ci(release): P1 hardening — versioning, F-Droid changelogs, R8 mapping, docs

P1.3 Versioning: the git tag is already the de-facto single source of truth
(every published versionCode uses MAJOR*10000+MINOR*100+PATCH; committed 13
was a stale outlier). Align the committed default to 20000 and document the
scheme in a comment + docs/RELEASING.md.

P1.4 F-Droid changelogs: a tag-only step extracts the tag's CHANGELOG section
into metadata/.../en-US/changelogs/<versionCode>.txt so clients show a
per-version "What's New". Also upload metadata/ (non-secret, never web-served)
alongside repo/ so changelog history survives across releases.

P1.5 R8 mapping: attach mapping-<version>.txt.gz to the Gitea release
(best-effort, continue-on-error) so user crash stacktraces stay
deobfuscatable. The gitea-release notes step is now an upsert (PATCH if the
release already exists) so it composes with the mapping step creating the
release first.

P1.6 docs/RELEASING.md: release ritual, versioning scheme, secrets inventory,
key custody/recovery, manual re-sign path, F-Droid repo details.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yaml

@@ -1,4 +1,4 @@
-name: Build and Release to F-Droid
+name: Release — F-Droid repo + Gitea release
 
 on:
   push:
@@ -121,7 +121,12 @@ jobs:
             $SUDO apk add --no-cache jq
           fi
 
+      # Tag-only build steps. On a manual workflow_dispatch (ref = a branch,
+      # not a tag) these are skipped: the job then just re-signs the existing
+      # index with the configured repo key and re-uploads — used for key
+      # rotation / repo recovery without publishing a new APK.
       - name: Set version from git tag
+        if: startsWith(github.ref, 'refs/tags/')
         run: |
           set -e
           RAW_TAG="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
@@ -135,8 +140,12 @@ jobs:
           sed -i "s/versionName = \".*\"/versionName = \"$VERSION\"/" app/build.gradle.kts
           sed -i "s/versionCode = .*/versionCode = $VERSION_CODE/" app/build.gradle.kts
           grep -E 'versionName|versionCode' app/build.gradle.kts
+          # Export for later steps (F-Droid changelog, mapping asset name).
+          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
+          echo "VERSION_CODE=$VERSION_CODE" >> "$GITHUB_ENV"
 
       - name: Setup Android Keystore
+        if: startsWith(github.ref, 'refs/tags/')
         env:
           KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
           KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
@@ -155,6 +164,7 @@ jobs:
         run: chmod +x ./gradlew
 
       - name: Build release APK
+        if: startsWith(github.ref, 'refs/tags/')
         run: ./gradlew assembleRelease
 
       - name: Setup F-Droid Server Tools
@@ -165,29 +175,48 @@ jobs:
           $SUDO apt-get install -y sshpass python3-pip
           pip3 install --break-system-packages --upgrade fdroidserver
 
-      - name: Initialize or fetch F-Droid Repository
+      - name: Fetch existing F-Droid repo from Hetzner
         env:
           HOST: ${{ secrets.HETZNER_HOST }}
           USER: ${{ secrets.HETZNER_USER }}
           PASS: ${{ secrets.HETZNER_PASS }}
         run: |
+          set -euo pipefail
+          SSH_OPTS="-o StrictHostKeyChecking=no -o ConnectTimeout=20"
           mkdir -p fdroid
-          sshpass -p "$PASS" sftp -o StrictHostKeyChecking=no "$USER@$HOST" <<'SFTP'
-          -mkdir dev
-          -mkdir dev/fdroid
-          -mkdir dev/fdroid/repo
-          SFTP
-          sshpass -p "$PASS" scp -o StrictHostKeyChecking=no -r "$USER@$HOST:dev/fdroid/." fdroid/ || (cd fdroid && fdroid init)
+          # Pull only the published repo/ (all apps' APKs), any per-app
+          # metadata, and the repo icon — enough to rebuild the index without
+          # dropping the other apps. The signing key is deliberately NOT pulled
+          # from the box; it comes from CI secrets in the next step so it never
+          # has to live in the web-served tree.
+          sshpass -p "$PASS" scp $SSH_OPTS -r "$USER@$HOST:dev/fdroid/repo" fdroid/ 2>/dev/null || true
+          sshpass -p "$PASS" scp $SSH_OPTS -r "$USER@$HOST:dev/fdroid/metadata" fdroid/ 2>/dev/null || true
+          sshpass -p "$PASS" scp $SSH_OPTS "$USER@$HOST:dev/fdroid/icon.png" fdroid/ 2>/dev/null || true
+          mkdir -p fdroid/repo fdroid/metadata
 
-      - name: Ensure F-Droid repo signing key and icon
+      - name: Restore F-Droid signing key and config from secrets
+        env:
+          FDROID_KEYSTORE_BASE64: ${{ secrets.FDROID_KEYSTORE_BASE64 }}
+          FDROID_CONFIG_BASE64: ${{ secrets.FDROID_CONFIG_BASE64 }}
         run: |
-          cd fdroid
-          mkdir -p repo/icons
-          if [ ! -f keystore.p12 ]; then
-            fdroid update --create-key
+          set -euo pipefail
+          # Fail loudly if the repo key is not configured. NEVER auto-generate
+          # one: a fresh key changes the repo fingerprint and breaks every
+          # user's pinned repo. (Replaces the old `fdroid update --create-key`
+          # path, which silently rotated the key on a wiped server.)
+          if [ -z "${FDROID_KEYSTORE_BASE64:-}" ] || [ -z "${FDROID_CONFIG_BASE64:-}" ]; then
+            echo "ERROR: FDROID_KEYSTORE_BASE64 / FDROID_CONFIG_BASE64 secrets are not set." >&2
+            echo "Refusing to continue — will not auto-generate a new repo key." >&2
+            exit 1
           fi
+          echo "$FDROID_KEYSTORE_BASE64" | base64 --decode > fdroid/keystore.p12
+          echo "$FDROID_CONFIG_BASE64"   | base64 --decode > fdroid/config.yml
+          test -s fdroid/keystore.p12
+          test -s fdroid/config.yml
+          mkdir -p fdroid/repo/icons
 
       - name: Copy new APK to repo
+        if: startsWith(github.ref, 'refs/tags/')
         run: |
           set -e
           mkdir -p fdroid/repo
@@ -203,12 +232,33 @@ jobs:
           mkdir -p fdroid/metadata
           cp -r fdroid-metadata/* fdroid/metadata/
 
+      # Per-version "What's New" for F-Droid clients: the tag's CHANGELOG
+      # section written to changelogs/<versionCode>.txt (same extraction as the
+      # Gitea release notes). en-US only — F-Droid falls back to it for locales
+      # without their own changelog. fdroid update bakes this into the index.
+      - name: Generate F-Droid changelog for this version
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          set -e
+          awk -v ver="$VERSION" '
+            $0 ~ "^## \\[" ver "\\]" { flag = 1; next }
+            /^## \[/ { flag = 0 }
+            flag' CHANGELOG.md > /tmp/changelog.txt
+          sed -i -e '/./,$!d' /tmp/changelog.txt
+          if [ ! -s /tmp/changelog.txt ]; then
+            echo "See CHANGELOG.md for $VERSION." > /tmp/changelog.txt
+          fi
+          CL_DIR="fdroid/metadata/de.jeanlucmakiola.calendula/en-US/changelogs"
+          mkdir -p "$CL_DIR"
+          cp /tmp/changelog.txt "$CL_DIR/${VERSION_CODE}.txt"
+          echo "Wrote $CL_DIR/${VERSION_CODE}.txt"
+
       - name: Generate F-Droid Index
         run: |
           cd fdroid
           fdroid update -c
 
