DRY pass #3 : the "from the text" mark is one composable (#5373 )

The label picker and the editor's tag row each wrote the same Text: the label_from_tag string, labelSmall, onSurfaceVariant, 8dp start padding. Chips.kt's FromTextMark() is now both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
One tag-name fold on the web and on Android, beside the core's (#5373 , #5385 )
2026-10-08 20:14:24 -04:00 · 2026-10-08 17:05:30 -04:00 · 2026-10-08 17:01:42 -04:00 · 2026-10-08 16:57:09 -04:00 · 2026-10-08 16:54:41 -04:00 · 2026-10-08 16:54:19 -04:00
370 changed files with 31210 additions and 7324 deletions
@@ -1,4 +1,4 @@
-# ThoughtSync production settings. Copy to `.env` and edit:
+# Inkwell production settings. Copy to `.env` and edit:
 #
 #   cp .env.example .env
 #
@@ -29,15 +29,15 @@ POSTGRES_PASSWORD=
 #
 # NOTE: `main` can sit well behind `dev`. If a feature you expect is missing,
 # check which branch it actually landed on before assuming a bug.
-#THOUGHTSYNC_TAG=latest
+#INKWELL_TAG=latest

 # The host port the app is published on.
-#THOUGHTSYNC_PORT=5000
+#INKWELL_PORT=5000

 # Which interface to bind. The default (all interfaces) is what lets desktop
 # clients on your network reach the server. Behind a reverse proxy, set this to
 # 127.0.0.1 so only the proxy can talk to it.
-#THOUGHTSYNC_BIND=0.0.0.0
+#INKWELL_BIND=0.0.0.0

 # NOTE: how many proxies sit in front of this app is a SETTING, not an env var —
 # Settings → Security → "Trusted proxy hops" in the admin UI. It defaults to 1 (one
@@ -47,12 +47,31 @@ POSTGRES_PASSWORD=
 # How much the app says. Credential events (sign-ins, failures, throttles, new
 # accounts, device tokens issued) are logged at INFO and read with
 # `docker compose logs app`.
-#THOUGHTSYNC_LOG_LEVEL=INFO
+#INKWELL_LOG_LEVEL=INFO

 # Database identity. Changing these AFTER the first start does not rename anything
 # that already exists — the volume keeps whatever the first run created.
+#POSTGRES_USER=inkwell
+#POSTGRES_DB=inkwell
+
+# --- Upgrading from ThoughtSync ---------------------------------------------
+#
+# Inkwell was called ThoughtSync, and a deployment installed under that name has
+# its data in volumes and a database named for it. Point at them instead of
+# renaming anything. Leaving these unset on such a deployment starts Inkwell
+# against EMPTY volumes; the old data is untouched, but you would not see it.
+#
+# Use the full names `docker volume ls` prints — compose prefixes them with the
+# project name, so they usually look like `thoughtsync_thoughtsync-db`:
+#INKWELL_DB_VOLUME=thoughtsync_thoughtsync-db
+#INKWELL_DATA_VOLUME=thoughtsync_thoughtsync-data
+#
+# And the database identity the first start created, which a volume keeps:
 #POSTGRES_USER=thoughtsync
 #POSTGRES_DB=thoughtsync
+#
+# Rename any THOUGHTSYNC_* lines already in your .env to INKWELL_* — the old
+# names are no longer read.

 # --- a note on HTTPS --------------------------------------------------------
 #
@@ -4,7 +4,7 @@ name: Android
 #
 # Replaces the Tauri-mobile lane deleted in step 2. What changed is what this
 # builds, not that Android has a lane: the UI is Compose, and the store and sync
-# engine are `thoughtsync-core` cross-compiled by cargo-ndk and loaded through
+# engine are `inkwell-core` cross-compiled by cargo-ndk and loaded through
 # uniffi.
 #
 # CI can only prove this BUILDS. A Linux runner cannot execute an APK, so anything
@@ -19,15 +19,9 @@ name: Android

 on:
  push:
+    # NO `paths:` FILTER — the `decide` job below reads the real file set instead.
+    # See desktop.yml for why, and 85ead4d for what the duplication cost.
    branches: [dev, main]
-    paths:
-      - "android/**"
-      # The Rust the .so is built from. A core change reaches the phone exactly
-      # as it reaches the desktop, so this lane has to rebuild on it.
-      - "core/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - ".forgejo/workflows/android.yml"
  workflow_dispatch:

 concurrency:
@@ -42,8 +36,70 @@ env:
  JAVA_TOOL_OPTIONS: "--enable-native-access=ALL-UNNAMED"

 jobs:
+  # Does the APK need rebuilding, or is the channel already serving this source?
+  # See the equivalent job in desktop.yml — same reasoning, same replacement of a
+  # hand-kept `paths:` filter with the one file set in `packaging/version.sh`.
+  #
+  # The guard runs here so it covers the skip path too (§6.3).
+  #
+  # NOTE THE COUPLING WITH ci.yml: when this lane builds, its server-image job dispatches
+  # ci.yml so the image bakes in the APK just published. When it SKIPS, no dispatch
+  # happens — and that is correct, because ci.yml's `gate` stands down only when the
+  # push touched Android's files, which is the same condition that makes this build.
+  # The two decisions agree because they read the same fact; they are still two
+  # readers of it, which is why the gate's grep carries a comment pointing here.
+  decide:
+    name: Build, or is the channel already serving this?
+    runs-on: python-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-python:3.14
+    outputs:
+      build: ${{ steps.d.outputs.build }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Decide
+        id: d
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          case "$GITHUB_REF_NAME" in
+            main) channel=stable ;;
+            *)    channel=dev ;;
+          esac
+          sh packaging/guard-forward.sh android "$channel"
+          echo "build=$(sh packaging/should-build.sh android "$channel")" >> $GITHUB_OUTPUT
+
+  # The core ships inside the APK (through android/ffi), so its checks have to gate
+  # the APK HERE, in this workflow's graph. desktop.yml runs them too, but a red run
+  # there cannot stop this lane publishing (rule 177, #5237).
+  #
+  # On ci-tauri, not ci-rust-android: these are host-target tests, and on Linux the
+  # core's native-tls is OpenSSL, whose headers only ci-tauri carries. The Android
+  # image has OpenSSL vendored for the Android targets alone (run 8663 failed at
+  # `openssl-sys` trying this there). Same Rust pin, same Cargo.lock.
+  rust:
+    name: Core and FFI clippy and tests
+    needs: [decide]
+    if: needs.decide.outputs.build == 'true'
+    runs-on: python-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-tauri:1.97
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Clippy
+        run: cargo clippy --locked -p inkwell-core -p inkwell-ffi --all-targets -- -D warnings
+
+      - name: Test
+        run: cargo test --locked -p inkwell-core -p inkwell-ffi
+
  build:
    name: Kotlin + Rust (APK)
+    needs: [decide, rust]
+    if: needs.decide.outputs.build == 'true'
    # runs-on is only a scheduling label (Label Model B). flutter-ci is the
    # proven-working label that can pull our container images.
    runs-on: flutter-ci
@@ -54,8 +110,6 @@ jobs:

    permissions:
      contents: write
-      # For the dispatch at the end: this lane starts the server image build.
-      actions: write

    defaults:
      run:
@@ -63,6 +117,10 @@ jobs:

    steps:
      - uses: actions/checkout@v4
+        with:
+          # Derives a version, so it needs the whole history — see the note in
+          # desktop.yml. Depth-1 is silently wrong here, not loudly broken (§6.1).
+          fetch-depth: 0

      - name: Cache Gradle and Cargo
        uses: actions/cache@v4
@@ -85,27 +143,29 @@ jobs:
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: |
-          version="$(sh ../desktop/packaging/build-version.sh)"
+          # TWO CLOCKS, ON PURPOSE (note 3127 §2). The NAME answers "is this the
+          # same code?", so it comes from the COMMIT and a dev build and the main
+          # build of one commit read identically. The CODE answers "may this be
+          # installed over that?" and must be monotonic BY CONSTRUCTION, because
+          # Android hard-fails a downgrade with INSTALL_FAILED_VERSION_DOWNGRADE and
+          # leaves a channel you cannot get out of — so it comes from BUILD time,
+          # which cannot go backwards. Commit time can.
+          version="$(sh ../packaging/version.sh display android)"
+          code="$(sh ../packaging/version.sh key android)"
          echo "name=$version" >> $GITHUB_OUTPUT
-          # versionCode must RISE for Android to accept an update, and the run
-          # number is the same monotonic counter the desktop's version scheme
-          # already uses — no state carried between runs, and immune to the
-          # shallow checkout that makes a commit count useless here.
-          echo "code=$GITHUB_RUN_NUMBER" >> $GITHUB_OUTPUT
+          echo "code=$code" >> $GITHUB_OUTPUT

          if [ -n "${ANDROID_KEYSTORE_BASE64:-}" ]; then
-            printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 -d > /tmp/thoughtsync-release.jks
+            printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 -d > /tmp/inkwell-release.jks
            echo "variant=Release" >> $GITHUB_OUTPUT
            echo "label=release" >> $GITHUB_OUTPUT
-            # DEBUG profile, in a release APK, deliberately — see the note above
-            # the cargoNdk task. The release profile strips the symbols uniffi
-            # reads its metadata out of, so `generateUniffiBindings` fails
-            # outright (run 4077). Unpicking that is worth doing and is not worth
-            # blocking signed builds on.
-            echo "profile=debug" >> $GITHUB_OUTPUT
-            echo "keystore=/tmp/thoughtsync-release.jks" >> $GITHUB_OUTPUT
+            # An optimised .so for the APK people install. The cargoNdk task keeps
+            # the symbols uniffi reads its metadata from, which the release
+            # profile would strip (run 4077, Scribe #2810).
+            echo "profile=release" >> $GITHUB_OUTPUT
+            echo "keystore=/tmp/inkwell-release.jks" >> $GITHUB_OUTPUT
            echo "apk=android/app/build/outputs/apk/release/app-release.apk" >> $GITHUB_OUTPUT
-            echo "Signed release build — $version (versionCode $GITHUB_RUN_NUMBER)"
+            echo "Signed release build — $version (versionCode $code)"
          else
            echo "::warning::No ANDROID_KEYSTORE_BASE64 secret. Building an UNSIGNED DEBUG APK: it cannot be installed over a signed build and cannot self-update."
            echo "variant=Debug" >> $GITHUB_OUTPUT
@@ -127,7 +187,7 @@ jobs:
      # from the built .so. Run as its own step so a Rust failure is legible as a
      # Rust failure instead of arriving inside a Gradle stack trace.
      - name: Build the native library and bindings
-        run: ./gradlew generateUniffiBindings -PTHOUGHTSYNC_CARGO_PROFILE=${{ steps.build.outputs.profile }}
+        run: ./gradlew generateUniffiBindings -PINKWELL_CARGO_PROFILE=${{ steps.build.outputs.profile }}

      # The image's PINNED CLIs, not Gradle plugins. ci-rust-android carries both
      # (M12 step 3) precisely so this lane needs no second image, and going
@@ -145,15 +205,15 @@ jobs:
      - name: Unit tests
        # Host-JVM tests only. Anything touching the core needs an Android
        # runtime to load the .so, so those are instrumented tests and belong on
-        # an emulator, not here — the Rust side is covered by the workspace
-        # tests in the desktop lane.
+        # an emulator, not here — the Rust side is the `rust` job, which this
+        # one needs.
        #
        # DEBUG regardless of what is being packaged: AGP creates unit-test tasks
        # only for `testBuildType`, which is debug, so `testReleaseUnitTest` does
        # not exist (run 4082). It costs one extra Kotlin compile and buys the
        # type-check on the debug variant, which is the one an emulator build
        # would use.
-        run: ./gradlew testDebugUnitTest -PTHOUGHTSYNC_CARGO_PROFILE=${{ steps.build.outputs.profile }}
+        run: ./gradlew testDebugUnitTest -PINKWELL_CARGO_PROFILE=${{ steps.build.outputs.profile }}

      - name: Assemble the APK
        env:
@@ -163,20 +223,40 @@ jobs:
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
        run: |
          ./gradlew assemble${{ steps.build.outputs.variant }} \
-            -PTHOUGHTSYNC_CARGO_PROFILE=${{ steps.build.outputs.profile }} \
-            -PTHOUGHTSYNC_VERSION_NAME=${{ steps.build.outputs.name }} \
-            -PTHOUGHTSYNC_VERSION_CODE=${{ steps.build.outputs.code }}
+            -PINKWELL_CARGO_PROFILE=${{ steps.build.outputs.profile }} \
+            -PINKWELL_VERSION_NAME=${{ steps.build.outputs.name }} \
+            -PINKWELL_VERSION_CODE=${{ steps.build.outputs.code }}

      # Prints the certificate the APK was actually signed with, so the operator
      # can compare it against the fingerprint recorded when the key was
      # generated. Signing with the WRONG key produces a perfectly valid APK that
      # simply refuses to install over the app already on the phone — a failure
      # that otherwise only shows up on the device, after the run is green.
-      - name: Show the signing certificate
+      #
+      # And FAILS unless there is exactly one signer and it is the release key
+      # (family idea #5103, practice 3). Printing alone was not a check: a build
+      # signed with any other key would have gone on to be staged and published,
+      # and every phone would have refused it. The steps that publish come after
+      # this one in the same job, so a failure here stops them.
+      - name: Check the signing certificate
        if: steps.build.outputs.keystore != ''
+        env:
+          # The release certificate's SHA-256, as apksigner printed it for the
+          # signed APK in run 8753 (CN=Bryan Van Deusen, O=fabledsword). Every
+          # installed copy carries this certificate. It only changes if the key
+          # does, and then every install has to be replaced by hand anyway.
+          RELEASE_CERT_SHA256: 408a5835ea1627f329d9fba4f00712b096faf2d30624ec6f3a8b2b5f8bb15caa
        run: |
          apksigner="$(ls /opt/android-sdk/build-tools/*/apksigner | head -1)"
-          "$apksigner" verify --print-certs "app/build/outputs/apk/release/app-release.apk"
+          certs="$("$apksigner" verify --print-certs "app/build/outputs/apk/release/app-release.apk")"
+          printf '%s\n' "$certs"
+          signers="$(printf '%s\n' "$certs" | grep -c '^Signer #[0-9]* certificate SHA-256 digest:' || true)"
+          digest="$(printf '%s\n' "$certs" | sed -n 's/^Signer #1 certificate SHA-256 digest: //p')"
+          if [ "$signers" != 1 ] || [ "$digest" != "$RELEASE_CERT_SHA256" ]; then
+            echo "::error::The APK is not signed by the release key alone ($signers signer(s), first $digest; expected $RELEASE_CERT_SHA256)."
+            exit 1
+          fi
+          echo "Signed by the release key."

      # Staged with a STABLE name plus the sidecar the server reads its version
      # out of — an APK keeps that in a binary manifest Python cannot parse, and
@@ -186,10 +266,10 @@ jobs:
        if: steps.build.outputs.keystore != ''
        run: |
          mkdir -p dist
-          cp "app/build/outputs/apk/release/app-release.apk" dist/thoughtsync.apk
-          size="$(wc -c < dist/thoughtsync.apk | tr -d ' ')"
-          sha="$(sha256sum dist/thoughtsync.apk | cut -d' ' -f1)"
-          cat > dist/thoughtsync-android.json <<JSON
+          cp "app/build/outputs/apk/release/app-release.apk" dist/inkwell.apk
+          size="$(wc -c < dist/inkwell.apk | tr -d ' ')"
+          sha="$(sha256sum dist/inkwell.apk | cut -d' ' -f1)"
+          cat > dist/inkwell-android.json <<JSON
          {
            "version_name": "${{ steps.build.outputs.name }}",
            "version_code": ${{ steps.build.outputs.code }},
@@ -197,52 +277,76 @@ jobs:
            "sha256": "$sha"
          }
          JSON
-          cat dist/thoughtsync-android.json
+          cat dist/inkwell-android.json

-      # The rolling dev channel, same fixed-tag release the desktop bundles use.
-      # CI artifacts are per-run and auth-gated, so they are no use as a fetch
-      # target; a release asset has a permanent URL. Only ever a SIGNED build —
-      # publishing an unsigned APK would offer people something they cannot
-      # install over what they already have.
-      - name: Publish to the dev channel
-        if: github.ref == 'refs/heads/dev' && steps.build.outputs.keystore != ''
+      # The rolling channel for this branch, the same fixed-tag releases the desktop
+      # bundles use. CI artifacts are per-run and auth-gated, so they are no use as a
+      # fetch target; a release asset has a permanent URL. Only ever a SIGNED build —
+      # publishing an unsigned APK would offer people something they cannot install
+      # over what they already have.
+      #
+      # `stable` from main is new in M314 step 3, and it is what lets the server image
+      # bake in a client that matches its own channel: a :latest image fetches the APK
+      # from `stable`, a :dev image from `dev`. Before this, main published no APK at
+      # all and every image — stable included — baked in the dev one.
+      - name: Publish to the channel for this branch
+        if: (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main') && steps.build.outputs.keystore != ''
        working-directory: .
        env:
          GITHUB_TOKEN: ${{ github.token }}
-          RELEASE_TAG: dev
-          RELEASE_PRERELEASE: "true"
-        run: bash desktop/packaging/publish-release.sh
+        run: |
+          case "$GITHUB_REF_NAME" in
+            main) channel=stable; RELEASE_PRERELEASE=false ;;
+            *)    channel=dev;    RELEASE_PRERELEASE=true  ;;
+          esac
+          # The channel's release TAG, not its name: `dev` publishes on `dev-rolling`
+          # (packaging/channel-tag.sh). A tag named `dev` shadowed the branch.
+          RELEASE_TAG="$(sh packaging/channel-tag.sh "$channel")"
+          export RELEASE_TAG RELEASE_PRERELEASE
+          echo "Publishing the APK to the $RELEASE_TAG channel."
+          bash desktop/packaging/publish-release.sh

      - name: Upload the APK
-        # Mirrored action, never actions/upload-artifact. @v4+ throws
-        # GHESNotSupportedError client-side on this hostname, and @v3 is worse —
-        # it reports success while Gitea serves artifacts back only through the
-        # v4 API, so the upload is stored and invisible. Pinned by SHA because
-        # the mirror auto-syncs; full URL because DEFAULT_ACTIONS_URL sends bare
-        # owner/repo to github.com. See Scribe issues 2255 / 2270.
-        uses: https://git.fabledsword.com/bvandeusen/upload-artifact@cb8afe72b42edc798abfb8fcb556cf660d894245
+        # Stock action: it works on this forge since the runner moved to
+        # gitea/runner 3.x, which edits upload-artifact's client-side GHES refusal
+        # out of the action bundle (Scribe snippet #2271). Never @v3 — it reports
+        # success while Gitea serves artifacts back only through the v4 API, so the
+        # upload is stored and invisible (Scribe 2270).
+        uses: actions/upload-artifact@v7
        with:
-          # The APK's variant, NOT the Cargo profile — those are the same word
-          # for different things and the profile is pinned to debug (#2810).
-          name: thoughtsync-android-${{ steps.build.outputs.label }}-${{ github.sha }}
+          # The APK's variant, NOT the Cargo profile. They are the same word for
+          # different things, and an unsigned debug APK still differs from a
+          # signed release one in more than its Rust.
+          name: inkwell-android-${{ steps.build.outputs.label }}-${{ github.sha }}
          path: ${{ steps.build.outputs.apk }}
          if-no-files-found: error

+  server-image:
+    name: Build the server image
+    needs: [decide, rust, build]
+    if: needs.decide.outputs.build == 'true' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
+    runs-on: flutter-ci
+    container:
+      # The image the dispatch has always run in, so its curl is a known quantity.
+      image: git.fabledsword.com/bvandeusen/ci-rust-android:1.97
+    permissions:
+      actions: write
+    steps:
      # The server image bakes in whatever client the dev release holds, so it has
      # to be built AFTER this lane, not alongside it. `ci.yml` stands down on any
      # push that touches the Android app (its `gate` job) and waits to be called
      # from here — that is the other half of this.
      #
-      # `always()`: a FAILED Android build must still let the server image through.
-      # There is no new client in that case, so it bakes in the previous one, which
-      # is exactly right — the alternative is a broken Android lane silently
-      # blocking server delivery.
+      # No `always()`: a red core check or APK build means no image for this
+      # commit (rule 177, #5419). This used to run regardless, on the reasoning that
+      # a broken Android lane shouldn't block server delivery, and the image would
+      # bake in the previous client. Run 8839 is what that meant: `:<sha>` published
+      # for 0ecdbfe while its APK lane (8835) was red, holding a client that wasn't
+      # from that commit. The previous `:dev` stays where it is; fix forward.
      #
-      # Not `if: success()` and not skipped on tags either: every ref that builds an
-      # image needs the call, or nothing builds one at all.
+      # Not skipped on tags: every ref that builds an image needs the call, since
+      # ci.yml stands down on these pushes and nothing else builds one.
      - name: Build the server image now the client is published
-        if: always() && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
-        working-directory: .
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
@@ -1,12 +1,21 @@
 # CI runs first; build only proceeds if lint + typecheck pass.
 #
-# Push to dev:       typecheck + lint + test + build :dev + :<sha>
-# Push to main:      typecheck + lint + test + build :latest + :<sha>
-# Tag v* (release):  typecheck + lint + test + build :latest + :<version> + :<sha>
+# Push to dev:   typecheck + lint + test + build :dev
+# Push to main:  typecheck + lint + test + build :latest + :<sha>
 #
-# main is the production line, so a merge to main rebuilds and moves :latest to its
-# tip (family rule 46) — no version release required. The :<sha> image is the
-# immutable rollback unit for every build.
+# THAT IS THE COMPLETE TAG SET (rule 145). No version-shaped image tag in any lane:
+# nothing pins one — verified by looking for a consumer, not for whether one is
+# imaginable — and the git release tag is a different object in a different system
+# (step 7). The image is addressed by CHANNEL or by COMMIT; the release by date.
+#
+# A `v*` tag builds nothing at all. The merge to main already published everything,
+# so a tag rebuilding that same source would re-push :<sha> with different bytes,
+# which rule 145 forbids even when they match.
+#
+# main is the production line, so a merge moves :latest to its tip (family rule 46)
+# — no version release required. :<sha> is the immutable rollback unit, and it is
+# on main ONLY: a sha tag per dev push is a rollback target nobody has ever pulled,
+# accumulating forever, for a channel whose entire contract is that it moves.
 #
 # Required secret (repo -> Settings -> Secrets -> Actions):
 #   REGISTRY_TOKEN  -- Forgejo PAT with write:packages scope
@@ -16,34 +25,36 @@ name: CI & Build

 on:
  push:
+    # NO `paths:` FILTER, and unlike the client lanes this one does not skip either —
+    # the image ALWAYS builds. Two reasons:
+    #
+    #   * Rule 145 promises that every push to `main` publishes a `:<sha>`, so any
+    #     production commit is addressable. A path filter quietly broke that promise
+    #     for a docs-only merge: no trigger, no image, no sha tag for that commit.
+    #   * It is the artifact most exposed to base-image staleness (`python:3.12-slim`
+    #     is a floating tag and this can face the internet), and building every push
+    #     picks those updates up. That is why note 3127 §4's base tension does not
+    #     bite here — the one artifact it would apply to never skips.
+    #
+    # Affordable because it is the cheap one: ~15 seconds, against 6 and 9 minutes
+    # for the clients, which is why THEY skip and this does not.
    branches: [dev, main]
-    tags: ["v*"]
-    paths:
-      - "src/**"
-      - "frontend/**"
-      - "tests/**"
-      - "pyproject.toml"
-      - "alembic/**"
-      - "alembic.ini"
-      - "Dockerfile"
-      - ".forgejo/workflows/ci.yml"
  # Dispatched by the Android lane once it has published a client, so the image
  # that bakes it in is built AFTER the APK exists rather than racing it. See the
  # `gate` job below for the other half.
  workflow_dispatch:

-# Cancel older runs on the same branch when a newer push lands. Tag runs get their
-# own group implicitly and are never cancelled.
+# Cancel older runs on the same branch when a newer push lands.
 concurrency:
  group: ci-${{ github.ref }}
-  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}
+  cancel-in-progress: true

 permissions:
  contents: read

 env:
  REGISTRY: git.fabledsword.com
-  IMAGE: git.fabledsword.com/bvandeusen/thoughtsync
+  IMAGE: git.fabledsword.com/bvandeusen/inkwell

 jobs:
  # Should this push build an image now, or is the Android lane about to publish a
@@ -64,7 +75,7 @@ jobs:
  # than a config so at least it is inspectable in the log.
  gate:
    name: Build now, or wait for Android?
-    if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
+    if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main'
    runs-on: python-ci
    container:
      image: git.fabledsword.com/bvandeusen/ci-python:3.14
@@ -89,17 +100,6 @@ jobs:
            exit 0
          fi

-          # A tag. The Android lane does not run on tags, so nothing would ever
-          # call back — standing down here would mean a release tag that never
-          # produces an image at all.
-          case "${{ github.ref }}" in
-            refs/tags/*)
-              echo "Tag build — the Android lane does not run on tags. Building."
-              echo "build=true" >> $GITHUB_OUTPUT
-              exit 0
-              ;;
-          esac
-
          # No parent (first commit, or a force-push that orphaned it) — nothing to
          # compare, so build rather than stall.
          if ! git rev-parse --verify -q HEAD^ >/dev/null; then
@@ -125,7 +125,12 @@ jobs:
          echo "Changed in this push:"
          echo "$changed" | sed 's/^/    /'

-          if echo "$changed" | grep -qE '^(android/|core/|Cargo\.toml$|Cargo\.lock$|\.forgejo/workflows/android\.yml$)'; then
+          # MUST match android's file set in packaging/version.sh. `packaging/` was
+          # missing here after step 4 added it there — so a packaging-only push had
+          # the Android lane rebuild and dispatch while this gate ALSO let the image
+          # build, producing two images for one commit and, on main, a second push of
+          # the same :<sha> with different bytes. Rule 145's exact prohibition.
+          if echo "$changed" | grep -qE '^(android/|core/|packaging/|Cargo\.toml$|Cargo\.lock$|\.forgejo/workflows/android\.yml$)'; then
            echo ""
            echo "This push also changes the Android client. Standing down: the"
            echo "Android lane will publish a new APK and dispatch this workflow,"
@@ -138,9 +143,13 @@ jobs:
            echo "build=true" >> $GITHUB_OUTPUT
          fi

+  # The web's whole verification: the type check, then its unit tests. Both in the
+  # job `build` already needs, so a red web test blocks the image like any other
+  # lane (rule 177). The unit tests arrived with #5166; before them the web copy of
+  # the note grammar, mirrored in Rust and Python, was guarded by nothing.
  typecheck:
-    name: TypeScript typecheck
-    if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
+    name: Web typecheck and unit tests
+    if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main'
    runs-on: python-ci
    container:
      image: git.fabledsword.com/bvandeusen/ci-python:3.14
@@ -151,13 +160,19 @@ jobs:
        run: npm ci
        working-directory: frontend

+      # tsconfig.test.json, not the default: the default leaves the unit tests out
+      # so the Docker build (which has only frontend/) can type-check the app.
      - name: Type check
-        run: npx vue-tsc --noEmit
+        run: npx vue-tsc --noEmit -p tsconfig.test.json
+        working-directory: frontend
+
+      - name: Unit tests
+        run: npm test
        working-directory: frontend

  lint:
    name: Python lint
-    if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
+    if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main'
    runs-on: python-ci
    container:
      image: git.fabledsword.com/bvandeusen/ci-python:3.14
@@ -170,7 +185,7 @@ jobs:

  test:
    name: Python tests
-    if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
+    if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main'
    runs-on: python-ci
    container:
      image: git.fabledsword.com/bvandeusen/ci-python:3.14
@@ -200,7 +215,7 @@ jobs:
  # discovery step below filters `docker ps` by it. Service hostnames are not routable
  # on this runner (rule 79), so the step resolves the container's bridge IP.
  integration:
-    if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
+    if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main'
    runs-on: python-ci
    container:
      image: git.fabledsword.com/bvandeusen/ci-python:3.14
@@ -210,11 +225,11 @@ jobs:
        # Postgres it will actually meet.
        image: postgres:16-alpine
        env:
-          POSTGRES_USER: thoughtsync
+          POSTGRES_USER: inkwell
          POSTGRES_PASSWORD: ci_integration
-          POSTGRES_DB: thoughtsync_test
+          POSTGRES_DB: inkwell_test
        options: >-
-          --health-cmd "pg_isready -U thoughtsync"
+          --health-cmd "pg_isready -U inkwell"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 10
@@ -234,11 +249,21 @@ jobs:
          set -eux
          echo "=== container landscape (diagnostic for the name filter) ==="
          docker ps -a --format '{{.ID}} {{.Image}} -> {{.Names}}'
-          PG=$(docker ps --filter "name=integration" --filter "ancestor=postgres:16-alpine" -q | head -n1)
-          test -n "$PG"
+          # Only THIS job's services. The runner's docker daemon is shared, so another
+          # repo's job can be running beside this one, and a job-name filter matches its
+          # containers too (Steward run 8358 and Inkwell run 8653 each took another repo's
+          # Postgres). act names every container of a task GITEA-ACTIONS-TASK-<n>-...: read
+          # <n> from our own container (its id is in the /etc/hostname bind mount) and
+          # require exactly one match.
+          SELF=$(grep -o '/containers/[0-9a-f]\{64\}/' /proc/self/mountinfo | head -n1 | cut -d/ -f3 || true)
+          SELF=${SELF:-$(hostname)}
+          TASK=$(docker inspect -f '{{.Name}}' "$SELF" | grep -o 'GITEA-ACTIONS-TASK-[0-9]*-')
+          test -n "$TASK"
+          PG=$(docker ps --filter "name=$TASK" --filter "ancestor=postgres:16-alpine" -q)
+          test "$(printf '%s\n' "$PG" | grep -c .)" -eq 1
          PG_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$PG")
          test -n "$PG_IP"
-          export THOUGHTSYNC_DATABASE_URL="postgresql+asyncpg://thoughtsync:ci_integration@${PG_IP}:5432/thoughtsync_test"
+          export INKWELL_DATABASE_URL="postgresql+asyncpg://inkwell:ci_integration@${PG_IP}:5432/inkwell_test"
          # Wait for Postgres to accept connections. `run:` is busybox sh (rule 81) —
          # no bash /dev/tcp — so use the Python that is always present here.
          /opt/venv/bin/python - "$PG_IP" <<'PY'
@@ -279,27 +304,35 @@ jobs:
      packages: write
    steps:
      - uses: actions/checkout@v6
+        with:
+          # Derives a version — see the note in desktop.yml. Depth-1 sees one commit
+          # and produces a too-low value silently, with the lane green (§6.1).
+          fetch-depth: 0

      - name: Generate image tags and version
        id: tags
        # run: steps execute under busybox sh (family rule 81), so use POSIX `case`,
        # NOT bash `[[ ]]`.
        run: |
-          TAGS="${{ env.IMAGE }}:${{ github.sha }}"
-          BUILD_VERSION="dev"
+          # The image's version is DERIVED from its own shipped files — including the
+          # Android client it bakes in, which is why an APK-only change re-versions
+          # it. One value and no ordering key: nothing compares a server image, so
+          # §2 says do not invent one just because the other artifacts have one.
+          #
+          # This was a short sha on main and the literal "dev" elsewhere, which could
+          # not answer "how old is this instance?" — the question that actually gets
+          # asked of a self-hosted app running in several places.
+          BUILD_VERSION="$(sh packaging/version.sh display server)"
          case "${{ github.ref }}" in
            refs/heads/dev)
-              TAGS="$TAGS,${{ env.IMAGE }}:dev"
+              TAGS="${{ env.IMAGE }}:dev"
              ;;
            refs/heads/main)
-              # Production line: :latest tracks main's tip (rule 46). No :main tag;
-              # the :<sha> above is the rollback unit. Version label = short sha.
-              TAGS="$TAGS,${{ env.IMAGE }}:latest"
-              BUILD_VERSION="$(echo ${{ github.sha }} | cut -c1-7)"
+              TAGS="${{ env.IMAGE }}:latest,${{ env.IMAGE }}:${{ github.sha }}"
              ;;
-            refs/tags/*)
-              TAGS="$TAGS,${{ env.IMAGE }}:latest,${{ env.IMAGE }}:${{ github.ref_name }}"
-              BUILD_VERSION="${{ github.ref_name }}"
+            *)
+              echo "::error::This lane builds images for dev and main only."
+              exit 1
              ;;
          esac
          echo "value=$TAGS" >> $GITHUB_OUTPUT
@@ -310,42 +343,41 @@ jobs:
          docker system prune -af || true
          docker builder prune --keep-storage 5g -f || true

-      # Bake the Android client in, on EVERY image build, so :dev, :latest and
-      # :<version> all carry one and a `docker compose pull` delivers a new client
-      # along with the new server.
+      # Bake EVERY client in, on every image build, so a self-hoster gets a working
+      # app for their machine from the server holding their notes — without an
+      # account on this forge, which is private (issue 2091) and is why serving them
+      # from a release page was never an option for anybody but the operator.
      #
-      # Always the rolling `dev` release — the newest build there is. A versioned
-      # image therefore carries the newest client rather than one pinned to that
-      # version; the two negotiate a sync protocol version before linking, so
-      # "newest" is safe in a way "matching" would not buy anything over.
+      # ~104 MB on top of the ~85 MB image, almost all of it the AppImage. That is
+      # the price of the product being complete (rule 23), and the AppImage is not
+      # optional within it: it is the ONLY bundle that can replace itself in place,
+      # so a server without one cannot serve in-app updates to anyone.
      #
-      # Fetched by the JOB, not by the Dockerfile: the release is private, and a
+      # Fetched by the JOB, not by the Dockerfile: the releases are private, and a
      # token used inside a build lands in the context or a layer.
      #
-      # NEVER fails the build. An image with no Android client advertises none and
-      # hides the download — a supported state, and the only one available before
-      # the first Android build has ever published.
-      - name: Fetch the Android client to bake in
+      # NEVER fails the build — see the script. A platform with nothing published
+      # means the server advertises nothing for it and the UI hides that download,
+      # which is a supported state and the only one available before that platform's
+      # first build has ever published.
+      - name: Fetch the clients to bake in
        env:
          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
        run: |
-          mkdir -p client
-          base="${{ github.server_url }}/${{ github.repository }}/releases/download/dev"
-          ok=1
-          for f in thoughtsync.apk thoughtsync-android.json; do
-            curl -fsSL -H "Authorization: token $GITHUB_TOKEN" -o "client/$f" "$base/$f" || ok=0
-          done
-          if [ "$ok" = 1 ]; then
-            echo "Baking in:"
-            cat client/thoughtsync-android.json
-            ls -l client/thoughtsync.apk
-          else
-            # Both or neither. Half a pair is worse than none: the server would
-            # read a sidecar describing an APK that isn't there, or an APK it
-            # cannot state a version for.
-            echo "::warning::No Android client on the dev release — this image ships without one."
-            rm -f client/thoughtsync.apk client/thoughtsync-android.json
-          fi
+          # THE CHANNEL IS A PROPERTY OF THE IMAGE. A :dev image serves dev clients;
+          # :latest serves stable ones. This read `download/dev` unconditionally
+          # until M314 step 3, on every branch — so every stable server shipped a
+          # dev-channel APK to anyone who downloaded the client from it. Not a
+          # versioning gap; a plain defect, and the reason the channel is chosen here
+          # rather than inside the script: the caller is what knows which image it is
+          # building.
+          case "${{ github.ref_name }}" in
+            main) channel=stable ;;
+            *)    channel=dev ;;
+          esac
+          sh packaging/fetch-clients.sh "$channel" client

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
@@ -16,33 +16,20 @@ name: Desktop (Tauri)

 on:
  push:
+    # NO `paths:` FILTER. It was a second, independent statement of this artifact's
+    # file set, hand-kept beside the one in `packaging/version.sh`, and it drifted
+    # from it within a day (85ead4d). The `decide` job below reads the real set and
+    # skips in seconds when nothing moved — one definition, one reader (§3).
+    #
+    # The cost is that this workflow starts on every push rather than on a matching
+    # one. That is a ~15s container for a decision, against a lane that cannot
+    # silently fail to run.
    branches: [dev, main]
-    tags: ["v*"]
-    paths:
-      - "desktop/**"
-      # The shared client core (store + sync engine) the desktop wraps. Its own
-      # crate since the Android client binds the same code, so a change there is a
-      # change to this app even though nothing under desktop/ moved.
-      - "core/**"
-      # The Android uniffi shim. It builds no desktop artifact, but it is a
-      # workspace member, so this lane's `cargo clippy --all-targets` is what
-      # compiles and lints it — and until the Android lane exists (M12 step 5),
-      # it is the ONLY thing that does.
-      - "android/**"
-      # The workspace manifest and lockfile, which now live at the repo root.
-      - "Cargo.toml"
-      - "Cargo.lock"
-      # The whole frontend, not just the adapter/bridge seam: it is compiled INTO
-      # the desktop binary, so any part of it changing means the shipped app is out
-      # of date. Config and lockfile included — a dependency bump changes the bundle
-      # as surely as a component does.
-      - "frontend/**"
-      - ".forgejo/workflows/desktop.yml"
  workflow_dispatch:

 concurrency:
  group: desktop-${{ github.ref }}
-  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}
+  cancel-in-progress: true

 permissions:
  # write (not read) so the tag build can publish a Release with the bundles
@@ -51,32 +38,85 @@ permissions:
  contents: write

 jobs:
-  build:
-    name: Tauri desktop (Linux)
-    if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
+  # Does anything need building at all?
+  #
+  # ONE reader of ONE definition — the file sets in `packaging/version.sh` — replacing
+  # the `paths:` filters that used to state the same fact a second time. They drifted
+  # from it within a day: `packaging/` was added to the sets and not to the filters,
+  # so the commit fixing a derivation bug never ran on the two lanes it fixed
+  # (85ead4d). Note 3127 §3 warns about exactly that duplication.
+  #
+  # THE GUARD RUNS HERE, so it runs on every path INCLUDING the skip one (§6.3).
+  # Skipping because "the channel already serves this version" is indistinguishable
+  # from "we derived a stale value that happens to match" unless something checks.
+  decide:
+    name: Build, or is the channel already serving this?
+    if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main'
+    runs-on: python-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-python:3.14
+    outputs:
+      build: ${{ steps.d.outputs.build }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          # Derives a version — depth-1 is silently wrong (§6.1).
+          fetch-depth: 0
+
+      - name: Decide
+        id: d
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          case "$GITHUB_REF_NAME" in
+            main) channel=stable ;;
+            *)    channel=dev ;;
+          esac
+          sh packaging/guard-forward.sh desktop "$channel"
+          echo "build=$(sh packaging/should-build.sh desktop "$channel")" >> $GITHUB_OUTPUT
+
+  # The workspace checks, in their OWN job, so that BOTH publishing jobs can need
+  # them (rule 177: nothing publishes on red).
+  #
+  # They used to be steps inside `build`, which gated the Linux publish and nothing
+  # else. `windows` needed only `decide`, so on run 8411 clippy failed, the Linux job
+  # stopped, and the Windows installer built and published to the dev release in the
+  # same minute (#5184). An edge from each publisher to this job is the gate; a
+  # verdict inside a sibling job is only a report.
+  #
+  # Both publishers need it directly rather than through each other, so a Windows
+  # failure still never blocks the Linux bundles, and neither waits on the other's
+  # bundling. No `always()` or `continue-on-error` anywhere on this path: a skipped
+  # or failed verify must leave both publishers skipped.
+  verify:
+    name: Web tests, clippy, Rust tests and rustfmt
+    needs: [decide]
+    timeout-minutes: 20
+    if: needs.decide.outputs.build == 'true'
    runs-on: python-ci
    container:
      image: git.fabledsword.com/bvandeusen/ci-tauri:1.97
-    env:
-      # AppImage tooling (linuxdeploy) FUSE-mounts itself by default; CI containers
-      # have no /dev/fuse, so tell it to extract-and-run instead. Without this the
-      # AppImage bundle step fails with a FUSE error.
-      APPIMAGE_EXTRACT_AND_RUN: "1"
    steps:
+      # No version is derived here, so the default shallow checkout is enough.
      - uses: actions/checkout@v6

      # tauri's generate_context! embeds the built frontend at compile time, so the
-      # frontend must exist before any cargo compile (clippy/test/build), not just
-      # at bundle time.
+      # frontend must exist before clippy or the tests can compile the desktop crate.
      - name: Build the shared frontend
        run: npm ci && npm run build
        working-directory: frontend

-      # --locked on the FIRST cargo invocation of the job is the lockfile gate: it
-      # fails the run if Cargo.toml and the committed Cargo.lock disagree, instead
-      # of silently re-resolving. Everything after it in this job then compiles the
-      # exact versions recorded in the lockfile, so the flag isn't repeated on the
-      # bundle build (issue 2102).
+      # The web's unit tests, HERE as well as in ci.yml. The installers embed this
+      # frontend, and ci.yml's verdict is invisible to this workflow — run there only,
+      # a red web test would still let both installers publish (rule 177).
+      - name: Web unit tests
+        run: npm test
+        working-directory: frontend
+
+      # --locked on the FIRST cargo invocation is the lockfile gate: it fails the
+      # run if Cargo.toml and the committed Cargo.lock disagree, instead of silently
+      # re-resolving (issue 2102). Both publishing jobs need this job, so neither
+      # bundles a commit whose lockfile drifted.
      #
      # Run from the REPO ROOT with --workspace, not from desktop/src-tauri.
      #
@@ -99,11 +139,45 @@ jobs:
      # but there is no Rust toolchain on the workstation (the desktop lane is
      # verified entirely here), so a formatting nit failing first SKIPS clippy and
      # the tests, and one CI cycle teaches nothing but whitespace. Running it here
-      # means every push reports its real problems too. Still before the ~20-40 min
-      # bundle build, so a fmt failure doesn't burn that.
+      # means every push reports its real problems too. Still before either bundle
+      # build, so a fmt failure doesn't burn one.
      - name: Rust format check
        run: cargo fmt --all --check

+  build:
+    name: Tauri desktop (Linux)
+    needs: [decide, verify]
+    # A deadline, not a budget: warm builds take ~4 minutes. Without one a hung step
+    # runs to the runner's own 30-minute cap, as run 8830 did on a rust-lld link whose
+    # threads had all deadlocked (#5409). Kept under that cap so this one is the limit
+    # that fires, whatever the runner is configured with.
+    timeout-minutes: 20
+    if: needs.decide.outputs.build == 'true'
+    runs-on: python-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-tauri:1.97
+    env:
+      # AppImage tooling (linuxdeploy) FUSE-mounts itself by default; CI containers
+      # have no /dev/fuse, so tell it to extract-and-run instead. Without this the
+      # AppImage bundle step fails with a FUSE error.
+      APPIMAGE_EXTRACT_AND_RUN: "1"
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          # DERIVES A VERSION -> needs the whole history. A depth-1 clone sees one
+          # commit and `git log -- <paths>` produces a too-LOW value, silently, with
+          # the lane green — note 3127 §6.1, and the direction you cannot recover
+          # from. `packaging/version.sh` fails loudly on an empty result rather than
+          # emitting something plausible, which is what turns this into a red lane
+          # if it is ever dropped.
+          fetch-depth: 0
+
+      # tauri's generate_context! embeds the built frontend at compile time, so the
+      # frontend must exist before cargo compiles anything, not just at bundle time.
+      - name: Build the shared frontend
+        run: npm ci && npm run build
+        working-directory: frontend
+
      # Frontend already built above; skip the beforeBuildCommand rebuild.
      #
      # createUpdaterArtifacts is applied only when a signing key exists (M10.9):
@@ -123,8 +197,20 @@ jobs:
          else
            echo "No TAURI_SIGNING_PRIVATE_KEY — building unsigned, no updater artifacts."
          fi
-          version="$(sh ../packaging/build-version.sh)"
-          echo "Building version $version"
+          # The ORDERING KEY, not the display version: this string is what Tauri's
+          # updater parses as semver, and what it stamps into bundle FILENAMES that
+          # `write-manifest.sh` then selects on. The human-readable version is a
+          # separate value and arrives with the UI that shows it (#3181).
+          version="$(sh ../../packaging/version.sh key desktop)"
+          echo "Building desktop ordering key $version"
+          # The DISPLAY version, baked into the binary by `option_env!` (#3181).
+          # A different value for a different audience: this is the one a person
+          # quotes in a bug report, the key above is the one only a comparator
+          # sees. Exported rather than passed as a flag because the macro that
+          # reads it is in Rust source, not in Tauri's config.
+          INKWELL_DISPLAY_VERSION="$(sh ../../packaging/version.sh display desktop)"
+          export INKWELL_DISPLAY_VERSION
+          echo "Baking display version $INKWELL_DISPLAY_VERSION"
          cargo tauri build \
            --config '{"build":{"beforeBuildCommand":""}}' \
            --config "{\"version\":\"$version\"}" \
@@ -185,18 +271,17 @@ jobs:
        run: bash desktop/packaging/arch/package-prebuilt.sh

      # Make the built .deb + .AppImage downloadable from the run (for hand-testing).
-      # Mirrored action, never actions/upload-artifact: @v4+ throws
-      # GHESNotSupportedError on the hostname before it connects, and @v3 uploads
+      # Stock action: it works on this forge since the runner moved to
+      # gitea/runner 3.x, which edits upload-artifact's client-side GHES refusal
+      # out of the action bundle (Scribe snippet #2271). Never @v3 — it uploads
      # something Gitea stores but will never serve back (it returns artifacts only
      # through the v4 API, which filters on content_encoding='application/zip').
-      # Pinned by SHA — the mirror auto-syncs, so a moved upstream tag would
-      # silently change what runs. See Scribe issues 2255 / 2270.
      # No continue-on-error: a swallowed upload failure is exactly how 110
      # unreachable artifacts accumulated here unnoticed. Fail loudly instead.
      - name: Upload bundles
-        uses: https://git.fabledsword.com/bvandeusen/upload-artifact@cb8afe72b42edc798abfb8fcb556cf660d894245
+        uses: actions/upload-artifact@v7
        with:
-          name: thoughtsync-linux
+          name: inkwell-linux
          path: |
            target/release/bundle/appimage/*.AppImage
            target/release/bundle/deb/*.deb
@@ -205,37 +290,43 @@ jobs:
          # failure, not as a green run with an empty artifact.
          if-no-files-found: error

-      # Tag builds only: publish a real, versioned Fabled-Git Release with the
-      # AppImage + .deb attached — the stable fetch target the install script and
-      # the in-app updater consume (Actions artifacts above are ephemeral/test).
-      # Cutting the tag is the operator's action (rule 2); this only publishes a
-      # Release for a tag that already exists. Dormant on dev/main pushes.
-      - name: Publish release
-        if: startsWith(github.ref, 'refs/tags/v')
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: bash desktop/packaging/publish-release.sh
-
-      # The rolling DEVELOPMENT channel (M10.9): a release whose tag never moves, so
-      # the updater has a permanent URL to read — Forgejo has no
-      # /releases/latest/download/<asset> route, so "newest" can't be named in a URL.
+      # The rolling channel for this branch: `dev` from dev, `stable` from main. Both
+      # are releases whose tag never moves, so the updater has a permanent URL to
+      # read — Forgejo has no /releases/latest/download/<asset> route, so "newest"
+      # cannot be named in a URL.
+      #
+      # MAIN PUBLISHING HERE is what makes a `v*` tag optional (note 3127 §0). Until
+      # M314 step 3 this job built on main and published nothing, so the stable
+      # channel moved only when somebody cut a tag — that section's diagnostic
+      # failing outright: main publishing was not sufficient for a user to receive
+      # the build.
      #
      # Gated on the signing key INSIDE the script rather than with an `if:`, because
      # the secrets context isn't reliably available to step conditions. Publishing
      # bundles the app would then refuse to verify is worse than publishing nothing:
      # it looks like a working feed.
-      - name: Publish to the dev channel
-        if: github.ref == 'refs/heads/dev'
+      - name: Publish to the channel for this branch
+        if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main'
        env:
          GITHUB_TOKEN: ${{ github.token }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          RELEASE_TAG: dev
-          RELEASE_PRERELEASE: "true"
        run: |
          if [ -z "${TAURI_SIGNING_PRIVATE_KEY:-}" ]; then
-            echo "No TAURI_SIGNING_PRIVATE_KEY — skipping the dev channel publish."
+            echo "No TAURI_SIGNING_PRIVATE_KEY — skipping the channel publish."
            exit 0
          fi
+          # POSIX `case`, not bash `[[ ]]` — these run under busybox sh (rule 81).
+          # `prerelease` is true for dev so it does not read as a supported build,
+          # and false for stable, which is the real thing.
+          case "$GITHUB_REF_NAME" in
+            main) channel=stable; RELEASE_PRERELEASE=false ;;
+            *)    channel=dev;    RELEASE_PRERELEASE=true  ;;
+          esac
+          # The channel's release TAG, not its name: `dev` publishes on `dev-rolling`
+          # (packaging/channel-tag.sh). A tag named `dev` shadowed the branch.
+          RELEASE_TAG="$(sh packaging/channel-tag.sh "$channel")"
+          export RELEASE_TAG RELEASE_PRERELEASE
+          echo "Publishing to the $RELEASE_TAG channel."
          bash desktop/packaging/publish-release.sh

  # Windows installer, CROSS-COMPILED from Linux — there is no Windows build host.
@@ -253,12 +344,22 @@ jobs:
  # built, not that it runs. A real-machine check stays mandatory before trusting it.
  windows:
    name: Windows installer (cross-compiled)
-    if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
+    needs: [decide, verify]
+    timeout-minutes: 20
+    if: needs.decide.outputs.build == 'true'
    runs-on: python-ci
    container:
      image: git.fabledsword.com/bvandeusen/ci-tauri-win:1.97
    steps:
      - uses: actions/checkout@v6
+        with:
+          # DERIVES A VERSION -> needs the whole history. A depth-1 clone sees one
+          # commit and `git log -- <paths>` produces a too-LOW value, silently, with
+          # the lane green — note 3127 §6.1, and the direction you cannot recover
+          # from. `packaging/version.sh` fails loudly on an empty result rather than
+          # emitting something plausible, which is what turns this into a red lane
+          # if it is ever dropped.
+          fetch-depth: 0

      # Same reason as the Linux job: generate_context! embeds the built frontend
      # at compile time, so it must exist before cargo runs.
@@ -275,8 +376,8 @@ jobs:
        run: cargo tauri icon app-icon.png
        working-directory: desktop/src-tauri

-      # This lane's lockfile gate (the Linux job gets it from `cargo clippy
-      # --locked`). It has to be its own step here because the build is this job's
+      # This lane's own lockfile check (`verify` has already run `cargo clippy
+      # --locked` for the workspace). It has to be its own step here because the build is this job's
      # only crate-graph command, and discovering the drift 30 minutes into a
      # cross-compile is the expensive way to learn it. Fetching for the Windows
      # target also pre-warms exactly the crates the build will want.
@@ -292,8 +393,20 @@ jobs:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
-          version="$(sh ../packaging/build-version.sh)"
-          echo "Building version $version"
+          # The ORDERING KEY, not the display version: this string is what Tauri's
+          # updater parses as semver, and what it stamps into bundle FILENAMES that
+          # `write-manifest.sh` then selects on. The human-readable version is a
+          # separate value and arrives with the UI that shows it (#3181).
+          version="$(sh ../../packaging/version.sh key desktop)"
+          echo "Building desktop ordering key $version"
+          # The DISPLAY version, baked into the binary by `option_env!` (#3181).
+          # A different value for a different audience: this is the one a person
+          # quotes in a bug report, the key above is the one only a comparator
+          # sees. Exported rather than passed as a flag because the macro that
+          # reads it is in Rust source, not in Tauri's config.
+          INKWELL_DISPLAY_VERSION="$(sh ../../packaging/version.sh display desktop)"
+          export INKWELL_DISPLAY_VERSION
+          echo "Baking display version $INKWELL_DISPLAY_VERSION"
          updater='{}'
          if [ -n "${TAURI_SIGNING_PRIVATE_KEY:-}" ]; then
            updater='{"bundle":{"createUpdaterArtifacts":true}}'
@@ -307,45 +420,51 @@ jobs:
            --config "$updater"
        working-directory: desktop/src-tauri

-      # Mirrored action, never actions/upload-artifact — see the Linux job's
-      # Upload bundles step for the full reasoning. Pinned by SHA because the
-      # mirror auto-syncs.
+      # Stock action — see the Linux job's Upload bundles step for why.
      - name: Upload installer
-        uses: https://git.fabledsword.com/bvandeusen/upload-artifact@cb8afe72b42edc798abfb8fcb556cf660d894245
+        uses: actions/upload-artifact@v7
        with:
-          name: thoughtsync-windows
+          name: inkwell-windows
          path: target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe
          if-no-files-found: error

-      # Publishes to the SAME release as the Linux job. Safe to run twice: the
-      # script reuses an existing release (409) and nullglob means each job uploads
-      # only the bundles present in its own workspace.
-      - name: Publish release
-        if: startsWith(github.ref, 'refs/tags/v')
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: bash desktop/packaging/publish-release.sh
-
-      # The rolling DEVELOPMENT channel (M10.9): a release whose tag never moves, so
-      # the updater has a permanent URL to read — Forgejo has no
-      # /releases/latest/download/<asset> route, so "newest" can't be named in a URL.
+      # The rolling channel for this branch: `dev` from dev, `stable` from main. Both
+      # are releases whose tag never moves, so the updater has a permanent URL to
+      # read — Forgejo has no /releases/latest/download/<asset> route, so "newest"
+      # cannot be named in a URL.
+      #
+      # MAIN PUBLISHING HERE is what makes a `v*` tag optional (note 3127 §0). Until
+      # M314 step 3 this job built on main and published nothing, so the stable
+      # channel moved only when somebody cut a tag — that section's diagnostic
+      # failing outright: main publishing was not sufficient for a user to receive
+      # the build.
      #
      # Gated on the signing key INSIDE the script rather than with an `if:`, because
      # the secrets context isn't reliably available to step conditions. Publishing
      # bundles the app would then refuse to verify is worse than publishing nothing:
      # it looks like a working feed.
-      - name: Publish to the dev channel
-        if: github.ref == 'refs/heads/dev'
+      - name: Publish to the channel for this branch
+        if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main'
        env:
          GITHUB_TOKEN: ${{ github.token }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          RELEASE_TAG: dev
-          RELEASE_PRERELEASE: "true"
        run: |
          if [ -z "${TAURI_SIGNING_PRIVATE_KEY:-}" ]; then
-            echo "No TAURI_SIGNING_PRIVATE_KEY — skipping the dev channel publish."
+            echo "No TAURI_SIGNING_PRIVATE_KEY — skipping the channel publish."
            exit 0
          fi
+          # POSIX `case`, not bash `[[ ]]` — these run under busybox sh (rule 81).
+          # `prerelease` is true for dev so it does not read as a supported build,
+          # and false for stable, which is the real thing.
+          case "$GITHUB_REF_NAME" in
+            main) channel=stable; RELEASE_PRERELEASE=false ;;
+            *)    channel=dev;    RELEASE_PRERELEASE=true  ;;
+          esac
+          # The channel's release TAG, not its name: `dev` publishes on `dev-rolling`
+          # (packaging/channel-tag.sh). A tag named `dev` shadowed the branch.
+          RELEASE_TAG="$(sh packaging/channel-tag.sh "$channel")"
+          export RELEASE_TAG RELEASE_PRERELEASE
+          echo "Publishing to the $RELEASE_TAG channel."
          bash desktop/packaging/publish-release.sh

