Record the refcount removal beside the sweep that raised it

The sweep is Iris `97fca76`. Its two largest findings are both costs per
thing rather than per frame: a container's draw searched a list once per
child and so cost the square of its children, and a mask's rectangle was
resolved once per fragment rather than once per instance. Both now have a
rig that can see them -- `children_cost.rs` is the only one here that varies
width, and `chain_cost.rs` has a masked fixture beside its two-pixel quads.

The sweep also settles the `Fixed::div`-versus-`ratio` item this file listed,
by deleting the operation nothing performed, and adds to the pre-gate
review's waiting list the `Arc<AtomicU32>` every `StrongWidget` allocates for
a count it can never raise.

.claude/skills/ai-app-rigs/SKILL.md

@@ -0,0 +1,244 @@
+---
+name: ai-app-rigs
+description: ai-app's test rigs, harness scripts and reference measurements - ui-sandbox.sh, debug-transcript.sh, transcript-bench.sh, stream-bench.sh, trace-draw.sh, the /usage fixture vocabulary, the fake CLI, the rule that no UI-driving script may tap a coordinate, how to test llama.cpp and ssh on this machine, how importing behaves, and the scroll/stream/explorer numbers not worth re-measuring. Read before running or writing a benchmark, driving the app's UI from a script, exercising the session lifecycle, testing a llama or remote session, or touching the import screen.
+---
+
+# ai-app: rigs, harnesses and measurements
+
+Moved out of `AGENTS.md` on 2026-09-04 so it is read when it is relevant
+rather than sent with every request in this repo -- it was 12 KB of the 35 KB
+that file cost on every one. Unchanged in the move, and still the only copy.
+
+## The rigs
+
+Each exists because something was invisible without it.
+
+- **`app/ui-sandbox.sh`** — a second `ai-server` with its own `$HOME`, config
+  and data directory, holding eight invented Claude Code transcripts and a
+  `claude` that is two lines of shell. **That isolation is the point**: the
+  import screen lists whatever is in `~/.claude/projects`, which in this VM is
+  real agent transcripts, so exercising *delete* against the ordinary server
+  deletes somebody's conversation and exercising *import* starts a real
+  `--resume` on the owner's account.
+  Its port and root derive from the checkout's name, so two checkouts'
+  sandboxes cannot reach each other, and its token is generated once into
+  `~/.config/ai-app/sandbox-token` and carried across restarts along with any
+  the enrolment flow appended — so the emulator app is enrolled **once** (the
+  start banner prints the command) and stays enrolled. It shares the real TLS
+  certificates, because the installed APK pins that CA.
+  Driving verbs, so none of this is re-derived per session:
+  `./ui-sandbox.sh spawn [title]` (an echo session, prints its id),
+  `./ui-sandbox.sh send SID text|@file`, and
+  `./ui-sandbox.sh api /path [curl args]`.
+  `./ui-sandbox.sh keep` restarts the server without wiping the sessions and
+  enrolment already there — for when the fixture under test was expensive to
+  build; plain `start` wipes them, which is right for the list-screen
+  fixtures and wrong for that.
+  It passes `--delay` by default, and `AI_SANDBOX_BIG_MB` puts one large
+  transcript among the small ones while `AI_SANDBOX_SPAWN_DELAY` makes the
+  fake CLI slow to start. Both exist because operations that finish in
+  milliseconds have states on the way that nothing can observe, and an
+  unobservable state is one where broken and working look identical.
+  It also builds a fixture tree at the sandbox home's `~/files` for the
+  explorer, holding the states otherwise only reachable by finding a real
+  machine in one: an empty directory, a name with a tab and one with an
+  apostrophe, a binary file, one over `FILE_LIMIT`, one `chmod 000`, a
+  symlink to a directory and a broken one, a source file per language, and
+  the three sizes the limits were measured against (`edit-32k.rs`,
+  `edit-128k.rs`, `big-source.rs`). Point a session at it with
+  `./ui-sandbox.sh api /sessions/<id>/cwd -X POST -H 'content-type: application/json' -d '{"cwd":"~/files"}'`.
+  The explorer's 409 is produced by editing the file on the machine
+  (`printf … > file`) between pressing the pencil and pressing save.
+- **`app/debug-transcript.sh`** — a real conversation on the emulator. The
+  echo driver is the right rig for most things and the wrong one for anything
+  whose cost scales with what was actually written: a real reply is longer,
+  is real markdown, and carries tool calls whose input and output are
+  kilobytes. Two faults were invisible until a real transcript was loaded — a
+  page of history landing mid-fling threw the reader back to the newest end,
+  and parsing one real reply took 51ms against 4.6ms for a synthetic one.
+  `-b` takes the biggest conversation on the machine rather than the newest,
+  which is what a scrolling test wants; `--stop` takes it down.
+  It copies the transcript into `/tmp` and gives the server a `HOME` of its
+  own, so the import can only see the copy — importing spawns `claude
+  --resume`, and against the real file that is a second CLI writing to a
+  conversation somebody may still be in. **A transcript never goes in this
+  repository**: they hold whatever was said, read and written in that
+  session, and `~/repos` is shared with the host besides.
+- **`/usage` in an echo session puts up an invented meter**, which is how the
+  rate-limit screens' states are reached without spending quota: `/usage 42`,
+  `/usage 95 20` (minutes left), `/usage 42 never` (the between-blocks window
+  with no reset time), `/usage 42 unreadable`, `/usage notloggedin`,
+  `/usage unreachable`, `/usage failed`, `/usage off`. The vocabulary is
+  `usage::Fixture`'s, since those are its states. With none set an echo
+  session meters nothing, which is the ordinary case and draws no bar.
+- **A fake CLI exercises the process lifecycle without a token.** Point a
+  `claude_cli` provider's `command` at a two-line script — `#!/bin/sh` and
+  `cat > /dev/null` — and it behaves the way the lifecycle code cares about:
+  it holds the fifo open, records a real pid, writes nothing, and dies on a
+  signal. So adopt, stop, restart and start are all drivable without a real
+  `--resume` and without spending a turn on somebody's account. Reach for
+  this when what is under test is *whether a process is running*, and for
+  `debug-transcript.sh` when it is *what the transcript draws*.
+- **`app/transcript-bench.sh`** is the standard scroll measurement: it opens
+  the first session (or `-k` keeps the current screen), scrolls a fixed
+  gesture loop, and prints the app's render report — the same one the in-app
+  copy button produces, whose `on screen:` line names what the viewport was
+  holding. Compare two runs with the same gestures; the emulator's absolute
+  frame times transfer nothing, the report's accounting does. Run it either
+  side of any change under `Markdown*.kt`, `Transcript*.kt` or
+  `SessionScreen.kt`'s list, and put the report in the commit. The numbers
+  that move first are the worst `record: one block`, the reparse mean while
+  streaming, and the draw phase's accounting line.
+- **`app/stream-bench.sh [-k] FILE`** is that measurement for a reply still
+  arriving. It taps "Jump to latest" so the list is pinned to the newest end,
+  resets the report, sends FILE, waits for the transcript to stop growing,
+  and prints. Both of those are corrections to a first version that measured
+  nothing: a transcript parked further back never redraws while a reply
+  streams into it, and a session is idle at *both* ends of a turn, so polling
+  for idle answers before the turn has started.
+- **`app/trace-draw.sh`** names what a scrolling frame spends inside the
+  framework, from `atrace` text output with no trace processor needed. It is
+  how the cost of a layout node per link was attributed to the framework
+  rather than guessed at.
+
+### Driving the UI
+
+**No script that drives this app's UI presses a coordinate.** Every control
+is found by the name it already carries for assistive technology —
+`ui-trace record --do "tap 'Session settings'"` — which resolves the label
+against the screen at the moment of the gesture and fails the whole run when
+it is not there. `app/bench-lib.sh` is what the bench scripts share for it. A
+coordinate is a position measured once by hand, and anything that moves the
+control makes the tap land on whatever now sits there — the bench then
+reports a number that was never measured, which reads exactly like a result.
+Both bench scripts pressed the render report at `tap 723 205` until that
+button moved into the session settings dialog on 2026-09-03. The check that
+none has crept back:
+
+    grep -n "tap [0-9]" app/*.sh
+
+Swipes are still coordinates, deliberately: a gesture across a scrolling area
+is a distance rather than a control.
+
+**Two traps in the emulator bench loop**, each of which cost a run.
+`adb shell pm clear` removes the enrolment and the notification permission
+along with the saved anchors, so the next run measures a permission dialog —
+re-enrol with the command `ui-sandbox.sh` prints, and
+`pm grant … POST_NOTIFICATIONS`. And a saved scroll anchor is per session id,
+so the only way two builds start a scroll from the same place is a *fresh
+session for each*.
+
+**The emulator is `~/repos/emulator-tools`' business, not this repo's.**
+`emu up` creates and boots the AVD named after this checkout — whatever `emu
+name` prints, never a name typed out here, since this file is the same in
+every clone. `run-android.sh` is that plus a build and an install. The `adb`
+on `PATH` after sourcing `android-env.sh` is that repo's wrapper, which fills
+in `-s` from the same rule. Gradle does not go through it, so a Gradle init
+script from `emulator-tools` runs `emu check` before `installDebug`,
+`uninstallDebug` and `connectedAndroidTest` and fails rather than fanning out
+to every attached device; when it refuses, say which device you mean at the
+moment you use it — `ANDROID_SERIAL=$(emu serial) ./gradlew …`.
+
+### Testing llama.cpp and ssh here
+
+**Both are set up here as of 2026-09-04** and need nothing typed. The
+prebuilt CPU llama.cpp lives outside the repo at `~/.local/opt/llama.cpp`
+(the 15 MB `ubuntu-x64` release asset) and is symlinked as
+`/usr/local/bin/llama-server`, which is what makes **discovery find it over
+ssh**: `~/.local/bin` is not on the PATH a non-interactive ssh session gets.
+It resolves its own libraries through `$ORIGIN`, so no `LD_LIBRARY_PATH` is
+needed. One model is downloaded — `unsloth/Qwen3-0.6B-GGUF/Qwen3-0.6B-Q8_0.gguf`,
+639 MB under `~/.local/share/ai-app/models` — and answers at usable speed on
+this VM's 8 cores. **Do not test with a 2-bit quant**: the
+IQ2_XXS of that model produces fluent nonsense, which reads exactly like a
+broken driver — `llama-cli` produces the same from the file directly, which
+is how to tell the two apart in a hurry.
+
+There is no second machine, so **ssh this VM to itself**. That is set up
+too: the key is `~/.config/ai-app/ssh-self` (its public half is in
+`~/.ssh/authorized_keys`, labelled removable), and the real config carries a
+setup called **"this vm over ssh"** — `bob@127.0.0.1` with that
+`identityFile` plus
+`options: ["StrictHostKeyChecking=no", "UserKnownHostsFile=/tmp/ai-app-known-hosts"]`
+so it touches nothing real — offering `claude-cli` and `llama-cpp`. It is the
+whole rig for "does a remote llama session work", since the far machine is
+this one and the model file is the same file. For a throwaway setup of your
+own, point a provider's `command` at something harmless like `/bin/echo`
+rather than at `claude`: the transport is what is under test, the process
+exiting immediately is the signal, and it costs no tokens. The remote login
+shell here is **fish**; the
+remote script and `ssh.rs`'s POSIX quoting happen to mean the same thing in
+both, but that is luck rather than design, and a shell that is neither is the
+thing to suspect first if a remote spawn ever mangles an argument.
+
+## Importing
+
+The import list reports each session's **size as well as its line count**,
+because the two disagree in the way that matters: these transcripts embed
+screenshots as base64, so one line can be a megabyte. On this machine a 69 MB
+session has 3,427 lines and a 44 MB one has 6,792 — nothing about a line
+count tells you what continuing a session will cost. Shown, not warned about;
+importing a large session is a choice somebody is entitled to make.
+
+**Never import a Claude Code session that is open in a terminal.** The app
+refuses it — see PLAN.md for the incident that made that a refusal rather
+than a warning.
+
+**One Claude Code session id can name two files, and the listing offers it
+once.** Resuming from a different working directory makes the CLI write a
+second transcript with the same id under that directory's project folder — an
+ordinary state of a machine, not corruption. Everything downstream addresses
+a session by id, and the phone keyed its list on it, so two rows sharing one
+**closed the app** on a Compose duplicate-key throw. `parse_listing` keeps
+the copy with the most lines, because the other is usually a few-hundred-byte
+stub and is often the *newer* of the two, so recency is the wrong key.
+Deleting removes every copy rather than the first, or the row came back after
+a delete that reported success. The phone's half is `uniqueItems`, which
+every list keyed on a server-chosen id goes through: a repeat there must
+never be able to close the app, whatever produced it.
+
+**Deleting a session offers to take the machine's own transcript with it** —
+`DELETE /sessions/{id}?deleteForeign=true`, behind a switch in the
+confirmation, and only where the driver keeps a record of its own
+(`keepsOwnTranscript`, which today means Claude Code). Off by default,
+because leaving that copy is what makes an ordinary delete recoverable — and
+the dialog's paragraph is rewritten when it is on rather than appended to,
+since the sentence promising the conversation "should still be there to
+import again" is exactly the one the switch makes false. The server deletes
+the machine's copy *first*, so a machine it cannot reach leaves the session
+where it was instead of half-deleted.
+
+## Measurements worth not re-taking
+
+- **What the transcript screen costs to scroll.** Taken 2026-08-30 on the GPU
+  emulator against a real imported transcript with the server at
+  `--delay 120`. Settled and flinging fast, both into fresh history and back
+  through rows already drawn: **5.2–5.9% janky frames, 99th percentile
+  29–32ms, 0–2 slow UI-thread frames.** The stock Settings app on the same
+  device is 3.3% and 38ms, so this is at the platform floor. The number that
+  is *not* at the floor is the first few seconds after opening a session,
+  where every row on the way is being composed for the first time; that is
+  inherent to a lazy list and it is why a measurement taken before the screen
+  settles reads three times worse. **Settle first, then reset `gfxinfo`.**
+- **The reset path is not reachable by reopening a session.** Measured
+  2026-09-04 against a session streaming at 20 events a second: reopening one
+  with an anchor 1,800 events back connects **87–119 events behind**, well
+  under `CATCH_UP_LIMIT`'s 200, because the restore is two requests — the
+  opening page, then one span covering the whole distance. To exercise the
+  reset at all you have to lower `CATCH_UP_LIMIT` in a throwaway build; at 5
+  the app takes the reset on a live connection, clears, refills and carries
+  on without reconnecting.
+- **The session screen's stream survives backgrounding here** — 20 seconds at
+  the launcher while 415 events were produced brought no reconnect at all,
+  which is not what the comment above that loop expects, and is most likely
+  this emulator being headless rather than the phone's behaviour.
+- **Reopening a cached session costs one request for one event** (the probe),
+  and scrolling the whole conversation back costs nothing more; a cold open
+  of the same 500-event session is two pages, 100 events. Measured
+  2026-09-04 on the emulator against the sandbox.
+- **Reading is cheap and editing is not.** The viewer handles a 1 MiB,
+  28,000-line file because it draws one row per line; the editor is one
+  `BasicTextField`, which costs two seconds a frame at 128 kB and stops the
+  app at 1 MiB, so `EDIT_LIMIT` caps it at 32 kB with the reason said on
+  screen. If you make the editor faster, that number is what to move.
+  EXPLORER.md's "What the measurements said" has the rest.

.dev-updater.ron

@@ -17,9 +17,7 @@ label: "AI Sessions",
 // three constants -- there is nothing here worth spawning a process for.
 resources: Ron("resources.ron"),
 
-// The two halves this checkout produces: the server a phone talks to, and
-// the app that talks to it. They are built in parallel -- this list is the
-// set, not a sequence, so nothing here should be read as an order.
+// The server and Rust app build in parallel.
 components: [
     Server(
         name: "server",
@@ -39,15 +37,8 @@ components: [
     ),
     Apk(
         name: "app",
-        // Release first: the first mode is the default, and the phone runs
-        // the release build -- a debuggable one runs Compose at a fraction
-        // of the speed. Each command below is run with the chosen mode as
-        // its last argument, which is exactly build-apk.sh's interface.
         modes: ["release", "debug"],
-        // Resolved against this directory, and run in `app/` -- the script
-        // cds to its own directory anyway, so the cwd is here to say where
-        // the app is rather than because the build needs it.
-        build: "app/build-apk.sh",
+        build: "./build-apk.sh",
         cwd: "app",
         // The Enroll button in this component's settings: prints the link
         // that enrols the phone against the server built here, for the

.gitignore

@@ -1,12 +1,6 @@
-.gradle/
-build/
-app/androidApp/build/
-local.properties
-.kotlin/
-*.iml
-.idea/
-.DS_Store
 server/target/
+event-model/target/
+app/target/
 
 # Server logs from a development run (ai-server.log by convention,
 # wg-test.log from ./test-wg-tunnel.sh).
@@ -21,3 +15,8 @@ certs/
 config.ron
 config.json
 sessions/
+
+# iris, the in-house UI library, is vendored at iris/ and built by cargo.
+iris/target/
+
+scripts/rigs/gpu-probe/target/

.gitmodules

@@ -1,3 +1,7 @@
 [submodule "wg-app-link"]
 	path = wg-app-link
 	url = git@git.arirex.me:iris/wg-app-link.git
+[submodule "iris"]
+	path = iris
+	url = git@git.arirex.me:iris-ai/iris.git
+	branch = app-pin

AGENTS.md

@@ -1,783 +1,183 @@
 # ai-app
 
-A phone interface to AI coding sessions (Claude Code and llama.cpp via pi),
-replacing the Claude app for daily use. Rust/Axum backend on the desktop,
-Kotlin/Compose Android app, WireGuard + pinned self-signed TLS + bearer token
-between them.
+A phone and desktop interface to AI coding sessions. The backend is Rust/Axum;
+the shared client and UI are Rust, drawn by the `iris` framework pinned as a
+submodule. The
+Android app uses a thin Java activity and `android-view`; desktop uses winit.
 
-**`PLAN.md` is the design source of truth.** Read it before building or
-changing anything structural. It records every decision with its date, its
-rationale, and the alternatives that were rejected and why — keep that habit
-when a decision changes: update the plan in place, don't let this file and
-the plan drift into two versions of the truth. This file is the working notes
-layer: conventions, commands, and things that have bitten.
+`docs/PLAN.md` is the design source of truth. Read it before structural work
+and update it when a decision changes. `docs/HANDOFF.md` is where the work in
+flight stands; read it first in a fresh session and keep it current. Working
+documents are pruned as work lands: preserve current invariants, measurements,
+and failed hypotheses, not a chronicle of completed tasks. Do not create a
+decisions log.
 
-The central design point, worth not undoing by accident: **a session is a
-child process speaking JSONL over stdio, translated into one common event
-model.** Claude Code (stream-json) and pi (RPC mode) are two translators
-behind one `Driver` trait; the transcript, the SSE stream, the phone UI, and
-SSH spawning (the same command wrapped in `ssh host …`) all work purely in
-the common model. A new session type is a new driver — never a
-session-type branch in shared code (routes, transcript, app screens).
+## Architecture
+
+A session is a child process translated by a driver into one common event
+model. A new session type is a new driver, never a session-type branch in
+shared routes, transcripts, or screens.
+
+Android and desktop share `app/src/client` and `app/src/ui`. Platform modules
+own only what the platform forces: JNI, lifecycle, insets and IME on one side;
+winit and argv on the other. Layouts may differ, but widgets, styling, folding,
+paging, config, and network logic are shared.
+
+`iris/` is a UI framework and nothing else. It must not know about sessions,
+transcripts, setups, or servers. Product code belongs in `app/`, and the
+dependency runs one way.
 
 ## Layout
 
-Mirrors `../dev-updater` deliberately — same stack (axum 0.8 +
-axum-server/rustls, tokio, clap; Kotlin 2.4.x + Compose Multiplatform,
-single `:androidApp` module), same cert scheme, same registry pattern (every
-session mutation funnels through the manager so in-memory and on-disk state
-can't come apart). Read dev-updater's `README.md` and `AGENTS.md` for the
-conventions before diverging from them; module-by-module intent for this
-repo is in PLAN.md's "Backend layout" section.
+- `server/` — `ai-server`. `routes.rs`'s module comment is the HTTP table.
+- `event-model/` — the wire contract shared by server and app.
+- `app/` — the `ai-app` crate. `client` is platform/UI independent; `ui`
+  contains Iris widget trees; `android` and `desktop` are thin hosts.
+  `android-project/` packages the Rust cdylib. The `bench` feature and
+  `bench-fixture/` are retained performance rigs, not a second app.
+- `iris/` — the pinned framework submodule: proc macro, demos, and input rig.
+- `scripts/` — repository-wide scripts and independent profiling rigs.
+- `wg-app-link/` — a git submodule shared with dev-updater.
+- `docs/` — design and working documents.
 
-- `server/src/session/import.rs` — continuing a Claude Code session the
-  machine already has. Claude Code keeps each one as JSONL under
-  `~/.claude/projects/`, and the CLI resumes one with `--resume <id>` —
-  which `claude.rs` already does for crash recovery, so an import is that
-  same path with the token written up front rather than a second way to
-  start a session. The phone picks an **id**, never a path: the server
-  resolves which file that is, so an enrolled token cannot become "read me
-  an arbitrary file" — the same rule that keeps a command out of
-  `POST /setups`. Only the tail is replayed (`REPLAY_LINES`) because these
-  files reach tens of megabytes and the CLI reads the real one itself; what
-  crosses the tunnel is what a person reads, not what the model is given.
-  Images in the replayed tail are written into the session's `files/` by
-  the same function the live translator uses, so a screenshot looks the
-  same whether it was watched happening or replayed afterwards, and the
-  phone fetches the bytes only when it draws one.
-  An imported session then **keeps itself level with that file**, so work
-  done at a terminal appears without anyone pressing anything. Which new
-  lines came from *here* is answered by counting the events this session
-  has recorded, **not** by looking at its status — a turn that starts and
-  finishes between two polls reads as idle at both, and its own output
-  gets replayed on top of itself. That bug was visible on screen as
-  `donedone`.
-- `server/src/usage.rs` — rate-limit windows, asked **of each machine that
-  can run Claude**, not of the backend. Credentials are read through the
-  session `Transport`, so a remote setup is an ssh round trip and the local
-  one is unchanged; the HTTP call stays here. A machine with no Claude
-  provider is never asked. The four states (`ok`, `notLoggedIn`,
-  `unreachable`, `failed`) exist because a machine nobody logged in on is a
-  choice rather than a fault, and one `error` string made it look like one.
-- `server/src/models.rs` — downloaded GGUF models and the HuggingFace
-  browsing behind them. Downloads are keyed by the model rather than by
-  who asked, so any device can watch one; they resume through HTTP Range,
-  refuse to resume onto a partial from a different revision, and are
-  checked against HuggingFace's published sha256 before the file gets its
-  real name.
-- `server/` — Rust backend (`ai-server`). `main.rs` bootstraps (TLS, the
-  auth layer, token/QR enrollment, wg0 binding), `routes.rs` has the HTTP
-  table in its module doc comment, `auth.rs` the bearer-token middleware,
-  `config.rs` the persisted schema (written in the shared RON house rules),
-  `session/` the manager (registry pattern), `Driver` trait + event model,
-  `EchoDriver`, and transcripts.
-- `app/` — Compose Android app, single `:androidApp` module, package
-  `com.example.aiapp`, label "AI Sessions". `AppRoot.kt` is the navigation
-  `when`; `MainScreen.kt` the root's four tabs (sessions, import, models,
-  setups) with settings and refresh on the title row; `Api.kt`/`EventStream.kt`
-  the REST + SSE clients; `Events.kt` the event model mirror;
-  `ServerConfig.kt` settings + Keystore-sealed token; screens in
-  `SessionListScreen/SessionScreen/SpawnScreen/SettingsScreen`.
-  `Notifications.kt` is the foreground service holding the notification
-  stream and the one place that decides where a notification is said --
-  nothing for the session on screen, a `SessionAlerts` banner while the app
-  is up, Android's drawer otherwise, never two of them. See PLAN.md's
-  "Notifications: two places, never both".
-  **Icons are Nerd Fonts glyphs from a committed subset**, not vector assets
-  and not ordinary Unicode — `NerdIcons.kt` declares each codepoint and
-  `app/build-icon-font.sh` subsets the font. The two lists have to agree: a
-  codepoint in the Kotlin that the script did not subset is a glyph that
-  silently isn't there. Rerun the script and commit its output when adding
-  one; it needs network access. `md-cog` and `md-refresh` are deliberately
-  the same codepoints dev-updater uses and must not drift from it. The
-  subset is the **Mono** face, where every glyph is one em square — that is
-  what makes two icon buttons the same width without either being given
-  one, and it is why `GLYPH_SIZE` is smaller than it looks like it should
-  be.
-- `.dev-updater.ron` — what Dev Updater is asked to do with this checkout:
-  the server (built in `server/`, run as `service: Managed(...)`) and the
-  APK (built in `app/`), built in parallel. The project it serves is the
-  repository, not either half of it, which is why this sits at the root
-  rather than in `app/`.
-  It points at `resources.ron` beside it, which says this project keeps its
-  state as `ai-app` — so the Uninstall dialog offers `~/.local/share/ai-app`
-  and `~/.config/ai-app` instead of saying it cannot tell. That file is
-  *ours*, not Dev Updater's: it ignores keys it doesn't know, so anything
-  else worth keeping in one place belongs there too. Note what deleting the
-  config directory takes with it — the CA under `certs`, which is the
-  one-way door described below.
-  `Managed` means Dev Updater supervises `ai-server` with its own built-in
-  service implementation rather than a script kept here. ai-app had such a
-  script until 2026-08-28 and it was the generic case exactly — no
-  arguments, no environment — so the two projects were maintaining one
-  behaviour twice, including the OpenRC branch neither can test from a
-  systemd machine.
-  Worth knowing before pressing it: **Stop** on the server card stops the
-  server that a phone reaches through the tunnel, so on that phone it stays
-  down until someone starts it again from Dev Updater. Dev Updater reaches
-  it over its own port and is unaffected, which is what makes the button
-  safe to press and easy to regret.
-- `wg-app-link/` — a **git submodule**, and the half of this backend that
-  dev-updater also needed: the pinned CA and leaf (`certs`), QR enrollment
-  and the bearer token (`enroll`), wg0 binding and the certificate's SANs
-  (`netif`), owner-only files (`private`), and the RON house rules
-  (`format`). Both projects had written all five and they had drifted; see
-  that repo's `README.md` for the diff that decided each one. Clone with
-  `git clone --recurse-submodules`, or `git submodule update --init` in an
-  existing checkout — `server/` will not build without it, since it is a
-  path dependency rather than a registry one, which is what keeps the two
-  projects version-locked to the commit this repo pins.
-  The certificates are the one-way door: the CA is generated once on first
-  start into `$XDG_CONFIG_HOME/ai-app/certs` and regenerating it strands
-  the installed app.
-  What deliberately did **not** move is the API surface and the config
-  *schema* — routes, drivers, sessions and setups are what makes this
-  project itself.
-## Status
+Clone with `--recurse-submodules` or run `git submodule update --init` to
+populate both `iris/` and `wg-app-link/`.
 
-Phases 1–3 done 2026-08-24 (PLAN.md's phase list says what each verified):
-the skeleton pipe, the full Claude driver (streaming, tools, permission +
-AskUserQuestion cards, steering, interrupt, `--resume` crash recovery,
-images both ways), and the usage screen.
+Nerd Font icons are an app-owned committed subset. `app/build-icon-font.sh`
+produces `app/assets/fonts/nerd_icons.ttf`; its codepoints must match
+`app/src/ui/icon.rs`. The app registers it with Iris at startup. Body and
+monospace fonts come from the platform; Iris ships no font assets.
 
-**Phase 5 (SSH)** is written and exercised (2026-08-28): a session names a
-host, `session::transport` turns that into an `ssh host …` invocation, and
-the driver never learns which it got.
+## Checking work
 
-**Phase 4 (llama.cpp)** works end to end, phone included (2026-08-28).
-Models are browsed and downloaded from HuggingFace (`models.rs`, resumable
-and verified), and `session::llama` runs one through `llama-server` over
-its OpenAI-compatible streaming endpoint. Two things are deliberate and
-easy to undo by accident: the conversation is rebuilt from the
-**transcript** rather than kept in the driver, because driver memory is
-invisible to a second device; and a llama session is refused on an ssh
-host, because the model is reached over HTTP and forwarding that port is
-not built.
+Commit each coherent, warning-clean slice and push it.
 
-Setups — machines, each carrying what it can run — are added, renamed,
-re-probed and removed from the app; providers are **discovered by asking
-the machine**, never typed, so the enrolled token cannot introduce a
-command. What is left is real-phone/WireGuard bring-up, which is
-operational rather than code.
+- Whole product: `./scripts/run-tests.sh`.
+- Framework: `cd iris && cargo fmt --all --check && cargo clippy --all-targets
+  -- -D warnings && cargo test`.
+- App: `cd app && cargo fmt --all --check && cargo clippy --all-targets --
+  -D warnings && cargo test`.
+- Android: `cd app && ./build-apk.sh debug --abi x86_64` for this machine's
+  emulator, or `./build-apk.sh release` for a phone. The script builds with
+  cargo-ndk, packages with Gradle, and verifies the APK. Never infer phone
+  frame times from a debug emulator build.
 
-**`command -v` follows PATH under a non-interactive ssh session**, which is
-not the PATH a login shell shows, so a binary somewhere unusual is
-invisible to discovery — llama.cpp unpacked into `~/.local/opt` needs a
-symlink into `~/.local/bin` before a setup finds it. The escape hatch for
-anything odder is editing `config.ron` on the backend, deliberately the one
-authority the phone does not have.
+`app/`, `iris/`, and `scripts/rigs/ui-profile/` use rolling nightly through
+per-directory toolchain files. `server/` and `event-model/` use stable.
 
