, then who you are on it.
+            listOfNotNull(step.secondary, step.username.takeIf { it.isNotBlank() })
+                .forEach {
+                    Text(
+                        it,
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+        }
+    }
+
+    Spacer(Modifier.height(24.dp))
+
+    GroupedSectionHeader(
+        pluralStringResource(
+            R.plurals.add_account_summary_lists,
+            step.lists.size,
+            step.lists.size,
+        ),
+    )
+    step.lists.forEachIndexed { index, name ->
+        GroupedRow(
+            title = name,
+            position = positionOf(index, step.lists.size),
+            leading = {
+                Icon(
+                    Icons.Rounded.Check,
+                    contentDescription = null,
+                    tint = MaterialTheme.colorScheme.primary,
+                )
+            },
+        )
+    }
+    Spacer(Modifier.height(16.dp))
+}

app/src/full/java/de/jeanlucmakiola/agendula/ui/onboarding/AccountStep.kt

@@ -0,0 +1,35 @@
+package de.jeanlucmakiola.agendula.ui.onboarding
+
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.hilt.lifecycle.viewmodel.compose.hiltViewModel
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import de.jeanlucmakiola.agendula.ui.accounts.add.ADD_ACCOUNT_STEPS
+import de.jeanlucmakiola.agendula.ui.accounts.add.AddAccountScreen
+import de.jeanlucmakiola.agendula.ui.accounts.add.AddAccountViewModel
+
+/** The inline wizard's shortest length, before a provider is picked. */
+internal const val ACCOUNT_STEP_SLOTS = ADD_ACCOUNT_STEPS
+
+/** [OnboardingStep.Account]: the add-account wizard, given the whole screen. */
+@Composable
+internal fun AccountStep(state: OnboardingUiState, viewModel: OnboardingViewModel) {
+    // The same instance the wizard resolves for itself, so its length can be
+    // read here without keeping a second copy of its state.
+    val account: AddAccountViewModel = hiltViewModel()
+    val accountState by account.state.collectAsStateWithLifecycle()
+    // ⚠️ The wizard grows a step for a provider that needs an app password
+    // minted first, and the outer bar has to grow with it — otherwise first
+    // run counts one flow while the screen inside it counts another.
+    LaunchedEffect(accountState.totalSteps) {
+        viewModel.onAccountStepsChanged(accountState.totalSteps)
+    }
+    AddAccountScreen(
+        onDone = { viewModel.onAccountFinished(added = true) },
+        onBack = { viewModel.onAccountFinished(added = false) },
+        stepOffset = state.position - 1,
+        totalSteps = state.total,
+        viewModel = account,
+    )
+}

app/src/full/java/de/jeanlucmakiola/agendula/ui/settings/AccountSections.kt

@@ -0,0 +1,78 @@
+package de.jeanlucmakiola.agendula.ui.settings
+
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.saveable.rememberSaveable
+import androidx.compose.runtime.setValue
+import androidx.hilt.lifecycle.viewmodel.compose.hiltViewModel
+import de.jeanlucmakiola.agendula.data.tasks.room.AccountEntity
+import de.jeanlucmakiola.agendula.ui.accounts.AccountDetailScreen
+import de.jeanlucmakiola.agendula.ui.accounts.AccountsScreen
+import de.jeanlucmakiola.agendula.ui.accounts.AccountsViewModel
+import de.jeanlucmakiola.agendula.ui.accounts.add.AddAccountScreen
+import de.jeanlucmakiola.agendula.ui.accounts.add.AddAccountViewModel
+
+/** Settings → Accounts and the screens under it, layered over the hub. */
+@Composable
+internal fun AccountSections(
+    section: SettingsSection?,
+    initialAccountId: Long?,
+    onSection: (SettingsSection?) -> Unit,
+) {
+    // Hoisted so the add flow can refresh the list it returns to.
+    val accountsViewModel: AccountsViewModel = hiltViewModel()
+    // Shared with the add flow's own lookup, so "sign in again" can prefill it.
+    val addAccountViewModel: AddAccountViewModel = hiltViewModel()
+    val signInAgain: (AccountEntity) -> Unit = { account ->
+        addAccountViewModel.startReauthentication(account.id, account.principalUrl, account.username)
+        onSection(SettingsSection.AddAccount)
+    }
+    // Which account the detail screen is showing; the section alone cannot say.
+    var openAccount by rememberSaveable(initialAccountId) { mutableStateOf(initialAccountId) }
+
+    // Accounts stays composed under Add account, for the same reason Storage
+    // stays composed under Export: the deeper screen slides over it.
+    val accountsOpen = section == SettingsSection.Accounts ||
+        section?.parent == SettingsSection.Accounts
+    SlideInSection(visible = accountsOpen) {
+        AccountsScreen(
+            onAddAccount = {
+                // A sign-in abandoned half-way must not turn this into one.
+                if (addAccountViewModel.state.value.reauthenticating) addAccountViewModel.onStartOver()
+                onSection(SettingsSection.AddAccount)
+            },
+            onSignInAgain = signInAgain,
+            onOpenAccount = {
+                openAccount = it
+                onSection(SettingsSection.Account)
+            },
+            onOpenStorage = { onSection(SettingsSection.Storage) },
+            onBack = { onSection(null) },
+            viewModel = accountsViewModel,
+        )
+    }
+    SlideInSection(visible = section == SettingsSection.Account) {
+        openAccount?.let { id ->
+            AccountDetailScreen(
+                accountId = id,
+                onBack = { onSection(SettingsSection.Accounts) },
+                onRemoved = { onSection(SettingsSection.Accounts) },
+                onSignInAgain = signInAgain,
+                onOpenStorage = { onSection(SettingsSection.Storage) },
+                viewModel = accountsViewModel,
+            )
+        }
+    }
+    SlideInSection(visible = section == SettingsSection.AddAccount) {
+        AddAccountScreen(
+            // The list stays composed underneath, so nothing re-runs its
+            // init and OnResume never fires on a section change. It no longer
+            // needs to: the accounts come from an observed query, so a new
+            // account — and every later sync — arrives on its own.
+            onDone = { onSection(SettingsSection.Accounts) },
+            onBack = { onSection(SettingsSection.Accounts) },
+            viewModel = addAccountViewModel,
+        )
+    }
+}

app/src/full/res/xml/authenticator.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    The account type is generated per build variant by `resValue` in
+    app/build.gradle.kts, so the debug and releaseTest builds get their own and
+    can sit alongside the real app without their accounts colliding. It must stay
+    in step with SyncContract.ACCOUNT_TYPE.
+-->
+<account-authenticator xmlns:android="http://schemas.android.com/apk/res/android"
+    android:accountType="@string/account_type"
+    android:icon="@mipmap/ic_launcher"
+    android:smallIcon="@mipmap/ic_launcher"
+    android:label="@string/app_name" />

app/src/full/res/xml/network_security_config.xml

@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    Since Android 7 a user who correctly installs their private CA into the
+    system store is *still* not trusted by apps — user CAs are excluded from the
+    default trust anchors. That breaks exactly the self-hosting audience this app
+    is for, so they are added back here.
+
+    Cleartext stays off. It has been the default since API 28, and CalDavDiscovery
+    refuses a typed http:// address for the same reason: credentials are never
+    sent over an unencrypted connection. Any escape hatch has to be a narrow,
+    warned, per-account opt-in — Play's User Data policy requires modern
+    cryptography in transit — and this file is not the place for it.
+
+    ⚠️ KNOWN TRADE-OFF, and it is the widest form of this. base-config applies to
+    *all* traffic, so any CA in the user store — a corporate MDM profile, a "free
+    VPN" app's certificate, one installed during some earlier debugging — can
+    transparently intercept the CalDAV connection and read the app password out
+    of the Authorization header. Without this file
+    a correctly installed private CA is simply not trusted, which is the
+    self-hosting case the app exists to serve.
+
+    The narrower posture is cert4android's: trust nothing extra by default, and
+    ask the user per connection via its bound service + notification. That is
+    what should replace this block rather than
+    sit alongside it.
+-->
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false">
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="user" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>

app/src/full/res/xml/sync_adapter.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    userVisible="false" keeps our authority out of the per-item sync list in
+    system Settings — there is only one thing to sync and a switch for it adds
+    nothing. The cost is that Settings' "Sync now" stays greyed out, because
+    enabledSyncNowMenu() needs at least one checked authority switch, which is
+    why the app ships its own sync button.
+
+    supportsUploading="true": this is a two-way sync, and declaring otherwise
+    stops the framework requesting a sync on local changes.
+-->
+<sync-adapter xmlns:android="http://schemas.android.com/apk/res/android"
+    android:contentAuthority="@string/sync_authority"
+    android:accountType="@string/account_type"
+    android:userVisible="false"
+    android:supportsUploading="true"
+    android:allowParallelSyncs="false"
+    android:isAlwaysSyncable="true" />

app/src/main/AndroidManifest.xml

@@ -2,9 +2,15 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:tools="http://schemas.android.com/tools">
 
-    <!-- Tasks provider access. Both permission sets are declared; the active one
+    <!-- External tasks-provider access, for StorageMode.EXTERNAL only. Both
+         permission sets are declared, since the manifest is static; the active one
          (org.tasks.* for tasks.org, org.dmfs.* for OpenTasks) is requested at
-         runtime by the permission flow. Both are dangerous-level. -->
+         runtime by the permission flow, and only once the user has actually
+         selected External mode. Both are dangerous-level.
+
+         StorageMode.OWN needs nothing here: it is a Room database in our own data
+         directory. Agendula publishes no ContentProvider and declares no
+         permissions of its own. -->
     <uses-permission android:name="org.dmfs.permission.READ_TASKS" />
     <uses-permission android:name="org.dmfs.permission.WRITE_TASKS" />
     <uses-permission android:name="org.tasks.permission.READ_TASKS" />
@@ -12,10 +18,9 @@
 