  # The updater manifest, written AFTER both bundle jobs — they run in separate
@@ -359,12 +478,21 @@ jobs:
  manifest:
    name: Update manifest
    needs: [build, windows]
-    if: github.ref == 'refs/heads/dev' || startsWith(github.ref, 'refs/tags/v')
+    timeout-minutes: 5
+    if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main'
    runs-on: python-ci
    container:
      image: git.fabledsword.com/bvandeusen/ci-tauri:1.97
    steps:
      - uses: actions/checkout@v6
+        with:
+          # DERIVES A VERSION -> needs the whole history. A depth-1 clone sees one
+          # commit and `git log -- <paths>` produces a too-LOW value, silently, with
+          # the lane green — note 3127 §6.1, and the direction you cannot recover
+          # from. `packaging/version.sh` fails loudly on an empty result rather than
+          # emitting something plausible, which is what turns this into a red lane
+          # if it is ever dropped.
+          fetch-depth: 0

      - name: Write and publish latest.json
        env:
@@ -376,23 +504,32 @@ jobs:
            echo "manifest to write. Add the secret to enable in-app updates."
            exit 0
          fi
-          # The SAME helper the bundles were built with — a second derivation here
-          # could drift, and a manifest whose version doesn't match the binary it
-          # points at is an updater that never settles.
-          version="$(sh desktop/packaging/build-version.sh)"
-          if [ "${GITHUB_REF_NAME}" = "dev" ]; then
-            export RELEASE_TAG=dev
-            export RELEASE_NOTES="Development build from ${GITHUB_SHA}"
-            # Rolling channel: drop the previous build's bundles once the manifest
-            # points at this one. Nothing can reach them, and they're ~100 MB a push.
-            export PRUNE_OLD_ASSETS=true
-            APP_VERSION="$version" bash desktop/packaging/write-manifest.sh
-          else
-            export RELEASE_TAG="${GITHUB_REF_NAME}"
-            export RELEASE_NOTES="ThoughtSync ${GITHUB_REF_NAME}"
-            # Twice: once onto the versioned release itself, and once onto the
-            # permanent `stable` pointer the app actually reads. Same manifest both
-            # times — its URLs point at the versioned assets either way.
-            APP_VERSION="$version" bash desktop/packaging/write-manifest.sh
-            APP_VERSION="$version" MANIFEST_TAG=stable bash desktop/packaging/write-manifest.sh
-          fi
+          # The SAME helper AND the same request the bundles were built with — a
+          # second derivation here could drift, and a manifest whose version doesn't
+          # match the binary it points at is an updater that never settles. It must
+          # be `key`: this value is matched against bundle filenames.
+          version="$(sh packaging/version.sh key desktop)"
+          # The version a PERSON reads, published beside the manifest as
+          # `inkwell-desktop.json`. The image build reads it to describe the
+          # bundles it bakes in (packaging/fetch-clients.sh) without re-deriving
+          # anything from its own checkout — which would be a different commit
+          # whenever the desktop did not rebuild.
+          display="$(sh packaging/version.sh display desktop)"
+          # Both channels are rolling: the manifest lands on the same release that
+          # holds the bundles, and the previous build's bundles are dropped once it
+          # points at this one. Nothing can reach them, and they are ~100 MB a push.
+          #
+          # No tag arm any more. A `v*` tag does not reach this workflow at all — it
+          # triggers release.yml, which writes a changelog and builds nothing.
+          case "${GITHUB_REF_NAME}" in
+            main) RELEASE_TAG="$(sh packaging/channel-tag.sh stable)"
+                  export RELEASE_NOTES="Stable build from ${GITHUB_SHA}" ;;
+            *)    RELEASE_TAG="$(sh packaging/channel-tag.sh dev)"
+                  export RELEASE_NOTES="Development build from ${GITHUB_SHA}" ;;
+          esac
+          # Assigned bare above so a failing channel-tag.sh fails this step;
+          # `export X="$(...)"` would swallow its exit status.
+          export RELEASE_TAG
+          export PRUNE_OLD_ASSETS=true
+          APP_VERSION="$version" DISPLAY_VERSION="$display" \
+            bash desktop/packaging/write-manifest.sh
@@ -0,0 +1,68 @@
+name: Release
+
+# A RELEASE BUILDS NOTHING. That is the whole point of this lane (M314 step 7).
+#
+# The merge to `main` already published everything a user can receive: the server
+# image as `:latest` + `:<sha>`, the desktop bundles and the APK to the `stable`
+# channel, and the updater manifest that advertises them. A tag rebuilding that same
+# source would produce identical artifacts under identical names, and would re-push
+# `:<sha>` with different bytes — which rule 145 forbids even when they match.
+#
+# So the tag is a BOOKMARK, and this lane gives it the only job it has left: saying
+# what was in it. Note 3127 §5 — there are two halves to "what am I running", and
+# the version answers only the first:
+#
+#   which build is this?          the footer, /api/config, the APK's versionName
+#   what changed since the one    ← this
+#     I was running last month?
+#
+# Cutting the tag is the operator's act (rule 2). This only responds to one.
+#
+# THE TAG IS NOT AN IMAGE TAG and never becomes one. `ci.yml` does not trigger on
+# tags at all. The image is addressed by channel or by commit; the release by date.
+# Same string as the artifact version (rule 148, `vYYYY.MM.DD.HHMM`), different
+# system.
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+
+jobs:
+  notes:
+    name: Write the changelog
+    runs-on: python-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-python:3.14
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          # The whole history AND every tag: the notes are the commit range between
+          # this tag and the previous `v*` one, and neither end exists in a shallow
+          # clone. A depth-limited checkout here does not fail — it produces a
+          # shorter changelog, which is the kind of wrong nobody notices.
+          fetch-depth: 0
+
+      - name: Publish the release notes
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          notes="$(sh packaging/release-notes.sh "$GITHUB_REF_NAME")"
+          echo "$notes"
+          echo "---"
+
+          # JSON-escaped HERE rather than in publish-release.sh, which cannot assume
+          # python3 is on PATH in the three images that call it. `json.dumps` then
+          # strip the surrounding quotes — the script supplies those.
+          RELEASE_BODY_JSON="$(printf '%s' "$notes" \
+            | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read())[1:-1])')"
+          export RELEASE_BODY_JSON
+
+          # Through publish-release.sh for its create-or-PATCH-on-409 path: a
+          # release that is only ever POSTed keeps whatever body its first run
+          # wrote (#2182), so re-tagging or re-running must rewrite it. No bundles
+          # exist in this workspace, so its asset globs match nothing and it
+          # uploads none — which is the intended behaviour, not a side effect.
+          RELEASE_TAG="$GITHUB_REF_NAME" bash desktop/packaging/publish-release.sh
@@ -209,5 +209,5 @@ android/local.properties
 # The Android client CI bakes into the server image. Fetched fresh on every image
 # build, so it is never worth 55 MiB of git history. client/.keep IS tracked, so
 # the Dockerfile's COPY always has a directory to copy.
-client/thoughtsync.apk
-client/thoughtsync-android.json
+client/inkwell.apk
+client/inkwell-android.json
@@ -20,22 +20,33 @@ RUN --mount=type=cache,target=/root/.cache/pip \
 # Bake the built SPA into the package's static dir (served by app.py). PYTHONPATH
 # points at /app/src so the runtime imports this source tree (with static/ present),
 # not the pip-installed copy.
-COPY --from=build-frontend /build/dist/ src/thoughtsync/static/
+COPY --from=build-frontend /build/dist/ src/inkwell/static/
 COPY alembic.ini .
 COPY alembic/ alembic/

-# The Android client this server hands out. CI fetches the newest published build
-# into ./client immediately before this runs (ci.yml), so every image tag — :dev,
-# :latest and :<version> alike — ships a client, and a `docker compose pull`
-# delivers a new one with no file copying by hand.
+# The clients this server hands out — the APK and all four desktop bundles. CI
+# fetches the newest published build of each into ./client immediately before this
+# runs (packaging/fetch-clients.sh), so both image tags ship a full set and a
+# `docker compose pull` delivers new ones with no file copying by hand.
 #
-# Fetched by the JOB rather than here on purpose: the release is private, and a
+# ~104 MB of this image is that set, almost all of it the AppImage.
+#
+# Fetched by the JOB rather than here on purpose: the releases are private, and a
 # token used inside a build ends up in the build context or a layer.
 #
+# LAST of the COPYs, deliberately: this directory changes on every build, so
+# putting it above the `pip install` layer would invalidate that layer every time.
+#
 # The directory is tracked (client/.keep) so this COPY cannot fail on a tree where
-# that step never ran. An image with no APK is a supported state — the server
-# advertises nothing and the web UI hides the download (client_dist.py).
-COPY client/ src/thoughtsync/client/
+# that step never ran. An image with no clients — or with some and not others — is
+# a supported state: the server advertises what it has and the web UI hides the
+# rest (client_dist.py).
+COPY client/ src/inkwell/client/
+
+# The desktop installer, served at /install.sh with this server's own address
+# written into it (installer.py). The SAME script the forge serves raw, copied rather
+# than moved so the operator's documented forge URL keeps working.
+COPY desktop/packaging/install.sh src/inkwell/install.sh

 ENV PYTHONPATH=/app/src

@@ -46,4 +57,16 @@ EXPOSE 5000
 # Wait for the database, run migrations, then serve. The DB wait keeps a briefly
 # slow/unready database from crash-looping the container. Family convention
 # (rule 82): schema is built by real migrations, never metadata.create_all.
-CMD ["sh", "-c", "python -m thoughtsync.dbwait && alembic upgrade head && hypercorn 'thoughtsync.app:create_app()' --bind 0.0.0.0:5000 --keep-alive 600"]
+#
+# Timeouts (family idea #5105, practice 9; read from hypercorn 0.18's source):
+# - `--keep-alive 120` is the idle timeout. It is also the header timeout:
+#   hypercorn marks a connection busy only once a whole request has arrived, so a
+#   client dribbling headers is still "idle" and is cut off at this. It was 600,
+#   ten minutes per held connection. 120 stays above Traefik's 90s idle timeout
+#   for backend connections, so the proxy never reuses one this server has just
+#   closed (a 502).
+# - No `--read-timeout`, on purpose. It bounds every socket read, including the
+#   whole time a download is streaming and the client sends nothing, so it would
+#   cut off an APK fetched slowly over mobile data. Bodies are capped instead
+#   (MAX_CONTENT_LENGTH in app.py).
+CMD ["sh", "-c", "python -m inkwell.dbwait && alembic upgrade head && hypercorn 'inkwell.app:create_app()' --bind 0.0.0.0:5000 --keep-alive 120"]
@@ -1,4 +1,4 @@
-# ThoughtSync
+# Inkwell

 Self-hosted personal thought-capture web app in the **FabledSword** family — a
 Google-Keep-style **masonry post-it board** for capturing disparate thoughts in
@@ -13,7 +13,7 @@ under a second, designed to grow into a lightweight second brain (labels, search
 ## Layout

 ```
-src/thoughtsync/     Quart app (app factory, auth, models, ACL, config, db)
+src/inkwell/         Quart app (app factory, auth, models, ACL, config, db)
 alembic/             async migrations (schema built via `alembic upgrade head`)
 tests/               DB-free unit tests (pytest)
 frontend/            Vue 3 + Vite + TypeScript + Tailwind SPA
@@ -23,12 +23,12 @@ docker-compose.yml   local app + Postgres stack

 ## Development

-Backend (needs a Postgres reachable at `THOUGHTSYNC_DATABASE_URL`):
+Backend (needs a Postgres reachable at `INKWELL_DATABASE_URL`):

 ```sh
 pip install -e ".[dev]"
 alembic upgrade head
-hypercorn 'thoughtsync.app:create_app()' --bind 0.0.0.0:5000
+hypercorn 'inkwell.app:create_app()' --bind 0.0.0.0:5000
 ```

 Frontend (proxies `/api` to `:5000`):
@@ -64,49 +64,51 @@ services:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
-      POSTGRES_USER: thoughtsync
+      POSTGRES_USER: inkwell
      POSTGRES_PASSWORD: CHANGE_ME          # change this
-      POSTGRES_DB: thoughtsync
+      POSTGRES_DB: inkwell
    volumes:
-      - thoughtsync-db:/var/lib/postgresql/data
+      - inkwell-db:/var/lib/postgresql/data
    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U thoughtsync"]
+      test: ["CMD-SHELL", "pg_isready -U inkwell"]
      interval: 5s
      timeout: 5s
      retries: 10

  app:
-    image: git.fabledsword.com/bvandeusen/thoughtsync:latest   # :dev for the current dev build
+    image: git.fabledsword.com/bvandeusen/inkwell:latest   # :dev for the current dev build
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
-      THOUGHTSYNC_DATABASE_URL: postgresql+asyncpg://thoughtsync:CHANGE_ME@db:5432/thoughtsync
+      INKWELL_DATABASE_URL: postgresql+asyncpg://inkwell:CHANGE_ME@db:5432/inkwell
    volumes:
-      - thoughtsync-data:/var/thoughtsync   # uploaded images; omit if you don't use attachments
+      - inkwell-data:/var/inkwell   # uploaded images; omit if you don't use attachments
    ports:
      - "5000:5000"

 volumes:
-  thoughtsync-db:
-  thoughtsync-data:
+  inkwell-db:
+  inkwell-data:
 ```

 Then open `http://<host>:5000` and register — **the first account becomes the admin**.

- **Only `THOUGHTSYNC_DATABASE_URL` is required.** `THOUGHTSYNC_SECRET_KEY` is optional; if
+- **Only `INKWELL_DATABASE_URL` is required.** `INKWELL_SECRET_KEY` is optional; if
  unset, a signing key is generated and persisted in the database (sessions survive restarts).
- Uploaded images live under the `thoughtsync-data` volume at `/var/thoughtsync`.
+- Uploaded images live under the `inkwell-data` volume at `/var/inkwell`.
 - The app waits for the database and runs migrations (`alembic upgrade head`) automatically on start.
- **Image tags:** `:latest` (stable, built from `main`) · `:dev` (latest `dev` build) ·
-  `:<git-sha>` (immutable, for pinning / rollback).
+- **Image tags:** `:latest` (stable, built from `main`) · `:dev` (latest `dev`
+  build) · `:<git-sha>` on `main` only (immutable, the rollback unit). There are
+  no version-shaped tags: nothing pins one, and the build reports its own version
+  at `/api/config` and `/health`.
 - **Putting it on the public internet:** there are four things to do first — close
  registration, terminate TLS and forward `X-Forwarded-Proto`, stop publishing the app
  port, and back up the attachment volume as well as the database. See
  [docs/public-hosting.md](docs/public-hosting.md), which also lists what the app
  hardens on its own and what it deliberately doesn't.
- **Install as an app (PWA):** ThoughtSync is installable ("Add to Home Screen" / the
+- **Install as an app (PWA):** Inkwell is installable ("Add to Home Screen" / the
  browser's install button) for an app-like window. Browsers only offer install over a
  **secure context**, so put the app behind a reverse proxy terminating **HTTPS** (or reach
  it via `localhost`) — plain `http://<host>:5000` won't show the install prompt.
@@ -1,12 +1,12 @@
-# Alembic single-database async configuration for ThoughtSync.
+# Alembic single-database async configuration for Inkwell.

 [alembic]
 script_location = %(here)s/alembic
 prepend_sys_path = . src
 path_separator = os

-# Local-dev default; overridden at runtime by THOUGHTSYNC_DATABASE_URL (see env.py).
-sqlalchemy.url = postgresql+asyncpg://thoughtsync:thoughtsync@localhost:5432/thoughtsync
+# Local-dev default; overridden at runtime by INKWELL_DATABASE_URL (see env.py).
+sqlalchemy.url = postgresql+asyncpg://inkwell:inkwell@localhost:5432/inkwell


 [loggers]
@@ -8,8 +8,8 @@ from sqlalchemy.ext.asyncio import async_engine_from_config

 from alembic import context

-from thoughtsync.models import Base
-import thoughtsync.models.all  # noqa: F401  — registers every model on Base.metadata
+from inkwell.models import Base
+import inkwell.models.all  # noqa: F401  — registers every model on Base.metadata

 config = context.config

@@ -18,7 +18,7 @@ if config.config_file_name is not None:

 config.set_main_option(
    "sqlalchemy.url",
-    os.environ.get("THOUGHTSYNC_DATABASE_URL", config.get_main_option("sqlalchemy.url")),
+    os.environ.get("INKWELL_DATABASE_URL", config.get_main_option("sqlalchemy.url")),
 )

 target_metadata = Base.metadata
@@ -0,0 +1,168 @@
+"""lift standalone #tags out of note bodies
+
+Revision ID: 0028
+Revises: 0027
+Create Date: 2026-08-26
+
+M311. A `#tag` was being shown twice — once as the text you typed and once as a chip —
+and with the chip moved to the top of the card the text is redundant. This removes it,
+but only from notes where the tag was standing on its own.
+
+## This migration rewrites note bodies
+
+The rule is deliberately narrow, and the same one `notes/tags.py:split_body_tags`
+applies from here on:
+
+  * A line containing nothing but tags and whitespace is REMOVED.
+  * Every other line is left exactly as written.
+
+So `#todo` on its own line goes, and `remember to call #mom tomorrow` does not. The
+looser reading — also stripping a trailing tag off a prose line — was rejected because
+the text does not say which kind it is: `buy milk #grocery` is filing, `remember to
+call #mom` is the sentence's object, and lifting the second leaves "remember to call".
+Rewriting somebody's words to save a duplicate chip is a bad trade, and a migration is
+the worst possible place to make it.
+
+Two guards, both of which cost a note nothing:
+
+  * A line inside a ``` fence is never touched. A `#tag` there is a shell comment in a
+    snippet somebody pasted, and deleting it would eat a line of their example.
+  * A note that is NOTHING but tags keeps its text. Lifting would leave a blank card,
+    which is worse than the duplication this fixes.
+
+## The label rows have to graduate in the same transaction
+
+A `via_tag` row means "this label is backed by text still in the body". Once the text
+is gone that is false, and leaving it true is not cosmetic: `_lift_and_reconcile_tags`
+detaches any `via_tag` row it cannot find a `#tag` for, so the note would lose the tag
+on its very next save. The flip to `via_tag = false` is what makes the label the record
+instead — and what makes the chip's × appear in both editors, which is now the only way
+to remove a tag whose text no longer exists.
+
+## The transform is inlined, like 0027's
+
+`split_body_tags` is deliberately NOT imported. A migration has to keep producing what
+it produced the day it ran; if the app's rule is ever loosened, this file must not
+loosen with it and start eating prose it previously left alone.
+
+`_display_title` is inlined for the same reason, and is only recomputed for a note whose
+body actually moved — a note named after a `#todo` line needs a new name, and reading it
+from the app would couple this migration to a rule that has already changed once (M13).
+
+## `updated_at` is left alone, and that is load-bearing
+
+Raw SQL, so SQLAlchemy's `onupdate` never fires. A client holding an UNPUSHED body edit
+keeps the newer `updated_at`, so when it pulls the migrated note last-write-wins keeps
+its edit instead of the migration silently winning.
+
+The `sync_revision` trigger (migration 0015) does fire, so every rewritten note becomes
+pullable once and clients converge on the server's text. That is wanted here: unlike
+0027, the clients do NOT yet apply this rule locally, so the server's copy is the only
+correct one until they do.
+
+## The downgrade is not a true inverse, and says so
+
+It cannot be. Nothing distinguishes a `#todo` line this migration deleted from one that
+was never there, and putting one back would be guessing at where in the note it went.
+
+Nothing is lost, though, which is why that is acceptable: the tag still exists as a
+label on the note, and the chip still shows it. What a downgrade cannot restore is the
+DUPLICATE — which is the thing this migration set out to remove. Rolling the rows back
+to `via_tag = true` would be actively harmful: the text that flag claims to be backed by
+is gone, so the next save would detach the label and lose the tag for real. So the
+downgrade leaves both alone. The real rollback is a database restore.
+"""
+import re
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "0028"
+down_revision = "0027"
+branch_labels = None
+depends_on = None
+
+# Frozen copies. See "The transform is inlined" above — these must not follow the app.
+_TAG_RE = re.compile(r"(?:^|(?<=\s))#(\w[\w-]*)")
+_FENCE_RE = re.compile(r"^\s*(?:```|~~~)")
+_TASK_RE = re.compile(r"^(?P<indent>\s*)(?P<bullet>[-*]) +\[(?P<mark>[ xX])\](?: +(?P<text>.*))?$")
+_DISPLAY_TITLE_CAP = 200
+
+
+def _is_tag(name: str) -> bool:
+    """A tag must contain a letter, so #2024 and #_ are not tags — and a line holding
+    only those is therefore not a tag-only line and is left alone."""
+    return any(c.isalpha() for c in name)
+
+
+def _split(body: str) -> tuple[list[str], str]:
+    """(standalone tag names, body with their lines removed)."""
+    standalone: list[str] = []
+    kept: list[str] = []
+    in_fence = False
+    for line in body.split("\n"):
+        if _FENCE_RE.match(line):
+            in_fence = not in_fence
+            kept.append(line)
+            continue
+        matches = [m for m in _TAG_RE.finditer(line) if _is_tag(m.group(1))]
+        remainder = line
+        for m in reversed(matches):
+            remainder = remainder[: m.start()] + remainder[m.end() :]
+        if in_fence or not matches or remainder.strip():
+            kept.append(line)
+        else:
+            standalone.extend(m.group(1) for m in matches)
+    lifted = re.sub(r"\n{3,}", "\n\n", "\n".join(kept)).strip("\n")
+    if body.strip() and not lifted.strip():
+        return [], body  # nothing but tags: keep the note readable
+    # A tag still written in prose somewhere keeps its text, so it stays derived.
+    still_in_prose = {m.group(1).lower() for m in _TAG_RE.finditer(lifted) if _is_tag(m.group(1))}
+    return [n for n in standalone if n.lower() not in still_in_prose], lifted
+
+
+def _display_title(body: str) -> str:
+    for line in body.splitlines():
+        stripped = line.strip()
+        match = _TASK_RE.match(stripped)
+        text = (match.group("text") or "") if match else stripped
+        text = text.strip()
+        if text:
+            return text[:_DISPLAY_TITLE_CAP]
+    return ""
+
+
+def upgrade():
+    bind = op.get_bind()
+    rows = bind.execute(sa.text("SELECT id, body FROM notes WHERE body LIKE '%#%'")).fetchall()
+
+    flip = sa.text(
+        "UPDATE note_labels nl SET via_tag = false "
+        "FROM labels l "
+        "WHERE nl.label_id = l.id AND nl.note_id = :nid AND nl.via_tag = true "
+        "AND lower(l.name) IN :names"
+    ).bindparams(sa.bindparam("names", expanding=True))
+
+    for note_id, body in rows:
+        if not body:
+            continue
+        standalone, lifted = _split(body)
+        if lifted != body:
+            bind.execute(
+                sa.text("UPDATE notes SET body = :body, display_title = :title WHERE id = :id"),
+                {"body": lifted, "title": _display_title(lifted), "id": note_id},
+            )
+        # Even when the body did not move, a tag can be standalone only in the sense
+        # that its line was already removed by an earlier pass — so the flip is driven
+        # by the tag list, not by whether the text changed.
+        if standalone:
+            bind.execute(flip, {"nid": note_id, "names": [n.lower() for n in standalone]})
+
+
+def downgrade():
+    """Deliberately empty — see the module docstring.
+
+    Restoring the deleted lines would be guessing, and flipping the rows back to
+    `via_tag = true` would be worse than doing nothing: the text that flag claims backs
+    them is gone, so the next save would detach the label and lose the tag for real.
+    """
@@ -0,0 +1,93 @@
+"""drop notes.color — a card is one neutral surface, colour lives on the tag
+
+Revision ID: 0029
+Revises: 0028
+Create Date: 2026-08-28
+
+M315 step 3. A note's colour was set by a picker and read by three card renderers.
+Steps 1 and 2 stopped every one of those reads: the card is one neutral per theme and
+the only coloured thing on a board is a tag. This drops the column that nothing has
+been reading since, and the picker goes with it.
+
+`labels.color` is untouched. That is the colour that survived, and the one the whole
+milestone was about keeping.
+
+## What is lost, and why that is the change rather than a cost of it
+
+Any colour a note was explicitly given. There is nowhere to preserve it TO — the field
+it would be preserved in is the one being dropped — and nothing renders it, so a
+preserved value would be a column kept warm for a feature that was deliberately
+removed. A note that had a colour now takes its identity from its tags, which is what
+the operator asked for: "strip color from the cards ... and keep the color for tags
+just on the tag."
+
+The palette itself is not lost. `NOTE_COLORS` moved from `models/note.py` to
+`colors.py` in the same change — labels still name a colour, and leaving the vocabulary
+defined on the model that lost one would be an invitation to put the column back.
+
+## The saved-filter sweep is not optional
+
+`saved_filters.params` is opaque JSON mirroring the `GET /api/notes` facet query, and
+a stored view could carry `"color": "teal"`. With the facet gone that key would sit
+there forever, and `clean_params` only guards what is written FROM here on. A view that
+silently filters on a field the app no longer has is worse than one that visibly lost a
+criterion, so the stored rows are swept too.
+
+Done in Python rather than as `params::jsonb - 'color'`, deliberately. Postgres has no
+try-cast: one malformed blob would abort the whole migration, and these rows are
+somebody's saved views. `json.loads` in a try/except lets a corrupt row keep whatever it
+holds and lets every other row be fixed.
+
+## Search is not affected
+
+`notes.search_vector` is a stored generated column over `display_title` and `body`
+(rebuilt in 0026). It never named `color`, so unlike the title drop there is nothing
+here to tear down and recreate.
+
+## Downgrade
+
+Restores the column, empty, at its old default. The values are not recoverable — see
+above. It is the schema that comes back, not the data.
+"""
+import json
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0029"
+down_revision = "0028"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.drop_column("notes", "color")
+
+    bind = op.get_bind()
+    rows = bind.execute(
+        sa.text("SELECT id, params FROM saved_filters WHERE params LIKE '%color%'")
+    ).fetchall()
+    for sf_id, params in rows:
+        try:
+            parsed = json.loads(params)
+        except (ValueError, TypeError):
+            # A blob that does not parse cannot be edited safely. Leaving it is
+            # correct: it was already unreadable by the app, and this migration is not
+            # the place to decide what it should have said.
+            continue
+        if not isinstance(parsed, dict) or "color" not in parsed:
+            continue
+        parsed.pop("color")
+        bind.execute(
+            sa.text("UPDATE saved_filters SET params = :p WHERE id = :id"),
+            {"p": json.dumps(parsed), "id": sf_id},
+        )
+
+
+def downgrade() -> None:
+    # Comes back at the default every note would have had anyway. Which notes once
+    # carried a chosen colour is not recorded anywhere after the upgrade.
+    op.add_column(
+        "notes",
+        sa.Column("color", sa.Text(), nullable=False, server_default="default"),
+    )
@@ -0,0 +1,51 @@
+"""a stored site_name of the old default follows the rename to Inkwell
+
+Revision ID: 0030
+Revises: 0029
+Create Date: 2026-10-06
+
+The product is renamed ThoughtSync → Inkwell (Scribe note 5071), and the `site_name`
+registry default moves with it. On its own that only reaches servers whose settings
+table has no `site_name` row — and most servers have one, because the Settings page
+saves EVERY key on Save, not just the one that changed. An admin who opened Settings
+to flip registration off has persisted `"ThoughtSync"` without ever choosing it.
+
+So the row is rewritten, but only when it holds exactly the old default. A name the
+admin actually typed is theirs and is left alone; the old default is the one value we
+can be sure nobody chose.
+
+The match is on the stored JSON text (`settings.value` is `json.dumps(value)`), so
+`'"ThoughtSync"'` is the whole of what it looks for.
+
+## Downgrade
+
+Puts the old default back on a row holding exactly the new one. A server where the
+admin typed "Inkwell" themselves between the two cannot be told apart from one this
+migration rewrote; on downgrade both read "ThoughtSync", which is what the old code
+would have shown for either.
+"""
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0030"
+down_revision = "0029"
+branch_labels = None
+depends_on = None
+
+_OLD = '"ThoughtSync"'
+_NEW = '"Inkwell"'
+
+
+def _swap(old: str, new: str) -> None:
+    op.get_bind().execute(
+        sa.text("UPDATE settings SET value = :new WHERE key = 'site_name' AND value = :old"),
+        {"old": old, "new": new},
+    )
+
+
+def upgrade() -> None:
+    _swap(_OLD, _NEW)
+
+
+def downgrade() -> None:
+    _swap(_NEW, _OLD)
@@ -0,0 +1,38 @@
+"""a link preview's insert, update or delete bumps its note's sync revision
+
+Revision ID: 0031
+Revises: 0030
+Create Date: 2026-10-07
+
+0015 made every child table bump its parent note's `sync_revision`, so a note syncs
+as a whole. `note_link_previews` arrived later (0020) and was never added, and two
+things have been missing on every linked device since:
+
+- A preview fetched in the background after a save (`unfurl_queue.py`) never reached
+  a device that had already pulled the note. The note's revision was assigned when
+  the TEXT was saved, before the preview existed, and nothing moved it afterwards.
+- A preview dismissed on the web stayed on every other device, for the same reason.
+
+The trigger is the same function 0015 installs on the other child tables.
+
+## Downgrade
+
+Drops the trigger. Previews go back to not propagating; nothing is lost.
+"""
+from alembic import op
+
+revision = "0031"
+down_revision = "0030"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute(
+        "CREATE TRIGGER trg_note_link_previews_bump_note AFTER INSERT OR UPDATE OR DELETE "
+        "ON note_link_previews FOR EACH ROW EXECUTE PROCEDURE ts_bump_parent_note_revision()"
+    )
+
+
+def downgrade() -> None:
+    op.execute("DROP TRIGGER IF EXISTS trg_note_link_previews_bump_note ON note_link_previews")
@@ -0,0 +1,42 @@
+"""invites: single-use, expiring registration links an admin issues
+
+Revision ID: 0032
+Revises: 0031
+Create Date: 2026-10-07
+
+Until now the only way to add a second person was to re-open registration to the
+whole internet while they signed up (#2939 §1). An invite lets one person register
+while registration stays closed. Only the token's SHA-256 hash is stored.
+
+## Downgrade
+
+Drops the table. Accounts created through invites are untouched; the record of who
+invited them goes with it.
+"""
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects.postgresql import CITEXT, UUID
+
+revision = "0032"
+down_revision = "0031"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "invites",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True),
+        sa.Column("token_hash", sa.Text(), nullable=False, unique=True),
+        sa.Column("created_by", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("email", CITEXT(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("redeemed_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("redeemed_by", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("invites")
@@ -0,0 +1,50 @@
+"""password resets: an admin-issued, one-hour link; sessions an account can outlive
+
+Revision ID: 0033
+Revises: 0032
+Create Date: 2026-10-07
+
+A forgotten password used to need a hand on the database (#2939 §2), and the app has
+no mail path to send a reset by. An admin makes a reset link for the account and
+hands it over (#5173). Only the token's SHA-256 hash is stored.
+
+`users.session_epoch` is what lets a reset sign the account out everywhere. Sessions
+are signed cookies held by the browser, so the server can't delete them; each one
+carries the epoch it was signed in under, and a reset moves the account's epoch on.
+It starts at 0, the value a cookie from before this migration is read as, so nobody
+is signed out by the upgrade itself.
+
+## Downgrade
+
+Drops the table and the column. Outstanding reset links stop working; sessions keep
+working, since nothing checks an epoch any more.
+"""
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0033"
+down_revision = "0032"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("users", sa.Column("session_epoch", sa.Integer(), nullable=False, server_default="0"))
+    op.create_table(
+        "password_resets",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True),
+        sa.Column("token_hash", sa.Text(), nullable=False, unique=True),
+        sa.Column("user_id", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("created_by", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("used_at", sa.DateTime(timezone=True), nullable=True),
+    )
+    op.create_index("ix_password_resets_user_id", "password_resets", ["user_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_password_resets_user_id", table_name="password_resets")
+    op.drop_table("password_resets")
+    op.drop_column("users", "session_epoch")
@@ -0,0 +1,50 @@
+"""shares: one grant per note and person, and only the permissions the app knows
+
+Revision ID: 0034
+Revises: 0033
+Create Date: 2026-10-07
+
+Nothing wrote a share until #5174, so the table never needed these. Now the Share
+dialog does:
+- A unique index on (resource_type, resource_id, shared_with_user_id) where a user is
+  the target, so sharing a note with someone twice updates the one grant rather than
+  stacking two (the same for a group, ahead of step 15).
+- A check that `permission` is `view` or `edit`.
+- An index on `shared_with_user_id` for "Shared with me".
+
+## Downgrade
+
+Drops the indexes and the check. The rows stay.
+"""
+from alembic import op
+
+revision = "0034"
+down_revision = "0033"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_index(
+        "uq_shares_resource_user",
+        "shares",
+        ["resource_type", "resource_id", "shared_with_user_id"],
+        unique=True,
+        postgresql_where="shared_with_user_id IS NOT NULL",
+    )
+    op.create_index(
+        "uq_shares_resource_group",
+        "shares",
+        ["resource_type", "resource_id", "shared_with_group_id"],
+        unique=True,
+        postgresql_where="shared_with_group_id IS NOT NULL",
+    )
+    op.create_index("ix_shares_user", "shares", ["shared_with_user_id"])
+    op.create_check_constraint("ck_shares_permission", "shares", "permission IN ('view', 'edit')")
+
+
+def downgrade() -> None:
+    op.drop_constraint("ck_shares_permission", "shares", type_="check")
+    op.drop_index("ix_shares_user", table_name="shares")
+    op.drop_index("uq_shares_resource_group", table_name="shares")
+    op.drop_index("uq_shares_resource_user", table_name="shares")
@@ -0,0 +1,50 @@
+"""share_revocations: telling a recipient's devices a shared note has left them
+
+Revision ID: 0035
+Revises: 0034
+Create Date: 2026-10-07
+
+The change feed carries every note a person can see, including notes shared with
+them (#5175). When a share ends, the note stops being visible, so it simply stops
+appearing in the feed. A device that already holds a copy would keep it forever. A
+revocation is that missing signal: one row per (note, person) who lost the note,
+stamped from the same `sync_revision_seq` the notes and labels draw from, so it sits
+on the one cursor every client already pages by.
+
+Sharing the note with that person again deletes the row, so a device that never
+heard of the revocation never gets told to delete a note it is meant to have.
+
+## Downgrade
+
+Drops the table. Devices that missed a revocation keep their copy.
+"""
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0035"
+down_revision = "0034"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "share_revocations",
+        sa.Column("note_id", UUID(as_uuid=True), sa.ForeignKey("notes.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("user_id", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column(
+            "sync_revision",
+            sa.BigInteger(),
+            nullable=False,
+            server_default=sa.text("nextval('sync_revision_seq')"),
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.PrimaryKeyConstraint("note_id", "user_id"),
+    )
+    op.create_index("ix_share_revocations_user_revision", "share_revocations", ["user_id", "sync_revision"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_share_revocations_user_revision", table_name="share_revocations")
+    op.drop_table("share_revocations")
@@ -0,0 +1,55 @@
+"""note_user_state: a recipient's own pin, archive and place for a shared note
+
+Revision ID: 0036
+Revises: 0035
+Create Date: 2026-10-07
+
+Pin, archive and board order are personal organization, and until now they were
+columns on `notes`, so on a shared note they could only ever mean the owner's
+(#5176). This table holds them for everyone else: one row per (note, person it is
+shared with) who has pinned, archived or moved it. The owner keeps the note's own
+columns; a recipient with no row sees the note unpinned, unarchived, in the owner's
+order.
+
+`sync_revision` is stamped by the same `ts_set_sync_revision()` trigger the notes
+and labels use (0015), so a recipient's change reaches their own devices on the one
+cursor they already page by, and never moves the note on anyone else's.
+
+## Downgrade
+
+Drops the table. Recipients lose their own pins and archives; the notes are
+untouched.
+"""
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0036"
+down_revision = "0035"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "note_user_state",
+        sa.Column("note_id", UUID(as_uuid=True), sa.ForeignKey("notes.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("user_id", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("pinned", sa.Boolean(), nullable=False, server_default=sa.false()),
+        sa.Column("archived", sa.Boolean(), nullable=False, server_default=sa.false()),
+        sa.Column("position", sa.Integer(), nullable=True),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("sync_revision", sa.BigInteger(), nullable=True),
+        sa.PrimaryKeyConstraint("note_id", "user_id"),
+    )
+    op.create_index("ix_note_user_state_user_revision", "note_user_state", ["user_id", "sync_revision"])
+    op.execute(
+        "CREATE TRIGGER trg_note_user_state_sync_revision BEFORE INSERT OR UPDATE ON note_user_state "
+        "FOR EACH ROW EXECUTE PROCEDURE ts_set_sync_revision()"
+    )
+
+
+def downgrade() -> None:
+    op.execute("DROP TRIGGER IF EXISTS trg_note_user_state_sync_revision ON note_user_state")
+    op.drop_index("ix_note_user_state_user_revision", table_name="note_user_state")
+    op.drop_table("note_user_state")
@@ -0,0 +1,38 @@
+"""users: drop email_verified and avatar_path, which nothing used
+
+Revision ID: 0037
+Revises: 0036
+Create Date: 2026-10-07
+
+Both came with the foundation (0001) for features that were never built (#5178).
+Nothing ever set `email_verified`, so it was false for every account on the server
+while the offline desktop reported it as true; nothing read or wrote `avatar_path`.
+A field whose value means nothing is worse than no field: a later feature would
+trust it. If address verification is ever built, it adds its own column, with a
+migration that says what the existing accounts are.
+
+## Downgrade
+
+Adds both columns back empty: every account unverified, no avatar. That is what
+they held before.
+"""
+import sqlalchemy as sa
+from alembic import op
+
+revision = "0037"
+down_revision = "0036"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.drop_column("users", "email_verified")
+    op.drop_column("users", "avatar_path")
+
+
+def downgrade() -> None:
+    op.add_column("users", sa.Column("avatar_path", sa.Text(), nullable=True))
+    op.add_column(
+        "users",
+        sa.Column("email_verified", sa.Boolean(), nullable=False, server_default=sa.false()),
+    )
@@ -0,0 +1,41 @@
+"""saved_filters: drop the table, saved views are gone
+
+Revision ID: 0038
+Revises: 0037
+Create Date: 2026-10-08
+
+Saved views were removed in #5180 (note 2897: recall first, organizing second). They
+lived only on the web; the desktop kept its own set that never synced, and Android
+had none. Tags in the drawer already give one-click recall.
+
+## Downgrade
+
+Recreates the table empty, as 0021 made it. The views that were stored are not
+recoverable.
+"""
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0038"
+down_revision = "0037"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.drop_index("ix_saved_filters_owner", table_name="saved_filters")
+    op.drop_table("saved_filters")
+
+
+def downgrade() -> None:
+    op.create_table(
+        "saved_filters",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True),
+        sa.Column("owner_id", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("name", sa.Text(), nullable=False),
+        sa.Column("params", sa.Text(), nullable=False, server_default="{}"),
+        sa.Column("position", sa.Integer(), nullable=False, server_default="0"),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+    )
+    op.create_index("ix_saved_filters_owner", "saved_filters", ["owner_id", "position"])
@@ -0,0 +1,41 @@
+"""audit_events: the audit log
+
+Revision ID: 0039
+Revises: 0038
+Create Date: 2026-10-08
+
+Credential events were only written to the app log, which is not queryable and is
+gone at the container's log rotation (#2939 §5). This keeps them in the database for
+`audit_retention_days`, for admins to read in Settings → Activity.
+
+## Downgrade
+
+Drops the table and every event in it.
+"""
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0039"
+down_revision = "0038"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "audit_events",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True),
+        sa.Column("at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("event", sa.Text(), nullable=False),
+        sa.Column("user_id", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("email", sa.Text(), nullable=True),
+        sa.Column("address", sa.Text(), nullable=True),
+        sa.Column("detail", sa.Text(), nullable=True),
+    )
+    op.create_index("ix_audit_events_at", "audit_events", ["at"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_audit_events_at", table_name="audit_events")
+    op.drop_table("audit_events")
@@ -0,0 +1,41 @@
+"""labels: a tag's name is unique among LIVE tags only
+
+Revision ID: 0040
+Revises: 0039
+Create Date: 2026-10-08
+
+Deleting a tag now leaves a tombstone row (`purged_at` set) so the change feed can
+tell linked devices about it (#5382). Before, the web deleted the row outright and
+devices never heard. A tombstone must not hold its name: creating `#grocery` again
+after deleting it has to make a live tag, on the web and from a device alike. So
+`(owner_id, name)` stays unique only where `purged_at IS NULL`.
+
+## Downgrade
+
+Restores the plain unique constraint. Tombstones are deleted first, since one may
+share its name with a live tag; devices that have not pulled since keep the tag.
+"""
+import sqlalchemy as sa
+from alembic import op
+
+revision = "0040"
+down_revision = "0039"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.drop_constraint("uq_labels_owner_name", "labels", type_="unique")
+    op.create_index(
+        "uq_labels_owner_name_live",
+        "labels",
+        ["owner_id", "name"],
+        unique=True,
+        postgresql_where=sa.text("purged_at IS NULL"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("uq_labels_owner_name_live", table_name="labels")
+    op.execute("DELETE FROM labels WHERE purged_at IS NOT NULL")
+    op.create_unique_constraint("uq_labels_owner_name", "labels", ["owner_id", "name"])
@@ -16,7 +16,7 @@ val workspaceRoot: Directory = layout.projectDirectory.dir("../..")
 val androidAbis = listOf("arm64-v8a", "armeabi-v7a", "x86", "x86_64")

 /**
- * Cross-compile `thoughtsync-ffi` for each Android ABI and drop the resulting
+ * Cross-compile `inkwell-ffi` for each Android ABI and drop the resulting
 * `.so` into jniLibs, where AGP packages it.
 *
 * `ExecOperations` injected rather than `project.exec`: the latter was REMOVED in
@@ -49,15 +49,32 @@ abstract class CargoNdkBuild : DefaultTask() {
            args += "-t"
            args += abi
        }
-        args += listOf("-o", jniLibsDir.get().asFile.absolutePath, "build", "-p", "thoughtsync-ffi")
+        args += listOf("-o", jniLibsDir.get().asFile.absolutePath, "build", "-p", "inkwell-ffi")
        // --locked so an Android build cannot silently re-resolve the workspace
        // lockfile the desktop lanes are gated on.
        args += "--locked"
-        if (cargoProfile.get() == "release") args += "--release"
+        val release = cargoProfile.get() == "release"
+        if (release) args += "--release"

        execOps.exec {
            commandLine(listOf("cargo") + args)
            workingDir = workspaceDir.get().asFile
+            if (release) {
+                // The workspace's release profile with two of its settings put back,
+                // for this build only. Environment overrides rather than a profile of
+                // our own, because cargo-ndk copies its `-o` output from the
+                // `release` directory and nothing says it understands any other one;
+                // the desktop's binaries are untouched either way.
+                //
+                // Keep the symbol table: `strip = true` removes the symbols uniffi's
+                // `--library` mode reads the interface out of, and bindgen then fails
+                // with "No UniFFI metadata found" (run 4077). There is no debug info
+                // in a release build to strip, so this keeps symbols and nothing else.
+                environment("CARGO_PROFILE_RELEASE_STRIP", "debuginfo")
+                // Unwind, so a panic in the core reaches Kotlin as an exception the
+                // board can show rather than ending the app. See the ffi crate's docs.
+                environment("CARGO_PROFILE_RELEASE_PANIC", "unwind")
+            }
        }
    }
 }
@@ -94,7 +111,7 @@ abstract class UniffiBindgen : DefaultTask() {
                "run",
                "--locked",
                "-p",
-                "thoughtsync-uniffi-bindgen",
+                "inkwell-uniffi-bindgen",
                "--",
                "generate",
                "--library",
@@ -131,17 +148,13 @@ val rustInputs =
 * profiles. `android.yml` picks one profile and uses it for every Gradle call in
 * the run.
 *
- * CI currently passes `debug` even for a release APK, which is not where this
- * should end up: an unoptimised store and sync engine is a real difference on a
- * phone, not a theoretical one. The blocker is that the workspace's release
- * profile sets `strip = true`, which removes the symbols uniffi reads its
- * interface metadata from — `generateUniffiBindings` then fails with "No UniFFI
- * metadata found" (run 4077). Fixing it means either an Android-specific profile
- * that keeps symbols or generating the bindings from a separate unstripped
- * build, and neither is worth holding signed APKs up for. Scribe #2810.
+ * CI passes `release` for a signed APK, so a phone runs an optimised store and sync
+ * engine. Until Scribe #2810 it passed `debug`, because the release profile's
+ * `strip = true` broke bindgen; `CargoNdkBuild` now keeps the symbols for this
+ * build alone.
 */
 val rustProfile =
-    (project.findProperty("THOUGHTSYNC_CARGO_PROFILE") as String?)?.takeIf { it.isNotBlank() }
+    (project.findProperty("INKWELL_CARGO_PROFILE") as String?)?.takeIf { it.isNotBlank() }
        ?: "debug"

 val jniLibsOut = layout.buildDirectory.dir("rustJniLibs")
@@ -149,7 +162,7 @@ val bindingsOut = layout.buildDirectory.dir("generated/uniffi")

 val cargoNdk =
    tasks.register<CargoNdkBuild>("cargoNdk") {
-        description = "Cross-compile thoughtsync-ffi for the Android ABIs."
+        description = "Cross-compile inkwell-ffi for the Android ABIs."
        rustSources.from(rustInputs)
        abis.set(androidAbis)
        cargoProfile.set(rustProfile)
@@ -163,17 +176,17 @@ val generateBindings =
        dependsOn(cargoNdk)
        // arm64 is arbitrary — every ABI carries the same uniffi metadata, and
        // reading one is cheaper than reading four.
-        libraryFile.set(jniLibsOut.map { it.file("arm64-v8a/libthoughtsync_ffi.so") })
+        libraryFile.set(jniLibsOut.map { it.file("arm64-v8a/libinkwell_ffi.so") })
        workspaceDir.set(workspaceRoot)
        outputDir.set(bindingsOut)
    }

 android {
-    namespace = "com.fabledsword.thoughtsync"
+    namespace = "com.fabledsword.inkwell"
    compileSdk = 36

    defaultConfig {
-        applicationId = "com.fabledsword.thoughtsync"
+        applicationId = "com.fabledsword.inkwell"
        // 26 (Android 8, 2017) matches Minstrel and clears the NDK's floor with
        // room to spare.
        minSdk = 26
@@ -181,9 +194,9 @@ android {
        // Injected by CI from the git tag + commit count for a release; "dev"
        // locally so the About screen reads honestly rather than claiming 1.0.
        val nameOverride =
-            (project.findProperty("THOUGHTSYNC_VERSION_NAME") as String?)?.takeIf { it.isNotBlank() }
+            (project.findProperty("INKWELL_VERSION_NAME") as String?)?.takeIf { it.isNotBlank() }
        val codeOverride =
-            (project.findProperty("THOUGHTSYNC_VERSION_CODE") as String?)?.toIntOrNull()
+            (project.findProperty("INKWELL_VERSION_CODE") as String?)?.toIntOrNull()
        versionCode = codeOverride ?: 1
        versionName = nameOverride ?: "dev"

@@ -215,7 +228,10 @@ android {
                // Hardcoded, and NOT a secret: the alias is fixed for the life of
                // this app and is written into the certificate every install
                // already carries. Hiding it would buy nothing and stop this file
-                // describing its own signing setup.
+                // describing its own signing setup. It still says `thoughtsync`
+                // after the rename to Inkwell, because it names the key inside the
+                // existing keystore, and renaming it would only stop that key being
+                // found. Same key, so the signing certificate did not change either.
                keyAlias = "thoughtsync"
                // PKCS12 cannot hold a key password distinct from the store
                // password — keytool refuses to set one — so this is the same
@@ -288,5 +304,9 @@ dependencies {
    implementation(libs.compose.ui.tooling.preview)
    debugImplementation(libs.compose.ui.tooling)

+    // A link preview's image (LinkPreviewRow.kt).
+    implementation(libs.coil.compose)
+    implementation(libs.coil.network.okhttp)
+
    testImplementation(libs.junit)
 }
@@ -4,4 +4,4 @@
 # is the worst possible time to learn it.
 -keep class com.sun.jna.** { *; }
 -keepclassmembers class * extends com.sun.jna.** { public *; }
-keep class com.fabledsword.thoughtsync.core.** { *; }
+-keep class com.fabledsword.inkwell.core.** { *; }
@@ -7,6 +7,9 @@
      this permission never exercised.
    -->
    <uses-permission android:name="android.permission.INTERNET" />
+    <!-- Only to answer "is this connection metered?" before the app downloads its own
+         update in the background. Normal permission, no prompt, no location. -->
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />

    <!--
      Four more permissions are NOT declared here and still reach the merged
@@ -87,24 +90,80 @@
    <uses-permission android:name="android.permission.SCHEDULE_EXACT_ALARM" />
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />

+    <!--
+      allowBackup stays true, which family idea #5105 (practice 12) says to turn
+      off. Inkwell is local-first, so an unlinked phone's notes exist only on the
+      phone, and Android's backup is their one other copy. The device token is what
+      the practice protects, and it is stored sealed under a Keystore key that never
+      leaves the phone (KeystoreTokenSeal.kt). A backup therefore carries the notes
+      and a token nothing can open, and a restored app asks to sign in again.
+    -->
    <application
-        android:name=".ThoughtSyncApplication"
+        android:name=".InkwellApplication"
        android:allowBackup="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
-        android:theme="@style/Theme.ThoughtSync"
+        android:theme="@style/Theme.Inkwell"
        android:usesCleartextTraffic="true">
+        <!--
+          launchMode="singleTop" exists for the SHARE filters below.
+
+          The reminder notification adds FLAG_ACTIVITY_SINGLE_TOP to its own
+          intent, so onNewIntent already worked for that one. A share intent is
+          built by the OTHER app — Chrome, a reader, the text-selection toolbar —
+          and nothing here can add a flag to it. Without singleTop declared on the
+          activity itself, every share while the app is running would stack a
+          second MainActivity on top of the first: a second view model, a second
+          board, and a back press that lands on a stale copy of the same app.
+        -->
        <activity
            android:name=".MainActivity"
            android:exported="true"
+            android:launchMode="singleTop"
            android:windowSoftInputMode="adjustResize"
-            android:theme="@style/Theme.ThoughtSync">
+            android:theme="@style/Theme.Inkwell">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
+
+            <!--
+              Capture without opening the app first: Share → Inkwell from
+              anywhere, and the selection toolbar in any text field.
+
+              Text, and images one at a time or several at once. A shared image
+              becomes a note carrying it as an attachment, stored on the phone
+              and uploaded on the next sync that reaches a server (#5169).
+
+              image/* rather than */*: a photo or a screenshot is what people
+              share into a notes app. Claiming every type would put Inkwell in the
+              share sheet for APKs, contacts and calendar entries, where it would
+              be noise. Other files attach from inside the editor, whose picker
+              takes any type.
+            -->
+            <intent-filter>
+                <action android:name="android.intent.action.SEND" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="text/plain" />
+            </intent-filter>
+            <intent-filter>
+                <action android:name="android.intent.action.SEND" />
+                <action android:name="android.intent.action.SEND_MULTIPLE" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="image/*" />
+            </intent-filter>
+
+            <!--
+              The label is what appears in the text-selection menu beside Copy and
+              Share, where "Inkwell" would say who rather than what.
+            -->
+            <intent-filter android:label="@string/capture_process_text">
+                <action android:name="android.intent.action.PROCESS_TEXT" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="text/plain" />
+            </intent-filter>
        </activity>

        <!--
@@ -123,6 +182,22 @@
          PackageInstaller. Without it a failed install would be indistinguishable
          from someone declining the dialog (Scribe #2438).
        -->
+        <!--
+          Hands an attachment to the app that opens its type. Not exported, as a
+          FileProvider must not be: access is granted one URI at a time, on the
+          intent that opens it. It serves only the cache copies listed in
+          res/xml/file_paths.xml, never the note store.
+        -->
+        <provider
+            android:name="androidx.core.content.FileProvider"
+            android:authorities="${applicationId}.files"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+                android:name="android.support.FILE_PROVIDER_PATHS"
+                android:resource="@xml/file_paths" />
+        </provider>
+
        <receiver
            android:name=".UpdateReceiver"
            android:exported="false" />
@@ -1,9 +1,12 @@
-package com.fabledsword.thoughtsync
+package com.fabledsword.inkwell

 import android.content.Context
 import android.content.Intent
 import android.content.IntentSender
+import android.content.pm.ApplicationInfo
 import android.content.pm.PackageInstaller
+import android.net.ConnectivityManager
+import android.net.NetworkCapabilities
 import android.net.Uri
 import android.os.Build
 import android.provider.Settings
@@ -40,7 +43,7 @@ import java.io.File
 * [UpdateReceiver], which is why a failure can be shown rather than guessed at.
 */
 object AppUpdate {
-    private const val TAG = "ThoughtSyncUpdate"
+    private const val TAG = LogTag.UPDATE

    /** This build's versionCode — what the server's is compared against. */
    fun installedVersionCode(context: Context): Long =
@@ -48,6 +51,18 @@ object AppUpdate {
            context.packageManager.getPackageInfo(context.packageName, 0).longVersionCode
        }.getOrDefault(0L)

+    /**
+     * Whether this build can update itself at all.
+     *
+     * A debuggable build is signed with a debug key (CI's unsigned path, or a local
+     * build), and Android refuses the release-signed APK over it with
+     * INSTALL_FAILED_UPDATE_INCOMPATIBLE. Offering that update would be a download
+     * that can only fail, so a debug build says so instead (family idea #5103,
+     * practice 9).
+     */
+    fun selfUpdates(context: Context): Boolean =
+        (context.applicationInfo.flags and ApplicationInfo.FLAG_DEBUGGABLE) == 0
+
    /**
     * Whether this app may install packages at all.
     *
@@ -62,6 +77,30 @@ object AppUpdate {
            .setData(Uri.fromParts("package", context.packageName, null))
            .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)

+    /**
+     * Whether this is wifi somebody is not paying by the megabyte for.
+     *
+     * The app fetches its own update in the background, and fifty-odd megabytes over
+     * mobile data is a bill nobody agreed to. Anywhere else it simply waits — the
+     * update is found, nothing is downloaded, and nothing is said until it can be.
+     *
+     * BOTH conditions, deliberately. Wifi alone would still download over a tethered
+     * hotspot, which is mobile data wearing a different hat and the exact bill this
+     * avoids. Unmetered alone would download over an unmetered cellular plan, which
+     * is not what "on wifi" means to the person who asked for it.
+     *
+     * Every uncertain answer is `false`: the cautious one costs nothing.
+     */
+    fun onWifi(context: Context): Boolean {
+        val caps =
+            context
+                .getSystemService(ConnectivityManager::class.java)
+                ?.let { manager -> manager.activeNetwork?.let(manager::getNetworkCapabilities) }
+        return caps != null &&
+            caps.hasTransport(NetworkCapabilities.TRANSPORT_WIFI) &&
+            caps.hasCapability(NetworkCapabilities.NET_CAPABILITY_NOT_METERED)
+    }
+
    /** Where a download goes: app-private, so no storage permission is involved. */
    fun downloadTarget(context: Context): File = File(context.cacheDir, "update.apk")

@@ -147,5 +186,5 @@ object AppUpdate {
            .intentSender
    }

-    private const val WRITE_NAME = "thoughtsync-update"
+    private const val WRITE_NAME = "inkwell-update"
 }
@@ -0,0 +1,21 @@
+package com.fabledsword.inkwell
+
+import android.content.Context
+
+/**
+ * The `versionName` of the INSTALLED package, or null when it cannot be read.
+ *
+ * From the package manager rather than from `BuildConfig`: this reports what is
+ * actually on the phone, which is the question both callers are asking — a bug
+ * report reading the foot of Sync, and a server log reading the client header. It
+ * also needs no `buildFeatures.buildConfig`, which this module does not enable.
+ *
+ * Returns null rather than a fallback string, because the two callers want
+ * different ones: the UI wants a localized "unknown" from string resources, the
+ * client header wants the literal the core recognizes. Note 3127 §5 governs both —
+ * with no version tags, the artifact's self-report is the only answer to "which
+ * build is this?", so a missing name must read as missing and never as a plausible
+ * default that nothing can contradict.
+ */
+fun Context.installedVersionName(): String? =
+    runCatching { packageManager.getPackageInfo(packageName, 0).versionName }.getOrNull()
@@ -1,8 +1,9 @@
-package com.fabledsword.thoughtsync
+package com.fabledsword.inkwell

 import android.app.Application
 import android.util.Log
-import com.fabledsword.thoughtsync.core.ThoughtSync
+import com.fabledsword.inkwell.core.Inkwell
+import com.fabledsword.inkwell.core.setClientAgent