-**Testing llama.cpp here:** the prebuilt CPU build lives outside the repo
-at `~/.local/opt/llama.cpp` (the 15 MB `ubuntu-x64` release asset). It
-needs its own directory on `LD_LIBRARY_PATH`, so start the server as
-`LD_LIBRARY_PATH=~/.local/opt/llama.cpp ai-server …` and point a provider's
-`command` at `~/.local/opt/llama.cpp/llama-server`. A 0.6B Q8_0 answers at
-usable speed on this VM's 8 cores. **Do not test with a 2-bit quant**: the
-IQ2_XXS of that model produces fluent nonsense, which reads exactly like a
-broken driver — `llama-cli` produces the same from the file directly, which
-is how to tell the two apart in a hurry.
+The release signing key lives at `~/.config/ai-app/release.jks`, never in the
+checkout. `build-apk.sh` creates it once. Normal builds use application id
+`com.example.aiapp`; benchmark builds add `.bench` and are built explicitly:
 
-**How to test SSH here, since there is no second machine:** ssh this VM to
-itself. Generate a throwaway key, append the public half to
-`~/.ssh/authorized_keys`, and configure a host of `bob@127.0.0.1` with
-`identityFile` pointing at it plus
-`options: ["StrictHostKeyChecking=no", "UserKnownHostsFile=…"]` so it
-touches nothing real. Point a provider's `command` at something harmless
-like `/bin/echo` rather than at `claude`: the transport is what is under
-test, the process exiting immediately is the signal, and it costs no
-tokens. **Take the key back out afterwards.** Note the remote login shell
-here is **fish**; the remote script (`cd '…' && exec '…'`) and `ssh.rs`'s
-POSIX quoting happen to mean the same thing in both, but that is luck
-rather than design, and a shell that isn't either is the thing to suspect
-first if a remote spawn ever mangles an argument.
+    ./build-apk.sh release --features "screens bench"
 
-## Checking your work
+## Running the server
 
-- Server: `./run-tests.sh` from the repo root (or `cargo test` from
-  `server/`) +
-  `cargo clippy --all-targets` + `cargo fmt`. The build stays
-  warning-clean and rustfmt-clean at the defaults — there is no
-  `rustfmt.toml` and there should not be one.
-- App: from `app/`, `. ./android-env.sh && ./gradlew :androidApp:ktfmtFormat
-  :androidApp:compileDebugKotlin :androidApp:lintDebug` — format, typecheck
-  and lint, the app-side equivalent of the line above. Then `./build-apk.sh`
-  to produce the APK to install on a phone (through Dev Updater), or
-  `./run-android.sh` to build, install, and launch on the emulator.
-  **The phone gets the release build**, signed with a key the script
-  generates once under `~/.config/ai-app/release.jks` (never in the repo);
-  `./build-apk.sh debug` builds the other variant, and Dev Updater's build
-  modes call the script with exactly that word.
-  The emulator scripts stay on the debug build; a debuggable build runs
-  Compose at a fraction of release speed, so never read a frame time from
-  one as the app's -- the render report now says which build it came from.
-  Dev Updater lists every variant under `build/outputs/apk`, so pick
-  `release` there; a phone still holding the debug build has to uninstall
-  it first, since the two are signed differently.
-- **A row something is happening to is dimmed, drained of colour, inert,
-  and says which operation in a word** -- `BusyItem`, used by both the
-  session list and the import list so the appearance is learned once. The
-  word rather than a bare spinner because "deleting" and "importing" differ
-  in kind. It dims and desaturates but does **not** make the row inert: the
-  caller disables its own click handler while it passes a label. An overlay
-  consuming pointer events was tried and swallowed the drag along with the
-  tap, so a list could not be scrolled while anything in it was busy.
-- **Importing and deleting run on the server, not in the request, and a
-  batch is handed over in one call.** `POST
-  /setups/{id}/importable/delete` and `POST /setups/{id}/importable/import`
-  each take a list of session ids, answer 202, and do the work in spawned
-  tasks -- because the phone that asked is free to leave and used to cancel
-  its own batch by doing so. A list rather than a route per session because
-  one request per row made a handover only as atomic as the network: some
-  rows started and the rest were never asked for, and a row nobody asked
-  for looks exactly like a row nobody picked. Every id is registered as in
-  flight before the 202 goes back. Only the *registering* is atomic; the
-  work itself settles per row, since six deletes that all roll back
-  together is not something a filesystem offers. What replaces the reply is
-  `session::pending`: every row of the listing carries `pending` and
-  `error`, and `GET /setups/{id}/importable/events` streams the changes.
-  **Both, not either.** The stream is a broadcast with no memory, so an
-  operation that starts and finishes while it is still connecting is one
-  nothing will ever be said about -- that left a row marked "waiting" for
-  ever, and the listing is what repairs it. So the screen fetches again
-  after a handover when anything still looks outstanding, and takes the row
-  states from the answer rather than from what it remembers.
-- **A single tap still waits.** "Continue this and take me to it" needs the
-  session it made, and 202 does not carry one. The batch and the tap share
-  `spawn` on the server so the two cannot drift about what importing means.
-- **The import screen selects in batches: hold to enter, tap to add.** The
-  options that act on a selection appear along the bottom, and are Delete
-  and Import only. Submitting clears the selection immediately and marks
-  every chosen row -- the one in flight as "importing" or "deleting", the
-  rest as "waiting" -- so the bar goes away and the affected set is what
-  says the work is happening. Rows are taken out as each one lands rather
-  than all at the end: a finished row still sitting there looks exactly
-  like one that has not been imported, and tapping it starts a second CLI
-  on the same transcript. What that costs is that the rows below slide up
-  under the reader's finger, so a row that has just moved ignores taps for
-  half a second (`SETTLE_MS`).
-- **An answered question keeps its options and marks the one that was
-  taken**, in the same purple that says "picked" while it is still open --
-  it does not collapse into a line repeating the answer. The options are
-  what the question *was*, and "Deny" alone does not say that Allow was the
-  alternative. One rule in two places (`AskedQuestion` and `PermissionAsk`),
-  since a permission is a question with two bare options rather than a
-  different kind of thing. An answer typed into **Other** matches no option,
-  so that one is still written out -- the state the marking cannot say.
-- **Anything that is a note *about* the conversation rather than a turn in
-  it is closed by default**: a tool call, a peer message, and now a memory
-  note (`<cc-memory>`). Open-ness is the screen's, never the card's -- a
-  card that remembered for itself forgets the moment the lazy list stops
-  composing it, so a note opened and scrolled past would shut behind the
-  reader.
-- **The full-screen image lives on the screen, not in the row that drew the
-  thumbnail** (`SessionImageViewer`). A `Read` whose result is an image is a
-  row of one call until the next call arrives and makes it a group -- a
-  different composable in a different part of the tree, so the old subtree
-  and everything it remembered goes, the open dialog included. Somebody
-  looking at a screenshot was thrown back to the transcript because the
-  session made another tool call. `/tools n gap` puts an image on its first
-  call so this is reproducible: open it, wait a gap, watch the row regroup.
-- **All transcript text is selectable, from one `SelectionContainer` around
-  the whole list** (`TranscriptList.kt`). Not per row: a transcript is one
-  body of text to a reader, so a selection has to be able to run from a
-  reply into the tool output under it -- and a container per row leaves
-  whatever was drawn without one silently unselectable, which nothing on
-  screen reports. Rows keep their tap handlers; selection is a long press.
-- **A session can be moved to another directory** from the settings dialog
-  (`POST /sessions/{id}/cwd`). It stops the process, because a working
-  directory is settled at spawn; the next message starts it in the new one.
-  **`claude --resume <id>` finds a session from any directory** -- measured
-  on 2.1.237 -- so nothing of Claude Code's is relocated, and should you ever
-  be tempted, its project directory is the path with every non-alphanumeric
-  character replaced by `-`, cut at 200 characters with a hash appended, and
-  overridable besides.
-- **A message from another agent reaches a live session on the turn's
-  `result`, not before.** Measured on CLI 2.1.237 by sending a real
-  cross-session message to a real stream-json session: no `user` record, and
-  nothing in the partial-message stream -- the whole of it is an `origin`
-  object on the `result`, the same shape the session file records, which is
-  why `import::peer_message` reads both. So it is *recorded* after the reply
-  it caused, and cannot be recorded anywhere else in an append-only log --
-  which is why the event carries `turnStart`, the seq of the status that
-  opened its turn, and the phone draws the note at that seq instead of where
-  it arrived. Exercise it with the echo driver's `/peer-turn`; plain `/peer`
-  is the in-place shape an import replays. See PLAN.md.
-- **A queued message can be tapped to take it back**, which is
-  `POST /sessions/{id}/unqueue` and a `messageDropped` event -- see PLAN.md's
-  "Taking a queued message back". On a **Claude** session it always refuses,
-  and that is correct rather than broken: the driver writes a steer into the
-  CLI the moment it arrives, so what the bubble is waiting for is the CLI
-  *reading* it, not this server sending it. The refusal is drawn on the
-  bubble. The echo driver really does hold its queue, so that is the rig for
-  the case where the drop succeeds.
-- **Deleting a session offers to take the machine's own transcript with
-  it.** `DELETE /sessions/{id}?deleteForeign=true`, behind a switch in the
-  confirmation, and only where the driver keeps a record of its own
-  (`keepsOwnTranscript`, which today means Claude Code). Off by default,
-  because leaving that copy is what makes an ordinary delete recoverable --
-  and the dialog's paragraph is rewritten when it is on rather than
-  appended to, since the sentence promising the conversation "should still
-  be there to import again" is exactly the one the switch makes false. The
-  server deletes the machine's copy *first*, so a machine it cannot reach
-  leaves the session where it was instead of half-deleted.
-- **One Claude Code session id can name two files, and the listing offers
-  it once.** Resuming a session from a different working directory makes
-  the CLI write a second transcript with the same id under that
-  directory's project folder -- an ordinary state of a machine, not
-  corruption. Everything downstream addresses a session by id (`--resume`,
-  the delete glob, the in-flight registry) and the phone keyed its list on
-  it, so two rows sharing one *closed the app* on a Compose duplicate-key
-  throw. `parse_listing` keeps the copy with the most lines, because the
-  other is usually a few-hundred-byte stub and is often the *newer* of the
-  two -- so recency is the wrong key. Deleting removes every copy rather
-  than the first, or the row came back after a delete that reported
-  success. The phone's half is `uniqueItems`, which every list keyed on a
-  server-chosen id goes through: a repeat there must never be able to
-  close the app, whatever produced it.
-- **A markdown table wraps its cells and never cuts one off.** The
-  renderer's own defaults draw every cell at one line with an ellipsis,
-  which on a phone loses most of a table -- and an elided cell looks
-  exactly like a short one, so nothing on screen says anything was cut.
-  `Markdown.kt` supplies its own header and row blocks with `maxLines =
-  Int.MAX_VALUE` and `TextOverflow.Clip`, cells aligned to the top of the
-  row so a two-line cell does not re-centre its neighbours. Width is the
-  other half: a column narrows to 136dp and no further, and past that the
-  whole table scrolls sideways rather than squeezing -- 136 because it is
-  the widest floor that still fits three columns across a phone, which is
-  the commonest table there is. Exercise it with the echo driver's
-  `/table N` (default six columns), which writes long cells on purpose:
-  a fixture of tidy one-word values renders fine whether or not the
-  truncation is fixed.
-- **Android Lint is not optional and is not run by a build.** It found a
-  crash that had been shipping: `java.time` on a minSdk-24 app with
-  desugaring off — and later a permission check that silently dropped every
-  notification on Android 12 and below. It is fully clean as of 2026-08-31;
-  keep it that way, and suppress with `tools:ignore` plus a written reason
-  rather than by lowering the bar.
-- **The APK pins the CA of the machine that builds it**, read at build time
-  from `$XDG_CONFIG_HOME/ai-app/certs/ca.pem` (`AI_APP_CA` overrides) and
-  generated into a constant. So the server must have started once on that
-  machine first — the build stops with that instruction otherwise — and an
-  APK built in this VM only works against a server in this VM.
-- Run the server for development with `--bind 127.0.0.1`. Without it the
-  server binds wg0, which exists here but is unreachable from the emulator
-  (it dials 10.0.2.2). First run prints the enrollment QR/URI with the
-  token — capture it from the log. `ai-server --enroll-link` (same
-  `--config`/`--bind`/`--port`) mints one more device's link while the
-  server keeps running and prints only the URI; the server adopts that
-  token on its first use. It is what Dev Updater's Enroll button runs.
-- **`app/debug-transcript.sh` puts a real conversation on the emulator.**
-  The echo driver stays the right rig for most things and is the wrong one
-  for anything whose cost scales with what was actually written: a real
-  reply is longer, is real markdown, and carries tool calls whose input and
-  output are kilobytes rather than a word. Two faults were invisible until
-  a real transcript was loaded — a page of history landing mid-fling threw
-  the reader back to the newest end, and parsing one real reply took 51ms
-  against 4.6ms for a synthetic one. `-b` takes the biggest conversation on
-  the machine rather than the newest, which is what a scrolling test wants;
-  `--stop` takes it all down again.
-  It copies the transcript into `/tmp` and gives the server a `HOME` of its
-  own, so the import can only see the copy — importing spawns `claude
-  --resume`, and against the real file that is a second CLI writing to a
-  conversation somebody may still be in. **A transcript never goes in this
-  repository**: they hold whatever was said, read and written in that
-  session, and `~/repos` is shared with the host besides.
-- **`app/ui-sandbox.sh` is the rig for driving the UI against invented
-  sessions.** It starts a second `ai-server` with its own `$HOME`, config
-  and data directory, holding eight invented Claude Code transcripts and a
-  `claude` that is two lines of shell. That isolation is the point: the
-  import screen lists whatever is in `~/.claude/projects`, which in this VM
-  is real agent transcripts, so exercising *delete* against the ordinary
-  server deletes somebody's conversation and exercising *import* starts a
-  real `--resume` on the owner's account. Neither is a price worth paying to
-  look at a list. It shares the real TLS certificates, because the
-  installed APK pins that CA.
-  Its port and root are derived from the checkout's name, so two checkouts'
-  sandboxes (and the emulators enrolled against them) cannot reach each
-  other, and its token is generated once into
-  `~/.config/ai-app/sandbox-token` and carried across restarts along with
-  any tokens the server's own enrolment flow appended -- so the emulator app
-  is enrolled **once** (the start banner prints the command) and stays
-  enrolled. It also carries the driving verbs every UI investigation needs,
-  so none of this is re-derived per session:
-  `./ui-sandbox.sh spawn [title]` (an echo session, prints its id),
-  `./ui-sandbox.sh send SID text|@file`, and
-  `./ui-sandbox.sh api /path [curl args]` for everything else.
-  `./ui-sandbox.sh keep` restarts the server without wiping the sessions and
-  enrolment already there -- for when the fixture under test was expensive to
-  build (a long delta-heavy transcript, say) and should survive a rebuild of
-  the server binary; plain `start` wipes them, which is right for the
-  list-screen fixtures and wrong for that.
-  It passes `--delay` by default for the reason the next entry gives, and
-  `AI_SANDBOX_BIG_MB` puts one large transcript among the small ones --
-  `AI_SANDBOX_SPAWN_DELAY` makes the fake CLI slow to start. Both exist
-  because operations that finish in milliseconds have states on the way that
-  nothing can observe, and an unobservable state is one where broken and
-  working look identical.
-- **`app/transcript-bench.sh` is the standard scroll measurement.** It
-  opens the first session (or `-k` keeps the current screen), scrolls a
-  fixed gesture loop, and prints the app's render report -- the same one
-  the in-app copy button produces, whose `on screen:` line names what the
-  viewport was actually holding. Compare two runs of it with the same
-  gestures; the emulator's absolute frame times transfer nothing, the
-  report's accounting does.
-- **`ai-server --delay MS` holds every response back.** Over the tunnel a
-  phone's requests take tens to hundreds of milliseconds, and several
-  faults live entirely in what the app does *while* one is outstanding. On
-  a loopback server those windows close before anything can be observed,
-  so the bug looks like it is not there.
-- **A fake CLI exercises the process lifecycle without a token.** Point a
-  `claude_cli` provider's `command` at a two-line script — `#!/bin/sh` and
-  `cat > /dev/null` — and it behaves the way the lifecycle code cares
-  about: it holds the fifo open, records a real pid, writes nothing, and
-  dies on a signal. So adopt, stop, restart and start are all drivable
-  without a real `--resume` and without spending a turn on somebody's
-  account. Sibling to `debug-transcript.sh`, and the two cover different
-  halves: reach for this when what is under test is *whether a process is
-  running*, and for the script when it is *what the transcript draws*.
-  (From the ai-app-2 session, 2026-08-30, which found a clock bug with it
-  that the tests did not have.)
-- Prefer exercising the server directly over going through the UI:
-  `curl --cacert ~/.config/ai-app/certs/ca.pem -H "Authorization: Bearer …" https://127.0.0.1:8443/sessions`.
-  The CA is wherever `--certs` put it — by default under
-  `$XDG_CONFIG_HOME` (`~/.config` when that is unset), never in the
-  checkout, so a relative `certs/ca.pem` finds nothing.
-  The emulator app reaches it at `https://10.0.2.2:8443`; enroll it with
-  `adb -s "$SERIAL" shell "am start -a android.intent.action.VIEW -d 'aiapp://enroll?host=10.0.2.2&port=8443&token=…'"`
-  (quote so the device shell doesn't eat the `&`s).
-- **The emulator is `~/repos/emulator-tools`' business, not this repo's.**
-  `emu up` creates and boots the AVD named after this checkout — whatever
-  `emu name` prints, never a name typed out here, since this file is the same
-  in every clone — refusing when the machine has no room for one; `emu list`
-  says what is attached and what it costs; `emu down` stops it.
-  `run-android.sh` is that plus a build and an install. Run that repo's
-  `install.sh` once if `emu` is missing.
-  The `adb` on `PATH` after sourcing `android-env.sh` is that repo's wrapper,
-  which fills in `-s` from the same rule — so a bare `adb shell` reaches this
-  checkout's emulator and refuses to reach another one's. That defaulting is
-  what makes the old advice unnecessary rather than wrong: with two attached
-  and no `-s`, a bare `adb shell pm list packages` comes back **empty**,
-  which reads as the app having been uninstalled rather than as the question
-  being ambiguous.
-  **Gradle does not go through that wrapper**, so it had the same hole until
-  2026-08-31: `installDebug`, `uninstallDebug` and `connectedAndroidTest` ask
-  the adb server for every attached device and act on all of them, which is
-  how one session's debug build landed on another's emulator. A Gradle init
-  script from `emulator-tools` now runs `emu check` before those tasks and
-  fails the build rather than fanning out. When it refuses, say which device
-  you mean at the moment you use it — `ANDROID_SERIAL=$(emu serial)
-  ./gradlew …` — rather than exporting a serial into the shell, which goes
-  stale the next time an emulator restarts and another checkout's takes the
-  port.
+Use `--bind 127.0.0.1` for emulator development. Without it the server binds
+wg0, which the emulator cannot reach. Use scratch state:
 
-## Where things run (host vs this VM)
+    ai-server --bind 127.0.0.1 --config /tmp/ai-config.ron \
+      --data-dir /tmp/ai-sessions --port 8444
 
-Established 2026-08-25. The machine itself — the two boxes, the shared
-`~/repos` mount, and why the VM is untrusted — is described once in
-`~/.claude/MACHINE.md`; what follows is only what that means here.
+The emulator reaches the host at `10.0.2.2`. `ai-server --enroll-link` mints
+another device link while the server runs. `--delay MS` is important for UI
+states that disappear too quickly on loopback. `RUST_LOG=ai_server=debug`
+logs transcript page bounds and SSE catch-up/reset decisions.
 
-- **`ai-server` belongs on the host in production.** That is where the LAN
-  address the phone can reach is, and where WireGuard terminates.
-  `wg-setup-host.sh` sets that up (keys, `wg0.conf`, the phone's QR); run
-  it there with `sudo WG_ENDPOINT=<ddns name>`.
-- **The tunnel and the real phone can never terminate in the VM**, because
-  nothing outside can open a connection into it. Phone bring-up is host
-  work.
-- `wg0` (10.66.0.1) exists in this VM too, so the production path —
-  `ai-server` with no `--bind` — is exercisable during development. It has
-  no reachable peer and doesn't need one. Consequence: **with no `--bind`
-  the emulator can't reach the server** (it dials 10.0.2.2), so keep using
-  `--bind 127.0.0.1` for app work.
-- `./test-wg-tunnel.sh up|test|down` builds a real tunnel between two
-  network namespaces inside one machine and drives the server through it —
-  a genuine handshake against 10.66.0.1 with pinned TLS, no router or
-  phone involved. That's how to verify the wg0-only posture.
-- **The `claude` CLI is only in the VM, so from the host it is a remote.**
-  The backend reaches it as it would any other machine: a configured host,
-  and a session that names it.
-- **Nothing secret goes in the repo**, which is shared with the host and
-  attacker-writable under this project's threat model (PLAN.md's security
-  section). State lives outside it: `$XDG_CONFIG_HOME/ai-app/config.ron`
-  and `certs/`, `$XDG_DATA_HOME/ai-app/sessions/`, owner-only.
-- Certificates are generated **by the server, on first start**, into
-  `$XDG_CONFIG_HOME/ai-app/certs` (`--certs` overrides). The CA is created
-  once and left alone; the leaf is reissued every start, so covering a new
-  address is a restart. Starting the server in the VM therefore makes a
-  separate throwaway dev CA — never install a build pinning that on the
-  real phone.
-- Point development at a scratch state directory rather than the real one:
-  `--config /tmp/…/config.ron --data-dir /tmp/…/sessions --port 8444`.
+Exercise the server directly when possible:
 
-## Sessions outlive the backend
+    curl --cacert ~/.config/ai-app/certs/ca.pem \
+      -H "Authorization: Bearer …" https://127.0.0.1:8443/sessions
 
-Since 2026-08-29 a session's process is **deliberately left running when
-`ai-server` stops**, and adopted again when it starts — so restarting the
-backend does not end a turn. PLAN.md has the design; what matters day to
-day:
+`./scripts/test-wg-tunnel.sh up|test|down` builds a real WireGuard tunnel
+between network namespaces and verifies pinned TLS against 10.66.0.1.
 
-- **Stopping the server no longer stops the sessions.** After `pkill
-  ai-server` the `claude` processes are still there, on purpose, and the
-  next start picks them up (`reattaching to the claude-cli it left
-  running` in the log). To end one, either `POST /sessions/{id}/stop` —
-  which keeps the session and its transcript, and `POST .../start` brings
-  the process back on the same conversation — or delete the session, which
-  ends the conversation too.
-- **A message or a command sent to a stopped session starts it.** `POST
-  .../message`, `.../command` and `.../compact` go through
-  `SessionManager::send_message` and `::run_command`, which start a process
-  first when the session is known to have exited and then hand the thing to
-  the driver that has one behind it. Only on `exited`: `unknown` has a
-  process that may well be reading its fifo. `/rename` starts one too, and
-  for a sharper reason than the rest: the CLI keeps its own copy of the
-  name, that copy is what its session picker and other agents' session
-  lists show, and a session is only ever *given* a name at birth — every
-  later start is a `--resume` — so a rename that reached no process would
-  leave the two lists disagreeing for good. Its save happens before the
-  telling, so a failure there says the telling failed rather than the
-  rename. So the Start button is for when you want a process and nothing to
-  say to it yet.
-- **A backend start adopts and starts nothing** (2026-08-30). It picks up
-  the processes still running and leaves every other session as it found
-  it: listed, with its transcript and its stream, reporting `exited`, with
-  no process and no driver until somebody asks for one. Restarting the
-  server used to relaunch a driver for every session, which started a CLI
-  for each one that had none — so a session stopped on purpose came back at
-  the next rebuild, and the `Idle` the new driver announced stamped every
-  row as active just now. If you are looking for a stopped session's
-  process after a restart, there is deliberately none; press Start, or send
-  it anything.
-- **A launch never moves a session's clock.** A status it has to correct is
-  written at the time of the last thing the session actually did, not at
-  `now()`, and a session that has never done anything reports
-  `SessionConfig::created` rather than the clock — its transcript is empty,
-  since a driver announcing the state it starts in is not news, so there is
-  no line to read a time off. Both are the same rule as
-  `Transcript::last_activity`: a restart has been told nothing, so it must
-  not claim anything happened.
-- **A session spawned while testing cleans itself up: `--throwaway-sessions`**
-  (2026-08-30), which a **debug build defaults to on**. Every session
-  spawned by such a server is marked `throwaway: true` in `config.ron`, and
-  its process is stopped — SIGTERM, then SIGKILL after
-  `process::STOP_GRACE` — when the server exits or is sent SIGTERM/SIGINT.
-  Sessions outliving the backend is right for the ones somebody is using
-  and wrong for the ones a test made: those leave a `claude` behind that
-  every later server adopts, and they pile up unnoticed (twelve on this
-  machine in a day, each holding a conversation open).
-  Two things worth knowing. The flag decides only what **new** sessions are
-  marked as; what happens on the way out is decided by the **mark**, which
-  is the session's own — so a session you spawned deliberately keeps
-  running whichever server is up when one exits, and a throwaway one is
-  cleaned away even by a server started without the flag. And the waiting
-  is not optional: `process::stop` leaves its SIGKILL on a tokio timer,
-  which a runtime that is shutting down never runs, so
-  `process::wait_gone` does the waiting on the way out. Pass
-  `--throwaway-sessions=false` to keep what a development server spawns.
-- **A process that has exited but not been reaped reads as dead**, not
-  alive. `/proc/<pid>/stat` keeps the entry — same pid, same start time —
-  until the status is collected, so a zombie used to answer "still there",
-  which made `exited` unsayable: the session showed `unknown`, its Start
-  button never appeared, and stopping it said there was nothing to stop.
-  `process::stat_of` reads the state field alongside the start time.
-- **Each session directory now holds `process.json`, `stdin.fifo`,
-  `stdout.log` and `stderr.log`.** `stdout.log` is the driver's input, read
-  from the byte offset in `process.json`; removing either by hand while the
-  session is live loses output or replays it.
-- **`--resume` only ever runs when nothing is running.** That check is the
-  fix for the incident below, and the reason there is one entry point
-  (`ClaudeDriver::launch`) rather than a spawn and an attach. The status a
-  launch reports obeys the same rule: a session recorded as `exited` whose
-  launch has just started a process reports `idle`, because `exited` is the
-  word that refuses every command and offers a phone the chance to start a
-  second CLI on a live conversation.
-- **`exited` is never taken on trust; it is checked against the process
-  record** (`corrected` in `session/mod.rs`). It is the one status that draws
-  the phone's Start button and lets `start_session` build a driver, so a
-  record that is not known to be dead makes it false and the session reports
-  `unknown` instead. Without that, a session adopted at a backend start kept
-  the transcript's `exited` while its CLI was running, Start was accepted
-  every press, and each press left another reader on the same process —
-  which reads on screen as one reply written several times, interleaved
-  (`GotGotGot it — it — it —`), not as anything to do with a button.
-  A driver that `start_session` replaces gets `Driver::detach` for the same
-  reason: swapping the `Arc` does not end the tasks the old one is running.
-- Remote sessions are adopted too. The pid recorded for one is the **`ssh`
-  client's**, on this machine — that is the process the backend owns, and it
-  lives as long as the remote command does. (This said "local only" until
-  2026-08-29; the code never had that branch.) Note the far `claude` always
-  has an sshd pipe on stdin whichever version started it, since the fifo is
-  on the backend's side — so you cannot tell a backend's version by looking
-  at a remote session's stdin.
+## Rigs
 
-The import list reports each session's **size as well as its line count**,
-because the two disagree in the way that matters: these transcripts embed
-screenshots as base64, so one line can be a megabyte. On this machine a
-69 MB session has 3,427 lines and a 44 MB one has 6,792 — nothing about a
-line count tells you what continuing a session will cost. Shown, not warned
-about; importing a large session is a choice somebody is entitled to make.
+- `app/ui-sandbox.sh` runs an isolated delayed server with invented
+  transcripts, a fake CLI, stable enrollment, and a file-explorer fixture.
+  Its HOME and data are disposable; never point import/delete tests at real
+  `~/.claude/projects`.
+- A two-line fake CLI (`#!/bin/sh`, `cat > /dev/null`) exercises adoption,
+  stop, restart, and process lifetime without using an account or token.
+- `app/run-bench.sh` installs a benchmark APK on this checkout's emulator,
+  taps its accessibility-labelled control, and prints the report.
+- `cd app && cargo test` drives the real transcript screen without a window
+  through `iris::harness`; touch recordings live in `app/touch/`.
+- `iris/scripts/run-headless.sh phone --phone --dir ../app --shot …` opens the same
+  screen at phone size. `--replay ../app/touch/flick-120hz.touch` replays a
+  recorded gesture.
+- `scripts/rigs/ui-profile/tests/frame_profile.rs` measures CPU frame cost;
+  `arena_churn.rs` measures GPU-array upload. Run ignored profiling tests in
+  release mode or the numbers are meaningless.
 
-**Never import a Claude Code session that is open in a terminal.** The app
-refuses it now — it reads `~/.claude/sessions/<pid>.json`, which Claude
-Code keeps for every live session, and checks the pid's start time so a
-descriptor left by a crashed CLI doesn't count. Refused rather than warned
-about, because on 2026-08-29 an agent imported the session it was *itself*
-running in. That put two `claude --resume` processes on one file: the whole
-65 MB conversation, 154 embedded screenshots included, was re-appended to
-the transcript under a new prompt id, both copies replayed each other's
-writes as work done elsewhere, and the adopted one was billed for re-reading
-all of it. It ended at the account's session limit, with three `claude`
-processes running against one checkout.
+The checked-in benchmark transcript is synthetic. Never put a real transcript
+in this repository; it contains conversation text, tool input, and file data.
 
-## Things that have bitten
+The emulator is a GLES rig. Its Vulkan implementation is SwiftShader, while
+GLES is host-accelerated through virgl. Let Iris's runtime fallback select
+GLES; do not pass `force-gles`. Verify the `iris renderer:` log line before
+interpreting a measurement. Vulkan is verified on desktop and a real phone.
 