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
     <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
-    <!-- Exact due-time reminders: USE_EXACT_ALARM on 33+, SCHEDULE on 31-32. -->
-    <uses-permission android:name="android.permission.SCHEDULE_EXACT_ALARM"
-        android:maxSdkVersion="32" />
-    <uses-permission android:name="android.permission.USE_EXACT_ALARM" />
+    <!-- Exact due-time reminders. User-granted: USE_EXACT_ALARM is reserved for
+         alarm-clock and calendar apps on Play. Without it reminders go inexact. -->
+    <uses-permission android:name="android.permission.SCHEDULE_EXACT_ALARM" />
 
     <!-- Package visibility (Android 11+): see the tasks providers so
          resolveContentProvider works, and launchable apps so we can open the
@@ -30,15 +35,16 @@
     </queries>
 
     <application
-        android:name=".FloretApp"
+        android:name=".AgendulaApp"
         android:allowBackup="true"
         android:dataExtractionRules="@xml/data_extraction_rules"
         android:fullBackupContent="@xml/backup_rules"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
+        android:localeConfig="@xml/locales_config"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
-        android:theme="@style/Theme.Floret"
+        android:theme="@style/Theme.Agendula"
         tools:targetApi="35">
         <activity
             android:name=".MainActivity"
@@ -49,33 +55,208 @@
                 <action android:name="android.intent.action.MAIN" />
                 <category android:name="android.intent.category.LAUNCHER" />
             </intent-filter>
+            <!-- Shared text becomes a new task's title. -->
+            <intent-filter>
+                <action android:name="android.intent.action.SEND" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="text/plain" />
+            </intent-filter>
+            <!-- An .ics opened or shared from another app goes to the import screen. -->
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="content" />
+                <data android:mimeType="text/calendar" />
+            </intent-filter>
+            <intent-filter>
+                <action android:name="android.intent.action.SEND" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="text/calendar" />
+            </intent-filter>
         </activity>
 
+        <!-- Quick Settings "New task" tile. Only the system QS host can bind it. -->
+        <service
+            android:name=".qs.NewTaskTileService"
+            android:exported="true"
+            android:icon="@drawable/ic_qs_new_task"
+            android:label="@string/qs_tile_new_task"
+            android:permission="android.permission.BIND_QUICK_SETTINGS_TILE">
+            <intent-filter>
+                <action android:name="android.service.quicksettings.action.QS_TILE" />
+            </intent-filter>
+        </service>
+
+        <!-- Standalone crash-report surface; MainActivity routes here on a
+             startup crash-loop. Not exported, kept out of recents. -->
+        <activity
+            android:name=".ui.crash.CrashReportActivity"
+            android:exported="false"
+            android:excludeFromRecents="true"
+            android:launchMode="singleTask" />
+
         <!-- Reminder alarm fires here (internal PendingIntent → not exported). -->
         <receiver
             android:name=".data.reminders.DueReminderReceiver"
             android:exported="false" />
 
-        <!-- Re-arm alarms after reboot. -->
+        <!-- Done / Snooze on a reminder, and the snooze re-show (internal). -->
+        <receiver
+            android:name=".data.reminders.ReminderActionReceiver"
+            android:exported="false" />
+
+        <!-- Re-arm alarms after reboot, an update, a clock/zone change, or an exact-alarm grant. -->
         <receiver
             android:name=".data.reminders.BootReceiver"
             android:exported="true">
             <intent-filter>
                 <action android:name="android.intent.action.BOOT_COMPLETED" />
+                <action android:name="android.intent.action.MY_PACKAGE_REPLACED" />
+                <action android:name="android.intent.action.TIMEZONE_CHANGED" />
+                <action android:name="android.intent.action.TIME_SET" />
+                <action android:name="android.app.action.SCHEDULE_EXACT_ALARM_PERMISSION_STATE_CHANGED" />
             </intent-filter>
         </receiver>
 
-        <!-- Re-sync reminders when the provider changes (external DAVx5 sync).
-             Targets both known authorities; the host must be static. -->
+        <!-- Re-sync reminders when an external provider changes — DAVx5 pulling
+             tasks while Agendula is backgrounded. External mode only: in OWN mode
+             nothing outside the app can change our data, and Room's
+             InvalidationTracker covers our own writes.
+
+             An intent-filter host must be a literal, so both external authorities
+             are listed — one filter each. Two <data> tags in a single filter would
+             mean the same thing (Android takes the cross product of every data
+             attribute in a filter), but reads as if it might not, which is what
+             lint's IntentFilterUniqueDataAttributes warns about. -->
         <receiver
             android:name=".data.reminders.ProviderChangeReceiver"
             android:exported="true">
             <intent-filter>
                 <action android:name="android.intent.action.PROVIDER_CHANGED" />
-                <data android:scheme="content" android:host="org.tasks.opentasks" />
                 <data android:scheme="content" android:host="org.dmfs.tasks" />
             </intent-filter>
+            <intent-filter>
+                <action android:name="android.intent.action.PROVIDER_CHANGED" />
+                <data android:scheme="content" android:host="org.tasks.opentasks" />
+            </intent-filter>
         </receiver>
+
+        <!-- Home-screen task widget (Glance). Exported: the launcher binds it. -->
+        <receiver
+            android:name=".widget.TaskWidgetReceiver"
+            android:label="@string/widget_tasks_label"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.appwidget.action.APPWIDGET_UPDATE" />
+            </intent-filter>
+            <meta-data
+                android:name="android.appwidget.provider"
+                android:resource="@xml/appwidget_info_tasks" />
+        </receiver>
+
+        <!-- "Today" home-screen widget (Glance): a progress ring for today's tasks. -->
+        <receiver
+            android:name=".widget.TodayWidgetReceiver"
+            android:label="@string/widget_today_label"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.appwidget.action.APPWIDGET_UPDATE" />
+            </intent-filter>
+            <meta-data
+                android:name="android.appwidget.provider"
+                android:resource="@xml/appwidget_info_today" />
+        </receiver>
+
+        <!-- "Up next" home-screen widget (Glance): the single nearest due task. -->
+        <receiver
+            android:name=".widget.UpNextWidgetReceiver"
+            android:label="@string/widget_up_next_label"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.appwidget.action.APPWIDGET_UPDATE" />
+            </intent-filter>
+            <meta-data
+                android:name="android.appwidget.provider"
+                android:resource="@xml/appwidget_info_up_next" />
+        </receiver>
+
+        <!-- "Lists" home-screen widget (Glance): one shortcut tile per list. -->
+        <receiver
+            android:name=".widget.ListsWidgetReceiver"
+            android:label="@string/widget_lists_label"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.appwidget.action.APPWIDGET_UPDATE" />
+            </intent-filter>
+            <meta-data
+                android:name="android.appwidget.provider"
+                android:resource="@xml/appwidget_info_lists" />
+        </receiver>
+
+        <!-- "Week" home-screen widget (Glance): a seven-day strip of task counts. -->
+        <receiver
+            android:name=".widget.WeekWidgetReceiver"
+            android:label="@string/widget_week_label"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.appwidget.action.APPWIDGET_UPDATE" />
+            </intent-filter>
+            <meta-data
+                android:name="android.appwidget.provider"
+                android:resource="@xml/appwidget_info_week" />
+        </receiver>
+
+        <!-- Per-widget list picker, launched by the host on placement / reconfigure. -->
+        <activity
+            android:name=".widget.TaskWidgetConfigActivity"
+            android:exported="true"
+            android:excludeFromRecents="true">
+            <intent-filter>
+                <action android:name="android.appwidget.action.APPWIDGET_CONFIGURE" />
+            </intent-filter>
+        </activity>
+
+        <!-- Redraws the widget on the day boundary (the app's own ROLLOVER alarm,
+             sent by explicit PendingIntent) and on a language change; the rest
+             re-arm that alarm. Task changes are handled in-process instead. -->
+        <receiver
+            android:name=".widget.WidgetUpdateReceiver"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.DATE_CHANGED" />
+                <action android:name="android.intent.action.TIME_SET" />
+                <action android:name="android.intent.action.TIMEZONE_CHANGED" />
+                <action android:name="android.intent.action.LOCALE_CHANGED" />
+                <action android:name="android.intent.action.BOOT_COMPLETED" />
+                <action android:name="android.intent.action.MY_PACKAGE_REPLACED" />
+            </intent-filter>
+        </receiver>
+
+        <!-- WorkManager's on-demand initialisation. Removing the default
+             initializer is what lets AgendulaApp supply a HiltWorkerFactory, so
+             @HiltWorker workers can take injected dependencies. -->
+        <provider
+            android:name="androidx.startup.InitializationProvider"
+            android:authorities="${applicationId}.androidx-startup"
+            android:exported="false"
+            tools:node="merge">
+            <meta-data
+                android:name="androidx.work.WorkManagerInitializer"
+                android:value="androidx.startup"
+                tools:node="remove" />
+        </provider>
+
+        <!-- Persists the per-app language on API < 33, where the platform
+             per-app-languages API is unavailable. On 33+ this is a no-op. -->
+        <service
+            android:name="androidx.appcompat.app.AppLocalesMetadataHolderService"
+            android:enabled="false"
+            android:exported="false">
+            <meta-data
+                android:name="autoStoreLocales"
+                android:value="true" />
+        </service>
     </application>
 