 /**
 * Opens the shared Rust core once, for the process lifetime.
@@ -15,14 +16,14 @@ import com.fabledsword.thoughtsync.core.ThoughtSync
 * removed on uninstall, and never on external media. The core does not guess at
 * platform paths; Android is the only thing that knows where this is.
 */
-class ThoughtSyncApplication : Application() {
+class InkwellApplication : Application() {
    /**
     * Null only if the store could not be opened — a corrupt or unwritable
     * database. The UI reports that honestly rather than crashing on first
     * touch, because a user whose notes won't open needs a message, not a
     * stack trace.
     */
-    var core: ThoughtSync? = null
+    var core: Inkwell? = null
        private set

    var openFailure: String? = null
@@ -30,8 +31,16 @@ class ThoughtSyncApplication : Application() {

    override fun onCreate() {
        super.onCreate()
+
+        // Introduce this app to any server it links to, before anything can sync.
+        // The core cannot name us — the same crate is compiled into the desktop app,
+        // and it used to announce every phone as `inkwell-desktop` carrying the
+        // core crate's own version. "unknown" rather than a guess when the package
+        // manager will not say (note 3127 §5).
+        setClientAgent("inkwell-android", installedVersionName() ?: "unknown")
+
        try {
-            val handle = ThoughtSync(filesDir.absolutePath)
+            val handle = Inkwell(filesDir.absolutePath, KeystoreTokenSeal())
            core = handle
            Log.i(TAG, "local store ready — ${handle.summary()}")
        } catch (e: Exception) {
@@ -44,6 +53,6 @@ class ThoughtSyncApplication : Application() {
    }

    private companion object {
-        const val TAG = "ThoughtSync"
+        const val TAG = LogTag.APP
    }
 }
@@ -0,0 +1,98 @@
+package com.fabledsword.inkwell
+
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import android.util.Log
+import com.fabledsword.inkwell.core.TokenSeal
+import java.security.KeyStore
+import java.util.Base64
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+
+/**
+ * Keeps the device token sealed under a key in the Android Keystore (family idea
+ * #5105, practice 12). The core stores what this returns, never the token itself.
+ *
+ * The key never leaves this phone, so a copy of the app's files yields a token
+ * nothing can open. That includes Android's backup, which stays on: an unlinked
+ * phone's notes exist only here, and a backup is their one other copy. Restored
+ * onto another phone, the notes come back and the app asks to sign in again.
+ *
+ * Both methods answer null rather than throw, because an exception crossing into
+ * the core would be a panic there. The core reads null from [sealToken] as "store
+ * it as is for now" and from [openToken] as "sign in again".
+ *
+ * Shaped after Minstrel's KeystoreSessionVault (Scribe snippet #5025).
+ */
+class KeystoreTokenSeal : TokenSeal {
+    override fun sealToken(token: String): String? =
+        runCatching { SealedBox.seal(key(), token) }
+            .onFailure { Log.w(TAG, "couldn't seal the device token", it) }
+            .getOrNull()
+
+    override fun openToken(sealed: String): String? =
+        runCatching { SealedBox.open(key(), sealed) }
+            .onFailure { Log.w(TAG, "the device token won't open on this phone", it) }
+            .getOrNull()
+
+    private fun key(): SecretKey {
+        val store = KeyStore.getInstance(KEYSTORE).apply { load(null) }
+        (store.getKey(ALIAS, null) as? SecretKey)?.let { return it }
+        val generator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, KEYSTORE)
+        generator.init(
+            KeyGenParameterSpec
+                .Builder(ALIAS, KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT)
+                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+                .setKeySize(KEY_BITS)
+                .build(),
+        )
+        return generator.generateKey()
+    }
+
+    private companion object {
+        const val TAG = LogTag.APP
+        const val KEYSTORE = "AndroidKeyStore"
+        const val ALIAS = "inkwell-device-token"
+        const val KEY_BITS = 256
+    }
+}
+
+/**
+ * AES-GCM with a fresh IV per seal, the IV stored in front of the ciphertext. Split
+ * from the Keystore so it can be tested on the JVM with an ordinary key.
+ */
+internal object SealedBox {
+    private const val TRANSFORMATION = "AES/GCM/NoPadding"
+    private const val TAG_BITS = 128
+    private const val IV_BYTES = 12
+
+    // Binds a sealed value to what it is, so it can't be passed off as another secret.
+    private val AAD = "inkwell-device-token-v1".toByteArray(Charsets.UTF_8)
+
+    fun seal(
+        key: SecretKey,
+        plaintext: String,
+    ): String {
+        val cipher = Cipher.getInstance(TRANSFORMATION)
+        // The provider picks a random IV; the Keystore refuses a caller-chosen one.
+        cipher.init(Cipher.ENCRYPT_MODE, key)
+        cipher.updateAAD(AAD)
+        val sealed = cipher.iv + cipher.doFinal(plaintext.toByteArray(Charsets.UTF_8))
+        return Base64.getEncoder().encodeToString(sealed)
+    }
+
+    fun open(
+        key: SecretKey,
+        sealed: String,
+    ): String {
+        val bytes = Base64.getDecoder().decode(sealed)
+        require(bytes.size > IV_BYTES) { "sealed value too short" }
+        val cipher = Cipher.getInstance(TRANSFORMATION)
+        cipher.init(Cipher.DECRYPT_MODE, key, GCMParameterSpec(TAG_BITS, bytes, 0, IV_BYTES))
+        cipher.updateAAD(AAD)
+        return String(cipher.doFinal(bytes, IV_BYTES, bytes.size - IV_BYTES), Charsets.UTF_8)
+    }
+}
@@ -0,0 +1,12 @@
+package com.fabledsword.inkwell
+
+/**
+ * The tags the app logs under, one per concern, so `adb logcat -s` on one of them
+ * finds every line about it whichever file wrote it.
+ */
+internal object LogTag {
+    const val APP = "Inkwell"
+    const val UPDATE = "InkwellUpdate"
+    const val REMINDERS = "InkwellReminders"
+    const val WORKER = "InkwellWorker"
+}
@@ -1,7 +1,8 @@
-package com.fabledsword.thoughtsync
+package com.fabledsword.inkwell

 import android.Manifest
 import android.content.Intent
+import android.net.Uri
 import android.os.Build
 import android.os.Bundle
 import androidx.activity.ComponentActivity
@@ -11,6 +12,7 @@ import androidx.activity.compose.setContent
 import androidx.activity.enableEdgeToEdge
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.CompositionLocalProvider
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.MutableState
 import androidx.compose.runtime.getValue
@@ -21,20 +23,29 @@ import androidx.compose.runtime.saveable.rememberSaveable
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.res.stringResource
+import androidx.core.content.IntentCompat
 import androidx.lifecycle.viewmodel.compose.viewModel
-import com.fabledsword.thoughtsync.core.ThoughtSync
-import com.fabledsword.thoughtsync.ui.BoardScreen
-import com.fabledsword.thoughtsync.ui.BoardSync
-import com.fabledsword.thoughtsync.ui.BoardViewModel
-import com.fabledsword.thoughtsync.ui.ForegroundTransitions
-import com.fabledsword.thoughtsync.ui.NoteEditorScreen
-import com.fabledsword.thoughtsync.ui.StoreUnavailableScreen
-import com.fabledsword.thoughtsync.ui.SyncScreen
-import com.fabledsword.thoughtsync.ui.SyncState
-import com.fabledsword.thoughtsync.ui.SyncViewModel
-import com.fabledsword.thoughtsync.ui.ThoughtSyncTheme
-import com.fabledsword.thoughtsync.ui.UpdateViewModel
-import com.fabledsword.thoughtsync.ui.olderThan
+import com.fabledsword.inkwell.core.Inkwell
+import com.fabledsword.inkwell.ui.AttachmentFiles
+import com.fabledsword.inkwell.ui.BoardScreen
+import com.fabledsword.inkwell.ui.BoardSync
+import com.fabledsword.inkwell.ui.BoardUpdate
+import com.fabledsword.inkwell.ui.BoardViewModel
+import com.fabledsword.inkwell.ui.ForegroundTransitions
+import com.fabledsword.inkwell.ui.InkwellTheme
+import com.fabledsword.inkwell.ui.LocalAttachmentFiles
+import com.fabledsword.inkwell.ui.NoteEditorScreen
+import com.fabledsword.inkwell.ui.OnEachForeground
+import com.fabledsword.inkwell.ui.ShareSheet
+import com.fabledsword.inkwell.ui.ShareViewModel
+import com.fabledsword.inkwell.ui.StoreUnavailableScreen
+import com.fabledsword.inkwell.ui.SyncScreen
+import com.fabledsword.inkwell.ui.SyncState
+import com.fabledsword.inkwell.ui.SyncViewModel
+import com.fabledsword.inkwell.ui.TagsScreen
+import com.fabledsword.inkwell.ui.TagsViewModel
+import com.fabledsword.inkwell.ui.UpdateViewModel
+import com.fabledsword.inkwell.ui.olderThan
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
@@ -50,15 +61,27 @@ class MainActivity : ComponentActivity() {
     */
    private val requestedNote = mutableStateOf<String?>(null)

+    /**
+     * Text or files shared into the app from elsewhere, waiting to become a note.
+     *
+     * Same shape and same reason as [requestedNote]: a share that arrives while
+     * the app is already running lands in [onNewIntent], long after the
+     * composition was built, so a piece of state it is already reading is the only
+     * way in. The activity is `singleTop` in the manifest precisely so that this
+     * path exists for an intent another app built.
+     */
+    private val shared = mutableStateOf<SharedIn?>(null)
+
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        enableEdgeToEdge()

-        val app = application as ThoughtSyncApplication
+        val app = application as InkwellApplication
        requestedNote.value = takeRequestedNote(intent)
+        shared.value = takeShared(intent)

        setContent {
-            ThoughtSyncTheme {
+            InkwellTheme {
                val core = app.core
                if (core == null) {
                    // The store never opened. There is no board to show and no
@@ -66,7 +89,12 @@ class MainActivity : ComponentActivity() {
                    // than render an empty board that looks like data loss.
                    StoreUnavailableScreen(reason = app.openFailure)
                } else {
-                    App(core, requestedNote)
+                    // Application context inside, so holding it for the
+                    // composition's life cannot leak this activity.
+                    val files = remember(core) { AttachmentFiles(this, core) }
+                    CompositionLocalProvider(LocalAttachmentFiles provides files) {
+                        App(core, files, requestedNote, shared)
+                    }
                }
            }
        }
@@ -76,6 +104,7 @@ class MainActivity : ComponentActivity() {
        super.onNewIntent(intent)
        setIntent(intent)
        requestedNote.value = takeRequestedNote(intent)
+        shared.value = takeShared(intent)
    }

    /**
@@ -91,10 +120,83 @@ class MainActivity : ComponentActivity() {
        intent.removeExtra(Reminders.EXTRA_NOTE_ID)
        return id
    }
+
+    /**
+     * Read what a share or a text selection brought in, and CONSUME it.
+     *
+     * Consumed for the same reason [takeRequestedNote] is: the activity keeps the
+     * intent it was launched with, so without removing the extras a rotation would
+     * replay the share and mint the same note again, with nothing on screen to
+     * explain where the duplicates were coming from.
+     */
+    private fun takeShared(intent: Intent?): SharedIn? {
+        val incoming =
+            when (intent?.action) {
+                Intent.ACTION_SEND, Intent.ACTION_SEND_MULTIPLE ->
+                    SharedIn(intent.takeSendText(), intent.takeStreams())
+                Intent.ACTION_PROCESS_TEXT -> SharedIn(intent.takeProcessText(), emptyList())
+                else -> null
+            }
+        return incoming?.takeIf { !it.text.isNullOrBlank() || it.files.isNotEmpty() }
+    }
+}
+
+/**
+ * What a share brought: words, files, or both — a photo shared from the gallery
+ * often comes with a caption.
+ *
+ * The files are content URIs the sending app granted this one read access to. The
+ * grant lasts while this activity does, which is longer than reading them takes.
+ */
+data class SharedIn(
+    val text: String?,
+    val files: List<Uri>,
+)
+
+/** The file or files a SEND or SEND_MULTIPLE carried, consumed like the text. */
+private fun Intent.takeStreams(): List<Uri> {
+    val streams =
+        if (action == Intent.ACTION_SEND_MULTIPLE) {
+            IntentCompat.getParcelableArrayListExtra(this, Intent.EXTRA_STREAM, Uri::class.java).orEmpty()
+        } else {
+            listOfNotNull(IntentCompat.getParcelableExtra(this, Intent.EXTRA_STREAM, Uri::class.java))
+        }
+    removeExtra(Intent.EXTRA_STREAM)
+    return streams
+}
+
+/**
+ * The shared text, with a subject line above it when the sender gave one.
+ *
+ * Sharing a page from a browser sends EXTRA_SUBJECT as the page title and
+ * EXTRA_TEXT as the URL. Keeping both makes the note read as its title, because
+ * the core names a note by its first line — so this is not decoration, it is what
+ * turns a board of identical-looking links into a board you can scan.
+ *
+ * `distinct` because plenty of apps put the same string in both, and a note that
+ * says the URL twice is worse than one that says it once.
+ */
+private fun Intent.takeSendText(): String? {
+    val body = getStringExtra(Intent.EXTRA_TEXT)
+    val subject = getStringExtra(Intent.EXTRA_SUBJECT)
+    removeExtra(Intent.EXTRA_TEXT)
+    removeExtra(Intent.EXTRA_SUBJECT)
+    return listOfNotNull(subject, body)
+        .map { it.trim() }
+        .filter { it.isNotEmpty() }
+        .distinct()
+        .joinToString("\n")
+}
+
+/** The selection from another app's text field, via the selection toolbar. */
+private fun Intent.takeProcessText(): String? {
+    val text = getCharSequenceExtra(Intent.EXTRA_PROCESS_TEXT)?.toString()
+    removeExtra(Intent.EXTRA_PROCESS_TEXT)
+    return text
 }

 /** Which screen is up. Exactly one at a time. */
-private enum class Screen { BOARD, EDITOR, SYNC }
+private enum class Screen { BOARD, EDITOR, SYNC, TAGS }

 /**
 * The whole app, once the store is open.
@@ -103,21 +205,23 @@ private enum class Screen { BOARD, EDITOR, SYNC }
 * both cover the display completely, so keeping the board's two-column grid
 * measuring and recomposing underneath one would be pure waste.
 *
- * Still no navigation library. Three destinations, each entered from exactly one
+ * Still no navigation library. Four destinations, each entered from exactly one
 * place and left by back — a nav graph would be ceremony around an enum, and the
 * state that actually matters (which note is open, whether this device is linked)
 * already lives in view models.
 */
@Composable
 private fun App(
-    core: ThoughtSync,
+    core: Inkwell,
+    files: AttachmentFiles,
    requestedNote: MutableState<String?>,
+    shared: MutableState<SharedIn?>,
 ) {
    val context = LocalContext.current
    val board: BoardViewModel =
        viewModel(
            factory =
-                BoardViewModel.factory(core) {
+                BoardViewModel.factory(core, readFile = files::read) {
                    // Any store write can have moved the next reminder. Called on
                    // the IO dispatcher by the view model, which is where it has to
                    // be — this reads every note carrying a reminder.
@@ -134,6 +238,15 @@ private fun App(
        }
    }

+    // Cleared the same way and for the same reason: without it every later
+    // recomposition would capture the share again as a new note.
+    LaunchedEffect(shared.value) {
+        shared.value?.let {
+            board.captureShared(it.text, it.files)
+            shared.value = null
+        }
+    }
+
    ReminderAlarms(core)
    // A pull can rewrite every note the board is holding, so a sync that changed
    // anything tells it to reload. Wired here, at the one place that owns both.
@@ -148,17 +261,33 @@ private fun App(
    // opens the editor on an unsaved draft, so writing a note and editing one are the
    // same surface with the same toolbar.
    var showingSync by rememberSaveable { mutableStateOf(false) }
+    var showingTags by rememberSaveable { mutableStateOf(false) }
+
+    // Tag writes reach the board two ways at once: the drawer lists tags, and the
+    // board may be LOOKING at one that a delete or a merge just removed. Both are
+    // `refreshLabels`, which also leaves a lens whose tag stopped existing.
+    val tags: TagsViewModel =
+        viewModel(factory = TagsViewModel.factory(core, onStoreChanged = board::refreshLabels))
+
+    // A share landing changes the note's `shared` flag, which the board's card chip
+    // reads, so the board reloads after one.
+    val share: ShareViewModel =
+        viewModel(factory = ShareViewModel.factory(core, onStoreChanged = board::refresh))

    val update: UpdateViewModel = viewModel(factory = UpdateViewModel.factory(core, context))
    val settings = remember(context) { SyncSettings(context) }
    var automatic by remember { mutableStateOf(settings.automatic) }

    AutomaticSync(state = sync.state, enabled = automatic, onSync = sync::syncQuietly)
+    AutomaticUpdate(linked = sync.state.linked, onCheck = update::checkInBackground)

    val editing = board.state.editing
    val screen =
        when {
            showingSync -> Screen.SYNC
+            // Above the editor: tags are reached only from the board's drawer, so
+            // there is never an open note underneath one to go back to.
+            showingTags -> Screen.TAGS
            editing != null -> Screen.EDITOR
            else -> Screen.BOARD
        }
@@ -186,6 +315,18 @@ private fun App(
                onInstallOutcome = update::consumeInstallOutcome,
            )

+        Screen.TAGS ->
+            TagsScreen(
+                state = tags.state,
+                onClose = { showingTags = false },
+                onCreate = tags::create,
+                onRename = tags::rename,
+                onColour = tags::setColour,
+                onDelete = tags::remove,
+                onMerge = tags::merge,
+                onDismissError = tags::dismissError,
+            )
+
        Screen.EDITOR ->
            NoteEditorScreen(
                // Non-null by construction: `screen` is EDITOR only when it is.
@@ -194,6 +335,7 @@ private fun App(
                labels = board.state.labels,
                saving = board.state.saving,
                error = board.state.error,
+                onShare = { share.open(editing.id) },
                // The one seam between the editor and the store. Exhaustive at the
                // other end, so a new action cannot be added without being handled.
                onAction = { board.onEditorAction(editing, it) },
@@ -216,17 +358,49 @@ private fun App(
                        onDismissError = sync::dismissSyncError,
                    ),
                onOpenSync = { showingSync = true },
+                onManageTags = { showingTags = true },
                onSearch = board::search,
+                onFilter = board::filter,
+                onReorder = board::reorder,
                onCompose = board::compose,
                onToggleItem = board::toggleItem,
+                // The SAME seam the editor uses. `onEditorAction` is already the
+                // exhaustive dispatcher for every action a note has, and it takes
+                // the note to act on rather than reading the open one — so the board
+                // can hand it a card without a second dispatcher existing to drift.
+                onNoteAction = board::onEditorAction,
+                // Null unless there is genuinely something to say — the board is
+                // handed a decision, not a state to interpret.
+                update =
+                    update.state.available
+                        ?.takeIf { update.state.nagging }
+                        ?.let {
+                            BoardUpdate(
+                                version = it.version,
+                                busy = update.state.busy,
+                                onInstall = update::downloadAndInstall,
+                                onDismiss = update::dismissNag,
+                            )
+                        },
                onDismissError = board::dismissError,
            )
        }
    }

+    // Over whichever screen opened it; a ModalBottomSheet handles its own back.
+    if (share.state.noteId != null) {
+        ShareSheet(
+            state = share.state,
+            onShare = share::share,
+            onUnshare = share::unshare,
+            onDismiss = share::close,
+        )
+    }
+
    // The sync screen has no back handler of its own, so one lives here. The
    // editor keeps its own, because it has to save the open note before leaving.
    BackHandler(enabled = showingSync) { showingSync = false }
+    BackHandler(enabled = showingTags) { showingTags = false }
 }

 /**
@@ -243,7 +417,7 @@ private fun App(
 * notifications this app would send — is spending it on nothing.
 */
@Composable
-private fun ReminderAlarms(core: ThoughtSync) {
+private fun ReminderAlarms(core: Inkwell) {
    val context = LocalContext.current
    val scope = rememberCoroutineScope()
    // Off the main thread: this reads every note that has a reminder, and a phone
@@ -257,7 +431,7 @@ private fun ReminderAlarms(core: ThoughtSync) {
            refresh()
        }

-    ForegroundTransitions(onForeground = { refresh() }, onBackground = {})
+    ForegroundTransitions(onForeground = { refresh() })

    LaunchedEffect(Unit) {
        // TIRAMISU is where POST_NOTIFICATIONS became a runtime permission. Below
@@ -271,6 +445,28 @@ private fun ReminderAlarms(core: ThoughtSync) {
    }
 }

+/**
+ * Looking for an app update without being asked.
+ *
+ * Until this existed, `check()` had exactly one caller: a button on the sync screen.
+ * So a new build was found only by someone who went looking for one, and the operator
+ * had to remember to go looking — which is the same as not being told.
+ *
+ * On coming forward rather than on a timer: it is the moment the person is present,
+ * and the view model rate-limits so flicking between two apps is not a re-check.
+ * Unlinked devices are skipped entirely — updates come from a linked server, and
+ * there is nothing to ask.
+ */
+@Composable
+private fun AutomaticUpdate(
+    linked: Boolean,
+    onCheck: () -> Unit,
+) {
+    // Waits for a link rather than dropping the trip: linking a device while the app is
+    // in front checks as soon as it is linked.
+    OnEachForeground(ready = linked, act = onCheck)
+}
+
 /**
 * Syncing without being asked.
 *
@@ -305,28 +501,18 @@ private fun AutomaticSync(
        if (state.linked && enabled) SyncSchedule.enable(context) else SyncSchedule.disable(context)
    }

-    var wanted by remember { mutableStateOf(false) }
-    ForegroundTransitions(
-        onForeground = { wanted = true },
+    // Ready once `loading` is done, so the decision waits for the stored link to be
+    // READ. At first composition `linked` is still false because nothing has looked in
+    // the database yet, and acting on that would skip the sync on every cold start.
+    OnEachForeground(
+        ready = !state.loading,
        onBackground = {
            // Unsent work follows the person out of the app. Without this, a note
            // written on a phone that then goes into a pocket for the night does
            // not reach the desktop until the app is opened again by hand.
            if (enabled && state.linked && state.pending) SyncSchedule.pushSoon(context)
        },
-    )
-
-    // Keyed on `loading` so the decision waits for the stored link to be READ. At
-    // first composition `linked` is still false because nothing has looked in the
-    // database yet, and acting on that would skip the sync on every cold start.
-    LaunchedEffect(wanted, state.loading) {
-        if (!wanted || state.loading) return@LaunchedEffect
-        // Consumed here, so this fires exactly once per trip to the foreground
-        // however many times the effect restarts. Writing a key from inside the
-        // effect does restart it — but there is no suspension point between here
-        // and the call below, so the block runs to completion before the
-        // recomposition that would cancel it can be scheduled.
-        wanted = false
+    ) {
        val worthIt = state.pending || olderThan(state.status?.lastSyncAt, STALE_MINUTES)
        if (enabled && state.linked && worthIt) onSync()
    }
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync
+package com.fabledsword.inkwell

 import android.app.NotificationChannel
 import android.app.NotificationManager
@@ -8,7 +8,7 @@ import android.content.Intent
 import android.util.Log
 import androidx.core.app.NotificationCompat
 import androidx.core.app.NotificationManagerCompat
-import com.fabledsword.thoughtsync.core.Note
+import com.fabledsword.inkwell.core.Note

 /**
 * What a due reminder looks like in the shade.
@@ -117,5 +117,5 @@ internal object ReminderNotification {
        )

    private const val CHANNEL = "reminders"
-    private const val TAG = "ThoughtSyncReminders"
+    private const val TAG = LogTag.REMINDERS
 }
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync
+package com.fabledsword.inkwell

 import android.content.BroadcastReceiver
 import android.content.Context
@@ -36,7 +36,7 @@ class ReminderReceiver : BroadcastReceiver() {
        context: Context,
        intent: Intent,
    ) {
-        val core = (context.applicationContext as? ThoughtSyncApplication)?.core ?: return
+        val core = (context.applicationContext as? InkwellApplication)?.core ?: return
        val action = intent.action
        val noteId = intent.getStringExtra(Reminders.EXTRA_NOTE_ID)
        val app = context.applicationContext
@@ -64,9 +64,9 @@ class ReminderReceiver : BroadcastReceiver() {
    }

    companion object {
-        const val ACTION_DUE = "com.fabledsword.thoughtsync.REMINDER_DUE"
-        const val ACTION_DONE = "com.fabledsword.thoughtsync.REMINDER_DONE"
-        const val ACTION_SNOOZE = "com.fabledsword.thoughtsync.REMINDER_SNOOZE"
-        private const val TAG = "ThoughtSyncReminders"
+        const val ACTION_DUE = "com.fabledsword.inkwell.REMINDER_DUE"
+        const val ACTION_DONE = "com.fabledsword.inkwell.REMINDER_DONE"
+        const val ACTION_SNOOZE = "com.fabledsword.inkwell.REMINDER_SNOOZE"
+        private const val TAG = LogTag.REMINDERS
    }
 }
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync
+package com.fabledsword.inkwell

 import android.app.AlarmManager
 import android.app.PendingIntent
@@ -7,9 +7,10 @@ import android.content.Intent
 import android.os.Build
 import android.util.Log
 import androidx.core.app.NotificationManagerCompat
-import com.fabledsword.thoughtsync.core.Note
-import com.fabledsword.thoughtsync.core.ThoughtSync
-import java.time.OffsetDateTime
+import com.fabledsword.inkwell.core.Inkwell
+import com.fabledsword.inkwell.core.Note
+import com.fabledsword.inkwell.ui.SNOOZE_HOUR
+import com.fabledsword.inkwell.ui.epochMillis

 /**
 * Getting a reminder in front of someone at the time they asked for.
@@ -51,8 +52,7 @@ object Reminders {
     */
    private const val MISSED_WINDOW_MS = 24L * 60 * 60 * 1000

-    private const val SNOOZE_MINUTES = 60L
-    private const val TAG = "ThoughtSyncReminders"
+    private const val TAG = LogTag.REMINDERS

    /**
     * Announce what is due, then schedule the next one.
@@ -63,7 +63,7 @@ object Reminders {
     */
    fun refresh(
        context: Context,
-        core: ThoughtSync,
+        core: Inkwell,
    ) {
        ReminderNotification.ensureChannel(context)
        val notes =
@@ -111,7 +111,7 @@ object Reminders {
     */
    fun promptToNotifyDue(
        context: Context,
-        core: ThoughtSync,
+        core: Inkwell,
    ): Boolean =
        !Announced(context).askedToNotify &&
            !NotificationManagerCompat.from(context).areNotificationsEnabled() &&
@@ -123,7 +123,7 @@ object Reminders {
    /** Clear the reminder, as the notification's Done action. */
    fun complete(
        context: Context,
-        core: ThoughtSync,
+        core: Inkwell,
        noteId: String,
    ) {
        runCatching { core.completeReminder(noteId) }
@@ -134,10 +134,10 @@ object Reminders {
    /** Push the reminder an hour out, as the notification's Snooze action. */
    fun snooze(
        context: Context,
-        core: ThoughtSync,
+        core: Inkwell,
        noteId: String,
    ) {
-        runCatching { core.snoozeReminder(noteId, SNOOZE_MINUTES) }
+        runCatching { core.snoozeReminder(noteId, SNOOZE_HOUR) }
            .onFailure { Log.w(TAG, "could not snooze reminder", it) }
        ReminderNotification.dismiss(context, noteId)
    }
@@ -194,10 +194,7 @@ object Reminders {
    // ──────────────────────────────  bookkeeping  ──────────────────────────────

    /** Epoch millis of a note's reminder, or null if it has none we can read. */
-    private fun at(note: Note): Long? =
-        note.remindAt?.let {
-            runCatching { OffsetDateTime.parse(it).toInstant().toEpochMilli() }.getOrNull()
-        }
+    private fun at(note: Note): Long? = note.remindAt?.let(::epochMillis)

    /**
     * Identity of one OCCURRENCE, not of the note.
@@ -237,7 +234,7 @@ private class Announced(
    fun markAsked() = prefs.edit().putBoolean(KEY_ASKED, true).apply()

    private companion object {
-        const val FILE = "thoughtsync-reminders"
+        const val FILE = "inkwell-reminders"
        const val KEY_SEEN = "announced"
        const val KEY_PRIMED = "primed"
        const val KEY_ASKED = "asked_to_notify"
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync
+package com.fabledsword.inkwell

 import android.content.Context
 import androidx.work.BackoffPolicy
@@ -9,6 +9,7 @@ import androidx.work.NetworkType
 import androidx.work.OneTimeWorkRequestBuilder
 import androidx.work.PeriodicWorkRequestBuilder
 import androidx.work.WorkManager
+import androidx.work.WorkRequest
 import java.util.concurrent.TimeUnit

 /**
@@ -38,8 +39,7 @@ object SyncSchedule {
    fun enable(context: Context) {
        val request =
            PeriodicWorkRequestBuilder<SyncWorker>(PERIOD_MINUTES, TimeUnit.MINUTES)
-                .setConstraints(networkRequired())
-                .setBackoffCriteria(BackoffPolicy.EXPONENTIAL, BACKOFF_SECONDS, TimeUnit.SECONDS)
+                .online()
                .build()

        // UPDATE, not KEEP: this is called on every launch, and KEEP would ignore
@@ -68,8 +68,7 @@ object SyncSchedule {
    fun pushSoon(context: Context) {
        val request =
            OneTimeWorkRequestBuilder<SyncWorker>()
-                .setConstraints(networkRequired())
-                .setBackoffCriteria(BackoffPolicy.EXPONENTIAL, BACKOFF_SECONDS, TimeUnit.SECONDS)
+                .online()
                .build()

        // REPLACE rather than KEEP: if an earlier attempt is sitting in a long
@@ -79,14 +78,17 @@ object SyncSchedule {
            .enqueueUniqueWork(PUSH, ExistingWorkPolicy.REPLACE, request)
    }

-    private fun networkRequired(): Constraints =
-        Constraints
-            .Builder()
-            .setRequiredNetworkType(NetworkType.CONNECTED)
-            .build()
+    /** What both requests share: a network to run on, and the same backoff. */
+    private fun <B : WorkRequest.Builder<B, *>> B.online(): B =
+        setConstraints(
+            Constraints
+                .Builder()
+                .setRequiredNetworkType(NetworkType.CONNECTED)
+                .build(),
+        ).setBackoffCriteria(BackoffPolicy.EXPONENTIAL, BACKOFF_SECONDS, TimeUnit.SECONDS)

-    private const val PERIODIC = "thoughtsync-periodic-sync"
-    private const val PUSH = "thoughtsync-push-pending"
+    private const val PERIODIC = "inkwell-periodic-sync"
+    private const val PUSH = "inkwell-push-pending"

    /** WorkManager's own minimum for periodic work. Asking for less gets this. */
    private const val PERIOD_MINUTES = 15L
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync
+package com.fabledsword.inkwell

 import android.content.Context

@@ -38,7 +38,7 @@ class SyncSettings(
        }

    private companion object {
-        const val FILE = "thoughtsync-sync"
+        const val FILE = "inkwell-sync"
        const val KEY_AUTOMATIC = "automatic"
    }
 }
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync
+package com.fabledsword.inkwell

 import android.content.Context
 import android.util.Log
@@ -8,7 +8,7 @@ import androidx.work.WorkerParameters
 /**
 * One sync cycle, run by the system rather than by a person.
 *
- * WorkManager may start the process to run this, which means [ThoughtSyncApplication.onCreate]
+ * WorkManager may start the process to run this, which means [InkwellApplication.onCreate]
 * has already opened the store by the time [doWork] is called — the same handle
 * the UI uses, so there is never a second SQLite connection racing the first.
 *
@@ -30,7 +30,7 @@ class SyncWorker(
    params: WorkerParameters,
 ) : CoroutineWorker(context, params) {
    override suspend fun doWork(): Result {
-        val core = (applicationContext as? ThoughtSyncApplication)?.core
+        val core = (applicationContext as? InkwellApplication)?.core

        // Both of these are "nothing to do", not "something went wrong", so both
        // report success and let the run retire quietly:
@@ -67,6 +67,6 @@ class SyncWorker(
    }

    private companion object {
-        const val TAG = "ThoughtSyncWorker"
+        const val TAG = LogTag.WORKER
    }
 }
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync
+package com.fabledsword.inkwell

 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync
+package com.fabledsword.inkwell

 import android.content.BroadcastReceiver
 import android.content.Context
@@ -71,7 +71,7 @@ class UpdateReceiver : BroadcastReceiver() {
    }

    companion object {
-        const val ACTION_INSTALLED = "com.fabledsword.thoughtsync.UPDATE_INSTALLED"
-        private const val TAG = "ThoughtSyncUpdate"
+        const val ACTION_INSTALLED = "com.fabledsword.inkwell.UPDATE_INSTALLED"
+        private const val TAG = LogTag.UPDATE
    }
 }
@@ -0,0 +1,264 @@
+package com.fabledsword.inkwell.ui
+
+import android.content.Context
+import android.content.Intent
+import android.database.Cursor
+import android.graphics.Bitmap
+import android.graphics.BitmapFactory
+import android.graphics.Matrix
+import android.media.ExifInterface
+import android.net.Uri
+import android.provider.OpenableColumns
+import android.util.LruCache
+import androidx.compose.runtime.staticCompositionLocalOf
+import androidx.compose.ui.graphics.ImageBitmap
+import androidx.compose.ui.graphics.asImageBitmap
+import androidx.core.content.FileProvider
+import com.fabledsword.inkwell.R
+import com.fabledsword.inkwell.core.Attachment
+import com.fabledsword.inkwell.core.Inkwell
+import java.io.ByteArrayOutputStream
+import java.io.File
+import java.io.IOException
+import java.io.InputStream
+
+/**
+ * A file picked or shared into the app, read and ready to attach — or the reason
+ * it could not be.
+ */
+sealed interface PickedFile {
+    // A plain class: a data class would compare `bytes` by identity, and nothing
+    // here compares two picked files anyway.
+    class Ready(
+        val name: String,
+        val mime: String,
+        val bytes: ByteArray,
+    ) : PickedFile
+
+    data class Refused(
+        val reason: String,
+    ) : PickedFile
+}
+
+/** What [AttachmentFiles.opener] made: an intent to start, or why there isn't one. */
+sealed interface Opener {
+    data class Ready(
+        val intent: Intent,
+    ) : Opener
+
+    data class Failed(
+        val message: String,
+    ) : Opener
+}
+
+/**
+ * Everything the app does with attachment FILES, as opposed to attachment rows:
+ * reading a picked file, decoding an image for display, and handing a file to
+ * another app to open.
+ *
+ * Holds the application context, never an Activity, so the board's view model can
+ * keep a reference to [read] without leaking a screen.
+ */
+class AttachmentFiles(
+    context: Context,
+    private val core: Inkwell,
+) {
+    private val app = context.applicationContext
+
+    /**
+     * Decoded images, keyed by hash and size. Sized in bytes against an eighth of
+     * the heap, which is the platform's own guidance for an in-memory image cache.
+     */
+    private val images =
+        object : LruCache<String, ImageBitmap>(cacheBytes()) {
+            override fun sizeOf(
+                key: String,
+                value: ImageBitmap,
+            ): Int = value.width * value.height * BYTES_PER_PIXEL
+        }
+
+    /**
+     * Read a picked or shared file, all of it, with its name and type.
+     *
+     * Blocking; call it off the main thread. Refuses anything over
+     * [MAX_ATTACH_MB] — before reading it when the sender says how big it is — so
+     * a long video shared by mistake is a message rather than an out-of-memory
+     * crash.
+     */
+    fun read(uri: Uri): PickedFile {
+        val (label, declared) = describe(uri)
+        val overDeclared = (declared ?: 0) > MAX_ATTACH_BYTES
+        val bytes = if (overDeclared) null else readCapped(uri)
+        return when {
+            overDeclared -> tooLarge(label)
+            bytes == null -> PickedFile.Refused(app.getString(R.string.attach_unreadable, label))
+            bytes.size > MAX_ATTACH_BYTES -> tooLarge(label)
+            else -> PickedFile.Ready(label, app.contentResolver.getType(uri) ?: GENERIC_MIME, bytes)
+        }
+    }
+
+    /**
+     * The image, decoded no larger than it will be drawn, or null when this device
+     * doesn't hold the file yet or it isn't an image Android can read.
+     *
+     * Blocking; call it off the main thread.
+     */
+    fun image(
+        attachment: Attachment,
+        maxPx: Int,
+    ): ImageBitmap? {
+        val sha = attachment.sha256 ?: return null
+        val key = "$sha@$maxPx"
+        return images.get(key)
+            ?: core.blobPath(sha)?.let { decode(it, maxPx) }?.also { images.put(key, it) }
+    }
+
+    /**
+     * An intent that hands the file to whatever app opens its type, or the reason
+     * there can't be one.
+     *
+     * Copied out of the blob store first, under its real name: the store names files
+     * by hash with no extension, and a viewer shown `3f2a…` cannot tell a PDF from a
+     * spreadsheet. The copy lives in the cache, which the system reclaims, and only
+     * that directory is shared (`res/xml/file_paths.xml`).
+     *
+     * Blocking; call it off the main thread, then start the intent from a screen.
+     */
+    fun opener(attachment: Attachment): Opener {
+        val source = attachment.sha256?.let { core.blobPath(it) }?.let(::File)
+        if (source == null) return Opener.Failed(app.getString(R.string.attach_not_here))
+        val dir = File(app.cacheDir, "$OPEN_DIR/${attachment.id}")
+        val copy = File(dir, safeName(attachment.filename))
+        return try {
+            dir.mkdirs()
+            if (!copy.isFile || copy.length() != source.length()) source.copyTo(copy, overwrite = true)
+            val uri = FileProvider.getUriForFile(app, "${app.packageName}.files", copy)
+            val view =
+                Intent(Intent.ACTION_VIEW)
+                    .setDataAndType(uri, attachment.mime)
+                    .addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
+            Opener.Ready(view)
+        } catch (e: IOException) {
+            Opener.Failed(app.getString(R.string.attach_open_failed, e.message ?: attachment.filename.orEmpty()))
+        }
+    }
+
+    /** The name the sender gives the file and the size it declares, when it does. */
+    private fun describe(uri: Uri): Pair<String, Long?> {
+        val row =
+            try {
+                app.contentResolver.query(uri, COLUMNS, null, null, null)?.use { firstRow(it) }
+            } catch (expected: SecurityException) {
+                // No grant to read it at all; the read that follows says so.
+                null
+            }
+        val name = row?.first?.takeIf { it.isNotBlank() } ?: uri.lastPathSegment ?: FALLBACK_NAME
+        return name to row?.second
+    }
+
+    /**
+     * The file's bytes, at most one past the cap — enough to know it is over without
+     * reading the rest — or null when it can't be read.
+     */
+    private fun readCapped(uri: Uri): ByteArray? =
+        try {
+            app.contentResolver.openInputStream(uri)?.use { it.readUpTo(MAX_ATTACH_BYTES + 1) }
+        } catch (expected: IOException) {
+            null
+        } catch (expected: SecurityException) {
+            null
+        }
+
+    private fun tooLarge(label: String) =
+        PickedFile.Refused(app.getString(R.string.attach_too_large, label, MAX_ATTACH_MB))
+
+    private companion object {
+        const val BYTES_PER_PIXEL = 4
+        const val CACHE_FRACTION = 8
+        const val OPEN_DIR = "open"
+        const val GENERIC_MIME = "application/octet-stream"
+        const val FALLBACK_NAME = "file"
+        val COLUMNS = arrayOf(OpenableColumns.DISPLAY_NAME, OpenableColumns.SIZE)
+
+        /** How far each EXIF orientation is turned from upright. */
+        val ROTATIONS =
+            mapOf(
+                ExifInterface.ORIENTATION_ROTATE_90 to 90f,
+                ExifInterface.ORIENTATION_ROTATE_180 to 180f,
+                ExifInterface.ORIENTATION_ROTATE_270 to 270f,
+            )
+
+        /** DISPLAY_NAME and SIZE from the first row of a [COLUMNS] query; either may be absent. */
+        fun firstRow(cursor: Cursor): Pair<String?, Long?>? =
+            if (cursor.moveToFirst()) {
+                cursor.getString(0) to (if (cursor.isNull(1)) null else cursor.getLong(1))
+            } else {
+                null
+            }
+
+        fun cacheBytes(): Int =
+            (Runtime.getRuntime().maxMemory() / CACHE_FRACTION)
+                .coerceAtMost(Int.MAX_VALUE.toLong())
+                .toInt()
+
+        fun decode(
+            path: String,
+            maxPx: Int,
+        ): ImageBitmap? {
+            val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
+            BitmapFactory.decodeFile(path, bounds)
+            if (bounds.outWidth <= 0 || bounds.outHeight <= 0) return null
+            val options =
+                BitmapFactory.Options().apply {
+                    inSampleSize = sampleSize(bounds.outWidth, bounds.outHeight, maxPx)
+                }
+            return BitmapFactory.decodeFile(path, options)?.let { upright(it, path).asImageBitmap() }
+        }
+
+        /** Camera photos are stored sideways with a tag saying so; BitmapFactory ignores it. */
+        fun upright(
+            bitmap: Bitmap,
+            path: String,
+        ): Bitmap {
+            val orientation =
+                try {
+                    ExifInterface(path).getAttributeInt(ExifInterface.TAG_ORIENTATION, 0)
+                } catch (expected: IOException) {
+                    // No readable EXIF: draw it as stored.
+                    0
+                }
+            val degrees = ROTATIONS[orientation] ?: return bitmap
+            val turn = Matrix().apply { postRotate(degrees) }
+            return Bitmap.createBitmap(bitmap, 0, 0, bitmap.width, bitmap.height, turn, true)
+        }
+    }
+}
+
+/**
+ * The app's [AttachmentFiles], for the card and the editor. Null in previews and
+ * anywhere it was never provided, where attachments draw as plain file rows.
+ */
+val LocalAttachmentFiles = staticCompositionLocalOf<AttachmentFiles?> { null }
+
+/**
+ * The largest file the phone will attach. Read whole into memory and copied once
+ * into the core, so the cap is about the phone's heap. The server has its own
+ * limit (25 MB by default, `max_attachment_mb`); a file over that one is kept here
+ * and its upload reported as refused.
+ */
+const val MAX_ATTACH_MB = 50
+private const val MAX_ATTACH_BYTES = MAX_ATTACH_MB * 1024 * 1024
+
+/** `InputStream.readNBytes(int)` is API 33; this app supports 26. */
+private fun InputStream.readUpTo(limit: Int): ByteArray {
+    val out = ByteArrayOutputStream()
+    val buffer = ByteArray(DEFAULT_BUFFER_SIZE)
+    var total = 0
+    while (total < limit) {
+        val read = read(buffer, 0, minOf(buffer.size, limit - total))
+        if (read < 0) break
+        out.write(buffer, 0, read)
+        total += read
+    }
+    return out.toByteArray()
+}
@@ -0,0 +1,56 @@
+package com.fabledsword.inkwell.ui
+
+import java.util.Locale
+import kotlin.math.max
+import kotlin.math.roundToInt
+
+// The attachment decisions that need no Android: which files draw as pictures, how
+// far to scale a decode, what to name a copy, how to print a size. Kept apart from
+// AttachmentFiles so the JVM unit tests can load them without a device.
+
+/**
+ * Whether a type is drawn as a picture rather than offered as a file. SVG is
+ * excluded on every surface: it is a document that can carry script (#1981).
+ * The same rule as `rendersInline` in the web's `notes/attachments.ts`.
+ */
+fun rendersInline(mime: String): Boolean {
+    val type = mime.lowercase().substringBefore(';').trim()
+    return type.startsWith("image/") && type != "image/svg+xml"
+}
+
+/**
+ * The power-of-two step BitmapFactory decodes at, so the result's longer side is
+ * still at least [maxPx]: never upscaled on screen, never decoded at full camera
+ * resolution for a thumbnail.
+ */
+fun sampleSize(
+    width: Int,
+    height: Int,
+    maxPx: Int,
+): Int {
+    val longest = max(width, height)
+    var sample = 1
+    while (longest / (sample * 2) >= maxPx) sample *= 2
+    return sample
+}
+
+/** A name safe to create in the cache: no path separators, never empty. */
+fun safeName(filename: String?): String {
+    val base =
+        filename
+            ?.substringAfterLast('/')
+            ?.substringAfterLast('\\')
+            ?.trim()
+            .orEmpty()
+    return base.takeIf { it.isNotEmpty() && it != "." && it != ".." } ?: "file"
+}
+
+/** "12 KB", "3.4 MB" — the same rounding as `fmtSize` in the web's NoteEditor.vue. */
+fun sizeLabel(bytes: Long): String =
+    when {
+        bytes < KIB -> "$bytes B"
+        bytes < KIB * KIB -> "${(bytes / KIB).roundToInt()} KB"
+        else -> "%.1f MB".format(Locale.ROOT, bytes / (KIB * KIB))
+    }
+
+private const val KIB = 1024.0
@@ -0,0 +1,336 @@
+package com.fabledsword.inkwell.ui
+
+import android.content.ActivityNotFoundException
+import android.content.Context
+import android.widget.Toast
+import androidx.compose.foundation.Image
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.aspectRatio
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.produceState
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.ImageBitmap
+import androidx.compose.ui.layout.ContentScale
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.res.painterResource
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import com.fabledsword.inkwell.R
+import com.fabledsword.inkwell.core.Attachment
+import com.fabledsword.inkwell.core.LinkPreview
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+private val ATTACHMENT_RADIUS = 8.dp
+
+/**
+ * Decoded no larger than this on the card. A board column on a phone is around
+ * 180dp wide, which is about 540px at the common densities, so this is sharp on
+ * every screen the app runs on without decoding a 12-megapixel photo for it.
+ */
+private const val CARD_IMAGE_PX = 640
+
+/** The editor draws images at the sheet's full width. */
+private const val EDITOR_IMAGE_PX = 1440
+
+/**
+ * The narrowest an image may draw, as width over height. A tall screenshot drawn
+ * at its own ratio would push the rest of the card off the board, so it is cropped
+ * to 3:4 instead; anything wider than that draws whole.
+ */
+private const val MIN_ASPECT = 0.75f
+
+/** How many file names the card lists before it says "and N more". */
+private const val CARD_FILE_ROWS = 2
+
+/**
+ * A note's attachments on its board card: the first image as a picture, then the
+ * other files by name.
+ *
+ * One picture, not a gallery. The card is a glance at the note, and a strip of
+ * thumbnails would make an image note the tallest thing on the board whatever its
+ * words say. The editor shows them all.
+ */
+@Composable
+fun CardAttachments(attachments: List<Attachment>) {
+    val (images, files) = attachments.partition { rendersInline(it.mime) }
+    images.firstOrNull()?.let { first ->
+        Spacer(Modifier.height(8.dp))
+        AttachmentImage(attachment = first, maxPx = CARD_IMAGE_PX) {
+            FileRow(attachment = first)
+        }
+    }
+    val rest = images.drop(1) + files
+    rest.take(CARD_FILE_ROWS).forEach { file ->
+        Spacer(Modifier.height(4.dp))
+        FileRow(attachment = file)
+    }
+    if (rest.size > CARD_FILE_ROWS) {
+        Text(
+            text = stringResource(R.string.attach_more, rest.size - CARD_FILE_ROWS),
+            style = MaterialTheme.typography.labelSmall,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+            modifier = Modifier.padding(top = 2.dp),
+        )
+    }
+}
+
+/**
+ * Every attachment, in the editor: images at full width, files as rows, each one
+ * opening with the system and each removable.
+ *
+ * A file the server refused says so under it, in its own words — the upload is
+ * not retried, so without this a file that never reaches the other devices would
+ * look exactly like one that did.
+ */
+@Composable
+fun EditorAttachments(
+    attachments: List<Attachment>,
+    readOnly: Boolean,
+    onAction: (EditorAction) -> Unit,
+) {
+    val open = rememberOpener()
+    Column(modifier = Modifier.padding(top = 12.dp)) {
+        attachments.forEach { attachment ->
+            val remove = { onAction(EditorAction.RemoveAttachment(attachment.id)) }
+            Box(modifier = Modifier.padding(vertical = 4.dp)) {
+                if (rendersInline(attachment.mime)) {
+                    AttachmentImage(
+                        attachment = attachment,
+                        maxPx = EDITOR_IMAGE_PX,
+                        onClick = { open(attachment) },
+                    ) {
+                        FileRow(attachment = attachment, onClick = { open(attachment) })
+                    }
+                } else {
+                    FileRow(attachment = attachment, onClick = { open(attachment) })
+                }
+                if (!readOnly) {
+                    IconButton(
+                        onClick = remove,
+                        modifier =
+                            Modifier
+                                .align(Alignment.TopEnd)
+                                .padding(4.dp)
+                                .size(32.dp)
+                                .clip(CircleShape)
+                                .background(MaterialTheme.colorScheme.surface),
+                    ) {
+                        Icon(
+                            Icons.Filled.Close,
+                            contentDescription = stringResource(R.string.attach_remove),
+                        )
+                    }
+                }
+            }
+            attachment.uploadError?.let { reason ->
+                Text(
+                    text = stringResource(R.string.attach_refused, reason),
+                    style = MaterialTheme.typography.labelSmall,
+                    color = MaterialTheme.colorScheme.error,
+                )
+            }
+        }
+    }
+}
+
+/**
+ * The note's link previews in the editor, each dismissable.
+ *
+ * Dismissing is the only control: the server made the preview and will not make
+ * it again, so removing one is a decision about this note rather than a refresh.
+ */
+@Composable
+fun EditorPreviews(
+    previews: List<LinkPreview>,
+    readOnly: Boolean,
+    onAction: (EditorAction) -> Unit,
+) {
+    Column(modifier = Modifier.padding(top = 12.dp)) {
+        previews.forEach { preview ->
+            Row(
+                verticalAlignment = Alignment.CenterVertically,
+                modifier = Modifier.padding(vertical = 2.dp),
+            ) {
+                LinkPreviewCard(preview = preview, compact = true, modifier = Modifier.weight(1f))
+                if (!readOnly) {
+                    IconButton(onClick = { onAction(EditorAction.RemovePreview(preview.id)) }) {
+                        Icon(
+                            Icons.Filled.Close,
+                            contentDescription = stringResource(R.string.preview_remove),
+                        )
+                    }
+                }
+            }
+        }
+    }
+}
+
+/** Loading, drawn, or not drawable (not downloaded yet, or not an image Android reads). */
+private sealed interface ImageLoad {
+    data object Loading : ImageLoad
+
+    data class Ready(
+        val bitmap: ImageBitmap,
+    ) : ImageLoad
+
+    data object Missing : ImageLoad
+}
+
+/**
+ * An attachment drawn as a picture, decoded off the main thread.
+ *
+ * [fallback] is what draws when it can't be: a file this device hasn't downloaded
+ * yet, or bytes that don't decode. It is a file row, so the note still shows that
+ * something is attached instead of a gap.
+ */
+@Composable
+private fun AttachmentImage(
+    attachment: Attachment,
+    maxPx: Int,
+    onClick: (() -> Unit)? = null,
+    fallback: @Composable () -> Unit,
+) {
+    val files = LocalAttachmentFiles.current
+    val load by produceState<ImageLoad>(ImageLoad.Loading, attachment.sha256, maxPx, files) {
+        val bitmap = files?.let { withContext(Dispatchers.IO) { it.image(attachment, maxPx) } }
+        value = bitmap?.let { ImageLoad.Ready(it) } ?: ImageLoad.Missing
+    }
+    val shape = RoundedCornerShape(ATTACHMENT_RADIUS)
+    when (val state = load) {
+        ImageLoad.Loading ->
+            Box(
+                modifier =
+                    Modifier
+                        .fillMaxWidth()
+                        .aspectRatio(4f / 3f)
+                        .clip(shape)
+                        .background(MaterialTheme.colorScheme.surfaceVariant),
+            )
+        is ImageLoad.Ready -> {
+            val ratio = (state.bitmap.width.toFloat() / state.bitmap.height).coerceAtLeast(MIN_ASPECT)
+            val tap = onClick?.let { Modifier.clickable(onClick = it) } ?: Modifier
+            Image(
+                bitmap = state.bitmap,
+                contentDescription = attachment.filename,
+                contentScale = ContentScale.Crop,
+                modifier =
+                    Modifier
+                        .fillMaxWidth()
+                        .aspectRatio(ratio)
+                        .clip(shape)
+                        .then(tap),
+            )
+        }
+        ImageLoad.Missing -> fallback()
+    }
+}
+
+/** A file by name and size, behind a paperclip. Tappable in the editor, not on the card. */
+@Composable
+private fun FileRow(
+    attachment: Attachment,
+    onClick: (() -> Unit)? = null,
+) {
+    val shape = RoundedCornerShape(ATTACHMENT_RADIUS)
+    val tap = onClick?.let { Modifier.clickable(onClick = it) } ?: Modifier
+    Row(
+        verticalAlignment = Alignment.CenterVertically,
+        modifier =
+            Modifier
+                .fillMaxWidth()
+                .clip(shape)
+                .border(1.dp, MaterialTheme.colorScheme.outlineVariant, shape)
+                .then(tap)
+                .padding(horizontal = 8.dp, vertical = 6.dp),
+    ) {
+        Icon(
+            painter = painterResource(R.drawable.ic_attach),
+            contentDescription = null,
+            tint = MaterialTheme.colorScheme.onSurfaceVariant,
+            modifier = Modifier.size(16.dp),
+        )
+        Spacer(Modifier.width(6.dp))
+        Text(
+            text = attachment.filename?.takeIf { it.isNotBlank() } ?: stringResource(R.string.attach_unnamed),
+            style = MaterialTheme.typography.bodySmall,
+            maxLines = 1,
+            overflow = TextOverflow.Ellipsis,
+            modifier = Modifier.weight(1f),
+        )
+        attachment.size?.let { bytes ->
+            Text(
+                text = sizeLabel(bytes),
+                style = MaterialTheme.typography.labelSmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                // Clear of the editor's remove button, which sits over this corner.
+                modifier = Modifier.padding(start = 8.dp, end = if (onClick != null) 32.dp else 0.dp),
+            )
+        }
+    }
+}
+
+/**
+ * Open an attachment with whatever app handles its type, or say why not.
+ *
+ * The copy out of the blob store runs on IO; the activity starts on the main
+ * thread, from the screen's own context, so the viewer opens over this app rather
+ * than in a task of its own.
+ */
+@Composable
+private fun rememberOpener(): (Attachment) -> Unit {
+    val files = LocalAttachmentFiles.current
+    val context = LocalContext.current
+    val scope = rememberCoroutineScope()
+    return { attachment ->
+        if (files != null) {
+            scope.launch {
+                when (val opener = withContext(Dispatchers.IO) { files.opener(attachment) }) {
+                    is Opener.Ready -> start(context, opener)
+                    is Opener.Failed -> toast(context, opener.message)
+                }
+            }
+        }
+    }
+}
+
+private fun start(
+    context: Context,
+    opener: Opener.Ready,
+) {
+    try {
+        context.startActivity(opener.intent)
+    } catch (expected: ActivityNotFoundException) {
+        toast(context, context.getString(R.string.attach_no_app))
+    }
+}
+
+private fun toast(
+    context: Context,
+    message: String,
+) = Toast.makeText(context, message, Toast.LENGTH_SHORT).show()
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import androidx.annotation.StringRes
 import androidx.compose.foundation.layout.Arrangement
@@ -14,15 +14,18 @@ import androidx.compose.material.icons.filled.Close
 import androidx.compose.material3.Checkbox
 import androidx.compose.material3.Icon
 import androidx.compose.material3.IconButton
+import androidx.compose.material3.LocalMinimumInteractiveComponentSize
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.CompositionLocalProvider
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.remember
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.focus.FocusRequester
 import androidx.compose.ui.focus.focusRequester
+import androidx.compose.ui.focus.onFocusChanged
 import androidx.compose.ui.graphics.SolidColor
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.TextStyle
@@ -30,7 +33,7 @@ import androidx.compose.ui.text.input.ImeAction
 import androidx.compose.ui.text.input.TextFieldValue
 import androidx.compose.ui.text.style.TextDecoration
 import androidx.compose.ui.unit.dp
-import com.fabledsword.thoughtsync.R
+import com.fabledsword.inkwell.R