-      - name: Upload Repo to Hetzner
+      - name: Upload repo/ to Hetzner
         env:
           HOST: ${{ secrets.HETZNER_HOST }}
           USER: ${{ secrets.HETZNER_USER }}
@@ -219,6 +269,113 @@ jobs:
           sshpass -p "$PASS" sftp $SSH_OPTS "$USER@$HOST" <<'SFTP'
           -mkdir dev
           -mkdir dev/fdroid
-          -mkdir dev/fdroid/repo
           SFTP
-          sshpass -p "$PASS" scp $SSH_OPTS -r fdroid/. "$USER@$HOST:dev/fdroid/"
+          # Publish the signed repo/ plus metadata/ (descriptions, screenshots,
+          # per-version changelogs) so changelog history survives across
+          # releases. keystore.p12 and config.yml are NEVER uploaded, so they
+          # can't re-enter the web-served tree; nginx serves only repo/ anyway.
+          sshpass -p "$PASS" scp $SSH_OPTS -r fdroid/repo fdroid/metadata "$USER@$HOST:dev/fdroid/"
+
+      # Archive the R8 mapping so user crash stacktraces stay deobfuscatable.
+      # Attached to the Gitea release (it's not an APK, so it fits the
+      # no-binaries rule). Best-effort: never fail a release over it.
+      - name: Attach R8 mapping to Gitea release
+        if: startsWith(github.ref, 'refs/tags/')
+        continue-on-error: true
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+        run: |
+          set -e
+          MAP="app/build/outputs/mapping/release/mapping.txt"
+          if [ ! -f "$MAP" ]; then echo "No mapping.txt (R8 off?) — skipping."; exit 0; fi
+          TAG="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
+          ASSET="mapping-${VERSION:-$TAG}.txt.gz"
+          gzip -c "$MAP" > "/tmp/$ASSET"
+          # The release is created by the gitea-release job; ensure it exists
+          # (idempotent) so this job doesn't race it to a 404.
+          ID=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" | jq -r '.id // empty')
+          if [ -z "$ID" ]; then
+            ID=$(curl -s -X POST -H "Authorization: token $TOKEN" \
+              -H "Content-Type: application/json" \
+              -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\"}" \
+              "$API/releases" | jq -r '.id // empty')
+          fi
+          if [ -z "$ID" ]; then echo "Could not resolve release id — skipping."; exit 0; fi
+          # Replace any prior asset of the same name (re-run safe).
+          OLD=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/$ID/assets" \
+            | jq -r --arg n "$ASSET" '.[] | select(.name==$n) | .id')
+          [ -n "$OLD" ] && curl -s -X DELETE -H "Authorization: token $TOKEN" "$API/releases/$ID/assets/$OLD" >/dev/null || true
+          curl -s -X POST -H "Authorization: token $TOKEN" \
+            -F "attachment=@/tmp/$ASSET" \
+            "$API/releases/$ID/assets?name=$ASSET" -o /dev/null -w "asset upload HTTP %{http_code}\n"
+
+  # A Gitea release per tag, carrying the tag's CHANGELOG section as its
+  # notes. Deliberately no APK assets — distribution stays with the F-Droid
+  # repo; the release is the human-readable record. Gated on the tests-only
+  # ci job (not the deploy) so notes appear even if the F-Droid upload has
+  # an infrastructure hiccup.
+  gitea-release:
+    needs: ci
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: docker
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Extract changelog section for this tag
+        run: |
+          set -e
+          TAG="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
+          VERSION="${TAG#v}"
+          # Everything between "## [<version>]" and the next "## [" heading.
+          awk -v ver="$VERSION" '
+            $0 ~ "^## \\[" ver "\\]" { flag = 1; next }
+            /^## \[/ { flag = 0 }
+            flag' CHANGELOG.md > release-notes.md
+          # Trim leading blank lines.
+          sed -i -e '/./,$!d' release-notes.md
+          if [ ! -s release-notes.md ]; then
+            echo "_No changelog entry for ${VERSION} — see CHANGELOG.md._" > release-notes.md
+          fi
+          echo "--- release notes ---"
+          cat release-notes.md
+
+      - name: Create Gitea release
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+        run: |
+          set -e
+          TAG="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
+          python3 - "$TAG" <<'PY' > payload.json
+          import json, sys
+          print(json.dumps({
+              "tag_name": sys.argv[1],
+              "name": sys.argv[1],
+              "body": open("release-notes.md").read(),
+              "draft": False,
+              "prerelease": False,
+          }))
+          PY
+          # Upsert: the build-and-deploy job may have created a bare release
+          # first (to attach the mapping asset), so PATCH the notes if it
+          # exists, otherwise POST a new one. Both paths are re-run safe.
+          curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" > existing.json
+          ID=$(python3 -c "import json,sys; d=json.load(open('existing.json')); print(d.get('id',''))" 2>/dev/null || true)
+          if [ -n "$ID" ]; then
+            CODE=$(curl -s -o response.json -w '%{http_code}' -X PATCH \
+              -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+              -d @payload.json "$API/releases/$ID")
+            OK=200
+          else
+            CODE=$(curl -s -o response.json -w '%{http_code}' -X POST \
+              -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+              -d @payload.json "$API/releases")
+            OK=201
+          fi
+          cat response.json
+          if [ "$CODE" != "$OK" ]; then
+            echo "Release upsert failed with HTTP $CODE (expected $OK)"
+            exit 1
+          fi

.gitignore

@@ -40,6 +40,7 @@ captures/
 # Keystore files
 *.jks
 *.keystore
+*.p12
 /key.properties
 
 # Google Services (e.g. APIs or Firebase)
@@ -50,8 +51,7 @@ google-services.json
 Thumbs.db
 
 # F-Droid local artifacts (the pipeline generates them in CI)
-fdroid/repo/
-fdroid/keystore.p12
+/fdroid/
 
 # KSP
 .ksp/

.planning/PROJECT.md

@@ -2,11 +2,12 @@
 
 ## What This Is
 
-A modern Material 3 Expressive Android calendar app, read-only V1. Lives
-entirely on top of Android's `CalendarContract` — any calendar synced to the
-device (CalDAV via DAVx5, Google, local, WebCal, …) shows up automatically.
-The differentiator is visual: real Material 3 Expressive design that no
-existing FOSS calendar app delivers.
+A modern Material 3 Expressive Android calendar app. Lives entirely on top
+of Android's `CalendarContract` — any calendar synced to the device (CalDAV
+via DAVx5, Google, local, WebCal, …) shows up automatically; creating,
+editing, and deleting writes straight back, and reminders are delivered by
+the app itself (Etar model). The differentiator is visual: real Material 3
+Expressive design that no existing FOSS calendar app delivers.
 
 ## Core Value
 
@@ -15,8 +16,10 @@ re-inventing the calendar sync stack — leave that to DAVx5 and the system.
 
 ## Current Milestone
 
-**v0.1 — Foundation & CI:** Buildable Android project scaffold with theme,
-icon, i18n, Hilt, DataStore, green CI.
+Milestones 1 (read, v1.0) and 2 (write support, v1.1–v2.0.0 incl. reminder
+delivery) are **complete** — v2.0.0 shipped 2026-06-11. Next is v3.0
+(power-user features) plus an undecided "Locations & People" idea backlog;
+see `ROADMAP.md`.
 
 ## Stack
 
@@ -26,9 +29,8 @@ Expressive 1.5.0-alpha21 (alpha is intentional — Expressive APIs only
 live in the 1.5 alpha line). Hilt 2.59.2, DataStore. Gradle Kotlin DSL
 with Version Catalog. AGP 9.1.1, Gradle 9.5.1. JVM target 17.
 
-Read-only V1, write support V2.
-
-Android-only (minSdk 29, targetSdk 36). No iOS.
+Android-only (minSdk 29, targetSdk 36). No iOS. No `INTERNET` permission —
+any feature that would need one is an explicit product decision first.
 
 ## Naming
 

.planning/REQUIREMENTS.md

@@ -2,39 +2,43 @@
 
 See full design spec: `docs/superpowers/specs/2026-06-08-calendar-app-design.md`
 
-## V1 Scope (Variant "B")
+## V1 Scope (Variant "B") — shipped in full (v1.0.0, 2026-06-11)
 
-### Validated (shipped)
-- Foundation & CI infrastructure — v0.1.0 (2026-06-08)
-
-### Active (V1)
-
-- [x] Foundation & CI infrastructure
+- [x] Foundation & CI infrastructure — v0.1.0 (2026-06-08)
 - [x] Data Layer over `CalendarContract`
 - [x] Permission flow (`READ_CALENDAR`)
-- [ ] Month view (S1)
-- [ ] Week view (S2)
-- [ ] Day view (S3)
-- [ ] Event Detail Sheet (S4)
-- [ ] Multi-Calendar Filter (M3)
+- [x] Month view (S1)
+- [x] Week view (S2)
+- [x] Day view (S3)
+- [x] Event Detail Sheet (S4) — became a full screen, plus full event read (v0.6)
+- [x] Multi-Calendar Filter (M3)
 - [x] Today button (M2) — shipped v0.5; Jump-to-Date **cut from scope**
-- [ ] View-Switcher (M1)
-- [ ] Settings screen (M4)
-- [ ] Empty / no-permission / no-calendars states
-- [ ] German + English localization
-- [ ] Loading/Failure/Success states per screen (architectural pattern)
+- [x] View-Switcher (M1)
+- [x] Settings screen (M4)
+- [x] Empty / no-permission / no-calendars states
+- [x] German + English localization
+- [x] Loading/Failure/Success states per screen (architectural pattern)
 
-### Out of Scope (V2+)
+## V2 Scope — write support, shipped in full (v2.0.0, 2026-06-11)
+
+- [x] Write foundation: `WRITE_CALENDAR`, read-only-calendar detection, delete (v1.1)
+- [x] Create event: form, FAB, last-used calendar (v1.2; polish v1.2.1)
+- [x] Edit event: shared form, scoped recurring writes, recurrence picker (v1.3)
+- [x] Reminder notifications (v1.4) — **reversal of the original
+  "system handles reminders" assumption:** Calendula targets
+  sole-calendar-app users, so it posts reminder notifications itself
+  (Etar model), incl. `POST_NOTIFICATIONS` onboarding
+- [x] Conflict dialog on save + store polish (v2.0)
+- Quick-add — **cut from scope** (the prefilled form covers it)
+- Calendar switching while editing — moved to v3 backlog
+
+### Out of Scope (V3+)
 