 </manifest>

app/src/main/java/de/jeanlucmakiola/agendula/AgendulaApp.kt

@@ -0,0 +1,126 @@
+package de.jeanlucmakiola.agendula
+
+import android.app.Application
+import androidx.hilt.work.HiltWorkerFactory
+import androidx.lifecycle.ProcessLifecycleOwner
+import androidx.work.Configuration
+import dagger.hilt.EntryPoint
+import dagger.hilt.InstallIn
+import dagger.hilt.android.EntryPointAccessors
+import dagger.hilt.android.HiltAndroidApp
+import dagger.hilt.components.SingletonComponent
+import de.jeanlucmakiola.agendula.data.di.ApplicationScope
+import de.jeanlucmakiola.agendula.data.di.ChannelRefresher
+import de.jeanlucmakiola.agendula.data.reminders.ReminderMaintenanceWorker
+import de.jeanlucmakiola.agendula.data.reminders.ReminderScheduler
+import de.jeanlucmakiola.agendula.data.reminders.TaskNotifier
+import de.jeanlucmakiola.agendula.data.tasks.ProviderResolver
+import de.jeanlucmakiola.agendula.data.tasks.StartupGate
+import de.jeanlucmakiola.agendula.data.tasks.room.DatabaseCheckpoint
+import de.jeanlucmakiola.agendula.widget.TaskWidgetUpdater
+import de.jeanlucmakiola.floret.crash.CrashConfig
+import de.jeanlucmakiola.floret.crash.CrashReporter
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.launch
+import java.util.concurrent.atomic.AtomicBoolean
+import javax.inject.Inject
+
+/**
+ * Application entry point. Registered as android:name=".AgendulaApp". Besides
+ * Hilt init, it kicks off a reminder re-sync on launch (independent of any UI),
+ * so alarms reflect tasks synced while the app was closed.
+ */
+@HiltAndroidApp
+class AgendulaApp : Application(), Configuration.Provider {
+
+    /**
+     * Lets `@HiltWorker` workers take injected dependencies. The manifest removes
+     * WorkManager's default initializer so this one is used instead; without both
+     * halves, a worker with a constructor argument fails to instantiate at
+     * runtime rather than at build time.
+     */
+    @Inject lateinit var workerFactory: HiltWorkerFactory
+
+    override val workManagerConfiguration: Configuration
+        get() = Configuration.Builder()
+            .setWorkerFactory(workerFactory)
+            .build()
+
+    override fun onCreate() {
+        super.onCreate()
+        // Install first thing so startup crashes are captured too (privacy-
+        // respecting, on-device; the user submits the report by hand).
+        CrashReporter.install(
+            this,
+            CrashConfig(
+                appLabel = getString(R.string.app_name),
+                newIssueUrl = getString(R.string.report_issue_url),
+                chooseIssueUrl = getString(R.string.report_issue_url),
+            ),
+        )
+        val entryPoint = EntryPointAccessors.fromApplication(this, AppEntryPoint::class.java)
+        val scheduler = entryPoint.reminderScheduler()
+        // Mirror the stored storage mode into ProviderResolver and import a
+        // v0.3.x install's tasks, both before anything reads a store.
+        val startupGate = entryPoint.startupGate()
+        val scope = entryPoint.applicationScope()
+        // An alarm is armed off whichever store was active when it was scheduled,
+        // so a switch has to rebuild the set. Armed only once startup's own
+        // null -> stored transition is past, which the launch sync below covers.
+        val started = AtomicBoolean(false)
+        entryPoint.providerResolver().onModeChanged {
+            if (started.get()) {
+                scope.launch { runCatching { scheduler.sync() } }
+                runCatching { entryPoint.taskNotifier().refreshChannel() }
+            }
+        }
+        startupGate.start()
+        refreshNotificationChannels()
+        ProcessLifecycleOwner.get().lifecycle.addObserver(entryPoint.databaseCheckpoint())
+        scope.launch {
+            // Wait for the stored mode and the import to land first. Rescheduling
+            // alarms against whichever store autoMode happens to pick would arm
+            // them off the wrong one — or off an empty one, mid-import.
+            runCatching {
+                startupGate.awaitReady()
+                started.set(true)
+                scheduler.sync()
+            }
+            runCatching { entryPoint.taskWidgetUpdater().start() }
+            runCatching { ReminderMaintenanceWorker.schedule(this@AgendulaApp) }
+        }
+    }
+
+    override fun onConfigurationChanged(newConfig: android.content.res.Configuration) {
+        super.onConfigurationChanged(newConfig)
+        refreshNotificationChannels()
+        // Language or dark mode changed: the widget's strings and list colours follow.
+        runCatching {
+            EntryPointAccessors.fromApplication(this, AppEntryPoint::class.java).taskWidgetUpdater().requestRefresh()
+        }
+    }
+
+    /** Channel names are stored by the system in whatever language created them. */
+    private fun refreshNotificationChannels() {
+        val entryPoint = EntryPointAccessors.fromApplication(this, AppEntryPoint::class.java)
+        runCatching {
+            entryPoint.taskNotifier().refreshChannel()
+            entryPoint.channelRefreshers().forEach { it.refreshChannel() }
+        }
+    }
+
+        @EntryPoint
+    @InstallIn(SingletonComponent::class)
+    interface AppEntryPoint {
+        fun reminderScheduler(): ReminderScheduler
+        fun startupGate(): StartupGate
+        fun providerResolver(): ProviderResolver
+
+        @ApplicationScope
+        fun applicationScope(): CoroutineScope
+        fun databaseCheckpoint(): DatabaseCheckpoint
+        fun taskNotifier(): TaskNotifier
+        fun channelRefreshers(): Set<@JvmSuppressWildcards ChannelRefresher>
+        fun taskWidgetUpdater(): TaskWidgetUpdater
+    }
+}