 /**
 * The note's body, as fields and checkboxes rather than as markup.
@@ -97,24 +100,45 @@ fun BlockBody(
                    readOnly = readOnly,
                    requester = requester,
                    onChange = { replace(index, it) },
+                    onBlur = {
+                        // Compared by IDENTITY, not equality: `promotingTasks` hands
+                        // back the same list when there was nothing to promote, and a
+                        // blur that changed nothing must not touch the state at all.
+                        val promoted = blocks.promotingTasks(index)
+                        if (promoted !== blocks) onChange(promoted)
+                    },
                )
            }
        }
    }
 }

-/** A run of prose: one ordinary multi-line field, exactly as the editor always had. */
+/**
+ * A run of prose: one ordinary multi-line field, exactly as the editor always had.
+ *
+ * Leaving it is when a `- [ ] ` typed by hand becomes a real checklist item — see
+ * [promotingTasks] for why blur is the only safe moment to do that.
+ *
+ * `onFocusChanged` also fires with `isFocused = false` on the first composition, before
+ * the field has ever held focus. Deliberately not guarded: [splitBlocks] ran when the
+ * editor opened, so a prose block nobody has typed in cannot contain a task line, and
+ * the promotion is a no-op that the caller's identity check drops on the floor.
+ */
@Composable
 private fun ProseBlock(
    block: EditorBlock,
    readOnly: Boolean,
    requester: FocusRequester,
    onChange: (EditorBlock) -> Unit,
+    onBlur: () -> Unit,
 ) {
    BlockField(
        value = block.value,
        onValueChange = { onChange(block.copy(value = it)) },
-        modifier = Modifier.focusRequester(requester),
+        modifier =
+            Modifier
+                .focusRequester(requester)
+                .onFocusChanged { if (!it.isFocused) onBlur() },
        enabled = !readOnly,
        hint = R.string.editor_body_hint,
    )
@@ -136,38 +160,54 @@ private fun TaskBlock(
    onEnter: () -> Unit,
    onDelete: () -> Unit,
 ) {
-    Row(verticalAlignment = Alignment.CenterVertically) {
-        Checkbox(
-            checked = block.checked == true,
-            onCheckedChange = { onChange(block.copy(checked = it)) },
-            enabled = !readOnly,
-        )
-        BlockField(
-            value = block.value,
-            onValueChange = { onChange(block.copy(value = it)) },
-            modifier = Modifier.weight(1f).focusRequester(requester),
-            enabled = !readOnly,
-            singleLine = true,
-            textStyle =
-                MaterialTheme.typography.bodyLarge.copy(
-                    // Struck through when done, matching the card and the web.
-                    textDecoration =
-                        if (block.checked == true) TextDecoration.LineThrough else null,
-                ),
-            keyboardOptions = KeyboardOptions(imeAction = ImeAction.Next),
-            keyboardActions = KeyboardActions(onNext = { onEnter() }),
-        )
-        if (!readOnly) {
-            IconButton(onClick = onDelete) {
-                Icon(
-                    Icons.Filled.Close,
-                    contentDescription = stringResource(R.string.editor_remove_item),
-                )
+    // Material sizes every interactive component to a 48dp touch target, and on a
+    // checklist that IS the row height — which is why six items filled a phone screen
+    // even after the field's own padding came off.
+    CompositionLocalProvider(LocalMinimumInteractiveComponentSize provides ROW_TOUCH) {
+        Row(verticalAlignment = Alignment.CenterVertically) {
+            Checkbox(
+                checked = block.checked == true,
+                onCheckedChange = { onChange(block.copy(checked = it)) },
+                enabled = !readOnly,
+            )
+            BlockField(
+                value = block.value,
+                onValueChange = { onChange(block.copy(value = it)) },
+                modifier = Modifier.weight(1f).focusRequester(requester),
+                enabled = !readOnly,
+                singleLine = true,
+                textStyle =
+                    MaterialTheme.typography.bodyLarge.copy(
+                        // Struck through when done, matching the card and the web.
+                        textDecoration =
+                            if (block.checked == true) TextDecoration.LineThrough else null,
+                    ),
+                keyboardOptions = KeyboardOptions(imeAction = ImeAction.Next),
+                keyboardActions = KeyboardActions(onNext = { onEnter() }),
+            )
+            if (!readOnly) {
+                IconButton(onClick = onDelete) {
+                    Icon(
+                        Icons.Filled.Close,
+                        contentDescription = stringResource(R.string.editor_remove_item),
+                    )
+                }
            }
        }
    }
 }

+/**
+ * The touch target for a checklist row's controls.
+ *
+ * Material's floor is 48dp and this is deliberately under it. That floor is sized for
+ * a control somebody has to find; a checklist box sits in a predictable column with an
+ * identical box directly above and below, and the cost of a near miss is ticking the
+ * neighbouring item — visible, and undone by tapping again. Trading twelve of those
+ * dp for a list that fits on a screen is what was asked for, twice.
+ */
+private val ROW_TOUCH = 36.dp
+
 /**
 * The field a block is typed into.
 *
@@ -0,0 +1,190 @@
+package com.fabledsword.inkwell.ui
+
+import androidx.compose.foundation.gestures.awaitEachGesture
+import androidx.compose.foundation.gestures.awaitFirstDown
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.geometry.Offset
+import androidx.compose.ui.geometry.Rect
+import androidx.compose.ui.input.pointer.AwaitPointerEventScope
+import androidx.compose.ui.input.pointer.PointerEventPass
+import androidx.compose.ui.input.pointer.PointerId
+import androidx.compose.ui.input.pointer.PointerInputChange
+import androidx.compose.ui.input.pointer.pointerInput
+import androidx.compose.ui.layout.LayoutCoordinates
+import com.fabledsword.inkwell.core.Note
+
+// Reordering the board by dragging a card, as on the web (#5176): hold a card, then
+// move it. The hold is the same long press that opens the card's menu, so the menu
+// appears first and closes as the card starts to move. Lifting without moving
+// leaves the menu open, as before. Moving BEFORE the hold completes is a scroll.
+//
+// Watched on the Initial pass, ahead of the grid's scrolling and the card's own
+// click handling. Nothing is consumed until the hold has completed and the finger
+// has moved, so taps, long presses and scrolls all reach the grid and the card
+// untouched. After that point every change is consumed, so the grid cannot scroll
+// under a card that is being carried.
+
+/** A card being carried. Every offset is in root coordinates. */
+internal data class CardDrag(
+    val id: String,
+    /** Where the finger went down. */
+    val from: Offset,
+    /** Where the finger is now. */
+    val at: Offset,
+    /** Where the card's corner was when the drag began. */
+    val startTopLeft: Offset,
+) {
+    /** Where the card's corner should be drawn, so it stays under the finger. */
+    val topLeft: Offset get() = startTopLeft + (at - from)
+}
+
+/**
+ * Where each card on screen was last laid out, in root coordinates.
+ *
+ * A plain map rather than snapshot state: only the gesture reads it, so a write on
+ * every layout pass must not invalidate any composition.
+ */
+internal class CardBounds {
+    private val bounds = HashMap<String, Rect>()
+
+    fun record(
+        id: String,
+        rect: Rect,
+    ) {
+        bounds[id] = rect
+    }
+
+    fun forget(id: String) {
+        bounds.remove(id)
+    }
+
+    operator fun get(id: String): Rect? = bounds[id]
+
+    /** The card under [point], other than [except]. */
+    fun idAt(
+        point: Offset,
+        except: String? = null,
+    ): String? = bounds.entries.firstOrNull { (id, rect) -> id != except && rect.contains(point) }?.key
+}
+
+/** What the board does as a card is carried. Every offset is in root coordinates. */
+internal class CardCarrier(
+    val onStart: (id: String, at: Offset) -> Unit,
+    val onMove: (at: Offset) -> Unit,
+    /** Runs however the gesture finishes, cancelled included, so no card is left held. */
+    val onEnd: () -> Unit,
+)
+
+/**
+ * Carry a card: hold, then move.
+ *
+ * [toRoot] maps a position in this element to root coordinates, which is where
+ * [bounds] keeps the cards.
+ */
+internal fun Modifier.dragToReorder(
+    enabled: Boolean,
+    bounds: CardBounds,
+    toRoot: (Offset) -> Offset,
+    carrier: CardCarrier,
+): Modifier =
+    if (enabled) {
+        pointerInput(bounds) { awaitEachGesture { carry(bounds, toRoot, carrier) } }
+    } else {
+        this
+    }
+
+private suspend fun AwaitPointerEventScope.carry(
+    bounds: CardBounds,
+    toRoot: (Offset) -> Offset,
+    carrier: CardCarrier,
+) {
+    val down = awaitFirstDown(requireUnconsumed = false, pass = PointerEventPass.Initial)
+    val id = bounds.idAt(toRoot(down.position))
+    if (id == null || !holdsStill(down) || !movesAfterHold(down)) return
+    carrier.onStart(id, toRoot(down.position))
+    try {
+        followUntilUp(down.id) { carrier.onMove(toRoot(it)) }
+    } finally {
+        carrier.onEnd()
+    }
+}
+
+/** True when the finger stayed down and inside the touch slop for a long press. */
+private suspend fun AwaitPointerEventScope.holdsStill(down: PointerInputChange): Boolean {
+    val endedEarly =
+        withTimeoutOrNull(viewConfiguration.longPressTimeoutMillis) {
+            var ended = false
+            while (!ended) {
+                val change = awaitPointerEvent(PointerEventPass.Initial).changes.firstOrNull { it.id == down.id }
+                ended = change == null || !change.pressed || change.movedPast(down, viewConfiguration.touchSlop)
+            }
+        }
+    return endedEarly == null
+}
+
+/** After the hold: true once the finger moves past the slop, false if it lifts first. */
+private suspend fun AwaitPointerEventScope.movesAfterHold(down: PointerInputChange): Boolean {
+    var moved: Boolean? = null
+    while (moved == null) {
+        val change = awaitPointerEvent(PointerEventPass.Initial).changes.firstOrNull { it.id == down.id }
+        if (change == null || !change.pressed) {
+            moved = false
+        } else if (change.movedPast(down, viewConfiguration.touchSlop)) {
+            // Consumed so the grid's scrolling, which has not claimed this gesture
+            // yet, never does.
+            change.consume()
+            moved = true
+        }
+    }
+    return moved == true
+}
+
+/** Report every position until the finger lifts, consuming each change. */
+private suspend fun AwaitPointerEventScope.followUntilUp(
+    pointer: PointerId,
+    onMove: (Offset) -> Unit,
+) {
+    var pressed = true
+    while (pressed) {
+        val change = awaitPointerEvent(PointerEventPass.Initial).changes.firstOrNull { it.id == pointer }
+        pressed = change?.pressed == true
+        change?.consume()
+        if (change != null && pressed) onMove(change.position)
+    }
+}
+
+private fun PointerInputChange.movedPast(
+    down: PointerInputChange,
+    slop: Float,
+): Boolean = (position - down.position).getDistance() > slop
+
+/** The grid's own layout, so a position in it can be taken to root coordinates. */
+internal class GridOrigin {
+    var coords: LayoutCoordinates? = null
+}
+
+/**
+ * [order] with the carried card moved to the place of the card under the finger, the
+ * way the web's drop splices it. Unchanged when there is no card there, or when it is
+ * on the other side of the pinned line: the store sorts pinned notes first, so a
+ * card dropped across the line would only snap back.
+ */
+internal fun moved(
+    order: List<String>?,
+    drag: CardDrag,
+    bounds: CardBounds,
+    notes: List<Note>,
+): List<String>? {
+    val target = bounds.idAt(drag.at, except = drag.id)
+    val pinned = notes.associate { it.id to it.pinned }
+    val from = order?.indexOf(drag.id) ?: -1
+    val to = if (target != null && pinned[target] == pinned[drag.id]) order?.indexOf(target) ?: -1 else -1
+    return if (order == null || from < 0 || to < 0) {
+        order
+    } else {
+        order.toMutableList().apply {
+            removeAt(from)
+            add(to, drag.id)
+        }
+    }
+}
@@ -0,0 +1,168 @@
+package com.fabledsword.inkwell.ui
+
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.ExperimentalLayoutApi
+import androidx.compose.foundation.layout.FlowRow
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.FilterChip
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.unit.dp
+import com.fabledsword.inkwell.R
+import com.fabledsword.inkwell.core.Label
+import com.fabledsword.inkwell.core.NoteFacets
+
+/**
+ * The board's filters: the same three the web's Filters panel offers (FilterBar.vue,
+ * trimmed to these in #5180). Tags a note must ALL carry, has an attachment, and
+ * shared with me. Reminders and dates have their own lenses, here as on the web.
+ *
+ * Only the main board filters, as on the web. Opening Archive, Trash or a tag from
+ * the drawer starts that view unfiltered. A search narrows whichever view is open,
+ * and on the main board it combines with these.
+ */
+data class BoardFilters(
+    val labelIds: Set<String> = emptySet(),
+    val hasAttachment: Boolean = false,
+    val sharedWithMe: Boolean = false,
+) {
+    /** How many are on, counted the way the web's badge counts them: each tag is one. */
+    val count: Int
+        get() = labelIds.size + (if (hasAttachment) 1 else 0) + (if (sharedWithMe) 1 else 0)
+
+    /**
+     * The core's facets for these and the search box's [text], or null when there is
+     * nothing to narrow by. The core ANDs them, the same as the server's query.
+     */
+    fun facets(text: String = ""): NoteFacets? {
+        val q = text.trim().ifEmpty { null }
+        return if (count == 0 && q == null) {
+            null
+        } else {
+            NoteFacets(
+                q = q,
+                label = labelIds.toList().ifEmpty { null },
+                hasAttachment = if (hasAttachment) true else null,
+                createdAfter = null,
+                createdBefore = null,
+                shared = if (sharedWithMe) SHARED_WITH_ME else null,
+            )
+        }
+    }
+
+    fun toggleLabel(id: String) = copy(labelIds = if (id in labelIds) labelIds - id else labelIds + id)
+}
+
+/** The facet value the core reads as "only notes someone else shared with me". */
+private const val SHARED_WITH_ME = "with_me"
+
+/**
+ * The row under the search bar: a Filters chip that opens the sheet, showing how many
+ * are on, and a Clear beside it once any are.
+ */
+@Composable
+internal fun FilterRow(
+    filters: BoardFilters,
+    onOpen: () -> Unit,
+    onClear: () -> Unit,
+) {
+    Row(
+        modifier = Modifier.fillMaxWidth().padding(horizontal = GUTTER),
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.spacedBy(8.dp),
+    ) {
+        FilterChip(
+            selected = filters.count > 0,
+            onClick = onOpen,
+            label = {
+                Text(
+                    if (filters.count > 0) {
+                        stringResource(R.string.filters_count, filters.count)
+                    } else {
+                        stringResource(R.string.filters)
+                    },
+                )
+            },
+        )
+        if (filters.count > 0) {
+            TextButton(onClick = onClear) { Text(stringResource(R.string.filters_clear)) }
+        }
+    }
+}
+
+/**
+ * Pick the filters. Each tap applies at once, as on the web, so the board behind the
+ * sheet is already showing the answer when it is dismissed.
+ */
+@OptIn(ExperimentalMaterial3Api::class, ExperimentalLayoutApi::class)
+@Composable
+internal fun FilterSheet(
+    filters: BoardFilters,
+    labels: List<Label>,
+    onChange: (BoardFilters) -> Unit,
+    onDismiss: () -> Unit,
+) {
+    Sheet(
+        title = R.string.filters,
+        onDismiss = onDismiss,
+        modifier = Modifier.verticalScroll(rememberScrollState()),
+    ) {
+        FilterHeading(R.string.filters_show)
+        FlowRow(horizontalArrangement = Arrangement.spacedBy(6.dp)) {
+            FilterChip(
+                selected = filters.hasAttachment,
+                onClick = { onChange(filters.copy(hasAttachment = !filters.hasAttachment)) },
+                label = { Text(stringResource(R.string.filters_has_attachment)) },
+            )
+            FilterChip(
+                selected = filters.sharedWithMe,
+                onClick = { onChange(filters.copy(sharedWithMe = !filters.sharedWithMe)) },
+                label = { Text(stringResource(R.string.filters_shared_with_me)) },
+            )
+        }
+
+        // No heading and no empty row when there are no tags yet: a section that
+        // can only ever say "none" is noise in a sheet this small.
+        if (labels.isNotEmpty()) {
+            FilterHeading(R.string.filters_tags)
+            FlowRow(horizontalArrangement = Arrangement.spacedBy(6.dp)) {
+                labels.forEach { label ->
+                    FilterChip(
+                        selected = label.id in filters.labelIds,
+                        onClick = { onChange(filters.toggleLabel(label.id)) },
+                        label = { Text(label.name) },
+                    )
+                }
+            }
+        }
+
+        if (filters.count > 0) {
+            TextButton(
+                onClick = { onChange(BoardFilters()) },
+                modifier = Modifier.align(Alignment.End),
+            ) {
+                Text(stringResource(R.string.filters_clear))
+            }
+        }
+    }
+}
+
+@Composable
+private fun FilterHeading(labelRes: Int) {
+    Text(
+        text = stringResource(labelRes),
+        style = MaterialTheme.typography.labelMedium,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+        modifier = Modifier.padding(top = 8.dp, bottom = 2.dp),
+    )
+}
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
@@ -6,11 +6,14 @@ import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.PaddingValues
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.WindowInsets
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.ime
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.union
 import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.foundation.lazy.staggeredgrid.LazyVerticalStaggeredGrid
 import androidx.compose.foundation.lazy.staggeredgrid.StaggeredGridCells
@@ -23,6 +26,7 @@ import androidx.compose.foundation.verticalScroll
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.filled.Add
 import androidx.compose.material.icons.filled.Close
+import androidx.compose.material.icons.filled.Edit
 import androidx.compose.material.icons.filled.Menu
 import androidx.compose.material.icons.filled.Search
 import androidx.compose.material3.CircularProgressIndicator
@@ -37,6 +41,11 @@ import androidx.compose.material3.ModalDrawerSheet
 import androidx.compose.material3.ModalNavigationDrawer
 import androidx.compose.material3.NavigationDrawerItem
 import androidx.compose.material3.Scaffold
+import androidx.compose.material3.ScaffoldDefaults
+import androidx.compose.material3.SnackbarDuration
+import androidx.compose.material3.SnackbarHost
+import androidx.compose.material3.SnackbarHostState
+import androidx.compose.material3.SnackbarResult
 import androidx.compose.material3.Surface
 import androidx.compose.material3.Text
 import androidx.compose.material3.pulltorefresh.PullToRefreshDefaults
@@ -44,15 +53,28 @@ import androidx.compose.material3.pulltorefresh.pullToRefresh
 import androidx.compose.material3.pulltorefresh.rememberPullToRefreshState
 import androidx.compose.material3.rememberDrawerState
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.DisposableEffect
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.derivedStateOf
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.rememberUpdatedState
+import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.graphicsLayer
+import androidx.compose.ui.layout.boundsInRoot
+import androidx.compose.ui.layout.onGloballyPositioned
+import androidx.compose.ui.platform.LocalConfiguration
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.input.ImeAction
 import androidx.compose.ui.unit.dp
-import com.fabledsword.thoughtsync.R
-import com.fabledsword.thoughtsync.core.Label
-import com.fabledsword.thoughtsync.core.Note
+import androidx.compose.ui.zIndex
+import com.fabledsword.inkwell.R
+import com.fabledsword.inkwell.core.Label
+import com.fabledsword.inkwell.core.Note
 import kotlinx.coroutines.launch

@Composable
@@ -62,13 +84,58 @@ fun BoardScreen(
    onOpenNote: (Note) -> Unit,
    sync: BoardSync,
    onOpenSync: () -> Unit,
+    onManageTags: () -> Unit,
    onSearch: (String) -> Unit,
+    onFilter: (BoardFilters) -> Unit,
+    onReorder: (List<String>) -> Unit,
    onCompose: () -> Unit,
    onToggleItem: (Note, Int, Boolean) -> Unit,
+    onNoteAction: (Note, EditorAction) -> Unit,
+    update: BoardUpdate?,
    onDismissError: () -> Unit,
 ) {
    val drawerState = rememberDrawerState(DrawerValue.Closed)
    val scope = rememberCoroutineScope()
+    val snackbars = remember { SnackbarHostState() }
+
+    // Held HERE rather than on the card. A card lives in a lazy grid and is disposed
+    // the moment it scrolls out of view, which would take its dialog down with it —
+    // and the board can scroll under an open dialog.
+    var confirmingDelete by remember { mutableStateOf<Note?>(null) }
+    var filtering by remember { mutableStateOf(false) }
+
+    // Resolved in composition, not inside the coroutine: `stringResource` is a
+    // composable read and cannot be called from a suspend block.
+    val trashedMessage = stringResource(R.string.board_trashed)
+    val undoLabel = stringResource(R.string.board_undo)
+
+    // Trash gets an UNDO rather than a confirmation, and the two are not
+    // interchangeable. A long press is a gesture you can make by accident — resting a
+    // thumb while reading is enough — so the mistake worth designing for is the one
+    // nobody meant to make, and a dialog only helps someone who is paying attention
+    // in the moment they were not. Trash is already recoverable; the snackbar just
+    // says so where it happened, instead of leaving you to find the Trash view and
+    // work out which note went missing.
+    //
+    // Delete forever keeps its dialog. That one does not undo.
+    val onCardAction: (Note, EditorAction) -> Unit = { note, action ->
+        onNoteAction(note, action)
+        if (action == EditorAction.Trash) {
+            scope.launch {
+                val outcome =
+                    snackbars.showSnackbar(
+                        message = trashedMessage,
+                        actionLabel = undoLabel,
+                        duration = SnackbarDuration.Short,
+                    )
+                // `note` is the pre-trash copy and deliberately so: Restore only needs
+                // its id, and the id is the one thing trashing does not change.
+                if (outcome == SnackbarResult.ActionPerformed) {
+                    onNoteAction(note, EditorAction.Restore)
+                }
+            }
+        }
+    }

    ModalNavigationDrawer(
        drawerState = drawerState,
@@ -85,10 +152,30 @@ fun BoardScreen(
                    onOpenSync()
                    scope.launch { drawerState.close() }
                },
+                onManageTags = {
+                    onManageTags()
+                    scope.launch { drawerState.close() }
+                },
            )
        },
    ) {
        Scaffold(
+            // The IME, added to what the Scaffold already insets for. `enableEdgeToEdge`
+            // makes the manifest's `adjustResize` a no-op on API 30+, so nothing resizes
+            // for the keyboard unless the app asks — and `ScaffoldDefaults.contentWindowInsets`
+            // is systemBars, which the IME is not part of. The Scaffold positions the FAB
+            // AND the snackbar host from this value, so without it both sit behind the
+            // keyboard whenever the search field has focus. That is not theoretical: the
+            // undo on a trashed search hit is exactly the control you cannot reach.
+            //
+            // `union` rather than `add` — the two are the same edge, not two stacked ones.
+            // Adding them would inset by the navigation bar a second time underneath a
+            // keyboard that already covers it.
+            //
+            // One owner for the edge, as with the search bar's missing statusBarsPadding:
+            // set here, the content Column gets it through `padding` and must not repeat it.
+            contentWindowInsets = ScaffoldDefaults.contentWindowInsets.union(WindowInsets.ime),
+            snackbarHost = { SnackbarHost(snackbars) },
            floatingActionButton = {
                // The + is the ONLY way in, by design: one obvious target rather
                // than a capture bar and a button competing for the same job.
@@ -108,6 +195,14 @@ fun BoardScreen(
                    onMenu = { scope.launch { drawerState.open() } },
                )

+                if (state.filterable) {
+                    FilterRow(
+                        filters = state.filters,
+                        onOpen = { filtering = true },
+                        onClear = { onFilter(BoardFilters()) },
+                    )
+                }
+
                state.error?.let { message ->
                    ErrorBanner(message = message, onDismiss = onDismissError)
                }
@@ -118,6 +213,17 @@ fun BoardScreen(
                    ErrorBanner(message = message, onDismiss = sync.onDismissError)
                }

+                // Below the failures and above the notes: an update is worth saying,
+                // and never worth saying before a note failed to save.
+                update?.let {
+                    UpdateBanner(
+                        version = it.version,
+                        busy = it.busy,
+                        onInstall = it.onInstall,
+                        onDismiss = it.onDismiss,
+                    )
+                }
+
                // Only where someone is already thinking about reminders. On the
                // main board it would nag people who have never set one.
                if (state.destination == Destination.Reminders) ReminderNotice()
@@ -146,6 +252,10 @@ fun BoardScreen(
                                notes = state.notes,
                                onOpenNote = onOpenNote,
                                onToggleItem = onToggleItem,
+                                onNoteAction = onCardAction,
+                                onConfirmDelete = { confirmingDelete = it },
+                                reorderable = state.reorderable,
+                                onReorder = onReorder,
                            )
                    }
                    // `PullToRefreshBox` would be less code, but it takes no
@@ -159,6 +269,25 @@ fun BoardScreen(
                }
            }
        }
+
+        if (filtering) {
+            FilterSheet(
+                filters = state.filters,
+                labels = state.labels,
+                onChange = onFilter,
+                onDismiss = { filtering = false },
+            )
+        }
+
+        confirmingDelete?.let { note ->
+            ConfirmDeleteDialog(
+                onConfirm = {
+                    confirmingDelete = null
+                    onNoteAction(note, EditorAction.DeleteForever)
+                },
+                onDismiss = { confirmingDelete = null },
+            )
+        }
    }
 }

@@ -187,6 +316,25 @@ data class BoardSync(
    val onDismissError: () -> Unit,
 )

+/**
+ * The waiting app update, or null when there is nothing to say.
+ *
+ * A holder rather than five loose parameters, for the same reason [BoardSync] is one:
+ * `version` and a pair of booleans as positional arguments could be swapped with
+ * nothing to catch it.
+ *
+ * Null covers every reason there is nothing to show — unlinked, up to date, found but
+ * not yet downloaded, dismissed for this sitting — so the board never has to know
+ * which.
+ */
+data class BoardUpdate(
+    val version: String,
+    /** An install is in flight — the banner stays and reports it. */
+    val busy: Boolean,
+    val onInstall: () -> Unit,
+    val onDismiss: () -> Unit,
+)
+
 /**
 * A search field IS the top bar, following the phone convention rather than the
 * desktop's title-plus-sidebar.
@@ -256,6 +404,7 @@ private fun NavigationDrawer(
    syncSummary: String?,
    onOpen: (Destination) -> Unit,
    onOpenSync: () -> Unit,
+    onManageTags: () -> Unit,
 ) {
    ModalDrawerSheet {
        Column(modifier = Modifier.verticalScroll(rememberScrollState())) {
@@ -269,18 +418,36 @@ private fun NavigationDrawer(
                DrawerRow(destination, current, onOpen)
            }

-            if (labels.isNotEmpty()) {
-                HorizontalDivider(modifier = Modifier.padding(horizontal = 16.dp, vertical = 8.dp))
+            // The header renders even with no tags, unlike the rows below it: the
+            // manage screen is where you go to MAKE the first one, and hiding the
+            // way in until one exists would be a door that appears only once you
+            // are already inside. It is an action ON the section rather than a row
+            // in it, so it cannot be mistaken for one more lens.
+            HorizontalDivider(modifier = Modifier.padding(horizontal = 16.dp, vertical = 8.dp))
+            Row(
+                modifier =
+                    Modifier
+                        .fillMaxWidth()
+                        .padding(start = 28.dp, end = 16.dp, bottom = 4.dp),
+                verticalAlignment = Alignment.CenterVertically,
+            ) {
                Text(
                    text = stringResource(R.string.nav_labels),
                    style = MaterialTheme.typography.labelMedium,
                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    modifier = Modifier.padding(start = 28.dp, bottom = 4.dp),
+                    modifier = Modifier.weight(1f),
                )
-                labels.forEach { label ->
-                    DrawerRow(Destination.WithLabel(label.id, label.name), current, onOpen)
+                IconButton(onClick = onManageTags) {
+                    Icon(
+                        Icons.Filled.Edit,
+                        contentDescription = stringResource(R.string.tags_manage),
+                        tint = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
                }
            }
+            labels.forEach { label ->
+                DrawerRow(Destination.WithLabel(label.id, label.name), current, onOpen)
+            }

            HorizontalDivider(modifier = Modifier.padding(horizontal = 16.dp, vertical = 8.dp))
            listOf(Destination.Archive, Destination.Trash).forEach { destination ->
@@ -303,6 +470,16 @@ private fun NavigationDrawer(
    }
 }

+@Composable
+private fun Destination.title(): String =
+    when (this) {
+        Destination.Notes -> stringResource(R.string.nav_notes)
+        Destination.Reminders -> stringResource(R.string.nav_reminders)
+        Destination.Archive -> stringResource(R.string.nav_archive)
+        Destination.Trash -> stringResource(R.string.nav_trash)
+        is Destination.WithLabel -> name
+    }
+
@Composable
 private fun DrawerRow(
    destination: Destination,
@@ -310,7 +487,7 @@ private fun DrawerRow(
    onOpen: (Destination) -> Unit,
 ) {
    NavigationDrawerItem(
-        label = { Text(destination.title) },
+        label = { Text(destination.title()) },
        selected = destination == current,
        onClick = { onOpen(destination) },
        modifier = Modifier.padding(horizontal = 12.dp),
@@ -318,7 +495,7 @@ private fun DrawerRow(
 }

 /**
- * The board: a two-column masonry, matching the web and desktop.
+ * The board: a masonry of two to four columns, by window width, matching the web.
 *
 * Staggered rather than a uniform grid because notes are wildly different heights
 * — a one-line thought beside a twelve-item checklist — and forcing them to a
@@ -330,10 +507,68 @@ private fun NoteBoard(
    notes: List<Note>,
    onOpenNote: (Note) -> Unit,
    onToggleItem: (Note, Int, Boolean) -> Unit,
+    onNoteAction: (Note, EditorAction) -> Unit,
+    onConfirmDelete: (Note) -> Unit,
+    /** Whether cards can be dragged into a new order: the plain main board only. */
+    reorderable: Boolean,
+    onReorder: (List<String>) -> Unit,
 ) {
+    // The web's breakpoints (NoteGrid.vue: three columns from `lg`, 1024px, four from
+    // `xl`, 1280px), on the window's width, so a tablet lays out like a browser of the
+    // same size. Below that it stays at two, where the web drops to one on a phone.
+    val windowWidth = LocalConfiguration.current.screenWidthDp
+    val columns =
+        when {
+            windowWidth >= 1280 -> 4
+            windowWidth >= 1024 -> 3
+            else -> 2
+        }
+
+    // The drag (BoardDrag.kt). `order` is the board as the drag has rearranged it, and
+    // it stays until the store's next list arrives, so a drop does not flash back to
+    // the old order while the write is in flight.
+    val bounds = remember { CardBounds() }
+    val grid = remember { GridOrigin() }
+    var drag by remember { mutableStateOf<CardDrag?>(null) }
+    var order by remember { mutableStateOf<List<String>?>(null) }
+    val current by rememberUpdatedState(notes)
+    val reorder by rememberUpdatedState(onReorder)
+    LaunchedEffect(notes) { order = null }
+    // Which card is carried, read by every item; where it is, read only when its layer
+    // is drawn. A move then redraws one card instead of recomposing them all.
+    val carriedId by remember { derivedStateOf { drag?.id } }
+
+    val byId = notes.associateBy { it.id }
+    val shown = order?.mapNotNull { byId[it] } ?: notes
+
    LazyVerticalStaggeredGrid(
-        columns = StaggeredGridCells.Fixed(BOARD_COLUMNS),
-        modifier = Modifier.fillMaxSize(),
+        columns = StaggeredGridCells.Fixed(columns),
+        modifier =
+            Modifier
+                .fillMaxSize()
+                .onGloballyPositioned { grid.coords = it }
+                .dragToReorder(
+                    enabled = reorderable,
+                    bounds = bounds,
+                    toRoot = { grid.coords?.localToRoot(it) ?: it },
+                    carrier =
+                        CardCarrier(
+                            onStart = { id, at ->
+                                val corner = bounds[id]?.topLeft ?: at
+                                drag = CardDrag(id = id, from = at, at = at, startTopLeft = corner)
+                                order = current.map { it.id }
+                            },
+                            onMove = { at ->
+                                drag = drag?.copy(at = at)
+                                order = drag?.let { moved(order, it, bounds, current) } ?: order
+                            },
+                            onEnd = {
+                                val final = order
+                                drag = null
+                                if (final != null && final != current.map { it.id }) reorder(final)
+                            },
+                        ),
+                ),
        // Bottom padding clears the FAB, so the last note is never trapped under it.
        contentPadding = PaddingValues(start = GUTTER, end = GUTTER, top = 4.dp, bottom = 88.dp),
        verticalItemSpacing = 8.dp,
@@ -342,12 +577,38 @@ private fun NoteBoard(
        // Keyed by id so Compose reuses cards across a refresh rather than
        // rebuilding them — and so a newly captured note slides in instead of
        // making every card below it flicker.
-        items(items = notes, key = { it.id }) { note ->
-            NoteCard(
-                note = note,
-                onOpen = { onOpenNote(note) },
-                onToggleItem = { index, checked -> onToggleItem(note, index, checked) },
-            )
+        items(items = shown, key = { it.id }) { note ->
+            val carried = carriedId == note.id
+            // Bounds recorded BEFORE the carried card's translation in the chain, so
+            // they are where the layout put it, not where the finger has taken it.
+            val follow =
+                if (carried) {
+                    Modifier.zIndex(1f).graphicsLayer {
+                        drag?.let { d ->
+                            val laid = bounds[note.id]?.topLeft ?: d.startTopLeft
+                            translationX = d.topLeft.x - laid.x
+                            translationY = d.topLeft.y - laid.y
+                        }
+                    }
+                } else {
+                    Modifier.animateItem()
+                }
+            Box(
+                modifier =
+                    Modifier
+                        .onGloballyPositioned { bounds.record(note.id, it.boundsInRoot()) }
+                        .then(follow),
+            ) {
+                NoteCard(
+                    note = note,
+                    onOpen = { onOpenNote(note) },
+                    onToggleItem = { index, checked -> onToggleItem(note, index, checked) },
+                    onAction = { onNoteAction(note, it) },
+                    onConfirmDelete = { onConfirmDelete(note) },
+                    dragging = carried,
+                )
+            }
+            DisposableEffect(note.id) { onDispose { bounds.forget(note.id) } }
        }
    }
 }
@@ -366,6 +627,8 @@ private fun EmptyBoard(state: BoardState) {
            state.searching ->
                stringResource(R.string.empty_search_title) to
                    stringResource(R.string.empty_search_body, state.query)
+            state.destination == Destination.Notes && state.filters.count > 0 ->
+                stringResource(R.string.empty_filtered_title) to stringResource(R.string.empty_filtered_body)
            state.destination == Destination.Trash ->
                stringResource(R.string.empty_trash_title) to stringResource(R.string.empty_trash_body)
            state.destination == Destination.Archive ->
@@ -388,13 +651,7 @@ private fun EmptyBoard(state: BoardState) {
    ) {
        item {
            Column(horizontalAlignment = Alignment.CenterHorizontally) {
-                Text(text = title, style = MaterialTheme.typography.titleMedium)
-                Spacer(Modifier.height(8.dp))
-                Text(
-                    text = body,
-                    style = MaterialTheme.typography.bodyMedium,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
+                TitleAndBody(title, body)
            }
        }
    }
@@ -424,20 +681,27 @@ fun StoreUnavailableScreen(reason: String?) {
        horizontalAlignment = Alignment.CenterHorizontally,
        verticalArrangement = Arrangement.Center,
    ) {
-        Text(
-            text = stringResource(R.string.store_unavailable_title),
-            style = MaterialTheme.typography.titleMedium,
-        )
-        Spacer(Modifier.height(8.dp))
-        Text(
-            text = reason ?: stringResource(R.string.store_unavailable_body),
-            style = MaterialTheme.typography.bodyMedium,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        TitleAndBody(
+            title = stringResource(R.string.store_unavailable_title),
+            body = reason ?: stringResource(R.string.store_unavailable_body),
        )
    }
 }

-private const val BOARD_COLUMNS = 2
+/** A whole-screen message: what is the case, then what it means, in the quieter ink. */
+@Composable
+private fun TitleAndBody(
+    title: String,
+    body: String,
+) {
+    Text(text = title, style = MaterialTheme.typography.titleMedium)
+    Spacer(Modifier.height(8.dp))
+    Text(
+        text = body,
+        style = MaterialTheme.typography.bodyMedium,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+    )
+}

 // Not private: the reminder notice is board content and has to line up with the
 // search bar and the cards, so it shares the board's gutter rather than guessing.
@@ -1,17 +1,21 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

+import android.net.Uri
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.setValue
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.ViewModelProvider
 import androidx.lifecycle.viewModelScope
-import com.fabledsword.thoughtsync.core.Label
-import com.fabledsword.thoughtsync.core.Note
-import com.fabledsword.thoughtsync.core.NoteDraft
-import com.fabledsword.thoughtsync.core.NoteEdit
-import com.fabledsword.thoughtsync.core.NoteQuery
-import com.fabledsword.thoughtsync.core.ThoughtSync
+import androidx.lifecycle.viewmodel.initializer
+import androidx.lifecycle.viewmodel.viewModelFactory
+import com.fabledsword.inkwell.core.Inkwell
+import com.fabledsword.inkwell.core.Label
+import com.fabledsword.inkwell.core.Note
+import com.fabledsword.inkwell.core.NoteDraft
+import com.fabledsword.inkwell.core.NoteEdit
+import com.fabledsword.inkwell.core.NoteFacets
+import com.fabledsword.inkwell.core.NoteQuery
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.Job
 import kotlinx.coroutines.delay
@@ -26,27 +30,17 @@ import kotlinx.coroutines.withContext
 * empty board.
 */
 sealed interface Destination {
-    val title: String
+    data object Notes : Destination

-    data object Notes : Destination {
-        override val title = "Notes"
-    }
+    data object Reminders : Destination

-    data object Reminders : Destination {
-        override val title = "Reminders"
-    }
+    data object Archive : Destination

-    data object Archive : Destination {
-        override val title = "Archive"
-    }
-
-    data object Trash : Destination {
-        override val title = "Trash"
-    }
+    data object Trash : Destination

    data class WithLabel(
        val id: String,
-        override val title: String,
+        val name: String,
    ) : Destination
 }

@@ -56,6 +50,8 @@ data class BoardState(
    val notes: List<Note> = emptyList(),
    val labels: List<Label> = emptyList(),
    val query: String = "",
+    /** The main board's filters. Only [Destination.Notes] applies them. */
+    val filters: BoardFilters = BoardFilters(),
    val loading: Boolean = true,
    val saving: Boolean = false,
    val error: String? = null,
@@ -79,8 +75,22 @@ data class BoardState(
     */
    val editingSession: Long = 0,
 ) {
-    /** Search overrides the destination while there is a query to run. */
+    /**
+     * A search narrows the board in view rather than replacing it, as on the web,
+     * where the box writes `?q=` beside the Filters panel's facets and one query
+     * answers both (Scribe #2942). "These words, in notes tagged grocery" is the
+     * question tags exist to help ask (note 2930).
+     */
    val searching: Boolean get() = query.isNotBlank()
+
+    /** The main board only, as on the web, whose Filters panel is the main board's. */
+    val filterable: Boolean get() = destination == Destination.Notes
+
+    /**
+     * The whole board in one order, as on the web: not a search, another view, or a
+     * filtered subset, whose order would be renumbered against notes it can't see.
+     */
+    val reorderable: Boolean get() = filterable && filters.count == 0 && !searching
 }

 /**
@@ -99,7 +109,7 @@ data class BoardState(
 */
@Suppress("TooManyFunctions")
 class BoardViewModel(
-    private val core: ThoughtSync,
+    private val core: Inkwell,
    /**
     * Called after any write that could have moved a reminder.
     *
@@ -110,6 +120,11 @@ class BoardViewModel(
     * view model's `onStoreChanged`.
     */
    private val onRemindersChanged: () -> Unit = {},
+    /**
+     * Read a picked or shared file. Blocking; only ever called on the IO dispatcher.
+     * A function rather than a Context for the same reason as the callback above.
+     */
+    private val readFile: (Uri) -> PickedFile = { PickedFile.Refused(FALLBACK_ERROR) },
 ) : ViewModel() {
    var state by mutableStateOf(BoardState())
        private set
@@ -123,7 +138,7 @@ class BoardViewModel(

    init {
        refresh()
-        loadLabels()
+        refreshLabels()
    }

    fun open(destination: Destination) {
@@ -131,7 +146,13 @@ class BoardViewModel(
        // running should show the archive, not search results filtered by a box
        // the user has visually moved on from.
        searchJob?.cancel()
-        state = state.copy(destination = destination, query = "")
+        state = state.copy(destination = destination, query = "", filters = BoardFilters())
+        refresh()
+    }
+
+    /** Apply the main board's filters. */
+    fun filter(filters: BoardFilters) {
+        state = state.copy(filters = filters)
        refresh()
    }

@@ -140,41 +161,86 @@ class BoardViewModel(
            state = state.copy(loading = true)
            state =
                try {
-                    val notes = withContext(Dispatchers.IO) { load(state.destination) }
+                    val destination = state.destination
+                    val filters = state.filters
+                    val text = state.query
+                    val notes = withContext(Dispatchers.IO) { load(destination, filters, text) }
                    state.copy(notes = notes, loading = false, error = null)
                } catch (e: Exception) {
                    // Broad by intent: the board must render something for any
                    // failure, and the core reports problems as one error type
                    // carrying a message meant to be shown.
-                    state.copy(loading = false, error = e.message ?: FALLBACK_ERROR)
+                    state.copy(loading = false, error = e.shownAs())
                }
        }
    }

-    private fun load(destination: Destination): List<Note> =
-        when (destination) {
-            Destination.Notes -> core.listNotes(query(VIEW_NOTES))
-            Destination.Archive -> core.listNotes(query(VIEW_ARCHIVE))
-            Destination.Trash -> core.listNotes(query(VIEW_TRASH))
+    /** The notes [destination] shows, narrowed by the board's filters and by [text]. */
+    private fun load(
+        destination: Destination,
+        filters: BoardFilters,
+        text: String,
+    ): List<Note> {
+        // Only the main board has filters; every board view takes the search text.
+        val searchOnly = BoardFilters().facets(text)
+        return when (destination) {
+            Destination.Notes -> core.listNotes(query(VIEW_NOTES, facets = filters.facets(text)))
+            Destination.Archive -> core.listNotes(query(VIEW_ARCHIVE, facets = searchOnly))
+            Destination.Trash -> core.listNotes(query(VIEW_TRASH, facets = searchOnly))
            // Not a board view: the core models reminders as its own query, since
-            // "has a reminder" cuts across archived and active alike.
+            // "has a reminder" cuts across archived and active alike. `search` moves
+            // a search off this view, so it never has text to apply.
            Destination.Reminders -> core.reminderNotes()
-            is Destination.WithLabel -> core.listNotes(query(VIEW_NOTES, labelId = destination.id))
+            is Destination.WithLabel -> core.listNotes(query(VIEW_NOTES, labelId = destination.id, facets = searchOnly))
        }
+    }

-    private fun loadLabels() {
+    /**
+     * Reload the drawer's tags, and leave a lens whose tag no longer exists.
+     *
+     * Public because the Tags screen owns operations this board cannot see: a
+     * delete or a merge removes a tag, and the board may be LOOKING at that tag —
+     * `Destination.WithLabel` holds an id, and a query for a deleted one returns
+     * nothing forever. Without the fallback, tidying up tags could strand the board
+     * on a permanently empty lens whose only escape is the drawer.
+     *
+     * A rename needs no fallback: the id survives, and re-listing gives the drawer
+     * the new name. A rename that MERGED is a delete of one of the two, which this
+     * catches by id like any other.
+     */
+    fun refreshLabels() {
        viewModelScope.launch {
            runCatching { withContext(Dispatchers.IO) { core.listLabels() } }
-                .onSuccess { state = state.copy(labels = it) }
+                .onSuccess { labels ->
+                    state = state.copy(labels = labels)
+                    // A deleted tag is dropped from the filters as it is from the lens
+                    // below: a filter on an id nothing carries matches nothing forever.
+                    val kept = state.filters.labelIds intersect labels.map { it.id }.toSet()
+                    if (kept != state.filters.labelIds) filter(state.filters.copy(labelIds = kept))
+                    val lens = state.destination
+                    if (lens is Destination.WithLabel && labels.none { it.id == lens.id }) {
+                        open(Destination.Notes)
+                    }
+                }
                // A drawer that cannot list labels is a degraded drawer, not a
                // broken board — the notes are still there. Failing quietly here
-                // beats an error banner over working content.
+                // beats an error banner over working content. The lens is left
+                // alone in this case on purpose: "I could not read the tags" is not
+                // evidence that this one is gone.
                .onFailure { state = state.copy(labels = emptyList()) }
        }
    }

    fun search(text: String) {
-        state = state.copy(query = text)
+        // Reminders is a list, not a board view, so a search there runs over the main
+        // board — which is where the web sends a search typed off the board.
+        val destination =
+            if (text.isNotBlank() && state.destination == Destination.Reminders) {
+                Destination.Notes
+            } else {
+                state.destination
+            }
+        state = state.copy(query = text, destination = destination)
        searchJob?.cancel()

        if (text.isBlank()) {
@@ -190,10 +256,11 @@ class BoardViewModel(
                state = state.copy(loading = true)
                state =
                    try {
-                        val hits = withContext(Dispatchers.IO) { core.searchNotes(text) }
+                        val filters = state.filters
+                        val hits = withContext(Dispatchers.IO) { load(destination, filters, text) }
                        state.copy(notes = hits, loading = false, error = null)
                    } catch (e: Exception) {
-                        state.copy(loading = false, error = e.message ?: FALLBACK_ERROR)
+                        state.copy(loading = false, error = e.shownAs())
                    }
            }
    }
@@ -210,11 +277,20 @@ class BoardViewModel(
    fun openNoteById(id: String) {
        viewModelScope.launch {
            runCatching { withContext(Dispatchers.IO) { core.getNote(id) } }
-                .onSuccess { state = state.copy(editing = it, editingSession = state.editingSession + 1) }
+                .onSuccess { beginSitting(it) }
        }
    }

    fun openNote(note: Note) {
+        beginSitting(note)
+    }
+
+    /**
+     * A new sitting in the editor, on [note]: bumps [BoardState.editingSession] so
+     * the editor's field is re-keyed onto what it now shows. Saving within a
+     * sitting never comes through here.
+     */
+    private fun beginSitting(note: Note? = state.editing) {
        state = state.copy(editing = note, editingSession = state.editingSession + 1)
    }

@@ -232,7 +308,40 @@ class BoardViewModel(
     */
    fun compose() {
        draftDismissed = false
-        state = state.copy(editing = blankDraft(), editingSession = state.editingSession + 1)
+        beginSitting(blankDraft())
+    }
+
+    /**
+     * Capture text shared into the app from somewhere else, and open it.
+     *
+     * The note is CREATED here rather than opened as a pre-filled draft, and that
+     * is the whole design of this path. The editor only flushes when its text
+     * differs from the note it was handed (`NoteEditorScreen`'s `flush`), so a
+     * draft arriving already full of the shared text is a draft with nothing to
+     * save — share a link, press back without typing, and it would be gone. A
+     * share has already said "keep this"; making the row first is what honours it.
+     *
+     * Opening the editor afterwards is then free of that risk: the note exists,
+     * back leaves it alone, and adding a line of context is optional rather than
+     * load-bearing.
+     */
+    fun captureShared(
+        text: String?,
+        files: List<Uri> = emptyList(),
+    ) {
+        val content = text?.trim().orEmpty()
+        if (content.isEmpty() && files.isEmpty()) return
+        // A share is a new sitting even if the editor was already open on
+        // something, so the field must be re-keyed onto what arrives. `createFrom
+        // Draft` deliberately does not bump this — it is written for the autosave
+        // case, where re-keying mid-typing would be the bug.
+        draftDismissed = false
+        beginSitting()
+        // A shared photo arrives with no words, and the note it makes is still a
+        // note: the picture is its content.
+        createFromDraft(content, allowEmpty = files.isNotEmpty()) { created ->
+            if (files.isNotEmpty()) onEditorAction(created, EditorAction.Attach(files))
+        }
    }

    /**
@@ -263,6 +372,10 @@ class BoardViewModel(
            }
            EditorAction.DismissError -> dismissError()
            is EditorAction.SaveText -> createFromDraft(action.body)
+            // Attaching to an empty draft is a note with a file and no words yet, so
+            // it is the one action that may create a note with no text.
+            is EditorAction.Attach ->
+                createFromDraft(draft.body, allowEmpty = true) { created -> onEditorAction(created, action) }
            // Colour, reminder, pin, labels: attributes OF a note, so there has to be
            // a note. With autosave at a second, "typed something" is true by the time
            // anyone reaches the toolbar; before that there is nothing to attribute.
@@ -311,7 +424,7 @@ class BoardViewModel(
                        error = null,
                    )
                } catch (e: Exception) {
-                    state.copy(saving = false, error = e.message ?: FALLBACK_ERROR)
+                    state.copy(saving = false, error = e.shownAs())
                }
            if (!draftDismissed) state.editing?.let(then)
        }
@@ -327,7 +440,7 @@ class BoardViewModel(
     * mutation that lands between a tap and its dispatch cannot redirect the
     * action at a different note.
     *
-     * Both suppressions have ONE cause: [EditorAction] has twenty variants, so a
+     * Both suppressions have ONE cause: [EditorAction] has over twenty variants, so a
     * total function over it is twenty branches and sixty-odd lines no matter how
     * it is written. Splitting it into sub-dispatchers is the only way to shorten
     * it, and each of those would need an `else` — which throws away precisely the
@@ -354,8 +467,6 @@ class BoardViewModel(
            is EditorAction.SaveText ->
                mutate { it.updateNote(id, listOf(NoteEdit.Body(action.body))) }

-            is EditorAction.SetColor -> edit(id, NoteEdit.Color(action.color))
-
            // Pinning re-sorts the board rather than emptying it, and on a phone
            // you often pin while still reading — so unlike the three below, it
            // deliberately leaves the editor open.
@@ -384,12 +495,11 @@ class BoardViewModel(
                action.name.trim().takeIf { it.isNotEmpty() }?.let { name ->
                    mutate {
                        val label = it.createLabel(name)
-                        val manual = note.labels.filterNot { l -> l.viaTag }.map { l -> l.id }
-                        it.setNoteLabels(id, (manual + label.id).distinct())
+                        it.setNoteLabels(id, (note.manualLabelIds + label.id).distinct())
                    }
                    // The drawer lists labels with their note counts, and both
                    // just changed.
-                    loadLabels()
+                    refreshLabels()
                }

            is EditorAction.SetReminder -> edit(id, NoteEdit.RemindAt(action.at))
@@ -401,6 +511,35 @@ class BoardViewModel(
                    id,
                    action.rule?.let { NoteEdit.Recurrence(it) } ?: NoteEdit.ClearRecurrence,
                )
+
+            is EditorAction.Attach -> attach(id, action.uris)
+            is EditorAction.RemoveAttachment -> mutate { it.deleteAttachment(id, action.attachmentId) }
+            is EditorAction.RemovePreview -> mutate { it.deletePreview(id, action.previewId) }
+        }
+    }
+
+    /**
+     * Read each file and attach it, one at a time.
+     *
+     * A file that can't be read, or is too large, is skipped and named afterwards
+     * rather than failing the rest: sharing four photos where one is a video should
+     * still attach the three.
+     */
+    private fun attach(
+        id: String,
+        uris: List<Uri>,
+    ) {
+        val refused = mutableListOf<String>()
+        mutate(notice = { refused.takeIf { it.isNotEmpty() }?.joinToString("\n") }) { core ->
+            uris.fold(null as Note?) { latest, uri ->
+                when (val file = readFile(uri)) {
+                    is PickedFile.Ready -> core.addAttachment(id, file.name, file.mime, file.bytes)
+                    is PickedFile.Refused -> {
+                        refused += file.reason
+                        latest
+                    }
+                }
+            }
        }
    }

@@ -427,13 +566,20 @@ class BoardViewModel(
     * correct-until-a-moment-ago content, and flashing it empty would be a worse
     * lie than showing it one frame stale.
     *
-     * Search results are left alone — they are the answer to a query, not a live
-     * view, and re-running the board query underneath them would replace the hits
-     * with the whole board.
+     * While a search is running the QUERY is re-run rather than the board's
+     * destination — running `load` here would replace the hits with the whole
+     * board, which is why this branch exists at all. It used to keep the existing
+     * list instead, and that was right for a note whose place in the pile changed
+     * and wrong for one that left it: trashing a hit left the card sitting there,
+     * with a snackbar saying it was gone, until the query happened to re-run
+     * (#3111). Re-asking is still the answer to the query, just a current one.
     */
    private fun mutate(
        closeEditor: Boolean = false,
-        block: (ThoughtSync) -> Note?,
+        // Something to say once the write has landed, shown where an error would be.
+        // Read after `block` has run, so the block can decide it.
+        notice: () -> String? = { null },
+        block: (Inkwell) -> Note?,
    ) {
        viewModelScope.launch {
            state = state.copy(saving = true)
@@ -441,11 +587,7 @@ class BoardViewModel(
                try {
                    val updated = withContext(Dispatchers.IO) { block(core) }
                    val notes =
-                        if (state.searching) {
-                            state.notes
-                        } else {
-                            withContext(Dispatchers.IO) { load(state.destination) }
-                        }
+                        withContext(Dispatchers.IO) { load(state.destination, state.filters, state.query) }
                    // On IO, not here: re-deriving the alarm reads every note
                    // that carries a reminder, and this line runs on the main
                    // thread — the coroutine is back from its withContext by now.
@@ -459,13 +601,13 @@ class BoardViewModel(
                        // which is exactly what ticking a checkbox on a card did.
                        editing = if (closeEditor) null else state.editing?.let { updated ?: it },
                        saving = false,
-                        error = null,
+                        error = notice(),
                    )
                } catch (e: Exception) {
                    // Broad by intent, as elsewhere: the core reports every failure
                    // as one error type carrying a message meant to be shown, and a
                    // half-applied edit must still leave a usable screen.
-                    state.copy(saving = false, error = e.message ?: FALLBACK_ERROR)
+                    state.copy(saving = false, error = e.shownAs())
                }
        }
    }
@@ -485,12 +627,24 @@ class BoardViewModel(
        checked: Boolean,
    ) = mutate { it.setItemChecked(note.id, index.toString(), checked) }