-- Event create / edit / delete (V2)
 - Home-screen widget
 - Full-text search
-- Quick-add
-- ~~Custom notifications/reminders (system already handles these)~~ —
-  **reversed:** Calendula targets sole-calendar-app users, so no other app
-  posts reminder notifications. We post them ourselves (Etar model). Planned
-  for v1.4 — see `ROADMAP.md`.
 - Tablet/foldable-specific layouts
+- Locations & People ideas (contact picker, OSM autocomplete) — see
+  `ROADMAP.md` idea backlog, undecided
 - iOS support (Android-only by design)
 
 ## Constraints

.planning/ROADMAP.md

@@ -53,7 +53,7 @@ after v0.6 (full event read) plus the onboarding-screen polish pass.
 - ~~Redesign the initial grant-access (permission) screen~~ — **done**
   (Material 3 Expressive onboarding, shipped in v0.6.0 / v1.0.0)
 
-## v2.0 — Write Support (in progress)
+## v2.0 — Write Support (complete, shipped 2026-06-11)
 
 Delivered in four releasable slices (plan:
 `docs/superpowers/plans/2026-06-11-03-write-support.md`). The V1 spec is a
@@ -66,7 +66,21 @@ guide here, not a contract — scope per slice is decided as we go.
 | v1.2.1 | Form polish after on-device review — card design system, optional fields + settings defaults, OptionCard dialogs, expressive motion | complete (shipped 2026-06-11) |
 | v1.3 | Edit event — shared form, scoped recurring writes (this / following / all), recurrence picker | complete (shipped 2026-06-11) |
 | v1.4 | Reminder notifications — see below | complete (shipped 2026-06-11) |
-| v2.0 | Quick-add, occurrence edit, conflict dialog, polish, release | planned |
+| v2.0 | Conflict dialog, polish pass (store copy refresh, F-Droid screenshots), release | complete (shipped 2026-06-11) |
+
+v2.0 scope was re-cut on 2026-06-11, after v1.4:
+- **Occurrence edit** already shipped early, in v1.3.
+- **Quick-add** is **cut from scope**: the full form already opens prefilled
+  (visible day, last-used calendar, optional fields hidden), so the sheet
+  would only save one screen transition while adding a second create-surface
+  to maintain. Revisit only if real-world feedback says creation feels heavy.
+- **Calendar switching while editing** moves to the v3 backlog (sync-adapter
+  minefield: `CALENDAR_ID` is sync-adapter-owned, AOSP locks the field; an
+  honest implementation is copy+delete like Google Calendar, with sync-identity
+  and attendee side effects).
+- **Conflict dialog** stays (plan 03, decision 5): on save, compare against
+  the row as it was when the form loaded; on external change, ask
+  overwrite / discard. Closes the silent-clobber gap on synced calendars.
 
 ## v1.4 — Reminder Notifications
 
@@ -99,5 +113,53 @@ Deliberately deferred (add only if needed):
 - Full-text search
 - Tablet / foldable layouts
 - Optional: ICS file import (drag-and-drop)
+- Optional: move event to another calendar (copy+delete model with a
+  consequences warning — deferred from v2.0, see above)
 
 Order is indicative — community feedback after V1 may re-prioritize.
+
+## Idea backlog — Daily-driver polish (captured 2026-06-11, all approved as ideas, unscheduled)
+
+Interaction:
+- Tap/long-press an empty slot in day/week → create form prefilled with that time
+- Drag & drop rescheduling in day/week (recurring drops reuse the scope dialog) — big-ticket, own slice
+- Agenda view (fourth view: upcoming events grouped by day; natural widget data source)
+- Pinch-to-zoom time scale in day/week
+
+Reminders, round two:
+- Snooze + dismiss actions on the notification (snooze needs an exact-alarm/WorkManager decision)
+- Settings default reminder applied to new events
+
+Event niceties:
+- Duplicate event (detail action → prefilled create form)
+- Per-event color (`Events.EVENT_COLOR`, OptionCard picker in the form)
+- Share event as .ics + open/receive .ics into a prefilled create form (front-runs v3 ICS import)
+
+Small delights:
+- App shortcuts (launcher long-press → New event), maybe a quick-settings tile
+- Jump to date (un-cut from V1 — drawer date picker)
+
+Consciously rejected: travel time / weather / smart suggestions (network,
+core-promise conflict), natural-language quick entry (high effort,
+locale-fragile, prefilled form already covers fast entry).
+
+## Idea backlog — Locations & People (captured 2026-06-11, undecided)
+
+Beyond classic calendar-client scope; discussed, deliberately not planned
+in detail yet:
+
+- **Contact address picker** for the location field via the system picker
+  (`ACTION_PICK` on postal addresses) — one-shot, needs no READ_CONTACTS,
+  fits the privacy story. Same mechanism later for picking emails.
+- **OSM address autocomplete** in the location field (type "Brandenburger
+  Tor" → tap suggestion → resolved address inserted). Backend would be
+  Photon (Nominatim's public policy forbids autocomplete). **Requires the
+  INTERNET permission** — first dent in the "no network access" promise;
+  if built: opt-in (off by default), honest copy, configurable endpoint
+  for self-hosters, onboarding footnote + F-Droid copy reworded. This
+  trade-off is an explicit go/no-go decision before any work starts.
+- **Inline contact suggestions** while typing (needs READ_CONTACTS) — only
+  if the picker proves clunky.
+- **Attendee editing / invites from contacts** — own milestone; writing
+  `Attendees` rows touches sync-adapter invitation behavior (Google vs
+  DAVx5 differ).

.planning/STATE.md

@@ -4,13 +4,10 @@
 
 ## Status
 
-**Milestone:** v2.0 — Write support (milestone 2, in progress)
-**Phase:** v1.3.0 (edit event) shipped 2026-06-11 after four on-device
-review rounds (BYDAY toggles, scoped recurring writes, scope-at-save flip,
-stale-instances split bugfix). Milestone 2 runs in four slices
-(`docs/superpowers/plans/2026-06-11-03-write-support.md`); v2.0 (quick-add,
-conflict dialog, polish) is the remaining slice, v1.4 (reminder
-notifications) comes first.
+**Milestone:** 2 (write support) **complete** — v2.0.0 shipped 2026-06-11.
+**Phase:** between milestones. Next: v3.0 (power-user features) and the
+go/no-go on the "Locations & People" idea backlog (`ROADMAP.md`). Docs
+pass done (ARCHITECTURE.md, README overhaul, planning docs refreshed).
 
 ## Progress
 
@@ -62,10 +59,22 @@ notifications) comes first.
   recurring saves park in `SaveUiState.AwaitingScope`, a changed rule drops
   the "only this event" option
 
+- [x] v1.4 reminder notifications (shipped 2026-06-11) — exported
+  `EVENT_REMINDER` receiver → `CalendarAlerts` (SCHEDULED & due) →
+  dedicated channel, tap opens detail (singleTop deep link); best-effort
+  FIRED marking; one-time onboarding step requesting `POST_NOTIFICATIONS`
+  with duplicate-reminders warning; Settings mirror. Provider only fires
+  `METHOD_ALERT` rows (AOSP-verified), so email reminders never reach us
+
+- [x] v2.0 conflict dialog + store polish (shipped 2026-06-11 as v2.0.0) —
+  `EditSnapshot` compare on save (overwrite/discard; deleted → close),
+  quick-add cut, calendar-switch → v3 backlog; F-Droid/README copy
+  refreshed, fastlane screenshots DE+EN captured on-device
+
 ## Next
 
-1. v1.4 — reminder notifications (essential for sole-app use): `EVENT_REMINDER`
-   receiver + notification channel, `POST_NOTIFICATIONS`, onboarding step with
-   default-on toggle + duplicate-reminder warning (Etar model)
-2. v2.0 — quick-add sheet, conflict dialog, polish pass, milestone release
-3. Monitor the F-Droid build/publish for v1.1.0 – v1.3.0
+1. Decide the "Locations & People" go/no-go (INTERNET permission question)
+   — see `ROADMAP.md` idea backlog
+2. v3.0 scoping: widget, full-text search, tablet layouts, ICS import,
+   calendar-move
+3. Monitor the F-Droid build/publish for the v1.4.0 / v2.0.0 tags

CHANGELOG.md

@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Typing in the event title, location, and description fields no longer
+  makes the cursor jump around: the form state's round-trip to the UI was
+  hopping to a background dispatcher, so the text field saw a lagging value
+  while typing. Only the calendar/preferences reads stay off the main
+  thread now; the keystroke path is synchronous again
+
+## [2.0.0] — 2026-06-11
+
+### Added
+- Conflict handling when saving an edit: if the event changed elsewhere
+  (sync, another device) while the form was open, saving now asks whether
+  to keep or discard your changes instead of silently overwriting the
+  edited fields — and tells you when the event was deleted in the meantime.
+  "Keep" still writes only the fields you touched; external changes to
+  untouched fields survive either way
+- F-Droid store screenshots (German + English), captured with demo data
+
+### Changed
+- F-Droid description and README no longer claim the app is read-only —
+  they now describe write support and reminder delivery
+
+### Fixed
+- `versionName`/`versionCode` bumped to 2.0.0 / 13 — closing out the
+  write-support milestone (v1.1 through v2.0)
+
 ## [1.4.0] — 2026-06-11
 