-Project-specific only — a lesson that would bite any project on this
-machine belongs in `~/.claude/TOOLCHAIN.md` (toolchain versions) or
-`~/.claude/MACHINE.md` (the machine itself) instead.
+## Driving Android UI
 
-- **tracing caches callsite interest process-wide.** A test that hits a
-  `tracing::warn!` with no subscriber installed can poison the interest
-  cache for a concurrent test that captures logs (flaky "nothing was
-  logged" failures). Keep every exercise of a logging code path under the
-  one capturing subscriber — that's why the auth middleware has a single
-  combined gating+logging test.
-- **The composer can get stuck floating above the bottom of the screen after
-  the keyboard closes, while a reply is streaming.** The composer's position
-  and the transcript's bottom padding are both driven by the raw, animated
-  `WindowInsets.ime` value read inside a `graphicsLayer` block, to avoid
-  recomposing the whole screen every frame of the keyboard's animation (see
-  the layout note above it). That animation is carried by a
-  `WindowInsetsAnimationCallback`, and a callback interrupted mid-flight
-  leaves whatever it was carrying frozen at its last value with nothing
-  left to correct it, since no further keyboard movement will fire it
-  again. A streaming reply invalidates the view every frame, which is
-  exactly the condition known to starve that callback of its `onEnd`.
-  `WindowInsets.isImeVisible` (`ExperimentalLayoutApi`) does not share the
-  failure mode -- it is set once, from the platform's own start/end of the
-  transition over a different path -- so it is read once per keyboard
-  toggle and used to force both places back to zero the moment the
-  platform says the keyboard is gone, whatever the animated value still
-  claims.
-  **The guard is a boolean; the inset itself must never be read in the
-  composable body.** That correction first shipped as a `padding(bottom =
-  ... imeInsets.getBottom(this) ...)` computed in `SessionScreen`, which
-  subscribes the whole screen to a value that changes every frame of the
-  animation: measured on the emulator at **16 full recompositions of
-  `SessionScreen` per keyboard open, against 1**, and it put the
-  transcript's position behind a recomposition while the composer's stayed
-  a draw-phase read of the same frame, so the two were only together while
-  that recomposition kept landing inside the frame. It is `.then(if (imeVisible) Modifier.imePadding() else
-  Modifier)` instead -- `imePadding` reads the inset in the layout phase,
-  which is what the comment above the transcript box means by "the whole of
-  what the keyboard re-measures", and dropping the modifier is the same
-  coercion to zero that the boolean was added for. The counter to check is
-  `session screen recomposed` in the debug button's report, which should
-  move by one across a keyboard open, not by the number of frames it took.
-- **The keyboard pans the window unless the activity opts into resize.**
-  Without `android:windowSoftInputMode="adjustResize"`, opening the IME
-  slides the whole window up (top bar off screen) instead of resizing —
-  `imePadding()` alone doesn't fix it and the transcript looks empty.
-- **A PEM constant must start at the opening quotes.** A generated
-  `"""\n-----BEGIN CERTIFICATE-----` costs Android's `CertificateFactory`
-  its preamble sniff, so it tries DER instead and fails at runtime with
-  `ASN.1 ... DECODE_ERROR` — nowhere near the code that produced it.
-- **A reconnecting phone used to be sent the entire backlog.** The SSE
-  stream replayed everything after the client's cursor, unbounded, while
-  *opening* a session was bounded to a page — so a long disconnect
-  delivered thousands of events one frame at a time. Past
-  `CATCH_UP_LIMIT` the stream now sends a `reset` frame and the newest
-  window instead, and the client rebuilds from it exactly as it does when
-  the screen opens. The reset is not optional: without it the window is
-  spliced onto rows that are no longer adjacent to it, which reads as
-  ordinary output.
-- **The five-hour window has no reset time between blocks, and that is not
-  a missing value.** The usage API anchors it to the block it started in --
-  measured 2026-08-31, the reset came back as exactly five hours after work
-  resumed, and the weekly windows in the same response carried the identical
-  microsecond, so both are computed from one `now()` at request time. When
-  no block is running there is nothing to reset and `resets_at` is `null`;
-  the same response shows other idle windows with the same shape. The weekly
-  ones always have a reset because a week is always running, which is why
-  "the others seem fine".
-  So `resets_at` absent means **not running**, and only a timestamp that
-  arrives and cannot be parsed is unknown. The app collapsed both into one
-  null and the session bar said "reset time unknown" for a machine behaving
-  perfectly -- while the usage dialog, reading the same field, quietly drew
-  nothing. `WindowEnd` in `ResetCountdown.kt` is now the one rule both go
-  through.
-- **Resolving one importable session used to list every one of them.**
-  `import::delete` and the import seed both called `list`, which reads every
-  transcript Claude Code has ever written -- measured at 3.7 seconds against
-  the 867 MB in this VM, paid once per session in a batch. `import::find`
-  takes the same script with one glob narrower, and `delete` resolves the
-  path itself: 78ms. Ids are checked (`is_session_id`) before they reach
-  that glob, since a `/` or `..` in one walks it out of the projects
-  directory and `delete` removes what it lands on.
-- **A transcript page used to cost the whole transcript.** `read_window`
-  read and parsed every line and then kept the last `limit` of them, so the
-  work was the size of the conversation rather than the size of the answer:
-  on a 21 MB, 24,000-event transcript one page took ~500ms of server time to
-  return 620 KB, and took the same 500ms whichever page was asked for. A
-  phone scrolling back paid it per page and every stream reconnect paid it
-  again to find out nothing had happened. It is a bisection now
-  (`Indexed` in `transcript.rs`) -- sequence numbers only increase, so the
-  edge of a range is found by parsing one line per halving and only the
-  window is built. Same page, ~110ms, of which ~20ms is the file scan. The
-  file is still read whole; that is where the remaining cost is, and going
-  further means a chunked backwards reader.
-  `RUST_LOG=ai_server=debug` logs each page with what was asked and what
-  came back, which is how to see a phone paging back in real time.
-- **Paging back has two failures that look like "there is simply no more
-  history", and neither says anything on screen.** Both fixed 2026-08-31,
-  both invisible on a loopback server and reproducible at `--delay 150`.
-  The pager fires on the *first layout*, before any event has arrived --
-  `moreHistory` starts true, so the history spinner is in the list and
-  `visibleItemsInfo` is not empty -- and `before = 0` asks for the events
-  before the first one, which is none, which is exactly how this code is
-  told it has reached the start. `loadOlderPage` refuses `oldestSeq == 0`
-  now. And `joinPages` only ran `adoptRun` on the path where a *split* call
-  had been found, so a boundary landing cleanly between two calls -- most of
-  them -- left one run of tool calls drawn as two groups with the seam
-  wherever the reader happened to have paged. Reproducing either takes a
-  boundary placed on purpose: the opening page is 80 events, so arrange the
-  transcript so that event counts back from the newest.
-- **A page is 800 events and a screen is a handful of rows, and the two
-  have no fixed ratio.** A run of thirty-five tool calls is one row; a reply
-  is hundreds of text deltas folded into one. So anything that budgets in
-  rows has to measure a screen rather than name a number: the history
-  cushion was eight rows, which on a tool-heavy transcript is less than one
-  screenful, and the reader hit the end of what was loaded on every swipe
-  and stood there for a round trip. It is `HISTORY_SCREENS` viewports now,
-  counted from what is actually on screen. Measured at the server, which is
-  the one number here that does not depend on how the emulator renders:
-  against a 24,000-event transcript, ten swipes asked for ten pages before
-  and three after.
-- **What the transcript screen costs to scroll, for whoever measures it
-  next.** Taken 2026-08-30 on the GPU emulator (`emu up` provides one; a
-  frame number from the software rasteriser means nothing -- see
-  `~/.claude/MACHINE.md`), against a real imported transcript with the debug
-  server at `--delay 120`. Settled and flinging fast, both into fresh
-  history and back through rows already drawn: **5.2-5.9% janky frames, 99th
-  percentile 29-32ms, 0-2 slow UI-thread frames.** The stock Settings app on
-  the same device is 3.3% and 38ms, so this is at the platform floor and
-  what is left is the emulator rather than the app. The number that is *not*
-  at the floor is the first few seconds after opening a session, where every
-  row on the way is being composed for the first time; that is inherent to a
-  lazy list and it is why a measurement taken before the screen settles
-  reads three times worse. **Settle first, then reset `gfxinfo`.**
-- **Only `fetchTranscript` was off the main thread; the fold was not.**
-  `foldEvent` returns a new list per event, so a page is that many copies of
-  a growing list -- fine at 80 events and about 300,000 element copies at
-  800, run in the middle of the scroll that asked for it. `warm` had the
-  same shape: the `markdownIn` scan that decides *what* to parse ran before
-  the hop to `Dispatchers.Default`, over every assistant message loaded, on
-  every page. Both are off it now. The shape to watch for is a
-  `withContext` that wraps the *fetch* and leaves the work done with the
-  result outside it.
-- **ZXing only looks for a dark code on a light ground.** The enrollment
-  QR is block characters in the terminal's foreground colour, so a
-  dark-themed terminal renders it as a negative and the in-app scanner
-  silently never matches — while the phone's own camera app, which tries
-  both, does. The scanner asks for `Intents.Scan.MIXED_SCAN`, which
-  alternates normal and inverted frames; keep it that way rather than
-  making the server dictate the colours. `EnrollmentScanActivity` also
-  turns off the library's 10% framing-rect inset (it decodes only what is
-  inside it) and its laser/result-point decorations.
+Read the installed `this-machine-android` skill before using Gradle, adb, an
+AVD, screenshots, or UI traces. This checkout gets its own AVD; resolve it
+with `emu serial` rather than typing a device name.
+
+Scripts tap controls by accessibility label, never by coordinate. Coordinates
+are allowed for swipes because a swipe describes a distance across a scrolling
+surface. A coordinate tap can silently hit a different control and turn a
+failed run into a plausible-looking result.
+
+## Host and VM boundary
+
+Production `ai-server` runs on the host, where the phone can reach WireGuard.
+The Claude CLI is in this VM, so the host reaches it as a remote provider.
+The VM's wg0 is useful for development but has no reachable phone peer. A dev
+server in the VM creates a throwaway CA; never install an APK enrolled against
+that CA on the real phone.
+
+For llama.cpp tests, the CPU build is at `~/.local/opt/llama.cpp`; add that
+directory to `LD_LIBRARY_PATH`. Avoid 2-bit quants for driver diagnosis because
+their fluent nonsense resembles a broken integration.
+
+For SSH transport tests, SSH this VM to itself with a throwaway key and a
+harmless command. Remove the key afterwards. The remote login shell is fish,
+so POSIX-quoting assumptions require explicit verification.
+
+## Session invariants
+
+Sessions deliberately outlive `ai-server`. Shutdown leaves marked processes
+running; restart adopts their process records without starting stopped
+sessions. Sending a message to a stopped session starts it. Use
+`--throwaway-sessions` for test-created sessions.
+
+Each session directory contains `process.json`, `stdin.fifo`, `stdout.log`,
+and `stderr.log`. Do not edit or remove them while live: the stdout byte offset
+in `process.json` prevents replay and loss.
+
+Never import a Claude Code session open in a terminal. One Claude session id
+may occur in multiple project directories; import listing deduplicates by id
+and prefers the copy with more lines, while deletion removes every copy.
+
+Deleting an app session only deletes the provider's transcript when
+`deleteForeign=true`. The server deletes the foreign transcript first so an
+unreachable machine cannot leave a half-deleted session.
+
+## Known traps
+
+- `tracing` caches callsite interest process-wide. Logging tests must install
+  their capturing subscriber before any tested callsite runs.
+- `serde_json` needs `float_roundtrip`: transcript pages and SSE must preserve
+  identical timestamp bytes.
+- Import lookup must use `import::find`, not list every transcript. Validate
+  ids before putting them in a glob.
+- Transcript sequence numbers increase, so page edges are found by bisection.
+  Do not replace indexed window reads with whole-transcript parsing.
+- A page's event count has no fixed relationship to visible rows because
+  deltas and tool calls fold together. History cushions are measured in
+  viewports, not row counts.
+- Android generic motion is separate from touch. Keep hover, wheel, and mouse
+  button handling in `iris::android`; product UI consumes the same pointer
+  state on desktop and Android.

app/.gitignore

@@ -0,0 +1,7 @@
+android-project/.gradle/
+android-project/build/
+android-project/app/build/
+# Rebuilt by build-apk.sh before every Gradle build.
+android-project/app/src/main/jniLibs/
+target/
+Cargo.lock.orig

app/Cargo.toml

@@ -0,0 +1,105 @@
+# Product code lives here; reusable UI belongs in `iris/`.
+[package]
+name = "ai-app"
+version = "0.1.0"
+edition = "2024"
+
+# Android loads the cdylib; desktop, examples, and tests link the rlib.
+[lib]
+name = "ai_app"
+crate-type = ["cdylib", "rlib"]
+
+[[bin]]
+name = "ai-app-desktop"
+path = "src/bin_desktop.rs"
+required-features = ["screens"]
+
+[[example]]
+name = "transcript"
+required-features = ["screens"]
+
+[[example]]
+name = "phone"
+required-features = ["fixture"]
+
+[dependencies]
+event-model = { path = "../event-model" }
+serde = { version = "1", features = ["derive"] }
+# Transcript lines must retain exact float values and raw JSON bytes.
+serde_json = { version = "1", features = ["float_roundtrip", "raw_value"] }
+ureq = { version = "3", features = ["json"] }
+pulldown-cmark = "0.13.4"
+base64 = "0.23"
+log = { version = "0.4.34", features = ["std"] }
+
+# UI dependencies stay optional so client-only tests do not link the renderer.
+iris = { path = "../iris", optional = true }
+libc = { version = "0.2.189", optional = true }
+tokio = { version = "1.53.1", features = ["rt", "time"], optional = true }
+
+[target.'cfg(not(target_os = "android"))'.dependencies]
+winit = "0.30.13"
+
+# Keep this pin synchronized with `iris/Cargo.toml`.
+[target.'cfg(target_os = "android")'.dependencies]
+android-view = { git = "https://github.com/rust-mobile/android-view.git", rev = "bec6c62a96cef8239b0fd7fedeef9b184d02e3a1" }
+android_logger = "0.15.1"
+
+[features]
+default = ["screens", "fixture"]
+screens = ["dep:iris"]
+# Default-on for tests; APK builds opt in so ordinary APKs omit the 1.9 MB fixture.
+fixture = ["screens"]
+bench = ["screens", "fixture", "dep:libc", "dep:tokio"]
+force-gles = ["screens", "iris/force-gles"]
+
+[dev-dependencies]
+tempfile = "3"
+tokio = { version = "1.53.1", features = ["rt", "time"] }
+swash = "0.2.10"
+
+# APK builds select these profiles explicitly.
+[profile.android-release]
+inherits = "release"
+panic = "abort"
+strip = true
+lto = "fat"
+codegen-units = 1
+# A warm-fling profile measured p90/p99 0.09/0.26 ms at 3 versus
+# 0.15/0.42 ms at "s"; the 1.9 MB saving is not worth that frame cost.
+opt-level = 3
+
+[profile.android-dev]
+inherits = "dev"
+panic = "abort"
+
+# Full DWARF in each renderer-linked test binary writes tens of gigabytes.
+[profile.dev]
+debug = "line-tables-only"
+
+[profile.test]
+debug = "line-tables-only"
+
+[[test]]
+name = "catch_a_fling"
+required-features = ["fixture"]
+
+[[test]]
+name = "fence_fling"
+required-features = ["fixture"]
+
+[[test]]
+name = "gesture_cancel"
+required-features = ["fixture"]
+
+[[test]]
+name = "input_log_roundtrip"
+required-features = ["fixture"]
+
+[[test]]
+name = "phone_screen"
+required-features = ["fixture"]
+
+[[test]]
+name = "top_edge"
+required-features = ["fixture"]

app/android-env.sh

@@ -1,55 +0,0 @@
-#!/bin/sh
-# Android SDK environment for this app's Gradle build: locates the SDK and
-# exports the PATH/env vars the build needs. Pure Kotlin/Gradle, so nothing
-# Rust/NDK-specific belongs here.
-#
-# Source this directly for one-off commands instead of going through the
-# full run-android.sh (which also creates/boots the emulator, builds,
-# installs, and launches):
-#
-#   . ./android-env.sh
-#   ./gradlew :androidApp:assembleDebug
-#   adb devices
-#
-# Safe to source repeatedly. Intentionally does NOT `set -e`/`set -u`: this
-# file is meant to be sourced into whatever shell is already running --
-# including a long-lived one a session reuses for unrelated commands -- and
-# changing that shell's error-handling options as a side effect of sourcing
-# would be surprising. run-android.sh, which does want strict mode, sets its
-# own `set -eu` before sourcing this.
-
-# Hardcoded (not derived from an inherited ANDROID_HOME) so this doesn't
-# silently follow whatever that happens to be set to elsewhere -- e.g. this
-# sandbox's own profile exports ANDROID_HOME=/opt/android-sdk system-wide, a
-# root-owned install this user can't write to. Everything needed lives under
-# the path below instead, matching Android Studio's own default SDK location
-# convention on Linux.
-SDK_ROOT="$HOME/Android/Sdk"
-ANDROID_HOME="$SDK_ROOT"
-ANDROID_SDK_ROOT="$SDK_ROOT"
-# ~/.local/bin is where the `android` CLI itself installs to (see its own
-# installer); adding it here too means sourcing this script guarantees a
-# working `android` command even in a shell that hasn't picked up
-# ~/.profile yet.
-PATH="$HOME/.local/bin:$SDK_ROOT/cmdline-tools/latest/bin:$SDK_ROOT/platform-tools:$SDK_ROOT/emulator:$PATH"
-# Pin the AVD directory explicitly so avdmanager (creation) and the emulator
-# binary (lookup at start time) are guaranteed to agree on where the AVD
-# lives -- left to their own defaults they can resolve different locations
-# and disagree on whether it exists.
-ANDROID_AVD_HOME="${ANDROID_AVD_HOME:-$HOME/.android/avd}"
-mkdir -p "$ANDROID_AVD_HOME"
-export ANDROID_HOME ANDROID_SDK_ROOT ANDROID_AVD_HOME PATH
-
-echo "==> Ensuring required SDK packages are installed in $SDK_ROOT"
-# $SDK_ROOT is user-owned (unlike /opt/android-sdk), so this genuinely
-# installs anything missing rather than just probing for it -- still
-# best-effort (`|| echo`) so a transient network hiccup doesn't abort a
-# script sourcing this under `set -e`.
-#
-# build-tools is needed twice over: by Gradle for this app's own build, and
-# by ../server at runtime for `aapt2` (reading a discovered APK's package
-# name) and `llvm-strip`/`apksigner` (the slim-APK pipeline).
-android sdk install "cmdline-tools/latest" "platform-tools" "emulator" \
-    "platforms/android-37.0" "build-tools/37.0.0" \
-    "system-images/android-36/google_apis/x86_64" \
-    || echo "    (non-fatal: see above)"

app/android-project/app/build.gradle

@@ -0,0 +1,63 @@
+plugins {
+    id("com.android.application")
+}
+
+// build-apk.sh places the Rust cdylib in src/main/jniLibs before Gradle runs.
+def benchBuild = System.getenv("AI_APP_BENCH") == "1"
+
+android {
+    namespace = "dev.iris.android.demo"
+    compileSdk = 37
+
+    defaultConfig {
+        applicationId = "com.example.aiapp"
+        // 29, not 26: `iris::android::view`'s touch handler dates each
+        // sample with `MotionEvent.getEventTimeNanos` and
+        // `getHistoricalEventTimeNanos`, both API 29, and a missing JNI
+        // method there is a hard crash on the first touch rather than a
+        // degraded fling. Raised deliberately rather than guarded at
+        // runtime: nothing this app is built for runs below 29, and an
+        // untested fallback path is its own defect. `build-apk.sh`'s
+        // `cargo ndk -P` is kept at the same number.
+        minSdk = 29
+        // targetSdk 35+ supplies real IME overlap under enforced edge-to-edge.
+        targetSdk = 37
+        versionCode = 1
+        versionName = "1.0"
+        manifestPlaceholders = [appLabel: benchBuild ? "AI Sessions bench" : "AI Sessions"]
+    }
+
+    // The signing key is machine-local; build-apk.sh creates and supplies it.
+    def keystore = System.getenv("AI_APP_KEYSTORE")
+    signingConfigs {
+        if (keystore != null) {
+            release {
+                storeFile = file(keystore)
+                storePassword = System.getenv("AI_APP_KEYSTORE_PASSWORD")
+                keyAlias = "ai-app"
+                keyPassword = storePassword
+            }
+        }
+    }
+
+    buildTypes {
+        debug {
+            if (benchBuild) {
+                applicationIdSuffix ".bench"
+            }
+        }
+        release {
+            if (benchBuild) {
+                applicationIdSuffix ".bench"
+            }
+            if (keystore != null) {
+                signingConfig = signingConfigs.release
+            }
+        }
+    }
+
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+    }
+}

app/android-project/app/src/main/AndroidManifest.xml

@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <!-- The transcript client talks to ai-server. -->
+    <uses-permission android:name="android.permission.INTERNET" />
+
+    <application
+        android:allowBackup="true"
+        android:label="${appLabel}"
+        android:theme="@android:style/Theme.Material.Light.NoActionBar">
+        <activity
+            android:name=".MainActivity"
+            android:configChanges="orientation|screenSize|screenLayout|keyboardHidden"
+            android:exported="true"
+            android:windowSoftInputMode="adjustResize">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+
+            <!-- Enrollment links minted by ai-server and Dev Updater. -->
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="aiapp" android:host="enroll" />
+            </intent-filter>
+
+            <meta-data android:name="android.app.lib_name" android:value="ai_app" />
+        </activity>
+
+        <!-- Read-only recent logs for Dev Updater. The authority follows
+             applicationId so normal and benchmark builds stay separate. -->
+        <provider
+            android:name=".DevLogProvider"
+            android:authorities="${applicationId}.devlog"
+            android:exported="true"
+            android:readPermission="dev.updater.permission.READ_DEVLOG" />
+
+    </application>
+
+</manifest>

app/android-project/app/src/main/java/dev/iris/android/demo/DevLogProvider.java

@@ -0,0 +1,125 @@
+package dev.iris.android.demo;
+
+import android.content.ContentProvider;
+import android.content.ContentValues;
+import android.content.UriMatcher;
+import android.database.Cursor;
+import android.database.MatrixCursor;
+import android.net.Uri;
+
+/** Read-only Dev Updater log provider; its URI and column schema are an external contract. */
+public final class DevLogProvider extends ContentProvider {
+    static {
+        // A provider can start the process without creating MainActivity.
+        System.loadLibrary("ai_app");
+    }
+
+    private static final int FIELDS_PER_LINE = 5;
+
+    private static final String[] LINE_COLUMNS = {"seq", "t_ms", "level", "target", "message"};
+    private static final String[] STATUS_COLUMNS = {"held", "dropped", "newest_seq"};
+
+    private static final int LINES = 1;
+    private static final int STATUS = 2;
+
+    private UriMatcher matcher;
+
+    private static native String[] nativeLinesSince(long since);
+
+    private static native String[] nativeStatus();
+
+    // The provider may be the process's only component, so it must supply
+    // the files directory normally initialized by MainActivity.
+    private static native void nativeReady(String authority, String filesDir);
+
+    @Override
+    public boolean onCreate() {
+        String authority = getContext().getPackageName() + ".devlog";
+        matcher = new UriMatcher(UriMatcher.NO_MATCH);
+        matcher.addURI(authority, "lines", LINES);
+        matcher.addURI(authority, "status", STATUS);
+        nativeReady(authority, getContext().getFilesDir().getAbsolutePath());
+        return true;
+    }
+
+    @Override
+    public Cursor query(
+            Uri uri,
+            String[] projection,
+            String selection,
+            String[] selectionArgs,
+            String sortOrder) {
+        switch (matcher.match(uri)) {
+            case LINES:
+                return lines(sinceOf(uri));
+            case STATUS:
+                return status();
+            default:
+                return null;
+        }
+    }
+
+    private static long sinceOf(Uri uri) {
+        String since = uri.getQueryParameter("since");
+        if (since == null) {
+            return 0;
+        }
+        try {
+            return Long.parseLong(since);
+        } catch (NumberFormatException ignored) {
+            return 0;
+        }
+    }
+
+    private static Cursor lines(long since) {
+        String[] fields = nativeLinesSince(since);
+        if (fields == null) {
+            return null;
+        }
+        MatrixCursor cursor = new MatrixCursor(LINE_COLUMNS, fields.length / FIELDS_PER_LINE);
+        for (int at = 0; at + FIELDS_PER_LINE <= fields.length; at += FIELDS_PER_LINE) {
+            cursor.addRow(
+                    new Object[] {
+                        Long.parseLong(fields[at]),
+                        Long.parseLong(fields[at + 1]),
+                        fields[at + 2],
+                        fields[at + 3],
+                        fields[at + 4],
+                    });
+        }
+        return cursor;
+    }
+
+    private static Cursor status() {
+        String[] fields = nativeStatus();
+        if (fields == null || fields.length != STATUS_COLUMNS.length) {
+            return null;
+        }
+        MatrixCursor cursor = new MatrixCursor(STATUS_COLUMNS, 1);
+        cursor.addRow(
+                new Object[] {
+                    Long.parseLong(fields[0]), Long.parseLong(fields[1]), Long.parseLong(fields[2]),
+                });
+        return cursor;
+    }
+
+    @Override
+    public String getType(Uri uri) {
+        return null;
+    }
+
+    @Override
+    public Uri insert(Uri uri, ContentValues values) {
+        throw new UnsupportedOperationException("this app's log is read-only");
+    }
+
+    @Override
+    public int update(Uri uri, ContentValues values, String selection, String[] selectionArgs) {
+        throw new UnsupportedOperationException("this app's log is read-only");
+    }
+
+    @Override
+    public int delete(Uri uri, String selection, String[] selectionArgs) {
+        throw new UnsupportedOperationException("this app's log is read-only");
+    }
+}

app/android-project/app/src/main/java/dev/iris/android/demo/IrisView.java

@@ -0,0 +1,60 @@
+package dev.iris.android.demo;
+
+import android.app.Activity;
+import android.content.Context;
+import android.view.Gravity;
+import android.widget.ScrollView;
+import android.widget.TextView;
+
+import org.linebender.android.rustview.RustView;
+
+/**
+ * android-view's abstract base plus the two native methods it has no hook
+ * for: window insets and unregistering this view's entry in
+ * iris::android::insets's side table. See iris/src/android/insets.rs's doc
+ * comment for why those could not ride along on an existing android-view
+ * callback the way the back gesture does.
+ */
+public final class IrisView extends RustView {
+    @Override
+    protected native long newViewPeer(Context context);
+
+    native void applyWindowInsetsNative(
+            long peer, int left, int top, int right, int bottom, int imeBottom, int imeVisible);
+
+    native void unregisterInsetsNative(long peer);
+
+    public IrisView(Context context) {
+        super(context);
+    }
+
+    void applyWindowInsets(
+            int left, int top, int right, int bottom, int imeBottom, int imeVisible) {
+        applyWindowInsetsNative(mViewPeer, left, top, right, bottom, imeBottom, imeVisible);
+    }
+
+    @Override
+    protected void onDetachedFromWindow() {
+        unregisterInsetsNative(mViewPeer);
+        super.onDetachedFromWindow();
+    }
+
+    // This path must not depend on the renderer that failed to initialize.
+    void showRendererError(String report) {
+        Context context = getContext();
+        if (!(context instanceof Activity)) {
+            return;
+        }
+        Activity activity = (Activity) context;
+        TextView text = new TextView(activity);
+        text.setText(report);
+        text.setTextIsSelectable(true);
+        text.setGravity(Gravity.TOP | Gravity.START);
+        int pad = (int) (16 * activity.getResources().getDisplayMetrics().density);
+        text.setPadding(pad, pad, pad, pad);
+        ScrollView scroll = new ScrollView(activity);
+        scroll.addView(text);
+        activity.setContentView(scroll);
+    }
+
+}

app/android-project/app/src/main/java/dev/iris/android/demo/MainActivity.java

@@ -0,0 +1,104 @@
+package dev.iris.android.demo;
+
+import android.app.Activity;
+import android.content.Intent;
+import android.net.Uri;
+import android.os.Build;
+import android.os.Bundle;
+import android.view.WindowInsets;
+import android.view.WindowInsetsAnimation;
+import android.widget.FrameLayout;
+import java.util.List;
+
+public final class MainActivity extends Activity {
+    static {
+        System.loadLibrary("ai_app");
+    }
+
+    private static native void nativeSetFilesDir(String path);
+
+    private static native void nativeEnroll(String uri);
+
+    @Override
+    public void onCreate(Bundle state) {
+        super.onCreate(state);
+        nativeSetFilesDir(getFilesDir().getAbsolutePath());
+        handleEnrollmentIntent(getIntent());
+        IrisView view = new IrisView(this);
+        view.setLayoutParams(new FrameLayout.LayoutParams(
+                FrameLayout.LayoutParams.MATCH_PARENT, FrameLayout.LayoutParams.MATCH_PARENT));
+        view.setFocusable(true);
+        view.setFocusableInTouchMode(true);
+        FrameLayout layout = new FrameLayout(this);
+        layout.addView(view);
+        setContentView(layout);
+        view.requestFocus();
+
+        // Edge-to-edge makes IME-only changes produce fresh inset dispatches.
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+            getWindow().setDecorFitsSystemWindows(false);
+        }
+
+        // Static dispatch supplies settled insets; the animation callback
+        // supplies intermediate IME heights. An interrupted animation may
+        // omit its final progress frame, so onEnd re-reads the root insets.
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+            view.setWindowInsetsAnimationCallback(new WindowInsetsAnimation.Callback(
+                    WindowInsetsAnimation.Callback.DISPATCH_MODE_CONTINUE_ON_SUBTREE) {
+                @Override
+                public WindowInsets onProgress(
+                        WindowInsets insets, List<WindowInsetsAnimation> running) {
+                    sendInsets(view, insets);
+                    return insets;
+                }
+
+                @Override
+                public void onEnd(WindowInsetsAnimation animation) {
+                    WindowInsets settled = view.getRootWindowInsets();
+                    if (settled != null) {
+                        sendInsets(view, settled);
+                    }
+                }
+            });
+        }
+
+        view.setOnApplyWindowInsetsListener((v, insets) -> {
+            sendInsets((IrisView) v, insets);
+            return insets;
+        });
+    }
+
+    @Override
+    protected void onNewIntent(Intent intent) {
+        super.onNewIntent(intent);
+        // Keep getIntent() consistent with the enrollment being handled.
+        setIntent(intent);
+        handleEnrollmentIntent(intent);
+    }
+
+    private static void handleEnrollmentIntent(Intent intent) {
+        if (intent == null) {
+            return;
+        }
+        Uri data = intent.getData();
+        if (data != null) {
+            nativeEnroll(data.toString());
+        }
+    }
+
+    private static void sendInsets(IrisView view, WindowInsets insets) {
+        int left = insets.getSystemWindowInsetLeft();
+        int top = insets.getSystemWindowInsetTop();
+        int right = insets.getSystemWindowInsetRight();
+        int bottom = insets.getSystemWindowInsetBottom();
+        // Visibility and height disagree during IME animation, so neither
+        // can be inferred from the other.
+        int imeBottom = 0;
+        int imeVisible = 0;
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+            imeBottom = insets.getInsets(WindowInsets.Type.ime()).bottom;
+            imeVisible = insets.isVisible(WindowInsets.Type.ime()) ? 1 : 0;
+        }
+        view.applyWindowInsets(left, top, right, bottom, imeBottom, imeVisible);
+    }
+}

app/android-project/app/src/main/java/org/linebender/android/rustview/RustInputConnection.java