+    /**
+     * Put the main board in this order, first on top: the end of a card drag.
+     *
+     * Through [mutate] so the board is re-read afterwards, which is what settles a
+     * drop the store did not take as shown. A card dragged across the pinned line
+     * snaps back to its own side, because the store sorts by pinned first.
+     */
+    fun reorder(orderedIds: List<String>) =
+        mutate {
+            it.reorderNotes(orderedIds)
+            null
+        }
+
    fun dismissError() {
        state = state.copy(error = null)
    }

    companion object {
-        private const val FALLBACK_ERROR = "Something went wrong."
        private const val SEARCH_DEBOUNCE_MS = 180L

        // The core's board vocabulary. "archived", not "archive" — it matches on
@@ -500,20 +654,14 @@ class BoardViewModel(
        private const val VIEW_TRASH = "trash"

        fun factory(
-            core: ThoughtSync,
+            core: Inkwell,
+            readFile: (Uri) -> PickedFile,
            onRemindersChanged: () -> Unit,
        ): ViewModelProvider.Factory =
-            object : ViewModelProvider.Factory {
-                @Suppress("UNCHECKED_CAST")
-                override fun <T : ViewModel> create(modelClass: Class<T>): T =
-                    BoardViewModel(core, onRemindersChanged) as T
-            }
+            viewModelFactory { initializer { BoardViewModel(core, onRemindersChanged, readFile) } }
    }
 }

-/** The palette key a note starts on, matching the web and the desktop. */
-private const val DEFAULT_COLOR = "default"
-
 // ── pure builders ───────────────────────────────────────────────────────────
 //
 // Neither of these reads or writes view-model state; they only shape a core input
@@ -523,13 +671,14 @@ private const val DEFAULT_COLOR = "default"
 private fun query(
    view: String,
    labelId: String? = null,
-) = NoteQuery(view = view, labelId = labelId, sort = null, facets = null)
+    facets: NoteFacets? = null,
+) = NoteQuery(view = view, labelId = labelId, sort = null, facets = facets)

 private fun draft(content: String): NoteDraft =
    // The core names the note from the body's first line, so a captured thought is
    // findable without anyone being asked to name it. A checklist is added afterwards,
    // in the editor — it is something a note HAS, not a different thing to capture.
-    NoteDraft(body = content, color = DEFAULT_COLOR, items = null)
+    NoteDraft(body = content, items = null)

 /**
 * The id a note has before it has been saved.
@@ -545,7 +694,6 @@ private fun blankDraft(): Note =
        id = DRAFT_ID,
        displayTitle = "",
        body = "",
-        color = DEFAULT_COLOR,
        position = 0,
        pinned = false,
        archived = false,
@@ -559,4 +707,7 @@ private fun blankDraft(): Note =
        previews = emptyList(),
        createdAt = null,
        updatedAt = null,
+        permission = NoteAccess.OWNER.wire,
+        shared = false,
+        sharedBy = null,
    )
@@ -0,0 +1,51 @@
+package com.fabledsword.inkwell.ui
+
+import androidx.compose.foundation.background
+import androidx.compose.foundation.isSystemInDarkTheme
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import com.fabledsword.inkwell.R
+
+/** The corner of every chip on a card: tags, reminders, who shared it. */
+internal val CHIP_RADIUS = 6.dp
+
+/** A one-line chip on a card, in the chip colours of the palette entry [tintKey]. */
+@Composable
+internal fun TintChip(
+    text: String,
+    tintKey: String,
+) {
+    val dark = isSystemInDarkTheme()
+    val tint = noteTint(tintKey)
+    Text(
+        text = text,
+        style = MaterialTheme.typography.labelSmall,
+        color = tint.chipForeground(dark),
+        maxLines = 1,
+        overflow = TextOverflow.Ellipsis,
+        modifier =
+            Modifier
+                .clip(RoundedCornerShape(CHIP_RADIUS))
+                .background(tint.chipBackground(dark))
+                .padding(horizontal = 6.dp, vertical = 2.dp),
+    )
+}
+
+/** Marks a tag the note's text carries, beside its name, wherever tags are listed. */
+@Composable
+internal fun FromTextMark() {
+    Text(
+        text = stringResource(R.string.label_from_tag),
+        style = MaterialTheme.typography.labelSmall,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+        modifier = Modifier.padding(start = 8.dp),
+    )
+}
@@ -0,0 +1,109 @@
+package com.fabledsword.inkwell.ui
+
+// The colour a LABEL wears when nobody picked one for it.
+//
+// Every `#tag` is born colourless, so without this a board of tags is a board of
+// identical grey chips. Hashing the tag's NAME is deterministic, identical on every
+// surface, costs no column and no migration, and a tag keeps its colour for life.
+//
+// THIS WAS THE CARD'S COLOUR TOO, ONCE. It is not any more (M315): a note's fill is
+// one neutral and only its tags carry hue. The hash survived that removal because the
+// job it still does — give a name a stable colour — was never the job that failed.
+// What failed was asking a colour that means "which tag" to also mean nothing at all
+// on an untagged note, at which point the board had two vocabularies and neither read.
+//
+// THIS IS HALF A MIRRORED PAIR. `frontend/src/notes/colors.ts` computes the same hash
+// over the same key order, and the two must agree exactly or a tag is one colour on
+// the phone and another in the browser. Same discipline as the checklist grammar's
+// three implementations, and the same reason: a value that disagrees across surfaces
+// is a bug you cannot unsee and cannot explain.
+//
+// NO COMPOSE IN THIS FILE, deliberately. It is the half of the pair that CAN be
+// pinned by a host-JVM test, and staying free of `androidx.compose` is what keeps
+// `DerivedTintTest` runnable in the Unit tests step rather than on an emulator. The
+// web side has no test runner at all, so this test is the only mechanical guard the
+// mirror gets — see the fixture comment in colors.ts.
+
+/**
+ * The colours a derived hue can land on: `NOTE_TINTS`' keys minus `default`, which is
+ * the ABSENCE of a colour — a tag that derived it would be indistinguishable from one
+ * nobody has tagged. `gray` stays: as a chip it reads as a deliberate choice.
+ *
+ * Order is load-bearing and matches `DERIVED_TINT_KEYS` in colors.ts. Reordering this
+ * list silently recolours every tag on one surface only.
+ */
+val DERIVED_TINT_KEYS: List<String> =
+    listOf("red", "orange", "yellow", "green", "teal", "blue", "purple", "pink", "gray")
+
+private const val FNV_OFFSET_BASIS = -0x7ee3623b // 0x811c9dc5 as a signed Int
+private const val FNV_PRIME = 0x01000193
+private const val BYTE_MASK = 0xFF
+private const val UNSIGNED_MASK = 0xFFFFFFFFL
+
+/**
+ * FNV-1a over the id's bytes, 32-bit.
+ *
+ * Chosen because both languages compute it identically in ten lines with no library.
+ * Explicitly NOT `String.hashCode()`: Kotlin's is specified but JS has no equivalent,
+ * and reimplementing Java's from memory in TypeScript is exactly how a mirror drifts.
+ *
+ * `and BYTE_MASK` is a no-op for the ASCII of a UUID, and is kept because it states
+ * the intent — this hashes BYTES, so the TypeScript side reading `charCodeAt(i) &
+ * 0xff` is the same function rather than a coincidence.
+ *
+ * Overflow is the point: Kotlin's `Int` wraps on multiply, which is what the web's
+ * `Math.imul` exists to reproduce.
+ */
+fun tintHash(id: String): Int {
+    var hash = FNV_OFFSET_BASIS
+    for (ch in id) {
+        hash = hash xor (ch.code and BYTE_MASK)
+        hash *= FNV_PRIME
+    }
+    return hash
+}
+
+/** The colour a name maps to, stable for as long as the name is. Called with a
+ *  label's lowercased name; `id` is the parameter's history, not its meaning. */
+fun derivedTint(id: String): String {
+    // Through Long to read the hash as unsigned. A signed remainder would be negative
+    // for half of all ids and index out of the list.
+    val index = (tintHash(id).toLong() and UNSIGNED_MASK) % DERIVED_TINT_KEYS.size
+    return DERIVED_TINT_KEYS[index.toInt()]
+}
+
+/**
+ * The colour key for a LABEL — its chip, and its `#tag` where it sits in the prose.
+ *
+ * Derived from the tag's NAME when nobody has picked one. Every `#tag` ever typed is
+ * `default`: the server mints one as `Label(owner_id=…, name=name)` with no colour,
+ * so without deriving, a board of tags would be a board of identical grey chips.
+ *
+ * DERIVED RATHER THAN PERSISTED AT MINT TIME, reversing #2965's plan. That plan wanted
+ * a hashed colour written at each of the four places a label can be born — and named
+ * the risk itself: `find_or_create_label` is "easy to miss, and it is the common one",
+ * since most tags are born from typing `#grocery`, not from a management screen.
+ * Deriving has no mint points to miss and no backfill for the tags already out there.
+ * The cost is that renaming a tag recolours it, which is fair: the name IS the tag.
+ *
+ * Folded because `#Todo` renamed to `#todo` is the same tag and should not change
+ * colour. [foldTag] and the web's are both locale-independent lowercasing, so the
+ * mirror holds.
+ */
+fun resolvedLabelColor(
+    name: String,
+    color: String,
+    known: Set<String>,
+): String =
+    when {
+        color.isNotEmpty() && color != "default" && color in known -> color
+        name.isEmpty() -> "default"
+        else -> derivedTint(foldTag(name))
+    }
+
+/**
+ * How two tag names compare: equal once every letter is lowercased, accented ones
+ * included, so `#Café` and `#CAFÉ` are one tag. The core's `derive::fold`, the server's
+ * `labeling.named` and the web's `foldTag` fold the same way (#5385).
+ */
+fun foldTag(name: String): String = name.lowercase()
@@ -1,4 +1,6 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui
+
+import android.net.Uri

 /**
 * Everything the editor can ask for, as one type.
@@ -25,10 +27,6 @@ sealed interface EditorAction {
        val body: String,
    ) : EditorAction

-    data class SetColor(
-        val color: String,
-    ) : EditorAction
-
    data class SetPinned(
        val pinned: Boolean,
    ) : EditorAction
@@ -82,10 +80,9 @@ sealed interface EditorAction {
    /**
     * Mark the reminder dealt with.
     *
-     * Distinct from [ClearReminder] even though the core does the same thing to
-     * the column today: this is where recurrence advancement lands when it is
-     * built, so a recurring reminder finished through the generic clear would
-     * silently stop recurring.
+     * Distinct from [ClearReminder]: a recurring reminder moves on to its next
+     * occurrence here, and only a one-off is cleared, so a recurring reminder
+     * finished through the generic clear would stop recurring.
     */
    data object CompleteReminder : EditorAction

@@ -97,4 +94,26 @@ sealed interface EditorAction {
    data class SetRecurrence(
        val rule: String?,
    ) : EditorAction
+
+    /**
+     * Attach files picked on this phone or shared into the app.
+     *
+     * URIs rather than bytes: reading them is blocking I/O, and the view model does
+     * it on the IO dispatcher where a failure can still become the error banner.
+     */
+    data class Attach(
+        val uris: List<Uri>,
+    ) : EditorAction
+
+    data class RemoveAttachment(
+        val attachmentId: String,
+    ) : EditorAction
+
+    data class RemovePreview(
+        val previewId: String,
+    ) : EditorAction
 }
+
+/** The two snoozes offered: the editor's buttons, and an hour from the notification. */
+internal const val SNOOZE_HOUR = 60L
+internal const val SNOOZE_DAY = 1440L
@@ -1,10 +1,10 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import androidx.compose.runtime.saveable.Saver
 import androidx.compose.ui.text.TextRange
 import androidx.compose.ui.text.input.TextFieldValue
-import com.fabledsword.thoughtsync.core.checklistItems
-import com.fabledsword.thoughtsync.core.checklistRender
+import com.fabledsword.inkwell.core.checklistItems
+import com.fabledsword.inkwell.core.checklistRender

 /**
 * One piece of a note body, as the editor DRAWS it.
@@ -142,6 +142,30 @@ fun List<EditorBlock>.plusTask(): Pair<List<EditorBlock>, Long> {
    return (this + EditorBlock(id, TextFieldValue(""), false)) to id
 }

+/**
+ * Re-read ONE prose block for `- [ ] ` lines somebody typed by hand, so a marker
+ * typed in the editor becomes an item without closing and reopening the note.
+ *
+ * **On blur, and only the block being left:** re-splitting on a keystroke would move
+ * the caret, and converting the moment `- [ ]` is complete would catch an item with
+ * no text yet.
+ *
+ * Returns THIS LIST when there was nothing to promote; the caller relies on that to
+ * leave the state alone, so a blur that changed nothing doesn't re-key every field.
+ *
+ * Non-canonical markers (`- [X]`, an odd bullet) come back canonical, as they would on
+ * reopen.
+ */
+internal fun List<EditorBlock>.promotingTasks(index: Int): List<EditorBlock> {
+    val block = getOrNull(index)
+    if (block == null || block.isTask) return this
+    val split = splitBlocks(block.value.text, nextId())
+    // A single prose block back means there was nothing to promote. `splitBlocks` never
+    // returns an empty list, so `first()` is safe.
+    val changed = split.size > 1 || split.first().isTask
+    return if (changed) take(index) + split + drop(index + 1) else this
+}
+
 /**
 * Put the caret at the end of the last block, for an editor that has just opened.
 *
@@ -1,7 +1,6 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import android.text.format.DateUtils
-import androidx.annotation.StringRes
 import androidx.compose.foundation.background
 import androidx.compose.foundation.border
 import androidx.compose.foundation.isSystemInDarkTheme
@@ -13,17 +12,14 @@ import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.imePadding
 import androidx.compose.foundation.layout.navigationBarsPadding
 import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.automirrored.filled.ArrowBack
 import androidx.compose.material.icons.automirrored.filled.List
 import androidx.compose.material.icons.filled.Check
 import androidx.compose.material.icons.filled.Close
 import androidx.compose.material.icons.filled.MoreVert
 import androidx.compose.material.icons.filled.Notifications
 import androidx.compose.material3.DropdownMenu
-import androidx.compose.material3.DropdownMenuItem
 import androidx.compose.material3.ExperimentalMaterial3Api
 import androidx.compose.material3.FilledTonalIconButton
 import androidx.compose.material3.Icon
@@ -42,10 +38,11 @@ import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
+import androidx.compose.ui.res.painterResource
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.unit.dp
-import com.fabledsword.thoughtsync.R
-import com.fabledsword.thoughtsync.core.Note
+import com.fabledsword.inkwell.R
+import com.fabledsword.inkwell.core.Note

 /**
 * The editor's action bar, along the top of the surface.
@@ -78,13 +75,19 @@ import com.fabledsword.thoughtsync.core.Note
 fun EditorTopBar(
    note: Note,
    readOnly: Boolean,
-    tint: NoteTint,
+    access: NoteAccess,
    onClose: () -> Unit,
    onStartChecklist: () -> Unit,
    onPicker: (Picker) -> Unit,
+    onAttach: () -> Unit,
+    onShare: () -> Unit,
    onConfirmDelete: () -> Unit,
    onAction: (EditorAction) -> Unit,
 ) {
+    // Someone else's note (#5175): its text, at `edit`, and this account's own pin
+    // and archive (#5176) are all that may change here, so the bar keeps the
+    // checklist button and an overflow of those two, and nothing that is the owner's.
+    val owner = access == NoteAccess.OWNER
    val dark = isSystemInDarkTheme()
    TopAppBar(
        title = {},
@@ -92,33 +95,18 @@ fun EditorTopBar(
            // The only way out, and the only thing that needed a "save" button
            // before writes became continuous. Leaving IS saving now, which is what
            // the line in the bottom corner is there to say out loud.
-            IconButton(onClick = onClose) {
-                Icon(
-                    Icons.AutoMirrored.Filled.ArrowBack,
-                    contentDescription = stringResource(R.string.editor_back),
-                )
-            }
+            BackButton(onClose, R.string.editor_back)
        },
        actions = {
-            if (!readOnly) {
-                // A dot in the note's CURRENT colour rather than a palette icon: it
-                // shows what the colour is as well as what the button does.
-                IconButton(onClick = { onPicker(Picker.COLOR) }) {
-                    Box(
-                        modifier =
-                            Modifier
-                                .size(SWATCH_DOT)
-                                .clip(CircleShape)
-                                .background(tint.chipBackground(dark))
-                                .border(1.dp, tint.border(dark), CircleShape),
-                    )
-                }
+            if (!readOnly && owner) {
                IconButton(onClick = { onPicker(Picker.REMINDER) }) {
                    Icon(
                        Icons.Filled.Notifications,
                        contentDescription = stringResource(R.string.editor_reminder),
                    )
                }
+            }
+            if (!readOnly) {
                // Inserts `- [ ] ` at the caret. Always available, and never hidden:
                // a checklist is text now (M304), so there is no section to be
                // already-showing and no reason a second list cannot start further
@@ -130,27 +118,42 @@ fun EditorTopBar(
                    )
                }
            }
-            OverflowMenu(
-                note = note,
-                readOnly = readOnly,
-                onPicker = onPicker,
-                onConfirmDelete = onConfirmDelete,
-                onAction = onAction,
-            )
+            // On the bar rather than in the overflow: attaching a photo is something
+            // people look for, and a menu of words is where it would not be found.
+            if (!readOnly && owner) {
+                IconButton(onClick = onAttach) {
+                    Icon(
+                        painter = painterResource(R.drawable.ic_attach),
+                        contentDescription = stringResource(R.string.editor_attach),
+                    )
+                }
+            }
+            if (owner || !note.trashed) {
+                OverflowMenu(
+                    note = note,
+                    owner = owner,
+                    onPicker = onPicker,
+                    onShare = onShare,
+                    onConfirmDelete = onConfirmDelete,
+                    onAction = onAction,
+                )
+            }
        },
        // EXPLICIT, and not optional — the same lesson the old bottom bar learned.
        // Material derives a bar's content colour from its container via
        // contentColorFor(), which maps a colour-SCHEME ROLE to its `on-` pair and
-        // returns Unspecified for anything else. A note tint is never a role, so the
-        // icons drew with no colour filter: black vectors on a near-black bar, a
-        // toolbar that rendered the whole time and was invisible in dark mode.
+        // returns Unspecified for anything else. The card surface is a plain constant
+        // and not a role, so the icons drew with no colour filter: black vectors on a
+        // near-black bar, a toolbar that rendered the whole time and was invisible in
+        // dark mode. STILL TRUE with one neutral surface — it is the same kind of
+        // value, so this stays exactly as it is.
        //
-        // onSurface for the actions too, not the default onSurfaceVariant: these sit
-        // on a tinted bar rather than a scheme surface, and the muted variant does
+        // onSurface for the actions too, not the default onSurfaceVariant: the bar has
+        // to read against the card rather than the board, and the muted variant does
        // not have the contrast to spare.
        colors =
            TopAppBarDefaults.topAppBarColors(
-                containerColor = tint.background(dark),
+                containerColor = noteCardSurface(dark),
                navigationIconContentColor = MaterialTheme.colorScheme.onSurface,
                titleContentColor = MaterialTheme.colorScheme.onSurface,
                actionIconContentColor = MaterialTheme.colorScheme.onSurface,
@@ -196,11 +199,9 @@ fun EditorTopBar(
 fun EditorFooter(
    updatedAt: String?,
    saving: Boolean,
-    tint: NoteTint,
    onClose: () -> Unit,
    modifier: Modifier = Modifier,
 ) {
-    val dark = isSystemInDarkTheme()
    Row(
        modifier =
            modifier
@@ -223,12 +224,20 @@ fun EditorFooter(
        )
        FilledTonalIconButton(
            onClick = onClose,
-            // The note's own colour rather than the scheme's secondaryContainer,
-            // which would be the one element on a tinted card ignoring the tint.
+            // The BRAND, matching the board's compose FAB — the app's one existing
+            // statement of "this is the affirmative action here", now reused rather
+            // than a second one invented.
+            //
+            // This wore the note's own tint until M315, on the argument that it would
+            // otherwise be the one element on a tinted card ignoring the tint. There is
+            // no tint to ignore any more, and the alternative — Material's default
+            // secondaryContainer — is a baseline M3 colour this theme never sets, so
+            // taking the default would put an off-brand lilac in the corner of the
+            // editor.
            colors =
                IconButtonDefaults.filledTonalIconButtonColors(
-                    containerColor = tint.chipBackground(dark),
-                    contentColor = tint.chipForeground(dark),
+                    containerColor = MaterialTheme.colorScheme.primary,
+                    contentColor = MaterialTheme.colorScheme.onPrimary,
                ),
        ) {
            Icon(Icons.Filled.Check, contentDescription = stringResource(R.string.editor_done))
@@ -264,8 +273,9 @@ private fun savedLabel(
@Composable
 private fun OverflowMenu(
    note: Note,
-    readOnly: Boolean,
+    owner: Boolean,
    onPicker: (Picker) -> Unit,
+    onShare: () -> Unit,
    onConfirmDelete: () -> Unit,
    onAction: (EditorAction) -> Unit,
 ) {
@@ -276,41 +286,62 @@ private fun OverflowMenu(
            Icon(Icons.Filled.MoreVert, contentDescription = stringResource(R.string.editor_more))
        }
        DropdownMenu(expanded = open, onDismissRequest = close) {
-            if (readOnly) {
-                MenuItem(R.string.editor_restore, close) { onAction(EditorAction.Restore) }
-                MenuItem(R.string.editor_delete_forever, close, onConfirmDelete)
+            if (note.trashed) {
+                TrashedNoteItems(close, onAction, onConfirmDelete)
            } else {
-                MenuItem(
-                    if (note.pinned) R.string.editor_unpin else R.string.editor_pin,
-                    close,
-                ) { onAction(EditorAction.SetPinned(!note.pinned)) }
-                MenuItem(R.string.editor_labels, close) { onPicker(Picker.LABELS) }
-                MenuItem(
-                    if (note.archived) R.string.editor_unarchive else R.string.editor_archive,
-                    close,
-                ) { onAction(EditorAction.SetArchived(!note.archived)) }
-                MenuItem(R.string.editor_trash, close) { onAction(EditorAction.Trash) }
+                PinItem(note, close, onAction)
+                if (owner) {
+                    MenuItem(R.string.editor_labels, close) { onPicker(Picker.LABELS) }
+                }
+                // Not on a draft: the server has nothing to share until it is saved.
+                if (owner && note.id != DRAFT_ID) {
+                    MenuItem(R.string.editor_share, close, onShare)
+                }
+                ArchiveItem(note, close, onAction)
+                if (owner) {
+                    MenuItem(R.string.editor_trash, close) { onAction(EditorAction.Trash) }
+                }
            }
        }
    }
 }

+// The rows a note's menu shares between the editor's overflow and the board's
+// long-press menu: two ways to the same acts, worded the same way.
+
+/** A trashed note's two ways out: back, or gone for good (which asks first). */
@Composable
-private fun MenuItem(
-    @StringRes labelRes: Int,
-    onClose: () -> Unit,
-    onClick: () -> Unit,
+internal fun TrashedNoteItems(
+    close: () -> Unit,
+    onAction: (EditorAction) -> Unit,
+    onConfirmDelete: () -> Unit,
 ) {
-    DropdownMenuItem(
-        text = { Text(stringResource(labelRes)) },
-        onClick = {
-            // Close BEFORE acting. An overflow menu left hanging over the sheet
-            // that just opened underneath it is the classic version of this bug,
-            // and doing it here means no call site can forget.
-            onClose()
-            onClick()
-        },
-    )
+    MenuItem(R.string.editor_restore, close) { onAction(EditorAction.Restore) }
+    MenuItem(R.string.editor_delete_forever, close, onConfirmDelete)
+}
+
+@Composable
+internal fun PinItem(
+    note: Note,
+    close: () -> Unit,
+    onAction: (EditorAction) -> Unit,
+) {
+    MenuItem(
+        if (note.pinned) R.string.editor_unpin else R.string.editor_pin,
+        close,
+    ) { onAction(EditorAction.SetPinned(!note.pinned)) }
+}
+
+@Composable
+internal fun ArchiveItem(
+    note: Note,
+    close: () -> Unit,
+    onAction: (EditorAction) -> Unit,
+) {
+    MenuItem(
+        if (note.archived) R.string.editor_unarchive else R.string.editor_archive,
+        close,
+    ) { onAction(EditorAction.SetArchived(!note.archived)) }
 }

 /**
@@ -330,37 +361,33 @@ fun EditorLabelRow(
    val dark = isSystemInDarkTheme()
    Column(modifier = Modifier.padding(top = 12.dp)) {
        note.labels.forEach { label ->
-            val tint = noteTint(label.color)
+            val tint = labelTintFor(label.name, label.color)
            Row(
                verticalAlignment = Alignment.CenterVertically,
                modifier = Modifier.padding(vertical = 2.dp),
            ) {
                Text(
-                    text = label.name,
+                    // `#` on every chip, matching the card. This row still shows the
+                    // tags the BODY owns as well — it is the control surface, and the
+                    // "from tag" hint beside one is what says why it has no cross.
+                    text = hashtag(label.name),
                    style = MaterialTheme.typography.labelLarge,
-                    color = tint.chipForeground(dark),
+                    color = tint.tagInk(dark),
                    modifier =
                        Modifier
                            .clip(CircleShape)
                            .background(tint.chipBackground(dark))
+                            .border(1.dp, tint.chipBorder(dark), CircleShape)
                            .padding(horizontal = 10.dp, vertical = 4.dp),
                )
                if (label.viaTag) {
-                    Text(
-                        text = stringResource(R.string.label_from_tag),
-                        style = MaterialTheme.typography.labelSmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        modifier = Modifier.padding(start = 8.dp),
-                    )
+                    FromTextMark()
                } else if (!readOnly) {
                    IconButton(onClick = {
                        // Only the MANUAL labels are sent: the core replaces
                        // exactly those, and including a tag label here would ask
                        // it to own something the body text already owns.
-                        val kept =
-                            note.labels
-                                .filterNot { it.viaTag || it.id == label.id }
-                                .map { it.id }
+                        val kept = note.manualLabelIds - label.id
                        onAction(EditorAction.SetLabels(kept))
                    }) {
                        Icon(
@@ -415,7 +442,3 @@ fun EditorReminderRow(
        }
    }
 }
-
-private val SWATCH_DOT = 22.dp
-private const val SNOOZE_HOUR = 60L
-private const val SNOOZE_DAY = 1440L
@@ -1,33 +1,26 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

-import androidx.compose.foundation.background
-import androidx.compose.foundation.border
+import androidx.annotation.StringRes
 import androidx.compose.foundation.clickable
-import androidx.compose.foundation.isSystemInDarkTheme
 import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.ColumnScope
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.heightIn
 import androidx.compose.foundation.layout.imePadding
 import androidx.compose.foundation.layout.navigationBarsPadding
 import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.foundation.lazy.items
-import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.foundation.text.KeyboardActions
 import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.filled.Check
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.Checkbox
 import androidx.compose.material3.DatePicker
 import androidx.compose.material3.DatePickerDialog
 import androidx.compose.material3.ExperimentalMaterial3Api
 import androidx.compose.material3.FilterChip
-import androidx.compose.material3.Icon
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.ModalBottomSheet
 import androidx.compose.material3.Text
@@ -42,13 +35,12 @@ import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.input.ImeAction
 import androidx.compose.ui.unit.dp
-import com.fabledsword.thoughtsync.R
-import com.fabledsword.thoughtsync.core.Label
-import com.fabledsword.thoughtsync.core.Note
+import com.fabledsword.inkwell.R
+import com.fabledsword.inkwell.core.Label
+import com.fabledsword.inkwell.core.Note
 import java.time.DayOfWeek
 import java.time.Instant
 import java.time.LocalDate
@@ -57,80 +49,17 @@ import java.time.LocalTime
 import java.time.ZoneId
 import java.time.temporal.TemporalAdjusters

-// The three things you pick rather than type: a colour, a set of labels, a time.
+// The two things you pick rather than type: a set of labels, and a time.
+//
+// It was three. The colour sheet went with `note.color` in M315 — a card is one neutral
+// surface now and colour lives on the tag, so the swatch grid was a control with nothing
+// behind it.
 //
 // All bottom sheets rather than dialogs. A dialog takes the middle of the screen
 // and asks to be dismissed; a sheet rises from the bottom, under the thumb, with
 // the note still visible above it — which matters when the choice you are making
 // is about the thing you are looking at.

-/** The note palette, as swatches. Order and colours come from [NOTE_TINTS]. */
-@OptIn(ExperimentalMaterial3Api::class)
-@Composable
-fun ColorSheet(
-    selected: String,
-    onPick: (String) -> Unit,
-    onDismiss: () -> Unit,
-) {
-    val dark = isSystemInDarkTheme()
-    ModalBottomSheet(onDismissRequest = onDismiss) {
-        Column(
-            modifier =
-                Modifier
-                    .fillMaxWidth()
-                    .padding(horizontal = 16.dp)
-                    .navigationBarsPadding(),
-        ) {
-            SheetTitle(R.string.color_picker_title)
-            // Chunked into fixed rows rather than a flow layout: ten swatches
-            // always lay out as two rows of five on every phone width, and a flow
-            // would reshuffle them between devices for no gain.
-            NOTE_TINTS.entries.chunked(SWATCHES_PER_ROW).forEach { row ->
-                Row(
-                    modifier = Modifier.fillMaxWidth().padding(vertical = 6.dp),
-                    horizontalArrangement = Arrangement.SpaceEvenly,
-                ) {
-                    row.forEach { (key, tint) ->
-                        Box(
-                            contentAlignment = Alignment.Center,
-                            modifier =
-                                Modifier
-                                    .size(SWATCH_SIZE)
-                                    .clip(CircleShape)
-                                    .background(tint.background(dark))
-                                    .border(
-                                        // The selected swatch gets a heavier ring
-                                        // as well as a tick: on the pale tints the
-                                        // tick alone is nearly invisible.
-                                        if (key == selected) 2.dp else 1.dp,
-                                        if (key == selected) {
-                                            MaterialTheme.colorScheme.primary
-                                        } else {
-                                            tint.border(dark)
-                                        },
-                                        CircleShape,
-                                    ).clickable(onClickLabel = tint.label) { onPick(key) },
-                        ) {
-                            if (key == selected) {
-                                Icon(
-                                    Icons.Filled.Check,
-                                    contentDescription = tint.label,
-                                    modifier = Modifier.size(18.dp),
-                                )
-                            }
-                        }
-                    }
-                    // Pad a short final row so its swatches line up with the row
-                    // above instead of spreading across the full width.
-                    repeat(SWATCHES_PER_ROW - row.size) {
-                        Box(modifier = Modifier.size(SWATCH_SIZE))
-                    }
-                }
-            }
-        }
-    }
-}
-
 /**
 * Every label, ticked where it is on the note.
 *
@@ -147,80 +76,62 @@ fun LabelSheet(
    onDismiss: () -> Unit,
 ) {
    var typed by remember { mutableStateOf("") }
-    val manual =
-        note.labels
-            .filterNot { it.viaTag }
-            .map { it.id }
-            .toSet()
+    val manual = note.manualLabelIds.toSet()
    val viaTag =
        note.labels
            .filter { it.viaTag }
            .map { it.id }
            .toSet()

-    ModalBottomSheet(onDismissRequest = onDismiss) {
-        Column(
-            modifier =
-                Modifier
-                    .fillMaxWidth()
-                    .padding(horizontal = 16.dp)
-                    .imePadding()
-                    .navigationBarsPadding(),
-        ) {
-            SheetTitle(R.string.label_picker_title)
+    Sheet(
+        title = R.string.label_picker_title,
+        onDismiss = onDismiss,
+        modifier = Modifier.imePadding(),
+    ) {
+        PlainTextField(
+            value = typed,
+            onValueChange = { typed = it },
+            hint = R.string.label_new_hint,
+            singleLine = true,
+            keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
+            keyboardActions =
+                KeyboardActions(onDone = {
+                    onAction(EditorAction.CreateLabel(typed))
+                    typed = ""
+                }),
+        )

-            PlainTextField(
-                value = typed,
-                onValueChange = { typed = it },
-                hint = R.string.label_new_hint,
-                singleLine = true,
-                keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
-                keyboardActions =
-                    KeyboardActions(onDone = {
-                        onAction(EditorAction.CreateLabel(typed))
-                        typed = ""
-                    }),
-            )
-
-            // Capped rather than unbounded: a sheet that grows past the screen
-            // makes its own scroll fight the sheet's drag gesture.
-            LazyColumn(modifier = Modifier.heightIn(max = LABEL_LIST_MAX_HEIGHT)) {
-                items(items = labels, key = { it.id }) { label ->
-                    val fromTag = label.id in viaTag
-                    Row(verticalAlignment = Alignment.CenterVertically) {
-                        Checkbox(
-                            checked = fromTag || label.id in manual,
-                            enabled = !fromTag,
-                            onCheckedChange = { on ->
-                                val next = if (on) manual + label.id else manual - label.id
-                                onAction(EditorAction.SetLabels(next.toList()))
-                            },
-                        )
-                        Text(
-                            text = label.name,
-                            style = MaterialTheme.typography.bodyLarge,
-                            modifier = Modifier.padding(start = 4.dp),
-                        )
-                        if (fromTag) {
-                            Text(
-                                text = stringResource(R.string.label_from_tag),
-                                style = MaterialTheme.typography.labelSmall,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                                modifier = Modifier.padding(start = 8.dp),
-                            )
-                        }
-                    }
+        // Capped rather than unbounded: a sheet that grows past the screen
+        // makes its own scroll fight the sheet's drag gesture.
+        LazyColumn(modifier = Modifier.heightIn(max = LABEL_LIST_MAX_HEIGHT)) {
+            items(items = labels, key = { it.id }) { label ->
+                val fromTag = label.id in viaTag
+                Row(verticalAlignment = Alignment.CenterVertically) {
+                    Checkbox(
+                        checked = fromTag || label.id in manual,
+                        enabled = !fromTag,
+                        onCheckedChange = { on ->
+                            val next = if (on) manual + label.id else manual - label.id
+                            onAction(EditorAction.SetLabels(next.toList()))
+                        },
+                    )
+                    Text(
+                        text = label.name,
+                        style = MaterialTheme.typography.bodyLarge,
+                        modifier = Modifier.padding(start = 4.dp),
+                    )
+                    if (fromTag) FromTextMark()
                }
            }
+        }

-            if (labels.isEmpty()) {
-                Text(
-                    text = stringResource(R.string.label_none_body),
-                    style = MaterialTheme.typography.bodyMedium,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    modifier = Modifier.padding(vertical = 16.dp),
-                )
-            }
+        if (labels.isEmpty()) {
+            Text(
+                text = stringResource(R.string.label_none_body),
+                style = MaterialTheme.typography.bodyMedium,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                modifier = Modifier.padding(vertical = 16.dp),
+            )
        }
    }
 }
@@ -243,60 +154,53 @@ fun ReminderSheet(
 ) {
    var exact by remember { mutableStateOf(false) }

-    ModalBottomSheet(onDismissRequest = onDismiss) {
-        Column(
-            modifier =
-                Modifier
-                    .fillMaxWidth()
-                    .padding(horizontal = 16.dp)
-                    .navigationBarsPadding(),
-        ) {
-            SheetTitle(R.string.reminder_title)
-
-            reminderPresets().forEach { (labelRes, at) ->
-                Text(
-                    text = "${stringResource(labelRes)} · ${formatInstant(rfc3339(at))}",
-                    style = MaterialTheme.typography.bodyLarge,
-                    modifier =
-                        Modifier
-                            .fillMaxWidth()
-                            .clickable {
-                                onAction(EditorAction.SetReminder(rfc3339(at)))
-                                onDismiss()
-                            }.padding(vertical = 12.dp),
-                )
-            }
-
+    Sheet(
+        title = R.string.reminder_title,
+        onDismiss = onDismiss,
+    ) {
+        reminderPresets().forEach { (labelRes, at) ->
            Text(
-                text = stringResource(R.string.reminder_pick),
+                text = "${stringResource(labelRes)} · ${formatInstant(rfc3339(at))}",
                style = MaterialTheme.typography.bodyLarge,
                modifier =
                    Modifier
                        .fillMaxWidth()
-                        .clickable { exact = true }
-                        .padding(vertical = 12.dp),
+                        .clickable {
+                            onAction(EditorAction.SetReminder(rfc3339(at)))
+                            onDismiss()
+                        }.padding(vertical = 12.dp),
            )
+        }

-            // Repeat only appears once there IS a reminder — a recurrence rule on
-            // a note with no time to recur from is a setting that does nothing.
-            if (note.remindAt != null) {
-                RecurrenceChips(
-                    current = note.recurrence,
-                    onPick = { onAction(EditorAction.SetRecurrence(it)) },
-                )
-                Text(
-                    text = stringResource(R.string.reminder_clear),
-                    style = MaterialTheme.typography.bodyLarge,
-                    color = MaterialTheme.colorScheme.error,
-                    modifier =
-                        Modifier
-                            .fillMaxWidth()
-                            .clickable {
-                                onAction(EditorAction.ClearReminder)
-                                onDismiss()
-                            }.padding(vertical = 12.dp),
-                )
-            }
+        Text(
+            text = stringResource(R.string.reminder_pick),
+            style = MaterialTheme.typography.bodyLarge,
+            modifier =
+                Modifier
+                    .fillMaxWidth()
+                    .clickable { exact = true }
+                    .padding(vertical = 12.dp),
+        )
+
+        // Repeat only appears once there IS a reminder — a recurrence rule on
+        // a note with no time to recur from is a setting that does nothing.
+        if (note.remindAt != null) {
+            RecurrenceChips(
+                current = note.recurrence,
+                onPick = { onAction(EditorAction.SetRecurrence(it)) },
+            )
+            Text(
+                text = stringResource(R.string.reminder_clear),
+                style = MaterialTheme.typography.bodyLarge,
+                color = MaterialTheme.colorScheme.error,
+                modifier =
+                    Modifier
+                        .fillMaxWidth()
+                        .clickable {
+                            onAction(EditorAction.ClearReminder)
+                            onDismiss()
+                        }.padding(vertical = 12.dp),
+            )
        }
    }

@@ -359,7 +263,7 @@ private fun ExactReminderPicker(
                ) { Text(stringResource(R.string.picker_next)) }
            },
            dismissButton = {
-                TextButton(onClick = onDismiss) { Text(stringResource(R.string.editor_cancel)) }
+                TextButton(onClick = onDismiss) { Text(stringResource(R.string.cancel)) }
            },
        ) {
            DatePicker(state = state)
@@ -385,7 +289,7 @@ private fun ExactReminderPicker(
                }) { Text(stringResource(R.string.picker_set)) }
            },
            dismissButton = {
-                TextButton(onClick = onDismiss) { Text(stringResource(R.string.editor_cancel)) }
+                TextButton(onClick = onDismiss) { Text(stringResource(R.string.cancel)) }
            },
        )
    }
@@ -410,8 +314,38 @@ private fun RecurrenceChips(
    }
 }

+/**
+ * A bottom sheet with its title: full width, the screen's side margin, and clear of
+ * the navigation bar. [modifier] adds to that, after the inset (ime padding, a
+ * scroll, extra space at the bottom).
+ */
+@OptIn(ExperimentalMaterial3Api::class)
@Composable
-private fun SheetTitle(labelRes: Int) {
+internal fun Sheet(
+    @StringRes title: Int,
+    onDismiss: () -> Unit,
+    modifier: Modifier = Modifier,
+    verticalArrangement: Arrangement.Vertical = Arrangement.Top,
+    content: @Composable ColumnScope.() -> Unit,
+) {
+    ModalBottomSheet(onDismissRequest = onDismiss) {
+        Column(
+            modifier =
+                Modifier
+                    .fillMaxWidth()
+                    .padding(horizontal = 16.dp)
+                    .navigationBarsPadding()
+                    .then(modifier),
+            verticalArrangement = verticalArrangement,
+        ) {
+            SheetTitle(title)
+            content()
+        }
+    }
+}
+
+@Composable
+internal fun SheetTitle(labelRes: Int) {
    Text(
        text = stringResource(labelRes),
        style = MaterialTheme.typography.titleMedium,
@@ -461,8 +395,6 @@ private val RECURRENCE_RULES: List<Pair<String?, Int>> =
        "yearly" to R.string.recurrence_yearly,
    )

-private const val SWATCHES_PER_ROW = 5
 private const val EVENING_HOUR = 18
 private const val MORNING_HOUR = 8
-private val SWATCH_SIZE = 44.dp
 private val LABEL_LIST_MAX_HEIGHT = 320.dp
@@ -1,9 +1,10 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import androidx.compose.foundation.background
 import androidx.compose.foundation.border
 import androidx.compose.foundation.isSystemInDarkTheme
 import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.RowScope
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.shape.RoundedCornerShape
@@ -16,7 +17,7 @@ import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.unit.dp
-import com.fabledsword.thoughtsync.R
+import com.fabledsword.inkwell.R

 // Shared by the board and the editor.
 //
@@ -28,9 +29,28 @@ import com.fabledsword.thoughtsync.R
 fun ErrorBanner(
    message: String,
    onDismiss: () -> Unit,
+) {
+    Banner("red") {
+        Text(
+            text = message,
+            style = MaterialTheme.typography.bodyMedium,
+            modifier = Modifier.weight(1f),
+        )
+        TextButton(onClick = onDismiss) { Text(stringResource(R.string.error_dismiss)) }
+    }
+}
+
+/**
+ * A strip across the top of a screen, tinted from the note palette by [tintKey]: a
+ * message on the left and what can be done about it on the right.
+ */
+@Composable
+fun Banner(
+    tintKey: String,
+    content: @Composable RowScope.() -> Unit,
 ) {
    val dark = isSystemInDarkTheme()
-    val tint = noteTint("red")
+    val tint = noteTint(tintKey)
    Row(
        modifier =
            Modifier
@@ -42,12 +62,7 @@ fun ErrorBanner(
                .padding(start = 12.dp),
        verticalAlignment = Alignment.CenterVertically,
    ) {
-        Text(
-            text = message,
-            style = MaterialTheme.typography.bodyMedium,
-            modifier = Modifier.weight(1f),
-        )
-        TextButton(onClick = onDismiss) { Text(stringResource(R.string.error_dismiss)) }
+        content()
    }
 }