app/src/main/java/de/jeanlucmakiola/agendula/MainActivity.kt

@@ -0,0 +1,231 @@
+package de.jeanlucmakiola.agendula
+
+import android.content.Context
+import android.content.Intent
+import android.os.Bundle
+import android.text.format.DateFormat
+import androidx.activity.ComponentActivity
+import androidx.activity.compose.setContent
+import androidx.activity.enableEdgeToEdge
+import androidx.compose.foundation.isSystemInDarkTheme
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.runtime.CompositionLocalProvider
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
+import androidx.core.net.toUri
+import de.jeanlucmakiola.agendula.data.prefs.is24Hour
+import de.jeanlucmakiola.agendula.ui.common.LocalFirstDayOfWeek
+import de.jeanlucmakiola.agendula.ui.common.LocalUse24HourFormat
+import de.jeanlucmakiola.agendula.ui.common.localeFirstDayOfWeek
+import androidx.hilt.lifecycle.viewmodel.compose.hiltViewModel
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import androidx.lifecycle.lifecycleScope
+import dagger.hilt.android.AndroidEntryPoint
+import de.jeanlucmakiola.agendula.data.di.LaunchHook
+import de.jeanlucmakiola.agendula.domain.SmartList
+import de.jeanlucmakiola.agendula.ui.imports.importIntentUri
+import de.jeanlucmakiola.agendula.ui.navigation.AppShortcuts
+import de.jeanlucmakiola.agendula.data.prefs.ThemeMode
+import de.jeanlucmakiola.agendula.ui.RootScreen
+import de.jeanlucmakiola.agendula.ui.crash.CrashReportActivity
+import de.jeanlucmakiola.agendula.ui.navigation.NavRequest
+import de.jeanlucmakiola.agendula.ui.settings.SettingsViewModel
+import de.jeanlucmakiola.agendula.ui.theme.AgendulaTheme
+import de.jeanlucmakiola.floret.crash.CrashReportDialog
+import de.jeanlucmakiola.floret.crash.CrashReporter
+import de.jeanlucmakiola.floret.crash.submitCrashReport
+import kotlinx.coroutines.launch
+import javax.inject.Inject
+
+/**
+ * Single activity. The theme follows [SettingsViewModel]; [RootScreen] is the
+ * (replaceable) functional scaffold over the real data layer. Notification taps
+ * arrive as a [NavRequest] (see [navRequestOf]).
+ */
+@AndroidEntryPoint
+class MainActivity : ComponentActivity() {
+
+    @Inject lateinit var launchHooks: Set<@JvmSuppressWildcards LaunchHook>
+
+    // A captured crash report awaiting the user's decision, surfaced as a dialog
+    // over the app on the next launch (the single-crash path). A startup
+    // crash-loop is handled out of band, before setContent — see below.
+    private var pendingCrashReport by mutableStateOf<String?>(null)
+
+    // A notification tap's destination, handed to the nav host and cleared once taken.
+    private var navRequest by mutableStateOf<NavRequest?>(null)
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
+        // If the app keeps crashing as it starts, the main UI can't be trusted
+        // to come up. Route to the standalone report screen instead of
+        // re-entering the crashing graph.
+        if (CrashReporter.isCrashLoop(this)) {
+            startActivity(Intent(this, CrashReportActivity::class.java))
+            finish()
+            return
+        }
+
+        enableEdgeToEdge()
+        AppShortcuts.publish(this)
+
+        // Only on a fresh launch: after a rotation or process restore the intent
+        // is the same old one and the back stack already holds its destination.
+        val fromHistory = intent.flags and Intent.FLAG_ACTIVITY_LAUNCHED_FROM_HISTORY != 0
+        if (savedInstanceState == null && !fromHistory) navRequest = navRequestOf(intent)
+
+        // Surface a single captured crash as a dialog on the next launch.
+        if (CrashReporter.shouldPrompt(this)) pendingCrashReport = CrashReporter.pendingReport(this)
+
+        // Each hook on its own, so one waiting on the network holds up no other.
+        if (savedInstanceState == null) {
+            launchHooks.forEach { hook -> lifecycleScope.launch { runCatching { hook.onLaunch(intent) } } }
+        }
+        setContent {
+            val settingsViewModel: SettingsViewModel = hiltViewModel()
+            val ui by settingsViewModel.state.collectAsStateWithLifecycle()
+            val darkTheme = when (ui.settings.themeMode) {
+                ThemeMode.SYSTEM -> isSystemInDarkTheme()
+                ThemeMode.LIGHT -> false
+                ThemeMode.DARK -> true
+            }
+            val context = LocalContext.current
+            val use24Hour = ui.settings.timeFormat.is24Hour(DateFormat.is24HourFormat(context))
+            val firstDayOfWeek = ui.settings.weekStart ?: localeFirstDayOfWeek()
+            AgendulaTheme(darkTheme = darkTheme, dynamicColor = ui.settings.dynamicColor) {
+                CompositionLocalProvider(
+                    LocalUse24HourFormat provides use24Hour,
+                    LocalFirstDayOfWeek provides firstDayOfWeek,
+                ) {
+                    RootScreen(
+                        modifier = Modifier.fillMaxSize(),
+                        navRequest = navRequest,
+                        onNavRequestConsumed = { navRequest = null },
+                    )
+                    pendingCrashReport?.let { report ->
+                        CrashReportDialog(
+                            report = report,
+                            onSend = {
+                                submitCrashReport(this@MainActivity, report)
+                                CrashReporter.clearReport(this@MainActivity)
+                                pendingCrashReport = null
+                            },
+                            onDismiss = {
+                                CrashReporter.dismissPrompt(this@MainActivity)
+                                pendingCrashReport = null
+                            },
+                        )
+                    }
+                }
+            }
+        }
+    }
+
+    override fun onNewIntent(intent: Intent) {
+        super.onNewIntent(intent)
+        setIntent(intent)
+        navRequestOf(intent)?.let { navRequest = it }
+    }
+
+    override fun onResume() {
+        super.onResume()
+        // A successful start breaks any loop; reset the timing trail so a later
+        // ordinary crash isn't mistaken for a loop.
+        CrashReporter.markHealthy(this)
+    }
+
+    companion object {
+        const val EXTRA_TASK_ID = "de.jeanlucmakiola.agendula.extra.TASK_ID"
+        const val EXTRA_OCCURRENCE_START = "de.jeanlucmakiola.agendula.extra.OCCURRENCE_START"
+        private const val EXTRA_OPEN_ACCOUNTS = "de.jeanlucmakiola.agendula.extra.OPEN_ACCOUNTS"
+
+        /** The account a sign-in notification is about, on the intent it opens. */
+        const val EXTRA_SIGN_IN_ACCOUNT_ID = "de.jeanlucmakiola.agendula.extra.SIGN_IN_ACCOUNT_ID"
+        const val ACTION_NEW_TASK = "de.jeanlucmakiola.agendula.action.NEW_TASK"
+        const val ACTION_TODAY = "de.jeanlucmakiola.agendula.action.TODAY"
+        private const val ACTION_OPEN_SMART = "de.jeanlucmakiola.agendula.action.OPEN_SMART"
+        private const val ACTION_OPEN_LIST = "de.jeanlucmakiola.agendula.action.OPEN_LIST"
+        private const val EXTRA_SMART_LIST = "de.jeanlucmakiola.agendula.extra.SMART_LIST"
+        private const val EXTRA_LIST_ID = "de.jeanlucmakiola.agendula.extra.LIST_ID"
+        private const val EXTRA_PRESET_LIST_ID = "de.jeanlucmakiola.agendula.extra.PRESET_LIST_ID"
+        private const val SHARED_TITLE_LIMIT = 500
+        private const val NO_OCCURRENCE = -1L
+
+        /**
+         * Opens a task's detail (reminder taps). [occurrenceStart] (epoch millis)
+         * picks the occurrence of a recurring task.
+         */
+        fun taskIntent(context: Context, taskId: Long, occurrenceStart: Long? = null): Intent =
+            Intent(context, MainActivity::class.java).apply {
+                putExtra(EXTRA_TASK_ID, taskId)
+                putExtra(EXTRA_OCCURRENCE_START, occurrenceStart ?: NO_OCCURRENCE)
+                addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+            }
+
+        /** Opens Settings → Accounts, where the sync notice's detail lives. */
+        fun openIntent(context: Context): Intent =
+            Intent(context, MainActivity::class.java)
+                .putExtra(EXTRA_OPEN_ACCOUNTS, true)
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+
+        /**
+         * The launcher shortcut's, Quick Settings tile's and a widget's "New
+         * task". [listId] preset the list when it names exactly one; the data
+         * URI keeps each widget's PendingIntent apart from the others.
+         */
+        fun newTaskIntent(context: Context, listId: Long? = null): Intent =
+            Intent(ACTION_NEW_TASK, listId?.let { "agendula://newtask/$it".toUri() }, context, MainActivity::class.java)
+                .putExtra(EXTRA_PRESET_LIST_ID, listId ?: -1L)
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+
+        fun todayIntent(context: Context): Intent =
+            Intent(ACTION_TODAY, null, context, MainActivity::class.java)
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+
+        /** Opens one smart list; the data URI keeps each widget's PendingIntent apart. */
+        fun smartListIntent(context: Context, list: SmartList): Intent =
+            Intent(ACTION_OPEN_SMART, "agendula://smart/${list.name}".toUri(), context, MainActivity::class.java)
+                .putExtra(EXTRA_SMART_LIST, list.name)
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+
+        /** Opens one real list. */
+        fun listIntent(context: Context, listId: Long): Intent =
+            Intent(ACTION_OPEN_LIST, "agendula://list/$listId".toUri(), context, MainActivity::class.java)
+                .putExtra(EXTRA_LIST_ID, listId)
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+
+        internal fun navRequestOf(intent: Intent?): NavRequest? {
+            if (intent == null) return null
+            if (BuildConfig.SYNC_ENABLED) {
+                intent.getLongExtra(EXTRA_SIGN_IN_ACCOUNT_ID, -1L).takeIf { it > 0L }
+                    ?.let { return NavRequest.OpenAccount(it) }
+                if (intent.getBooleanExtra(EXTRA_OPEN_ACCOUNTS, false)) return NavRequest.OpenAccounts
+            }
+            when (intent.action) {
+                ACTION_NEW_TASK -> return NavRequest.NewTask(
+                    listId = intent.getLongExtra(EXTRA_PRESET_LIST_ID, -1L).takeIf { it > 0L },
+                )
+                ACTION_TODAY -> return NavRequest.OpenSmart(SmartList.TODAY)
+                ACTION_OPEN_SMART -> intent.getStringExtra(EXTRA_SMART_LIST)
+                    ?.let { name -> SmartList.entries.firstOrNull { it.name == name } }
+                    ?.let { return NavRequest.OpenSmart(it) }
+                ACTION_OPEN_LIST -> intent.getLongExtra(EXTRA_LIST_ID, -1L).takeIf { it > 0L }
+                    ?.let { return NavRequest.OpenList(it) }
+            }
+            importIntentUri(intent)?.let { return NavRequest.Import(it) }
+            if (intent.action == Intent.ACTION_SEND && intent.type?.startsWith("text/plain") == true) {
+                val shared = intent.getStringExtra(Intent.EXTRA_SUBJECT)?.takeIf { it.isNotBlank() }
+                    ?: intent.getStringExtra(Intent.EXTRA_TEXT)
+                return NavRequest.NewTask(shared?.trim()?.take(SHARED_TITLE_LIMIT))
+            }
+            val taskId = intent.getLongExtra(EXTRA_TASK_ID, -1L).takeIf { it > 0L } ?: return null
+            val occurrence = intent.getLongExtra(EXTRA_OCCURRENCE_START, NO_OCCURRENCE)
+                .takeIf { it != NO_OCCURRENCE }
+            return NavRequest.OpenTask(taskId, occurrence)
+        }
+    }
+}

app/src/main/java/de/jeanlucmakiola/agendula/data/di/ChannelRefresher.kt

@@ -0,0 +1,22 @@
+package de.jeanlucmakiola.agendula.data.di
+
+import dagger.Module
+import dagger.hilt.InstallIn
+import dagger.hilt.components.SingletonComponent
+import dagger.multibindings.Multibinds
+
+/**
+ * A notification channel a build variant adds, re-created in the current
+ * language on start and on a configuration change. The `full` flavor
+ * contributes the sync notices; `offline` has none.
+ */
+fun interface ChannelRefresher {
+    fun refreshChannel()
+}
+
+@Module
+@InstallIn(SingletonComponent::class)
+abstract class ChannelRefresherModule {
+    @Multibinds
+    abstract fun channelRefreshers(): Set<ChannelRefresher>
+}

app/src/main/java/de/jeanlucmakiola/agendula/data/di/DataModule.kt

@@ -0,0 +1,120 @@
+package de.jeanlucmakiola.agendula.data.di
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.room.Room
+import androidx.room.RoomDatabase
+import androidx.datastore.preferences.preferencesDataStore
+import dagger.Binds
+import dagger.Module
+import dagger.Provides
+import dagger.hilt.InstallIn
+import dagger.hilt.android.qualifiers.ApplicationContext
+import dagger.hilt.components.SingletonComponent
+import de.jeanlucmakiola.agendula.data.tasks.AndroidProviderEnvironment
+import de.jeanlucmakiola.agendula.data.tasks.AndroidTasksDataSource
+import de.jeanlucmakiola.agendula.data.tasks.ModeRoutingTasksDataSource
+import de.jeanlucmakiola.agendula.data.tasks.ProviderEnvironment
+import de.jeanlucmakiola.agendula.data.tasks.ProviderResolver
+import de.jeanlucmakiola.agendula.data.tasks.TasksDataSource
+import de.jeanlucmakiola.agendula.data.tasks.TasksRepository
+import de.jeanlucmakiola.agendula.data.tasks.TasksRepositoryImpl
+import de.jeanlucmakiola.agendula.data.tasks.room.RoomTasksDataSource
+import de.jeanlucmakiola.agendula.data.tasks.room.TasksDatabase
+import androidx.datastore.core.handlers.ReplaceFileCorruptionHandler
+import androidx.datastore.preferences.core.emptyPreferences
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import javax.inject.Provider
+import javax.inject.Singleton
+
+/**
+ * ⚠️ Every one of these needs a corruption handler, and without one a truncated
+ * `preferences_pb` is a **crash at every launch**: `DataStore.data` throws
+ * `CorruptionException` on collection, and the collectors here are root
+ * coroutines in a scope with no handler. A file half-written by a kill during
+ * `edit` is the ordinary way to get one.
+ *
+ * Starting empty is the only recovery available and it is a mild one: the
+ * settings store falls back to defaults, the sync-state store to "never
+ * reconciled", and the credential store to accounts that ask to be signed in
+ * again — all states the app already knows how to be in, unlike a launch loop.
+ */
+internal fun replaceCorrupted() = ReplaceFileCorruptionHandler { emptyPreferences() }
+
+private val Context.agendulaDataStore: DataStore<Preferences> by preferencesDataStore(
+    name = "agendula_prefs",
+    corruptionHandler = replaceCorrupted(),
+)
+
+@Module
+@InstallIn(SingletonComponent::class)
+abstract class DataBindModule {
+
+    @Binds
+    @Singleton
+    abstract fun bindTasksRepository(impl: TasksRepositoryImpl): TasksRepository
+
+    @Binds
+    @Singleton
+    abstract fun bindProviderEnvironment(impl: AndroidProviderEnvironment): ProviderEnvironment
+
+    // Deliberately unqualified-free of the routing above: this is the external
+    // store itself, for the one caller that has to read it while another store is
+    // the active one.
+    @Binds
+    @Singleton
+    @ExternalStore
+    abstract fun bindExternalTasksDataSource(impl: AndroidTasksDataSource): TasksDataSource
+}
+
+@Module
+@InstallIn(SingletonComponent::class)
+object DataProvideModule {
+
+    @Provides
+    @Singleton
+    fun provideDataStore(@ApplicationContext context: Context): DataStore<Preferences> =
+        context.agendulaDataStore
+
+    @Provides
+    @Singleton
+    fun provideTasksDatabase(@ApplicationContext context: Context): TasksDatabase =
+        Room.databaseBuilder(context, TasksDatabase::class.java, TasksDatabase.NAME)
+            // Room's default, stated rather than assumed: Auto Backup copies files
+            // without checkpointing, so a `-wal` sidecar can hold writes the
+            // backed-up `.db` does not. The backup rules carry all three files and
+            // the app checkpoints on ON_STOP.
+            .setJournalMode(RoomDatabase.JournalMode.WRITE_AHEAD_LOGGING)
+            .build()
+
+    /**
+     * The active store, chosen by [StorageMode].
+     *
+     * Resolved per injection point rather than bound once, because the mode is a
+     * user setting that [de.jeanlucmakiola.agendula.data.tasks.StorageModeHolder]
+     * can change while the process lives. Both implementations are singletons, so
+     * this picks between two long-lived objects rather than building either.
+     */
+    @Provides
+    @Singleton
+    fun provideTasksDataSource(
+        resolver: ProviderResolver,
+        room: Provider<RoomTasksDataSource>,
+        external: Provider<AndroidTasksDataSource>,
+    ): TasksDataSource = ModeRoutingTasksDataSource(resolver, room, external)
+
+    @Provides
+    @IoDispatcher
+    fun provideIoDispatcher(): CoroutineDispatcher = Dispatchers.IO
+
+    @Provides
+    @Singleton
+    @ApplicationScope
+    fun provideApplicationScope(): CoroutineScope =
+        // SupervisorJob so one failing collector can't take the others down with it.
+        CoroutineScope(SupervisorJob() + Dispatchers.Default)
+}