 ### Added

README.md

@@ -1,43 +1,120 @@
-# Calendula
+<div align="center">
 
-A modern Material 3 Expressive calendar app for Android.
+<img src="fdroid-metadata/de.jeanlucmakiola.calendula/en-US/icon.png" width="112" alt="Calendula icon">
 
-Calendula is named after the flower of the same name, whose name comes from
-the Latin *kalendae* — the first day of the month — the same root as the
-word "calendar". Calendula reads from Android's built-in `CalendarContract`,
-so any calendar source synced to your device (CalDAV via DAVx5, Google,
-local, WebCal subscriptions, ...) is shown.
+<h1>Calendula</h1>
 
-## Features (V1)
+<p><strong>A modern Material 3 Expressive calendar for Android.</strong><br>
+Reads, writes, and reminds — on top of the system calendar, with zero network access.</p>
 
-- Month, Week, and Day views
-- Read-only event details (write support comes in V2)
-- Multi-calendar visibility toggle
-- Material You Dynamic Color (Android 12+)
-- Light/Dark theme follows system
-- German + English UI
+<p>
+<a href="https://gitea.jeanlucmakiola.de/makiolaj/calendula/actions"><img src="https://gitea.jeanlucmakiola.de/makiolaj/calendula/actions/workflows/ci.yaml/badge.svg?branch=main" alt="CI"></a>
+<img src="https://img.shields.io/badge/Android-10%2B-3DDC84?logo=android&logoColor=white" alt="Android 10+">
+<img src="https://img.shields.io/badge/Kotlin-Compose-7F52FF?logo=kotlin&logoColor=white" alt="Kotlin + Compose">
+<img src="https://img.shields.io/badge/Material%203-Expressive-4285F4" alt="Material 3 Expressive">
+<a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-green" alt="MIT License"></a>
+</p>
 
-## Building
+<p>
+<img src="fdroid-metadata/de.jeanlucmakiola.calendula/en-US/phoneScreenshots/01-week.png" width="19%" alt="Week view">&nbsp;
+<img src="fdroid-metadata/de.jeanlucmakiola.calendula/en-US/phoneScreenshots/02-month.png" width="19%" alt="Month view">&nbsp;
+<img src="fdroid-metadata/de.jeanlucmakiola.calendula/en-US/phoneScreenshots/04-detail.png" width="19%" alt="Event detail">&nbsp;
+<img src="fdroid-metadata/de.jeanlucmakiola.calendula/en-US/phoneScreenshots/05-edit.png" width="19%" alt="Event form">&nbsp;
+<img src="fdroid-metadata/de.jeanlucmakiola.calendula/en-US/phoneScreenshots/06-onboarding.png" width="19%" alt="Reminder onboarding">
+</p>
 
-Requires Android SDK 36 and JDK 17. The Gradle wrapper is checked in, so no host Gradle install is needed:
+</div>
+
+Calendula is named after the flower whose name — like the word *calendar* —
+comes from the Latin *kalendae*, the first day of the month. It lives
+entirely on top of Android's `CalendarContract`: any calendar synced to your
+device (CalDAV via DAVx5, Google, local, WebCal subscriptions, …) simply
+appears, and everything you create or edit syncs back the same way. No own
+database, no sync stack reinvented.
+
+## ✨ Features
+
+**Calendar**
+
+- Month, week, and day views with a one-tap view switcher
+- Full event details — attendees and their responses, reminders, recurrence
+  (humanized), availability, visibility, foreign time zones
+- Per-calendar visibility toggle, grouped by account
+
+**Editing**
+
+- Create, edit, and delete events — including recurring events with scoped
+  writes: *only this event*, *this and all following*, or *the whole series*
+- Recurrence picker with one-tap presets and custom rules (interval, weekday
+  toggles, end conditions); rules it can't express are preserved verbatim
+- Conflict-safe saves: if an event changed elsewhere while you were editing,
+  Calendula asks instead of silently overwriting
+- Read-only calendars (WebCal, birthdays) are detected and respected
+
+**Reminders**
+
+- Event reminders delivered by Calendula itself as notifications —
+  essential when it's your only calendar app, since Android delegates
+  reminder delivery to calendar apps
+- Tap a reminder to land on the event
+
+**Design & privacy**
+
+- Real Material 3 Expressive throughout — dynamic color (Android 12+),
+  expressive motion and shapes, light/dark theme
+- German and English UI, per-app language setting
+- **Zero telemetry, zero analytics, no internet permission** — your data
+  never leaves the device
+
+## 📦 Install
+
+Calendula ships through a self-hosted F-Droid repository; every version tag
+is built, signed, and published there automatically.
+
+1. Install an F-Droid client ([F-Droid](https://f-droid.org), Droid-ify, Neo
+   Store, …).
+2. Add the repository — open this link on your phone, or paste it under
+   *Settings → Repositories → Add*:
+
+   ```
+   https://apps.dev.jeanlucmakiola.de/dev/fdroid/repo?fingerprint=C2C0640402BF458FC0ED957AF0B37AA4C14022E72F89CE90B5965B458CF73425
+   ```
+
+   <sub>Repo: `https://apps.dev.jeanlucmakiola.de/dev/fdroid/repo` ·
+   fingerprint (SHA-256):
+   `C2C0 6404 02BF 458F C0ED 957A F0B3 7AA4 C140 22E7 2F89 CE90 B596 5B45 8CF7 3425`</sub>
+
+3. Refresh, search for **Calendula**, install. Updates arrive like any
+   other F-Droid app.
+
+Alternatively, build from source — see below.
+
+## 🛠 Building
+
+Requires Android SDK 36+ and JDK 17. The Gradle wrapper is checked in:
 
 ```bash
-# Build debug APK
-./gradlew assembleDebug
-
-# Run unit tests
-./gradlew test
-
-# Run lint
-./gradlew lint
+./gradlew assembleDebug   # debug APK
+./gradlew test            # JVM unit tests
+./gradlew lint            # Android lint
 ```
 
-If your default JDK is something other than 17, set `JAVA_HOME` explicitly:
+If your default JDK is not 17, set `JAVA_HOME` explicitly.
 
-```bash
-JAVA_HOME=/path/to/jdk-17 ./gradlew assembleDebug
-```
+## 🏗 Architecture
 
-## License
+Single-activity Compose app, layered `UI → Repository → DataSource →
+CalendarContract`, observer-driven refresh, JVM-first tests. The full tour —
+including the recurring-write and reminder pipelines — lives in
+[docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).
+
+## 🗺 Roadmap
+
+Shipped: read (v1.0), write (v1.1–v2.0), reminder delivery (v1.4).
+Next up: power-user features — widget, search, tablet layouts. The living
+roadmap is in [.planning/ROADMAP.md](.planning/ROADMAP.md), the release
+history in [CHANGELOG.md](CHANGELOG.md).
+
+## 📜 License
 
 [MIT](LICENSE) — Jean-Luc Makiola, 2026

app/build.gradle.kts

@@ -23,8 +23,13 @@ android {
         applicationId = "de.jeanlucmakiola.calendula"
         minSdk = 29
         targetSdk = 36
-        versionCode = 12
-        versionName = "1.4.0"
+        // The git tag is the single source of truth for released builds: at
+        // release time .gitea/workflows/release.yaml derives both fields from
+        // the tag, with versionCode = MAJOR*10000 + MINOR*100 + PATCH
+        // (e.g. v2.0.0 -> 20000). These committed values are the dev/local
+        // default; keep them matching the latest released tag. See docs/RELEASING.md.
+        versionCode = 20000
+        versionName = "2.0.0"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }

app/src/main/java/de/jeanlucmakiola/calendula/domain/EventForm.kt

@@ -94,6 +94,30 @@ fun EventDetail.toEditForm(beginMillis: Long, endMillis: Long, zone: TimeZone):
     )
 }
 
+/**
+ * What the edit form saw when it loaded — compared against a fresh read at
+ * save time to detect external changes (sync, another device) that landed
+ * while the form was open. The raw row times ride along because
+ * [toEditForm] derives the form's times from the *tapped occurrence*, so
+ * re-deriving with the same occurrence would mask an externally moved
+ * event. Not covered (the form can't write them, and the dirty-checked
+ * write can't clobber them): attendees, status, the user's own response,
+ * reminder methods, and a recurring event's duration.
+ */
+data class EditSnapshot(
+    val form: EventForm,
+    /** The raw Events-row times (for recurring events: the series anchor). */
+    val rowStart: Instant,
+    val rowEnd: Instant,
+)
+
+fun EventDetail.toEditSnapshot(beginMillis: Long, endMillis: Long, zone: TimeZone): EditSnapshot =
+    EditSnapshot(
+        form = toEditForm(beginMillis, endMillis, zone),
+        rowStart = instance.start,
+        rowEnd = instance.end,
+    )
+
 /**
  * The optional sections that hold a value in [form] — when editing, these
  * must be visible regardless of the user's default-fields setting, or the

app/src/main/java/de/jeanlucmakiola/calendula/ui/edit/EventEditScreen.kt

@@ -217,7 +217,8 @@ fun EventEditScreen(
                 viewModel.consumeSaveResult()
                 snackbarHostState.showSnackbar(writeDeniedMessage)
             }
-            SaveUiState.Idle, SaveUiState.AwaitingScope, SaveUiState.Saving, null -> Unit
+            // AwaitingScope/AwaitingConflict/Gone render as dialogs below.
+            else -> Unit
         }
     }
 