@@ -0,0 +1,153 @@
+package org.linebender.android.rustview;
+
+import android.os.Bundle;
+import android.os.Handler;
+import android.view.KeyEvent;
+import android.view.inputmethod.CompletionInfo;
+import android.view.inputmethod.CorrectionInfo;
+import android.view.inputmethod.ExtractedText;
+import android.view.inputmethod.ExtractedTextRequest;
+import android.view.inputmethod.InputConnection;
+import android.view.inputmethod.InputContentInfo;
+
+class RustInputConnection implements InputConnection {
+    private final RustView mView;
+
+    RustInputConnection(RustView view) {
+        mView = view;
+    }
+
+    private long getViewPeer() {
+        return mView.mViewPeer;
+    }
+
+    @Override
+    public CharSequence getTextBeforeCursor(int n, int flags) {
+        return mView.getTextBeforeCursorNative(getViewPeer(), n);
+    }
+
+    @Override
+    public CharSequence getTextAfterCursor(int n, int flags) {
+        return mView.getTextAfterCursorNative(getViewPeer(), n);
+    }
+
+    @Override
+    public CharSequence getSelectedText(int flags) {
+        return mView.getSelectedTextNative(getViewPeer());
+    }
+
+    @Override
+    public int getCursorCapsMode(int reqModes) {
+        return mView.getCursorCapsModeNative(getViewPeer(), reqModes);
+    }
+
+    @Override
+    public ExtractedText getExtractedText(ExtractedTextRequest request, int flags) {
+        return null;
+    }
+
+    @Override
+    public boolean deleteSurroundingText(int beforeLength, int afterLength) {
+        return mView.deleteSurroundingTextNative(getViewPeer(), beforeLength, afterLength);
+    }
+
+    @Override
+    public boolean deleteSurroundingTextInCodePoints(int beforeLength, int afterLength) {
+        return mView.deleteSurroundingTextInCodePointsNative(getViewPeer(), beforeLength, afterLength);
+    }
+
+    @Override
+    public boolean setComposingText(CharSequence text, int newCursorPosition) {
+        return mView.setComposingTextNative(getViewPeer(), text.toString(), newCursorPosition);
+    }
+
+    @Override
+    public boolean setComposingRegion(int start, int end) {
+        return mView.setComposingRegionNative(getViewPeer(), start, end);
+    }
+
+    @Override
+    public boolean finishComposingText() {
+        return mView.finishComposingTextNative(getViewPeer());
+    }
+
+    @Override
+    public boolean commitText(CharSequence text, int newCursorPosition) {
+        return mView.commitTextNative(getViewPeer(), text.toString(), newCursorPosition);
+    }
+
+    @Override
+    public boolean commitCompletion(CompletionInfo text) {
+        return false;
+    }
+
+    @Override
+    public boolean commitCorrection(CorrectionInfo correctionInfo) {
+        return false;
+    }
+
+    @Override
+    public boolean setSelection(int start, int end) {
+        return mView.setSelectionNative(getViewPeer(), start, end);
+    }
+
+    @Override
+    public boolean performEditorAction(int editorAction) {
+        return mView.performEditorActionNative(getViewPeer(), editorAction);
+    }
+
+    @Override
+    public boolean performContextMenuAction(int id) {
+        return mView.performContextMenuActionNative(getViewPeer(), id);
+    }
+
+    @Override
+    public boolean beginBatchEdit() {
+        return mView.beginBatchEditNative(getViewPeer());
+    }
+
+    @Override
+    public boolean endBatchEdit() {
+        return mView.endBatchEditNative(getViewPeer());
+    }
+
+    @Override
+    public boolean sendKeyEvent(KeyEvent event) {
+        return mView.inputConnectionSendKeyEventNative(getViewPeer(), event);
+    }
+
+    @Override
+    public boolean clearMetaKeyStates(int states) {
+        return mView.inputConnectionClearMetaKeyStatesNative(getViewPeer(), states);
+    }
+
+    @Override
+    public boolean reportFullscreenMode(boolean enabled) {
+        return mView.inputConnectionReportFullscreenModeNative(getViewPeer(), enabled);
+    }
+
+    @Override
+    public boolean performPrivateCommand(String action, Bundle data) {
+        return false;
+    }
+
+    @Override
+    public boolean requestCursorUpdates(int cursorUpdateMode) {
+        return mView.requestCursorUpdatesNative(getViewPeer(), cursorUpdateMode);
+    }
+
+    @Override
+    public Handler getHandler() {
+        return null;
+    }
+
+    @Override
+    public void closeConnection() {
+        mView.closeInputConnectionNative(getViewPeer());
+    }
+
+    @Override
+    public boolean commitContent(InputContentInfo inputContentInfo, int flags, Bundle opts) {
+        return false;
+    }
+}

app/android-project/app/src/main/java/org/linebender/android/rustview/RustView.java

@@ -0,0 +1,287 @@
+package org.linebender.android.rustview;
+
+import android.content.Context;
+import android.graphics.Rect;
+import android.os.Bundle;
+import android.view.Choreographer;
+import android.view.KeyEvent;
+import android.view.MotionEvent;
+import android.view.SurfaceHolder;
+import android.view.SurfaceView;
+import android.view.accessibility.AccessibilityNodeInfo;
+import android.view.accessibility.AccessibilityNodeProvider;
+import android.view.inputmethod.EditorInfo;
+import android.view.inputmethod.InputConnection;
+import android.view.inputmethod.InputMethodManager;
+
+public abstract class RustView extends SurfaceView
+        implements SurfaceHolder.Callback, Choreographer.FrameCallback {
+    // Vendored from android-view bec6c62. The only local change is `protected`,
+    // allowing IrisView to forward insets through this native peer.
+    protected final long mViewPeer;
+    final InputMethodManager mInputMethodManager;
+
+    protected abstract long newViewPeer(Context context);
+
+    public RustView(Context context) {
+        super(context);
+        mViewPeer = newViewPeer(context);
+        getHolder().addCallback(this);
+        mInputMethodManager =
+                (InputMethodManager) context.getSystemService(Context.INPUT_METHOD_SERVICE);
+    }
+
+    private native int[] onMeasureNative(long peer, int widthSpec, int heightSpec);
+
+    @Override
+    protected void onMeasure(int widthSpec, int heightSpec) {
+        int[] result = onMeasureNative(mViewPeer, widthSpec, heightSpec);
+        if (result != null) {
+            setMeasuredDimension(result[0], result[1]);
+        } else {
+            super.onMeasure(widthSpec, heightSpec);
+        }
+    }
+
+    private native void onLayoutNative(
+            long peer, boolean changed, int left, int top, int right, int bottom);
+
+    @Override
+    protected void onLayout(boolean changed, int left, int top, int right, int bottom) {
+        onLayoutNative(mViewPeer, changed, left, top, right, bottom);
+        super.onLayout(changed, left, top, right, bottom);
+    }
+
+    private native void onSizeChangedNative(long peer, int w, int h, int oldw, int oldh);
+
+    @Override
+    protected void onSizeChanged(int w, int h, int oldw, int oldh) {
+        onSizeChangedNative(mViewPeer, w, h, oldw, oldh);
+        super.onSizeChanged(w, h, oldw, oldh);
+    }
+
+    private native boolean onKeyDownNative(long peer, int keyCode, KeyEvent event);
+
+    @Override
+    public boolean onKeyDown(int keyCode, KeyEvent event) {
+        return onKeyDownNative(mViewPeer, keyCode, event) || super.onKeyDown(keyCode, event);
+    }
+
+    private native boolean onKeyUpNative(long peer, int keyCode, KeyEvent event);
+
+    @Override
+    public boolean onKeyUp(int keyCode, KeyEvent event) {
+        return onKeyUpNative(mViewPeer, keyCode, event) || super.onKeyUp(keyCode, event);
+    }
+
+    private native boolean onTrackballEventNative(long peer, MotionEvent event);
+
+    @Override
+    public boolean onTrackballEvent(MotionEvent event) {
+        return onTrackballEventNative(mViewPeer, event) || super.onTrackballEvent(event);
+    }
+
+    private native boolean onTouchEventNative(long peer, MotionEvent event);
+
+    @Override
+    public boolean onTouchEvent(MotionEvent event) {
+        return onTouchEventNative(mViewPeer, event) || super.onTouchEvent(event);
+    }
+
+    private native boolean onGenericMotionEventNative(long peer, MotionEvent event);
+
+    @Override
+    public boolean onGenericMotionEvent(MotionEvent event) {
+        return onGenericMotionEventNative(mViewPeer, event) || super.onGenericMotionEvent(event);
+    }
+
+    private native boolean onHoverEventNative(long peer, MotionEvent event);
+
+    @Override
+    public boolean onHoverEvent(MotionEvent event) {
+        return onHoverEventNative(mViewPeer, event) || super.onHoverEvent(event);
+    }
+
+    private native void onFocusChangedNative(
+            long peer, boolean gainFocus, int direction, Rect previouslyFocusedRect);
+
+    @Override
+    protected void onFocusChanged(boolean gainFocus, int direction, Rect previouslyFocusedRect) {
+        super.onFocusChanged(gainFocus, direction, previouslyFocusedRect);
+        onFocusChangedNative(mViewPeer, gainFocus, direction, previouslyFocusedRect);
+    }
+
+    private native void onWindowFocusChangedNative(long peer, boolean hasWindowFocus);
+
+    @Override
+    public void onWindowFocusChanged(boolean hasWindowFocus) {
+        super.onWindowFocusChanged(hasWindowFocus);
+        onWindowFocusChangedNative(mViewPeer, hasWindowFocus);
+    }
+
+    private native void onAttachedToWindowNative(long peer);
+
+    @Override
+    protected void onAttachedToWindow() {
+        super.onAttachedToWindow();
+        onAttachedToWindowNative(mViewPeer);
+    }
+
+    private native void onDetachedFromWindowNative(long peer);
+
+    @Override
+    protected void onDetachedFromWindow() {
+        super.onDetachedFromWindow();
+        onDetachedFromWindowNative(mViewPeer);
+    }
+
+    private native void onWindowVisibilityChangedNative(long peer, int visibility);
+
+    @Override
+    protected void onWindowVisibilityChanged(int visibility) {
+        super.onWindowVisibilityChanged(visibility);
+        onWindowVisibilityChangedNative(mViewPeer, visibility);
+    }
+
+    private native void surfaceCreatedNative(long peer, SurfaceHolder holder);
+
+    @Override
+    public void surfaceCreated(SurfaceHolder holder) {
+        surfaceCreatedNative(mViewPeer, holder);
+    }
+
+    private native void surfaceChangedNative(
+            long peer, SurfaceHolder holder, int format, int width, int height);
+
+    @Override
+    public void surfaceChanged(SurfaceHolder holder, int format, int width, int height) {
+        surfaceChangedNative(mViewPeer, holder, format, width, height);
+    }
+
+    private native void surfaceDestroyedNative(long peer, SurfaceHolder holder);
+
+    @Override
+    public void surfaceDestroyed(SurfaceHolder holder) {
+        surfaceDestroyedNative(mViewPeer, holder);
+    }
+
+    void postFrameCallback() {
+        Choreographer c = Choreographer.getInstance();
+        c.removeFrameCallback(this);
+        c.postFrameCallback(this);
+    }
+
+    void removeFrameCallback() {
+        Choreographer.getInstance().removeFrameCallback(this);
+    }
+
+    private native void doFrameNative(long peer, long frameTimeNanos);
+
+    @Override
+    public void doFrame(long frameTimeNanos) {
+        doFrameNative(mViewPeer, frameTimeNanos);
+    }
+
+    private native void delayedCallbackNative(long peer);
+
+    private final Runnable mDelayedCallback =
+            new Runnable() {
+                @Override
+                public void run() {
+                    delayedCallbackNative(mViewPeer);
+                }
+            };
+
+    boolean postDelayed(long delayMillis) {
+        return postDelayed(mDelayedCallback, delayMillis);
+    }
+
+    boolean removeDelayedCallbacks() {
+        return removeCallbacks(mDelayedCallback);
+    }
+
+    private native boolean hasAccessibilityNodeProviderNative(long peer);
+
+    private native AccessibilityNodeInfo createAccessibilityNodeInfoNative(
+            long peer, int virtualViewId);
+
+    private native AccessibilityNodeInfo accessibilityFindFocusNative(long peer, int virtualViewId);
+
+    private native boolean performAccessibilityActionNative(
+            long peer, int virtualViewId, int action, Bundle arguments);
+
+    @Override
+    public AccessibilityNodeProvider getAccessibilityNodeProvider() {
+        if (!hasAccessibilityNodeProviderNative(mViewPeer)) {
+            return super.getAccessibilityNodeProvider();
+        }
+        return new AccessibilityNodeProvider() {
+            @Override
+            public AccessibilityNodeInfo createAccessibilityNodeInfo(int virtualViewId) {
+                return createAccessibilityNodeInfoNative(mViewPeer, virtualViewId);
+            }
+
+            @Override
+            public AccessibilityNodeInfo findFocus(int focusType) {
+                return accessibilityFindFocusNative(mViewPeer, focusType);
+            }
+
+            @Override
+            public boolean performAction(int virtualViewId, int action, Bundle arguments) {
+                return performAccessibilityActionNative(
+                        mViewPeer, virtualViewId, action, arguments);
+            }
+        };
+    }
+
+    private native boolean onCreateInputConnectionNative(long peer, EditorInfo outAttrs);
+
+    @Override
+    public InputConnection onCreateInputConnection(EditorInfo outAttrs) {
+        if (!onCreateInputConnectionNative(mViewPeer, outAttrs)) {
+            return null;
+        }
+        return new RustInputConnection(this);
+    }
+
+    native String getTextBeforeCursorNative(long peer, int n);
+
+    native String getTextAfterCursorNative(long peer, int n);
+
+    native String getSelectedTextNative(long peer);
+
+    native int getCursorCapsModeNative(long peer, int reqModes);
+
+    native boolean deleteSurroundingTextNative(long peer, int beforeLength, int afterLength);
+
+    native boolean deleteSurroundingTextInCodePointsNative(
+            long peer, int beforeLength, int afterLength);
+
+    native boolean setComposingTextNative(long peer, String text, int newCursorPosition);
+
+    native boolean setComposingRegionNative(long peer, int start, int end);
+
+    native boolean finishComposingTextNative(long peer);
+
+    native boolean commitTextNative(long peer, String text, int newCursorPosition);
+
+    native boolean setSelectionNative(long peer, int start, int end);
+
+    native boolean performEditorActionNative(long peer, int editorAction);
+
+    native boolean performContextMenuActionNative(long peer, int id);
+
+    native boolean beginBatchEditNative(long peer);
+
+    native boolean endBatchEditNative(long peer);
+
+    native boolean inputConnectionSendKeyEventNative(long peer, KeyEvent event);
+
+    native boolean inputConnectionClearMetaKeyStatesNative(long peer, int states);
+
+    native boolean inputConnectionReportFullscreenModeNative(long peer, boolean enabled);
+
+    native boolean requestCursorUpdatesNative(long peer, int cursorUpdateMode);
+
+    native void closeInputConnectionNative(long peer);
+}

app/android-project/build.gradle

@@ -0,0 +1,3 @@
+plugins {
+    id("com.android.application") version "9.4.0" apply false
+}

app/android-project/settings.gradle

@@ -0,0 +1,15 @@
+pluginManagement {
+    repositories {
+        google()
+        mavenCentral()
+        gradlePluginPortal()
+    }
+}
+dependencyResolutionManagement {
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+rootProject.name = "iris-android-demo"
+include(":app")

app/androidApp/build.gradle.kts

@@ -1,178 +0,0 @@
-plugins {
-    alias(libs.plugins.androidApplication)
-    alias(libs.plugins.composeMultiplatform)
-    alias(libs.plugins.composeCompiler)
-    alias(libs.plugins.ktfmt)
-}
-
-// Formatting is the formatter's. The one setting is which of ktfmt's two
-// styles: kotlinlang is the 4-space one, which is what this code already
-// is -- picking the 2-space default would have reindented every file to
-// say nothing. Everything else stays at ktfmt's defaults, deliberately.
-//
-//   ./gradlew :androidApp:ktfmtFormat   to apply
-//   ./gradlew :androidApp:ktfmtCheck    to verify
-ktfmt { kotlinLangStyle() }
-
-// The CA this app pins is baked in at build time from the certificates on
-// the machine doing the build -- `$XDG_CONFIG_HOME/ai-app/certs/ca.pem`,
-// which the server generates on first start. AI_APP_CA overrides the path.
-//
-// Reading it rather than keeping a pasted copy in the source is what makes
-// the trust boundary follow the build: an APK built on the backend host
-// pins the host's CA and never sees any other, while one built in the dev
-// VM pins that VM's throwaway CA and is only good for its emulator. There
-// is no second trust anchor to get wrong, and no stale paste to notice
-// three days later. It also means the private key never has to exist
-// anywhere near this repo.
-val pinnedCaPath: String =
-    System.getenv("AI_APP_CA")
-        ?: "${System.getenv("XDG_CONFIG_HOME") ?: "${System.getProperty("user.home")}/.config"}" +
-            "/ai-app/certs/ca.pem"
-
-abstract class GeneratePinnedCert : DefaultTask() {
-    /** Where the certificate is looked for, reported in failures. */
-    @get:Input abstract val caPath: Property<String>
-
-    /**
-     * The certificate itself, set only when it exists -- so a missing one produces this task's own
-     * instructions rather than Gradle's "no such input file", which doesn't say what to run.
-     */
-    @get:InputFile
-    @get:Optional
-    @get:PathSensitive(PathSensitivity.NONE)
-    abstract val caCertificate: RegularFileProperty
-
-    /** Wired by AGP through `addGeneratedSourceDirectory`. */
-    @get:OutputDirectory abstract val outputDir: DirectoryProperty
-
-    @TaskAction
-    fun generate() {
-        val path = caPath.get()
-        val ca = File(path)
-        if (!ca.isFile) {
-            throw GradleException(
-                "No CA certificate at $path.\n" +
-                    "Start ai-server once on this machine first -- it generates the CA the " +
-                    "app pins, and the certificate has to exist before an APK can embed it.\n" +
-                    "Set AI_APP_CA=/path/to/ca.pem to build against a different one."
-            )
-        }
-        val pem = ca.readText().trim()
-        if (!pem.startsWith("-----BEGIN CERTIFICATE-----")) {
-            throw GradleException("$path is not a PEM certificate.")
-        }
-        val file = outputDir.get().file("PinnedCaCertificate.kt").asFile
-        file.parentFile.mkdirs()
-        // The PEM must start immediately after the opening quotes: a
-        // leading newline makes Android's CertificateFactory stop
-        // recognising the "-----BEGIN" preamble and try to parse the whole
-        // thing as DER, which fails with an ASN.1 decode error at runtime
-        // rather than anywhere near this file.
-        file.writeText(
-            """
-            |// Generated from $path by the generatePinnedCert task. Do not edit.
-            |package com.example.aiapp
-            |
-            |const val PINNED_CA_PEM = ""${'"'}$pem
-            |""${'"'}
-            |
-            """
-                .trimMargin()
-        )
-    }
-}
-
-val generatePinnedCert =
-    tasks.register<GeneratePinnedCert>("generatePinnedCert") {
-        val ca = file(pinnedCaPath)
-        caPath.set(pinnedCaPath)
-        if (ca.isFile) {
-            caCertificate.set(ca)
-        }
-    }
-
-android {
-    namespace = "com.example.aiapp"
-    compileSdk = 37
-
-    defaultConfig {
-        applicationId = "com.example.aiapp"
-        minSdk = 24
-        targetSdk = 37
-        versionCode = 1
-        versionName = "1.0"
-    }
-    packaging {
-        resources { excludes += "/META-INF/{AL2.0,LGPL2.1}" }
-        // The one native library here is AndroidX's, a few hundred kilobytes with its symbols.
-        // Stripping them needs an NDK the release build would otherwise not use; keeping them
-        // is declared so AGP stops warning that it could not.
-        jniLibs { keepDebugSymbols += "**/libandroidx.graphics.path.so" }
-    }
-    // A release build must be signed, and the key is per machine rather than per repo: it is
-    // what the phone recognises the app by, and a secret never lives in a checkout (the mount is
-    // shared with an untrusted VM). build-apk.sh keeps it beside the pinned CA and points here
-    // through the environment; without it the release build is unsigned, which is fine for
-    // everything except installing.
-    val keystore = System.getenv("AI_APP_KEYSTORE")
-    signingConfigs {
-        if (keystore != null) {
-            create("release") {
-                storeFile = file(keystore)
-                storePassword = System.getenv("AI_APP_KEYSTORE_PASSWORD")
-                keyAlias = "ai-app"
-                keyPassword = storePassword
-            }
-        }
-    }
-    buildTypes {
-        getByName("release") {
-            isMinifyEnabled = false
-            if (keystore != null) signingConfig = signingConfigs.getByName("release")
-        }
-    }
-    compileOptions {
-        sourceCompatibility = JavaVersion.VERSION_21
-        targetCompatibility = JavaVersion.VERSION_21
-        // minSdk is 24 and UsageScreen formats its countdown with
-        // java.time, which the platform only has from 26. Without this it
-        // is a NoClassDefFoundError on 24 and 25 -- an Error, so the
-        // catch around that code does not stop it.
-        isCoreLibraryDesugaringEnabled = true
-    }
-}
-
-// AGP 9 wants generated sources registered through the variant API rather
-// than added to a source set, so the task dependency is carried properly.
-androidComponents {
-    onVariants { variant ->
-        variant.sources.java?.addGeneratedSourceDirectory(
-            generatePinnedCert,
-            GeneratePinnedCert::outputDir,
-        )
-    }
-}
-
-dependencies {
-    // The link both this app and Dev Updater's need in order to reach a
-    // machine they were enrolled against: the pinned CA, the enrollment
-    // store, and the QR capture activity. See wg-app-link's README.
-    implementation(project(":link"))
-    // Not a library this code calls: it is what `isCoreLibraryDesugaring
-    // Enabled` above rewrites java.time against, so API 24 and 25 have it.
-    coreLibraryDesugaring(libs.desugar.jdk.libs)
-
-    implementation(libs.compose.runtime)
-    implementation(libs.compose.runtime.tracing)
-    implementation(libs.compose.foundation)
-    implementation(libs.compose.material3)
-    implementation(libs.compose.ui)
-    implementation(libs.androidx.activity.compose)
-    implementation(libs.androidx.core.ktx)
-    implementation(libs.androidx.lifecycle.runtime.compose)
-    implementation(libs.zxing.embedded)
-    implementation(libs.markdown.renderer)
-    implementation(libs.highlights)
-    implementation(libs.androidx.exifinterface)
-}

app/androidApp/src/main/AndroidManifest.xml

@@ -1,105 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools">
-    <uses-permission android:name="android.permission.INTERNET" />
-    <!-- Android 17 (API 37) made Local Network Protection mandatory: an app
-         targeting 37+ needs this runtime permission to reach *any* local
-         network address, including a plain socket to a LAN IP literal.
-         Without it the traffic is silently dropped, surfacing only as a
-         connect timeout. See MainActivity.kt's runtime request, and
-         dev-updater's manifest for the full story. -->
-    <uses-permission android:name="android.permission.ACCESS_LOCAL_NETWORK" />
-
-    <!-- Telling somebody a session wants them. POST_NOTIFICATIONS is a
-         runtime permission from Android 13; the foreground-service pair
-         below is what lets the connection outlive the app being closed,
-         which is the entire point (see Notifications.kt). -->
-    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
-
-    <!-- tools:ignore MissingApplicationIcon: there is no icon yet, and
-         that is a decision rather than an oversight. An app with no icon
-         of its own is obvious to anyone who opens a launcher, so the
-         warning tells nobody here anything they cannot already see, and
-         the fix is a judgement about how this app should look. Drop this
-         suppression when a real icon lands. -->
-    <application
-        android:label="AI Sessions"
-        android:allowBackup="true"
-        android:theme="@android:style/Theme.Material.Light.NoActionBar"
-        tools:ignore="MissingApplicationIcon">
-        <!-- Lets the phone's own System Tracing see this app's trace sections
-             (Compose's phases, and the composable names runtime-tracing
-             adds) in a release build, so a frame cost measured on the real
-             device can be attributed. shell="true" limits it to profilers
-             run from the shell; it grants nothing to other apps. -->
-        <profileable android:shell="true" />
-        <!-- adjustResize (not the system's default pan): the layout handles
-             the keyboard itself via imePadding(), so the window must resize
-             rather than slide the top bar off screen. -->
-        <activity
-            android:name=".MainActivity"
-            android:exported="true"
-            android:launchMode="singleTop"
-            android:windowSoftInputMode="adjustResize"
-            android:theme="@android:style/Theme.Material.Light.NoActionBar">
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN" />
-                <category android:name="android.intent.category.LAUNCHER" />
-            </intent-filter>
-            <!-- Enrollment: the server prints its aiapp://enroll QR to the
-                 terminal. This intent filter is the fallback path for a
-                 camera app that redirects a scanned aiapp:// URI here
-                 directly; the Settings screen's own "Scan QR code" button
-                 (zxing-android-embedded) is the primary path and needs no
-                 filter, since it decodes the QR itself and hands the URI
-                 to parseEnrollmentUri in-process. -->
-            <intent-filter>
-                <action android:name="android.intent.action.VIEW" />
-                <category android:name="android.intent.category.DEFAULT" />
-                <category android:name="android.intent.category.BROWSABLE" />
-                <data android:scheme="aiapp" android:host="enroll" />
-            </intent-filter>
-        </activity>
-
-        <!-- specialUse rather than dataSync, which is the type this looks
-             like: Android 15 caps dataSync at six hours a day, and a
-             connection that stops listening after six hours is one that
-             misses the overnight run it exists for. The subtype below is
-             the reason string that type requires. -->
-        <service
-            android:name=".NotificationService"
-            android:exported="false"
-            android:foregroundServiceType="specialUse">
-            <property
-                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
-                android:value="Holds one connection to the user's own backend so a session
-                    that needs an answer can be reported while the app is closed. There is no
-                    push service: the backend is reachable only over the user's WireGuard
-                    tunnel and never talks to a third party." />
-        </service>
-
-        <!-- The scanner behind Settings' "Scan QR code". Declared here so
-             it can drop the library CaptureActivity's landscape pin: the
-             code being scanned is usually on a monitor in front of someone
-             holding the phone upright. zxing_CaptureTheme is the library's
-             own fullscreen theme, which is all the activity needs. -->
-        <!-- tools:ignore DiscouragedApi: lint flags every fixed
-             screenOrientation, because Android 16 ignores most of them.
-             This one is not a pin but its removal. fullSensor is what
-             drops the library's landscape lock, so the activity follows
-             the phone rather than asking anyone to turn it, and where the
-             platform ignores the attribute the behaviour is the one this
-             asked for anyway. Scoped to this activity, so a genuine pin
-             elsewhere would still be reported. -->
-        <activity
-            android:name="com.example.wgapplink.EnrollmentScanActivity"
-            android:clearTaskOnLaunch="true"
-            android:screenOrientation="fullSensor"
-            android:stateNotNeeded="true"
-            android:theme="@style/zxing_CaptureTheme"
-            android:windowSoftInputMode="stateAlwaysHidden"
-            tools:ignore="DiscouragedApi" />
-    </application>
-</manifest>