@@ -0,0 +1,14 @@
+package com.fabledsword.inkwell.ui
+
+/** What a failure says when the core gave it no message of its own. */
+internal const val FALLBACK_ERROR = "Something went wrong."
+
+/**
+ * The message to show for a failure.
+ *
+ * The core writes its errors for people to read ("notes.example.com responded, but
+ * not with Inkwell's configuration"), so they are shown as they are rather than
+ * replaced with a generic line that would throw away the only useful part.
+ * [fallback] is for the failure that carries no message at all.
+ */
+internal fun Throwable.shownAs(fallback: String = FALLBACK_ERROR): String = message ?: fallback
@@ -0,0 +1,85 @@
+package com.fabledsword.inkwell.ui
+
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.DisposableEffect
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberUpdatedState
+import androidx.compose.runtime.setValue
+import androidx.lifecycle.Lifecycle
+import androidx.lifecycle.LifecycleEventObserver
+import androidx.lifecycle.compose.LocalLifecycleOwner
+
+/**
+ * Calls back when the app comes to the front and when it leaves.
+ *
+ * `ON_START`/`ON_STOP` and not `ON_RESUME`/`ON_PAUSE`: resume and pause fire for
+ * anything that merely covers the window — a permission dialog, the notification
+ * shade — and a sync per shade-pull is not automatic sync, it is a stutter, just as
+ * a save per dialog would save the editor mid-sentence.
+ *
+ * A single-Activity app, so the Activity's lifecycle is the app's. If a second
+ * Activity is ever added this needs `ProcessLifecycleOwner` instead, or rotating
+ * between them will read as leaving and returning.
+ *
+ * Callers want different halves of it: automatic sync uses both, the reminder
+ * notice and the update card use the return to re-read a permission the person may
+ * have just changed in the system settings, and the editor uses the leaving to
+ * write down text that otherwise exists only in a composable — the process can be
+ * killed while backgrounded without it being told again.
+ *
+ * Both callbacks go through [rememberUpdatedState]: the observer is registered
+ * once, and without it the lambda would keep reading the first composition's
+ * state forever — deciding whether to push unsent notes from a snapshot taken
+ * before any note existed, or saving the first composition's empty text over a
+ * full note.
+ */
+@Composable
+fun ForegroundTransitions(
+    onForeground: () -> Unit = {},
+    onBackground: () -> Unit = {},
+) {
+    val forward by rememberUpdatedState(onForeground)
+    val away by rememberUpdatedState(onBackground)
+    val owner = LocalLifecycleOwner.current
+    DisposableEffect(owner) {
+        val observer =
+            LifecycleEventObserver { _, event ->
+                when (event) {
+                    Lifecycle.Event.ON_START -> forward()
+                    Lifecycle.Event.ON_STOP -> away()
+                    else -> Unit
+                }
+            }
+        owner.lifecycle.addObserver(observer)
+        onDispose { owner.lifecycle.removeObserver(observer) }
+    }
+}
+
+/**
+ * Run [act] once per trip to the front, as soon as [ready] holds.
+ *
+ * A trip that arrives before [ready] is held, not dropped: it runs when [ready]
+ * turns true. [onBackground] is passed through to [ForegroundTransitions].
+ *
+ * The trip is consumed inside the effect, so [act] fires once however many times
+ * the effect restarts. Writing a key from inside the effect does restart it — but
+ * there is no suspension point between consuming it and the call, so the block
+ * runs to completion before the recomposition that would cancel it is scheduled.
+ */
+@Composable
+fun OnEachForeground(
+    ready: Boolean,
+    onBackground: () -> Unit = {},
+    act: () -> Unit,
+) {
+    var wanted by remember { mutableStateOf(false) }
+    ForegroundTransitions(onForeground = { wanted = true }, onBackground = onBackground)
+    LaunchedEffect(wanted, ready) {
+        if (!wanted || !ready) return@LaunchedEffect
+        wanted = false
+        act()
+    }
+}
@@ -0,0 +1,196 @@
+package com.fabledsword.inkwell.ui
+
+import androidx.compose.foundation.border
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.IntrinsicSize
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxHeight
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.layout.ContentScale
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import coil3.compose.AsyncImage
+import com.fabledsword.inkwell.core.LinkPreview
+import com.fabledsword.inkwell.core.Note
+
+private val PREVIEW_RADIUS = 8.dp
+
+// The image's width on each size of card, matching the web's `w-24` and `w-12`.
+private val FULL_IMAGE_WIDTH = 96.dp
+private val COMPACT_IMAGE_WIDTH = 48.dp
+
+/**
+ * A URL that is the WHOLE body, whitespace either side allowed.
+ *
+ * Mirrors `LONE_URL_RE` in the web's `notes/links.ts` deliberately — the two surfaces
+ * have to agree on what counts as "this note is a link", or the same note reads as a
+ * card on one and a paragraph on the other. Someone pasting a link rarely trims it,
+ * which is why the surrounding whitespace is tolerated rather than rejected.
+ */
+private val LONE_URL = Regex("""^\s*(https?://[^\s<>"'\]\)]+)\s*$""")
+
+/** The sentence's punctuation, not the link's: the server trims it before unfurling. */
+private val TRAILING_PUNCTUATION = charArrayOf('.', ',', ';', ':', '!', '?')
+
+/**
+ * The link a note that is nothing but a link files its preview under, or null.
+ *
+ * Trimmed the way the server's `unfurl_queue.detect_urls` trims it, since that is the
+ * key the preview arrives under (#5399). The web's `loneUrl` is the same rule, and
+ * both run the `urls` cases in `core/testdata/grammar.json` (here, by hand).
+ */
+fun loneUrl(body: String): String? =
+    LONE_URL
+        .matchEntire(body)
+        ?.groupValues
+        ?.get(1)
+        ?.trimEnd { it in TRAILING_PUNCTUATION }
+        ?.ifEmpty { null }
+
+/**
+ * The preview for a note that is nothing but a URL, or null.
+ *
+ * Null covers three different situations that all render the same way — the body
+ * is not a lone URL, the server has not unfurled it yet, or it never could. The
+ * card falls back to showing the URL as text in every one of them, so it is never
+ * blank and the link is never unreachable.
+ *
+ * A note written on the phone and not yet synced is permanently in the middle
+ * case: the unfurl happens server-side (`unfurl_queue.py`) and arrives on a later
+ * pull. That is the honest behaviour and it has to look deliberate, which showing
+ * the URL does.
+ */
+fun loneUrlPreview(note: Note): LinkPreview? {
+    val url = loneUrl(note.body) ?: return null
+    return note.previews.firstOrNull { it.url == url }
+}
+
+/** True when the body is a lone URL, whether or not a preview has arrived for it. */
+fun isLoneUrl(note: Note): Boolean = loneUrl(note.body) != null
+
+/**
+ * A fetched link preview, in one of two sizes.
+ *
+ * [compact] is a single row — one line of title and the site — for a URL mentioned
+ * *inside* a note that has its own words. The note is the thing; the link is a
+ * footnote to it. Full size is for a note that IS a URL, where the link is the
+ * note and a compact strip would be a card with nothing on it.
+ *
+ * The image sits in a strip down the left edge, cropped to the card's height, as in
+ * the web's `LinkPreview.vue`. `image_url` is a REMOTE third-party address — the
+ * linked page's og:image — so the phone fetches it from whatever host the link
+ * points at, exactly as a browser does for the web card. The operator chose that
+ * parity knowingly (Scribe #3307). Coil's disk cache means a card scrolled past
+ * twice costs one download, not two.
+ */
+@Composable
+fun LinkPreviewCard(
+    preview: LinkPreview,
+    compact: Boolean,
+    modifier: Modifier = Modifier,
+) {
+    // Every element of the Modifier chain stays on ONE line, which is why the shape
+    // and the two paddings are named first. `standard:chain-method-continuation`
+    // wants a `.` that follows a MULTILINE element glued to its closing paren —
+    // `).padding(…)` — which is unreadable, so the multiline element is avoided
+    // instead (Scribe #3110).
+    val shape = RoundedCornerShape(PREVIEW_RADIUS)
+    val padH = if (compact) 8.dp else 10.dp
+    val padV = if (compact) 6.dp else 8.dp
+
+    // IntrinsicSize.Min so the image strip can fill exactly the text's height, which
+    // is what the web's `self-stretch` does.
+    Row(
+        modifier =
+            modifier
+                .fillMaxWidth()
+                .height(IntrinsicSize.Min)
+                .clip(shape)
+                .border(1.dp, MaterialTheme.colorScheme.outlineVariant, shape),
+    ) {
+        PreviewImage(url = preview.imageUrl, compact = compact)
+        PreviewText(
+            preview = preview,
+            compact = compact,
+            modifier = Modifier.weight(1f).padding(horizontal = padH, vertical = padV),
+        )
+    }
+}
+
+/**
+ * The preview's image, or nothing at all.
+ *
+ * Nothing rather than an empty box when there is no image, AND when it fails to
+ * load: a page that names an og:image it no longer serves is common, and a grey
+ * square says "broken" about a card whose words are perfectly good. Same outcome
+ * as a preview that never had an image.
+ */
+@Composable
+private fun PreviewImage(
+    url: String?,
+    compact: Boolean,
+) {
+    var failed by remember(url) { mutableStateOf(false) }
+    if (url.isNullOrBlank() || failed) return
+    AsyncImage(
+        model = url,
+        // Decoration: the title beside it already says what the link is.
+        contentDescription = null,
+        contentScale = ContentScale.Crop,
+        onError = { failed = true },
+        modifier = Modifier.width(if (compact) COMPACT_IMAGE_WIDTH else FULL_IMAGE_WIDTH).fillMaxHeight(),
+    )
+}
+
+@Composable
+private fun PreviewText(
+    preview: LinkPreview,
+    compact: Boolean,
+    modifier: Modifier,
+) {
+    Column(modifier = modifier) {
+        preview.siteName?.takeIf { it.isNotBlank() }?.let { site ->
+            Text(
+                text = site.uppercase(),
+                style = MaterialTheme.typography.labelSmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                maxLines = 1,
+                overflow = TextOverflow.Ellipsis,
+            )
+        }
+        Text(
+            // The URL stands in for a missing title so the row always says SOMETHING
+            // about where it goes.
+            text = preview.title?.takeIf { it.isNotBlank() } ?: preview.url,
+            style = if (compact) MaterialTheme.typography.bodySmall else MaterialTheme.typography.bodyMedium,
+            maxLines = 1,
+            overflow = TextOverflow.Ellipsis,
+        )
+        // First thing to go when there is no room — the compact row is a footnote and
+        // a description would make it the loudest part of the card.
+        if (!compact) {
+            preview.description?.takeIf { it.isNotBlank() }?.let { body ->
+                Text(
+                    text = body,
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    maxLines = 2,
+                    overflow = TextOverflow.Ellipsis,
+                )
+            }
+        }
+    }
+}
@@ -0,0 +1,39 @@
+package com.fabledsword.inkwell.ui
+
+import com.fabledsword.inkwell.core.Note
+
+/**
+ * How this account holds a note (#5175), read from the core's `permission`.
+ *
+ * Someone else's note at [EDIT] may have its TEXT changed here; at [VIEW] it may
+ * not. Either way its pin and archive are this account's own (#5176). The core
+ * refuses the rest anyway — this only keeps the editor from offering what would be
+ * refused.
+ */
+enum class NoteAccess(
+    /** The core's `permission` string, which is also the server's and the web's. */
+    val wire: String,
+) {
+    OWNER("owner"),
+    EDIT("edit"),
+    VIEW("view"),
+}
+
+val Note.access: NoteAccess
+    get() = NoteAccess.entries.firstOrNull { it.wire == permission } ?: NoteAccess.OWNER
+
+/** Its content can't change here: it is in the trash, or shared with us to view. */
+val Note.readOnlyHere: Boolean
+    get() = trashed || access == NoteAccess.VIEW
+
+/** The owner's own controls apply: tags, reminder, files, previews, share, trash. */
+val Note.ownerControlsHere: Boolean
+    get() = !readOnlyHere && access == NoteAccess.OWNER
+
+/**
+ * The tags attached by hand (the picker, or a lifted line), as opposed to the ones
+ * the body's own `#tags` carry. A label write sets exactly these; a body tag is the
+ * body's to keep.
+ */
+val Note.manualLabelIds: List<String>
+    get() = labels.filterNot { it.viaTag }.map { it.id }
@@ -0,0 +1,519 @@
+package com.fabledsword.inkwell.ui
+
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.combinedClickable
+import androidx.compose.foundation.isSystemInDarkTheme
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material3.DropdownMenu
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.draw.shadow
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.hapticfeedback.HapticFeedbackType
+import androidx.compose.ui.platform.LocalHapticFeedback
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.AnnotatedString
+import androidx.compose.ui.text.SpanStyle
+import androidx.compose.ui.text.buildAnnotatedString
+import androidx.compose.ui.text.font.FontStyle
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.style.TextDecoration
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import com.fabledsword.inkwell.R
+import com.fabledsword.inkwell.core.BodyItem
+import com.fabledsword.inkwell.core.Note
+import com.fabledsword.inkwell.core.NoteLabel
+import com.fabledsword.inkwell.core.bodyTags
+import com.fabledsword.inkwell.core.checklistItems
+
+@Composable
+fun NoteCard(
+    note: Note,
+    onOpen: () -> Unit,
+    onToggleItem: (Int, Boolean) -> Unit,
+    onAction: (EditorAction) -> Unit,
+    onConfirmDelete: () -> Unit,
+    /** The board is carrying this card (BoardDrag.kt). */
+    dragging: Boolean = false,
+) {
+    val dark = isSystemInDarkTheme()
+    val haptics = LocalHapticFeedback.current
+    var menuOpen by remember { mutableStateOf(false) }
+
+    // A drag starts from the same long press that opens the menu, so the menu is
+    // already up when the card begins to move. It goes as the card does.
+    LaunchedEffect(dragging) { if (dragging) menuOpen = false }
+
+    // NAMED rather than written inline in the chain below, and not for taste: ktlint's
+    // chain-method-continuation wants the next `.` glued to the closing paren of a
+    // multiline element — `).background(…)` — which is worse to read than a modifier
+    // with a name. Every other multiline element in this codebase happens to be last
+    // in its chain, so this is the first place the rule bites.
+    val opening =
+        Modifier.combinedClickable(
+            onClickLabel = stringResource(R.string.board_open_note),
+            onLongClickLabel = stringResource(R.string.board_note_actions),
+            onLongClick = {
+                // Fired HERE rather than when the menu appears. A long press is
+                // confirmed by the system before the popup has laid out, and the whole
+                // point of the buzz is to say "that registered" at the moment your
+                // finger has been still long enough — a menu that arrives with no tick
+                // under it reads as a phone that missed the gesture and then changed
+                // its mind.
+                haptics.performHapticFeedback(HapticFeedbackType.LongPress)
+                menuOpen = true
+            },
+            onClick = onOpen,
+        )
+
+    // The Box exists only to anchor the menu. A DropdownMenu is a popup and takes no
+    // space, so the card's size is still the Column's.
+    Box {
+        Column(
+            modifier =
+                Modifier
+                    .fillMaxWidth()
+                    // Depth, not the boundary — the edge below is that. 1dp: enough to
+                    // separate a white card from a #fafafa board, and the web's own
+                    // `shadow-sm` is the value it is matching.
+                    .shadow(CARD_ELEVATION, RoundedCornerShape(CARD_RADIUS))
+                    // Clipped BEFORE the click modifier, so the ripple is bounded by the
+                    // card's rounded corners instead of a rectangle overhanging them —
+                    // and BEFORE padding, so the padded edge is still a tap target.
+                    .clip(RoundedCornerShape(CARD_RADIUS))
+                    .then(opening)
+                    // ONE surface and ONE edge on every card, both neutral, neither
+                    // asking the note anything. See noteCardSurface and CARD_EDGE_DARK.
+                    .background(noteCardSurface(dark))
+                    .border(1.dp, if (dark) CARD_EDGE_DARK else CARD_EDGE_LIGHT, RoundedCornerShape(CARD_RADIUS))
+                    .padding(12.dp),
+        ) {
+            CardContents(note = note, onToggleItem = onToggleItem)
+        }
+
+        NoteMenu(
+            note = note,
+            expanded = menuOpen,
+            onDismiss = { menuOpen = false },
+            onAction = onAction,
+            onConfirmDelete = onConfirmDelete,
+        )
+    }
+}
+
+/** What a card shows, top to bottom: tags, body, links, attachments, reminder, sharing. */
+@Composable
+private fun CardContents(
+    note: Note,
+    onToggleItem: (Int, Boolean) -> Unit,
+) {
+    // TAGS FIRST, on a row of their own above the body: a board is scanned, and
+    // what a note is about should be the first thing the eye lands on. Not beside
+    // the body, whose first line is the note's name.
+    //
+    // Only labels whose text is not still in the note (`via_tag` is false). A tag
+    // left in prose is tinted in place instead (see [tintTags]), so this row holds
+    // what the body cannot say: a tag lifted off its own line, or one added by hand.
+    val chips = note.labels.filterNot { it.viaTag }
+    if (chips.isNotEmpty()) {
+        LabelChips(labels = chips)
+        Spacer(Modifier.height(8.dp))
+    }
+
+    // A note that is NOTHING but a URL renders as its preview and nothing
+    // else — printing the raw address under a card that already says where it
+    // goes is saying the same thing twice, badly. Until the unfurl lands, or
+    // if it never does, `preview` is null and the body falls through to
+    // NoteBody, which shows the URL. Never a blank card.
+    val lonePreview = remember(note.body, note.previews) { loneUrlPreview(note) }
+
+    // Body then checklist, in order — a note can carry both (M13 step 2). The
+    // first line of the body IS the note's name, at the same weight as the rest of
+    // it (M13 steps 3 and 4).
+    if (lonePreview != null) {
+        LinkPreviewCard(preview = lonePreview, compact = false)
+    } else if (note.body.isNotBlank()) {
+        // A note shared with us to view has inert boxes (#5175): ticking one is
+        // changing its text, which is not ours to do.
+        NoteBody(
+            note = note,
+            onToggleItem = if (note.access == NoteAccess.VIEW) INERT_TOGGLE else onToggleItem,
+        )
+    }
+
+    // Links mentioned INSIDE a note: a compact strip at the foot of the card,
+    // under the note's own words rather than stacked on top of them. Putting
+    // them above would set a stranger's headline where the note's first line
+    // should be — the web learned that in M13 and moved them down.
+    if (!isLoneUrl(note) && note.previews.isNotEmpty()) {
+        Spacer(Modifier.height(8.dp))
+        note.previews.forEach { preview ->
+            LinkPreviewCard(preview = preview, compact = true)
+            Spacer(Modifier.height(4.dp))
+        }
+    }
+
+    // Under the words and the links, like the web's card: a photo is often what a
+    // note is ABOUT, but its first line is still its name.
+    if (note.attachments.isNotEmpty()) {
+        CardAttachments(attachments = note.attachments)
+    }
+
+    // A note with nothing in it still has to occupy the board legibly — otherwise
+    // it reads as a rendering bug.
+    if (note.body.isBlank() && note.previews.isEmpty() && note.attachments.isEmpty()) {
+        Text(
+            text = stringResource(R.string.board_empty_note),
+            style = MaterialTheme.typography.bodyMedium,
+            fontStyle = FontStyle.Italic,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+    }
+
+    note.remindAt?.let { at ->
+        Spacer(Modifier.height(8.dp))
+        ReminderChip(instant = at, recurrence = note.recurrence)
+    }
+
+    SharedChip(note)
+}
+
+/**
+ * What you can do to a note without opening it, on a long press.
+ *
+ * The same items as the editor's overflow, in the same words from the same string
+ * resources, dispatched through [EditorAction] so `BoardViewModel.onEditorAction`
+ * stays the one place they are handled.
+ *
+ * Gated on the NOTE (`note.trashed`), not on the view, because Reminders and search
+ * mix piles: a note already in Trash must not offer "Move to trash".
+ *
+ * No Labels item: the picker it opens is editor state.
+ */
+@Composable
+private fun NoteMenu(
+    note: Note,
+    expanded: Boolean,
+    onDismiss: () -> Unit,
+    onAction: (EditorAction) -> Unit,
+    onConfirmDelete: () -> Unit,
+) {
+    // Pin and archive are this account's own on someone else's note too (#5176);
+    // trash is the owner's. A note shared with us never reaches our Trash, so the
+    // trashed set is only ever the owner's.
+    val owner = note.access == NoteAccess.OWNER
+    DropdownMenu(expanded = expanded && (owner || !note.trashed), onDismissRequest = onDismiss) {
+        if (note.trashed) {
+            TrashedNoteItems(onDismiss, onAction, onConfirmDelete)
+        } else {
+            PinItem(note, onDismiss, onAction)
+            ArchiveItem(note, onDismiss, onAction)
+            if (owner) {
+                MenuItem(R.string.editor_trash, onDismiss) { onAction(EditorAction.Trash) }
+            }
+        }
+    }
+}
+
+/**
+ * The note's body, with its checklist drawn where it actually sits.
+ *
+ * Rendered line by line rather than as one block of text, because an item is a line
+ * of the body now (M304) and a card that showed the prose and then the list would put
+ * every list in the wrong place — and, since the body already contains those lines,
+ * would show each one twice.
+ *
+ * Which lines are items is asked of the core rather than matched here. The grammar is
+ * already written three times; a fourth in Compose would be a fourth place for a
+ * checklist to change shape when it syncs.
+ */
+@Composable
+private fun NoteBody(
+    note: Note,
+    onToggleItem: (Int, Boolean) -> Unit,
+) {
+    val lines = remember(note.body) { note.body.split("\n") }
+    // Read from the BODY rather than from note.items, which is the same list by a
+    // longer route — and one that can lag the text by a save.
+    val itemAtLine =
+        remember(note.body) {
+            checklistItems(note.body)
+                .mapIndexed { index, item -> item.line.toInt() to (index to item) }
+                .toMap()
+        }
+
+    Column(verticalArrangement = Arrangement.spacedBy(2.dp)) {
+        lines.take(MAX_PREVIEW_LINES).forEachIndexed { n, line ->
+            val found = itemAtLine[n]
+            when {
+                found != null ->
+                    ChecklistRow(note, found.second) { onToggleItem(found.first, !found.second.checked) }
+                // Kept as a gap rather than dropped: it is the paragraph break
+                // somebody typed, and the card reads as a wall without it.
+                line.isBlank() -> Spacer(Modifier.height(4.dp))
+                else ->
+                    Text(
+                        text = tintTags(line, note),
+                        style = MaterialTheme.typography.bodyMedium,
+                        maxLines = MAX_WRAPPED_LINES,
+                        overflow = TextOverflow.Ellipsis,
+                    )
+            }
+        }
+        if (lines.size > MAX_PREVIEW_LINES) {
+            Text(
+                text = "…",
+                style = MaterialTheme.typography.bodyMedium,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+        }
+    }
+}
+
+/**
+ * One checklist row on a card, with a box you can actually tick.
+ *
+ * A glyph rather than a Material Checkbox: it sits on a line of text and has to share
+ * that line's metrics, and a real Checkbox brings 48dp of touch target that would
+ * space a list out like a form. The tap target is the glyph's own padding, which is
+ * why it carries `clickable` rather than the row — clicking the TEXT should open the
+ * note, the way clicking anywhere else on the card does.
+ */
+@Composable
+private fun ChecklistRow(
+    note: Note,
+    item: BodyItem,
+    onToggle: () -> Unit,
+) {
+    Row(verticalAlignment = Alignment.Top) {
+        Text(
+            text = if (item.checked) "☑" else "☐",
+            style = MaterialTheme.typography.bodyMedium,
+            modifier =
+                Modifier
+                    .clickable(onClick = onToggle)
+                    .padding(end = 6.dp),
+        )
+        Text(
+            text = tintTags(item.text, note),
+            style = MaterialTheme.typography.bodyMedium,
+            textDecoration = if (item.checked) TextDecoration.LineThrough else null,
+            color =
+                if (item.checked) {
+                    MaterialTheme.colorScheme.onSurfaceVariant
+                } else {
+                    MaterialTheme.colorScheme.onSurface
+                },
+            maxLines = MAX_WRAPPED_LINES,
+            overflow = TextOverflow.Ellipsis,
+        )
+    }
+}
+
+/**
+ * One string of a note's own words, with every `#tag` in it drawn in that tag's colour.
+ *
+ * This is what replaced the chip for a tag still living in the prose. The card used to
+ * print such a tag twice — once where it was typed and once in the row above — and the
+ * duplicate was the loud copy, which made a tagged note read as "tag, then some text
+ * that happens to start with the same word". Colouring it in place says the same thing
+ * with no furniture, and says it more honestly: the token you can see IS the text you
+ * would delete to remove the tag.
+ *
+ * WHICH characters are a tag is asked of the core, exactly as [NoteBody] asks it which
+ * lines are checklist items. The grammar already exists three times (Rust, Python,
+ * TypeScript); a fourth in Compose would be a fourth thing to disagree — and this one
+ * would fail silently, as the wrong characters tinted rather than an error anywhere.
+ * The core's offsets are UTF-16 code units for this call site specifically, which is
+ * the only unit `addStyle` can take.
+ *
+ * Called per rendered STRING rather than once per body so a checklist item's text can
+ * be handled with no arithmetic: an item is a line minus a `- [ ] ` prefix of a length
+ * nothing carries, and shifting spans by a guessed prefix is the kind of off-by-one
+ * that shows up only on the one note that had a tag in a list.
+ */
+@Composable
+private fun tintTags(
+    text: String,
+    note: Note,
+): AnnotatedString {
+    val dark = isSystemInDarkTheme()
+    return remember(text, note.labels, dark) {
+        val spans = bodyTags(text)
+        if (spans.isEmpty()) {
+            AnnotatedString(text)
+        } else {
+            // A tag the note does not carry as a label yet — just typed, not yet
+            // derived — still gets a colour: `labelTint` falls back to deriving one
+            // from the name, which is what the chip would have shown anyway.
+            val picked = note.labels.associate { foldTag(it.name) to it.color }
+            buildAnnotatedString {
+                append(text)
+                spans.forEach { tag ->
+                    val tint = labelTint(tag.name, picked[foldTag(tag.name)].orEmpty())
+                    addStyle(
+                        SpanStyle(color = tint.tagInk(dark), fontWeight = FontWeight.Medium),
+                        tag.start.toInt(),
+                        tag.end.toInt(),
+                    )
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun LabelChips(labels: List<NoteLabel>) {
+    val dark = isSystemInDarkTheme()
+    // A plain row that clips rather than wraps: a card with eight labels should
+    // not grow taller than its content. The editor shows the full set.
+    Row(horizontalArrangement = Arrangement.spacedBy(4.dp)) {
+        labels.take(MAX_LABEL_CHIPS).forEach { label ->
+            val tint = labelTintFor(label.name, label.color)
+            Text(
+                // The `#` is carried on every chip, because everything that reaches
+                // this row is a tag — a tag lifted off its own line, or one attached
+                // through the picker — and the hash is how you would type either. It
+                // also keeps a lifted chip reading as the `#todo` somebody wrote.
+                text = hashtag(label.name),
+                style = MaterialTheme.typography.labelSmall,
+                color = tint.tagInk(dark),
+                maxLines = 1,
+                overflow = TextOverflow.Ellipsis,
+                modifier =
+                    Modifier
+                        .clip(RoundedCornerShape(CHIP_RADIUS))
+                        .background(tint.chipBackground(dark))
+                        .border(1.dp, tint.chipBorder(dark), RoundedCornerShape(CHIP_RADIUS))
+                        .padding(horizontal = 6.dp, vertical = 2.dp),
+            )
+        }
+    }
+}
+
+/**
+ * The reminder, red once it has passed.
+ *
+ * Red for overdue and neutral otherwise, matching the web card exactly — the same
+ * red-100/red-700 and black/5 pairs, resolved through the shared tint table. It
+ * used to be blue for every reminder here, which made "you missed this" and
+ * "coming up on Friday" look identical on a board full of both.
+ */
+@Composable
+private fun ReminderChip(
+    instant: String,
+    recurrence: String?,
+) {
+    TintChip(reminderLabel(instant, recurrence), if (isPast(instant)) "red" else "default")
+}
+
+/**
+ * Whose note this is, when it is not only ours (#5175): "From Robin" on a note someone
+ * shared with us, "Shared" on one of ours that we shared. Nothing on a private note.
+ */
+@Composable
+private fun SharedChip(note: Note) {
+    val text =
+        when {
+            note.access != NoteAccess.OWNER ->
+                stringResource(R.string.share_chip_by, sharerName(note))
+            note.shared -> stringResource(R.string.share_chip_shared)
+            else -> return
+        }
+    Spacer(Modifier.height(8.dp))
+    TintChip(text, "default")
+}
+
+/** A box that does nothing when tapped: someone else's note, shared to view. */
+private val INERT_TOGGLE: (Int, Boolean) -> Unit = { _, _ -> }
+
+private const val MAX_PREVIEW_LINES = 8
+
+/** How far one long line of a card may wrap before it is cut. */
+private const val MAX_WRAPPED_LINES = 2
+private const val MAX_LABEL_CHIPS = 3
+private val CARD_RADIUS = 12.dp
+private val CARD_ELEVATION = 1.dp
+
+// ---------------------------------------------------------------------------
+// WHAT A CARD IS: one surface and one edge, neither of which asks the note anything.
+//
+// Both are constants HERE rather than columns in NoteTint precisely so the palette
+// CANNOT vary them; uniformity is the feature. The editor reads the surface from here
+// too, so a note opened is the same object as the note on the board.
+
+/**
+ * THE CARD SURFACE — one neutral per theme (M315).
+ *
+ * This used to be a function of the note: a palette fill for a tagged one, a colour
+ * generated from the id for the rest. Both are gone. The operator's verdict after four
+ * passes — "my coloring attempt has failed and nothing looks right… we've tried a lot
+ * to make the color work and somehow it never seems to land" — and the diagnosis under
+ * it is that a card's fill was being asked to carry meaning it could not carry. Nine
+ * keys is too few to identify anything on a board of any size, and a generated fill
+ * identifies nothing by construction, so a coloured board taught the eye to read hue
+ * as significant and then handed it noise. Colour lives on the TAG now, where the
+ * thing it names is right beside it.
+ *
+ * The values are `neutral-900` on dark and white on light — exactly what the palette's
+ * `default` always was, and exactly what the web card and both editors already use, so
+ * this is a collapse onto a surface every surface already had rather than a new colour
+ * anybody has to like. Mirrored as `NOTE_CARD_SURFACE` in `frontend/src/notes/colors.ts`
+ * (`bg-white dark:bg-neutral-900`).
+ *
+ * NOT a colour-scheme role: `surface` is the BOARD in this theme (neutral-50 / -950),
+ * and Material's `surfaceContainer` roles are unset here so they would resolve to
+ * baseline M3 greys rather than to the web's neutrals. Two hexes matching the web beats
+ * a role that nearly does.
+ *
+ * Measured, against the operator's "not the same color as their background but close
+ * to it" — the card fill is deliberately the WEAKEST number on the card:
+ *
+ *   card vs board   light  #FFFFFF on #FAFAFA   1.04
+ *                   dark   #171717 on #0A0A0A   1.10
+ *   edge vs card    light  #B8B8B8 on #FFFFFF   1.98
+ *                   dark   #404040 on #171717   1.73
+ *   body vs card    light  #171717 on #FFFFFF  17.93   (needs 4.5)
+ *                   dark   #FAFAFA on #171717  17.17
+ *   muted vs card   light  #404040 on #FFFFFF  10.37
+ *                   dark   #E5E5E5 on #171717  14.23
+ *
+ * A card is not separated from the board by its fill and never was — the edge and the
+ * shadow do that, which is why 1.04 is enough and why it has to stay near 1. A fill
+ * that separated on its own would be a panel, and a board of panels is the wall this
+ * whole line of work started from.
+ */
+fun noteCardSurface(dark: Boolean): Color = if (dark) CARD_SURFACE_DARK else CARD_SURFACE_LIGHT
+
+private val CARD_SURFACE_LIGHT = Color(0xFFFFFFFF)
+private val CARD_SURFACE_DARK = Color(0xFF171717)
+
+// THE CARD'S EDGE — one neutral grey, every card, both themes. The fill barely differs
+// from the board, so this line is what makes a card a card. Neutral on purpose: a
+// coloured edge would carry information and turn a board into a grid of outlines.
+//
+// Opaque rather than a translucent black/white, which would composite differently over
+// whatever is under it. NoteCard.vue writes the same two hex values, which is how the
+// surfaces stay the same card. Contrast: #B8B8B8 on white 1.98, #404040 on #171717 1.73.
+private val CARD_EDGE_LIGHT = Color(0xFFB8B8B8)
+private val CARD_EDGE_DARK = Color(0xFF404040)
@@ -1,6 +1,8 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import androidx.activity.compose.BackHandler
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
 import androidx.compose.foundation.isSystemInDarkTheme
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
@@ -12,13 +14,10 @@ import androidx.compose.foundation.layout.windowInsetsPadding
 import androidx.compose.foundation.rememberScrollState
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.ExperimentalMaterial3Api
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Surface
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
@@ -27,11 +26,9 @@ import androidx.compose.runtime.remember
 import androidx.compose.runtime.saveable.rememberSaveable
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Modifier
-import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.unit.dp
-import com.fabledsword.thoughtsync.R
-import com.fabledsword.thoughtsync.core.Label
-import com.fabledsword.thoughtsync.core.Note
+import com.fabledsword.inkwell.core.Label
+import com.fabledsword.inkwell.core.Note
 import kotlinx.coroutines.delay

 /**
@@ -44,8 +41,9 @@ import kotlinx.coroutines.delay
 * negotiating with the IME for the bottom half of the display, and the swipe-down it
 * buys is a gesture back already does. The shape is what was worth keeping.
 *
- * The note's own colour paints the WHOLE card rather than a panel inside it, so
- * opening a note reads as the same object growing to fill the display.
+ * The card's surface paints the WHOLE sheet rather than a panel inside it, so opening
+ * a note reads as the same object growing to fill the display — the more literally
+ * true since M315, where the board and the editor became the same one neutral.
 *
 * No save button, deliberately. Writes are continuous, so a button offering to do
 * what already happened would be a lie with a tap attached; [EditorFooter] in the
@@ -60,10 +58,10 @@ fun NoteEditorScreen(
    labels: List<Label>,
    saving: Boolean,
    error: String?,
+    onShare: () -> Unit,
    onAction: (EditorAction) -> Unit,
 ) {
    val dark = isSystemInDarkTheme()
-    val tint = noteTint(note.color)

    // Keyed by the SESSION, not by note.id: the editor is reused across notes, so it
    // needs a key — but a draft's id changes the moment it is first saved, and
@@ -93,7 +91,13 @@ fun NoteEditorScreen(
    // A note in the trash is a record, not a document: editing one would silently
    // resurrect work that was meant to be thrown away. It renders read-only, with
    // Restore and Delete forever as the only things to do with it.
-    val readOnly = note.trashed
+    //
+    // A note shared with us to view is read-only for the same reason it is on the
+    // web: nothing about it is ours to change (#5175). At edit, the text is, and the
+    // rows that are the owner's (tags, reminder, files, previews) stay inert.
+    val access = note.access
+    val readOnly = note.readOnlyHere
+    val ownerControls = note.ownerControlsHere

    // Persist the text, if it changed. The baseline check is what makes "open a
    // note, read it, back out" write nothing at all — without it every glance
@@ -137,10 +141,18 @@ fun NoteEditorScreen(

    BackHandler(onBack = leave)

+    // The system picker, for any type: a note can carry a PDF as readily as a photo.
+    // Leaving for it stops this screen, so the flush on leaving has already saved the text by
+    // the time the files come back.
+    val pickFiles =
+        rememberLauncherForActivityResult(ActivityResultContracts.GetMultipleContents()) { uris ->
+            if (uris.isNotEmpty()) onAction(EditorAction.Attach(uris))
+        }
+
    // Leaving the APP is not closing the editor, so the text has to be saved
    // without the screen being torn down. Losing a paragraph to an incoming call
    // is exactly the failure that makes someone stop trusting a notes app.
-    FlushOnStop(flush)
+    ForegroundTransitions(onBackground = flush)

    // The sheet shape, kept. `windowInsetsPadding` both insets the card below the
    // status bar AND consumes that inset, so the bar inside adds no second gap of
@@ -155,24 +167,24 @@ fun NoteEditorScreen(
        Surface(
            modifier = Modifier.fillMaxSize(),
            shape = RoundedCornerShape(topStart = SHEET_CORNER, topEnd = SHEET_CORNER),
-            color = tint.background(dark),
+            color = noteCardSurface(dark),
            // Both content colours are spelled out for the reason the toolbar had to
            // be: Surface and Scaffold each default theirs to contentColorFor(their
            // container), which returns Unspecified for anything that is not a
-            // colour-SCHEME ROLE. A note tint never is, so the default publishes
+            // colour-SCHEME ROLE. The card surface is not one, so the default publishes
            // Unspecified as LocalContentColor and everything inside that does not
            // set its own colour draws black — which is how the last toolbar became
            // invisible in dark mode.
            contentColor = MaterialTheme.colorScheme.onSurface,
        ) {
            Scaffold(
-                containerColor = tint.background(dark),
+                containerColor = noteCardSurface(dark),
                contentColor = MaterialTheme.colorScheme.onSurface,
                topBar = {
                    EditorTopBar(
                        note = note,
                        readOnly = readOnly,
-                        tint = tint,
+                        access = access,
                        onClose = leave,
                        onStartChecklist = {
                            val (next, id) = blocks.plusTask()
@@ -180,6 +192,11 @@ fun NoteEditorScreen(
                            focus = id
                        },
                        onPicker = { picker = it },
+                        onAttach = { pickFiles.launch(ANY_TYPE) },
+                        onShare = {
+                            flush()
+                            onShare()
+                        },
                        onConfirmDelete = { confirmingDelete = true },
                        onAction = onAction,
                    )
@@ -192,7 +209,6 @@ fun NoteEditorScreen(
                    EditorFooter(
                        updatedAt = note.updatedAt,
                        saving = saving,
-                        tint = tint,
                        onClose = leave,
                    )
                },
@@ -221,6 +237,9 @@ fun NoteEditorScreen(
                        )
                    }

+                    // Whose note this is, and what may be done with it here.
+                    SharedByLine(note)
+
                    // A note is its body; its NAME is that body's first line, so there
                    // is nothing separate to type into and nothing rendered bolder than
                    // the line beneath it (M13 steps 3 and 4). What 2992 changed is only
@@ -239,17 +258,29 @@ fun NoteEditorScreen(
                    // list on screen twice.

                    if (note.labels.isNotEmpty()) {
-                        EditorLabelRow(note = note, readOnly = readOnly, onAction = onAction)
+                        EditorLabelRow(note = note, readOnly = !ownerControls, onAction = onAction)
                    }

                    note.remindAt?.let { at ->
                        EditorReminderRow(
                            at = at,
                            recurrence = note.recurrence,
-                            readOnly = readOnly,
+                            readOnly = !ownerControls,
                            onAction = onAction,
                        )
                    }
+
+                    if (note.attachments.isNotEmpty()) {
+                        EditorAttachments(
+                            attachments = note.attachments,
+                            readOnly = !ownerControls,
+                            onAction = onAction,
+                        )
+                    }
+
+                    if (note.previews.isNotEmpty()) {
+                        EditorPreviews(previews = note.previews, readOnly = !ownerControls, onAction = onAction)
+                    }
                }
            }
        }
@@ -264,31 +295,18 @@ fun NoteEditorScreen(
    )

    if (confirmingDelete) {
-        // The only irreversible action in the app earns the only confirmation in
-        // it. Everything else — archive, trash, even unlinking a server — undoes.
-        AlertDialog(
-            onDismissRequest = { confirmingDelete = false },
-            title = { Text(stringResource(R.string.editor_delete_forever_title)) },
-            text = { Text(stringResource(R.string.editor_delete_forever_body)) },
-            confirmButton = {
-                TextButton(onClick = {
-                    confirmingDelete = false
-                    onAction(EditorAction.DeleteForever)
-                }) {
-                    Text(stringResource(R.string.editor_delete_forever_confirm))
-                }
-            },
-            dismissButton = {
-                TextButton(onClick = { confirmingDelete = false }) {
-                    Text(stringResource(R.string.editor_cancel))
-                }
+        ConfirmDeleteDialog(
+            onConfirm = {
+                confirmingDelete = false
+                onAction(EditorAction.DeleteForever)
            },
+            onDismiss = { confirmingDelete = false },
        )
    }
 }

 /** Which overlay is open. One at a time, so they cannot stack on a phone screen. */
-enum class Picker { NONE, COLOR, LABELS, REMINDER }
+enum class Picker { NONE, LABELS, REMINDER }

 /** The pickers, hoisted out so the screen above reads as a layout rather than a switch. */
@Composable
@@ -302,15 +320,6 @@ private fun EditorOverlays(
    val dismiss = { onPicker(Picker.NONE) }
    when (picker) {
        Picker.NONE -> Unit
-        Picker.COLOR ->
-            ColorSheet(
-                selected = note.color,
-                onPick = {
-                    onAction(EditorAction.SetColor(it))
-                    dismiss()
-                },
-                onDismiss = dismiss,
-            )
        Picker.LABELS ->
            LabelSheet(
                note = note,
@@ -331,11 +340,14 @@ private fun EditorOverlays(
 * How long typing has to stop before the note is written.
 *
 * Long enough that a normal sentence is one write, short enough that nothing
- * meaningful is at risk if the app dies. The flush on close and [FlushOnStop] still
+ * meaningful is at risk if the app dies. The flush on close and on leaving the app still
 * cover the window between the last keystroke and this elapsing.
 */
 private const val AUTOSAVE_IDLE_MS = 1_000L

+/** What the file picker offers: everything. The server takes any type. */
+private const val ANY_TYPE = "*/*"
+
 /**
 * The card's top corner radius — Material's extra-large, which is what a bottom
 * sheet uses. Same shape as the capture surface this replaced, on purpose.
@@ -0,0 +1,302 @@
+package com.fabledsword.inkwell.ui
+
+import androidx.annotation.StringRes
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.ReadOnlyComposable
+import androidx.compose.ui.graphics.Color
+import com.fabledsword.inkwell.R
+
+/**
+ * The colour palette, matching `frontend/src/notes/colors.ts` VALUE FOR VALUE.
+ *
+ * A colour is stored by the core as a key ("red", "teal", …) and every surface
+ * resolves it to its own tints. The web app resolves through Tailwind classes; this
+ * table is those same Tailwind colours as literals, so a tag that is amber on the
+ * desktop is the same amber on the phone rather than a near-miss. Generated from
+ * tailwindcss 3.4's palette rather than transcribed by eye.
+ *
+ * Dark tints keep the web's ALPHA instead of a precomputed blend — Compose composites
+ * a translucent colour over what's beneath exactly as CSS does, so a panel sits on the
+ * background the same way in both.
+ *
+ * This table is the palette of MEANINGFUL colours: a tag's. A NOTE no longer has one
+ * at all (M315) — the card is one neutral per theme, held in NoteCard.kt beside the
+ * edge, where the palette cannot reach either of them. What is left here is the chip,
+ * the inline `#tag`, and the panels and banners that borrow a hue to say what they
+ * are.
+ *
+ * `yellow` maps to Tailwind's *amber*, matching colors.ts; plain yellow is too
+ * acid against the neutral surfaces.
+ */
+data class NoteTint(
+    @StringRes val label: Int,
+    val lightBackground: Color,
+    val lightBorder: Color,
+    val darkBackground: Color,
+    val darkBorder: Color,
+    val lightChipBackground: Color,
+    val darkChipBackground: Color,
+    /**
+     * The REMINDER pill's ink, and nothing else's — see [chipForeground].
+     *
+     * Only two of these ten are ever read (`red` when a reminder has passed, `default`
+     * otherwise). They stay a per-hue column because they are transcribed from the
+     * web's literals rather than derived from anything here.
+     */
+    val lightChipForeground: Color,
+    val darkChipForeground: Color,
+    /**
+     * THE INK A TAG IS DRAWN IN — inline in the prose and as a chip's text — see
+     * [tagInk]. One value serves both: `-800` light / `-300` dark clears body-text
+     * contrast on the card and on a chip's own fill.
+     */
+    val lightTagInk: Color,
+    val darkTagInk: Color,
+) {
+    /**
+     * The pale fill of a PANEL, a banner, an update card or a picker swatch — the
+     * places that borrow a hue to say what they are. Not a note's: since M315 a card
+     * has one neutral surface and does not come through this table at all.
+     */
+    fun background(dark: Boolean): Color = if (dark) darkBackground else lightBackground
+
+    fun border(dark: Boolean): Color = if (dark) darkBorder else lightBorder
+
+    fun chipBackground(dark: Boolean): Color = if (dark) darkChipBackground else lightChipBackground
+
+    /**
+     * The REMINDER pill's ink. NOT a tag's — a tag takes [tagInk] wherever it is drawn.
+     *
+     * Kept apart from [tagInk] because the reminder pill is not a tag: it borrows the
+     * chip's shape and its `red-100`/`black-5` fills, and its `red-700`/`neutral-600`
+     * text is transcribed from NoteCard.vue's literal classes. The two happened to be
+     * one value; making the tag ink one step deeper (M315) is where they parted, and
+     * moving the reminder with it would have silently broken that mirror instead.
+     */
+    fun chipForeground(dark: Boolean): Color = if (dark) darkChipForeground else lightChipForeground
+
+    /**
+     * The colour a `#tag` is drawn in — in the note's own words, or as a chip.
+     *
+     * A tag whose text is in the body is no longer repeated as a chip (the card was
+     * printing every tag twice — once where it was typed, once at the top). It is
+     * tinted in place instead, which is both less furniture and a more honest card:
+     * the thing you see IS the thing you would delete to remove the tag.
+     */
+    fun tagInk(dark: Boolean): Color = if (dark) darkTagInk else lightTagInk
+
+    /**
+     * A hairline edge for a chip, in its own ink at low alpha.
+     *
+     * THE EDGE IS THE PILL. Against the one card surface a chip's fill measures
+     * 1.02-1.26 in light and 1.02-1.73 in dark — very nearly nothing, and dark red at
+     * 1.02 is literally invisible. Without this the tag name would read as loose text.
+     * The fill only tints a shape the edge is drawing.
+     *
+     * An edge rather than a heavier fill, because a fill loud enough to hold its own
+     * shape would be the loudest thing on a board whose whole point is now that the tag
+     * is the one coloured thing on it.
+     */
+    fun chipBorder(dark: Boolean): Color = tagInk(dark).copy(alpha = CHIP_EDGE_ALPHA)
+}
+
+// How strongly a chip's edge is drawn, as a fraction of its own ink.
+//
+// SOLVED FOR, NOT GUESSED — and re-solved once the answer became solvable. 0.60 was
+// picked against the worst case of the time: a chip on a card of its OWN colour, back
+// when a note took its first tag's fill. It gave 2.32:1 there, missed the 3:1 of WCAG
+// 1.4.11, and the comment here reasoned its way out of that on the grounds that a
+// chip's information is its text.
+//
+// M315 removed that worst case. The edge is now the ink at alpha over a KNOWN fill, so
+// the smallest alpha clearing 3:1 for all ten hues is arithmetic rather than judgment:
+// 0.60 gives 2.75-3.82 in light and misses for six of the ten, 0.65 gives 3.03-4.36 and
+// misses for none. Dark runs 4.52-5.76. The old comment named 0.80 as the fallback if
+// the judgment were ever overruled; it is not needed, and it draws a hard outline where
+// a hairline does the job.
+//
+// Mirrored on the web as the `/65` in LABEL_CHIP_SHELL's ring.
+private const val CHIP_EDGE_ALPHA = 0.65f
+
+/** Keyed by the core's colour vocabulary. Order matches the web's picker. */
+val NOTE_TINTS: Map<String, NoteTint> =
+    mapOf(
+        "default" to
+            NoteTint(
+                label = R.string.tint_default,
+                lightBackground = Color(0xFFFFFFFF),
+                lightBorder = Color(0xFFE5E5E5),
+                darkBackground = Color(0xFF171717),
+                darkBorder = Color(0xFF404040),
+                lightChipBackground = Color(0x0D000000),
+                lightChipForeground = Color(0xFF525252),
+                darkChipBackground = Color(0x1AFFFFFF),
+                darkChipForeground = Color(0xFFD4D4D4),
+                lightTagInk = Color(0xFF404040),
+                darkTagInk = Color(0xFFD4D4D4),
+            ),
+        "red" to
+            NoteTint(
+                label = R.string.tint_red,
+                lightBackground = Color(0xFFFEF2F2),
+                lightBorder = Color(0xFFFECACA),
+                darkBackground = Color(0x66450A0A),
+                darkBorder = Color(0xFF7F1D1D),
+                lightChipBackground = Color(0xFFFEE2E2),
+                lightChipForeground = Color(0xFFB91C1C),
+                darkChipBackground = Color(0x80450A0A),
+                darkChipForeground = Color(0xFFFCA5A5),
+                lightTagInk = Color(0xFF991B1B),
+                darkTagInk = Color(0xFFFCA5A5),
+            ),
+        "orange" to
+            NoteTint(
+                label = R.string.tint_orange,
+                lightBackground = Color(0xFFFFF7ED),
+                lightBorder = Color(0xFFFED7AA),
+                darkBackground = Color(0x66431407),
+                darkBorder = Color(0xFF7C2D12),
+                lightChipBackground = Color(0xFFFFEDD5),
+                lightChipForeground = Color(0xFFC2410C),
+                darkChipBackground = Color(0x80431407),
+                darkChipForeground = Color(0xFFFDBA74),
+                lightTagInk = Color(0xFF9A3412),
+                darkTagInk = Color(0xFFFDBA74),
+            ),
+        "yellow" to
+            NoteTint(
+                label = R.string.tint_yellow,
+                lightBackground = Color(0xFFFFFBEB),
+                lightBorder = Color(0xFFFDE68A),
+                darkBackground = Color(0x66451A03),
+                darkBorder = Color(0xFF78350F),
+                lightChipBackground = Color(0xFFFEF3C7),
+                lightChipForeground = Color(0xFF92400E),
+                darkChipBackground = Color(0x80451A03),
+                darkChipForeground = Color(0xFFFCD34D),
+                lightTagInk = Color(0xFF92400E),
+                darkTagInk = Color(0xFFFCD34D),
+            ),
+        "green" to
+            NoteTint(
+                label = R.string.tint_green,
+                lightBackground = Color(0xFFF0FDF4),
+                lightBorder = Color(0xFFBBF7D0),
+                darkBackground = Color(0x66052E16),
+                darkBorder = Color(0xFF14532D),
+                lightChipBackground = Color(0xFFDCFCE7),
+                lightChipForeground = Color(0xFF15803D),
+                darkChipBackground = Color(0x80052E16),
+                darkChipForeground = Color(0xFF86EFAC),
+                lightTagInk = Color(0xFF166534),
+                darkTagInk = Color(0xFF86EFAC),
+            ),
+        "teal" to
+            NoteTint(
+                label = R.string.tint_teal,
+                lightBackground = Color(0xFFF0FDFA),
+                lightBorder = Color(0xFF99F6E4),
+                darkBackground = Color(0x66042F2E),
+                darkBorder = Color(0xFF134E4A),
+                lightChipBackground = Color(0xFFCCFBF1),
+                lightChipForeground = Color(0xFF0F766E),
+                darkChipBackground = Color(0x80042F2E),
+                darkChipForeground = Color(0xFF5EEAD4),
+                lightTagInk = Color(0xFF115E59),
+                darkTagInk = Color(0xFF5EEAD4),
+            ),
+        "blue" to
+            NoteTint(
+                label = R.string.tint_blue,
+                lightBackground = Color(0xFFEFF6FF),
+                lightBorder = Color(0xFFBFDBFE),
+                darkBackground = Color(0x66172554),
+                darkBorder = Color(0xFF1E3A8A),
+                lightChipBackground = Color(0xFFDBEAFE),
+                lightChipForeground = Color(0xFF1D4ED8),
+                darkChipBackground = Color(0x80172554),
+                darkChipForeground = Color(0xFF93C5FD),
+                lightTagInk = Color(0xFF1E40AF),
+                darkTagInk = Color(0xFF93C5FD),
+            ),
+        "purple" to
+            NoteTint(
+                label = R.string.tint_purple,
+                lightBackground = Color(0xFFFAF5FF),
+                lightBorder = Color(0xFFE9D5FF),
+                darkBackground = Color(0x663B0764),
+                darkBorder = Color(0xFF581C87),
+                lightChipBackground = Color(0xFFF3E8FF),
+                lightChipForeground = Color(0xFF7E22CE),
+                darkChipBackground = Color(0x803B0764),
+                darkChipForeground = Color(0xFFD8B4FE),
+                lightTagInk = Color(0xFF6B21A8),
+                darkTagInk = Color(0xFFD8B4FE),
+            ),
+        "pink" to
+            NoteTint(
+                label = R.string.tint_pink,
+                lightBackground = Color(0xFFFDF2F8),
+                lightBorder = Color(0xFFFBCFE8),
+                darkBackground = Color(0x66500724),
+                darkBorder = Color(0xFF831843),
+                lightChipBackground = Color(0xFFFCE7F3),
+                lightChipForeground = Color(0xFFBE185D),
+                darkChipBackground = Color(0x80500724),
+                darkChipForeground = Color(0xFFF9A8D4),
+                lightTagInk = Color(0xFF9D174D),
+                darkTagInk = Color(0xFFF9A8D4),
+            ),
+        "gray" to
+            NoteTint(
+                label = R.string.tint_gray,
+                lightBackground = Color(0xFFF5F5F5),
+                lightBorder = Color(0xFFD4D4D4),
+                darkBackground = Color(0xFF262626),
+                darkBorder = Color(0xFF404040),
+                lightChipBackground = Color(0xFFE5E5E5),
+                lightChipForeground = Color(0xFF404040),
+                darkChipBackground = Color(0xFF404040),
+                darkChipForeground = Color(0xFFE5E5E5),
+                lightTagInk = Color(0xFF262626),
+                darkTagInk = Color(0xFFE5E5E5),
+            ),
+    )
+
+/**
+ * Resolve a stored colour key.
+ *
+ * An unknown key falls back to `default` rather than throwing: colours are data
+ * that arrives from a server which may be newer than this client, and a note
+ * whose tint we don't recognise should still be readable.
+ */
+@Composable
+@ReadOnlyComposable
+fun noteTint(key: String): NoteTint = NOTE_TINTS[key] ?: NOTE_TINTS.getValue("default")
+
+/**
+ * The tint for a LABEL, derived from its name when nobody has picked one.
+ *
+ * Every `#tag` is born colourless, so without this a board of tags is a board of
+ * identical grey chips. See `DerivedTint.kt` for why this derives rather than
+ * persisting a colour when the tag is minted.
+ */
+@Composable
+@ReadOnlyComposable
+fun labelTintFor(
+    name: String,
+    color: String,
+): NoteTint = labelTint(name, color)
+
+/**
+ * [labelTintFor] with no composable context, for a caller building its value inside
+ * `remember` — where a `@Composable` call is not allowed. The card's inline tag
+ * colours are computed there, once per body rather than once per recomposition.
+ *
+ * One implementation, two entry points: the composable one delegates here rather than
+ * repeating the lookup, so the chip and the inline token cannot resolve differently.
+ */
+fun labelTint(
+    name: String,
+    color: String,
+): NoteTint = NOTE_TINTS[resolvedLabelColor(name, color, NOTE_TINTS.keys)] ?: NOTE_TINTS.getValue("default")
@@ -0,0 +1,217 @@
+package com.fabledsword.inkwell.ui
+
+import androidx.annotation.StringRes
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.isSystemInDarkTheme
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.automirrored.filled.ArrowBack
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.DropdownMenuItem
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.unit.dp
+import com.fabledsword.inkwell.R
+
+/**
+ * A bordered block, tinted from the same table the notes use.
+ *
+ * Reusing the note palette rather than Material's `errorContainer` keeps the whole
+ * app one visual language: a warning here is the same yellow a note can be, which
+ * is also what the web app does with its Tailwind amber.
+ */
+@Composable
+fun Panel(
+    tone: Tone = Tone.NEUTRAL,
+    content: @Composable () -> Unit,
+) {
+    val dark = isSystemInDarkTheme()
+    val tint = noteTint(tone.tintKey())
+    Column(
+        modifier =
+            Modifier
+                .fillMaxWidth()
+                .clip(RoundedCornerShape(PANEL_RADIUS))
+                .background(tint.background(dark))
+                .border(1.dp, tint.border(dark), RoundedCornerShape(PANEL_RADIUS))
+                .padding(12.dp),
+        verticalArrangement = Arrangement.spacedBy(2.dp),
+    ) {
+        content()
+    }
+}
+
+@Composable
+fun Notice(
+    tone: Tone,
+    title: String,
+    body: String,
+    onDismiss: (() -> Unit)? = null,
+    /**
+     * A way to FIX what the notice describes, when there is one.
+     *
+     * Separate from [onDismiss] because they are opposites: dismissing accepts the
+     * situation, acting changes it. A notice about a permission has an action and
+     * no dismiss — acknowledging a reminder that cannot ring does not make it ring.
+     */
+    actionLabel: String? = null,
+    onAction: (() -> Unit)? = null,
+) {
+    Panel(tone = tone) {
+        Text(
+            text = title,
+            style = MaterialTheme.typography.titleSmall,
+            fontWeight = FontWeight.SemiBold,
+        )
+        Text(text = body, style = MaterialTheme.typography.bodyMedium)
+        if (actionLabel != null && onAction != null) {
+            TextButton(onClick = onAction) { Text(actionLabel) }
+        }
+        onDismiss?.let {
+            TextButton(onClick = it) { Text(stringResource(R.string.error_dismiss)) }
+        }
+    }
+}
+
+/**
+ * One row of a dropdown menu, closing the menu before it acts.
+ *
+ * Lives here rather than beside either menu because there are two now — the
+ * editor's overflow and the board's long-press menu — and they offer the same
+ * actions in the same words. A second copy of this would be a second place for the
+ * closing order to be got wrong.
+ *
+ * Closing FIRST is the whole point: an action that raises a sheet or a dialog would
+ * otherwise do it underneath a menu still hanging over the screen. Doing it in here
+ * means no call site can forget.
+ */
+@Composable
+fun MenuItem(
+    @StringRes labelRes: Int,
+    onClose: () -> Unit,
+    onClick: () -> Unit,
+) {
+    DropdownMenuItem(
+        text = { Text(stringResource(labelRes)) },
+        onClick = {
+            onClose()
+            onClick()
+        },
+    )
+}
+
+/**
+ * The one confirmation in the app.
+ *
+ * Delete-forever is the only irreversible thing a note can be asked to do —
+ * archive, trash, even unlinking a server all undo — so it is the only one that
+ * interrupts. Both surfaces that offer it raise THIS dialog: the editor's overflow
+ * and the board's long-press menu are two ways to the same act, and two dialogs
+ * would be two chances to word the consequences differently.
+ *
+ * Nothing about a note is passed in. The caller already knows which note it is
+ * asking about and holds it while this is on screen; taking one here would only let
+ * the dialog and the action that follows it disagree.
+ */
+@Composable
+fun ConfirmDeleteDialog(
+    onConfirm: () -> Unit,
+    onDismiss: () -> Unit,
+) {
+    ConfirmDialog(
+        title = stringResource(R.string.editor_delete_forever_title),
+        body = stringResource(R.string.editor_delete_forever_body),
+        confirm = stringResource(R.string.editor_delete_forever_confirm),
+        onDismiss = onDismiss,
+        onConfirm = onConfirm,
+    )
+}
+
+/**
+ * A confirmation: what is about to happen, what it costs, and one way out.
+ *
+ * Every dialog that asks before acting is this one, so they all word their buttons
+ * and lay out their consequences the same way.
+ */
+@Composable
+fun ConfirmDialog(
+    title: String,
+    body: String,
+    confirm: String,
+    onDismiss: () -> Unit,
+    onConfirm: () -> Unit,
+    footnote: String? = null,
+) {
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        title = { Text(title) },
+        text = {
+            Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                Text(text = body, style = MaterialTheme.typography.bodyMedium)
+                footnote?.let {
+                    Text(
+                        text = it,
+                        style = MaterialTheme.typography.labelSmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+            }
+        },
+        confirmButton = {
+            TextButton(onClick = onConfirm) { Text(confirm) }
+        },
+        dismissButton = {
+            TextButton(onClick = onDismiss) { Text(stringResource(R.string.cancel)) }
+        },
+    )
+}
+
+/** The arrow out of a full-screen surface, at the start of its top bar. */
+@Composable
+fun BackButton(
+    onClick: () -> Unit,
+    @StringRes label: Int,
+) {
+    IconButton(onClick = onClick) {
+        Icon(Icons.AutoMirrored.Filled.ArrowBack, contentDescription = stringResource(label))
+    }
+}
+
+/** Secondary text under a field or a heading: smaller, and in the quieter ink. */
+@Composable
+fun Hint(
+    text: String,
+    modifier: Modifier = Modifier,
+) {
+    Text(
+        text = text,
+        style = MaterialTheme.typography.bodySmall,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+        modifier = modifier,
+    )
+}
+
+/** The three tones a panel or notice can take, mapped onto the note palette. */
+enum class Tone { NEUTRAL, WARN, ERROR }
+
+private fun Tone.tintKey(): String =
+    when (this) {
+        Tone.NEUTRAL -> "default"
+        Tone.WARN -> "yellow"
+        Tone.ERROR -> "red"
+    }
+
+private val PANEL_RADIUS = 12.dp
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import androidx.annotation.StringRes
 import androidx.compose.foundation.layout.fillMaxWidth
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import android.app.AlarmManager
 import android.content.Context
@@ -17,8 +17,8 @@ import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.unit.dp
 import androidx.core.app.NotificationManagerCompat
-import com.fabledsword.thoughtsync.R
-import com.fabledsword.thoughtsync.Reminders
+import com.fabledsword.inkwell.R
+import com.fabledsword.inkwell.Reminders

 /**
 * Says so when a reminder would not actually reach anyone.
@@ -48,7 +48,6 @@ fun ReminderNotice() {
            canNotify = notificationsAllowed(context)
            canBeExact = exactAllowed(context)
        },
-        onBackground = {},
    )

    if (canNotify && canBeExact) return
@@ -0,0 +1,245 @@
+package com.fabledsword.inkwell.ui
+
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.items
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.FilterChip
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.RadioButton
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.pluralStringResource
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.unit.dp
+import com.fabledsword.inkwell.R
+import com.fabledsword.inkwell.core.Member
+import com.fabledsword.inkwell.core.Note
+import com.fabledsword.inkwell.core.NoteShare
+import com.fabledsword.inkwell.core.ShareGroup
+import com.fabledsword.inkwell.core.ShareTarget
+
+/** Who shared [note] with us, by name, or "Someone" when the server sent none. */
+@Composable
+internal fun sharerName(note: Note): String =
+    note.sharedBy?.displayName?.takeIf { it.isNotBlank() } ?: stringResource(R.string.share_someone)
+
+/** "Shared by Robin · view only" over someone else's note; nothing over our own. */
+@Composable
+fun SharedByLine(note: Note) {
+    if (note.access == NoteAccess.OWNER) return
+    val who = sharerName(note)
+    val line =
+        if (note.access == NoteAccess.EDIT) {
+            stringResource(R.string.share_by_can_edit, who)
+        } else {
+            stringResource(R.string.share_by_view_only, who)
+        }
+    Text(
+        text = line,
+        style = MaterialTheme.typography.labelMedium,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+        modifier = Modifier.padding(bottom = 8.dp),
+    )
+}
+
+private val VIEW = NoteAccess.VIEW.wire
+private val EDIT = NoteAccess.EDIT.wire
+
+/**
+ * The Share sheet: who the note is shared with, and adding someone or a group.
+ *
+ * A peer of the web's `ShareDialog.vue`. Each share's permission is a pair of chips
+ * rather than a menu, because there are exactly two and both fit.
+ */
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+fun ShareSheet(
+    state: ShareState,
+    onShare: (target: ShareTarget, permission: String) -> Unit,
+    onUnshare: (shareId: String) -> Unit,
+    onDismiss: () -> Unit,
+) {
+    Sheet(
+        title = R.string.share_title,
+        onDismiss = onDismiss,
+        modifier = Modifier.padding(bottom = 16.dp),
+        verticalArrangement = Arrangement.spacedBy(8.dp),
+    ) {
+        when {
+            state.loading -> Muted(stringResource(R.string.share_loading))
+            state.needsServer -> Muted(stringResource(R.string.share_needs_server))
+            state.loadError != null -> ErrorText(state.loadError)
+            else -> ShareBody(state, onShare, onUnshare)
+        }
+    }
+}
+
+@Composable
+private fun ShareBody(
+    state: ShareState,
+    onShare: (target: ShareTarget, permission: String) -> Unit,
+    onUnshare: (shareId: String) -> Unit,
+) {
+    if (state.shares.isEmpty()) {
+        Muted(stringResource(R.string.share_none))
+    }
+    state.shares.forEach { share ->
+        ShareRow(
+            share = share,
+            busy = state.busy,
+            onPermission = { onShare(share.target, it) },
+            onRemove = { onUnshare(share.id) },
+        )
+    }
+    if (state.available.isEmpty()) {
+        Muted(stringResource(R.string.share_everyone))
+    } else {
+        AddPerson(state = state, onShare = onShare)
+    }
+    state.error?.let { ErrorText(it) }
+}
+
+@Composable
+private fun ShareRow(
+    share: NoteShare,
+    busy: Boolean,
+    onPermission: (String) -> Unit,
+    onRemove: () -> Unit,
+) {
+    Column {
+        Row(verticalAlignment = Alignment.CenterVertically) {
+            TargetName(share.member, share.group, Modifier.weight(1f))
+            IconButton(onClick = onRemove, enabled = !busy) {
+                Icon(Icons.Filled.Close, contentDescription = stringResource(R.string.share_remove))
+            }
+        }
+        PermissionChips(selected = share.permission, enabled = !busy, onSelect = onPermission)
+    }
+}
+
+@Composable
+private fun AddPerson(
+    state: ShareState,
+    onShare: (target: ShareTarget, permission: String) -> Unit,
+) {
+    var pick by remember(state.noteId) { mutableStateOf<ShareCandidate?>(null) }
+    var permission by remember(state.noteId) { mutableStateOf(VIEW) }
+
+    Text(
+        text = stringResource(R.string.share_add),
+        style = MaterialTheme.typography.labelLarge,
+        modifier = Modifier.padding(top = 8.dp),
+    )
+    // Capped, like the tag picker: a sheet that grows past the screen makes its own
+    // scroll fight the sheet's drag.
+    LazyColumn(modifier = Modifier.heightIn(max = MEMBER_LIST_MAX_HEIGHT)) {
+        items(items = state.available, key = { it.key }) { candidate ->
+            Row(
+                verticalAlignment = Alignment.CenterVertically,
+                modifier = Modifier.fillMaxWidth().clickable { pick = candidate },
+            ) {
+                RadioButton(selected = pick?.key == candidate.key, onClick = { pick = candidate })
+                TargetName(candidate.member, candidate.group, Modifier.weight(1f))
+            }
+        }
+    }
+    Row(verticalAlignment = Alignment.CenterVertically) {
+        PermissionChips(selected = permission, enabled = !state.busy, onSelect = { permission = it })
+        Spacer(Modifier.weight(1f))
+        TextButton(
+            enabled = pick != null && !state.busy,
+            onClick = {
+                pick?.let { onShare(it.target, permission) }
+                pick = null
+            },
+        ) { Text(stringResource(R.string.share_action)) }
+    }
+}
+
+@Composable
+private fun PermissionChips(
+    selected: String,
+    enabled: Boolean,
+    onSelect: (String) -> Unit,
+) {
+    Row(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+        FilterChip(
+            selected = selected == VIEW,
+            enabled = enabled,
+            onClick = { onSelect(VIEW) },
+            label = { Text(stringResource(R.string.share_can_view)) },
+        )
+        FilterChip(
+            selected = selected == EDIT,
+            enabled = enabled,
+            onClick = { onSelect(EDIT) },
+            label = { Text(stringResource(R.string.share_can_edit)) },
+        )
+    }
+}
+
+/** A person (name over email) or a group (name over how many are in it). */
+@Composable
+private fun TargetName(
+    member: Member?,
+    group: ShareGroup?,
+    modifier: Modifier = Modifier,
+) {
+    val title = group?.name ?: member?.let { it.displayName.ifBlank { it.email } }.orEmpty()
+    val detail =
+        when {
+            group != null ->
+                pluralStringResource(
+                    R.plurals.share_group_members,
+                    group.memberCount.toInt(),
+                    group.memberCount.toInt(),
+                )
+            member != null && member.displayName.isNotBlank() -> member.email
+            else -> null
+        }
+    Column(modifier = modifier) {
+        Text(text = title, style = MaterialTheme.typography.bodyLarge)
+        detail?.let {
+            Hint(it)
+        }
+    }
+}
+
+@Composable
+private fun Muted(text: String) {
+    Text(
+        text = text,
+        style = MaterialTheme.typography.bodyMedium,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+    )
+}
+
+@Composable
+private fun ErrorText(text: String) {
+    Text(
+        text = text,
+        style = MaterialTheme.typography.bodyMedium,
+        color = MaterialTheme.colorScheme.error,
+    )
+}
+
+private val MEMBER_LIST_MAX_HEIGHT = 240.dp
@@ -0,0 +1,142 @@
+package com.fabledsword.inkwell.ui
+
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.setValue
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.ViewModelProvider
+import androidx.lifecycle.viewModelScope
+import androidx.lifecycle.viewmodel.initializer
+import androidx.lifecycle.viewmodel.viewModelFactory
+import com.fabledsword.inkwell.core.CoreException
+import com.fabledsword.inkwell.core.Inkwell
+import com.fabledsword.inkwell.core.Member
+import com.fabledsword.inkwell.core.NoteShare
+import com.fabledsword.inkwell.core.ShareGroup
+import com.fabledsword.inkwell.core.ShareTarget
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+/** Everything the Share sheet renders from. [noteId] null means the sheet is closed. */
+data class ShareState(
+    val noteId: String? = null,
+    val loading: Boolean = false,
+    val members: List<Member> = emptyList(),
+    /** The groups the admin made (#5177); a note shared with one reaches its members. */
+    val groups: List<ShareGroup> = emptyList(),
+    val shares: List<NoteShare> = emptyList(),
+    /** This device has no server, and sharing is between people on one. */
+    val needsServer: Boolean = false,
+    /** Why the sheet couldn't load, when it has a server and still failed. */
+    val loadError: String? = null,
+    /** An in-flight write, for disabling the controls that would race it. */
+    val busy: Boolean = false,
+    val error: String? = null,
+) {
+    /** The people and groups it isn't shared with yet, people first. */
+    val available: List<ShareCandidate>
+        get() {
+            val people = shares.mapNotNull { it.member?.id }.toSet()
+            val grouped = shares.mapNotNull { it.group?.id }.toSet()
+            return members.filterNot { it.id in people }.map { ShareCandidate(member = it) } +
+                groups.filterNot { it.id in grouped }.map { ShareCandidate(group = it) }
+        }
+}
+
+/** Someone, or a group, the sheet offers to share with. Exactly one is set. */
+data class ShareCandidate(
+    val member: Member? = null,
+    val group: ShareGroup? = null,
+) {
+    val key: String
+        get() = group?.let { "g:${it.id}" } ?: "u:${member?.id}"
+    val target: ShareTarget
+        get() = targetOf(member, group)
+}
+
+/** Who an existing share goes to, to change its permission. */
+val NoteShare.target: ShareTarget
+    get() = targetOf(member, group)
+
+private fun targetOf(
+    member: Member?,
+    group: ShareGroup?,
+): ShareTarget = group?.let { ShareTarget.Group(it.id) } ?: ShareTarget.Member(member?.id.orEmpty())
+
+/**
+ * Sharing a note with other people on the linked server (#5175).
+ *
+ * A peer of the web's `ShareDialog.vue`. Shares belong to the server, so every call
+ * here is a network round-trip through the core — `suspend` functions on uniffi's
+ * tokio runtime, not blocking store calls, so no IO dispatcher is needed. The one
+ * thing the core keeps locally is the note's `shared` flag, which is why a write
+ * that landed tells the board to reload: its card chip reads that flag.
+ */
+class ShareViewModel(
+    private val core: Inkwell,
+    /** Called after a share was granted, changed or removed. */
+    private val onStoreChanged: () -> Unit,
+) : ViewModel() {
+    var state by mutableStateOf(ShareState())
+        private set
+
+    fun open(noteId: String) {
+        state = ShareState(noteId = noteId, loading = true)
+        viewModelScope.launch {
+            // Unlinked is not a failure: it is the phone working as intended, so the
+            // sheet says what sharing needs rather than showing an error.
+            state =
+                try {
+                    if (!withContext(Dispatchers.IO) { core.syncStatus().linked }) {
+                        state.copy(loading = false, needsServer = true)
+                    } else {
+                        val directory = core.shareDirectory()
+                        val shares = core.noteShares(noteId)
+                        state.copy(
+                            loading = false,
+                            members = directory.members,
+                            groups = directory.groups,
+                            shares = shares,
+                        )
+                    }
+                } catch (e: CoreException) {
+                    state.copy(loading = false, loadError = e.shownAs())
+                }
+        }
+    }
+
+    fun close() {
+        state = ShareState()
+    }
+
+    /** Share with someone or a group, or change what they may do. */
+    fun share(
+        target: ShareTarget,
+        permission: String,
+    ) = write { noteId -> core.shareNote(noteId, target, permission) }
+
+    fun unshare(shareId: String) = write { noteId -> core.unshareNote(noteId, shareId) }
+
+    private fun write(call: suspend (String) -> List<NoteShare>) {
+        val noteId = state.noteId ?: return
+        state = state.copy(busy = true, error = null)
+        viewModelScope.launch {
+            state =
+                try {
+                    val shares = call(noteId)
+                    onStoreChanged()
+                    state.copy(busy = false, shares = shares)
+                } catch (e: CoreException) {
+                    state.copy(busy = false, error = e.shownAs())
+                }
+        }
+    }
+
+    companion object {
+        fun factory(
+            core: Inkwell,
+            onStoreChanged: () -> Unit,
+        ): ViewModelProvider.Factory = viewModelFactory { initializer { ShareViewModel(core, onStoreChanged) } }
+    }
+}
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import android.os.Build
 import androidx.compose.foundation.layout.Arrangement
@@ -27,9 +27,9 @@ import androidx.compose.ui.text.input.KeyboardCapitalization
 import androidx.compose.ui.text.input.KeyboardType
 import androidx.compose.ui.text.input.PasswordVisualTransformation
 import androidx.compose.ui.unit.dp
-import com.fabledsword.thoughtsync.R
-import com.fabledsword.thoughtsync.core.Compatibility
-import com.fabledsword.thoughtsync.core.RevokeOutcome
+import com.fabledsword.inkwell.R
+import com.fabledsword.inkwell.core.Compatibility
+import com.fabledsword.inkwell.core.RevokeOutcome