@@ -269,6 +270,68 @@ fun EventEditScreen(
             onDismiss = viewModel::consumeSaveResult,
         )
     }
+
+    // The event changed externally (sync) while the form was open (v2.0).
+    if (state?.saveState is SaveUiState.AwaitingConflict) {
+        SaveConflictDialog(
+            onOverwrite = viewModel::saveOverwriting,
+            onDiscard = close,
+            onDismiss = viewModel::consumeSaveResult,
+        )
+    }
+
+    // ...or was deleted underneath us — nothing left to save onto. Closing
+    // through [onSaved] also pops the detail screen, whose occurrence is gone.
+    if (state?.saveState == SaveUiState.Gone) {
+        AlertDialog(
+            onDismissRequest = {},
+            title = { Text(stringResource(R.string.event_edit_gone_title)) },
+            text = { Text(stringResource(R.string.event_edit_gone_body)) },
+            confirmButton = {
+                TextButton(onClick = {
+                    viewModel.reset()
+                    onSaved()
+                }) { Text(stringResource(R.string.dialog_ok)) }
+            },
+        )
+    }
+}
+
+/**
+ * Overwrite-or-discard choice when the event changed underneath an open
+ * form (no locking; detected by re-reading at save time). "Overwrite" still
+ * only writes the fields the user edited — external changes to untouched
+ * fields survive either way. Cancelling returns to the form.
+ */
+@Composable
+private fun SaveConflictDialog(
+    onOverwrite: () -> Unit,
+    onDiscard: () -> Unit,
+    onDismiss: () -> Unit,
+) {
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        title = { Text(stringResource(R.string.event_edit_conflict_title)) },
+        text = {
+            Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                Text(stringResource(R.string.event_edit_conflict_body))
+                Spacer(Modifier.height(4.dp))
+                OptionCard(
+                    label = stringResource(R.string.event_edit_conflict_overwrite),
+                    supportingText = stringResource(R.string.event_edit_conflict_overwrite_hint),
+                    onClick = onOverwrite,
+                )
+                OptionCard(
+                    label = stringResource(R.string.event_edit_conflict_discard),
+                    supportingText = stringResource(R.string.event_edit_conflict_discard_hint),
+                    onClick = onDiscard,
+                )
+            }
+        },
+        confirmButton = {
+            TextButton(onClick = onDismiss) { Text(stringResource(R.string.dialog_cancel)) }
+        },
+    )
 }
 
 /**

app/src/main/java/de/jeanlucmakiola/calendula/ui/edit/EventEditUiState.kt

@@ -4,6 +4,7 @@ import de.jeanlucmakiola.calendula.domain.CalendarSource
 import de.jeanlucmakiola.calendula.domain.EventForm
 import de.jeanlucmakiola.calendula.domain.EventFormField
 import de.jeanlucmakiola.calendula.domain.EventFormProblem
+import de.jeanlucmakiola.calendula.domain.RecurringWriteScope
 
 /**
  * UI state for the event form (v1.2: create; v1.3 reuses it for edit). Null
@@ -39,6 +40,14 @@ sealed interface SaveUiState {
     data object Idle : SaveUiState
     /** A dirty recurring event waits for the user to pick the write scope. */
     data object AwaitingScope : SaveUiState
+    /**
+     * The event changed externally (sync) while the form was open; the save
+     * is parked with its chosen [scope] until the user picks overwrite,
+     * discard, or cancel.
+     */
+    data class AwaitingConflict(val scope: RecurringWriteScope) : SaveUiState
+    /** The event was deleted externally while the form was open. */
+    data object Gone : SaveUiState
     data object Saving : SaveUiState
     data object Saved : SaveUiState
     /** WRITE_CALENDAR was revoked between the tap and the provider call. */

app/src/main/java/de/jeanlucmakiola/calendula/ui/edit/EventEditViewModel.kt

@@ -4,18 +4,20 @@ import androidx.lifecycle.ViewModel
 import androidx.lifecycle.viewModelScope
 import dagger.hilt.android.lifecycle.HiltViewModel
 import de.jeanlucmakiola.calendula.data.calendar.CalendarRepository
+import de.jeanlucmakiola.calendula.data.calendar.NoSuchEventException
 import de.jeanlucmakiola.calendula.data.di.IoDispatcher
 import de.jeanlucmakiola.calendula.data.prefs.CalendarPrefs
 import de.jeanlucmakiola.calendula.data.prefs.SettingsPrefs
 import de.jeanlucmakiola.calendula.domain.AccessLevel
 import de.jeanlucmakiola.calendula.domain.Availability
 import de.jeanlucmakiola.calendula.domain.CalendarSource
+import de.jeanlucmakiola.calendula.domain.EditSnapshot
 import de.jeanlucmakiola.calendula.domain.EventForm
 import de.jeanlucmakiola.calendula.domain.EventFormField
 import de.jeanlucmakiola.calendula.domain.RecurringWriteScope
 import de.jeanlucmakiola.calendula.domain.populatedFields
 import de.jeanlucmakiola.calendula.domain.problems
-import de.jeanlucmakiola.calendula.domain.toEditForm
+import de.jeanlucmakiola.calendula.domain.toEditSnapshot
 import kotlinx.coroutines.CoroutineDispatcher
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.asStateFlow
@@ -68,15 +70,21 @@ class EventEditViewModel @Inject constructor(
     val loadFailed: StateFlow<Boolean> = _loadFailed.asStateFlow()
 
     /**
-     * The event being edited plus the form exactly as it was prefilled.
+     * The event being edited plus everything the form saw at load time.
      * For recurring events the write scope is chosen at save time; the
-     * tapped occurrence's [beginMillis] anchors occurrence-level writes.
+     * tapped occurrence's [beginMillis]/[endMillis] anchor occurrence-level
+     * writes and the conflict re-read. [zone] is pinned at load so a device
+     * timezone change mid-edit can't fake a conflict.
      */
     private data class EditTarget(
         val eventId: Long,
-        val original: EventForm,
+        val snapshot: EditSnapshot,
         val beginMillis: Long,
-    )
+        val endMillis: Long,
+        val zone: TimeZone,
+    ) {
+        val original: EventForm get() = snapshot.form
+    }
 
     private data class LocalInputs(
         val form: EventForm?,
@@ -101,7 +109,7 @@ class EventEditViewModel @Inject constructor(
             prefs.lastUsedCalendarId,
             settingsPrefs.defaultFormFields,
             ::ExternalInputs,
-        ),
+        ).flowOn(io),
     ) { local, external ->
         val form = local.form ?: return@combine null
         val resolvedId = form.calendarId
@@ -123,7 +131,6 @@ class EventEditViewModel @Inject constructor(
                 resolved.rrule != local.editTarget.original.rrule,
         )
     }
-        .flowOn(io)
         .stateIn(
             scope = viewModelScope,
             started = SharingStarted.WhileSubscribed(5_000L),
@@ -167,11 +174,12 @@ class EventEditViewModel @Inject constructor(
                 _loadFailed.value = true
                 return@launch
             }
-            val original = detail.toEditForm(beginMillis, endMillis, TimeZone.currentSystemDefault())
-            _editTarget.value = EditTarget(eventId, original, beginMillis)
+            val zone = TimeZone.currentSystemDefault()
+            val snapshot = detail.toEditSnapshot(beginMillis, endMillis, zone)
+            _editTarget.value = EditTarget(eventId, snapshot, beginMillis, endMillis, zone)
             // Sections holding data must show even when not in the defaults.
-            _revealed.value = original.populatedFields()
-            _form.value = original
+            _revealed.value = snapshot.form.populatedFields()
+            _form.value = snapshot.form
         }
     }
 
@@ -249,10 +257,43 @@ class EventEditViewModel @Inject constructor(
         performSave(current.form, scope)
     }
 
-    private fun performSave(form: EventForm, scope: RecurringWriteScope) {
+    /** Finish a save parked in [SaveUiState.AwaitingConflict], overwriting. */
+    fun saveOverwriting() {
+        val current = state.value ?: return
+        val parked = current.saveState as? SaveUiState.AwaitingConflict ?: return
+        performSave(current.form, parked.scope, ignoreConflict = true)
+    }
+
+    private fun performSave(
+        form: EventForm,
+        scope: RecurringWriteScope,
+        ignoreConflict: Boolean = false,
+    ) {
         val target = _editTarget.value
         viewModelScope.launch {
             _saveState.value = SaveUiState.Saving
+            // No locking (plan 03, decision 5): right before writing, re-read
+            // the event and compare against what the form loaded. An external
+            // change parks the save in a conflict dialog instead of silently
+            // clobbering the edited fields.
+            if (target != null && !ignoreConflict) {
+                val fresh = try {
+                    repository.eventDetail(target.eventId)
+                        .toEditSnapshot(target.beginMillis, target.endMillis, target.zone)
+                } catch (e: CancellationException) {
+                    throw e
+                } catch (e: NoSuchEventException) {
+                    _saveState.value = SaveUiState.Gone
+                    return@launch
+                } catch (e: Exception) {
+                    // Can't verify — proceed; a real problem fails the write itself.
+                    null
+                }
+                if (fresh != null && fresh != target.snapshot) {
+                    _saveState.value = SaveUiState.AwaitingConflict(scope)
+                    return@launch
+                }
+            }
             _saveState.value = try {
                 if (target == null) {
                     repository.createEvent(form)

app/src/main/res/values-de/strings.xml

@@ -82,6 +82,16 @@
     <string name="event_edit_availability">Verfügbarkeit</string>
     <string name="event_edit_visibility">Sichtbarkeit</string>
 