app/androidApp/src/main/kotlin/com/example/aiapp/Api.kt

@@ -1,969 +0,0 @@
-package com.example.aiapp
-
-import java.io.IOException
-import java.net.HttpURLConnection
-import java.net.URL
-import org.json.JSONArray
-import org.json.JSONObject
-
-// The REST half of the backend's surface (see server/src/routes.rs for the
-// table); the SSE half is EventStream.kt. All blocking network calls --
-// invoke from a background dispatcher. Each throws ApiException on failure,
-// carrying the server's own explanation where it sent one, since those
-// messages are written to be read on this screen.
-
-// Shared with EventStream.kt, which connects the same way but then reads
-// without a deadline.
-const val CONNECT_TIMEOUT_MS = 5000
-private const val READ_TIMEOUT_MS = 5000
-
-class ApiException(message: String, cause: Throwable? = null) : Exception(message, cause)
-
-/**
- * Runs one request against the backend, with the pinned TLS setup, the bearer token, and the
- * failure translation every call needs. [readBody] gets the connected, already-status-checked
- * connection to read from.
- *
- * @param readTimeoutMs how long to wait on the response body. The SSE stream doesn't come through
- *   here -- an event stream has no bounded read time (see EventStream.kt).
- */
-fun <T> requestFromServer(
-    settings: ServerSettings,
-    path: String,
-    method: String = "GET",
-    jsonBody: String? = null,
-    /** Raw request body as content-type to bytes -- the upload path. */
-    binaryBody: Pair<String, ByteArray>? = null,
-    readTimeoutMs: Int = READ_TIMEOUT_MS,
-    readBody: (HttpURLConnection) -> T,
-): T {
-    val connection = URL("${settings.baseUrl}$path").openConnection() as HttpURLConnection
-    try {
-        connection.applyPinnedTls()
-        connection.requestMethod = method
-        connection.connectTimeout = CONNECT_TIMEOUT_MS
-        connection.readTimeout = readTimeoutMs
-        connection.setRequestProperty("Authorization", "Bearer ${settings.token}")
-        if (jsonBody != null) {
-            connection.doOutput = true
-            connection.setRequestProperty("Content-Type", "application/json")
-            connection.outputStream.use { it.write(jsonBody.encodeToByteArray()) }
-        } else if (binaryBody != null) {
-            connection.doOutput = true
-            connection.setRequestProperty("Content-Type", binaryBody.first)
-            connection.outputStream.use { it.write(binaryBody.second) }
-        }
-        if (connection.responseCode !in 200..299) {
-            val detail = connection.errorStream?.bufferedReader()?.readText()?.trim()
-            throw ApiException(
-                when {
-                    connection.responseCode == 401 ->
-                        "The server rejected this device's token. Re-enroll by scanning " +
-                            "the server's QR (or rotate with --rotate-token and scan the new one)."
-                    detail.isNullOrEmpty() ->
-                        "Server returned HTTP ${connection.responseCode} for $path"
-                    else -> detail
-                }
-            )
-        }
-        return readBody(connection)
-    } catch (e: ApiException) {
-        throw e
-    } catch (e: IOException) {
-        // Surfacing the real exception (rather than one canned message for
-        // every failure mode) is what lets this be diagnosed on a device
-        // with no logcat access.
-        throw ApiException(
-            "Couldn't reach the server at ${settings.baseUrl} " +
-                "(${e::class.simpleName}: ${e.message}) -- is ai-server running, and is " +
-                "this device able to reach that address (WireGuard up)?",
-            e,
-        )
-    } catch (e: Exception) {
-        throw ApiException(
-            "Reached ${settings.baseUrl}$path but couldn't read its response " +
-                "(${e::class.simpleName}: ${e.message})",
-            e,
-        )
-    } finally {
-        connection.disconnect()
-    }
-}
-
-/** The response body as one JSON object. */
-private fun HttpURLConnection.jsonObject(): JSONObject =
-    JSONObject(inputStream.bufferedReader().readText())
-
-/** The response body as a JSON array of objects, each mapped through [parse]. */
-private fun <T> HttpURLConnection.jsonObjects(parse: (JSONObject) -> T): List<T> =
-    JSONArray(inputStream.bufferedReader().readText()).mapObjects(parse)
-
-private fun <T> JSONArray.mapObjects(parse: (JSONObject) -> T): List<T> =
-    (0 until length()).map { parse(getJSONObject(it)) }
-
-private fun JSONArray.strings(): List<String> = (0 until length()).map { getString(it) }
-
-/** Percent-encodes a value going into a query string. */
-private fun String.urlEncoded(): String = java.net.URLEncoder.encode(this, Charsets.UTF_8.name())
-
-// One row of GET /sessions. A session names the machine it runs on and
-// which of that machine's providers it runs.
-data class SessionSummary(
-    val id: String,
-    /**
-     * Id of the machine this session runs on. Only ever used to *address* that machine -- to pick
-     * this session's row out of the per-machine usage snapshots for the header's five-hour bar.
-     *
-     * It was deliberately left out until 2026-08-29, on the grounds that nothing here addressed a
-     * setup and holding both the id and the name invited showing the wrong one, which had already
-     * happened once. Something addresses one now, so the reason lapsed rather than being overruled.
-     * The guard that replaces it is the rule below: never show this.
-     */
-    val setup: String,
-    /** The machine's current label. This is the one to display; [setup] is never shown. */
-    val setupName: String,
-    val provider: String,
-    val title: String,
-    val model: String?,
-    /**
-     * Whether the conversation would outlive deleting this session, decided by the server from the
-     * provider's kind rather than here from its name.
-     *
-     * What it licenses is narrow, and the delete dialog is worded to match: the driver keeps its
-     * own record of the conversation somewhere this app's delete does not reach. It is not a
-     * promise that the file is still there, and re-importing is not a restore -- this app's
-     * transcript holds things that record does not.
-     */
-    val keepsOwnTranscript: Boolean,
-    /** How much the session asks before acting; null when it was never set. */
-    val permissionMode: String?,
-    /**
-     * Whether this continues a session the machine already had, which changes what deleting means.
-     */
-    val imported: Boolean,
-    /**
-     * Whether this session announces itself when it wants attention.
-     *
-     * Reported rather than assumed, for the same reason [permissionMode] is: a switch that draws
-     * itself from a default is one you can turn off while believing you are reading it. Defaults to
-     * on when a backend is too old to say, which matches what that backend actually does.
-     */
-    val notify: Boolean,
-    /**
-     * The directory the session works in, or null where it was never given one.
-     *
-     * Null is not "the home directory": it is the session never having been told, and what the
-     * process then starts in belongs to whatever launches it. Shown as unset rather than filled in
-     * with a guess, so a reader changing it is choosing rather than confirming.
-     */
-    val cwd: String?,
-    /**
-     * How much context this session is holding, as the server last measured it -- see
-     * `SessionEvent.UsageDelta`.
-     *
-     * Null where nothing has been measured: a session that has not run a turn, a provider that does
-     * not report usage, or a clear nobody has run a turn since. That is not zero, and the status
-     * row says so in words rather than drawing an empty context for a conversation that may be
-     * nearly full.
-     */
-    val contextTokens: Long?,
-    /**
-     * The longest edge an image should have when it reaches this session, or null where the
-     * provider has no limit.
-     *
-     * Null and "a big number" are different answers, and only the first stays true: a provider that
-     * does not care about size should not be given a threshold this app invented. Decided by the
-     * server because that is where a provider's kind is known -- see `uploadPickedImage`.
-     */
-    val maxImageEdge: Int?,
-    val status: String,
-    val lastActivity: Double,
-)
-
-private fun parseSession(session: JSONObject) =
-    SessionSummary(
-        id = session.getString("id"),
-        setup = session.getString("setup"),
-        keepsOwnTranscript = session.optBoolean("keepsOwnTranscript", false),
-        setupName = session.getString("setupName"),
-        provider = session.getString("provider"),
-        title = session.getString("title"),
-        model = session.optString("model").ifEmpty { null },
-        permissionMode = session.optString("permissionMode").ifEmpty { null },
-        imported = session.optBoolean("imported", false),
-        notify = session.optBoolean("notify", true),
-        cwd = session.optString("cwd").ifEmpty { null },
-        contextTokens =
-            if (session.has("contextTokens")) session.getLong("contextTokens") else null,
-        maxImageEdge = session.optInt("maxImageEdge", 0).takeIf { it > 0 },
-        status = session.getString("status"),
-        lastActivity = session.getDouble("lastActivity"),
-    )
-
-fun fetchSessions(settings: ServerSettings): List<SessionSummary> =
-    requestFromServer(settings, "/sessions") { it.jsonObjects(::parseSession) }
-
-/**
- * One session as the server has it now.
- *
- * For screens whose controls are *set to* something rather than merely showing it. A screen opened
- * from a list row carries the row the list last fetched, which is a snapshot: fine for a title,
- * wrong for a switch, since a switch drawn from a stale row shows a position that may have been
- * changed since -- here or on another device -- and nothing on screen says which.
- */
-fun fetchSession(settings: ServerSettings, sessionId: String): SessionSummary =
-    requestFromServer(settings, "/sessions/$sessionId") { parseSession(it.jsonObject()) }
-
-// What the server offers, so the spawn screen has no hardcoded lists: a
-// setup added to the server's config.ron appears here with no app rebuild.
-//
-// One list rather than two. A provider only exists on a machine that has
-// it installed, so offering machines and providers as independent choices
-// would offer pairs that cannot work.
-data class Provider(val name: String, val kind: String, val models: List<String>)
-
-/**
- * A machine, and what it can run. [address] is absent for the backend itself.
- *
- * [id] is stable and [name] is not: renaming a machine keeps its sessions, so everything that
- * refers to a setup uses the id and everything a person reads uses the name.
- */
-data class Setup(
-    val id: String,
-    val name: String,
-    val address: String?,
-    val providers: List<Provider>,
-)
-
-private fun parseProvider(provider: JSONObject) =
-    Provider(
-        name = provider.getString("name"),
-        kind = provider.getString("kind"),
-        // Omitted entirely when the provider offers none.
-        models = provider.optJSONArray("models")?.strings().orEmpty(),
-    )
-
-private fun parseSetup(setup: JSONObject) =
-    Setup(
-        id = setup.getString("id"),
-        name = setup.getString("name"),
-        address = setup.optString("address").ifEmpty { null },
-        providers = setup.getJSONArray("providers").mapObjects(::parseProvider),
-    )
-
-fun fetchSetups(settings: ServerSettings): List<Setup> =
-    requestFromServer(settings, "/setups") { it.jsonObjects(::parseSetup) }
-
-/**
- * A Claude Code session already on a machine, which can be continued here.
- *
- * Identified by [id] and never by a path. The server resolves which file that is, so this app has
- * no way to ask it to read one -- the same rule that keeps a provider's command out of this client.
- */
-data class Importable(
-    val id: String,
-    val cwd: String,
-    val title: String,
-    val modified: Double,
-    val lines: Int,
-    /**
-     * Size of the session file in bytes.
-     *
-     * Worth a place on the row because it is the only thing there that predicts what continuing the
-     * session costs, and the line count does not: these transcripts embed screenshots as base64, so
-     * a single line can be a megabyte.
-     */
-    val bytes: Long,
-    /**
-     * Tokens the model was holding at the last turn, or null if no turn has recorded any.
-     *
-     * The number that predicts what continuing this session costs. It disagrees with [bytes] in the
-     * direction that matters: most of a large transcript is usually history from before a
-     * compaction, which the model is no longer given.
-     */
-    val contextTokens: Long?,
-    /** Whether [title] is a name somebody chose rather than the last thing said in the session. */
-    val named: Boolean,
-    /**
-     * Whether a Claude Code is running this session right now.
-     *
-     * "unknown" is a third answer and not a synonym for "no": the machine may keep no record of
-     * what is running, and a session that cannot be checked is not a session that is free. The
-     * server refuses an import of a "yes"; the row says so before you press it.
-     */
-    val inUse: String,
-    /**
-     * What this server is doing to the session right now -- "importing" or "deleting" -- or null
-     * when nothing is.
-     *
-     * The server's answer rather than the phone's, because the work outlives the screen that asked
-     * for it: leaving the import list and coming back has to show what is still running, and a
-     * phone that was asleep or out of range never saw the events that said so.
-     */
-    val pending: String?,
-    /**
-     * How the last attempt on this row failed, if it did. Kept by the server until something
-     * replaces it, for the same reason [pending] is the server's to answer.
-     */
-    val error: String?,
-)
-
-/**
- * One frame of `GET /setups/{id}/importable/events`: an operation starting, finishing or failing.
- *
- * [operation] is only set by a start, and [message] only by a failure -- the three states are every
- * way an operation can be, and each carries exactly what that state knows.
- */
-data class ImportableChange(
-    val session: String,
-    val state: String,
-    val operation: String?,
-    val message: String?,
-)
-
-fun parseImportableChange(payload: String): ImportableChange? =
-    try {
-        val frame = JSONObject(payload)
-        ImportableChange(
-            session = frame.getString("session"),
-            state = frame.getString("state"),
-            operation = frame.optString("operation").takeIf { it.isNotEmpty() },
-            message = frame.optString("message").takeIf { it.isNotEmpty() },
-        )
-    } catch (_: org.json.JSONException) {
-        // A frame this build does not understand is not a reason to drop the stream: the listing
-        // is the truth and will say what happened whatever this missed.
-        null
-    }
-
-/**
- * What a machine has that could be continued.
- *
- * The slowest call this app makes, and it was the only expensive one left on the 5 second default —
- * which is how it came to time out against a server that was answering perfectly well. Listing
- * means reading every transcript Claude Code has ever written: about four seconds against a
- * gigabyte of them before the tunnel adds anything, and that figure grows with every session
- * anybody has. A timeout is for a server that has stopped answering, so it is set well clear of how
- * long the work takes rather than just above it.
- */
-fun fetchImportable(settings: ServerSettings, setup: String): List<Importable> =
-    requestFromServer(settings, "/setups/$setup/importable", readTimeoutMs = 60000) {
-        it.jsonObjects { session ->
-            Importable(
-                id = session.getString("id"),
-                cwd = session.optString("cwd"),
-                title = session.optString("title"),
-                modified = session.optDouble("modified", 0.0),
-                lines = session.optInt("lines", 0),
-                bytes = session.optLong("bytes", 0L),
-                // Absent means nothing has been measured -- which is not a context of zero, so
-                // it stays null and the row simply does not claim a figure.
-                contextTokens =
-                    if (session.isNull("contextTokens")) null
-                    else session.optLong("contextTokens").takeIf { it > 0L },
-                // Absent means an older backend that cannot answer, which is exactly what
-                // "unknown" says -- so the default is the honest one rather than "no".
-                inUse = session.optString("inUse", "unknown"),
-                named = session.optBoolean("named", false),
-                pending = session.optString("pending").takeIf { it.isNotEmpty() },
-                error = session.optString("error").takeIf { it.isNotEmpty() },
-            )
-        }
-    }
-
-/**
- * How to reach a machine. Deliberately carries no command: the server discovers what a machine can
- * run by asking it, so this app has no way to introduce something to run.
- *
- * [identityFile] is a path on the *backend*, not a key -- private keys do not travel.
- */
-data class SshDetails(
-    val address: String,
-    val port: Int? = null,
-    val identityFile: String? = null,
-)
-
-private fun SshDetails.toJson() =
-    JSONObject().put("address", address).apply {
-        if (port != null) put("port", port)
-        if (!identityFile.isNullOrBlank()) put("identityFile", identityFile)
-    }
-
-/** What a machine turns out to have, without saving anything. */
-fun probeSetup(settings: ServerSettings, ssh: SshDetails?): List<Provider> =
-    requestFromServer(
-        settings,
-        "/setups/probe",
-        method = "POST",
-        jsonBody = JSONObject().apply { if (ssh != null) put("ssh", ssh.toJson()) }.toString(),
-        readTimeoutMs = 40000,
-    ) {
-        it.jsonObjects(::parseProvider)
-    }
-
-fun addSetup(settings: ServerSettings, name: String, ssh: SshDetails?): Setup =
-    requestFromServer(
-        settings,
-        "/setups",
-        method = "POST",
-        jsonBody =
-            JSONObject()
-                .put("name", name)
-                .apply { if (ssh != null) put("ssh", ssh.toJson()) }
-                .toString(),
-        readTimeoutMs = 40000,
-    ) {
-        parseSetup(it.jsonObject())
-    }
-
-/** Renames a machine, and optionally asks it again what it has. */
-fun updateSetup(
-    settings: ServerSettings,
-    id: String,
-    name: String? = null,
-    rediscover: Boolean = false,
-): Setup =
-    requestFromServer(
-        settings,
-        "/setups/${id.urlEncoded()}",
-        method = "PUT",
-        jsonBody =
-            JSONObject()
-                .apply {
-                    if (name != null) put("name", name)
-                    if (rediscover) put("rediscover", true)
-                }
-                .toString(),
-        readTimeoutMs = 40000,
-    ) {
-        parseSetup(it.jsonObject())
-    }
-
-fun deleteSetup(settings: ServerSettings, id: String) {
-    requestFromServer(settings, "/setups/${id.urlEncoded()}", method = "DELETE") {}
-}
-
-/**
- * Spawns a session and returns it as the list would show it. [setup] names the machine and
- * [provider] one of the things that machine offers.
- */
-fun spawnSession(
-    settings: ServerSettings,
-    setup: String,
-    provider: String,
-    title: String,
-    model: String? = null,
-    cwd: String? = null,
-    permissionMode: String? = null,
-    params: Map<String, String> = emptyMap(),
-    /** Continue this Claude Code session instead of starting an empty one. */
-    import: String? = null,
-): SessionSummary =
-    requestFromServer(
-        settings,
-        "/sessions",
-        method = "POST",
-        jsonBody =
-            JSONObject()
-                .put("setup", setup)
-                .put("provider", provider)
-                .put("title", title)
-                .apply {
-                    if (!model.isNullOrBlank()) put("model", model)
-                    if (!cwd.isNullOrBlank()) put("cwd", cwd)
-                    if (!permissionMode.isNullOrBlank()) put("permissionMode", permissionMode)
-                    if (!import.isNullOrBlank()) put("import", import)
-                    if (params.isNotEmpty()) {
-                        put("params", JSONObject(params.toMap<String, Any>()))
-                    }
-                }
-                .toString(),
-        readTimeoutMs = 30000,
-    ) { connection ->
-        parseSession(connection.jsonObject())
-    }
-
-fun sendMessage(
-    settings: ServerSettings,
-    sessionId: String,
-    text: String,
-    attachmentIds: List<String> = emptyList(),
-) {
-    requestFromServer(
-        settings,
-        "/sessions/$sessionId/message",
-        method = "POST",
-        jsonBody =
-            JSONObject()
-                .put("text", text)
-                .put("attachmentIds", JSONArray(attachmentIds))
-                .toString(),
-    ) {}
-}
-
-/**
- * Takes back a message the session has not read yet, named by the id its `messageQueued` carried.
- *
- * Throws rather than returning an outcome, because both ways of failing are things the reader has
- * to be told: 409 means the session was already given it, and 404 means nothing is waiting under
- * that id. The bubble disappearing is the success case and it arrives on the event stream, not from
- * here -- every device drops it, not only the one that tapped.
- */
-fun unqueueMessage(settings: ServerSettings, sessionId: String, messageId: String) {
-    requestFromServer(
-        settings,
-        "/sessions/$sessionId/unqueue",
-        method = "POST",
-        jsonBody = JSONObject().put("messageId", messageId).toString(),
-    ) {}
-}
-
-/**
- * Moves a session to a different working directory.
- *
- * The server checks the directory is there on that machine and refuses if it is not -- a mistyped
- * path accepted here would surface much later, as a session that would not start, with nothing
- * pointing at the typo.
- *
- * Its process is **stopped**, because a working directory is settled when the process is spawned.
- * The next thing said to the session starts it again in the new one, which is this app's rule for a
- * session with no process everywhere else.
- */
-fun setSessionCwd(settings: ServerSettings, sessionId: String, cwd: String) {
-    requestFromServer(
-        settings,
-        "/sessions/$sessionId/cwd",
-        method = "POST",
-        jsonBody = JSONObject().put("cwd", cwd).toString(),
-        readTimeoutMs = 30000,
-    ) {}
-}
-
-/** Uploads one picked image; the returned id goes into [sendMessage]. */
-fun uploadAttachment(
-    settings: ServerSettings,
-    sessionId: String,
-    bytes: ByteArray,
-    mime: String,
-): String {
-    val boundary = "----aiapp-${System.currentTimeMillis()}"
-    val head =
-        ("--$boundary\r\n" +
-                "Content-Disposition: form-data; name=\"file\"; filename=\"image\"\r\n" +
-                "Content-Type: $mime\r\n\r\n")
-            .encodeToByteArray()
-    val tail = "\r\n--$boundary--\r\n".encodeToByteArray()
-    return requestFromServer(
-        settings,
-        "/sessions/$sessionId/attachments",
-        method = "POST",
-        binaryBody = "multipart/form-data; boundary=$boundary" to (head + bytes + tail),
-        readTimeoutMs = 60000,
-    ) { connection ->
-        connection.jsonObject().getString("id")
-    }
-}
-
-/** Fetches an image the transcript references (produced or uploaded). */
-fun fetchSessionFile(settings: ServerSettings, sessionId: String, name: String): ByteArray =
-    requestFromServer(settings, "/sessions/$sessionId/files/$name", readTimeoutMs = 30000) {
-        it.inputStream.readBytes()
-    }
-
-// One rate-limit window, rendered as a labeled bar on the usage screen.
-data class UsageWindow(
-    /**
-     * The API's own word for which window this is -- "session" for the five-hour one.
-     *
-     * How to find a particular window. The label beside it is written for a person to read, so
-     * matching on it would select nothing the day its wording changes.
-     */
-    val kind: String,
-    val label: String,
-    val percent: Double,
-    val resetsAt: String?,
-    val active: Boolean,
-)
-
-data class UsageSnapshot(
-    val provider: String,
-    /** Stable id of the machine these numbers belong to. */
-    val setup: String,
-    /** That machine's current label. */
-    val setupName: String,
-    /**
-     * What came back: "ok", "notLoggedIn", "unreachable" or "failed".
-     *
-     * Four rather than a flag, because the screen has to treat them differently. "notLoggedIn" is a
-     * machine somebody chose not to put an account on -- a fact, not a fault -- while the other two
-     * are faults worth chasing. Collapsing them made a healthy setup read as broken.
-     */
-    val state: String,
-    /** Why, for the two states that are faults. Absent otherwise. */
-    val detail: String?,
-    val windows: List<UsageWindow>,
-)
-
-/** The backend caches; refreshing more often than its poll interval just re-reads the cache. */
-fun fetchUsage(settings: ServerSettings): List<UsageSnapshot> =
-    requestFromServer(settings, "/usage", readTimeoutMs = 30000) { connection ->
-        connection.jsonObjects { snapshot ->
-            UsageSnapshot(
-                provider = snapshot.getString("provider"),
-                setup = snapshot.optString("setup"),
-                setupName = snapshot.optString("setupName"),
-                // Unknown to an older backend, and unknown is not "fine": defaulting to "ok"
-                // would draw an empty card as a healthy one.
-                state = snapshot.optString("state").ifEmpty { "failed" },
-                detail = snapshot.optString("detail").ifEmpty { null },
-                windows =
-                    snapshot.getJSONArray("windows").mapObjects { window ->
-                        UsageWindow(
-                            kind = window.optString("kind").ifEmpty { "unknown" },
-                            label = window.getString("label"),
-                            percent = window.getDouble("percent"),
-                            resetsAt = window.optString("resetsAt").ifEmpty { null },
-                            active = window.getBoolean("active"),
-                        )
-                    },
-            )
-        }
-    }
-
-/**
- * Answers one question with everything that was chosen.
- *
- * A list even when one thing was picked, because that is the shape of the answer rather than a
- * special case of it. What a provider makes of several answers is its own business and is decided
- * on the server; nothing here joins, splits or reformats them for one.
- */
-fun answerQuestion(
-    settings: ServerSettings,
-    sessionId: String,
-    questionId: String,
-    answers: List<String>,
-) {
-    requestFromServer(
-        settings,
-        "/sessions/$sessionId/answer",
-        method = "POST",
-        jsonBody =
-            JSONObject()
-                .put("questionId", questionId)
-                .put("answers", JSONArray(answers))
-                .toString(),
-    ) {}
-}
-
-fun interruptSession(settings: ServerSettings, sessionId: String) {
-    requestFromServer(settings, "/sessions/$sessionId/interrupt", method = "POST") {}
-}
-
-/**
- * Ends the process behind a session, leaving the session and its transcript.
- *
- * Not a delete and not an interrupt: the conversation stays exactly where it is and [startSession]
- * picks it back up. The server reports what it could not do -- there was nothing running, or the
- * machine would not say whether there was -- rather than answering the same way either way.
- */
-fun stopSession(settings: ServerSettings, sessionId: String) {
-    requestFromServer(settings, "/sessions/$sessionId/stop", method = "POST") {}
-}
-
-/** Starts the process again on the conversation it left. See [stopSession]. */
-fun startSession(settings: ServerSettings, sessionId: String) {
-    requestFromServer(settings, "/sessions/$sessionId/start", method = "POST") {}
-}
-
-/**
- * Asks the machine to delete Claude Code sessions, and returns as soon as it has accepted the lot.
- *
- * The transcript *is* the session, so this ends any chance of resuming those conversations. The
- * caller confirms first; see ImportScreen.
- *
- * The work runs on the server, so this returning is not the same as it being done -- what says that
- * is each row's own state, through [fetchImportable] and the change stream. That is the point:
- * leaving the screen used to cancel the delete it had started.
- *
- * One request for the whole batch, which is what makes a handover all-or-nothing. Sending one per
- * row meant a batch could half-arrive -- four deleted, two never asked for -- and the two that were
- * missed looked exactly like two that had not been picked.
- */
-fun deleteImportable(settings: ServerSettings, setup: String, sessionIds: List<String>) {
-    requestFromServer(
-        settings,
-        "/setups/$setup/importable/delete",
-        method = "POST",
-        jsonBody = JSONObject().put("sessions", JSONArray(sessionIds)).toString(),
-    ) {}
-}
-
-/**
- * Continues Claude Code sessions in the background, returning once the server has accepted them.
- *
- * Separate from [spawnSession] because the two are asked different questions. That one means "start
- * this and take me to it", so it waits and answers with the session. This is the import list's
- * batch: several at once, nobody waiting on any particular one, and the result arrives as a row
- * changing rather than as a reply -- which is what lets the screen be left. One request for all of
- * them, for the reason [deleteImportable] gives.
- */
-fun startImport(
-    settings: ServerSettings,
-    setup: String,
-    sessionIds: List<String>,
-    provider: String,
-    permissionMode: String? = null,
-    model: String? = null,
-) {
-    val body =
-        JSONObject().apply {
-            put("sessions", JSONArray(sessionIds))
-            put("provider", provider)
-            permissionMode?.let { put("permissionMode", it) }
-            model?.let { put("model", it) }
-        }
-    requestFromServer(
-        settings,
-        "/setups/$setup/importable/import",
-        method = "POST",
-        jsonBody = body.toString(),
-    ) {}
-}
-
-/**
- * A page of a session's transcript, oldest first within the page.
- *
- * One request instead of one stream frame per event. The SSE stream is the right shape for live
- * events and the wrong one for a backlog: opening an imported session replayed hundreds of frames
- * before anything was readable, which looked exactly like the app loading top-down, because it was.
- *
- * [before] pages backwards for history somebody scrolls to; absent means the newest page.
- */
-fun fetchTranscript(
-    settings: ServerSettings,
-    sessionId: String,
-    before: Long? = null,
-    limit: Int = 80,
-    // Count [limit] in rows, not events, joining a reply's streamed deltas into one -- so a page
-    // of a delta-heavy conversation is a page of the screen rather than a fraction of one message.
-    // The scroll-back pager wants this; the anchor restore does not (it counts events to a known
-    // seq). Ignored by the server for the newest window, where the live cursor needs real seqs.
-    // See the server's `read_window`.
-    coalesce: Boolean = false,
-): List<SeqEvent> {
-    val query = buildString {
-        append("?limit=").append(limit)
-        if (before != null) append("&before=").append(before)
-        if (coalesce) append("&coalesce=true")
-    }
-    return requestFromServer(settings, "/sessions/$sessionId/transcript$query") { connection ->
-        val body = JSONArray(connection.inputStream.bufferedReader().readText())
-        (0 until body.length()).map { parseSeqEvent(body.getJSONObject(it).toString()) }
-    }
-}
-
-/**
- * Renames a session.
- *
- * The name is the backend's own -- it is what the list shows and it exists before any process does
- * -- so this settles it rather than asking. Where the thing running the session has a name of its
- * own, the backend passes it on, which is what makes a session the same session in Claude Code's
- * picker and to any other agent that lists it.
- */
-fun renameSession(settings: ServerSettings, sessionId: String, title: String) {
-    requestFromServer(
-        settings,
-        "/sessions/$sessionId/title",
-        method = "POST",
-        jsonBody = JSONObject().put("title", title).toString(),
-    ) {}
-}
-
-/** Switches a running session's model; the CLI changes it in place. */
-fun setSessionModel(settings: ServerSettings, sessionId: String, model: String) {
-    requestFromServer(
-        settings,
-        "/sessions/$sessionId/model",
-        method = "POST",
-        jsonBody = JSONObject().put("model", model).toString(),
-    ) {}
-}
-
-/**
- * The permission modes the Claude CLI accepts, in the order they give up asking. "manual" asks for
- * everything (each ask arrives on the phone as a question card); the others are the CLI's own
- * escalating levels of autonomy.
- *
- * One list for every screen that offers them -- spawn, import, and the session's own picker --
- * because three copies had already drifted: the import screen was missing "plan".
- */
-val PERMISSION_MODES = listOf("manual", "acceptEdits", "auto", "bypassPermissions", "plan")
-
-/** Switches how much a running session asks before acting, also in place. */
-fun setSessionPermissionMode(settings: ServerSettings, sessionId: String, mode: String) {
-    requestFromServer(
-        settings,
-        "/sessions/$sessionId/permission-mode",
-        method = "POST",
-        jsonBody = JSONObject().put("mode", mode).toString(),
-    ) {}
-}
-
-/** Turns this session's notifications on or off. Stored on the backend -- see `SessionConfig`. */
-fun setSessionNotify(settings: ServerSettings, sessionId: String, notify: Boolean) {
-    requestFromServer(
-        settings,
-        "/sessions/$sessionId/notify",
-        method = "POST",
-        jsonBody = JSONObject().put("notify", notify).toString(),
-    ) {}
-}
-
-/**
- * Asks the session to run one of its own commands.
- *
- * Sent as typed. The server turns the two it understands into its own operations -- a compaction, a
- * rename, which is also what the settings screen sends -- and passes anything else to whatever runs
- * the session. Either way it waits for the turn to end if one is in flight, and says so on the
- * event stream, which is where the waiting bubble comes from.
- */
-fun runCommand(settings: ServerSettings, sessionId: String, text: String) {
-    requestFromServer(
-        settings,
-        "/sessions/$sessionId/command",
-        method = "POST",
-        jsonBody = JSONObject().put("text", text).toString(),
-    ) {}
-}
-
-/**
- * Asks the session to summarise its own history and carry on from the summary.
- *
- * Nothing comes back here: a compaction takes a minute or two, and what it is doing arrives on the
- * event stream like everything else -- a `compacting` status while it runs, then how much context
- * it recovered. A call that waited would be a second, worse account of the same thing.
- */
-fun compactSession(settings: ServerSettings, sessionId: String) {
-    requestFromServer(settings, "/sessions/$sessionId/compact", method = "POST") {}
-}
-
-/**
- * Removes a session, and optionally the machine's own transcript of the same conversation.
- *
- * [deleteForeign] is the delete this app cannot otherwise reach: Claude Code keeps its own record
- * under `~/.claude/projects`, and leaving it is what makes an ordinary delete recoverable. The
- * server does both halves, and does the unrecoverable one first, so a machine it cannot reach
- * leaves the session exactly where it was rather than half-deleted.
- */
-fun deleteSession(settings: ServerSettings, sessionId: String, deleteForeign: Boolean = false) {
-    val query = if (deleteForeign) "?deleteForeign=true" else ""
-    requestFromServer(settings, "/sessions/$sessionId$query", method = "DELETE") {}
-}
-
-// Models: what this backend has downloaded, what it is downloading, and
-// what HuggingFace offers. Browsing is proxied by the server rather than
-// done here, because this app trusts exactly one certificate and has no
-// general internet trust to spend on huggingface.co.
-
-data class LocalModel(val key: String, val repo: String, val file: String, val bytes: Long)
-
-/**
- * A download in flight or finished. [total] is null when the server never said how big the file is
- * -- which must render as "not known", never as a bar at some invented position.
- */
-data class Download(
-    val key: String,
-    val run: Long,
-    val repo: String,
-    val file: String,
-    val state: String,
-    val done: Long,
-    val total: Long?,
-    val error: String?,
-)
-
-data class Models(val local: List<LocalModel>, val downloads: List<Download>)
-
-data class RemoteRepo(val id: String, val downloads: Long, val likes: Long)
-
-data class RemoteFile(val path: String, val bytes: Long, val have: Boolean)
-
-private fun parseDownload(o: JSONObject) =
-    Download(
-        key = o.getString("key"),
-        run = o.getLong("run"),
-        repo = o.getString("repo"),
-        file = o.getString("file"),
-        state = o.getString("state"),
-        done = o.getLong("done"),
-        // Absent rather than zero when unknown; see the field's comment.
-        total = if (o.has("total")) o.getLong("total") else null,
-        error = if (o.has("error")) o.getString("error") else null,
-    )
-
-fun fetchModels(settings: ServerSettings): Models =
-    requestFromServer(settings, "/models") { connection ->
-        val body = JSONObject(connection.inputStream.bufferedReader().readText())
-        Models(
-            local =
-                body.getJSONArray("local").mapObjects { m ->
-                    LocalModel(
-                        key = m.getString("key"),
-                        repo = m.getString("repo"),
-                        file = m.getString("file"),
-                        bytes = m.getLong("bytes"),
-                    )
-                },
-            downloads = body.getJSONArray("downloads").mapObjects(::parseDownload),
-        )
-    }
-
-fun searchModels(settings: ServerSettings, query: String): List<RemoteRepo> =
-    requestFromServer(settings, "/models/search?q=${query.urlEncoded()}") { connection ->
-        connection.jsonObjects { r ->
-            RemoteRepo(
-                id = r.getString("id"),
-                downloads = r.getLong("downloads"),
-                likes = r.getLong("likes"),
-            )
-        }
-    }
-
-fun fetchRepoFiles(settings: ServerSettings, repo: String): List<RemoteFile> =
-    requestFromServer(settings, "/models/files?repo=${repo.urlEncoded()}") { connection ->
-        connection.jsonObjects { f ->
-            RemoteFile(
-                path = f.getString("path"),
-                bytes = f.getLong("bytes"),
-                have = f.getBoolean("have"),
-            )
-        }
-    }
-
-fun startDownload(settings: ServerSettings, repo: String, file: String): Download =
-    requestFromServer(
-        settings,
-        "/models/download",
-        method = "POST",
-        jsonBody = JSONObject().put("repo", repo).put("file", file).toString(),
-    ) { connection ->
-        parseDownload(JSONObject(connection.inputStream.bufferedReader().readText()))
-    }
-
-fun cancelDownload(settings: ServerSettings, key: String) {
-    requestFromServer(
-        settings,
-        "/models/cancel",
-        method = "POST",
-        jsonBody = JSONObject().put("key", key).toString(),
-    ) {}
-}
-
-fun deleteModel(settings: ServerSettings, key: String) {
-    requestFromServer(
-        settings,
-        "/models/delete",
-        method = "POST",
-        jsonBody = JSONObject().put("key", key).toString(),
-    ) {}
-}