 // Becoming linked: the probe-then-sign-in flow, and the notices around it.
 //
@@ -201,11 +201,7 @@ private fun SignInFields(
            singleLine = true,
            keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
        )
-        Text(
-            text = stringResource(R.string.sync_device_name_help),
-            style = MaterialTheme.typography.bodySmall,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
-        )
+        Hint(stringResource(R.string.sync_device_name_help))
    } else {
        PlainTextField(
            value = token,
@@ -218,11 +214,7 @@ private fun SignInFields(
                    imeAction = ImeAction.Done,
                ),
        )
-        Text(
-            text = stringResource(R.string.sync_token_help),
-            style = MaterialTheme.typography.bodySmall,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
-        )
+        Hint(stringResource(R.string.sync_token_help))
    }
 }

@@ -260,11 +252,7 @@ private fun AddressSection(
            Text(stringResource(R.string.sync_check))
        }
    }
-    Text(
-        text = stringResource(R.string.sync_address_help),
-        style = MaterialTheme.typography.bodySmall,
-        color = MaterialTheme.colorScheme.onSurfaceVariant,
-    )
+    Hint(stringResource(R.string.sync_address_help))
 }

 /** Everything the probe produced: progress, failure, what answered, and the risk. */
@@ -311,11 +299,7 @@ private fun ProbeCard(
            fontWeight = FontWeight.SemiBold,
        )
        version?.let {
-            Text(
-                text = stringResource(R.string.sync_server_version, it),
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
+            Hint(stringResource(R.string.sync_server_version, it))
        }
        Text(
            text = describeCompatibility(compatibility),
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
@@ -9,14 +9,9 @@ import androidx.compose.foundation.layout.imePadding
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.rememberScrollState
 import androidx.compose.foundation.verticalScroll
-import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.automirrored.filled.ArrowBack
-import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.Button
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.ExperimentalMaterial3Api
-import androidx.compose.material3.Icon
-import androidx.compose.material3.IconButton
 import androidx.compose.material3.LinearProgressIndicator
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Scaffold
@@ -31,18 +26,20 @@ import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.res.pluralStringResource
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.unit.dp
-import com.fabledsword.thoughtsync.R
-import com.fabledsword.thoughtsync.UpdateOutcome
+import com.fabledsword.inkwell.R
+import com.fabledsword.inkwell.UpdateOutcome
+import com.fabledsword.inkwell.installedVersionName

 /**
 * Opt-in server pairing.
 *
 * The whole screen is written around one idea: **being unlinked is not a
- * problem.** ThoughtSync is local-first and completely usable having never opened
+ * problem.** Inkwell is local-first and completely usable having never opened
 * this screen, so the unlinked state leads with "Working offline on this device"
 * and explains what connecting would ADD, rather than presenting an empty form as
 * unfinished setup.
@@ -75,14 +72,7 @@ fun SyncScreen(
        topBar = {
            TopAppBar(
                title = { Text(stringResource(R.string.sync_title)) },
-                navigationIcon = {
-                    IconButton(onClick = onClose) {
-                        Icon(
-                            Icons.AutoMirrored.Filled.ArrowBack,
-                            contentDescription = stringResource(R.string.editor_back),
-                        )
-                    }
-                },
+                navigationIcon = { BackButton(onClose, R.string.editor_back) },
            )
        },
    ) { padding ->
@@ -120,10 +110,36 @@ fun SyncScreen(
                        onDismissRevokeNotice = onDismissRevokeNotice,
                    )
            }
+
+            BuildLine()
        }
    }
 }

+/**
+ * The build, dim, at the foot of Sync — the same thing the web UI puts at the
+ * bottom of its rail (#3181).
+ *
+ * Note 3127 §5 is why it is here at all. With version tags gone, an artifact's own
+ * self-report is the only answer to "which build is this?" — so it renders
+ * "unknown" rather than nothing when the name is absent, because a blank line looks
+ * like a layout bug and a plausible default cannot be caught by anything.
+ *
+ * The read itself is `installedVersionName()`, shared with the client header the
+ * app sends its server: one answer to "which build is on this phone", so the line
+ * a person quotes in a bug report and the line in the server's log cannot disagree.
+ */
+@Composable
+private fun BuildLine() {
+    val context = LocalContext.current
+    val unknown = stringResource(R.string.build_unknown)
+    val version = remember(context) { context.installedVersionName() ?: unknown }
+    Hint(
+        text = version,
+        modifier = Modifier.padding(bottom = 16.dp),
+    )
+}
+
 // ─────────────────────────────────  linked  ─────────────────────────────────

@Composable
@@ -153,11 +169,7 @@ private fun LinkedPanel(
            fontWeight = FontWeight.SemiBold,
        )
        state.linkedAs?.let {
-            Text(
-                text = stringResource(R.string.sync_linked_as, it),
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
+            Hint(stringResource(R.string.sync_linked_as, it))
        }
        Text(
            text =
@@ -170,11 +182,7 @@ private fun LinkedPanel(
            color = MaterialTheme.colorScheme.onSurfaceVariant,
        )
        if (state.pending) {
-            Text(
-                text = stringResource(R.string.sync_unsent),
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
+            Hint(stringResource(R.string.sync_unsent))
        }
    }

@@ -195,11 +203,7 @@ private fun LinkedPanel(

    state.lastOutcome?.let { outcome ->
        if (state.syncError == null) {
-            Text(
-                text = syncSummary(outcome),
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
+            Hint(syncSummary(outcome))
        }
        // Rejections are the server refusing a SPECIFIC change. Surfaced, never
        // swallowed, because only a person can resolve them.
@@ -239,10 +243,8 @@ private fun LinkedPanel(
        onOutcome = onInstallOutcome,
    )

-    Text(
+    Hint(
        text = stringResource(R.string.sync_footer),
-        style = MaterialTheme.typography.bodySmall,
-        color = MaterialTheme.colorScheme.onSurfaceVariant,
        modifier = Modifier.padding(vertical = 8.dp),
    )

@@ -250,20 +252,14 @@ private fun LinkedPanel(
        // Confirmed because it is not obvious what disconnecting does to the notes.
        // The copy answers that first — they stay — since the fear it raises is
        // "will this delete something?", not "am I sure?".
-        AlertDialog(
-            onDismissRequest = { confirmingUnlink = false },
-            title = { Text(stringResource(R.string.sync_disconnect_title)) },
-            text = { Text(stringResource(R.string.sync_disconnect_body)) },
-            confirmButton = {
-                TextButton(onClick = {
-                    confirmingUnlink = false
-                    onUnlink()
-                }) { Text(stringResource(R.string.sync_disconnect)) }
-            },
-            dismissButton = {
-                TextButton(onClick = { confirmingUnlink = false }) {
-                    Text(stringResource(R.string.editor_cancel))
-                }
+        ConfirmDialog(
+            title = stringResource(R.string.sync_disconnect_title),
+            body = stringResource(R.string.sync_disconnect_body),
+            confirm = stringResource(R.string.sync_disconnect),
+            onDismiss = { confirmingUnlink = false },
+            onConfirm = {
+                confirmingUnlink = false
+                onUnlink()
            },
        )
    }
@@ -1,11 +1,11 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import androidx.compose.runtime.Composable
 import androidx.compose.ui.res.pluralStringResource
 import androidx.compose.ui.res.stringResource
-import com.fabledsword.thoughtsync.R
-import com.fabledsword.thoughtsync.core.Compatibility
-import com.fabledsword.thoughtsync.core.SyncOutcome
+import com.fabledsword.inkwell.R
+import com.fabledsword.inkwell.core.Compatibility
+import com.fabledsword.inkwell.core.SyncOutcome

 // Turning sync results into sentences.
 //
@@ -32,6 +32,8 @@ fun syncSummary(outcome: SyncOutcome): String {
    if (sent > 0) parts += stringResource(R.string.sync_summary_sent, sent)
    if (received > 0) parts += stringResource(R.string.sync_summary_received, received)
    if (blobs > 0) parts += pluralStringResource(R.plurals.sync_summary_attachments, blobs, blobs)
+    val uploaded = outcome.push.uploaded.toInt()
+    if (uploaded > 0) parts += pluralStringResource(R.plurals.sync_summary_uploaded, uploaded, uploaded)

    val line =
        if (parts.isEmpty()) {
@@ -44,11 +46,13 @@ fun syncSummary(outcome: SyncOutcome): String {
    // rather than an error — but saying nothing would leave a missing image
    // looking like data loss.
    val failed = outcome.pull.blobsFailed.toInt()
-    return if (failed > 0) {
-        line + " " + pluralStringResource(R.plurals.sync_summary_attachments_failed, failed, failed)
-    } else {
-        line
-    }
+    val notUploaded = outcome.push.uploadFailed.toInt()
+    val notes = mutableListOf(line)
+    if (failed > 0) notes += pluralStringResource(R.plurals.sync_summary_attachments_failed, failed, failed)
+    // A refused upload is recorded on its attachment and shown in the editor; this
+    // line is what sends someone looking.
+    if (notUploaded > 0) notes += pluralStringResource(R.plurals.sync_summary_upload_failed, notUploaded, notUploaded)
+    return notes.joinToString(" ")
 }

 /**
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
@@ -6,12 +6,14 @@ import androidx.compose.runtime.setValue
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.ViewModelProvider
 import androidx.lifecycle.viewModelScope
-import com.fabledsword.thoughtsync.core.Compatibility
-import com.fabledsword.thoughtsync.core.ProbeResult
-import com.fabledsword.thoughtsync.core.RevokeOutcome
-import com.fabledsword.thoughtsync.core.SyncOutcome
-import com.fabledsword.thoughtsync.core.SyncStatus
-import com.fabledsword.thoughtsync.core.ThoughtSync
+import androidx.lifecycle.viewmodel.initializer
+import androidx.lifecycle.viewmodel.viewModelFactory
+import com.fabledsword.inkwell.core.Compatibility
+import com.fabledsword.inkwell.core.Inkwell
+import com.fabledsword.inkwell.core.ProbeResult
+import com.fabledsword.inkwell.core.RevokeOutcome
+import com.fabledsword.inkwell.core.SyncOutcome
+import com.fabledsword.inkwell.core.SyncStatus
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
@@ -113,7 +115,7 @@ data class SyncState(
 * stored cursor next time (Scribe #2736).
 */
 class SyncViewModel(
-    private val core: ThoughtSync,
+    private val core: Inkwell,
    /**
     * Called after a sync that changed the store.
     *
@@ -143,7 +145,7 @@ class SyncViewModel(
                    // A store that won't answer is a real fault, but the screen
                    // still has to render — showing the unlinked state is honest,
                    // since without a readable link there is effectively none.
-                    state.copy(loading = false, status = null, syncError = e.describe())
+                    state.copy(loading = false, status = null, syncError = e.shownAs())
                }
        }
    }
@@ -163,7 +165,7 @@ class SyncViewModel(
                try {
                    state.copy(probe = core.probe(url), probing = false)
                } catch (e: Exception) {
-                    state.copy(probing = false, probeError = e.describe())
+                    state.copy(probing = false, probeError = e.shownAs())
                }
        }
    }
@@ -217,7 +219,7 @@ class SyncViewModel(
                        status = withContext(Dispatchers.IO) { core.syncStatus() },
                    )
                } catch (e: Exception) {
-                    state.copy(linking = false, linkError = e.describe())
+                    state.copy(linking = false, linkError = e.shownAs())
                }
            if (state.linked) syncNow()
        }
@@ -259,7 +261,7 @@ class SyncViewModel(
                } catch (e: Exception) {
                    state.copy(
                        syncing = false,
-                        syncError = if (announce) e.describe() else state.syncError,
+                        syncError = if (announce) e.shownAs() else state.syncError,
                    )
                }
            // Only when something actually arrived: a no-op sync must not make the
@@ -293,7 +295,7 @@ class SyncViewModel(
                        pending = false,
                    )
                } catch (e: Exception) {
-                    state.copy(syncing = false, syncError = e.describe())
+                    state.copy(syncing = false, syncError = e.shownAs())
                }
        }
    }
@@ -316,13 +318,9 @@ class SyncViewModel(

    companion object {
        fun factory(
-            core: ThoughtSync,
+            core: Inkwell,
            onStoreChanged: () -> Unit,
-        ): ViewModelProvider.Factory =
-            object : ViewModelProvider.Factory {
-                @Suppress("UNCHECKED_CAST")
-                override fun <T : ViewModel> create(modelClass: Class<T>): T = SyncViewModel(core, onStoreChanged) as T
-            }
+        ): ViewModelProvider.Factory = viewModelFactory { initializer { SyncViewModel(core, onStoreChanged) } }
    }
 }

@@ -339,12 +337,3 @@ private fun SyncOutcome.changedTheStore(): Boolean =
        pull.labelsApplied > 0uL ||
        pull.labelsDeleted > 0uL ||
        pull.blobsDownloaded > 0uL
-
-/**
- * The message to show for a failure.
- *
- * The core writes these for people to read — "notes.example.com responded, but not
- * with ThoughtSync's configuration" — so they are shown as-is rather than
- * replaced with a generic string that would throw away the only useful part.
- */
-private fun Exception.describe(): String = message ?: "Something went wrong."
@@ -0,0 +1,545 @@
+package com.fabledsword.inkwell.ui
+
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.isSystemInDarkTheme
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.imePadding
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.foundation.text.KeyboardActions
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.MoreVert
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.DropdownMenu
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.LinearProgressIndicator
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Scaffold
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.material3.TopAppBar
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.res.pluralStringResource
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.input.ImeAction
+import androidx.compose.ui.unit.dp
+import com.fabledsword.inkwell.R
+import com.fabledsword.inkwell.core.Label
+
+/** The swatch shown beside a tag, and tapped to change its colour. */
+private val SWATCH = 22.dp
+
+/** What the row's overflow menu is currently asking about. */
+private sealed interface TagDialog {
+    data class Rename(
+        val tag: Label,
+    ) : TagDialog
+
+    /** A rename whose new name another tag already holds — see [RenameDialog]. */
+    data class ConfirmMerge(
+        val tag: Label,
+        val into: Label,
+        val name: String,
+    ) : TagDialog
+
+    data class Merge(
+        val tag: Label,
+    ) : TagDialog
+
+    data class Delete(
+        val tag: Label,
+    ) : TagDialog
+
+    data class Colour(
+        val tag: Label,
+    ) : TagDialog
+}
+
+/**
+ * Tag management: list, create, rename, recolour, delete, merge.
+ *
+ * A destination you go to, not a modal. The web's `LabelsModal.vue` is a modal
+ * because a desktop has room to float one over the board; on a phone this is a
+ * place you visit to tidy up, and a full screen is what that is.
+ *
+ * It is also, since the per-note colour picker was removed, the ONLY colour
+ * control in the product. That is why the swatch is a first-class tap target on
+ * every row rather than something behind the overflow menu.
+ */
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+fun TagsScreen(
+    state: TagsState,
+    onClose: () -> Unit,
+    onCreate: (String) -> Unit,
+    onRename: (String, String) -> Unit,
+    onColour: (String, String) -> Unit,
+    onDelete: (String) -> Unit,
+    onMerge: (String, String) -> Unit,
+    onDismissError: () -> Unit,
+) {
+    var dialog by remember { mutableStateOf<TagDialog?>(null) }
+
+    Scaffold(
+        topBar = {
+            TopAppBar(
+                title = { Text(stringResource(R.string.tags_title)) },
+                navigationIcon = { BackButton(onClose, R.string.tags_back) },
+            )
+        },
+    ) { padding ->
+        Column(
+            modifier =
+                Modifier
+                    .fillMaxSize()
+                    .padding(padding)
+                    .imePadding(),
+        ) {
+            // An indeterminate bar rather than blocking the list: a tag write is a
+            // local SQLite call and usually finishes before this is seen at all.
+            if (state.busy) {
+                LinearProgressIndicator(modifier = Modifier.fillMaxWidth())
+            }
+
+            // The same banner the board and the editor use. A third way of saying
+            // "that did not work" would be a third thing to keep consistent.
+            state.error?.let { message ->
+                ErrorBanner(message = message, onDismiss = onDismissError)
+            }
+
+            NewTagField(
+                enabled = !state.busy,
+                onCreate = onCreate,
+            )
+
+            if (!state.loading && state.tags.isEmpty()) {
+                EmptyTags()
+            }
+
+            // weight, NOT fillMaxSize: this has siblings above it, and filling the
+            // whole height would measure the list against space the field and the
+            // banner have already taken — pushing the end of the list off-screen.
+            LazyColumn(modifier = Modifier.weight(1f)) {
+                items(state.tags, key = { it.id }) { tag ->
+                    TagRow(
+                        tag = tag,
+                        enabled = !state.busy,
+                        onColour = { dialog = TagDialog.Colour(tag) },
+                        onRename = { dialog = TagDialog.Rename(tag) },
+                        onMerge = { dialog = TagDialog.Merge(tag) },
+                        onDelete = { dialog = TagDialog.Delete(tag) },
+                    )
+                }
+            }
+        }
+    }
+
+    when (val open = dialog) {
+        null -> Unit
+
+        is TagDialog.Rename ->
+            RenameDialog(
+                tag = open.tag,
+                others = state.tags,
+                onDismiss = { dialog = null },
+                onRename = { name ->
+                    dialog = null
+                    onRename(open.tag.id, name)
+                },
+                // Renaming onto a name another tag holds MERGES the two, and that
+                // cannot be undone by repeating it, so the confirmation replaces
+                // this dialog rather than the rename just happening.
+                onWouldMerge = { into, name -> dialog = TagDialog.ConfirmMerge(open.tag, into, name) },
+            )
+
+        is TagDialog.ConfirmMerge ->
+            ConfirmDialog(
+                title = stringResource(R.string.tags_rename_merges_title, hashtag(open.into.name)),
+                body = stringResource(R.string.tags_rename_merges_body, hashtag(open.into.name)),
+                confirm = stringResource(R.string.tags_rename_merges_confirm),
+                onDismiss = { dialog = null },
+                onConfirm = {
+                    dialog = null
+                    onRename(open.tag.id, open.name)
+                },
+            )
+
+        is TagDialog.Merge ->
+            MergeDialog(
+                tag = open.tag,
+                others = state.tags.filter { it.id != open.tag.id },
+                onDismiss = { dialog = null },
+                onMerge = { target ->
+                    dialog = null
+                    onMerge(open.tag.id, target.id)
+                },
+            )
+
+        is TagDialog.Delete ->
+            ConfirmDialog(
+                title = stringResource(R.string.tags_delete_title, hashtag(open.tag.name)),
+                // The count is the part that makes the consequence real — "it is on
+                // 40 notes" is a different decision from "delete this tag?". It comes
+                // from the LIST, the only call the core populates a count on.
+                body =
+                    open.tag.count
+                        ?.takeIf { it > 0 }
+                        ?.let { pluralStringResource(R.plurals.tags_delete_body_counted, it.toInt(), it.toInt()) }
+                        ?: stringResource(R.string.tags_delete_body),
+                footnote = stringResource(R.string.tags_delete_from_text),
+                confirm = stringResource(R.string.tags_delete_confirm),
+                onDismiss = { dialog = null },
+                onConfirm = {
+                    dialog = null
+                    onDelete(open.tag.id)
+                },
+            )
+
+        is TagDialog.Colour ->
+            ColourDialog(
+                tag = open.tag,
+                onDismiss = { dialog = null },
+                onPick = { key ->
+                    dialog = null
+                    onColour(open.tag.id, key)
+                },
+            )
+    }
+}
+
+/**
+ * `#` on the name, everywhere it is spoken about: the chips on a card and in the
+ * editor (`NoteCard.kt`, `EditorChrome.kt`) and every dialog here.
+ *
+ * It is the reason these are called tags at all — a dialog that said "Delete
+ * grocery?" would be talking about something else.
+ */
+internal fun hashtag(name: String): String = "#$name"
+
+/** A tag's colour as a dot: the row's at-a-glance colour, and each choice in the picker. */
+@Composable
+private fun Swatch(
+    tint: NoteTint,
+    dark: Boolean,
+    modifier: Modifier = Modifier,
+) {
+    Box(
+        modifier =
+            Modifier
+                .size(SWATCH)
+                .clip(CircleShape)
+                .background(tint.chipBackground(dark))
+                .border(1.dp, tint.chipBorder(dark), CircleShape)
+                .then(modifier),
+    )
+}
+
+@Composable
+private fun NewTagField(
+    enabled: Boolean,
+    onCreate: (String) -> Unit,
+) {
+    var text by remember { mutableStateOf("") }
+    val submit = {
+        if (text.isNotBlank()) {
+            onCreate(text)
+            text = ""
+        }
+    }
+
+    Row(
+        modifier = Modifier.padding(horizontal = 16.dp, vertical = 8.dp),
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.spacedBy(8.dp),
+    ) {
+        PlainTextField(
+            value = text,
+            onValueChange = { text = it },
+            modifier = Modifier.weight(1f),
+            hint = R.string.tags_new_hint,
+            enabled = enabled,
+            singleLine = true,
+            keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
+            keyboardActions = KeyboardActions(onDone = { submit() }),
+        )
+        TextButton(onClick = submit, enabled = enabled && text.isNotBlank()) {
+            Text(stringResource(R.string.tags_create))
+        }
+    }
+}
+
+/**
+ * Said out loud rather than left as a blank screen — and it names the `#` route,
+ * because the operator did not know `#tag` extraction existed at all (Scribe
+ * #2949) and this is the natural place to say so.
+ */
+@Composable
+private fun EmptyTags() {
+    Column(
+        modifier = Modifier.padding(horizontal = 16.dp, vertical = 24.dp),
+        verticalArrangement = Arrangement.spacedBy(4.dp),
+    ) {
+        Text(
+            text = stringResource(R.string.tags_empty_title),
+            style = MaterialTheme.typography.titleSmall,
+        )
+        Text(
+            text = stringResource(R.string.tags_empty_body),
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+    }
+}
+
+@Composable
+private fun TagRow(
+    tag: Label,
+    enabled: Boolean,
+    onColour: () -> Unit,
+    onRename: () -> Unit,
+    onMerge: () -> Unit,
+    onDelete: () -> Unit,
+) {
+    val dark = isSystemInDarkTheme()
+    val tint = labelTintFor(tag.name, tag.color)
+    var menuOpen by remember { mutableStateOf(false) }
+
+    Row(
+        modifier =
+            Modifier
+                .fillMaxWidth()
+                .padding(horizontal = 16.dp, vertical = 10.dp),
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.spacedBy(12.dp),
+    ) {
+        Swatch(tint, dark, Modifier.clickable(enabled = enabled, onClick = onColour))
+
+        Column(modifier = Modifier.weight(1f)) {
+            Text(
+                text = hashtag(tag.name),
+                style = MaterialTheme.typography.bodyLarge,
+                color = tint.tagInk(dark),
+            )
+            Text(
+                text = countLabel(tag.count),
+                style = MaterialTheme.typography.labelSmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+        }
+
+        Column {
+            IconButton(onClick = { menuOpen = true }, enabled = enabled) {
+                Icon(
+                    Icons.Filled.MoreVert,
+                    contentDescription = stringResource(R.string.tags_actions),
+                )
+            }
+            DropdownMenu(expanded = menuOpen, onDismissRequest = { menuOpen = false }) {
+                // Panel.kt's MenuItem, not a bare DropdownMenuItem: every one of
+                // these raises a dialog, and it closes the menu BEFORE acting so the
+                // dialog cannot open underneath a menu still hanging over it.
+                val close = { menuOpen = false }
+                MenuItem(R.string.tags_rename, close, onRename)
+                MenuItem(R.string.tags_merge, close, onMerge)
+                MenuItem(R.string.tags_delete, close, onDelete)
+            }
+        }
+    }
+}
+
+/**
+ * Zero is its own sentence, not "0 notes".
+ *
+ * A count of null means the core did not populate one — only `list_labels` does —
+ * which is a different thing from a tag with no notes, so it reads as unknown
+ * rather than as empty.
+ */
+@Composable
+private fun countLabel(count: Long?): String =
+    when {
+        count == null -> ""
+        count <= 0L -> stringResource(R.string.tags_count_none)
+        else -> pluralStringResource(R.plurals.tags_count, count.toInt(), count.toInt())
+    }
+
+/**
+ * Rename, with the merge caught before it happens.
+ *
+ * The collision is detected HERE, against the list, rather than from what the
+ * core returns: the merge survivor is whichever tag is older, so it may well be
+ * the one being renamed, and an unchanged id afterwards would prove nothing.
+ * Matching is case-insensitive because the core's is.
+ */
+@Composable
+private fun RenameDialog(
+    tag: Label,
+    others: List<Label>,
+    onDismiss: () -> Unit,
+    onRename: (String) -> Unit,
+    onWouldMerge: (Label, String) -> Unit,
+) {
+    var text by remember(tag.id) { mutableStateOf(tag.name) }
+    val trimmed = text.trim()
+    val clash =
+        others.firstOrNull { it.id != tag.id && foldTag(it.name) == foldTag(trimmed) }
+    val submit = {
+        when {
+            trimmed.isEmpty() -> Unit
+            clash != null -> onWouldMerge(clash, trimmed)
+            else -> onRename(trimmed)
+        }
+    }
+
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        title = { Text(stringResource(R.string.tags_rename_title, hashtag(tag.name))) },
+        text = {
+            PlainTextField(
+                value = text,
+                onValueChange = { text = it },
+                hint = R.string.tags_new_hint,
+                singleLine = true,
+                keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
+                keyboardActions = KeyboardActions(onDone = { submit() }),
+            )
+        },
+        confirmButton = {
+            TextButton(onClick = submit, enabled = trimmed.isNotEmpty()) {
+                Text(stringResource(R.string.tags_rename_confirm))
+            }
+        },
+        dismissButton = {
+            TextButton(onClick = onDismiss) { Text(stringResource(R.string.cancel)) }
+        },
+    )
+}
+
+/**
+ * Merge, with the direction stated and the survivor named.
+ *
+ * Unlike a rename — where the OLDER tag survives so that the outcome cannot
+ * depend on which way round it was typed — this one is deliberate, so the
+ * direction the person chooses IS the intent and is honoured. The price of that
+ * is that the direction has to be unmissable, which is why the body names the tag
+ * that stops existing and every row here is the one that survives.
+ */
+@Composable
+private fun MergeDialog(
+    tag: Label,
+    others: List<Label>,
+    onDismiss: () -> Unit,
+    onMerge: (Label) -> Unit,
+) {
+    val dark = isSystemInDarkTheme()
+
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        title = { Text(stringResource(R.string.tags_merge_title, hashtag(tag.name))) },
+        text = {
+            Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                Text(
+                    text = stringResource(R.string.tags_merge_body, hashtag(tag.name)),
+                    style = MaterialTheme.typography.bodyMedium,
+                )
+                if (others.isEmpty()) {
+                    Text(
+                        text = stringResource(R.string.tags_merge_none),
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+                others.forEach { other ->
+                    val tint = labelTintFor(other.name, other.color)
+                    Text(
+                        text = hashtag(other.name),
+                        style = MaterialTheme.typography.bodyLarge,
+                        color = tint.tagInk(dark),
+                        modifier =
+                            Modifier
+                                .fillMaxWidth()
+                                .clickable { onMerge(other) }
+                                .padding(vertical = 8.dp),
+                    )
+                }
+            }
+        },
+        confirmButton = {},
+        dismissButton = {
+            TextButton(onClick = onDismiss) { Text(stringResource(R.string.cancel)) }
+        },
+    )
+}
+
+/**
+ * The palette, and since the per-note picker was removed this is the only place in
+ * the product a colour is chosen.
+ *
+ * Every key from [NOTE_TINTS], `default` included: a tag whose colour is
+ * `default` gets a hue derived from its name (`DerivedTint.kt`), so "default" here
+ * means "let it pick" rather than "grey", and taking it away would leave no way
+ * back to that.
+ */
+@Composable
+private fun ColourDialog(
+    tag: Label,
+    onDismiss: () -> Unit,
+    onPick: (String) -> Unit,
+) {
+    val dark = isSystemInDarkTheme()
+
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        title = { Text(stringResource(R.string.tags_colour_of, hashtag(tag.name))) },
+        text = {
+            Column(verticalArrangement = Arrangement.spacedBy(4.dp)) {
+                NOTE_TINTS.forEach { (key, tint) ->
+                    Row(
+                        modifier =
+                            Modifier
+                                .fillMaxWidth()
+                                .clickable { onPick(key) }
+                                .padding(vertical = 8.dp),
+                        verticalAlignment = Alignment.CenterVertically,
+                        horizontalArrangement = Arrangement.spacedBy(12.dp),
+                    ) {
+                        Swatch(tint, dark)
+                        Text(
+                            text = stringResource(tint.label),
+                            style = MaterialTheme.typography.bodyMedium,
+                            color =
+                                if (key == tag.color) {
+                                    MaterialTheme.colorScheme.primary
+                                } else {
+                                    MaterialTheme.colorScheme.onSurface
+                                },
+                        )
+                    }
+                }
+            }
+        },
+        confirmButton = {},
+        dismissButton = {
+            TextButton(onClick = onDismiss) { Text(stringResource(R.string.cancel)) }
+        },
+    )
+}
@@ -0,0 +1,173 @@
+package com.fabledsword.inkwell.ui
+
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.setValue
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.ViewModelProvider
+import androidx.lifecycle.viewModelScope
+import androidx.lifecycle.viewmodel.initializer
+import androidx.lifecycle.viewmodel.viewModelFactory
+import com.fabledsword.inkwell.core.Inkwell
+import com.fabledsword.inkwell.core.Label
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+/**
+ * Everything the Tags screen renders from.
+ *
+ * [tags] comes from `list_labels`, which is the only call that populates a
+ * `count` — the single-tag returns leave it null by design. So the counts a
+ * confirmation dialog quotes are always the LIST's, never an operation's result.
+ */
+data class TagsState(
+    val loading: Boolean = true,
+    val tags: List<Label> = emptyList(),
+    /** An in-flight write, for disabling the controls that would race it. */
+    val busy: Boolean = false,
+    val error: String? = null,
+)
+
+/**
+ * Create, rename, recolour, delete and merge tags.
+ *
+ * A peer of the web's `LabelsModal.vue`, not a reduced companion — the same six
+ * operations over the same core the desktop uses.
+ *
+ * ## Why every write re-lists
+ *
+ * A tag operation changes more than the row it names. A merge deletes one tag and
+ * moves its notes; a delete changes nothing else's count but removes a drawer
+ * lens; a rename can MERGE (see below) and so can make a different row vanish.
+ * Re-listing after each write costs one cheap local SQLite read and removes a
+ * whole class of "the screen thinks there are still two" bugs. Patching the list
+ * in place would mean re-deriving, in Kotlin, rules the core already owns.
+ *
+ * ## Renaming can merge
+ *
+ * `rename_label` folds two tags together when the new name is one another tag
+ * already holds, and the OLDER row survives (Scribe #3324). So it can return a
+ * tag whose id is not the one passed in, and it can make another tag stop
+ * existing. The screen asks first; this view model does not, because a
+ * confirmation belongs to the surface with a person in front of it.
+ *
+ * ## Threading
+ *
+ * All of these are ordinary blocking FFI into SQLite — no async, no network — so
+ * they take [Dispatchers.IO], exactly like the board's calls. Sync happens later:
+ * the core marks the rows dirty and the next sync carries them.
+ */
+class TagsViewModel(
+    private val core: Inkwell,
+    /**
+     * Called after any write that landed.
+     *
+     * The board holds its own snapshot of the tag list for the drawer, and its
+     * current destination may BE one of these tags — deleting or merging that one
+     * leaves it looking at a lens that no longer exists. Wiring the two together
+     * explicitly is less magic than a shared event bus and makes the dependency
+     * visible at the construction site, the same way [SyncViewModel] does it.
+     */
+    private val onStoreChanged: () -> Unit,
+) : ViewModel() {
+    var state by mutableStateOf(TagsState())
+        private set
+
+    init {
+        refresh()
+    }
+
+    fun refresh() {
+        viewModelScope.launch {
+            state =
+                runCatching { withContext(Dispatchers.IO) { core.listLabels() } }
+                    .fold(
+                        onSuccess = { state.copy(tags = it, loading = false, error = null) },
+                        // Unlike the drawer, this screen cannot fail quietly: it is
+                        // the only thing on the display, and an empty list here
+                        // would read as "you have no tags" rather than "I couldn't
+                        // look".
+                        onFailure = { state.copy(loading = false, error = it.shownAs()) },
+                    )
+        }
+    }
+
+    fun create(name: String) {
+        val trimmed = name.trim()
+        if (trimmed.isEmpty()) return
+        // Find-or-create in the core: typing a name that exists in another case
+        // attaches the existing tag rather than minting a near-duplicate.
+        write { it.createLabel(trimmed) }
+    }
+
+    fun rename(
+        id: String,
+        name: String,
+    ) {
+        val trimmed = name.trim()
+        if (trimmed.isEmpty()) return
+        write { it.renameLabel(id, trimmed) }
+    }
+
+    fun setColour(
+        id: String,
+        colour: String,
+    ) = write { it.setLabelColor(id, colour) }
+
+    fun remove(id: String) = write { it.removeLabel(id) }
+
+    /**
+     * Fold [sourceId] into [targetId]. The source stops existing.
+     *
+     * Directional and not undone by repeating it — the caller has to have said
+     * which one survives before this runs, because afterwards there is nothing
+     * left to read the direction from.
+     */
+    fun merge(
+        sourceId: String,
+        targetId: String,
+    ) {
+        if (sourceId == targetId) return
+        write { it.mergeLabels(sourceId, targetId) }
+    }
+
+    fun dismissError() {
+        state = state.copy(error = null)
+    }
+
+    /**
+     * Run one store write, then re-list and tell the board.
+     *
+     * `busy` is cleared in the same assignment that stores the result, so no path
+     * out of here can leave the screen stuck with its controls disabled.
+     */
+    private fun write(block: (Inkwell) -> Unit) {
+        if (state.busy) return
+        state = state.copy(busy = true, error = null)
+        viewModelScope.launch {
+            val failure =
+                runCatching { withContext(Dispatchers.IO) { block(core) } }
+                    .exceptionOrNull()
+            val tags =
+                runCatching { withContext(Dispatchers.IO) { core.listLabels() } }
+                    .getOrDefault(state.tags)
+            state =
+                state.copy(
+                    tags = tags,
+                    busy = false,
+                    error = failure?.shownAs(),
+                )
+            // Even a FAILED write can have changed the store — a merge that threw
+            // partway still moved rows — so the board is told either way.
+            onStoreChanged()
+        }
+    }
+
+    companion object {
+        fun factory(
+            core: Inkwell,
+            onStoreChanged: () -> Unit,
+        ): ViewModelProvider.Factory = viewModelFactory { initializer { TagsViewModel(core, onStoreChanged) } }
+    }
+}
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import androidx.compose.foundation.isSystemInDarkTheme
 import androidx.compose.material3.MaterialTheme
@@ -59,7 +59,7 @@ private val DarkColors =
    )

 /**
- * Material 3 in ThoughtSync's own colours, following the system light/dark setting.
+ * Material 3 in Inkwell's own colours, following the system light/dark setting.
 *
 * DELIBERATELY NOT Material You dynamic colour, which this used until the operator
 * saw the first build. Dynamic colour is the more Android-native choice and it
@@ -72,7 +72,7 @@ private val DarkColors =
 * If dynamic colour is ever wanted it belongs behind a setting, not as the default.
 */
@Composable
-fun ThoughtSyncTheme(
+fun InkwellTheme(
    darkTheme: Boolean = isSystemInDarkTheme(),
    content: @Composable () -> Unit,
 ) {
@@ -1,4 +1,4 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import java.time.LocalDateTime
 import java.time.OffsetDateTime
@@ -1,24 +1,31 @@
-package com.fabledsword.thoughtsync.ui
+package com.fabledsword.inkwell.ui

 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
 import androidx.compose.material3.Button
+import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.LinearProgressIndicator
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.unit.dp
-import com.fabledsword.thoughtsync.AppUpdate
-import com.fabledsword.thoughtsync.R
-import com.fabledsword.thoughtsync.UpdateOutcome
+import com.fabledsword.inkwell.AppUpdate
+import com.fabledsword.inkwell.R
+import com.fabledsword.inkwell.UpdateOutcome

 /**
 * Updating the app from the server it is linked to.
@@ -41,6 +48,13 @@ fun UpdateCard(
 ) {
    val context = LocalContext.current

+    // Re-read on every return to the app, as ReminderNotice does: the grant is given
+    // in a system screen this app cannot observe. Read once, the warning would still
+    // be up after someone granted it and came back, and the offer below it would
+    // look blocked when it is not (family idea #5103, practice 9).
+    var canInstall by remember { mutableStateOf(AppUpdate.canInstall(context)) }
+    ForegroundTransitions(onForeground = { canInstall = AppUpdate.canInstall(context) })
+
    // The system answers an install through a BroadcastReceiver, which has no way
    // back into a view model. This is the seam.
    UpdateOutcome.latest?.let { result ->
@@ -48,11 +62,12 @@ fun UpdateCard(
    }

    Column(modifier = Modifier.fillMaxWidth().padding(top = 4.dp)) {
-        Text(
-            text = stringResource(R.string.update_installed_version, state.installedVersion),
-            style = MaterialTheme.typography.bodySmall,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
-        )
+        Hint(stringResource(R.string.update_installed_version, state.installedVersion))
+
+        if (!state.selfUpdates) {
+            Hint(stringResource(R.string.update_debug_build))
+            return@Column
+        }

        val available = state.available
        if (available != null) {
@@ -66,11 +81,7 @@ fun UpdateCard(
                style = MaterialTheme.typography.bodyMedium,
            )
        } else if (state.upToDate) {
-            Text(
-                text = stringResource(R.string.update_current),
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
+            Hint(stringResource(R.string.update_current))
        }

        if (state.working) {
@@ -92,7 +103,7 @@ fun UpdateCard(
        // Android's "install unknown apps" grant is separate from anything in the
        // manifest and only the person can give it. Said BEFORE a download rather
        // than after, so nobody spends 55 MiB to be told no.
-        if (available != null && !AppUpdate.canInstall(context)) {
+        if (available != null && !canInstall) {
            Notice(
                tone = Tone.WARN,
                title = stringResource(R.string.update_permission_title),
@@ -113,6 +124,46 @@ fun UpdateCard(
    }
 }