+    <!-- Termin-Formular — Speicher-Konflikt (v2.0) -->
+    <string name="event_edit_conflict_title">Termin wurde extern geändert</string>
+    <string name="event_edit_conflict_body">Während du bearbeitet hast, wurde dieser Termin anderswo geändert — durch Synchronisierung oder eine andere App. Was soll mit deinen Änderungen passieren?</string>
+    <string name="event_edit_conflict_overwrite">Meine Änderungen speichern</string>
+    <string name="event_edit_conflict_overwrite_hint">Nur von dir bearbeitete Felder überschreiben die externe Änderung</string>
+    <string name="event_edit_conflict_discard">Meine Änderungen verwerfen</string>
+    <string name="event_edit_conflict_discard_hint">Der Termin bleibt, wie er jetzt ist</string>
+    <string name="event_edit_gone_title">Termin wurde gelöscht</string>
+    <string name="event_edit_gone_body">Dieser Termin wurde zwischenzeitlich gelöscht, etwa auf einem anderen Gerät. Deine Änderungen können nicht mehr gespeichert werden.</string>
+
     <!-- Termin-Formular — Wiederholungs-Picker (v1.3) -->
     <string name="event_edit_recurrence_none">Wiederholt sich nicht</string>
     <string name="event_edit_recurrence_custom">Benutzerdefiniert</string>

app/src/main/res/values/strings.xml

@@ -83,6 +83,16 @@
     <string name="event_edit_availability">Availability</string>
     <string name="event_edit_visibility">Visibility</string>
 
+    <!-- Event form — save conflict (v2.0) -->
+    <string name="event_edit_conflict_title">Event changed elsewhere</string>
+    <string name="event_edit_conflict_body">While you were editing, this event was changed — by sync or another app. What should happen to your changes?</string>
+    <string name="event_edit_conflict_overwrite">Save my changes</string>
+    <string name="event_edit_conflict_overwrite_hint">Only fields you edited overwrite the outside change</string>
+    <string name="event_edit_conflict_discard">Discard my changes</string>
+    <string name="event_edit_conflict_discard_hint">The event stays as it is now</string>
+    <string name="event_edit_gone_title">Event deleted</string>
+    <string name="event_edit_gone_body">This event was deleted in the meantime, for example on another device. Your changes can no longer be saved.</string>
+
     <!-- Event form — recurrence picker (v1.3) -->
     <string name="event_edit_recurrence_none">Does not repeat</string>
     <string name="event_edit_recurrence_custom">Custom</string>

app/src/test/java/de/jeanlucmakiola/calendula/domain/EventFormTest.kt

@@ -112,21 +112,24 @@ class EventFormTest {
         reminders: List<Reminder> = emptyList(),
         availability: Availability = Availability.Busy,
         accessLevel: AccessLevel = AccessLevel.Default,
+        rowStart: Long = 0L,
+        rowEnd: Long = 0L,
+        attendees: List<Attendee> = emptyList(),
     ): EventDetail = EventDetail(
         instance = EventInstance(
             instanceId = 1L,
             eventId = 1L,
             calendarId = 7L,
             title = title,
-            start = Instant.fromEpochMilliseconds(0L),
-            end = Instant.fromEpochMilliseconds(0L),
+            start = Instant.fromEpochMilliseconds(rowStart),
+            end = Instant.fromEpochMilliseconds(rowEnd),
             isAllDay = isAllDay,
             color = 0,
             location = location,
         ),
         description = description,
         organizer = null,
-        attendees = emptyList(),
+        attendees = attendees,
         rrule = rrule,
         reminders = reminders,
         availability = availability,
@@ -177,6 +180,41 @@ class EventFormTest {
         assertThat(prefilled.rrule).isEqualTo("FREQ=WEEKLY")
     }
 
+    @Test
+    fun `snapshots of an unchanged event are equal`() {
+        val a = detail().toEditSnapshot(0L, 3_600_000L, berlin)
+        val b = detail().toEditSnapshot(0L, 3_600_000L, berlin)
+        assertThat(b).isEqualTo(a)
+    }
+
+    @Test
+    fun `an external field change makes snapshots differ`() {
+        val loaded = detail().toEditSnapshot(0L, 3_600_000L, berlin)
+        val fresh = detail(title = "Stand-up (moved)").toEditSnapshot(0L, 3_600_000L, berlin)
+        assertThat(fresh).isNotEqualTo(loaded)
+    }
+
+    @Test
+    fun `an external time move is caught by the row times the form cannot see`() {
+        // Both snapshots are taken for the same tapped occurrence, so the
+        // *forms* derive identical times — only rowStart/rowEnd betray the move.
+        val loaded = detail(rrule = "FREQ=WEEKLY", rowStart = 0L)
+            .toEditSnapshot(0L, 3_600_000L, berlin)
+        val fresh = detail(rrule = "FREQ=WEEKLY", rowStart = 86_400_000L)
+            .toEditSnapshot(0L, 3_600_000L, berlin)
+        assertThat(fresh.form).isEqualTo(loaded.form)
+        assertThat(fresh).isNotEqualTo(loaded)
+    }
+
+    @Test
+    fun `changes the form cannot write do not fake a conflict`() {
+        val loaded = detail().toEditSnapshot(0L, 3_600_000L, berlin)
+        val fresh = detail(
+            attendees = listOf(Attendee("Ada", "ada@example.org", AttendeeStatus.Accepted)),
+        ).toEditSnapshot(0L, 3_600_000L, berlin)
+        assertThat(fresh).isEqualTo(loaded)
+    }
+
     @Test
     fun `populatedFields reports exactly the sections holding values`() {
         val empty = form().copy(location = "", description = "")