app/androidApp/src/main/kotlin/com/example/aiapp/AppRoot.kt

@@ -1,214 +0,0 @@
-package com.example.aiapp
-
-import androidx.activity.compose.BackHandler
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.imePadding
-import androidx.compose.foundation.layout.padding
-import androidx.compose.material3.AlertDialog
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.key
-import androidx.compose.runtime.mutableIntStateOf
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.unit.dp
-import com.example.wgapplink.localNetworkAllowed
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-/**
- * One `when` rather than a navigation library: a handful of screens, with [Screen.Main] as the root
- * and the back button the only other way between them.
- *
- * Import, models and setups are not here any more. They are tabs inside [MainScreen] -- four views
- * of the same backend, none of them a step down from another -- and what is left in this `when` is
- * only what genuinely is a step down: one session, spawning one, and settings. A session's own
- * settings are not among them: they are a dialog over the session, which is where the thing they
- * change is.
- */
-private sealed class Screen {
-    data object Main : Screen()
-
-    data class Session(val summary: SessionSummary) : Screen()
-
-    data object Spawn : Screen()
-
-    data object Settings : Screen()
-}
-
-/**
- * A session a notification tap asked to open, before it is a screen.
- *
- * The notification names an id and nothing else, so opening it means fetching the session first.
- * [serial] tells two taps on the same session's notification apart, since they are two requests and
- * would otherwise compare equal -- see MainActivity, which counts them.
- */
-data class SessionOpenRequest(val sessionId: String, val serial: Int)
-
-/** A tap that could not be turned into a screen, kept with its request so Try again knows what. */
-private data class FailedOpen(val request: SessionOpenRequest, val message: String)
-
-/**
- * [settingsVersion] bumps when enrollment lands via an `aiapp://` intent (see MainActivity),
- * re-reading the stored settings -- a plain `remember` would keep serving the pre-enrollment null.
- *
- * [openRequest] is the session a notification tap asked for, likewise from MainActivity.
- */
-@Composable
-fun AppRoot(settingsVersion: Int, openRequest: SessionOpenRequest?) {
-    val context = LocalContext.current
-    val scope = rememberCoroutineScope()
-    var settings by remember(settingsVersion) { mutableStateOf(loadServerSettings(context)) }
-    var screen by remember { mutableStateOf<Screen>(Screen.Main) }
-    // A notification tap this could not follow, and why. Null both before one is asked for and
-    // after one succeeds, since success is a screen rather than a message.
-    var failedOpen by remember { mutableStateOf<FailedOpen?>(null) }
-    // Bumped whenever another screen changes something the list shows, so
-    // returning to it refetches instead of showing a stale list.
-    var reloadToken by remember { mutableIntStateOf(0) }
-
-    // A standing condition rather than a per-request failure, so it is
-    // stated once here instead of appended to every error that might be
-    // caused by it. Without this the app is simply unreachable and every
-    // screen blames the server or the tunnel for it.
-    if (!localNetworkAllowed(context)) {
-        Text(
-            "This app is not allowed to reach local network addresses, so it cannot " +
-                "connect to the backend at all. Grant \"local network\" in Android's app " +
-                "settings; until then every screen here will look like the server is down.",
-            color = MaterialTheme.colorScheme.error,
-            style = MaterialTheme.typography.bodySmall,
-            modifier = Modifier.padding(16.dp),
-        )
-    }
-
-    val current = settings
-    if (current == null) {
-        // Not enrolled yet: settings is the only usable screen. The QR
-        // path lands in MainActivity and recomposes from the top.
-        Box(Modifier.imePadding()) {
-            SettingsScreen(
-                existing = null,
-                onSaved = { saved ->
-                    settings = saved
-                    screen = Screen.Main
-                },
-                onBack = null,
-            )
-        }
-        return
-    }
-
-    // The one way back, whichever screen is showing and whether it was
-    // reached by the system back gesture or a screen's own Back button.
-    // Every leaf screen can have changed something the list shows, so it
-    // always refetches.
-    val goToMain = {
-        reloadToken++
-        screen = Screen.Main
-    }
-    if (screen !is Screen.Main) {
-        BackHandler(onBack = goToMain)
-    }
-
-    // Turning a notification into the screen it points at. The id has to be resolved to a session
-    // first, because that is what SessionScreen is given -- and unlike a list row, which is a
-    // snapshot the list already fetched, there is nothing here to seed it from.
-    //
-    // A failure is reported rather than swallowed: somebody deliberately tapped a notification, so
-    // an app that opens to the session list with no explanation looks like the tap missed.
-    val open: suspend (SessionOpenRequest) -> Unit = { request ->
-        failedOpen = null
-        try {
-            val session = withContext(Dispatchers.IO) { fetchSession(current, request.sessionId) }
-            screen = Screen.Session(session)
-        } catch (e: ApiException) {
-            failedOpen = FailedOpen(request, e.message ?: "Unknown error")
-        }
-    }
-    LaunchedEffect(openRequest) { openRequest?.let { open(it) } }
-
-    val failed = failedOpen
-    if (failed != null) {
-        AlertDialog(
-            onDismissRequest = { failedOpen = null },
-            title = { Text("Couldn't open that session") },
-            text = { Text(failed.message) },
-            confirmButton = {
-                TextButton(onClick = { scope.launch { open(failed.request) } }) {
-                    Text("Try again")
-                }
-            },
-            dismissButton = { TextButton(onClick = { failedOpen = null }) { Text("Cancel") } },
-        )
-    }
-
-    // Every screen but the session takes the keyboard as bottom padding here. The session
-    // screen deliberately does not: resizing a whole screen on every frame of the keyboard
-    // animation is the cost that made it lag, so it moves only its composer and transcript --
-    // see the layout note in SessionScreen.
-    when (val here = screen) {
-        is Screen.Main ->
-            Box(Modifier.imePadding()) {
-                MainScreen(
-                    settings = current,
-                    reloadToken = reloadToken,
-                    onOpen = { screen = Screen.Session(it) },
-                    onSpawn = { screen = Screen.Spawn },
-                    onImported = { imported ->
-                        reloadToken++
-                        screen = Screen.Session(imported)
-                    },
-                    onSettings = { screen = Screen.Settings },
-                )
-            }
-        is Screen.Session ->
-            // Keyed on the id, because a different session is a different screen rather than this
-            // one showing other rows. SessionScreen remembers a transcript, an open event stream, a
-            // draft and a scroll position, and without the key Compose keeps all of it across the
-            // change and merges two conversations -- which crashes the list on the first duplicate
-            // row key. Only reachable since a notification can move straight from one session to
-            // another; every other way here passes through [Screen.Main], which disposes it anyway.
-            key(here.summary.id) {
-                SessionScreen(settings = current, summary = here.summary, onBack = goToMain)
-            }
-        is Screen.Spawn ->
-            Box(Modifier.imePadding()) {
-                SpawnScreen(
-                    settings = current,
-                    onSpawned = { spawned ->
-                        reloadToken++
-                        screen = Screen.Session(spawned)
-                    },
-                    onBack = goToMain,
-                )
-            }
-        is Screen.Settings ->
-            Box(Modifier.imePadding()) {
-                SettingsScreen(
-                    existing = current,
-                    onSaved = { saved ->
-                        settings = saved
-                        goToMain()
-                    },
-                    onBack = goToMain,
-                )
-            }
-    }
-
-    // Last, so it draws over the screen above rather than under it: these are stacked in the Box
-    // the activity puts around this, and that Box paints in the order it was given. A session
-    // wanting attention is not a fact about the page somebody happens to be on, so it is not the
-    // page's job to leave room for it. Tapping one is the same act as tapping a notification, so
-    // it goes through the same `open`, failure dialog included.
-    SessionAlerts(onOpen = { request -> scope.launch { open(request) } })
-}

app/androidApp/src/main/kotlin/com/example/aiapp/AskQuestion.kt

@@ -1,273 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.BorderStroke
-import androidx.compose.foundation.horizontalScroll
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.FlowRow
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.material3.ButtonDefaults
-import androidx.compose.material3.CardDefaults
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedButton
-import androidx.compose.material3.OutlinedCard
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.Surface
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.text.font.FontFamily
-import androidx.compose.ui.unit.dp
-
-/**
- * Every question one tool call is waiting on.
- *
- * All of it comes from the question events themselves -- what each option means, what picking it
- * would produce, whether several may be picked at once. None of it is read out of the call's own
- * input, which is one provider's JSON: parsing that here would put that provider's schema in the
- * app, where no other provider can reach it and where it drifts the first time the schema moves.
- */
-@Composable
-fun AskUserQuestionBody(
-    asks: List<TranscriptItem.QuestionCard>,
-    onAnswer: (questionId: String, answers: List<String>) -> Unit,
-) {
-    Column(Modifier.fillMaxWidth()) {
-        asks.forEach { ask ->
-            Spacer(Modifier.height(12.dp))
-            AskedQuestion(ask) { answers -> onAnswer(ask.id, answers) }
-        }
-    }
-}
-
-/**
- * One question: what is being asked, what can be answered, and what was.
- *
- * The same body wherever a question appears -- on the call that asked it, or as a card of its own
- * when nothing did. A question is the same thing either way, and two renderings of it would be two
- * places for an answer to go missing.
- */
-@Composable
-fun AskedQuestion(ask: TranscriptItem.QuestionCard, onAnswer: (List<String>) -> Unit) {
-    Column(Modifier.fillMaxWidth()) {
-        ask.header?.let { header ->
-            // Its own line rather than beside the question, because it is a label *for* the
-            // question and the question is the thing to read.
-            Text(
-                header.uppercase(),
-                style = MaterialTheme.typography.labelSmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-        }
-        Text(ask.prompt, style = MaterialTheme.typography.bodyLarge)
-        Spacer(Modifier.height(8.dp))
-        // An answered question keeps its options and marks the one that was taken, rather than
-        // replacing them with a line repeating it. The options are what the question *was*, and
-        // dropping them leaves an answer with nothing to have been an answer to -- "Sonnet" says
-        // very little without the three it was chosen over. Marked in the same purple that says
-        // "picked" while the question is still open, so it is one appearance learned once.
-        val answered = ask.answers.isNotEmpty()
-        if (ask.multiSelect && !answered) {
-            MultipleChoice(ask.options, onAnswer)
-        } else if (ask.options.all { it.description == null && it.preview == null }) {
-            // Nothing to read, so nothing to lay out: Allow and Deny are two words, and two words
-            // do not need a card each.
-            AnswerOptions(ask.options, ask.answers, onAnswer.takeUnless { answered })
-        } else {
-            ask.options.forEach { option ->
-                OptionCard(option, selected = option.label in ask.answers) {
-                    if (!answered) onAnswer(listOf(option.label))
-                }
-            }
-        }
-        // What was answered in the reader's own words, which no option can mark -- see
-        // [OtherAnswer]. Only ever the answers that match nothing offered, so a question answered
-        // by picking says it by the mark alone.
-        val inWords = ask.answers.filterNot { answer -> ask.options.any { it.label == answer } }
-        if (inWords.isNotEmpty()) {
-            Text(
-                "Answered: ${inWords.joinToString(", ")}",
-                style = MaterialTheme.typography.labelLarge,
-                color = MaterialTheme.colorScheme.primary,
-                modifier = Modifier.padding(top = 8.dp),
-            )
-        }
-        if (!answered) OtherAnswer(onAnswer)
-    }
-}
-
-/**
- * Options that can be chosen together, with one button to send them.
- *
- * The answer goes back as the list it is. What a provider makes of several answers is decided where
- * that provider is spoken to -- Claude Code's answers map holds a string, so they are joined there
- * -- and nothing on this side has to know that.
- */
-@Composable
-private fun MultipleChoice(options: List<QuestionOption>, onAnswer: (List<String>) -> Unit) {
-    var chosen by remember { mutableStateOf(setOf<String>()) }
-    options.forEach { option ->
-        OptionCard(option, selected = option.label in chosen) {
-            chosen = if (option.label in chosen) chosen - option.label else chosen + option.label
-        }
-    }
-    Spacer(Modifier.height(4.dp))
-    OutlinedButton(
-        // In the order they were offered rather than the order they were tapped: the reader is
-        // answering a list, and it should read back as that list.
-        onClick = { onAnswer(options.map { it.label }.filter { it in chosen }) },
-        enabled = chosen.isNotEmpty(),
-    ) {
-        Text(if (chosen.size <= 1) "Send answer" else "Send ${chosen.size} answers")
-    }
-}
-
-/**
- * One option: what it is called, what it means, and what it would produce.
- *
- * Outlined rather than tinted. Drawn first as a card one step up the surface ladder, it was
- * indistinguishable from the card behind it -- three paragraphs of text where three things to press
- * should have been, which is the failure a tint step routinely produces on a dark theme. A border
- * is one cue and it is unambiguous.
- */
-@Composable
-private fun OptionCard(option: QuestionOption, selected: Boolean, onPick: () -> Unit) {
-    OutlinedCard(
-        onClick = onPick,
-        modifier = Modifier.fillMaxWidth().padding(top = 6.dp),
-        colors =
-            CardDefaults.outlinedCardColors(
-                containerColor =
-                    if (selected) MaterialTheme.colorScheme.primaryContainer
-                    else MaterialTheme.colorScheme.surface
-            ),
-        // Picked shows in the border as well as the fill, because the fill alone is a colour
-        // difference somebody has to have seen the unpicked version to notice.
-        border =
-            BorderStroke(
-                if (selected) 2.dp else 1.dp,
-                if (selected) MaterialTheme.colorScheme.primary
-                else MaterialTheme.colorScheme.outlineVariant,
-            ),
-    ) {
-        Column(Modifier.padding(12.dp)) {
-            Text(option.label, style = MaterialTheme.typography.titleSmall)
-            option.description?.let {
-                Text(
-                    it,
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    modifier = Modifier.padding(top = 2.dp),
-                )
-            }
-            option.preview?.let { Preview(it) }
-        }
-    }
-}
-
-/**
- * An option's worked example, shown as written.
- *
- * On its own surface, because it is a different kind of thing from the sentence above it: that
- * describes the option, this is a sample of what the option produces, and monospace alone reads as
- * a description that happens to be in code font.
- */
-@Composable
-private fun Preview(preview: String) {
-    Surface(
-        color = MaterialTheme.colorScheme.surfaceContainerLowest,
-        modifier = Modifier.fillMaxWidth().padding(top = 8.dp),
-    ) {
-        Text(
-            preview,
-            style = MaterialTheme.typography.bodySmall,
-            fontFamily = FontFamily.Monospace,
-            // Not wrapped: these are mockups and diffs, where a wrapped line reads as two lines
-            // of the thing being previewed.
-            softWrap = false,
-            modifier = Modifier.padding(8.dp).horizontalScroll(rememberScrollState()),
-        )
-    }
-}
-
-/**
- * The choice the asker always leaves open, and the app has to as well.
- *
- * Every AskUserQuestion carries an implicit "Other" -- the reader may answer in their own words
- * rather than pick. Leaving it out narrows a question that was never that narrow, and the reader
- * cannot tell that it was ever open.
- */
-@Composable
-private fun OtherAnswer(onAnswer: (List<String>) -> Unit) {
-    var text by remember { mutableStateOf("") }
-    Row(Modifier.fillMaxWidth().padding(top = 8.dp)) {
-        OutlinedTextField(
-            value = text,
-            onValueChange = { text = it },
-            label = { Text("Other") },
-            singleLine = true,
-            modifier = Modifier.weight(1f),
-        )
-        TextButton(onClick = { onAnswer(listOf(text.trim())) }, enabled = text.isNotBlank()) {
-            Text("Send")
-        }
-    }
-}
-
-/**
- * Bare options, wrapped rather than in a row.
- *
- * A Row hands out intrinsic widths in order and clips whatever runs past the edge, so a question
- * with four options showed the first one or two and dropped the rest off the side of the screen.
- * That does not read as a bug: it reads as those having been the only choices, which is the worst
- * way for a list of choices to be wrong.
- */
-@Composable
-fun AnswerOptions(
-    options: List<QuestionOption>,
-    /** What was chosen, marked rather than restated; empty while the question is open. */
-    answers: List<String> = emptyList(),
-    /** Null once the question is answered -- the buttons stay, and stop being buttons. */
-    onAnswer: ((List<String>) -> Unit)?,
-) {
-    FlowRow(
-        horizontalArrangement = Arrangement.spacedBy(8.dp),
-        verticalArrangement = Arrangement.spacedBy(4.dp),
-        modifier = Modifier.fillMaxWidth(),
-    ) {
-        options.forEach { option ->
-            val taken = option.label in answers
-            OutlinedButton(
-                onClick = { onAnswer?.invoke(listOf(option.label)) },
-                // Disabled rather than removed, so an answered question still shows what it
-                // offered. Material dims a disabled button's own border and label, which would
-                // take the mark with it -- both are stated here instead.
-                enabled = onAnswer != null,
-                border =
-                    BorderStroke(
-                        if (taken) 2.dp else 1.dp,
-                        if (taken) MaterialTheme.colorScheme.primary
-                        else MaterialTheme.colorScheme.outlineVariant,
-                    ),
-                colors =
-                    ButtonDefaults.outlinedButtonColors(
-                        disabledContentColor =
-                            if (taken) MaterialTheme.colorScheme.primary
-                            else MaterialTheme.colorScheme.onSurfaceVariant
-                    ),
-            ) {
-                Text(option.label)
-            }
-        }
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/Attachments.kt

@@ -1,104 +0,0 @@
-package com.example.aiapp
-
-import android.content.Context
-import android.graphics.Bitmap
-import android.graphics.BitmapFactory
-import android.graphics.Matrix
-import android.net.Uri
-import androidx.exifinterface.media.ExifInterface
-import java.io.ByteArrayOutputStream
-import kotlin.math.max
-
-/**
- * Getting a picked photo to a session, at a size the session can actually take.
- *
- * A phone camera produces twelve megapixels and several megabytes. The Claude API resizes anything
- * larger than 1568px on its long edge before looking at it and refuses images past a much higher
- * bound outright, so a photo sent straight off the camera roll was uploaded whole over the tunnel
- * to be either thrown away or rejected -- which is what "sending an image is broken" was.
- *
- * Shrunk here rather than on the backend, so the bytes that never mattered are never sent: the
- * expensive part of this on a phone is the upload, not the decode. What the limit *is* comes from
- * the server, per session -- see `DriverKind::max_image_edge` -- because that is where a provider's
- * requirements are known, and a phone that carried its own copy of them would be a second place to
- * update when one changes.
- */
-suspend fun uploadPickedImage(
-    context: Context,
-    settings: ServerSettings,
-    sessionId: String,
-    uri: Uri,
-    maxEdge: Int?,
-): String {
-    val (bytes, mime) = readForUpload(context, uri, maxEdge)
-    return uploadAttachment(settings, sessionId, bytes, mime)
-}
-
-/**
- * The bytes to upload and what they are, scaled down only if they need to be.
- *
- * An image already inside the limit is uploaded exactly as it came, rather than decoded and
- * re-encoded to the same size: a round trip through JPEG loses a little every time, and there is
- * nothing to gain from it. This is also the path a provider with no limit always takes.
- */
-private fun readForUpload(context: Context, uri: Uri, maxEdge: Int?): Pair<ByteArray, String> {
-    val resolver = context.contentResolver
-    val mime = resolver.getType(uri) ?: "image/jpeg"
-    val original =
-        resolver.openInputStream(uri)?.use { it.readBytes() }
-            ?: throw ApiException("couldn't read the picked image")
-    if (maxEdge == null) return original to mime
-
-    val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
-    BitmapFactory.decodeByteArray(original, 0, original.size, bounds)
-    val longest = max(bounds.outWidth, bounds.outHeight)
-    // outWidth is -1 when the bytes are not an image this device can decode. Sent on untouched:
-    // this function's job is the size, and refusing something the server might understand is a
-    // decision it has no business making.
-    if (longest <= 0 || longest <= maxEdge) return original to mime
-
-    // Powers of two first, which is all the decoder can do, and then the exact scale. Decoding
-    // the full twelve megapixels only to shrink it is how this runs out of memory on the images
-    // it most needs to handle.
-    val decode =
-        BitmapFactory.Options().apply {
-            inSampleSize = Integer.highestOneBit(max(1, longest / maxEdge))
-        }
-    val decoded =
-        BitmapFactory.decodeByteArray(original, 0, original.size, decode) ?: return original to mime
-    val scale = maxEdge.toFloat() / max(decoded.width, decoded.height)
-    val matrix = Matrix()
-    if (scale < 1f) matrix.postScale(scale, scale)
-    // The camera writes which way up the picture is into EXIF rather than rotating the pixels, and
-    // re-encoding drops the tag -- so a portrait photo would arrive at the model on its side, with
-    // nothing anywhere saying so. Applied to the same matrix as the scale, so it costs no second
-    // copy of the bitmap.
-    matrix.postRotate(exifRotation(original))
-    val scaled = Bitmap.createBitmap(decoded, 0, 0, decoded.width, decoded.height, matrix, true)
-    val out = ByteArrayOutputStream()
-    // JPEG whatever came in: this is a photograph being made smaller, which is what JPEG is for,
-    // and a PNG of a resampled photo is several times the size for no visible difference.
-    scaled.compress(Bitmap.CompressFormat.JPEG, JPEG_QUALITY, out)
-    return out.toByteArray() to "image/jpeg"
-}
-
-/** How far to turn the picture so it is the way up it was taken. */
-private fun exifRotation(bytes: ByteArray): Float =
-    try {
-        when (
-            ExifInterface(bytes.inputStream())
-                .getAttributeInt(ExifInterface.TAG_ORIENTATION, ExifInterface.ORIENTATION_NORMAL)
-        ) {
-            ExifInterface.ORIENTATION_ROTATE_90 -> 90f
-            ExifInterface.ORIENTATION_ROTATE_180 -> 180f
-            ExifInterface.ORIENTATION_ROTATE_270 -> 270f
-            else -> 0f
-        }
-    } catch (_: java.io.IOException) {
-        // No EXIF, or none this can read. Upright is the assumption every
-        // image without the tag is displayed under anyway.
-        0f
-    }
-
-/** High enough that resampling is what the reader notices, not the encoder. */
-private const val JPEG_QUALITY = 90

app/androidApp/src/main/kotlin/com/example/aiapp/BusyItem.kt

@@ -1,101 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.width
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.drawWithContent
-import androidx.compose.ui.geometry.Offset
-import androidx.compose.ui.geometry.Rect
-import androidx.compose.ui.graphics.ColorFilter
-import androidx.compose.ui.graphics.ColorMatrix
-import androidx.compose.ui.graphics.Paint
-import androidx.compose.ui.graphics.drawscope.drawIntoCanvas
-import androidx.compose.ui.graphics.graphicsLayer
-import androidx.compose.ui.unit.dp
-
-/**
- * An item something is happening to: dimmed, drained of colour, inert, with a spinner and the name
- * of the operation over it.
- *
- * One composable rather than a pattern each list repeats, because "this row is busy" has to look
- * the same in the import list and the session list or the appearance becomes a per-screen dialect
- * rather than something the reader learns once.
- *
- * [label] names the operation and `null` means none is running. One parameter rather than a boolean
- * beside a string, which can disagree: there is no such thing as busy with nothing happening. It is
- * a *word* because a spinner alone cannot say which operation this is — deleting and importing are
- * different in kind, and losing a session to the wrong one is not recoverable by waiting.
- *
- * It does **not** make the row inert; the caller disables its own click handling while it passes a
- * label. That was the other way round at first — an overlay consuming pointer events, so no caller
- * had to remember — and it swallowed the drag along with the tap, which meant a list could not be
- * scrolled while anything in it was busy. Consuming taps but not drags means re-deciding what a
- * gesture is above the components that already decide it; disabling the click is the platform's own
- * answer and leaves the scroll where it belongs.
- */
-@Composable
-fun BusyItem(label: String?, content: @Composable () -> Unit) {
-    Box {
-        Box(Modifier.busy(label != null)) { content() }
-        if (label != null) {
-            Box(Modifier.matchParentSize(), contentAlignment = Alignment.Center) {
-                Row(verticalAlignment = Alignment.CenterVertically) {
-                    CircularProgressIndicator(
-                        modifier = Modifier.width(16.dp).height(16.dp),
-                        strokeWidth = 2.dp,
-                        color = MaterialTheme.colorScheme.onSurface,
-                    )
-                    Spacer(Modifier.width(8.dp))
-                    // Full strength, over content that is not: the operation is the one thing on
-                    // this row that is still current, and it has to read against a card whose own
-                    // text is still visible behind it.
-                    Text(
-                        label,
-                        style = MaterialTheme.typography.labelLarge,
-                        color = MaterialTheme.colorScheme.onSurface,
-                    )
-                }
-            }
-        }
-    }
-}
-
-/**
- * How an item looks while it is being acted on: darker, and nearly grey.
- *
- * Both, rather than either alone. Dimming by itself is what this app already used for a row on its
- * way out, and it is the same cue as a disabled control, so a busy row read as one more thing that
- * could not be tapped. Draining the colour is what says the row is *suspended* — the status word,
- * the accent on a warning and everything else that means something by its colour stop meaning it
- * for as long as the operation runs, which is exactly true: none of them is being kept up to date.
- *
- * Not all the way to grey. A row with no colour left is hard to find again in a list, and the
- * reader is watching this one.
- */
-private fun Modifier.busy(busy: Boolean): Modifier =
-    if (!busy) this
-    else
-        this.graphicsLayer { alpha = 0.5f }
-            .drawWithContent {
-                drawIntoCanvas { canvas ->
-                    canvas.saveLayer(
-                        Rect(Offset.Zero, size),
-                        Paint().apply {
-                            colorFilter =
-                                ColorFilter.colorMatrix(
-                                    ColorMatrix().apply { setToSaturation(0.2f) }
-                                )
-                        },
-                    )
-                    drawContent()
-                    canvas.restore()
-                }
-            }

app/androidApp/src/main/kotlin/com/example/aiapp/Chevron.kt

@@ -1,53 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.Canvas
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.width
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.geometry.Offset
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.graphics.StrokeCap
-import androidx.compose.ui.unit.dp
-
-/**
- * A chevron, pointing up or down.
- *
- * Drawn rather than set in a font: a chevron from an icon font is one of the glyphs a system font
- * may simply not have, and the reader who gets an empty box instead is never the one who wrote it.
- *
- * One composable for both directions rather than two that differ by a minus sign -- the pair would
- * drift, and the drift would be a bug in exactly one direction.
- *
- * It draws no label of its own, so every caller owes it a `contentDescription`: this is the whole
- * of what assistive technology has to go on, and it is also the answer to "what was that arrow for"
- * six months from now.
- */
-@Composable
-fun Chevron(
-    pointingUp: Boolean,
-    modifier: Modifier = Modifier,
-    colour: Color = MaterialTheme.colorScheme.onSurfaceVariant,
-) {
-    Canvas(modifier.width(20.dp).height(10.dp)) {
-        val inset = 2.dp.toPx()
-        val point = if (pointingUp) inset else size.height - inset
-        val ends = if (pointingUp) size.height - inset else inset
-        val stroke = 2.dp.toPx()
-        drawLine(
-            colour,
-            Offset(inset, ends),
-            Offset(size.width / 2, point),
-            strokeWidth = stroke,
-            cap = StrokeCap.Round,
-        )
-        drawLine(
-            colour,
-            Offset(size.width / 2, point),
-            Offset(size.width - inset, ends),
-            strokeWidth = stroke,
-            cap = StrokeCap.Round,
-        )
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/Commands.kt