app/src/main/java/de/jeanlucmakiola/agendula/data/di/LaunchHook.kt

@@ -0,0 +1,22 @@
+package de.jeanlucmakiola.agendula.data.di
+
+import android.content.Intent
+import dagger.Module
+import dagger.hilt.InstallIn
+import dagger.hilt.components.SingletonComponent
+import dagger.multibindings.Multibinds
+
+/**
+ * Something a build variant runs on a genuine app open (not on a configuration
+ * change): sync in the `full` flavor, the demo seeder in debug builds.
+ */
+fun interface LaunchHook {
+    suspend fun onLaunch(intent: Intent)
+}
+
+@Module
+@InstallIn(SingletonComponent::class)
+abstract class LaunchHookModule {
+    @Multibinds
+    abstract fun launchHooks(): Set<LaunchHook>
+}

app/src/main/java/de/jeanlucmakiola/agendula/data/di/Qualifiers.kt

@@ -0,0 +1,32 @@
+package de.jeanlucmakiola.agendula.data.di
+
+import javax.inject.Qualifier
+
+/** Marks the IO [kotlinx.coroutines.CoroutineDispatcher] for provider access. */
+@Qualifier
+@Retention(AnnotationRetention.BINARY)
+annotation class IoDispatcher
+
+/**
+ * Marks the process-lifetime [kotlinx.coroutines.CoroutineScope] — for work that
+ * outlives any screen and has nothing to be cancelled by, such as keeping the
+ * selected storage mode mirrored out of DataStore. It is never cancelled, so
+ * don't launch anything unbounded in it.
+ */
+@Qualifier
+@Retention(AnnotationRetention.BINARY)
+annotation class ApplicationScope
+
+/**
+ * Marks the **external** provider's [de.jeanlucmakiola.agendula.data.tasks
+ * .TasksDataSource] — the OpenTasks/tasks.org path specifically, rather than
+ * whichever store the active mode selects.
+ *
+ * Only the one-time copy into our own store needs to name a store this way;
+ * everything else goes through the routed source and must keep doing so. Having
+ * it as a binding rather than depending on the concrete class is also what lets
+ * that copy be tested against a fake.
+ */
+@Qualifier
+@Retention(AnnotationRetention.BINARY)
+annotation class ExternalStore

app/src/main/java/de/jeanlucmakiola/agendula/data/export/ExportWriter.kt

@@ -0,0 +1,133 @@
+package de.jeanlucmakiola.agendula.data.export
+
+import android.content.Context
+import android.net.Uri
+import androidx.documentfile.provider.DocumentFile
+import dagger.hilt.android.qualifiers.ApplicationContext
+import de.jeanlucmakiola.agendula.data.di.IoDispatcher
+import de.jeanlucmakiola.agendula.domain.export.ExportDocument
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.withContext
+import java.io.IOException
+import java.util.zip.ZipEntry
+import java.util.zip.ZipOutputStream
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/** Where an export ended up, for the UI to report. */
+data class ExportResult(val fileCount: Int, val taskListNames: List<String>)
+
+/**
+ * Why an export failed, as a value rather than a message: the UI is translated
+ * (see `res/xml/locales_config.xml`), so the wording has to come from a string
+ * resource rather than being built here.
+ */
+enum class ExportFailure {
+    FOLDER_UNAVAILABLE,
+    FOLDER_NOT_WRITABLE,
+    CANNOT_CREATE_FILE,
+    LOST_ACCESS,
+    WRITE_FAILED,
+}
+
+/** The export could not be written. */
+class ExportFailedException(
+    val failure: ExportFailure,
+    cause: Throwable? = null,
+) : IOException(failure.name, cause)
+
+/**
+ * Writes [ExportDocument]s to a user-chosen location through the Storage Access
+ * Framework.
+ *
+ * No storage permission anywhere: SAF hands us a `Uri` the user picked
+ * themselves, which is both the modern approach and the only one that still works
+ * on scoped storage. The caller owns launching `ACTION_CREATE_DOCUMENT` (for
+ * [writeZip]) or `ACTION_OPEN_DOCUMENT_TREE` (for [writeToTree]) and passes the
+ * result here.
+ *
+ * floret-kit material — the plumbing is
+ * not task-domain and Calendula will want the same thing. Kept app-local for now
+ * on the kit's own stated principle of not extracting until a second consumer
+ * actually exists; the seam is here, so moving it later is a file move.
+ */
+@Singleton
+class ExportWriter @Inject constructor(
+    @ApplicationContext private val context: Context,
+    @IoDispatcher private val io: CoroutineDispatcher,
+) {
+
+    /**
+     * Writes every document into [treeUri], a directory the user picked.
+     *
+     * A same-named file is truncated and rewritten in place rather than deleted
+     * and recreated: SAF would otherwise append " (1)" and turn the folder into
+     * an unusable pile of snapshots, and a delete that is not followed by a
+     * successful create loses the previous export outright.
+     *
+     * The directory is listed once. `DocumentFile.findFile` queries the whole
+     * tree per call, so looking each name up in the loop is one full
+     * cross-process directory scan per list.
+     */
+    suspend fun writeToTree(treeUri: Uri, documents: List<ExportDocument>): ExportResult =
+        withContext(io) {
+            runCatching {
+                val tree = DocumentFile.fromTreeUri(context, treeUri)
+                    ?: throw ExportFailedException(ExportFailure.FOLDER_UNAVAILABLE)
+                if (!tree.canWrite()) throw ExportFailedException(ExportFailure.FOLDER_NOT_WRITABLE)
+                val existing = tree.listFiles().associateBy { it.name }
+
+                documents.forEach { document ->
+                    val file = existing[document.fileName]
+                        ?: tree.createFile(MIME_ICALENDAR, document.fileName)
+                        ?: throw ExportFailedException(ExportFailure.CANNOT_CREATE_FILE)
+                    write(file.uri, document.content)
+                }
+            }.getOrElse { throw asExportFailure(it) }
+            ExportResult(documents.size, documents.map { it.fileName })
+        }
+
+    /**
+     * Writes every document into a single zip at [target].
+     *
+     * The one-file form, for sharing or for a backup the user filed somewhere
+     * themselves — one attachment rather than one per list.
+     */
+    suspend fun writeZip(target: Uri, documents: List<ExportDocument>): ExportResult =
+        withContext(io) {
+            runCatching {
+                context.contentResolver.openOutputStream(target, "wt")?.use { raw ->
+                    ZipOutputStream(raw.buffered()).use { zip ->
+                        documents.forEach { document ->
+                            zip.putNextEntry(ZipEntry(document.fileName))
+                            zip.write(document.content)
+                            zip.closeEntry()
+                        }
+                    }
+                } ?: throw ExportFailedException(ExportFailure.WRITE_FAILED)
+            }.getOrElse { throw asExportFailure(it) }
+            ExportResult(documents.size, documents.map { it.fileName })
+        }
+
+    private fun write(target: Uri, bytes: ByteArray) {
+        runCatching {
+            // "wt" truncates. Without it a shorter export leaves the tail of the
+            // previous, longer one behind and produces a corrupt file.
+            context.contentResolver.openOutputStream(target, "wt")?.use { it.write(bytes) }
+                ?: throw ExportFailedException(ExportFailure.WRITE_FAILED)
+        }.getOrElse { throw asExportFailure(it) }
+    }
+
+    private fun asExportFailure(cause: Throwable): Throwable = when (cause) {
+        is ExportFailedException -> cause
+        // A SAF grant can be revoked between the picker and the write (the volume
+        // was unmounted, the provider's process died, the user cleared the grant).
+        is SecurityException -> ExportFailedException(ExportFailure.LOST_ACCESS, cause)
+        is IOException -> ExportFailedException(ExportFailure.WRITE_FAILED, cause)
+        else -> cause
+    }
+
+    private companion object {
+        const val MIME_ICALENDAR = "text/calendar"
+    }
+}