docs/ARCHITECTURE.md

@@ -0,0 +1,147 @@
+# Architecture
+
+Calendula is a single-activity Jetpack Compose app layered strictly on top
+of Android's calendar provider. This document is the orientation tour: the
+principles, the layers, and the three pipelines that are not obvious from
+the package list (recurring writes, save conflicts, reminder delivery).
+
+## Principles
+
+1. **`CalendarContract` is the single source of truth.** No app database,
+   no caching layer, no sync code. Reads query the provider; writes go
+   straight back to it. Sync is DAVx5's / Google's / the system's job.
+2. **Observer-driven UI.** A `ContentObserver` on the provider triggers
+   re-queries; every screen recomposes from fresh provider state. After a
+   write, nothing is patched by hand — the provider notifies, the views
+   refresh. This also covers external changes (sync) for free.
+3. **JVM-first testing.** Everything between the UI and the
+   `ContentResolver` is shaped so it runs as a plain JUnit 5 test: pure
+   domain logic, cursor-free mappers, a `FakeCalendarDataSource` for
+   repository tests. Instrumented tests are a last resort.
+4. **No network.** The app declares no `INTERNET` permission. Anything that
+   would need one is an explicit, documented product decision first
+   (see the roadmap's idea backlog).
+
+## Layers
+
+```mermaid
+flowchart TD
+    subgraph UI ["ui/ — Compose screens + ViewModels"]
+        Screens["Month / Week / Day\nDetail / Edit / Settings\nPermission + Reminder onboarding"]
+    end
+    subgraph Data ["data/"]
+        Repo["CalendarRepository\n(interface + impl, Flow-based, io-dispatched)"]
+        DS["CalendarDataSource\n(interface + AndroidCalendarDataSource)"]
+        Prefs["SettingsPrefs / CalendarPrefs\n(DataStore)"]
+        Rem["reminders/\nReminderAlertStore + ReminderNotifier"]
+    end
+    Provider[("CalendarContract\n(system calendar provider)")]
+
+    Screens --> Repo
+    Screens --> Prefs
+    Repo --> DS
+    DS --> Provider
+    Provider -. "ContentObserver tick" .-> Repo
+    Provider -. "EVENT_REMINDER broadcast" .-> Rem
+    Rem --> Provider
+```
+
+- **`domain/`** — pure Kotlin, no Android imports: models
+  (`EventInstance`, `EventDetail`, `CalendarSource`, …), the `EventForm`
+  with validation, `SimpleRecurrence` (RRULE parse/render for the picker),
+  and `EditSnapshot` (conflict detection). All JVM-tested.
+- **`data/calendar/`** — the provider seam. `AndroidCalendarDataSource`
+  owns every `ContentResolver` call; cursor parsing lives in mappers
+  (`InstanceMapper`, `EventDetailMapper`, `CalendarMapper`) that read
+  through a `ColumnReader` abstraction so tests feed them plain maps.
+  `EventWriteMapper` builds dirty-checked update value sets. `TimeBridge`
+  converts provider epoch millis ↔ `kotlin.time.Instant`.
+- **`data/reminders/`** — the notification pipeline (see below). Kept out
+  of `data/calendar/` because the receiver needs neither the repository
+  nor its flows.
+- **`data/prefs/`** — DataStore-backed settings (theme, week start, form
+  field defaults, reminders toggle) and small state (last-used calendar).
+- **`ui/`** — one package per screen, each with Screen + ViewModel +
+  UiState. Shared pieces in `ui/common/` (OptionCard — the app's only
+  sanctioned selection-dialog style —, recurrence humanizer, FAB column,
+  drawer, transitions).
+
+## Navigation
+
+There is no navigation library. `MainActivity` hosts `RootScreen`, which
+gates on the calendar permission and the one-time reminder onboarding, then
+shows `CalendarHost`. `CalendarHost` holds the active view (month/week/day)
+plus overlay state for detail, edit, and settings — full-screen overlays
+driven by `AnimatedVisibility` with a *held-key* pattern: the last shown
+key stays alive through the slide-out so content never flashes empty.
+A tapped reminder notification routes through `MainActivity` (`singleTop` +
+`onNewIntent`) as an external detail key that `CalendarHost` consumes
+exactly like an event tap.
+
+## Recurring writes
+
+The provider's invariants drive the design (learned the hard way, verified
+on-device — see plan 03):
+
+- Recurring rows carry `RRULE` + `DURATION` (no `DTEND`); one-off rows
+  carry `DTEND`.
+- *Only this event* → insert a **modified-occurrence exception** via
+  `CONTENT_EXCEPTION_URI` (the provider clones the series row, so empty
+  optionals are written as explicit NULLs).
+- *This and following* → **series split**: insert the new event first (if
+  that fails the original is untouched), then truncate the original's
+  RRULE with `UNTIL`.
+- Truncation updates must send the **complete time-column set**
+  (`DTSTART`/`DURATION`/`RRULE`/`ALL_DAY`/`EVENT_TIMEZONE`) — the provider
+  regenerates cached instances only from the values carried by the update
+  itself; an RRULE-only update leaves stale instances behind.
+- `UNTIL` is written as the local end of the previous day expressed in
+  UTC, so zones ahead of UTC can't leak an extra occurrence.
+- All-day events are normalised to UTC midnights with an exclusive end.
+
+## Save conflicts
+
+No locking. `openForEdit` keeps an `EditSnapshot` — the prefilled form
+*plus the raw Events-row times* (the form derives its times from the tapped
+occurrence, so a remotely moved event would otherwise be invisible to it).
+Right before writing, the event is re-read and snapshots compared: a
+mismatch parks the save in an overwrite/discard dialog; a vanished event
+informs and closes. Overwrite still writes only dirty fields, so external
+changes to untouched fields survive either way. Fields the form cannot
+write (attendees, status, reminder methods) are excluded so sync noise
+can't fake a conflict.
+
+## Reminder delivery
+
+The provider schedules reminder alarms (for `METHOD_ALERT` rows only) and
+broadcasts `EVENT_REMINDER` — but posts no notification; a calendar app
+must (the Etar model):
+
+```mermaid
+sequenceDiagram
+    participant P as CalendarProvider
+    participant R as EventReminderReceiver
+    participant S as ReminderAlertStore
+    participant N as ReminderNotifier
+    P->>R: EVENT_REMINDER broadcast (manifest receiver, exported)
+    R->>S: dueAlerts(now) — CalendarAlerts: SCHEDULED, alarmTime ≤ now
+    S-->>R: due alerts
+    R->>N: post(alert) — one notification per alert, tag = alert id
+    R->>S: markFired(ids) — best effort, needs WRITE_CALENDAR
+```
+
+Posting happens before marking: a crash in between re-posts silently (same
+tag + `setOnlyAlertOnce`) rather than losing a reminder. Swiped
+notifications never return because `FIRED` rows are never re-queried.
+Deliberately absent until real devices prove it necessary: own alarm
+scheduling, `BOOT_COMPLETED`, snooze/dismiss actions, battery-exemption
+prompts.
+
+## Testing
+
+JUnit 5 + Truth + Turbine on the JVM. The seams that make it work:
+`CalendarDataSource` is faked (`FakeCalendarDataSource` records writes),
+mappers parse `ColumnReader`/plain maps instead of cursors, domain logic
+(recurrence, validation, snapshots, write-value building) is pure. CI
+(Gitea Actions) runs `lint test assembleDebug` on every push; release tags
+additionally build, sign, and publish to the self-hosted F-Droid repo.

docs/README.md

@@ -0,0 +1,20 @@
+# Documentation map
+
+Where to look for what:
+
+| Document | What it is |
+|---|---|
+| [`ARCHITECTURE.md`](ARCHITECTURE.md) | Orientation tour: principles, layers, navigation, recurring-write / conflict / reminder pipelines, testing |
+| [`../CHANGELOG.md`](../CHANGELOG.md) | Release history (Keep a Changelog, SemVer) |
+| [`../.planning/ROADMAP.md`](../.planning/ROADMAP.md) | Living roadmap: shipped milestones, current scope, idea backlog |
+| [`../.planning/PROJECT.md`](../.planning/PROJECT.md) | What the project is, stack, naming, infrastructure |
+| [`../.planning/REQUIREMENTS.md`](../.planning/REQUIREMENTS.md) | Requirement checklist per milestone |
+| [`../.planning/STATE.md`](../.planning/STATE.md) | Snapshot of where development currently stands |
+| [`superpowers/specs/`](superpowers/specs/) | The original design spec (2026-06-08) — historical record, not updated |
+| [`superpowers/plans/`](superpowers/plans/) | Per-milestone implementation plans with task checklists — historical record of how each slice was built, including provider lessons learned |
+| [`../fdroid-metadata/`](../fdroid-metadata/) | F-Droid/fastlane store metadata: descriptions, icon, screenshots (DE + EN) |
+
+Conventions: plans and specs under `superpowers/` are point-in-time
+artifacts of the agentic workflow that built each milestone — they get
+status updates but are never rewritten. The `.planning/` files are living
+documents and should stay current.

docs/RELEASING.md

@@ -0,0 +1,101 @@
+# Releasing Calendula
+
+Calendula is distributed through a self-hosted F-Droid repository. Every
+release is built, signed, and published automatically by
+`.gitea/workflows/release.yaml` when a version tag is pushed.
+
+## Versioning — the git tag is the single source of truth
+
+A release is defined by its tag, `vMAJOR.MINOR.PATCH` (e.g. `v2.1.0`). At
+release time the workflow derives both Gradle fields from the tag:
+
+- `versionName` = the tag without the leading `v` (`2.1.0`)
+- `versionCode` = `MAJOR*10000 + MINOR*100 + PATCH` (`2.1.0` → `20100`)
+
+So `MINOR` and `PATCH` each have room for 0–99. The values committed in
+`app/build.gradle.kts` are only the dev/local default — CI overwrites them
+from the tag. Keep the committed `versionCode`/`versionName` matching the
+**latest released tag** so local builds are sanely versioned; the published
+value always comes from the tag.
+
+Published version codes so far: `v0.1.0`→100 … `v1.0.0`→10000 … `v2.0.0`→20000.
+
+## Cutting a release
+
+1. Move the `## [Unreleased]` section of `CHANGELOG.md` under a new
+   `## [X.Y.Z] — <date>` heading (Keep a Changelog format). The text between
+   that heading and the next `## [` becomes both the Gitea release notes and
+   the F-Droid per-version changelog.
+2. Optionally bump the committed `versionCode`/`versionName` in
+   `app/build.gradle.kts` to match the new version (keeps local builds tidy).
+3. Commit, then tag and push:
+   ```bash
+   git tag vX.Y.Z
+   git push origin vX.Y.Z
+   ```
+4. The push triggers the release workflow. **Hold UI releases for on-device
+   review and explicit go-ahead before tagging.**
+
+## What the pipeline does
+
+`release.yaml` has three jobs:
+
+- **ci** — unit tests + a debug assemble (sanity).
+- **build-and-deploy** — derives the version, builds & signs the release APK
+  with the app key, copies it into the F-Droid repo, generates the per-version
+  changelog, re-signs the F-Droid index with the **repo key**, uploads
+  `repo/` + `metadata/` to the box, and attaches the R8 `mapping.txt` to the
+  Gitea release (best-effort).
+- **gitea-release** — creates/updates the Gitea release carrying the tag's
+  CHANGELOG section as notes. Gated on `ci` only (not the deploy) so notes
+  publish even if the F-Droid upload hiccups.
+
+### Manual re-sign / recovery
+
+A manual `workflow_dispatch` of the release workflow **from a branch** (not a
+tag) runs a **re-sign-only** path: it skips the APK build and just re-signs
+the existing F-Droid index with the configured repo key and re-uploads. Use
+this for key rotation or repo recovery without publishing a new app version.
+
+## Secrets (Gitea → repo Settings → Actions → Secrets)
+
+| Secret | Purpose |
+| --- | --- |
+| `KEYSTORE_BASE64`, `KEY_PASSWORD`, `KEY_ALIAS` | **App** signing key — signs the APK. Losing it means existing installs can't be updated. |
+| `FDROID_KEYSTORE_BASE64` | **F-Droid repo** signing key (`keystore.p12`, base64). Signs the repo index. |
+| `FDROID_CONFIG_BASE64` | F-Droid `config.yml` (base64) — repo metadata + keystore passwords. |
+| `HETZNER_HOST`, `HETZNER_USER`, `HETZNER_PASS` | Upload target for the F-Droid repo. |
+| `GITHUB_TOKEN` | Provided by Gitea Actions; used to create the release + attach assets. |
+
+The two keys are independent: the **app key** signs APKs; the **repo key**
+signs the index (its fingerprint is what users pin). Neither key nor the
+F-Droid `config.yml` is ever uploaded to the server — they live only in CI
+secrets and are reconstructed in-runner. If `FDROID_KEYSTORE_BASE64` /
+`FDROID_CONFIG_BASE64` are unset the workflow **fails loudly** rather than
+minting a new repo key (which would break every user's pinned fingerprint).
+
+## Key custody & recovery
+
+- **Offline backups** of both keys (and passwords) live in a password manager.
+  These are the only safe copies — losing them is unrecoverable.
+- **App key lost** → no existing install can be updated again; you'd have to
+  ship a new app under a new applicationId.
+- **Repo key lost or compromised** → rotate it, publish the new fingerprint in
+  the README, and have users remove + re-add the repo. To rotate: generate a
+  new `keystore.p12` + `config.yml`, set them as the `FDROID_*` secrets, update
+  the README fingerprint, and run the manual re-sign dispatch above.
+
+## F-Droid repo
+
+- URL: `https://apps.dev.jeanlucmakiola.de/dev/fdroid/repo`
+- Fingerprint (current): `C2C0640402BF458FC0ED957AF0B37AA4C14022E72F89CE90B5965B458CF73425`
+- Served from the Hetzner storage box. **nginx serves only `…/fdroid/repo/`** —
+  the working dir (key, config, metadata) sits above it and must never be
+  web-reachable. After any webserver change, verify `keystore.p12` and
+  `config.yml` return 404 while `repo/index-v2.json` returns 200.
+
+## Crash deobfuscation
+
+Each release attaches `mapping-<version>.txt.gz` (the R8 mapping) to its Gitea
+release. To deobfuscate a user stacktrace, download the mapping for that
+version and run it through `retrace`.