@@ -1,153 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.width
-import androidx.compose.material3.Card
-import androidx.compose.material3.CardDefaults
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.unit.dp
-
-/**
- * Something a session can be asked to do to itself, rather than something to say to it.
- *
- * These are the two this app understands, and understanding them is what lets it show them: a
- * suggestion while one is being typed, a name in the settings screen that sends one, and a bubble
- * that stays up while the session is too busy to run it. Anything else beginning with "/" is passed
- * through to whatever runs the session, because a dialect's own vocabulary is its own and grows
- * without this list -- it just arrives unannounced and unexplained.
- */
-data class SessionCommand(
-    /** With the slash, as it is typed and as it is sent. */
-    val name: String,
-    /** One line, in the suggestion list: what it does, not how. */
-    val summary: String,
-    /** What follows the name, named for the reader, or null when nothing does. */
-    val argument: String?,
-) {
-    /** What to put in the box when this is picked: ready to send, or ready to be finished. */
-    fun typed(): String = if (argument == null) name else "$name "
-}
-
-val SESSION_COMMANDS =
-    listOf(
-        SessionCommand(
-            "/compact",
-            "Summarise the conversation so far and carry on from the summary",
-            null,
-        ),
-        SessionCommand(
-            "/clear",
-            "Start fresh: drop the conversation from the session's context, keeping it on screen",
-            null,
-        ),
-        SessionCommand("/rename", "Change what this session is called", "name"),
-    )
-
-/**
- * The commands worth offering for what has been typed so far.
- *
- * Only for a line that starts with a slash and has not yet become a whole command with an argument
- * -- once there is something after "/rename ", the reader is writing the name and a list of
- * commands underneath it is in the way.
- */
-fun suggestedCommands(input: String): List<SessionCommand> {
-    if (!input.startsWith("/") || input.contains(' ')) return emptyList()
-    return SESSION_COMMANDS.filter { it.name.startsWith(input) }
-}
-
-/**
- * The commands matching what is being typed, above the box they are being typed into.
- *
- * Above rather than over: a list that covers the transcript hides what the command is about, and
- * the reader is usually looking at the thing they mean to act on.
- */
-@Composable
-fun CommandSuggestions(
-    commands: List<SessionCommand>,
-    onPick: (SessionCommand) -> Unit,
-    modifier: Modifier = Modifier,
-) {
-    if (commands.isEmpty()) return
-    Card(modifier.fillMaxWidth().padding(horizontal = 16.dp)) {
-        Column(Modifier.padding(vertical = 4.dp)) {
-            commands.forEach { command ->
-                Row(
-                    Modifier.fillMaxWidth()
-                        .clickable { onPick(command) }
-                        .padding(horizontal = 12.dp, vertical = 8.dp),
-                    verticalAlignment = Alignment.CenterVertically,
-                ) {
-                    Text(
-                        // The command in the colour commands are, so the suggestion and the
-                        // bubble it becomes are visibly the same thing.
-                        if (command.argument == null) command.name
-                        else "${command.name} <${command.argument}>",
-                        style = MaterialTheme.typography.titleSmall,
-                        color = commandColor,
-                    )
-                    Spacer(Modifier.width(12.dp))
-                    Text(
-                        command.summary,
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-            }
-        }
-    }
-}
-
-/**
- * A command, where the reader put it: at their end of the conversation.
- *
- * Blue rather than the colour of something they said, because they did not say it to the model --
- * it is an instruction to the session, and the reply to it is the session changing rather than
- * anything appearing here.
- *
- * [waiting] is a command the session is too busy to run yet, which is a state with a spinner and a
- * reason: pressing Compact in the middle of a long turn otherwise does nothing visible for minutes
- * and reads as having been missed.
- */
-@Composable
-fun CommandBubble(text: String, waiting: Boolean = false) {
-    Box(Modifier.fillMaxWidth()) {
-        Card(
-            colors = CardDefaults.cardColors(containerColor = commandColor),
-            modifier = Modifier.align(Alignment.CenterEnd).padding(start = 48.dp),
-        ) {
-            Column(Modifier.padding(12.dp)) {
-                // Stated beside the fill rather than inherited: a semantic colour has to carry
-                // its own contrast, because the surface under it will not change to rescue it.
-                Text(text, color = MaterialTheme.colorScheme.inverseOnSurface)
-                if (waiting) {
-                    Spacer(Modifier.height(6.dp))
-                    Row(verticalAlignment = Alignment.CenterVertically) {
-                        CircularProgressIndicator(
-                            modifier = Modifier.width(12.dp).height(12.dp),
-                            strokeWidth = 2.dp,
-                            color = MaterialTheme.colorScheme.inverseOnSurface,
-                        )
-                        Spacer(Modifier.width(6.dp))
-                        Text(
-                            "waiting for this turn to end",
-                            style = MaterialTheme.typography.bodySmall,
-                            color = MaterialTheme.colorScheme.inverseOnSurface,
-                        )
-                    }
-                }
-            }
-        }
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/Compaction.kt

@@ -1,68 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Modifier
-
-/**
- * The mark a compaction leaves in the transcript.
- *
- * A divider rather than something anybody said: everything above it is out of the session's context
- * now, and that is a fact about the conversation, not a turn in it. It has no collapsed form -- it
- * is already one line, and there is nothing behind it to open. Drawn by [TranscriptDivider], which
- * a clear also uses, so the two marks cannot drift apart.
- *
- * Blue is [commandColor]: the session acting on itself rather than working on what was asked of it,
- * which is the same thing the status line says while the compaction runs.
- */
-@Composable
-fun CompactedRow(item: TranscriptItem.CompactedNote, modifier: Modifier = Modifier) {
-    TranscriptDivider(compactionSummary(item), commandColor, modifier)
-}
-
-/**
- * What to say about a compaction: the two sizes, and nothing else.
- *
- * The counts are the whole point -- "a million tokens became ten thousand" is the reader's answer
- * to why the wait was worth it -- and they are all this says, because a divider is read in passing.
- * When they were not reported this says only that a compaction happened, rather than filling in a
- * plausible number or explaining at length what was missing.
- */
-fun compactionSummary(item: TranscriptItem.CompactedNote): String {
-    val pre = item.preTokens
-    val post = item.postTokens
-    return if (pre != null && post != null) {
-        "Compacted • ${tokens(pre)} → ${tokens(post)} tok"
-    } else {
-        "Compacted"
-    }
-}
-
-/**
- * A token count as a reader reads one.
- *
- * Shared with the status row rather than formatted at each: the divider and the row report the same
- * quantity about the same moment, and one of them grouping its thousands while the other did not
- * read as two different measurements.
- */
-fun tokens(count: Long): String = "%,d".format(count)
-
-/**
- * What the working indicator says while a compaction is running.
- *
- * Elapsed time and nothing else, because elapsed time is all there is: the CLI announces that a
- * compaction has begun and then says nothing until it has finished, so any bar, percentage or
- * estimate here would be this screen's guess wearing a measurement's clothes. Knowing it has been
- * going forty seconds is what a reader actually wants -- it is the difference between waiting and
- * going to look at why.
- *
- * [seconds] is null when this device did not see the compaction start, which is what opening a
- * session that is already compacting looks like. That case says only "compacting": no number is the
- * honest answer, and a number counted from the moment the screen opened would be wrong in the
- * direction that matters, since a compaction somebody is asking about is a long one.
- */
-fun compactingLabel(seconds: Long?): String =
-    when {
-        seconds == null -> "compacting"
-        seconds < 60 -> "compacting ${seconds}s"
-        else -> "compacting ${seconds / 60}m ${seconds % 60}s"
-    }

app/androidApp/src/main/kotlin/com/example/aiapp/CrashLog.kt

@@ -1,66 +0,0 @@
-package com.example.aiapp
-
-import android.content.Context
-import java.io.File
-import java.io.PrintWriter
-import java.io.StringWriter
-import java.text.SimpleDateFormat
-import java.util.Date
-import java.util.Locale
-
-/**
- * The last crash, kept so the debug button can hand it over.
- *
- * The alternative is asking somebody to reproduce a crash with the phone plugged into a computer
- * and `logcat` running, which is the one thing nobody has set up at the moment it happens -- and a
- * crash report that arrives a day later, without the stack, is a guess. This costs one file write
- * on a process that is already dying, and it turns "it crashes when I open that chat" into the
- * frame it crashed in.
- *
- * Kept until it is read rather than cleared on the next launch: the app restarts before anybody can
- * ask about it, so a log that lives for one session is a log that is never read.
- */
-private const val CRASH_FILE = "last-crash.txt"
-
-/**
- * How much of a stack is kept.
- *
- * This is pasted into a conversation, so it has a budget like any other output written for a
- * reader. The top of a stack is what identifies a crash and the bottom is framework plumbing, so
- * what gets cut is the part nobody reads.
- */
-private const val CRASH_LIMIT = 4000
-
-/**
- * Records uncaught exceptions, then lets the platform do what it was going to do.
- *
- * Chained rather than replacing: the default handler is what shows the "app has stopped" dialog and
- * ends the process, and an app that swallows that instead sits there in an unknown state. This only
- * adds a witness.
- */
-fun installCrashLog(context: Context) {
-    val app = context.applicationContext
-    val previous = Thread.getDefaultUncaughtExceptionHandler()
-    Thread.setDefaultUncaughtExceptionHandler { thread, error ->
-        runCatching { File(app.filesDir, CRASH_FILE).writeText(describe(thread, error)) }
-        previous?.uncaughtException(thread, error)
-    }
-}
-
-private fun describe(thread: Thread, error: Throwable): String {
-    val when_ = SimpleDateFormat("yyyy-MM-dd HH:mm:ss", Locale.US).format(Date())
-    val stack = StringWriter().also { error.printStackTrace(PrintWriter(it)) }.toString()
-    val kept =
-        if (stack.length <= CRASH_LIMIT) stack
-        else stack.take(CRASH_LIMIT) + "\n  ... ${stack.length - CRASH_LIMIT} more characters"
-    return "$when_ on thread ${thread.name}\n$kept"
-}
-
-/** The last crash, or null if there has not been one since it was last read. */
-fun lastCrash(context: Context): String? =
-    File(context.applicationContext.filesDir, CRASH_FILE).takeIf { it.exists() }?.readText()
-
-/** Forgets the last crash, once somebody has taken a copy of it. */
-fun clearCrash(context: Context) {
-    File(context.applicationContext.filesDir, CRASH_FILE).delete()
-}

app/androidApp/src/main/kotlin/com/example/aiapp/DebugStats.kt

@@ -1,164 +0,0 @@
-package com.example.aiapp
-
-import android.content.ClipData
-import android.content.ClipboardManager
-import android.content.Context
-import androidx.core.content.getSystemService
-import java.util.concurrent.ConcurrentHashMap
-import java.util.concurrent.atomic.AtomicLong
-
-/**
- * Counters and timers for the work the transcript does, for the readout behind the debug button.
- *
- * Here because the emulator cannot answer the question this is for. Its own scroll sits at the same
- * frame times as the stock Settings app -- 21ms at the median for both -- so every app-level cost
- * is under the floor of what it can measure, and a frame number taken in it says nothing about a
- * 120Hz phone. Counts do not have that problem: how many times a row was composed, or a reply
- * parsed, is the same number on any machine, and it is the number that says whether the work is
- * proportional to what is on screen or to everything ever loaded.
- *
- * Always on rather than behind a build flag. What is measured is an atomic increment on paths that
- * already allocate lists and parse markdown, and a counter that is only compiled into the build
- * nobody is holding when it is slow is not an instrument.
- */
-object DebugStats {
-    private val counts = ConcurrentHashMap<String, AtomicLong>()
-    private val nanos = ConcurrentHashMap<String, AtomicLong>()
-    private val worst = ConcurrentHashMap<String, AtomicLong>()
-
-    private fun at(map: ConcurrentHashMap<String, AtomicLong>, name: String) =
-        map.computeIfAbsent(name) { AtomicLong() }
-
-    fun count(name: String, by: Long = 1) {
-        at(counts, name).addAndGet(by)
-    }
-
-    /** Keeps [name] at the largest value it has been given, for a high-water mark. */
-    fun atLeast(name: String, value: Long) {
-        val slot = at(counts, name)
-        while (true) {
-            val had = slot.get()
-            if (value <= had || slot.compareAndSet(had, value)) break
-        }
-    }
-
-    /** Records one occurrence of [name] that took [elapsed] nanoseconds. */
-    fun record(name: String, elapsed: Long) {
-        count(name)
-        at(nanos, name).addAndGet(elapsed)
-        val slot = at(worst, name)
-        while (true) {
-            val had = slot.get()
-            if (elapsed <= had || slot.compareAndSet(had, elapsed)) break
-        }
-    }
-
-    fun <T> timed(name: String, body: () -> T): T {
-        val started = System.nanoTime()
-        try {
-            return body()
-        } finally {
-            record(name, System.nanoTime() - started)
-        }
-    }
-
-    fun reset() {
-        counts.clear()
-        nanos.clear()
-        worst.clear()
-    }
-
-    /** One line per counter: how many, how long in total, and the worst single one. */
-    fun lines(): List<String> =
-        counts.keys.sorted().map { name ->
-            val n = counts[name]?.get() ?: 0
-            val total = nanos[name]?.get() ?: 0
-            if (total == 0L) "  $name: $n"
-            else
-                "  $name: $n, ${ms(total)}ms total, ${ms(total / n.coerceAtLeast(1))}ms mean," +
-                    " ${ms(worst[name]?.get() ?: 0)}ms worst"
-        }
-
-    /** How long everything named [name] took in total, or zero if it never happened. */
-    fun nanosOf(name: String): Long = nanos[name]?.get() ?: 0
-
-    private fun ms(nanos: Long) = "%.1f".format(nanos / 1_000_000.0)
-}
-
-/**
- * How much of the frame's draw phase is this app's own work, and how much is not.
- *
- * The draw phase is where Compose's measurement lands as well as its recording -- the platform
- * calls `measureAndLayout()` from `dispatchDraw` -- so "draw is high" has never said which of three
- * different things is high. The transcript times its own measure, its own placement and its own
- * recording, and this is the subtraction that was otherwise done by hand in a conversation every
- * time a report arrived. What is left over is the framework's per-frame bookkeeping after a layout,
- * which grows with how many nodes are alive rather than with how many are on screen.
- *
- * Per frame rather than in total, because the budget it has to fit in is per frame. The recordings
- * are not themselves per-frame -- a measurement happens on the frames that need one -- so these are
- * shares of an average frame, not a claim about any particular one.
- */
-fun drawAccounting(drawNanos: Long, frames: Int): List<String> {
-    if (frames == 0 || drawNanos == 0L) return emptyList()
-    val measure = DebugStats.nanosOf("measure: the whole transcript")
-    val place = DebugStats.nanosOf("place: the whole transcript")
-    // The rows and blocks record *inside* this one, so adding them too would count them twice.
-    val record = DebugStats.nanosOf("draw: the whole transcript")
-    val ours = measure + place + record
-    val rest = (drawNanos - ours).coerceAtLeast(0)
-    fun per(n: Long) = "%.2f".format(n / 1_000_000.0 / frames)
-    return listOf(
-        "  draw phase ${per(drawNanos)}ms per frame, of which:",
-        "    the transcript: ${per(ours)}ms" +
-            " (measure ${per(measure)}, place ${per(place)}, record ${per(record)})",
-        "    everything else: ${per(rest)}ms" +
-            " (${if (drawNanos == 0L) "n/a" else "${rest * 100 / drawNanos}%"})",
-    )
-}
-
-/**
- * Everything the debug button copies: what the device is, what the transcript is holding, where the
- * frames went, and what the app did to produce them.
- *
- * Written for somebody to paste into a conversation, so it is plain text with the units on every
- * number -- a report whose reader has to ask what the columns mean costs another round trip, and
- * the whole point of it is to save one.
- */
-fun debugReport(
-    device: String,
-    transcript: List<String>,
-    frames: List<String>,
-    accounting: List<String>,
-    crash: String?,
-): String = buildString {
-    appendLine("ai-app render report")
-    appendLine(device)
-    appendLine()
-    // First, because a crash outranks every timing below it and the reader should not have to
-    // scroll past two screens of counters to find out the app fell over.
-    if (crash != null) {
-        appendLine("last crash:")
-        crash.trimEnd().lines().forEach { appendLine("  $it") }
-        appendLine()
-    }
-    appendLine("transcript:")
-    transcript.forEach { appendLine(it) }
-    appendLine()
-    appendLine("frames:")
-    frames.forEach { appendLine(it) }
-    appendLine()
-    if (accounting.isNotEmpty()) {
-        appendLine("where the draw phase went:")
-        accounting.forEach { appendLine(it) }
-        appendLine()
-    }
-    appendLine("work since this was last copied:")
-    val work = DebugStats.lines()
-    if (work.isEmpty()) appendLine("  nothing recorded") else work.forEach { appendLine(it) }
-}
-
-/** Puts [text] on the clipboard under [label], which is what the system offers as its name. */
-fun Context.copyToClipboard(label: String, text: String) {
-    getSystemService<ClipboardManager>()?.setPrimaryClip(ClipData.newPlainText(label, text))
-}

app/androidApp/src/main/kotlin/com/example/aiapp/Dividers.kt

@@ -1,54 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.material3.HorizontalDivider
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.unit.dp
-
-/**
- * A line across the transcript saying what left the session's context.
- *
- * Centred between two rules, because it is a divider rather than something anybody said. Two things
- * produce one -- a compaction and a clear -- and they are drawn the same way on purpose: to a
- * reader scrolling back, both mean "the session no longer has what is above this", and which of the
- * two it was is said by the words and the colour.
- *
- * The rules take [color] too, so the whole divider reads as one mark of one kind rather than a
- * coloured phrase sitting in an unrelated grey line.
- *
- * Written once here rather than styled at each of them, so the two cannot drift into looking like
- * different kinds of thing.
- */
-@Composable
-fun TranscriptDivider(text: String, color: Color, modifier: Modifier = Modifier) {
-    Row(
-        verticalAlignment = Alignment.CenterVertically,
-        horizontalArrangement = Arrangement.spacedBy(8.dp),
-        modifier = modifier.fillMaxWidth().padding(vertical = 8.dp),
-    ) {
-        HorizontalDivider(Modifier.weight(1f), color = color)
-        Text(text, style = MaterialTheme.typography.bodySmall, color = color)
-        HorizontalDivider(Modifier.weight(1f), color = color)
-    }
-}
-
-/**
- * The mark a clear leaves.
- *
- * Red, and no counts: a clear takes the conversation out of what the session is given, and unlike a
- * compaction it summarises nothing and measures nothing, so there is nothing to report but the
- * fact. Everything above stays on screen and stays scrollable -- the reader can see that, which is
- * why this does not say it.
- */
-@Composable
-fun ClearedRow(modifier: Modifier = Modifier) {
-    TranscriptDivider("Context cleared", clearedColor, modifier)
-}

app/androidApp/src/main/kotlin/com/example/aiapp/Drafts.kt

@@ -1,36 +0,0 @@
-package com.example.aiapp
-
-import android.content.Context
-import androidx.core.content.edit
-
-private const val DRAFTS = "session-drafts"
-
-/**
- * A message typed into a session and not sent yet.
- *
- * On this device rather than on the backend, which is where this app otherwise keeps state so that
- * every device sees it. A draft is the case that rule is not about: it is the contents of a text
- * box on the phone somebody is holding, written on every keystroke, and half a sentence surfacing
- * on another device would be a surprise rather than a convenience. What has been *sent* is the
- * server's, and that is the part which has to outlive this phone.
- *
- * Kept per session id, because the thing being typed belongs to the conversation it is aimed at:
- * one shared box would hand a message meant for one session to whichever was opened next.
- */
-fun loadDraft(context: Context, sessionId: String): String =
-    context.getSharedPreferences(DRAFTS, Context.MODE_PRIVATE).getString(sessionId, "").orEmpty()
-
-/**
- * Records [text] as the draft for [sessionId], or forgets it when there is nothing left to keep.
- *
- * The path out is emptying the box, which is what sending does -- so a sent message removes its own
- * entry and nothing accumulates for a session in ordinary use. A session *deleted* while it held a
- * draft does leave its key behind: pruning those means a pass over the live session list, which
- * this file would otherwise have no reason to know about, and the residue is a few bytes per
- * session ever abandoned mid-sentence. That is a trade rather than an oversight.
- */
-fun saveDraft(context: Context, sessionId: String, text: String) {
-    context.getSharedPreferences(DRAFTS, Context.MODE_PRIVATE).edit {
-        if (text.isEmpty()) remove(sessionId) else putString(sessionId, text)
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/EventStream.kt

@@ -1,38 +0,0 @@
-package com.example.aiapp
-
-/**
- * The frame name the server uses to say a cursor was too far behind to continue from. Must match
- * `send_backlog` in the backend's routes.rs.
- */
-private const val RESET_EVENT = "reset"
-
-/**
- * The SSE half of the API: one long-lived GET per open session screen, replaying the transcript
- * after a cursor and then following it live.
- *
- * The connection and its framing belong to [Sse]; what stays here is what this stream's frames
- * mean. [close] from any thread ends it, and the caller owns reconnecting -- with the last seq it
- * saw as the new cursor. See SessionScreen.
- */
-class EventStream(settings: ServerSettings, private val sessionId: String) {
-    private val stream = Sse(settings)
-
-    fun close() = stream.close()
-
-    /**
-     * Streams events after [after] into [onEvent] until the stream drops.
-     *
-     * [onReset] fires when the server answers that the cursor is too far behind to continue from:
-     * everything already displayed is stale and the events that follow are a fresh window, so the
-     * caller drops what it holds and rebuilds -- the same thing it does when the screen opens. It
-     * arrives before those events, so a caller that clears on it stays in order.
-     */
-    fun run(after: Long, onOpen: () -> Unit, onReset: () -> Unit, onEvent: (SeqEvent) -> Unit) {
-        stream.run("/sessions/$sessionId/events?after=$after", onOpen) { name, data ->
-            // A named frame carries no payload and a data frame has no name, so this is one or
-            // the other.
-            if (name == RESET_EVENT) onReset()
-            else if (data.isNotEmpty()) onEvent(parseSeqEvent(data))
-        }
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/Events.kt

@@ -1,318 +0,0 @@
-package com.example.aiapp
-
-import org.json.JSONObject
-
-// The common event model, mirrored from server/src/session/driver.rs --
-// the app renders purely from this stream (replayed from the transcript by
-// cursor, then live), so there is no separate "load history" shape to keep
-// in sync with it.
-
-/** One transcript line: the event plus its resume cursor and time. */
-data class SeqEvent(val seq: Long, val ts: Double, val event: SessionEvent)
-
-/**
- * One choice offered in answer to a question.
- *
- * More than a label because the reader is deciding rather than confirming: what an option means,
- * and what picking it would produce, are the things that decide it. Both are absent on a
- * permission, whose Allow and Deny mean exactly what they say.
- */
-data class QuestionOption(val label: String, val description: String?, val preview: String?)
-
-sealed class SessionEvent {
-    data class UserMessage(
-        val text: String,
-        /**
-         * The [MessageQueued] this resolves, or null when it never waited.
-         *
-         * Matched on rather than the text, because the same message sent twice is two waiting
-         * bubbles and clearing whichever one matched first would leave the wrong one on screen.
-         */
-        val id: String?,
-        /**
-         * What was attached to it, by the ref the files route serves.
-         *
-         * On the message rather than beside it: these arrived as separate image events until
-         * 2026-08-30, which drew somebody's screenshot as a row floating above the bubble that sent
-         * it, and left this app deciding from adjacency alone which message an image went with --
-         * something the sender knew and could simply have said.
-         */
-        val images: List<String>,
-    ) : SessionEvent()
-
-    /**
-     * A message the server has accepted and the session has not read yet.
-     *
-     * From the server, not from this app's memory of what it sent. The pending bubble used to be
-     * screen state, so leaving the session or restarting the app drew nothing waiting while the
-     * message was still queued -- and nothing waiting is what "there is nothing" looks like.
-     *
-     * Resolved by the [UserMessage] carrying the same id, exactly as [CommandQueued] is resolved by
-     * [CommandSent].
-     */
-    data class MessageQueued(val id: String, val text: String, val images: List<String>) :
-        SessionEvent()
-
-    /**
-     * A queued message taken back before the session read it.
-     *
-     * Recorded by the server for the same reason [MessageQueued] is: a phone that reconnects
-     * replays both, and without this one it would put back a bubble for a message that is never
-     * coming -- with nothing left to resolve it, since the [UserMessage] that normally does is
-     * exactly what was cancelled.
-     */
-    data class MessageDropped(val id: String) : SessionEvent()
-
-    data class AssistantText(val delta: String) : SessionEvent()
-
-    data class ToolStart(val id: String, val tool: String, val input: String) : SessionEvent()
-
-    data class ToolUpdate(val id: String, val output: String) : SessionEvent()
-
-    data class ToolEnd(val id: String, val output: String) : SessionEvent()
-
-    data class Image(
-        val ref: String,
-        /** The tool call whose result carried it, or null for a person's own attachment. */
-        val about: String?,
-    ) : SessionEvent()
-
-    data class Question(
-        val id: String,
-        val prompt: String,
-        /** A few words naming what the question is about, when the asker offered one. */
-        val header: String?,
-        val options: List<QuestionOption>,
-        /** Whether several options may be chosen at once. */
-        val multiSelect: Boolean,
-        /** The tool call this is permission for, or null when it is not about one. */
-        val about: String?,
-    ) : SessionEvent()
-
-    /** Everything chosen for one question, in the order it was offered. */
-    data class Answered(val id: String, val answers: List<String>) : SessionEvent()
-
-    /**
-     * A message another agent sent this session.
-     *
-     * Not a [UserMessage]: nobody holding the phone said it, and drawing it in their voice would
-     * claim they had. It is also the explanation for a session that starts working on something
-     * this device never asked for.
-     */
-    data class PeerMessage(
-        val from: String,
-        val text: String,
-        /**
-         * Where the turn this started begins, when the server could say.
-         *
-         * The live Claude Code path only learns a turn was somebody else's when the turn ends, so
-         * the event arrives below everything it caused; this is what puts it back above it. Null
-         * for a message read out of a session file, which is already in the right place, and for
-         * one that started no turn. See the server's `Event::PeerMessage`.
-         */
-        val turnStart: Long? = null,
-    ) : SessionEvent()
-
-    /**
-     * A command the session was asked to run on itself and cannot run yet.
-     *
-     * Resolved by [CommandSent] with the same id. A command that ran straight away has only that
-     * one, so nothing here ever draws a bubble that resolves in the same frame.
-     */
-    data class CommandQueued(val id: String, val text: String) : SessionEvent()
-
-    /** The same command, handed to the session. */
-    data class CommandSent(val id: String, val text: String) : SessionEvent()
-
-    data class Status(val state: String) : SessionEvent()
-
-    /**
-     * What the session is set to, as the session itself reports it.
-     *
-     * Either field alone: the two are confirmed separately and by different things. Asking for a
-     * change is not having one, so this -- not the request -- is what the pickers show.
-     */
-    data class Settings(val model: String?, val permissionMode: String?) : SessionEvent()
-
-    /**
-     * What a turn cost, and how much the model was holding when it ended.
-     *
-     * [context] is prompt plus both cache figures, measured by the backend from the turn's own
-     * usage. Carried on the event rather than summed by the reader, because it is not a sum: a
-     * conversation's context drops at a compaction and a clear, so adding turns up would report a
-     * figure the session stopped being true of. Null where the dialect did not say, and on entries
-     * recorded before the backend sent it -- which leaves the context unmeasured rather than
-     * unchanged.
-     */
-    data class UsageDelta(val tokens: Long, val context: Long?) : SessionEvent()
-
-    /**
-     * A compaction that finished, and how much context it recovered.
-     *
-     * The counts are nullable because the server sends them only when it was told them: a
-     * compaction whose size nobody measured has to be able to say so, since a zero here would read
-     * as "recovered nothing" and a made-up number would read as a measurement.
-     */
-    data class Compacted(
-        val preTokens: Long?,
-        val postTokens: Long?,
-        /** What asked for it, in the CLI's own word; `auto` is the one worth naming. */
-        val trigger: String?,
-    ) : SessionEvent()
-
-    /**
-     * The conversation was cleared. Everything above this is still here to read and is no longer in
-     * the session's context.
-     *
-     * An object rather than a class because it carries nothing: what it means is entirely its
-     * position in the transcript.
-     */
-    data object Cleared : SessionEvent()
-
-    data class Error(val message: String) : SessionEvent()
-
-    /**
-     * An event type this app build doesn't know -- a newer server. Kept (not thrown) so one new
-     * event kind degrades to a placeholder row instead of killing the stream.
-     */
-    data class Unknown(val type: String) : SessionEvent()
-}
-
-/**
- * A JSON array of strings under [name], empty when the field is absent.
- *
- * Absent is the ordinary case -- most messages carry no attachment, and the server omits the field
- * rather than sending an empty list -- so this is the shape every caller wants.
- */
-private fun JSONObject.stringList(name: String): List<String> {
-    val array = optJSONArray(name) ?: return emptyList()
-    return (0 until array.length()).map { array.getString(it) }
-}
-
-fun parseSeqEvent(json: String): SeqEvent {
-    val body = JSONObject(json)
-    val event =
-        when (val type = body.getString("type")) {
-            "userMessage" ->
-                SessionEvent.UserMessage(
-                    body.getString("text"),
-                    body.optString("id").ifEmpty { null },
-                    body.stringList("images"),
-                )
-            "messageQueued" ->
-                SessionEvent.MessageQueued(
-                    body.getString("id"),
-                    body.getString("text"),
-                    body.stringList("images"),
-                )
-            "messageDropped" -> SessionEvent.MessageDropped(body.getString("id"))
-            "assistantText" -> SessionEvent.AssistantText(body.getString("delta"))
-            "toolStart" ->
-                SessionEvent.ToolStart(
-                    id = body.getString("id"),
-                    tool = body.getString("tool"),
-                    // Kept as raw JSON text: the input shape is the tool's own
-                    // business, and the UI only ever shows it verbatim.
-                    input = body.get("input").toString(),
-                )
-            "toolUpdate" -> SessionEvent.ToolUpdate(body.getString("id"), body.getString("output"))
-            "toolEnd" -> SessionEvent.ToolEnd(body.getString("id"), body.getString("output"))
-            "image" ->
-                SessionEvent.Image(
-                    ref = body.getString("ref"),
-                    about = body.optString("about").ifEmpty { null },
-                )
-            "question" ->
-                SessionEvent.Question(
-                    id = body.getString("id"),
-                    prompt = body.getString("prompt"),
-                    header = body.optString("header").ifEmpty { null },
-                    options =
-                        body.getJSONArray("options").let { options ->
-                            (0 until options.length()).map { at ->
-                                val option = options.getJSONObject(at)
-                                QuestionOption(
-                                    label = option.getString("label"),
-                                    description = option.optString("description").ifEmpty { null },
-                                    preview = option.optString("preview").ifEmpty { null },
-                                )
-                            }
-                        },
-                    multiSelect = body.optBoolean("multiSelect", false),
-                    about = body.optString("about").ifEmpty { null },
-                )
-            "answered" ->
-                SessionEvent.Answered(
-                    body.getString("id"),
-                    body.getJSONArray("answers").let { answers ->
-                        (0 until answers.length()).map { answers.getString(it) }
-                    },
-                )
-            "peerMessage" ->
-                SessionEvent.PeerMessage(
-                    body.getString("from"),
-                    body.getString("text"),
-                    if (body.has("turnStart")) body.getLong("turnStart") else null,
-                )
-            "commandQueued" ->
-                SessionEvent.CommandQueued(body.getString("id"), body.getString("text"))
-            "commandSent" -> SessionEvent.CommandSent(body.getString("id"), body.getString("text"))
-            "status" -> SessionEvent.Status(body.getString("state"))
-            "settings" ->
-                SessionEvent.Settings(
-                    model = body.optString("model").ifEmpty { null },
-                    permissionMode = body.optString("permissionMode").ifEmpty { null },
-                )
-            "usageDelta" ->
-                SessionEvent.UsageDelta(
-                    body.getLong("tokens"),
-                    if (body.has("context")) body.getLong("context") else null,
-                )
-            "compacted" ->
-                SessionEvent.Compacted(
-                    preTokens = if (body.has("preTokens")) body.getLong("preTokens") else null,
-                    postTokens = if (body.has("postTokens")) body.getLong("postTokens") else null,
-                    trigger = body.optString("trigger").ifEmpty { null },
-                )
-            "cleared" -> SessionEvent.Cleared
-            "error" -> SessionEvent.Error(body.getString("message"))
-            else -> SessionEvent.Unknown(type)
-        }
-    return SeqEvent(seq = body.getLong("seq"), ts = body.getDouble("ts"), event = event)
-}
-
-/**
- * The context after [event], given what it was before.
- *
- * The same rule the server folds with, because the screen has to keep up between page loads: the
- * summary it opened with is a measurement from before this stream started, and every event that
- * moves the figure arrives here.
- *
- * The two that lower it are the point. A clear takes the conversation away and a compaction
- * replaces it with a summary, so a figure measured before either stopped being true at that moment
- * -- and carrying it forward is how a session that had just been cleared went on reporting the
- * context it no longer had.
- *
- * Null is "we don't know", which is a state each of them can reach: nothing measured yet, a
- * compaction that finished without saying how much it recovered, or a clear nobody has run a turn
- * since.
- */
-/**
- * Whether [state] is one the session is doing work in -- the states a turn is still open under.
- *
- * One predicate because two readers have to agree on the list: the session screen's working
- * indicator, and the fold's decision that the newest reply is finished
- * ([TranscriptItem.AssistantMsg.settled]). Two copies would drift the first time the server grows a
- * state, and the drift would be a reply that never splits or one split mid-stream.
- */
-fun sessionWorking(state: String): Boolean = state == "running" || state == "compacting"
-
-fun contextAfter(current: Long?, event: SessionEvent): Long? =
-    when (event) {
-        // Falls back to what we had, so a turn the dialect reported no usage for is stale by a
-        // turn -- which every context figure is -- rather than unknown.
-        is SessionEvent.UsageDelta -> event.context ?: current
-        is SessionEvent.Compacted -> event.postTokens
-        is SessionEvent.Cleared -> null
-        else -> current
-    }