app/src/main/java/de/jeanlucmakiola/agendula/data/export/TaskExporter.kt

@@ -0,0 +1,76 @@
+package de.jeanlucmakiola.agendula.data.export
+
+import de.jeanlucmakiola.agendula.data.di.IoDispatcher
+import de.jeanlucmakiola.agendula.data.tasks.TasksDataSource
+import de.jeanlucmakiola.agendula.domain.export.ExportDocument
+import de.jeanlucmakiola.agendula.domain.export.ExportList
+import de.jeanlucmakiola.agendula.domain.export.ICalendarWriter
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.withContext
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * Turns the user's task lists into `.ics` documents.
+ *
+ * Export is a v1 feature rather than a nicety because of where the data now
+ * lives: our own provider is inside the app's private storage, so in Local mode a
+ * user's tasks exist in exactly one place and uninstalling deletes them. On Play,
+ * where most people will never have a sync engine, that is the majority case.
+ *
+ * **One document per list**, because a list is a CalDAV collection and that is the
+ * unit every other client understands. Bundling everything into a single file
+ * would flatten the lists away, and list membership is not recoverable from a
+ * VTODO afterwards.
+ */
+@Singleton
+class TaskExporter @Inject constructor(
+    private val dataSource: TasksDataSource,
+    @IoDispatcher private val io: CoroutineDispatcher,
+) {
+
+    /**
+     * Serialises [listIds] — every visible list when null.
+     *
+     * A list with no tasks still produces a document. An empty `.ics` is a real
+     * answer ("this list is empty"), whereas a missing file is indistinguishable
+     * from the export having gone wrong.
+     */
+    suspend fun export(listIds: Set<Long>? = null): List<ExportDocument> = withContext(io) {
+        dataSource.taskLists()
+            .filter { listIds == null || it.id in listIds }
+            .map { list ->
+                val document = ExportList(
+                    listId = list.id,
+                    name = list.name,
+                    accountName = list.accountName,
+                    tasks = dataSource.exportTasks(list.id),
+                )
+                ExportDocument(
+                    fileName = fileNameFor(list.name, list.id),
+                    content = ICalendarWriter.write(document).toByteArray(Charsets.UTF_8),
+                )
+            }
+    }
+
+    companion object {
+
+        /**
+         * A file name derived from the list name, safe on every filesystem the
+         * user might pick through SAF (including FAT32 on an SD card).
+         *
+         * The list id is appended rather than trusted to be redundant: two lists on
+         * different accounts may share a name, and two exports landing on the same
+         * file would silently lose one of them.
+         */
+        fun fileNameFor(listName: String, listId: Long): String {
+            val safe = listName
+                .map { if (it.isLetterOrDigit() || it == '-' || it == '_') it else '-' }
+                .joinToString("")
+                .trim('-')
+                .take(60)
+                .ifBlank { "list" }
+            return "$safe-$listId.ics"
+        }
+    }
+}