docs/superpowers/plans/2026-06-11-03-write-support.md

@@ -47,8 +47,8 @@ Domain bleibt pure Kotlin.
 |---|---|---|
 | v1.1 | Write-Fundament: `WRITE_CALENDAR`, `canModifyContents`, Delete (Serie + einzelnes Vorkommen) | ausgeliefert (v1.1.0, 2026-06-11) |
 | v1.2 | Create: Event-Formular (Titel, Kalender, ganztägig, Start/Ende, Ort, Beschreibung), FAB, Default-Kalender-Pref | ausgeliefert (v1.2.0, 2026-06-11) |
-| v1.3 | Edit: Formular wiederverwendet, Serien-Edit, Reminder-Edit, einfacher Recurrence-Picker | implementiert (Release wartet auf On-Device-Review) |
-| v2.0 | Quick-Add, Occurrence-Edit, Konflikt-Dialog, Polish-Pass, Release | offen |
+| v1.3 | Edit: Formular wiederverwendet, Serien-Edit, Reminder-Edit, einfacher Recurrence-Picker | ausgeliefert (v1.3.0, 2026-06-11) |
+| v2.0 | Konflikt-Dialog, Polish-Pass (Store-Copy, Screenshots), Release | ausgeliefert (v2.0.0, 2026-06-11) |
 
 ## v1.1 — Write-Fundament + Delete
 
@@ -180,9 +180,25 @@ Domain bleibt pure Kotlin.
 Bewusst nicht in v1.3 (→ v2.0): Konflikt-Dialog, Kalender-Wechsel beim
 Bearbeiten (Sync-Adapter-Minenfeld, sperren auch alle Stock-Apps).
 
-## v2.0 — Abschluss (Skizze)
+## v2.0 — Abschluss (Scope-Recut 2026-06-11, nach v1.4)
 
-- Quick-Add-Sheet (Titel + Zeit, Rest Defaults)
-- Occurrence-Edit (Exception mit geänderten Werten)
-- Konflikt-Dialog beim Speichern
-- Changelog, F-Droid-Metadaten, Release-Tag
+- ~~Quick-Add-Sheet (Titel + Zeit, Rest Defaults)~~ — **gestrichen**: das
+  Formular öffnet bereits vorbefüllt (sichtbarer Tag, zuletzt benutzter
+  Kalender, optionale Felder versteckt); der Sheet spart nur einen
+  Screen-Übergang und kostet eine zweite Create-Surface. Nur bei
+  Praxis-Feedback wieder aufnehmen
+- ~~Occurrence-Edit (Exception mit geänderten Werten)~~ — schon in v1.3
+  ausgeliefert (vorgezogen)
+- [x] Konflikt-Dialog beim Speichern (Leitentscheidung 5): `EditSnapshot`
+      (Formular + rohe Row-Zeiten) wird beim Laden gemerkt und vor dem
+      Schreiben gegen einen frischen Read verglichen; Abweichung parkt den
+      Save in `AwaitingConflict` (Überschreiben/Verwerfen/Abbrechen,
+      OptionCard-Stil), gelöschtes Event → `Gone`-Dialog. "Überschreiben"
+      schreibt weiterhin nur dirty Felder
+- Kalender-Wechsel beim Bearbeiten → v3-Backlog (copy+delete-Modell)
+- [x] Polish: F-Droid-Description + README auf Write-Support + Reminder
+      aktualisiert (DE+EN)
+- [x] F-Droid-Screenshots (de-DE + en-US, je 6: Woche/Monat/Tag/Detail/
+      Formular/Onboarding) — mit Demo-Kalendern auf dem Gerät aufgenommen
+- [x] Changelog, Release-Tag v2.0.0 (ausgeliefert 2026-06-11 — Milestone 2
+      damit abgeschlossen)

fdroid-metadata/de.jeanlucmakiola.calendula/de-DE/description.txt

@@ -1,12 +1,17 @@
-Calendula ist eine moderne, quelloffene Kalender-App für Android. Sie liest
-direkt aus dem System-Kalender-Provider — jede Quelle, die mit deinem Gerät
-synchronisiert ist (Nextcloud über DAVx5, Google, lokal, WebCal-Subscriptions)
-erscheint automatisch.
+Calendula ist eine moderne, quelloffene Kalender-App für Android. Sie
+arbeitet direkt auf dem System-Kalender-Provider — jede Quelle, die mit
+deinem Gerät synchronisiert ist (Nextcloud über DAVx5, Google, lokal,
+WebCal-Subscriptions), erscheint automatisch, und deine Änderungen
+synchronisieren auf demselben Weg zurück.
+
+Termine erstellen, bearbeiten und löschen — auch wiederkehrende, mit
+wählbarer Reichweite (nur dieser Termin / dieser und alle folgenden / ganze
+Serie) und einem einfachen Wiederholungs-Picker. Erinnerungen stellt
+Calendula selbst als Benachrichtigung zu — ein Tipp darauf öffnet den
+Termin.
 
 Der Unterschied liegt im Design: echtes Material 3 Expressive durchgehend,
 mit Dynamic Color, expressiven Animationen und neuen Shape-Sprachen.
 
-V1 ist read-only. Erstellen, Bearbeiten und Löschen von Events kommt mit V2.
-
-Datenschutz: keinerlei Telemetrie, kein Tracking, kein Netzwerkzugriff — deine
-Daten bleiben auf dem Gerät.
+Datenschutz: keinerlei Telemetrie, kein Tracking, kein Netzwerkzugriff —
+deine Daten bleiben auf dem Gerät.

fdroid-metadata/de.jeanlucmakiola.calendula/en-US/description.txt

@@ -1,11 +1,15 @@
-Calendula is a modern, open-source calendar app for Android. It reads from
-the system calendar provider, so any source synced to your device — Nextcloud
-via DAVx5, Google, local, WebCal subscriptions — shows up automatically.
+Calendula is a modern, open-source calendar app for Android. It works
+directly on the system calendar provider, so any source synced to your
+device — Nextcloud via DAVx5, Google, local, WebCal subscriptions — shows up
+automatically, and changes you make sync back the same way.
 
-The differentiator is the design: real Material 3 Expressive throughout, with
-dynamic color, expressive motion, and expressive shapes.
+Create, edit and delete events, including recurring events with scoped
+changes (only this event / this and all following / the whole series) and a
+simple repeat picker. Calendula also delivers your event reminders as
+notifications — tap one and you're on the event.
 
-V1 is read-only. Event creation, editing, and deletion are planned for V2.
+The differentiator is the design: real Material 3 Expressive throughout,
+with dynamic color, expressive motion, and expressive shapes.
 
 Privacy: zero telemetry, no analytics, no network access — your data never
 leaves the device.