+/**
+ * The nag: an update is waiting, said where someone will actually see it.
+ *
+ * Until this existed the only way to learn about a new build was to open the sync
+ * screen and press Check — so the updates that got installed were the ones somebody
+ * went looking for, and the rest were simply never found.
+ *
+ * Only ever shown once the build is DOWNLOADED, so the offer is a single tap rather
+ * than the start of a wait — and so nothing is said at all until the app has been on
+ * wifi, which is where the fetch happens.
+ *
+ * Dismissible, but not permanently. "Later" clears it for this sitting; the next time
+ * the app comes forward it says so again. That is the difference between a reminder
+ * and a notice you can lose.
+ */
+@Composable
+fun UpdateBanner(
+    version: String,
+    busy: Boolean,
+    onInstall: () -> Unit,
+    onDismiss: () -> Unit,
+) {
+    Banner("blue") {
+        Text(
+            text = stringResource(R.string.update_banner_ready, version),
+            style = MaterialTheme.typography.bodyMedium,
+            modifier = Modifier.weight(1f),
+        )
+        if (busy) {
+            CircularProgressIndicator(modifier = Modifier.size(BANNER_SPINNER), strokeWidth = 2.dp)
+            Spacer(Modifier.size(12.dp))
+        } else {
+            TextButton(onClick = onDismiss) { Text(stringResource(R.string.update_later)) }
+            TextButton(onClick = onInstall) { Text(stringResource(R.string.update_install)) }
+        }
+    }
+}
+
+private val BANNER_SPINNER = 18.dp
+
 /**
 * The one line an unlinked device gets.
 *
@@ -122,10 +173,8 @@ fun UpdateCard(
 */
@Composable
 fun UnlinkedUpdateNote() {
-    Text(
+    Hint(
        text = stringResource(R.string.update_needs_server),
-        style = MaterialTheme.typography.bodySmall,
-        color = MaterialTheme.colorScheme.onSurfaceVariant,
        // Carries the bottom breathing room the connect button used to provide,
        // now that it is the last thing on the unlinked screen.
        modifier = Modifier.padding(top = 8.dp, bottom = 24.dp),
@@ -0,0 +1,240 @@
+package com.fabledsword.inkwell.ui
+
+import android.content.Context
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.setValue
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.ViewModelProvider
+import androidx.lifecycle.viewModelScope
+import androidx.lifecycle.viewmodel.initializer
+import androidx.lifecycle.viewmodel.viewModelFactory
+import com.fabledsword.inkwell.AppUpdate
+import com.fabledsword.inkwell.UpdateOutcome
+import com.fabledsword.inkwell.core.ClientUpdate
+import com.fabledsword.inkwell.core.Inkwell
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+/** Everything the update card renders from. */
+data class UpdateState(
+    /** What is running now. Shown even when there is nothing to update to. */
+    val installedVersion: Long = 0,
+    val checking: Boolean = false,
+    /** Only ever set to something NEWER — the core does that comparison. */
+    val available: ClientUpdate? = null,
+    /** A check completed and found nothing. Distinct from "not checked yet". */
+    val upToDate: Boolean = false,
+    /** The available build has been fetched and is sitting in the cache. */
+    val ready: Boolean = false,
+    val downloading: Boolean = false,
+    val working: Boolean = false,
+    val error: String? = null,
+    /** The banner has been waved away — until the app next comes forward. */
+    val nagDismissed: Boolean = false,
+    /** False on a debug build, which can never install a release update over itself. */
+    val selfUpdates: Boolean = true,
+) {
+    val busy: Boolean get() = checking || downloading || working
+
+    /**
+     * Worth interrupting the board for.
+     *
+     * Gated on [ready], so the banner never appears until the bytes are on disk. An
+     * update that has been FOUND is not news anyone can act on quickly — offering it
+     * off wifi would turn one tap into a download somebody did not plan.
+     *
+     * Deliberately still true while [working]: the install is the one moment the
+     * banner has something to report, and hiding it there would look like the tap
+     * did nothing.
+     */
+    val nagging: Boolean get() = ready && available != null && !nagDismissed
+}
+
+/**
+ * Updating the app from the server it syncs with.
+ *
+ * **Linked-only, and said out loud.** The app is local-first and completely usable
+ * having never touched a server, so an unlinked install has no update path at all.
+ * The card says that rather than offering a Check button that silently finds
+ * nothing — the same lesson as the desktop's unlink copy (issue 2110).
+ *
+ * The core does the network work, not this class: the device token lives in the
+ * Rust store and pulling it into Kotlin to make an HTTP call would spread the one
+ * secret this app holds across two languages for no gain.
+ */
+class UpdateViewModel(
+    private val core: Inkwell,
+    /**
+     * MUST be the application context — it outlives this view model, and holding an
+     * Activity here is the textbook way to leak a window.
+     */
+    private val context: Context,
+) : ViewModel() {
+    var state by mutableStateOf(
+        UpdateState(
+            installedVersion = AppUpdate.installedVersionCode(context),
+            selfUpdates = AppUpdate.selfUpdates(context),
+        ),
+    )
+        private set
+
+    /** When the last check ran, so coming back to the app twice in a minute is one. */
+    private var lastCheckAt = 0L
+
+    /** Ask the linked server what it has. The Check button on the sync screen. */
+    fun check() = runCheck(fetch = false)
+
+    /**
+     * The automatic path: look, fetch, then nag.
+     *
+     * Called when the app comes forward. Until this existed an update was only ever
+     * found by someone opening the sync screen and pressing a button — so the ones
+     * that mattered were the ones nobody went looking for.
+     *
+     * Skipped when a check is already in flight, when a build is already waiting, and
+     * when one ran recently: flicking between two apps is not a request to re-check.
+     */
+    fun checkInBackground() {
+        val now = System.currentTimeMillis()
+        when {
+            // Nothing a debug build could do with what it found.
+            !state.selfUpdates -> Unit
+
+            state.busy -> Unit
+
+            // Already fetched and waved away — say so again. "Later" is for that
+            // sitting, not forever, and without this branch a single dismissal would
+            // silence the update permanently. Which is precisely the "lost" this whole
+            // path exists to prevent.
+            state.ready -> if (state.nagDismissed) state = state.copy(nagDismissed = false)
+
+            // Found one and never fetched it — almost always because the last look
+            // happened on mobile data. Retry the FETCH rather than the check, and
+            // ignore the interval: this is what makes an update found on the train
+            // arrive when the person gets home instead of waiting out six hours.
+            state.available != null ->
+                if (AppUpdate.onWifi(context)) viewModelScope.launch { download() }
+
+            // Flicking between two apps is not a request to re-check.
+            now - lastCheckAt < CHECK_INTERVAL_MS -> Unit
+
+            else -> {
+                lastCheckAt = now
+                runCheck(fetch = true)
+            }
+        }
+    }
+
+    private fun runCheck(fetch: Boolean) {
+        viewModelScope.launch {
+            state = state.copy(checking = true, error = null, upToDate = false)
+            state =
+                try {
+                    val found = core.clientUpdate(state.installedVersion)
+                    state.copy(
+                        checking = false,
+                        available = found,
+                        upToDate = found == null,
+                        // A build that is still there is worth mentioning again. The
+                        // dismissal was for that sitting, not for this version.
+                        nagDismissed = if (found == null) state.nagDismissed else false,
+                    )
+                } catch (e: Exception) {
+                    // Broad by intent, as everywhere the core is called: it reports
+                    // every failure as one error type carrying a message written to
+                    // be read, and a failed check must not take the screen down.
+                    state.copy(checking = false, error = e.shownAs(FALLBACK))
+                }
+            // Fetched before anything is said, so the banner is a one-tap install
+            // rather than the start of a wait. Off wifi this simply does not happen
+            // and the app stays quiet — the next foreground on wifi picks it up.
+            if (fetch && state.available != null && AppUpdate.onWifi(context)) {
+                download()
+            }
+        }
+    }
+
+    /** Fetch the waiting build into the cache, leaving it for [install]. */
+    private suspend fun download() {
+        state = state.copy(downloading = true, error = null)
+        state =
+            try {
+                core.downloadClientUpdate(AppUpdate.downloadTarget(context).absolutePath)
+                state.copy(downloading = false, ready = true)
+            } catch (e: Exception) {
+                state.copy(downloading = false, error = e.shownAs(FALLBACK_DOWNLOAD))
+            }
+    }
+
+    /** Stop nagging for this sitting. The next trip to the foreground says it again. */
+    fun dismissNag() {
+        state = state.copy(nagDismissed = true)
+    }
+
+    /**
+     * Hand the update to the system installer, downloading first if it is not already
+     * in the cache.
+     *
+     * Still one action from the outside. A downloaded APK is not a state anyone wants
+     * to think about, so whether the fetch already happened in the background is this
+     * class's problem rather than the person's.
+     */
+    fun downloadAndInstall() {
+        viewModelScope.launch {
+            state = state.copy(working = true, error = null)
+            UpdateOutcome.clear()
+            val failure =
+                try {
+                    val target = AppUpdate.downloadTarget(context)
+                    if (!state.ready) core.downloadClientUpdate(target.absolutePath)
+                    // Off the main thread: this streams ~55 MiB into the session.
+                    withContext(Dispatchers.IO) { AppUpdate.install(context, target) }
+                } catch (e: Exception) {
+                    e.shownAs(FALLBACK)
+                }
+            // `working` stays TRUE on success: the install is still in flight, and
+            // on a silent update this process is about to be replaced. Clearing it
+            // here would flash "ready" a moment before the app disappears.
+            state =
+                if (failure == null) state else state.copy(working = false, error = failure)
+        }
+    }
+
+    /**
+     * Take whatever the system finally said about the install.
+     *
+     * Called from the composition, because the answer arrives at a BroadcastReceiver
+     * the system owns and there is no other way back into this class.
+     */
+    fun consumeInstallOutcome(result: UpdateOutcome.Result) {
+        UpdateOutcome.clear()
+        state = state.copy(working = false, error = result.error)
+    }
+
+    fun dismissError() {
+        state = state.copy(error = null)
+    }
+
+    companion object {
+        fun factory(
+            core: Inkwell,
+            context: Context,
+        ): ViewModelProvider.Factory =
+            viewModelFactory { initializer { UpdateViewModel(core, context.applicationContext) } }
+    }
+}
+
+private const val FALLBACK = "The update couldn't be checked."
+private const val FALLBACK_DOWNLOAD = "The update couldn't be downloaded."
+
+/**
+ * How long a background check stays good for.
+ *
+ * Long enough that switching to another app and back is not a re-check; short enough
+ * that a build published this morning is offered today. The same reasoning as sync's
+ * STALE_MINUTES, at a slower cadence — an app update is not urgent, it is just
+ * something that must not get lost.
+ */
+private const val CHECK_INTERVAL_MS = 6L * 60 * 60 * 1000
@@ -1,36 +0,0 @@
-package com.fabledsword.thoughtsync.ui
-
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.DisposableEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.rememberUpdatedState
-import androidx.lifecycle.Lifecycle
-import androidx.lifecycle.LifecycleEventObserver
-import androidx.lifecycle.compose.LocalLifecycleOwner
-
-/**
- * Run [flush] when the app goes to the background.
- *
- * `ON_STOP` rather than `ON_PAUSE`: pause also fires when a dialog opens over the
- * activity, which would save mid-sentence for no reason. The lambda goes through
- * `rememberUpdatedState` so the observer — registered once — always calls the
- * CURRENT one; captured directly it would hold the first composition's empty text
- * forever and save that over a full note.
- *
- * Shared by the editor and the capture sheet. Both are places where text exists
- * only in a composable until something writes it down, and the process can be
- * killed while backgrounded without either of them being told again.
- */
-@Composable
-fun FlushOnStop(flush: () -> Unit) {
-    val current by rememberUpdatedState(flush)
-    val owner = LocalLifecycleOwner.current
-    DisposableEffect(owner) {
-        val observer =
-            LifecycleEventObserver { _, event ->
-                if (event == Lifecycle.Event.ON_STOP) current()
-            }
-        owner.lifecycle.addObserver(observer)
-        onDispose { owner.lifecycle.removeObserver(observer) }
-    }
-}
@@ -1,52 +0,0 @@
-package com.fabledsword.thoughtsync.ui
-
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.DisposableEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.rememberUpdatedState
-import androidx.lifecycle.Lifecycle
-import androidx.lifecycle.LifecycleEventObserver
-import androidx.lifecycle.compose.LocalLifecycleOwner
-
-/**
- * Calls back when the app comes to the front and when it leaves.
- *
- * `ON_START`/`ON_STOP` and not `ON_RESUME`/`ON_PAUSE`, which is the same choice
- * the editor's save-on-leave makes for the same reason: resume and pause fire for
- * anything that merely covers the window — a permission dialog, the notification
- * shade — and a sync per shade-pull is not automatic sync, it is a stutter.
- *
- * A single-Activity app, so the Activity's lifecycle is the app's. If a second
- * Activity is ever added this needs `ProcessLifecycleOwner` instead, or rotating
- * between them will read as leaving and returning.
- *
- * Two callers, wanting opposite halves of it: automatic sync uses the return to
- * decide whether to fetch, and the reminder notice uses it to re-read a
- * permission the person may have just changed in the system settings.
- *
- * Both callbacks go through [rememberUpdatedState]: the observer is registered
- * once, and without it the lambda would keep reading the first composition's
- * state forever — deciding whether to push unsent notes from a snapshot taken
- * before any note existed.
- */
-@Composable
-fun ForegroundTransitions(
-    onForeground: () -> Unit,
-    onBackground: () -> Unit,
-) {
-    val forward by rememberUpdatedState(onForeground)
-    val away by rememberUpdatedState(onBackground)
-    val owner = LocalLifecycleOwner.current
-    DisposableEffect(owner) {
-        val observer =
-            LifecycleEventObserver { _, event ->
-                when (event) {
-                    Lifecycle.Event.ON_START -> forward()
-                    Lifecycle.Event.ON_STOP -> away()
-                    else -> Unit
-                }
-            }
-        owner.lifecycle.addObserver(observer)
-        onDispose { owner.lifecycle.removeObserver(observer) }
-    }
-}
@@ -1,237 +0,0 @@
-package com.fabledsword.thoughtsync.ui
-
-import androidx.compose.foundation.background
-import androidx.compose.foundation.border
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.isSystemInDarkTheme
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.shape.RoundedCornerShape
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.remember
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.text.font.FontStyle
-import androidx.compose.ui.text.style.TextDecoration
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.dp
-import com.fabledsword.thoughtsync.R
-import com.fabledsword.thoughtsync.core.BodyItem
-import com.fabledsword.thoughtsync.core.Note
-import com.fabledsword.thoughtsync.core.NoteLabel
-import com.fabledsword.thoughtsync.core.checklistItems
-
-@Composable
-fun NoteCard(
-    note: Note,
-    onOpen: () -> Unit,
-    onToggleItem: (Int, Boolean) -> Unit,
-) {
-    val dark = isSystemInDarkTheme()
-    val tint = noteTint(note.color)
-
-    Column(
-        modifier =
-            Modifier
-                .fillMaxWidth()
-                // Clipped BEFORE clickable, so the ripple is bounded by the card's
-                // rounded corners instead of a rectangle overhanging them.
-                .clip(RoundedCornerShape(CARD_RADIUS))
-                .clickable(onClickLabel = stringResource(R.string.board_open_note), onClick = onOpen)
-                .background(tint.background(dark))
-                .border(1.dp, tint.border(dark), RoundedCornerShape(CARD_RADIUS))
-                .padding(12.dp),
-    ) {
-        // Body then checklist, in order — a note can carry both (M13 step 2), and
-        // nothing above them: the first line of the body IS the note's name, at the
-        // same weight as the rest of it (M13 steps 3 and 4).
-        if (note.body.isNotBlank()) {
-            NoteBody(note = note, onToggleItem = onToggleItem)
-        }
-
-        // A note with nothing in it still has to occupy the board legibly — otherwise
-        // it reads as a rendering bug.
-        if (note.body.isBlank()) {
-            Text(
-                text = stringResource(R.string.board_empty_note),
-                style = MaterialTheme.typography.bodyMedium,
-                fontStyle = FontStyle.Italic,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-        }
-
-        if (note.labels.isNotEmpty()) {
-            Spacer(Modifier.height(8.dp))
-            LabelChips(labels = note.labels)
-        }
-
-        note.remindAt?.let { at ->
-            Spacer(Modifier.height(8.dp))
-            ReminderChip(instant = at, recurrence = note.recurrence)
-        }
-    }
-}
-
-/**
- * The note's body, with its checklist drawn where it actually sits.
- *
- * Rendered line by line rather than as one block of text, because an item is a line
- * of the body now (M304) and a card that showed the prose and then the list would put
- * every list in the wrong place — and, since the body already contains those lines,
- * would show each one twice.
- *
- * Which lines are items is asked of the core rather than matched here. The grammar is
- * already written three times; a fourth in Compose would be a fourth place for a
- * checklist to change shape when it syncs.
- */
-@Composable
-private fun NoteBody(
-    note: Note,
-    onToggleItem: (Int, Boolean) -> Unit,
-) {
-    val lines = remember(note.body) { note.body.split("\n") }
-    // Read from the BODY rather than from note.items, which is the same list by a
-    // longer route — and one that can lag the text by a save.
-    val itemAtLine =
-        remember(note.body) {
-            checklistItems(note.body)
-                .mapIndexed { index, item -> item.line.toInt() to (index to item) }
-                .toMap()
-        }
-
-    Column(verticalArrangement = Arrangement.spacedBy(2.dp)) {
-        lines.take(MAX_PREVIEW_LINES).forEachIndexed { n, line ->
-            val found = itemAtLine[n]
-            when {
-                found != null ->
-                    ChecklistRow(found.second) { onToggleItem(found.first, !found.second.checked) }
-                // Kept as a gap rather than dropped: it is the paragraph break
-                // somebody typed, and the card reads as a wall without it.
-                line.isBlank() -> Spacer(Modifier.height(4.dp))
-                else ->
-                    Text(
-                        text = line,
-                        style = MaterialTheme.typography.bodyMedium,
-                        maxLines = MAX_WRAPPED_LINES,
-                        overflow = TextOverflow.Ellipsis,
-                    )
-            }
-        }
-        if (lines.size > MAX_PREVIEW_LINES) {
-            Text(
-                text = "…",
-                style = MaterialTheme.typography.bodyMedium,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-        }
-    }
-}
-
-/**
- * One checklist row on a card, with a box you can actually tick.
- *
- * A glyph rather than a Material Checkbox: it sits on a line of text and has to share
- * that line's metrics, and a real Checkbox brings 48dp of touch target that would
- * space a list out like a form. The tap target is the glyph's own padding, which is
- * why it carries `clickable` rather than the row — clicking the TEXT should open the
- * note, the way clicking anywhere else on the card does.
- */
-@Composable
-private fun ChecklistRow(
-    item: BodyItem,
-    onToggle: () -> Unit,
-) {
-    Row(verticalAlignment = Alignment.Top) {
-        Text(
-            text = if (item.checked) "☑" else "☐",
-            style = MaterialTheme.typography.bodyMedium,
-            modifier =
-                Modifier
-                    .clickable(onClick = onToggle)
-                    .padding(end = 6.dp),
-        )
-        Text(
-            text = item.text,
-            style = MaterialTheme.typography.bodyMedium,
-            textDecoration = if (item.checked) TextDecoration.LineThrough else null,
-            color =
-                if (item.checked) {
-                    MaterialTheme.colorScheme.onSurfaceVariant
-                } else {
-                    MaterialTheme.colorScheme.onSurface
-                },
-            maxLines = MAX_WRAPPED_LINES,
-            overflow = TextOverflow.Ellipsis,
-        )
-    }
-}
-
-@Composable
-private fun LabelChips(labels: List<NoteLabel>) {
-    val dark = isSystemInDarkTheme()
-    // A plain row that clips rather than wraps: a card with eight labels should
-    // not grow taller than its content. The editor shows the full set.
-    Row(horizontalArrangement = Arrangement.spacedBy(4.dp)) {
-        labels.take(MAX_LABEL_CHIPS).forEach { label ->
-            val tint = noteTint(label.color)
-            Text(
-                text = label.name,
-                style = MaterialTheme.typography.labelSmall,
-                color = tint.chipForeground(dark),
-                maxLines = 1,
-                overflow = TextOverflow.Ellipsis,
-                modifier =
-                    Modifier
-                        .clip(RoundedCornerShape(CHIP_RADIUS))
-                        .background(tint.chipBackground(dark))
-                        .padding(horizontal = 6.dp, vertical = 2.dp),
-            )
-        }
-    }
-}
-
-/**
- * The reminder, red once it has passed.
- *
- * Red for overdue and neutral otherwise, matching the web card exactly — the same
- * red-100/red-700 and black/5 pairs, resolved through the shared tint table. It
- * used to be blue for every reminder here, which made "you missed this" and
- * "coming up on Friday" look identical on a board full of both.
- */
-@Composable
-private fun ReminderChip(
-    instant: String,
-    recurrence: String?,
-) {
-    val dark = isSystemInDarkTheme()
-    val tint = noteTint(if (isPast(instant)) "red" else "default")
-    Text(
-        text = reminderLabel(instant, recurrence),
-        style = MaterialTheme.typography.labelSmall,
-        color = tint.chipForeground(dark),
-        maxLines = 1,
-        overflow = TextOverflow.Ellipsis,
-        modifier =
-            Modifier
-                .clip(RoundedCornerShape(CHIP_RADIUS))
-                .background(tint.chipBackground(dark))
-                .padding(horizontal = 6.dp, vertical = 2.dp),
-    )
-}
-
-private const val MAX_PREVIEW_LINES = 8
-
-/** How far one long line of a card may wrap before it is cut. */
-private const val MAX_WRAPPED_LINES = 2
-private const val MAX_LABEL_CHIPS = 3
-private val CARD_RADIUS = 12.dp
-private val CHIP_RADIUS = 6.dp
@@ -1,177 +0,0 @@
-package com.fabledsword.thoughtsync.ui
-
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.ReadOnlyComposable
-import androidx.compose.ui.graphics.Color
-
-/**
- * The note colour palette, matching `frontend/src/notes/colors.ts` VALUE FOR VALUE.
- *
- * A note's colour is stored by the core as a key ("red", "teal", …) and every
- * surface resolves it to its own tints. The web app resolves through Tailwind
- * classes; this table is those same Tailwind colours as literals, so a note that
- * is amber on the desktop is the same amber on the phone rather than a near-miss.
- * Generated from tailwindcss 3.4's palette rather than transcribed by eye.
- *
- * Dark tints keep the web's ALPHA (`dark:bg-red-950/40`) instead of a
- * precomputed blend — Compose composites a translucent colour over what's beneath
- * exactly as CSS does, so the card sits on the background the same way in both.
- *
- * `yellow` maps to Tailwind's *amber*, matching colors.ts; plain yellow is too
- * acid against the neutral surfaces.
- */
-data class NoteTint(
-    val label: String,
-    val lightBackground: Color,
-    val lightBorder: Color,
-    val darkBackground: Color,
-    val darkBorder: Color,
-    val lightChipBackground: Color,
-    val lightChipForeground: Color,
-    val darkChipBackground: Color,
-    val darkChipForeground: Color,
-) {
-    fun background(dark: Boolean): Color = if (dark) darkBackground else lightBackground
-
-    fun border(dark: Boolean): Color = if (dark) darkBorder else lightBorder
-
-    fun chipBackground(dark: Boolean): Color = if (dark) darkChipBackground else lightChipBackground
-
-    fun chipForeground(dark: Boolean): Color = if (dark) darkChipForeground else lightChipForeground
-}
-
-/** Keyed by the core's colour vocabulary. Order matches the web's picker. */
-val NOTE_TINTS: Map<String, NoteTint> =
-    mapOf(
-        "default" to
-            NoteTint(
-                label = "Default",
-                lightBackground = Color(0xFFFFFFFF),
-                lightBorder = Color(0xFFE5E5E5),
-                darkBackground = Color(0xFF171717),
-                darkBorder = Color(0xFF404040),
-                lightChipBackground = Color(0x0D000000),
-                lightChipForeground = Color(0xFF525252),
-                darkChipBackground = Color(0x1AFFFFFF),
-                darkChipForeground = Color(0xFFD4D4D4),
-            ),
-        "red" to
-            NoteTint(
-                label = "Red",
-                lightBackground = Color(0xFFFEF2F2),
-                lightBorder = Color(0xFFFECACA),
-                darkBackground = Color(0x66450A0A),
-                darkBorder = Color(0xFF7F1D1D),
-                lightChipBackground = Color(0xFFFEE2E2),
-                lightChipForeground = Color(0xFFB91C1C),
-                darkChipBackground = Color(0x80450A0A),
-                darkChipForeground = Color(0xFFFCA5A5),
-            ),
-        "orange" to
-            NoteTint(
-                label = "Orange",
-                lightBackground = Color(0xFFFFF7ED),
-                lightBorder = Color(0xFFFED7AA),
-                darkBackground = Color(0x66431407),
-                darkBorder = Color(0xFF7C2D12),
-                lightChipBackground = Color(0xFFFFEDD5),
-                lightChipForeground = Color(0xFFC2410C),
-                darkChipBackground = Color(0x80431407),
-                darkChipForeground = Color(0xFFFDBA74),
-            ),
-        "yellow" to
-            NoteTint(
-                label = "Yellow",
-                lightBackground = Color(0xFFFFFBEB),
-                lightBorder = Color(0xFFFDE68A),
-                darkBackground = Color(0x66451A03),
-                darkBorder = Color(0xFF78350F),
-                lightChipBackground = Color(0xFFFEF3C7),
-                lightChipForeground = Color(0xFF92400E),
-                darkChipBackground = Color(0x80451A03),
-                darkChipForeground = Color(0xFFFCD34D),
-            ),
-        "green" to
-            NoteTint(
-                label = "Green",
-                lightBackground = Color(0xFFF0FDF4),
-                lightBorder = Color(0xFFBBF7D0),
-                darkBackground = Color(0x66052E16),
-                darkBorder = Color(0xFF14532D),
-                lightChipBackground = Color(0xFFDCFCE7),
-                lightChipForeground = Color(0xFF15803D),
-                darkChipBackground = Color(0x80052E16),
-                darkChipForeground = Color(0xFF86EFAC),
-            ),
-        "teal" to
-            NoteTint(
-                label = "Teal",
-                lightBackground = Color(0xFFF0FDFA),
-                lightBorder = Color(0xFF99F6E4),
-                darkBackground = Color(0x66042F2E),
-                darkBorder = Color(0xFF134E4A),
-                lightChipBackground = Color(0xFFCCFBF1),
-                lightChipForeground = Color(0xFF0F766E),
-                darkChipBackground = Color(0x80042F2E),
-                darkChipForeground = Color(0xFF5EEAD4),
-            ),
-        "blue" to
-            NoteTint(
-                label = "Blue",
-                lightBackground = Color(0xFFEFF6FF),
-                lightBorder = Color(0xFFBFDBFE),
-                darkBackground = Color(0x66172554),
-                darkBorder = Color(0xFF1E3A8A),
-                lightChipBackground = Color(0xFFDBEAFE),
-                lightChipForeground = Color(0xFF1D4ED8),
-                darkChipBackground = Color(0x80172554),
-                darkChipForeground = Color(0xFF93C5FD),
-            ),
-        "purple" to
-            NoteTint(
-                label = "Purple",
-                lightBackground = Color(0xFFFAF5FF),
-                lightBorder = Color(0xFFE9D5FF),
-                darkBackground = Color(0x663B0764),
-                darkBorder = Color(0xFF581C87),
-                lightChipBackground = Color(0xFFF3E8FF),
-                lightChipForeground = Color(0xFF7E22CE),
-                darkChipBackground = Color(0x803B0764),
-                darkChipForeground = Color(0xFFD8B4FE),
-            ),
-        "pink" to
-            NoteTint(
-                label = "Pink",
-                lightBackground = Color(0xFFFDF2F8),
-                lightBorder = Color(0xFFFBCFE8),
-                darkBackground = Color(0x66500724),
-                darkBorder = Color(0xFF831843),
-                lightChipBackground = Color(0xFFFCE7F3),
-                lightChipForeground = Color(0xFFBE185D),
-                darkChipBackground = Color(0x80500724),
-                darkChipForeground = Color(0xFFF9A8D4),
-            ),
-        "gray" to
-            NoteTint(
-                label = "Gray",
-                lightBackground = Color(0xFFF5F5F5),
-                lightBorder = Color(0xFFD4D4D4),
-                darkBackground = Color(0xFF262626),
-                darkBorder = Color(0xFF404040),
-                lightChipBackground = Color(0xFFE5E5E5),
-                lightChipForeground = Color(0xFF404040),
-                darkChipBackground = Color(0xFF404040),
-                darkChipForeground = Color(0xFFE5E5E5),
-            ),
-    )
-
-/**
- * Resolve a stored colour key.
- *
- * An unknown key falls back to `default` rather than throwing: colours are data
- * that arrives from a server which may be newer than this client, and a note
- * whose tint we don't recognise should still be readable.
- */
-@Composable
-@ReadOnlyComposable
-fun noteTint(key: String): NoteTint = NOTE_TINTS[key] ?: NOTE_TINTS.getValue("default")
@@ -1,92 +0,0 @@
-package com.fabledsword.thoughtsync.ui
-
-import androidx.compose.foundation.background
-import androidx.compose.foundation.border
-import androidx.compose.foundation.isSystemInDarkTheme
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.shape.RoundedCornerShape
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.unit.dp
-import com.fabledsword.thoughtsync.R
-
-/**
- * A bordered block, tinted from the same table the notes use.
- *
- * Reusing the note palette rather than Material's `errorContainer` keeps the whole
- * app one visual language: a warning here is the same yellow a note can be, which
- * is also what the web app does with its Tailwind amber.
- */
-@Composable
-fun Panel(
-    tone: Tone = Tone.NEUTRAL,
-    content: @Composable () -> Unit,
-) {
-    val dark = isSystemInDarkTheme()
-    val tint = noteTint(tone.tintKey())
-    Column(
-        modifier =
-            Modifier
-                .fillMaxWidth()
-                .clip(RoundedCornerShape(PANEL_RADIUS))
-                .background(tint.background(dark))
-                .border(1.dp, tint.border(dark), RoundedCornerShape(PANEL_RADIUS))
-                .padding(12.dp),
-        verticalArrangement = Arrangement.spacedBy(2.dp),
-    ) {
-        content()
-    }
-}
-
-@Composable
-fun Notice(
-    tone: Tone,
-    title: String,
-    body: String,
-    onDismiss: (() -> Unit)? = null,
-    /**
-     * A way to FIX what the notice describes, when there is one.
-     *
-     * Separate from [onDismiss] because they are opposites: dismissing accepts the
-     * situation, acting changes it. A notice about a permission has an action and
-     * no dismiss — acknowledging a reminder that cannot ring does not make it ring.
-     */
-    actionLabel: String? = null,
-    onAction: (() -> Unit)? = null,
-) {
-    Panel(tone = tone) {
-        Text(
-            text = title,
-            style = MaterialTheme.typography.titleSmall,
-            fontWeight = FontWeight.SemiBold,
-        )
-        Text(text = body, style = MaterialTheme.typography.bodyMedium)
-        if (actionLabel != null && onAction != null) {
-            TextButton(onClick = onAction) { Text(actionLabel) }
-        }
-        onDismiss?.let {
-            TextButton(onClick = it) { Text(stringResource(R.string.error_dismiss)) }
-        }
-    }
-}
-
-/** The three tones a panel or notice can take, mapped onto the note palette. */
-enum class Tone { NEUTRAL, WARN, ERROR }
-
-private fun Tone.tintKey(): String =
-    when (this) {
-        Tone.NEUTRAL -> "default"
-        Tone.WARN -> "yellow"
-        Tone.ERROR -> "red"
-    }
-
-private val PANEL_RADIUS = 12.dp
@@ -1,128 +0,0 @@
-package com.fabledsword.thoughtsync.ui
-
-import android.content.Context
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.setValue
-import androidx.lifecycle.ViewModel
-import androidx.lifecycle.ViewModelProvider
-import androidx.lifecycle.viewModelScope
-import com.fabledsword.thoughtsync.AppUpdate
-import com.fabledsword.thoughtsync.UpdateOutcome
-import com.fabledsword.thoughtsync.core.ClientUpdate
-import com.fabledsword.thoughtsync.core.ThoughtSync
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-/** Everything the update card renders from. */
-data class UpdateState(
-    /** What is running now. Shown even when there is nothing to update to. */
-    val installedVersion: Long = 0,
-    val checking: Boolean = false,
-    /** Only ever set to something NEWER — the core does that comparison. */
-    val available: ClientUpdate? = null,
-    /** A check completed and found nothing. Distinct from "not checked yet". */
-    val upToDate: Boolean = false,
-    val working: Boolean = false,
-    val error: String? = null,
-) {
-    val busy: Boolean get() = checking || working
-}
-
-/**
- * Updating the app from the server it syncs with.
- *
- * **Linked-only, and said out loud.** The app is local-first and completely usable
- * having never touched a server, so an unlinked install has no update path at all.
- * The card says that rather than offering a Check button that silently finds
- * nothing — the same lesson as the desktop's unlink copy (issue 2110).
- *
- * The core does the network work, not this class: the device token lives in the
- * Rust store and pulling it into Kotlin to make an HTTP call would spread the one
- * secret this app holds across two languages for no gain.
- */
-class UpdateViewModel(
-    private val core: ThoughtSync,
-    /**
-     * MUST be the application context — it outlives this view model, and holding an
-     * Activity here is the textbook way to leak a window.
-     */
-    private val context: Context,
-) : ViewModel() {
-    var state by mutableStateOf(UpdateState(installedVersion = AppUpdate.installedVersionCode(context)))
-        private set
-
-    /** Ask the linked server what it has. */
-    fun check() {
-        viewModelScope.launch {
-            state = state.copy(checking = true, error = null, upToDate = false)
-            state =
-                try {
-                    val found = core.clientUpdate(state.installedVersion)
-                    state.copy(checking = false, available = found, upToDate = found == null)
-                } catch (e: Exception) {
-                    // Broad by intent, as everywhere the core is called: it reports
-                    // every failure as one error type carrying a message written to
-                    // be read, and a failed check must not take the screen down.
-                    state.copy(checking = false, error = e.message ?: FALLBACK)
-                }
-        }
-    }
-
-    /**
-     * Download the update and hand it to the system installer.
-     *
-     * One action rather than two buttons: nobody wants a downloaded APK sitting
-     * around as an intermediate state they have to think about.
-     */
-    fun downloadAndInstall() {
-        viewModelScope.launch {
-            state = state.copy(working = true, error = null)
-            UpdateOutcome.clear()
-            val failure =
-                try {
-                    val target = AppUpdate.downloadTarget(context)
-                    core.downloadClientUpdate(target.absolutePath)
-                    // Off the main thread: this streams ~55 MiB into the session.
-                    withContext(Dispatchers.IO) { AppUpdate.install(context, target) }
-                } catch (e: Exception) {
-                    e.message ?: FALLBACK
-                }
-            // `working` stays TRUE on success: the install is still in flight, and
-            // on a silent update this process is about to be replaced. Clearing it
-            // here would flash "ready" a moment before the app disappears.
-            state =
-                if (failure == null) state else state.copy(working = false, error = failure)
-        }
-    }
-
-    /**
-     * Take whatever the system finally said about the install.
-     *
-     * Called from the composition, because the answer arrives at a BroadcastReceiver
-     * the system owns and there is no other way back into this class.
-     */
-    fun consumeInstallOutcome(result: UpdateOutcome.Result) {
-        UpdateOutcome.clear()
-        state = state.copy(working = false, error = result.error)
-    }
-
-    fun dismissError() {
-        state = state.copy(error = null)
-    }
-
-    companion object {
-        fun factory(
-            core: ThoughtSync,
-            context: Context,
-        ): ViewModelProvider.Factory =
-            object : ViewModelProvider.Factory {
-                @Suppress("UNCHECKED_CAST")
-                override fun <T : ViewModel> create(modelClass: Class<T>): T =
-                    UpdateViewModel(core, context.applicationContext) as T
-            }
-    }
-}
-
-private const val FALLBACK = "The update couldn't be checked."
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  The Material paperclip ("attach_file"), for the editor's Attach button and the
+  file rows under a note.
+
+  A drawable rather than an Icons.* constant because material-icons-core does not
+  carry it, and the extended set is a multi-megabyte dependency for one glyph.
+  Tinted by whatever draws it, like every other icon in the toolbar.
+-->
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="24"
+    android:viewportHeight="24">
+    <path
+        android:fillColor="#FF000000"
+        android:pathData="M16.5,6v11.5c0,2.21 -1.79,4 -4,4s-4,-1.79 -4,-4V5c0,-1.38 1.12,-2.5 2.5,-2.5s2.5,1.12 2.5,2.5v10.5c0,0.55 -0.45,1 -1,1s-1,-0.45 -1,-1V6H10v9.5c0,1.38 1.12,2.5 2.5,2.5s2.5,-1.12 2.5,-2.5V5c0,-2.21 -1.79,-4 -4,-4S7,2.79 7,5v12.5c0,3.04 2.46,5.5 5.5,5.5s5.5,-2.46 5.5,-5.5V6h-1.5z" />
+</vector>
@@ -3,10 +3,12 @@
  Adaptive icon. minSdk is 26, so this is the ONLY icon Android will ask for —
  no legacy raster fallback is needed.

-  The foreground is the shared maskable asset the web app already ships
-  (frontend/public/icon-maskable-512.png), which is drawn with the safe-zone
-  padding adaptive icons require. Reusing it means the phone, the web app and the
-  desktop all wear the same face rather than three near-misses.
+  The foreground is the inkwell mark alone on transparency, inside the 66dp safe
+  circle; the yellow is the background colour. It is rendered by
+  packaging/icons.py from the same drawing as the web and desktop icons, so all
+  three wear one face. Transparent rather than a full-bleed tile because the
+  monochrome layer below reuses it: a themed icon draws its alpha as a silhouette,
+  and an opaque foreground would come out as a solid square.
 -->
 <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
    <background android:drawable="@color/ic_launcher_background" />
@@ -2,6 +2,6 @@
 <resources>
    <!-- The product's brand colour, same value the web app's manifest and
         <meta name="theme-color"> already use. One source of truth for "what
-         colour is ThoughtSync" across the three surfaces. -->
+         colour is Inkwell" across the three surfaces. -->
    <color name="ic_launcher_background">#F5C518</color>
 </resources>
@@ -1,12 +1,26 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <string name="app_name">ThoughtSync</string>
+    <string name="app_name">Inkwell</string>

    <!-- Search bar -->
    <string name="search_hint">Search your notes</string>
    <string name="search_clear">Clear search</string>
    <string name="nav_open">Open navigation</string>
-    <string name="nav_labels">Labels</string>
+    <string name="nav_labels">Tags</string>
+    <string name="nav_notes">Notes</string>
+    <string name="nav_reminders">Reminders</string>
+    <string name="nav_archive">Archive</string>
+    <string name="nav_trash">Trash</string>
+    <string name="tint_default">Default</string>
+    <string name="tint_red">Red</string>
+    <string name="tint_orange">Orange</string>
+    <string name="tint_yellow">Yellow</string>
+    <string name="tint_green">Green</string>
+    <string name="tint_teal">Teal</string>
+    <string name="tint_blue">Blue</string>
+    <string name="tint_purple">Purple</string>
+    <string name="tint_pink">Pink</string>
+    <string name="tint_gray">Gray</string>

    <!-- Compose sheet -->
    <string name="compose_open">New note</string>
@@ -14,12 +28,29 @@
    <!-- Board -->
    <string name="board_empty_note">Empty note</string>

+    <!-- The long-press menu. Its ITEMS are the editor_* strings, deliberately: a
+         note has one vocabulary of things you can do to it, and a board that said
+         "Delete" where the editor says "Move to trash" would be describing two
+         different apps. Only the wrapper and the undo need words of their own. -->
+    <string name="board_note_actions">Note actions</string>
+    <string name="board_trashed">Moved to trash</string>
+    <string name="board_undo">Undo</string>
+
    <!-- Empty states. Each destination says something true of ITSELF; a single
         "nothing here" reads as encouragement on the board and as a fault in Trash. -->
    <string name="board_empty_title">Nothing here yet</string>
    <string name="board_empty_body">Tap + to start a note or a list. Everything stays on this device until you connect a server.</string>
    <string name="empty_search_title">No matches</string>
    <string name="empty_search_body">Nothing matched “%1$s”.</string>
+    <string name="empty_filtered_title">No matches</string>
+    <string name="empty_filtered_body">No notes match these filters.</string>
+    <string name="filters">Filters</string>
+    <string name="filters_count">Filters · %1$d</string>
+    <string name="filters_clear">Clear</string>
+    <string name="filters_show">Show only</string>
+    <string name="filters_has_attachment">Has attachment</string>
+    <string name="filters_shared_with_me">Shared with me</string>
+    <string name="filters_tags">Tagged with all of</string>
    <string name="empty_trash_title">Trash is empty</string>
    <string name="empty_trash_body">Deleted notes wait here before they are removed for good.</string>
    <string name="empty_archive_title">Nothing archived</string>
@@ -32,9 +63,8 @@
    <string name="editor_back">Back to notes</string>
    <string name="editor_add_checklist">Add a checklist</string>
    <string name="editor_body_hint">Take a note…</string>
-    <string name="editor_add_item">Add item</string>
    <string name="editor_remove_item">Remove item</string>
-    <string name="editor_remove_label">Remove label</string>
+    <string name="editor_remove_label">Remove tag</string>
    <string name="editor_reminder">Set a reminder</string>
    <string name="editor_more">More actions</string>
    <string name="editor_saving">Saving…</string>
@@ -44,12 +74,49 @@
    <string name="editor_done">Done</string>
    <string name="editor_pin">Pin</string>
    <string name="editor_unpin">Unpin</string>
-    <string name="editor_labels">Labels…</string>
+    <string name="editor_labels">Tags…</string>
    <string name="editor_archive">Archive</string>
    <string name="editor_unarchive">Unarchive</string>
    <string name="editor_trash">Move to trash</string>
    <string name="editor_restore">Restore</string>
-    <string name="editor_cancel">Cancel</string>
+    <string name="cancel">Cancel</string>
+    <string name="editor_share">Share…</string>
+
+    <!-- Sharing (#5175). Shares live on the server, so the sheet says so when this
+         phone isn't linked to one. -->
+    <string name="share_title">Share</string>
+    <string name="share_loading">Loading…</string>
+    <string name="share_needs_server">Sharing is between people on a server. Link this phone in Sync to share notes.</string>
+    <string name="share_none">Not shared with anyone yet.</string>
+    <string name="share_everyone">Shared with everyone on this server.</string>
+    <string name="share_add">Add someone or a group</string>
+    <string name="share_action">Share</string>
+    <string name="share_remove">Stop sharing</string>
+    <string name="share_can_view">Can view</string>
+    <string name="share_can_edit">Can edit</string>
+    <string name="share_someone">someone</string>
+    <string name="share_by_view_only">Shared by %1$s · view only</string>
+    <string name="share_by_can_edit">Shared by %1$s · you can edit the text</string>
+    <string name="share_chip_shared">Shared</string>
+    <string name="share_chip_by">From %1$s</string>
+    <plurals name="share_group_members">
+        <item quantity="one">Group · %d person</item>
+        <item quantity="other">Group · %d people</item>
+    </plurals>
+
+    <!-- Attachments. A file is stored on the phone at once and uploaded on a later
+         sync, so nothing here talks about the network. -->
+    <string name="editor_attach">Attach a file</string>
+    <string name="attach_remove">Remove attachment</string>
+    <string name="attach_unnamed">Unnamed file</string>
+    <string name="attach_more">+%1$d more</string>
+    <string name="attach_refused">Not uploaded: %1$s</string>
+    <string name="attach_too_large">%1$s is over %2$d MB, too large to attach from the phone.</string>
+    <string name="attach_unreadable">Couldn\'t read %1$s.</string>
+    <string name="attach_not_here">This file hasn\'t downloaded to this phone yet. Sync, then try again.</string>
+    <string name="attach_no_app">No app on this phone opens this kind of file.</string>
+    <string name="attach_open_failed">Couldn\'t open the file: %1$s</string>
+    <string name="preview_remove">Remove link preview</string>

    <!-- Deleting for good is the only thing in the app that cannot be undone, so
         the copy says exactly that rather than asking "Are you sure?". -->
@@ -58,12 +125,65 @@
    <string name="editor_delete_forever_body">It will be removed from this device and from every device you sync with. This cannot be undone.</string>
    <string name="editor_delete_forever_confirm">Delete</string>

+    <!-- Quick capture from outside the app: the share sheet and the text-selection
+         toolbar. "New note" says what happens; the activity's own label would say
+         who it happens in. -->
+    <string name="capture_process_text">New note</string>
+
+    <!-- Tag management. The whole vocabulary is "tag" (see Scribe #2966); the
+         schema still says Label, and no string here needs to know that. -->
+    <string name="tags_manage">Manage tags</string>
+    <string name="tags_title">Tags</string>
+    <string name="tags_back">Back</string>
+    <string name="tags_new_hint">New tag</string>
+    <string name="tags_create">Create</string>
+    <plurals name="tags_count">
+        <item quantity="one">%d note</item>
+        <item quantity="other">%d notes</item>
+    </plurals>
+    <string name="tags_count_none">No notes yet</string>
+    <string name="tags_empty_title">No tags yet</string>
+    <string name="tags_empty_body">Create one above, or write a #tag in a note and it becomes one.</string>
+    <string name="tags_actions">More actions</string>
+    <string name="tags_colour">Colour</string>
+    <string name="tags_colour_of">Colour for %1$s</string>
+
+    <string name="tags_rename">Rename</string>
+    <string name="tags_rename_title">Rename %1$s</string>
+    <string name="tags_rename_confirm">Rename</string>
+    <!-- Renaming onto an existing tag merges the two, older survives (Scribe
+         #3324). A merge cannot be undone by repeating it and is reachable here by
+         a typo, so it says so before it happens — same reasoning as #2116. -->
+    <string name="tags_rename_merges_title">Merge with %1$s?</string>
+    <string name="tags_rename_merges_body">A tag called %1$s already exists. Renaming will merge these two into one, carrying every note from both. The notes are kept; one of the two tags stops existing, and that cannot be undone.</string>
+    <string name="tags_rename_merges_confirm">Merge</string>
+
+    <string name="tags_merge">Merge into…</string>
+    <string name="tags_merge_title">Merge %1$s into…</string>
+    <!-- The survivor is named in the button, not just the title: this is the one
+         operation here that repeating does not undo. -->
+    <string name="tags_merge_body">Every note tagged %1$s will be tagged with the one you pick instead, and %1$s will stop existing. The notes are kept.</string>
+    <string name="tags_merge_none">There is no other tag to merge into.</string>
+
+    <string name="tags_delete">Delete</string>
+    <string name="tags_delete_title">Delete %1$s?</string>
+    <string name="tags_delete_body">It will be removed from every note that has it, on every device you sync with. The notes themselves are kept.</string>
+    <plurals name="tags_delete_body_counted">
+        <item quantity="one">It is on %d note. It will be removed from it, on every device you sync with. The note itself is kept.</item>
+        <item quantity="other">It is on %d notes. It will be removed from all of them, on every device you sync with. The notes themselves are kept.</item>
+    </plurals>
+    <string name="tags_delete_confirm">Delete</string>
+    <!-- A tag written as #tag in a note's body is owned by that text. Deleting the
+         row cannot un-write the word, so it comes back on that note's next edit —
+         said here rather than left as a surprise. -->
+    <string name="tags_delete_from_text">Tags written as #tag in a note come back when that note is next edited.</string>
+
+
    <!-- Pickers -->
-    <string name="color_picker_title">Color</string>
-    <string name="label_picker_title">Labels</string>
-    <string name="label_new_hint">Type a label and press enter</string>
-    <string name="label_from_tag">from #tag</string>
-    <string name="label_none_body">No labels yet. Type one above, or write a #tag in a note and it becomes one.</string>
+    <string name="label_picker_title">Tags</string>
+    <string name="label_new_hint">Type a tag and press enter</string>
+    <string name="label_from_tag">from the text</string>
+    <string name="label_none_body">No tags yet. Type one above, or write a #tag in a note and it becomes one.</string>
    <string name="picker_next">Next</string>
    <string name="picker_set">Set</string>
    <string name="picker_time_title">Pick a time</string>
@@ -107,7 +227,7 @@
    <string name="reminder_channel">Reminders</string>
    <string name="reminder_channel_description">Notifies you when a note\'s reminder is due.</string>
    <string name="reminder_notifications_blocked_title">Reminders can\'t notify you</string>
-    <string name="reminder_notifications_blocked_body">Notifications are turned off for ThoughtSync, so reminders will only show here on the board.</string>
+    <string name="reminder_notifications_blocked_body">Notifications are turned off for Inkwell, so reminders will only show here on the board.</string>
    <string name="reminder_open_settings">Open settings</string>
    <string name="reminder_inexact_title">Reminders may arrive late</string>
    <string name="reminder_inexact_body">Without permission for exact alarms, Android delivers reminders when it next wakes the phone — usually within a few minutes, sometimes longer.</string>
@@ -120,10 +240,13 @@
    <string name="update_current">You\'re on the newest build this server has.</string>
    <string name="update_check">Check for an update</string>
    <string name="update_install">Update</string>
+    <string name="update_banner_ready">Build %1$s is downloaded and ready.</string>
+    <string name="update_later">Later</string>
    <string name="update_failed_title">The update didn\'t install</string>
    <string name="update_permission_title">Android needs your permission</string>
-    <string name="update_permission_body">ThoughtSync has to be allowed to install apps before it can update itself. This is a one-time setting.</string>
+    <string name="update_permission_body">Inkwell has to be allowed to install apps before it can update itself. This is a one-time setting.</string>
    <string name="update_permission_action">Allow installing</string>
+    <string name="update_debug_build">This is a debug build, so it can\'t update itself. Install new builds by hand.</string>
    <string name="update_needs_server">App updates come from a server you connect. Until then, install new builds yourself.</string>
    <string name="sync_footer">Your notes live on this device either way — syncing just keeps a server copy in step, so your other devices can catch up.</string>
    <string name="sync_failed_title">Sync failed</string>
@@ -137,14 +260,14 @@

    <!-- Unlinked -->
    <string name="sync_offline_title">Working offline on this device</string>
-    <string name="sync_offline_body">Everything works without a server — your notes are stored on this phone. Connect a ThoughtSync server if you want them to reach your other devices.</string>
+    <string name="sync_offline_body">Everything works without a server — your notes are stored on this phone. Connect an Inkwell server if you want them to reach your other devices.</string>
    <string name="sync_address_label">Server address</string>
    <string name="sync_address_hint">notes.example.com</string>
    <string name="sync_address_help">Uses https unless you type http:// yourself.</string>
    <string name="sync_check">Check</string>
    <string name="sync_probe_failed">Couldn\'t reach that server</string>
    <string name="sync_link_failed">Couldn\'t connect</string>
-    <string name="sync_server_generic">ThoughtSync server</string>
+    <string name="sync_server_generic">Inkwell server</string>
    <string name="sync_server_version">v%1$s</string>
    <string name="sync_compat_ok">Fully compatible.</string>
    <string name="sync_compat_degraded">Compatible, but these features aren\'t available on this server: %1$s.</string>
@@ -188,7 +311,20 @@
        <item quantity="one">%d attachment didn\'t download — it\'ll retry on the next sync.</item>
        <item quantity="other">%d attachments didn\'t download — they\'ll retry on the next sync.</item>
    </plurals>
+    <plurals name="sync_summary_uploaded">
+        <item quantity="one">uploaded %d file</item>
+        <item quantity="other">uploaded %d files</item>
+    </plurals>
+    <plurals name="sync_summary_upload_failed">
+        <item quantity="one">%d file didn\'t upload. If the server refused it, its note says why; otherwise it\'ll retry.</item>
+        <item quantity="other">%d files didn\'t upload. Any the server refused say why on their note; the rest will retry.</item>
+    </plurals>

    <!-- Errors -->
    <string name="error_dismiss">Dismiss</string>
+
+    <!-- The build, at the foot of Sync. Never blank: an APK with no versionName is
+         a real state (a bare `gradlew assembleDebug` with no override) and saying
+         so is better than an empty line that reads as a layout bug. -->
+    <string name="build_unknown">unknown</string>
 </resources>
@@ -6,5 +6,5 @@
      truth in XML — the same reason the desktop reads its live theme rather
      than hardcoding a window colour.
    -->
-    <style name="Theme.ThoughtSync" parent="android:Theme.Material.NoActionBar" />
+    <style name="Theme.Inkwell" parent="android:Theme.Material.NoActionBar" />
 </resources>
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  What the FileProvider may hand to another app: ONLY the copies made to open an
+  attachment (AttachmentFiles.open), never the store or the blob directory itself.
+  A viewer gets read access to the one file it was asked to show.
+-->
+<paths>
+    <cache-path name="open" path="open/" />
+</paths>
@@ -0,0 +1,38 @@
+package com.fabledsword.inkwell
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertThrows
+import org.junit.Test
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+
+class SealedBoxTest {
+    private fun aesKey(): SecretKey = KeyGenerator.getInstance("AES").apply { init(256) }.generateKey()
+
+    @Test
+    fun `a sealed token opens with the key that sealed it`() {
+        val key = aesKey()
+        val sealed = SealedBox.seal(key, "tok-1")
+        assertNotEquals("tok-1", sealed)
+        assertEquals("tok-1", SealedBox.open(key, sealed))
+    }
+
+    @Test
+    fun `sealing twice gives two different values`() {
+        // A fresh IV each time, so equal tokens can't be spotted in the file.
+        val key = aesKey()
+        assertNotEquals(SealedBox.seal(key, "tok-1"), SealedBox.seal(key, "tok-1"))
+    }
+
+    @Test
+    fun `another key can't open it, as on a phone the backup was restored to`() {
+        val sealed = SealedBox.seal(aesKey(), "tok-1")
+        assertThrows(Exception::class.java) { SealedBox.open(aesKey(), sealed) }
+    }
+
+    @Test
+    fun `a value that was never sealed is refused`() {
+        assertThrows(Exception::class.java) { SealedBox.open(aesKey(), "dG9vIHNob3J0") }
+    }
+}
@@ -0,0 +1,46 @@
+package com.fabledsword.inkwell.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class AttachmentRulesTest {
+    @Test
+    fun `raster images draw inline and SVG never does`() {
+        assertTrue(rendersInline("image/png"))
+        assertTrue(rendersInline("image/jpeg"))
+        assertTrue(rendersInline("IMAGE/WEBP; charset=binary"))
+        assertFalse(rendersInline("image/svg+xml"))
+        assertFalse(rendersInline("Image/SVG+XML"))
+        assertFalse(rendersInline("application/pdf"))
+        assertFalse(rendersInline(""))
+    }
+
+    @Test
+    fun `a decode is scaled down but never below the size it is drawn at`() {
+        assertEquals(1, sampleSize(width = 600, height = 400, maxPx = 640))
+        assertEquals(1, sampleSize(width = 1279, height = 900, maxPx = 640))
+        assertEquals(2, sampleSize(width = 1280, height = 900, maxPx = 640))
+        // A 12-megapixel portrait photo for a card: the longer side decides.
+        assertEquals(4, sampleSize(width = 3024, height = 4032, maxPx = 640))
+        assertTrue(4032 / sampleSize(3024, 4032, 640) >= 640)
+    }
+
+    @Test
+    fun `a cache copy's name cannot leave its directory and is never empty`() {
+        assertEquals("receipt.pdf", safeName("receipt.pdf"))
+        assertEquals("passwd", safeName("../../etc/passwd"))
+        assertEquals("evil.txt", safeName("C:\\temp\\evil.txt"))
+        assertEquals("file", safeName(".."))
+        assertEquals("file", safeName("   "))
+        assertEquals("file", safeName(null))
+    }
+
+    @Test
+    fun `sizes print like the web prints them`() {
+        assertEquals("512 B", sizeLabel(512))
+        assertEquals("2 KB", sizeLabel(1536))
+        assertEquals("3.5 MB", sizeLabel(3_670_016))
+    }
+}
@@ -0,0 +1,62 @@
+package com.fabledsword.inkwell.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class BoardFiltersTest {
+    @Test
+    fun `no filters asks the core for no facets at all`() {
+        assertNull(BoardFilters().facets())
+        assertEquals(0, BoardFilters().count)
+    }
+
+    @Test
+    fun `each tag counts as one, as on the web's badge`() {
+        val filters = BoardFilters(labelIds = setOf("a", "b"), hasAttachment = true, sharedWithMe = true)
+        assertEquals(4, filters.count)
+
+        val facets = requireNotNull(filters.facets())
+        assertEquals(setOf("a", "b"), facets.label?.toSet())
+        assertEquals(true, facets.hasAttachment)
+        assertEquals("with_me", facets.shared)
+        // Dates are Timeline's, and with nothing typed there is no text to search.
+        assertNull(facets.q)
+        assertNull(facets.createdAfter)
+        assertNull(facets.createdBefore)
+    }
+
+    @Test
+    fun `the search text and the tags go to the core together, so it can AND them`() {
+        val facets = requireNotNull(BoardFilters(labelIds = setOf("grocery")).facets("milk"))
+        assertEquals("milk", facets.q)
+        assertEquals(listOf("grocery"), facets.label)
+    }
+
+    @Test
+    fun `search text alone is enough to narrow, with no filters on`() {
+        val facets = requireNotNull(BoardFilters().facets("  milk "))
+        // Trimmed, as the web trims the box before it writes ?q=.
+        assertEquals("milk", facets.q)
+        assertNull(facets.label)
+    }
+
+    @Test
+    fun `a box holding only spaces narrows nothing`() {
+        assertNull(BoardFilters().facets("   "))
+    }
+
+    @Test
+    fun `a switch that is off is left out rather than sent as false`() {
+        val facets = requireNotNull(BoardFilters(labelIds = setOf("a")).facets())
+        assertNull(facets.hasAttachment)
+        assertNull(facets.shared)
+    }
+
+    @Test
+    fun `tapping a tag twice takes it back off`() {
+        val once = BoardFilters().toggleLabel("a")
+        assertEquals(setOf("a"), once.labelIds)
+        assertEquals(BoardFilters(), once.toggleLabel("a"))
+    }
+}
@@ -0,0 +1,135 @@
+package com.fabledsword.inkwell.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Test
+
+/**
+ * Pins the derived-colour rule against `frontend/src/notes/colors.ts`.
+ *
+ * These are not tests of Kotlin — they pin the pair. The web runs the same values
+ * from `core/testdata/grammar.json` (`tint`) in `notes/grammar.test.ts`; this file
+ * writes them out by hand, so changing the hash or the key order means changing the
+ * fixture and this file together, or one of the two suites goes red.
+ *
+ * SMALLER SINCE M315. Half of what this file used to pin — the generated card fill, and
+ * the resolution order that chose between a picked colour, a tag's and a generated one
+ * — went with the code it guarded when the card became one neutral. The four UUID
+ * hashes stay because they are what the hash ITSELF is pinned by; nothing derives a
+ * colour from an id any more, only from a tag's name.
+ */
+class DerivedTintTest {
+    @Test
+    fun `hashes match the fixture shared with the web`() {
+        // Kotlin's Int is signed, so the two hashes above 0x7FFFFFFF are written as
+        // their negative literal. The unsigned value in the comment is what colors.ts
+        // records and what an implementation of FNV-1a will actually produce.
+        assertEquals(-0x41B8712F, tintHash("00000000-0000-0000-0000-000000000000")) // 0xbe478ed1
+        assertEquals(0x3D75CC01, tintHash("11111111-1111-1111-1111-111111111111"))
+        assertEquals(-0x0EF71AD0, tintHash("6ba7b810-9dad-11d1-80b4-00c04fd430c8")) // 0xf108e530
+        assertEquals(0x5B651540, tintHash("f47ac10b-58cc-4372-a567-0e02b2c3d479"))
+    }
+
+    @Test
+    fun `colours match the fixture shared with the web`() {
+        assertEquals("purple", derivedTint("00000000-0000-0000-0000-000000000000"))
+        assertEquals("blue", derivedTint("11111111-1111-1111-1111-111111111111"))
+        assertEquals("orange", derivedTint("6ba7b810-9dad-11d1-80b4-00c04fd430c8"))
+        assertEquals("orange", derivedTint("f47ac10b-58cc-4372-a567-0e02b2c3d479"))
+    }
+
+    /** Half of all 32-bit hashes are negative as Kotlin Ints; a signed remainder would
+     *  index out of the list for those. The bug this catches is a crash, not a wrong
+     *  colour, so it is worth more than one name's worth of coverage. */
+    @Test
+    fun `every derived colour is a real palette key, over many names`() {
+        for (n in 0 until 2000) {
+            assertEquals(true, derivedTint("tag-$n") in DERIVED_TINT_KEYS)
+        }
+    }
+
+    @Test
+    fun `the derived palette excludes default`() {
+        assertEquals(false, "default" in DERIVED_TINT_KEYS)
+        assertEquals(9, DERIVED_TINT_KEYS.size)
+    }
+
+    /** The order IS the mapping — reordering silently recolours every tag on one
+     *  surface only. Written out longhand so a reorder fails here loudly. */
+    @Test
+    fun `key order matches colors ts`() {
+        assertEquals(
+            listOf("red", "orange", "yellow", "green", "teal", "blue", "purple", "pink", "gray"),
+            DERIVED_TINT_KEYS,
+        )
+    }
+
+    /** A tag with no colour of its own derives one from its NAME, which is what makes
+     *  every `#todo` chip the same colour rather than nine different ones. */
+    @Test
+    fun `a label with no colour derives one from its name`() {
+        val known = DERIVED_TINT_KEYS.toSet() + "default"
+        val todo = resolvedLabelColor("todo", "default", known)
+        assertEquals(derivedTint("todo"), todo)
+        assertNotEquals("default", todo)
+    }
+
+    /** Tags dedupe case-insensitively, so `#Todo` and `#todo` are one tag and must not
+     *  be two colours. This is the whole reason the name is lowercased first. */
+    @Test
+    fun `label colour ignores case`() {
+        val known = DERIVED_TINT_KEYS.toSet() + "default"
+        assertEquals(
+            resolvedLabelColor("todo", "default", known),
+            resolvedLabelColor("ToDo", "default", known),
+        )
+    }
+
+    /** `teal` deliberately, NOT the colour "todo" derives to (pink) — asserting the
+     *  derived value here would pass even with the explicit branch deleted. */
+    @Test
+    fun `an explicitly picked label colour still wins`() {
+        val known = DERIVED_TINT_KEYS.toSet() + "default"
+        assertNotEquals("teal", derivedTint("todo"))
+        assertEquals("teal", resolvedLabelColor("todo", "teal", known))
+    }
+
+    /** An unreadable key is not a choice — it is data from a server newer than this
+     *  client, and the tag should still be drawn as something. */
+    @Test
+    fun `an unknown colour key falls back to the derived colour`() {
+        val known = DERIVED_TINT_KEYS.toSet() + "default"
+        assertEquals(derivedTint("todo"), resolvedLabelColor("todo", "chartreuse", known))
+    }
+
+    /** A label with no name at all has nothing to hash. Neutral, not a random hue. */
+    @Test
+    fun `a nameless label stays default`() {
+        val known = DERIVED_TINT_KEYS.toSet() + "default"
+        assertEquals("default", resolvedLabelColor("", "", known))
+        assertEquals("default", resolvedLabelColor("", "default", known))
+    }
+
+    /**
+     * The spread is real, and collisions are real too.
+     *
+     * Nine keys means two tags sharing a colour is not a bug and cannot be designed
+     * out — in this very sample `home`/`reading` are both gray and `work`/`ideas` are
+     * both green. Colour is a hint that two chips are distinct, never a claim that two
+     * of one colour are the same tag; the chip's TEXT is what says which tag it is.
+     */
+    @Test
+    fun `different tag names spread across the palette`() {
+        val known = DERIVED_TINT_KEYS.toSet() + "default"
+        val names = listOf("todo", "grocery", "work", "home", "ideas", "reading", "urgent")
+        val colours = names.map { resolvedLabelColor(it, "default", known) }
+        assertEquals(true, colours.toSet().size >= 5)
+    }
+
+    /** The reason the feature exists: two tags on one board should not look identical. */
+    @Test
+    fun `the derived colour spreads across the palette`() {
+        val seen = (0 until 500).map { derivedTint("spread-$it") }.toSet()
+        assertEquals(DERIVED_TINT_KEYS.size, seen.size)
+    }
+}
@@ -0,0 +1,33 @@
+package com.fabledsword.inkwell.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+/**
+ * Pins [loneUrl] against the `urls` cases in `core/testdata/grammar.json`, written out
+ * by hand as [DerivedTintTest] does the tint: these JVM tests do not read the fixture.
+ * The web runs the same cases in `notes/grammar.test.ts`, the server in
+ * `tests/test_grammar_fixture.py`, so a change to the rule changes the fixture and
+ * this file together, or a suite goes red.
+ */
+class LoneUrlTest {
+    @Test
+    fun `lone links match the fixture shared with the web and the server`() {
+        val cases =
+            listOf(
+                "https://example.com/a" to "https://example.com/a",
+                "  https://example.com/a \n" to "https://example.com/a",
+                "https://example.com/a." to "https://example.com/a",
+                "https://example.com/a?q=1!" to "https://example.com/a?q=1",
+                "see https://example.com/a, then https://example.com/b." to null,
+                "<https://example.com/a>" to null,
+                "https://example.com/a)" to null,
+                "https://example.com/a https://example.com/a" to null,
+                "ftp://example.com/a" to null,
+                "" to null,
+            )
+        for ((body, lone) in cases) {
+            assertEquals("body [$body]", lone, loneUrl(body))
+        }
+    }
+}
@@ -1,13 +1,13 @@
 [package]
-name = "thoughtsync-uniffi-bindgen"
+name = "inkwell-uniffi-bindgen"
 version = "0.1.0"
-description = "Generates the Kotlin bindings for thoughtsync-ffi"
+description = "Generates the Kotlin bindings for inkwell-ffi"
 authors = ["bvandeusen"]
 edition = "2021"

 # A crate whose ONLY dependency is uniffi itself.
 #
-# This started life as a `[[bin]]` inside thoughtsync-ffi, which failed: building
+# This started life as a `[[bin]]` inside inkwell-ffi, which failed: building
 # it compiled that crate and therefore the core, reqwest, native-tls and
 # openssl-sys — for the HOST. The vendored-OpenSSL block in core/Cargo.toml is
 # scoped to `cfg(target_os = "android")`, so a host build looks for a system
@@ -3,8 +3,8 @@
 //! Invoked by Gradle (see android/app/build.gradle.kts) as:
 //!
 //! ```text
-//! cargo run --locked -p thoughtsync-uniffi-bindgen -- \
-//!     generate --library <path/to/libthoughtsync_ffi.so> \
+//! cargo run --locked -p inkwell-uniffi-bindgen -- \
+//!     generate --library <path/to/libinkwell_ffi.so> \
 //!     --language kotlin --out-dir <build/generated/uniffi>
 //! ```
 //!
@@ -74,7 +74,7 @@ exceptions:
    # right and still applies.
    excludes:
      - "**/ui/**"
-      - "**/ThoughtSyncApplication.kt"
+      - "**/InkwellApplication.kt"
      - "**/SyncWorker.kt"
      - "**/ReminderReceiver.kt"
      - "**/AppUpdate.kt"
@@ -1,7 +1,7 @@
 [package]
-name = "thoughtsync-ffi"
+name = "inkwell-ffi"
 version = "0.1.0"
-description = "uniffi bindings exposing thoughtsync-core to the native Android client"
+description = "uniffi bindings exposing inkwell-core to the native Android client"
 authors = ["bvandeusen"]
 edition = "2021"

@@ -10,10 +10,10 @@ edition = "2021"
 # bindgen binary below — and this crate's own tests — can use the crate normally;
 # a cdylib-only crate is unusable from Rust.
 crate-type = ["cdylib", "lib"]
-name = "thoughtsync_ffi"
+name = "inkwell_ffi"

 [dependencies]
-thoughtsync-core = { path = "../../core" }
+inkwell-core = { path = "../../core" }
 serde_json = { workspace = true }
 log = { workspace = true }

--- a/Show More
+++ b/Show More