app/src/main/java/de/jeanlucmakiola/agendula/data/prefs/SettingsPrefs.kt

@@ -0,0 +1,303 @@
+package de.jeanlucmakiola.agendula.data.prefs
+
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.booleanPreferencesKey
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.intPreferencesKey
+import androidx.datastore.preferences.core.longPreferencesKey
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.core.stringSetPreferencesKey
+import de.jeanlucmakiola.agendula.data.tasks.ProviderResolver
+import de.jeanlucmakiola.agendula.data.tasks.StorageMode
+import de.jeanlucmakiola.agendula.domain.Task
+import de.jeanlucmakiola.agendula.domain.TaskFilter
+import de.jeanlucmakiola.agendula.domain.TaskFormField
+import de.jeanlucmakiola.agendula.domain.TaskSortOrder
+import de.jeanlucmakiola.floret.reminders.ReminderOverride
+import de.jeanlucmakiola.floret.reminders.ReminderOverrideCodec
+import de.jeanlucmakiola.floret.reminders.applyReminderOverride
+import de.jeanlucmakiola.floret.reminders.normalizeReminders
+import de.jeanlucmakiola.floret.reminders.reminderLeadsFor
+import kotlinx.coroutines.flow.Flow
+import java.time.DayOfWeek
+import kotlinx.coroutines.flow.map
+import javax.inject.Inject
+import javax.inject.Singleton
+
+enum class ThemeMode { SYSTEM, LIGHT, DARK }
+
+/** Clock convention: AUTO follows the device's 24-hour switch. */
+enum class TimeFormatPref { AUTO, TWELVE_HOUR, TWENTY_FOUR_HOUR }
+
+fun TimeFormatPref.is24Hour(systemIs24Hour: Boolean): Boolean = when (this) {
+    TimeFormatPref.AUTO -> systemIs24Hour
+    TimeFormatPref.TWELVE_HOUR -> false
+    TimeFormatPref.TWENTY_FOUR_HOUR -> true
+}
+
+const val DEFAULT_SNOOZE_MINUTES = 10
+
+/** The snooze lengths Settings offers. */
+val SNOOZE_PRESETS = listOf(5, 10, 15, 30, 60)
+
+/** Minutes between background syncs; 0 = only when asked. */
+const val DEFAULT_SYNC_INTERVAL_MINUTES = 240
+
+/** The sync intervals Settings offers; 15 minutes is WorkManager's floor. */
+val SYNC_INTERVAL_PRESETS = listOf(15, 30, 60, 120, 240, 720, 1_440, 0)
+
+/** 09:00. */
+const val DEFAULT_ALL_DAY_REMINDER_MINUTE = 9 * 60
+
+data class Settings(
+    val themeMode: ThemeMode = ThemeMode.SYSTEM,
+    val dynamicColor: Boolean = true,
+    /** The list a new task defaults to; `null` = first available. */
+    val defaultListId: Long? = null,
+    /** Default reminders, as minutes before due (0 = at due time); empty = none. */
+    val defaultReminderMinutes: List<Int> = listOf(0),
+    /** Default reminders for all-day tasks, as days-scale minutes before [allDayReminderMinuteOfDay]. */
+    val defaultAllDayReminderMinutes: List<Int> = listOf(0),
+    /** Local time (minutes from midnight) an all-day task's reminder counts back from. */
+    val allDayReminderMinuteOfDay: Int = DEFAULT_ALL_DAY_REMINDER_MINUTE,
+    /** Master switch for due reminders; off clears every scheduled alarm. */
+    val remindersEnabled: Boolean = true,
+    /** Whether the inline "add a subtask" row shows on expanded task-list groups. */
+    val showAddSubtaskRow: Boolean = true,
+    /**
+     * Add affordance for a list: `false` = the floating "New task" button (opens
+     * the editor); `true` = a quick-add bar pinned to the bottom of a real list.
+     * Smart lists always use the button (they have no single list to add into).
+     */
+    val bottomAddBar: Boolean = false,
+    /**
+     * Per-list overrides of [defaultReminderMinutes]: a list present in the map
+     * overrides the global default (an empty list = no reminder); absent =
+     * inherit.
+     */
+    val perListReminderOverride: Map<Long, List<Int>> = emptyMap(),
+    /** Per-list overrides of [defaultAllDayReminderMinutes], same shape as [perListReminderOverride]. */
+    val perListAllDayReminderOverride: Map<Long, List<Int>> = emptyMap(),
+    /** Optional edit-form fields shown by default; the rest sit behind "More fields". */
+    val defaultEditFields: Set<TaskFormField> = emptySet(),
+    val sortOrder: TaskSortOrder = TaskSortOrder.DUE,
+    /** How long a reminder's "Snooze" action puts it off. */
+    val snoozeMinutes: Int = DEFAULT_SNOOZE_MINUTES,
+    val timeFormat: TimeFormatPref = TimeFormatPref.AUTO,
+    /** The first day of the week; `null` follows the locale. */
+    val weekStart: DayOfWeek? = null,
+    /** Put the cursor in the title (and raise the keyboard) when a new task opens. */
+    val autofocusTitle: Boolean = true,
+    /** Minutes between background syncs of every account; 0 = manual only. */
+    val syncIntervalMinutes: Int = DEFAULT_SYNC_INTERVAL_MINUTES,
+    /** Take server changes by push when a UnifiedPush distributor is installed. */
+    val pushEnabled: Boolean = true,
+    /** Lists of the current store whose tasks the smart lists (and their counts) leave out. */
+    val hiddenFromSmartLists: Set<Long> = emptySet(),
+    /** Pre-fill a new task's start with today's date. */
+    val defaultStartToday: Boolean = false,
+) {
+    /** [tasks] as [filter] shows them: a smart list drops the lists kept out of it. */
+    fun visibleIn(filter: TaskFilter, tasks: List<Task>): List<Task> =
+        if (filter is TaskFilter.Smart && hiddenFromSmartLists.isNotEmpty()) {
+            tasks.filter { it.listId !in hiddenFromSmartLists }
+        } else {
+            tasks
+        }
+
+    /** The lead times for a task in [listId]: its override if set, else the global default. */
+    fun reminderLeadsFor(listId: Long): List<Int> =
+        perListReminderOverride.reminderLeadsFor(listId, defaultReminderMinutes)
+
+    /** The lead times for an all-day task in [listId]. */
+    fun allDayReminderLeadsFor(listId: Long): List<Int> =
+        perListAllDayReminderOverride.reminderLeadsFor(listId, defaultAllDayReminderMinutes)
+}
+
+/** App preferences, backed by DataStore. Mirrors Calendula's prefs shape. */
+@Singleton
+class SettingsPrefs @Inject constructor(
+    private val dataStore: DataStore<Preferences>,
+    private val resolver: ProviderResolver,
+) {
+    val settings: Flow<Settings> = dataStore.data.map { p ->
+        Settings(
+            themeMode = p[THEME_MODE]?.let { runCatching { ThemeMode.valueOf(it) }.getOrNull() }
+                ?: ThemeMode.SYSTEM,
+            dynamicColor = p[DYNAMIC_COLOR] ?: true,
+            defaultListId = p[DEFAULT_LIST_ID]?.takeIf { it > 0 },
+            // The single lead of earlier versions carries over until a list is saved.
+            defaultReminderMinutes = p[DEFAULT_REMINDERS]?.let(::parseMinutes)
+                ?: listOf(p[REMINDER_LEAD] ?: 0),
+            defaultAllDayReminderMinutes = p[DEFAULT_ALL_DAY_REMINDERS]?.let(::parseMinutes) ?: listOf(0),
+            allDayReminderMinuteOfDay = p[ALL_DAY_REMINDER_MINUTE]?.takeIf { it in 0 until 24 * 60 }
+                ?: DEFAULT_ALL_DAY_REMINDER_MINUTE,
+            remindersEnabled = p[REMINDERS_ENABLED] ?: true,
+            showAddSubtaskRow = p[SHOW_ADD_SUBTASK_ROW] ?: true,
+            bottomAddBar = p[BOTTOM_ADD_BAR] ?: false,
+            perListReminderOverride = reminderCodec.parse(p[LIST_REMINDER_OVERRIDE]),
+            perListAllDayReminderOverride = reminderCodec.parse(p[LIST_ALL_DAY_REMINDER_OVERRIDE]),
+            defaultEditFields = p[DEFAULT_EDIT_FIELDS].orEmpty()
+                .mapNotNull { name -> runCatching { TaskFormField.valueOf(name) }.getOrNull() }
+                .toSet(),
+            sortOrder = p[SORT_ORDER]?.let { runCatching { TaskSortOrder.valueOf(it) }.getOrNull() }
+                ?: TaskSortOrder.DUE,
+            snoozeMinutes = p[SNOOZE_MINUTES]?.takeIf { it > 0 } ?: DEFAULT_SNOOZE_MINUTES,
+            timeFormat = p[TIME_FORMAT]?.let { runCatching { TimeFormatPref.valueOf(it) }.getOrNull() }
+                ?: TimeFormatPref.AUTO,
+            autofocusTitle = p[AUTOFOCUS_TITLE] ?: true,
+            syncIntervalMinutes = p[SYNC_INTERVAL]?.takeIf { it == 0 || it >= 15 } ?: DEFAULT_SYNC_INTERVAL_MINUTES,
+            weekStart = p[WEEK_START]?.let { runCatching { DayOfWeek.valueOf(it) }.getOrNull() },
+            pushEnabled = p[PUSH_ENABLED] ?: true,
+            hiddenFromSmartLists = modeOf(p).name.let { mode ->
+                p[SMART_LIST_HIDDEN].orEmpty()
+                    .mapNotNull { entry -> entry.substringAfter("$mode:", "").toLongOrNull() }
+                    .toSet()
+            },
+            defaultStartToday = p[DEFAULT_START_TODAY] ?: false,
+        )
+    }
+
+    suspend fun setSortOrder(order: TaskSortOrder) = dataStore.edit { it[SORT_ORDER] = order.name }
+
+    suspend fun setSnoozeMinutes(minutes: Int) = dataStore.edit { it[SNOOZE_MINUTES] = minutes.coerceAtLeast(1) }
+
+    suspend fun setSyncIntervalMinutes(minutes: Int) = dataStore.edit { it[SYNC_INTERVAL] = minutes }
+
+    suspend fun setPushEnabled(enabled: Boolean) = dataStore.edit { it[PUSH_ENABLED] = enabled }
+
+    suspend fun setAutofocusTitle(enabled: Boolean) = dataStore.edit { it[AUTOFOCUS_TITLE] = enabled }
+
+    suspend fun setDefaultStartToday(enabled: Boolean) = dataStore.edit { it[DEFAULT_START_TODAY] = enabled }
+
+    suspend fun setTimeFormat(pref: TimeFormatPref) = dataStore.edit { it[TIME_FORMAT] = pref.name }
+
+    suspend fun setWeekStart(day: DayOfWeek?) = dataStore.edit {
+        if (day == null) it.remove(WEEK_START) else it[WEEK_START] = day.name
+    }
+
+    suspend fun setThemeMode(mode: ThemeMode) = dataStore.edit { it[THEME_MODE] = mode.name }
+    suspend fun setDynamicColor(enabled: Boolean) = dataStore.edit { it[DYNAMIC_COLOR] = enabled }
+    suspend fun setDefaultListId(id: Long?) = dataStore.edit {
+        if (id == null) it.remove(DEFAULT_LIST_ID) else it[DEFAULT_LIST_ID] = id
+    }
+
+    suspend fun setDefaultReminderMinutes(minutes: List<Int>) = dataStore.edit {
+        it[DEFAULT_REMINDERS] = minutes.normalizeReminders().joinToString(",")
+    }
+
+    suspend fun setDefaultAllDayReminderMinutes(minutes: List<Int>) = dataStore.edit {
+        it[DEFAULT_ALL_DAY_REMINDERS] = minutes.normalizeReminders().joinToString(",")
+    }
+
+    suspend fun setAllDayReminderMinuteOfDay(minuteOfDay: Int) =
+        dataStore.edit { it[ALL_DAY_REMINDER_MINUTE] = minuteOfDay.coerceIn(0, 24 * 60 - 1) }
+
+    /**
+     * Which task store backs the app, or `null` while the user has not chosen —
+     * which is the normal state, since most people never open Settings.
+     *
+     * Kept out of [Settings] on purpose. Everything in there is a rendering
+     * preference collected by the UI; this one selects an authority in the data
+     * layer, is read on paths that must not wait for a whole settings object, and
+     * `null` genuinely means "undecided" rather than "default" — the difference
+     * matters, because undecided is what lets `ProviderResolver.autoMode` keep an
+     * upgrading Posture A user pointed at the provider that holds their data.
+     */
+    val storageMode: Flow<StorageMode?> = dataStore.data.map { p -> storedMode(p[STORAGE_MODE]) }
+
+    private fun storedMode(stored: String?): StorageMode? = when (stored) {
+        null -> null
+        // 0.3.x's value for the bundled dmfs provider. That store is gone and
+        // its data was imported into OWN, so read it as OWN rather than
+        // letting it fall through to autoMode — someone who chose local
+        // storage explicitly would otherwise be sent to an external provider.
+        "LOCAL" -> StorageMode.OWN
+        else -> runCatching { StorageMode.valueOf(stored) }.getOrNull()
+    }
+
+    /** The store list ids belong to; each store numbers its lists on its own. */
+    private fun modeOf(p: Preferences): StorageMode = storedMode(p[STORAGE_MODE]) ?: resolver.autoMode()
+
+    suspend fun setStorageMode(mode: StorageMode) = dataStore.edit { it[STORAGE_MODE] = mode.name }
+
+    /**
+     * One-time first-run gate; false until the flow has been walked through.
+     *
+     * The key still says `reminder_onboarding_done` — it gated a single reminder
+     * step before the flow grew around it, and renaming it would drag every
+     * existing install back through onboarding.
+     */
+    val onboardingDone: Flow<Boolean> = dataStore.data.map { it[ONBOARDING_DONE] ?: false }
+
+    suspend fun setOnboardingDone() = dataStore.edit { it[ONBOARDING_DONE] = true }
+
+    suspend fun setRemindersEnabled(enabled: Boolean) = dataStore.edit { it[REMINDERS_ENABLED] = enabled }
+
+    suspend fun setShowAddSubtaskRow(show: Boolean) = dataStore.edit { it[SHOW_ADD_SUBTASK_ROW] = show }
+
+    suspend fun setBottomAddBar(enabled: Boolean) = dataStore.edit { it[BOTTOM_ADD_BAR] = enabled }
+
+    /** Set (or clear, via [ReminderOverride.Inherit]) a list's reminder override. */
+    suspend fun setListReminderOverride(listId: Long, override: ReminderOverride) = dataStore.edit { p ->
+        val current = reminderCodec.parse(p[LIST_REMINDER_OVERRIDE]).toMutableMap()
+        current.applyReminderOverride(listId, override)
+        p[LIST_REMINDER_OVERRIDE] = reminderCodec.serialize(current)
+    }
+
+    /** Set (or clear) a list's all-day reminder override. */
+    suspend fun setListAllDayReminderOverride(listId: Long, override: ReminderOverride) = dataStore.edit { p ->
+        val current = reminderCodec.parse(p[LIST_ALL_DAY_REMINDER_OVERRIDE]).toMutableMap()
+        current.applyReminderOverride(listId, override)
+        p[LIST_ALL_DAY_REMINDER_OVERRIDE] = reminderCodec.serialize(current)
+    }
+
+    suspend fun setHiddenFromSmartLists(listId: Long, hidden: Boolean) = dataStore.edit { p ->
+        val entry = "${modeOf(p).name}:$listId"
+        val current = p[SMART_LIST_HIDDEN].orEmpty()
+        p[SMART_LIST_HIDDEN] = if (hidden) current + entry else current - entry
+    }
+
+    suspend fun setDefaultEditFields(fields: Set<TaskFormField>) = dataStore.edit {
+        it[DEFAULT_EDIT_FIELDS] = fields.mapTo(mutableSetOf()) { field -> field.name }
+    }
+
+    private companion object {
+        val THEME_MODE = stringPreferencesKey("theme_mode")
+        val DYNAMIC_COLOR = booleanPreferencesKey("dynamic_color")
+        val DEFAULT_LIST_ID = longPreferencesKey("default_list_id")
+        val REMINDER_LEAD = intPreferencesKey("reminder_lead_minutes")
+        val DEFAULT_REMINDERS = stringPreferencesKey("default_reminder_minutes")
+        val DEFAULT_ALL_DAY_REMINDERS = stringPreferencesKey("default_all_day_reminder_minutes")
+        val LIST_ALL_DAY_REMINDER_OVERRIDE = stringPreferencesKey("list_all_day_reminder_override")
+        val ALL_DAY_REMINDER_MINUTE = intPreferencesKey("all_day_reminder_minute")
+        val REMINDERS_ENABLED = booleanPreferencesKey("reminders_enabled")
+        val SHOW_ADD_SUBTASK_ROW = booleanPreferencesKey("show_add_subtask_row")
+        val BOTTOM_ADD_BAR = booleanPreferencesKey("bottom_add_bar")
+        val ONBOARDING_DONE = booleanPreferencesKey("reminder_onboarding_done")
+        val STORAGE_MODE = stringPreferencesKey("storage_mode")
+        val LIST_REMINDER_OVERRIDE = stringPreferencesKey("list_reminder_override")
+        val DEFAULT_EDIT_FIELDS = stringSetPreferencesKey("default_edit_fields")
+        val SORT_ORDER = stringPreferencesKey("sort_order")
+        val SNOOZE_MINUTES = intPreferencesKey("snooze_minutes")
+        val TIME_FORMAT = stringPreferencesKey("time_format")
+        val WEEK_START = stringPreferencesKey("week_start")
+        val AUTOFOCUS_TITLE = booleanPreferencesKey("autofocus_title")
+        val SYNC_INTERVAL = intPreferencesKey("sync_interval_minutes")
+        val PUSH_ENABLED = booleanPreferencesKey("push_enabled")
+        val SMART_LIST_HIDDEN = stringSetPreferencesKey("smart_list_hidden")
+        val DEFAULT_START_TODAY = booleanPreferencesKey("default_start_today")
+    }
+}
+
+/**
+ * Agendula's stored dialect for the per-list override map: `id:minutes` entries
+ * joined by `;` (the family default). Fixed at release — don't change without a
+ * data migration.
+ */
+private val reminderCodec = ReminderOverrideCodec.DEFAULT
+
+/** `5,30` → [5, 30]; an empty string is an explicit "no reminder". */
+private fun parseMinutes(stored: String): List<Int> =
+    stored.split(',').mapNotNull { it.trim().toIntOrNull()?.takeIf { m -> m >= 0 } }.normalizeReminders()

app/src/main/java/de/jeanlucmakiola/agendula/data/reminders/BootReceiver.kt

@@ -0,0 +1,59 @@
+package de.jeanlucmakiola.agendula.data.reminders
+
+import android.app.AlarmManager
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import dagger.hilt.android.AndroidEntryPoint
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.launch
+import javax.inject.Inject
+
+/**
+ * Re-arms reminder alarms after a reboot (alarms don't survive it), an app update, a clock or
+ * zone change, or an exact-alarm grant — which only upgrades alarms set after it, so the whole
+ * set is cancelled and armed again.
+ */
+@AndroidEntryPoint
+class BootReceiver : BroadcastReceiver() {
+
+    @Inject lateinit var scheduler: ReminderScheduler
+    @Inject lateinit var snoozeScheduler: ReminderSnoozeScheduler
+
+    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.Default)
+
+    override fun onReceive(context: Context, intent: Intent) {
+        if (intent.action == AlarmManager.ACTION_SCHEDULE_EXACT_ALARM_PERMISSION_STATE_CHANGED) {
+            val pending = goAsync()
+            scope.launch {
+                try {
+                    runCatching { scheduler.sync(rearmAll = true) }
+                } finally {
+                    pending.finish()
+                }
+            }
+            return
+        }
+        val afterReboot = when (intent.action) {
+            Intent.ACTION_BOOT_COMPLETED -> true
+            // All-day reminders fire at a local wall-clock time, so their instant moves with the zone.
+            Intent.ACTION_MY_PACKAGE_REPLACED,
+            Intent.ACTION_TIMEZONE_CHANGED,
+            Intent.ACTION_TIME_CHANGED,
+            -> false
+            else -> return
+        }
+        ReminderMaintenanceWorker.schedule(context)
+        val pending = goAsync()
+        scope.launch {
+            try {
+                runCatching { scheduler.sync(afterReboot = afterReboot) }
+                if (afterReboot) runCatching { snoozeScheduler.rearm() }
+            } finally {
+                pending.finish()
+            }
+        }
+    }
+}

app/src/main/java/de/jeanlucmakiola/agendula/data/reminders/DueReminderReceiver.kt

@@ -0,0 +1,90 @@
+package de.jeanlucmakiola.agendula.data.reminders
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import androidx.core.net.toUri
+import dagger.hilt.android.AndroidEntryPoint
+import de.jeanlucmakiola.agendula.data.prefs.SettingsPrefs
+import de.jeanlucmakiola.agendula.data.tasks.TaskQuery
+import de.jeanlucmakiola.agendula.data.tasks.TasksDataSource
+import de.jeanlucmakiola.agendula.domain.Task
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.launch
+import javax.inject.Inject
+
+/**
+ * Fires when a task's reminder alarm goes off. Re-reads the task (it may have
+ * been completed or rescheduled since the alarm was set) and posts only if it's
+ * still open.
+ */
+@AndroidEntryPoint
+class DueReminderReceiver : BroadcastReceiver() {
+
+    @Inject lateinit var dataSource: TasksDataSource
+    @Inject lateinit var notifier: TaskNotifier
+    @Inject lateinit var settingsPrefs: SettingsPrefs
+    @Inject lateinit var scheduler: ReminderScheduler
+
+    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+
+    override fun onReceive(context: Context, intent: Intent) {
+        val taskId = intent.getLongExtra(EXTRA_TASK_ID, -1L)
+        if (taskId < 0L) return
+        val pending = goAsync()
+        scope.launch {
+            try {
+                val triggerAt = intent.getLongExtra(EXTRA_TRIGGER_AT, -1L)
+                val occurrence = intent.getLongExtra(EXTRA_OCCURRENCE, ScheduledReminder.NO_OCCURRENCE)
+                if (triggerAt >= 0L) {
+                    runCatching { scheduler.markFired(ScheduledReminder(taskId, triggerAt, occurrence)) }
+                }
+                val settings = settingsPrefs.settings.first()
+                if (!settings.remindersEnabled) return@launch
+                val task = runCatching { dataSource.occurrence(taskId, occurrence) }.getOrNull()
+                if (task != null && !task.isClosed) notifier.postDue(task, settings)
+            } finally {
+                pending.finish()
+            }
+        }
+    }
+
+    companion object {
+        private const val EXTRA_TASK_ID = "de.jeanlucmakiola.agendula.extra.TASK_ID"
+        private const val EXTRA_TRIGGER_AT = "de.jeanlucmakiola.agendula.extra.TRIGGER_AT"
+        private const val EXTRA_OCCURRENCE = "de.jeanlucmakiola.agendula.extra.OCCURRENCE_START"
+
+        /**
+         * The trigger rides in the intent *data*, not just an extra: PendingIntent
+         * identity ignores extras, so two occurrences of the same recurring task
+         * would otherwise collapse into one alarm under FLAG_UPDATE_CURRENT.
+         */
+        fun intent(context: Context, reminder: ScheduledReminder): Intent =
+            Intent(context, DueReminderReceiver::class.java)
+                .setData("agendula://reminder/${reminder.taskId}/${reminder.triggerAt}".toUri())
+                .putExtra(EXTRA_TASK_ID, reminder.taskId)
+                .putExtra(EXTRA_TRIGGER_AT, reminder.triggerAt)
+                .putExtra(EXTRA_OCCURRENCE, reminder.occurrenceStart)
+    }
+}
+
+/**
+ * The occurrence of [taskId] anchored at [occurrenceStart] (epoch millis), or the
+ * task's current one when there is no anchor or it can no longer be found.
+ * [TasksDataSource.task] alone resolves a series to whichever occurrence is
+ * current, which is not necessarily the one a reminder was armed for.
+ */
+internal fun TasksDataSource.occurrence(taskId: Long, occurrenceStart: Long): Task? {
+    val current = task(taskId) ?: return null
+    if (occurrenceStart == ScheduledReminder.NO_OCCURRENCE ||
+        current.occurrenceStart?.toEpochMilliseconds() == occurrenceStart
+    ) {
+        return current
+    }
+    return tasks(TaskQuery(listId = current.listId, includeCompleted = true))
+        .firstOrNull { it.taskId == taskId && it.occurrenceStart?.toEpochMilliseconds() == occurrenceStart }
+        ?: current
+}

app/src/main/java/de/jeanlucmakiola/agendula/data/reminders/ProviderChangeReceiver.kt

@@ -0,0 +1,60 @@
+package de.jeanlucmakiola.agendula.data.reminders
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.os.SystemClock
+import dagger.hilt.android.AndroidEntryPoint
+import de.jeanlucmakiola.agendula.data.tasks.ProviderResolver
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.launch
+import javax.inject.Inject
+
+/**
+ * Re-syncs reminders whenever the tasks provider changes — covers external sync
+ * (DAVx5 pulling new/edited tasks) while Agendula isn't in the foreground. The
+ * manifest filter targets both known authorities; best-effort (the in-app
+ * ContentObserver covers the foreground case regardless).
+ */
+@AndroidEntryPoint
+class ProviderChangeReceiver : BroadcastReceiver() {
+
+    @Inject lateinit var scheduler: ReminderScheduler
+    @Inject lateinit var providerResolver: ProviderResolver
+
+    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.Default)
+
+    override fun onReceive(context: Context, intent: Intent) {
+        // The receiver has to stay exported to hear the provider's broadcast, and
+        // the sender holds no permission we could require — so validate the
+        // broadcast itself. Without this, any installed app can spam a full
+        // re-sync (an unbounded provider read) by firing a matching intent.
+        if (intent.action != Intent.ACTION_PROVIDER_CHANGED) return
+        val authority = providerResolver.resolve()?.authority ?: return
+        if (intent.data?.host != authority) return
+        // External sync can fire these in bursts; one re-sync per burst is plenty.
+        val now = SystemClock.elapsedRealtime()
+        synchronized(Companion) {
+            if (now - lastSyncAt < MIN_SYNC_INTERVAL_MS) return
+            lastSyncAt = now
+        }
+
+        val pending = goAsync()
+        scope.launch {
+            try {
+                scheduler.sync()
+            } finally {
+                pending.finish()
+            }
+        }
+    }
+
+    private companion object {
+        const val MIN_SYNC_INTERVAL_MS = 10_000L
+
+        @Volatile
+        var lastSyncAt = -MIN_SYNC_INTERVAL_MS
+    }
+}