app/androidApp/src/main/kotlin/com/example/aiapp/FrameStats.kt

@@ -1,160 +0,0 @@
-package com.example.aiapp
-
-import android.app.Activity
-import android.content.Context
-import android.content.ContextWrapper
-import android.os.Build
-import android.os.Handler
-import android.os.HandlerThread
-import android.view.FrameMetrics
-import android.view.Window
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.DisposableEffect
-import androidx.compose.ui.platform.LocalContext
-
-/**
- * How long each frame took, and which phase of it, taken from the platform rather than from a frame
- * counter of our own.
- *
- * The point of splitting it up is that "the scroll is laggy" has two completely different causes
- * and one appearance. If the layout-and-measure and draw figures are small and the total is large,
- * the time is going into rasterising and compositing, and no amount of doing less work per row will
- * move it. If they are large, the work per row is the problem and it is ours to fix. Guessing
- * between those two is how a day gets spent rewriting the half that was already fast.
- *
- * The phases are the platform's own: [FrameMetrics] reports each frame's cost in nanoseconds,
- * broken down into the parts the UI thread is responsible for -- handling input, running
- * animations, measuring and laying out, recording the draw -- and the parts after it.
- *
- * One of these for the app, like [DebugStats], because the two are read as one report and
- * [drawAccounting] divides one by the other. Held per screen it was emptied by leaving a session
- * and the counters were not, so a report copied after visiting two sessions divided every session's
- * work by the newest one's frame count -- and printed the result as a per-frame measurement. It
- * said 36.8 seconds of placement inside a 13.5 second window, and left "everything else" clamped at
- * 0.00ms (0%), which reads as a screen whose whole cost is this app's own code.
- */
-object FrameStats {
-    private val total = ArrayList<Long>()
-    private val waited = ArrayList<Long>()
-    private val input = ArrayList<Long>()
-    private val animation = ArrayList<Long>()
-    private val layout = ArrayList<Long>()
-    private val draw = ArrayList<Long>()
-    private val sync = ArrayList<Long>()
-    private val issue = ArrayList<Long>()
-    private val swap = ArrayList<Long>()
-    private val gpu = ArrayList<Long>()
-    private var since = System.currentTimeMillis()
-
-    @Synchronized
-    fun add(metrics: FrameMetrics) {
-        // The first frame after a window opens includes inflating it and is nobody's scroll.
-        if (metrics.getMetric(FrameMetrics.FIRST_DRAW_FRAME) == 1L) return
-        if (total.size >= CAP) return
-        total += metrics.getMetric(FrameMetrics.TOTAL_DURATION)
-        // How long the frame waited for the UI thread to be free before it could start. Reported
-        // because the phases otherwise do not add up to the total, and the gap is the interesting
-        // part: it is the frame being held up by work that is not the frame's.
-        waited += metrics.getMetric(FrameMetrics.UNKNOWN_DELAY_DURATION)
-        input += metrics.getMetric(FrameMetrics.INPUT_HANDLING_DURATION)
-        animation += metrics.getMetric(FrameMetrics.ANIMATION_DURATION)
-        layout += metrics.getMetric(FrameMetrics.LAYOUT_MEASURE_DURATION)
-        draw += metrics.getMetric(FrameMetrics.DRAW_DURATION)
-        sync += metrics.getMetric(FrameMetrics.SYNC_DURATION)
-        issue += metrics.getMetric(FrameMetrics.COMMAND_ISSUE_DURATION)
-        swap += metrics.getMetric(FrameMetrics.SWAP_BUFFERS_DURATION)
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
-            gpu += metrics.getMetric(FrameMetrics.GPU_DURATION)
-        }
-    }
-
-    @Synchronized
-    fun reset() {
-        listOf(total, waited, input, animation, layout, draw, sync, issue, swap, gpu).forEach {
-            it.clear()
-        }
-        since = System.currentTimeMillis()
-    }
-
-    @Synchronized
-    fun lines(refreshHz: Float): List<String> {
-        if (total.isEmpty()) return listOf("  no frames recorded -- scroll first, then press this")
-        val seconds = (System.currentTimeMillis() - since) / 1000.0
-        val budget = if (refreshHz > 0) 1000.0 / refreshHz else 16.7
-        val late = total.count { it / 1_000_000.0 > budget }
-        return listOf(
-            "  ${total.size} frames over ${"%.1f".format(seconds)}s" +
-                " at ${"%.0f".format(refreshHz)}Hz (${"%.1f".format(budget)}ms budget)",
-            "  late: $late (${percent(late, total.size)})" +
-                if (total.size >= CAP) "  [capped]" else "",
-            phase("total ", total),
-            phase("waited", waited),
-            phase("input ", input),
-            phase("anim  ", animation),
-            phase("layout", layout),
-            phase("draw  ", draw),
-            phase("sync  ", sync),
-            phase("issue ", issue),
-            phase("swap  ", swap),
-        ) + if (gpu.isEmpty()) emptyList() else listOf(phase("gpu   ", gpu))
-    }
-
-    /** How long the frames recorded here spent in their draw phase, and how many there were. */
-    @Synchronized fun drawPhase(): Pair<Long, Int> = draw.sum() to draw.size
-
-    private fun phase(name: String, samples: List<Long>): String {
-        val sorted = samples.sorted()
-        return "  $name p50 ${at(sorted, 50)}  p90 ${at(sorted, 90)}  p99 ${at(sorted, 99)}"
-    }
-
-    private fun at(sorted: List<Long>, percentile: Int): String {
-        if (sorted.isEmpty()) return "-"
-        val index = (sorted.size - 1) * percentile / 100
-        return "%.1fms".format(sorted[index] / 1_000_000.0)
-    }
-
-    private fun percent(part: Int, whole: Int) = "%.1f%%".format(100.0 * part / whole)
-}
-
-/** Enough for a couple of minutes of scrolling; this is a diagnostic, not a log. */
-private const val CAP = 20_000
-
-/**
- * Records into [FrameStats] for as long as this screen is on it.
- *
- * The listener is what comes and goes; what it writes into does not, so a report covers the same
- * stretch of time as the counters beside it. See [FrameStats].
- *
- * The listener is handed its own thread because the platform calls it for every frame and the
- * documentation is explicit that doing that on the main thread taxes the very thing being measured.
- */
-@Composable
-fun recordFrames() {
-    val window = LocalContext.current.activity()?.window
-    DisposableEffect(window) {
-        if (window == null) return@DisposableEffect onDispose {}
-        val thread = HandlerThread("frame-stats").apply { start() }
-        val listener = Window.OnFrameMetricsAvailableListener { _, metrics, _ ->
-            FrameStats.add(metrics)
-        }
-        window.addOnFrameMetricsAvailableListener(listener, Handler(thread.looper))
-        onDispose {
-            window.removeOnFrameMetricsAvailableListener(listener)
-            thread.quitSafely()
-        }
-    }
-}
-
-/** The activity behind a composable's context, which is what owns the window. */
-fun Context.activity(): Activity? {
-    var context: Context? = this
-    while (context is ContextWrapper) {
-        if (context is Activity) return context
-        context = context.baseContext
-    }
-    return null
-}
-
-/** What the display is actually refreshing at, so "late" is measured against the real budget. */
-fun Context.refreshHz(): Float =
-    @Suppress("DEPRECATION") (activity()?.windowManager?.defaultDisplay?.refreshRate ?: 60f)

app/androidApp/src/main/kotlin/com/example/aiapp/ImportScreen.kt

@@ -1,714 +0,0 @@
-package com.example.aiapp
-
-import androidx.activity.compose.BackHandler
-import androidx.compose.foundation.ExperimentalFoundationApi
-import androidx.compose.foundation.combinedClickable
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.PaddingValues
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.width
-import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.material3.AlertDialog
-import androidx.compose.material3.Card
-import androidx.compose.material3.CardDefaults
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Surface
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.DisposableEffect
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.layout.onSizeChanged
-import androidx.compose.ui.platform.LocalDensity
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.Dp
-import androidx.compose.ui.unit.dp
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-/** What a row says about itself while an operation is running on it. See [BusyItem]. */
-private const val IMPORTING = "importing"
-private const val DELETING = "deleting"
-
-/**
- * What the rows further down a batch say while they wait their turn.
- *
- * Its own word rather than the operation's, because it is its own state and the difference is the
- * kind that matters: nothing has been done to this session yet, so a batch stopped here leaves it
- * exactly as it was. Marked from the moment the batch is handed over all the same -- a queued row
- * that still looked ordinary was still tappable, and tapping it would import it a second time
- * behind the batch already coming for it.
- */
-private const val WAITING = "waiting"
-
-/**
- * How long a row that has just moved ignores being touched.
- *
- * A batch takes rows out of the list as each one lands, so everything below the one that went
- * slides up -- and a tap already on its way then arrives at whichever row moved into that place. On
- * this screen that means importing a session nobody chose, which is not something a second tap can
- * undo.
- *
- * Swallowed silently rather than shown, because anything drawn on every row a batch passes would be
- * a flicker running down the list. Half a second: long enough to cover a tap already travelling
- * when the row moved, short enough that it is not in the way of a deliberate one.
- */
-private const val SETTLE_MS = 500L
-
-/**
- * Continuing a Claude Code session the machine already has.
- *
- * The list is the machine's answer, not this app's: it asks a setup what sessions it holds and
- * shows them. Choosing one sends its **id**, never a path, so an enrolled phone cannot turn this
- * screen into a file reader.
- *
- * Holding a row selects it and puts the screen in selection mode, where the options that act on a
- * selection appear along the bottom. That exists because these arrive in bulk — a machine
- * accumulates dozens of abandoned sessions — and one confirmation dialog per row is the reason
- * clearing them out was not worth doing.
- */
-@OptIn(ExperimentalFoundationApi::class)
-@Composable
-fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (SessionSummary) -> Unit) {
-    val scope = rememberCoroutineScope()
-    var setups by remember { mutableStateOf<LoadState<List<Setup>>>(LoadState.Loading) }
-    var chosen by remember { mutableStateOf<Setup?>(null) }
-    var sessions by remember { mutableStateOf<LoadState<List<Importable>>>(LoadState.Loading) }
-
-    // What is happening to each row right now, as the word the row shows: "importing" or
-    // "deleting". A map keyed by id rather than a flag per row, because the rows are rebuilt from
-    // whatever the server last said and this belongs to the request rather than to the session --
-    // the same arrangement the session list uses for its deletes.
-    var running by remember { mutableStateOf<Map<String, String>>(emptyMap()) }
-    // Which rows the reader has picked out. Empty means selection mode is off: there is no
-    // separate flag, because a selection mode with nothing selected is a state with no controls
-    // in it and no way to leave except Back.
-    var selected by remember { mutableStateOf<Set<String>>(emptySet()) }
-    // Failures that belong to one row rather than to the screen, shown on that row. A batch is
-    // exactly where a single banner fails: nine deletes succeeded and one did not, and the
-    // banner cannot say which.
-    var rowErrors by remember { mutableStateOf<Map<String, String>>(emptyMap()) }
-    // Deleting a transcript cannot be undone, so it is asked rather than done. Held as the rows
-    // themselves, not a flag, so the dialog can say what it is about.
-    var confirming by remember { mutableStateOf<List<Importable>?>(null) }
-    // Same default as the spawn screen, and for the same reason: a phone
-    // is the wrong place to answer "allow Bash?" forty times.
-    var permissionMode by remember { mutableStateOf("auto") }
-    // When each row last slid upwards, as a plain map rather than state: nothing is drawn from
-    // it, so a tap reading it needs no recomposition and there is no timer to cancel when a
-    // second removal lands on top of the first.
-    val movedAt = remember { mutableMapOf<String, Long>() }
-    fun settling(id: String) = System.currentTimeMillis() - (movedAt[id] ?: 0L) < SETTLE_MS
-
-    /**
-     * Fetches the list and takes the row states from it.
-     *
-     * Taken from the answer rather than kept across the load: the server is what knows what is
-     * running, and this screen may be opening on work another screen -- or another phone --
-     * started. Anything held locally would be a second version of that, and the stale one.
-     */
-    suspend fun fetchInto(setup: Setup): LoadState<List<Importable>> =
-        try {
-            val rows = withContext(Dispatchers.IO) { fetchImportable(settings, setup.id) }
-            running = rows.mapNotNull { row -> row.pending?.let { row.id to it } }.toMap()
-            rowErrors = rows.mapNotNull { row -> row.error?.let { row.id to it } }.toMap()
-            LoadState.Loaded(rows)
-        } catch (err: Exception) {
-            LoadState.Error(err.message ?: "Couldn't list sessions")
-        }
-
-    fun loadSessions(setup: Setup) {
-        sessions = LoadState.Loading
-        selected = emptySet()
-        scope.launch { sessions = fetchInto(setup) }
-    }
-
-    /** Takes a row out of the list, once the machine no longer has it to offer. */
-    fun forget(id: String) {
-        val loaded = sessions
-        if (loaded is LoadState.Loaded) {
-            // Only this row, and only what changed -- refetching instead put every other row back
-            // through a loading spinner to report a change that was never in doubt.
-            sessions = LoadState.Loaded(loaded.value.filterNot { it.id == id })
-        }
-    }
-
-    LaunchedEffect(reloadToken) {
-        setups =
-            try {
-                val found = withContext(Dispatchers.IO) { fetchSetups(settings) }
-                found.firstOrNull()?.let {
-                    chosen = it
-                    loadSessions(it)
-                }
-                LoadState.Loaded(found)
-            } catch (err: Exception) {
-                LoadState.Error(err.message ?: "Couldn't list machines")
-            }
-    }
-
-    /**
-     * Hands [targets] to the server in one request, marking every row it covers.
-     *
-     * The request only *starts* the work -- the server runs it and says how each row went on the
-     * change stream, which is what lets this screen be left while a batch is still going. So there
-     * is nothing here to wait for and nothing to sequence: the rows are marked, the batch goes, and
-     * everything after that arrives as an event.
-     *
-     * Marked [WAITING] rather than with the operation's own word until the server confirms. Between
-     * the request leaving and the `started` event coming back, "we have asked" is the truth and "it
-     * is importing" is a guess -- and the row is inert either way, which is the part that matters.
-     *
-     * The selection is dropped as the work is handed over, not when it finishes: the screen goes
-     * back to how it started, and what says the work is happening is the rows it is happening to.
-     */
-    fun handOver(targets: List<Importable>, send: suspend (List<String>) -> Unit) {
-        selected = emptySet()
-        running = running + targets.associate { it.id to WAITING }
-        rowErrors = rowErrors - targets.map { it.id }.toSet()
-        val setup = chosen
-        val ids = targets.map { it.id }
-        scope.launch {
-            // One request for the whole batch, not one per row. Sent row by row, a handover was
-            // only as atomic as the network: the fourth of six could fail, or the screen could be
-            // left with two still unsent, and what came back was some rows running and some
-            // untouched -- indistinguishable, on the list, from rows nobody had picked. Now
-            // either the server has the batch or it has none of it, and this is the one place
-            // that can be true.
-            try {
-                withContext(Dispatchers.IO) { send(ids) }
-            } catch (err: Exception) {
-                // The server never took it, so nothing is running and no event will arrive to say
-                // so. This is the one failure the screen must report itself -- and it is now the
-                // whole batch's failure, which is the point: no row was singled out.
-                running = running - ids.toSet()
-                rowErrors = rowErrors + ids.associateWith { err.message ?: "Couldn't ask" }
-                return@launch
-            }
-
-            // Then ask what actually happened, if anything still looks outstanding.
-            //
-            // The change stream is a broadcast with no memory, so an operation that started and
-            // finished while it was still connecting is one nothing will ever be said about --
-            // and the row sits marked for ever. That is not hypothetical: with responses held
-            // back far enough for the stream to open late, one row of a pair of deletes cleared
-            // and the other stayed on "waiting".
-            //
-            // The listing is the repair, because it carries the same state the events do. Only
-            // when something still looks outstanding, so the ordinary case -- where the events
-            // arrived and the rows are already gone -- does not pay for a second listing, which
-            // is the most expensive call this screen makes.
-            if (setup != null && targets.any { running.containsKey(it.id) }) {
-                // Quietly: no Loading, because blanking the list to report on rows that are
-                // already saying what is happening to them is the flicker this screen avoids
-                // everywhere else.
-                sessions = fetchInto(setup)
-            }
-        }
-    }
-
-    val provider = chosen?.providers?.firstOrNull { it.kind == "claude_cli" }
-
-    /**
-     * Imports [targets], and goes to the session it made when [thenOpen].
-     *
-     * One function for the tap and for the bar, differing in that one flag: continuing a session
-     * and then looking at it is what a tap on a row means, and a batch has several results and no
-     * reason to pick one of them to become the screen.
-     */
-    /** Continues [targets] in the background, leaving the screen where it is. */
-    fun importAll(targets: List<Importable>) {
-        val setup = chosen ?: return
-        val useProvider = provider ?: return
-        handOver(targets) { ids ->
-            startImport(
-                settings,
-                setup = setup.id,
-                sessionIds = ids,
-                provider = useProvider.name,
-                permissionMode = permissionMode,
-            )
-        }
-    }
-
-    /**
-     * Continues one session and goes to it.
-     *
-     * The tap keeps waiting, because "take me there" needs the session it made and the server's
-     * accepted-and-running answer does not carry one. It is one session and somebody is watching
-     * it, which is the case where waiting is the right thing anyway.
-     */
-    fun importAndOpen(target: Importable) {
-        val setup = chosen ?: return
-        val useProvider = provider ?: return
-        running = running + (target.id to IMPORTING)
-        rowErrors = rowErrors - target.id
-        scope.launch {
-            try {
-                val spawned =
-                    withContext(Dispatchers.IO) {
-                        spawnSession(
-                            settings,
-                            setup = setup.id,
-                            provider = useProvider.name,
-                            // Nothing to say: the server titles it from the session it continues.
-                            title = "",
-                            permissionMode = permissionMode,
-                            import = target.id,
-                        )
-                    }
-                forget(target.id)
-                onImported(spawned)
-            } catch (err: Exception) {
-                rowErrors = rowErrors + (target.id to (err.message ?: "Couldn't import that one"))
-            } finally {
-                running = running - target.id
-            }
-        }
-    }
-
-    // Live changes to what the server is doing to these sessions, for as long as this screen is
-    // up. The listing already carried the same state when the screen opened -- this is what keeps
-    // it current afterwards, including for work another screen or another phone started.
-    //
-    // Failures here are deliberately quiet. There is nothing for a reader to do about a dropped
-    // event stream, and nothing is lost by one: every state it would have carried is in the next
-    // listing, which is what Refresh and re-entering the tab already fetch.
-    val liveChanges = remember {
-        java.util.concurrent.atomic.AtomicReference<ImportableStream?>(null)
-    }
-    LaunchedEffect(chosen?.id) {
-        val setup = chosen?.id ?: return@LaunchedEffect
-        try {
-            while (true) {
-                val stream = ImportableStream(settings, setup)
-                liveChanges.set(stream)
-                try {
-                    withContext(Dispatchers.IO) {
-                        stream.run(onOpen = {}) { change ->
-                            when (change.state) {
-                                "started" ->
-                                    running =
-                                        running + (change.session to (change.operation ?: WAITING))
-                                // Gone from the machine either way: a delete removed the
-                                // transcript, an import made it a session, and neither is
-                                // something this list still has to offer.
-                                "finished" -> {
-                                    running = running - change.session
-                                    forget(change.session)
-                                }
-                                "failed" -> {
-                                    running = running - change.session
-                                    rowErrors =
-                                        rowErrors +
-                                            (change.session to (change.message ?: "Didn't work"))
-                                }
-                            }
-                        }
-                    }
-                } catch (e: kotlinx.coroutines.CancellationException) {
-                    // The screen leaving, not a failure -- and swallowing it would leave this
-                    // loop reconnecting to a stream nobody is watching.
-                    throw e
-                } catch (_: Exception) {
-                    // Retried below; the listing is the truth in the meantime.
-                    //
-                    // Any failure, not only an [ApiException]. A stream is an optimisation over
-                    // the listing here, so nothing it can do is worth taking the app down for --
-                    // and catching only the failure that was expected means an unexpected one
-                    // reaches the top of the app and closes it, from a screen that is merely
-                    // loading a list.
-                } finally {
-                    stream.close()
-                }
-                delay(RECONNECT_DELAY_MS)
-            }
-        } finally {
-            // Cancellation cannot interrupt a blocking socket read; closing is what unblocks it.
-            liveChanges.getAndSet(null)?.close()
-        }
-    }
-    // The screen leaving the composition entirely, which the effect above does not cover.
-    DisposableEffect(chosen?.id) { onDispose { liveChanges.get()?.close() } }
-
-    // Back leaves selection mode rather than the tab, which is the level it is one step above.
-    // Nested inside MainScreen's own handler, so it wins while there is a selection.
-    BackHandler(enabled = selected.isNotEmpty()) { selected = emptySet() }
-
-    // Measured rather than assumed: the list reserves exactly what the bar covers, so the last
-    // row can still be scrolled to while it is up, and nothing is nudged by a number that was
-    // right for one font size.
-    var barHeight by remember { mutableStateOf(0.dp) }
-    val density = LocalDensity.current
-
-    Box(Modifier.fillMaxSize()) {
-        Column(Modifier.fillMaxSize().padding(16.dp)) {
-            // No heading: the tab that selected this one already says "Import". The sentence below
-            // stays, because it says what importing *does*, which the tab label cannot.
-            Text(
-                "Sessions Claude Code already has on the machine. Importing continues one where " +
-                    "it left off; the transcript here shows its recent history. Hold one to " +
-                    "select it, and several at a time.",
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-            Spacer(Modifier.height(12.dp))
-
-            when (val loaded = setups) {
-                is LoadState.Loading -> CircularProgressIndicator()
-                is LoadState.Error -> Text(loaded.message, color = MaterialTheme.colorScheme.error)
-                is LoadState.Loaded -> {
-                    // Only worth choosing when there is a choice.
-                    if (loaded.value.size > 1) {
-                        Row(Modifier.fillMaxWidth()) {
-                            loaded.value.forEach { setup ->
-                                TextButton(
-                                    onClick = {
-                                        chosen = setup
-                                        loadSessions(setup)
-                                    }
-                                ) {
-                                    Text(
-                                        setup.name,
-                                        color =
-                                            if (setup.id == chosen?.id)
-                                                MaterialTheme.colorScheme.primary
-                                            else MaterialTheme.colorScheme.onSurfaceVariant,
-                                    )
-                                }
-                            }
-                        }
-                    }
-                    if (chosen != null && provider == null) {
-                        Text(
-                            "${chosen?.name} has no Claude CLI, so there is nothing here to " +
-                                "continue.",
-                            color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        )
-                    } else {
-                        ChipGroup(
-                            label = "Permissions",
-                            options = PERMISSION_MODES,
-                            selected = permissionMode,
-                            onSelect = { permissionMode = it },
-                        )
-                        Spacer(Modifier.height(8.dp))
-                        ImportableList(
-                            state = sessions,
-                            running = running,
-                            settling = ::settling,
-                            selected = selected,
-                            errors = rowErrors,
-                            bottomInset = barHeight,
-                            onToggle = { session ->
-                                selected =
-                                    if (session.id in selected) selected - session.id
-                                    else selected + session.id
-                            },
-                            onOpen = { session -> importAndOpen(session) },
-                        )
-                    }
-                }
-            }
-        }
-
-        // Beside nothing in particular, because a selection is not one row: the options that act
-        // on it belong to the screen, and the bottom is where a thumb already is.
-        if (selected.isNotEmpty()) {
-            val picked =
-                (sessions as? LoadState.Loaded)?.value?.filter { it.id in selected }.orEmpty()
-            SelectionBar(
-                count = picked.size,
-                modifier =
-                    Modifier.align(Alignment.BottomCenter).onSizeChanged {
-                        barHeight = with(density) { it.height.toDp() }
-                    },
-                onDelete = { confirming = picked },
-                onImport = { importAll(picked) },
-            )
-        }
-    }
-
-    confirming?.let { targets ->
-        AlertDialog(
-            onDismissRequest = { confirming = null },
-            title = {
-                Text(
-                    if (targets.size == 1) "Delete this session?"
-                    else "Delete ${targets.size} sessions?"
-                )
-            },
-            text = {
-                Text(
-                    // One name is worth showing and twelve are not, so the count stands in for
-                    // them. The sentence after it is the same either way, because what deleting
-                    // costs does not change with how many.
-                    (if (targets.size == 1) "\"${targets.first().title}\"\n\n" else "") +
-                        "Claude Code keeps no copy: its transcript is the session, so this ends " +
-                        "any chance of resuming that conversation. Sessions already imported " +
-                        "here keep the history they replayed, but cannot be continued."
-                )
-            },
-            confirmButton = {
-                TextButton(
-                    onClick = {
-                        val setup = chosen ?: return@TextButton
-                        confirming = null
-                        handOver(targets) { ids -> deleteImportable(settings, setup.id, ids) }
-                    }
-                ) {
-                    // Coloured by consequence: this takes something away, wherever it appears.
-                    Text("Delete", color = MaterialTheme.colorScheme.error)
-                }
-            },
-            dismissButton = { TextButton(onClick = { confirming = null }) { Text("Cancel") } },
-        )
-    }
-}
-
-/**
- * What can be done to the rows that are selected.
- *
- * Delete and Import only, for now: they are the two things this screen has ever done to a session,
- * and an option that appears here has to work on every row in a selection rather than on the one
- * somebody was thinking of.
- */
-@Composable
-private fun SelectionBar(
-    count: Int,
-    modifier: Modifier = Modifier,
-    onDelete: () -> Unit,
-    onImport: () -> Unit,
-) {
-    Surface(
-        modifier = modifier.fillMaxWidth(),
-        color = MaterialTheme.colorScheme.surfaceContainerHigh,
-        tonalElevation = 3.dp,
-    ) {
-        Row(
-            verticalAlignment = Alignment.CenterVertically,
-            modifier = Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 8.dp),
-        ) {
-            Text(
-                "$count selected",
-                style = MaterialTheme.typography.bodyMedium,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                modifier = Modifier.weight(1f),
-            )
-            TextButton(onClick = onDelete) {
-                Text("Delete", color = MaterialTheme.colorScheme.error)
-            }
-            Spacer(Modifier.width(4.dp))
-            TextButton(onClick = onImport) { Text("Import") }
-        }
-    }
-}
-
-@OptIn(ExperimentalFoundationApi::class)
-@Composable
-private fun ImportableList(
-    state: LoadState<List<Importable>>,
-    /** Rows an operation is running on, as the word each one shows. */
-    running: Map<String, String>,
-    /** Whether this row has just moved and should ignore being touched -- see [SETTLE_MS]. */
-    settling: (String) -> Boolean,
-    selected: Set<String>,
-    errors: Map<String, String>,
-    /** What the selection bar covers, so the last row can still be reached under it. */
-    bottomInset: Dp,
-    onToggle: (Importable) -> Unit,
-    onOpen: (Importable) -> Unit,
-) {
-    when (state) {
-        is LoadState.Loading -> CircularProgressIndicator()
-        is LoadState.Error -> Text(state.message, color = MaterialTheme.colorScheme.error)
-        is LoadState.Loaded ->
-            if (state.value.isEmpty()) {
-                Text(
-                    "No Claude Code sessions on that machine.",
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-            } else {
-                val selecting = selected.isNotEmpty()
-                LazyColumn(
-                    Modifier.fillMaxSize(),
-                    contentPadding = PaddingValues(bottom = bottomInset),
-                ) {
-                    uniqueItems(state.value, key = { it.id }) { session ->
-                        val picked = session.id in selected
-                        BusyItem(label = running[session.id]) {
-                            Card(
-                                colors =
-                                    if (picked)
-                                        CardDefaults.cardColors(
-                                            containerColor =
-                                                MaterialTheme.colorScheme.secondaryContainer,
-                                            contentColor =
-                                                MaterialTheme.colorScheme.onSecondaryContainer,
-                                        )
-                                    else CardDefaults.cardColors(),
-                                modifier =
-                                    Modifier.fillMaxWidth()
-                                        .padding(vertical = 4.dp)
-                                        .combinedClickable(
-                                            // Off while something is happening to this row --
-                                            // see [BusyItem], which draws that but deliberately
-                                            // leaves the gestures alone so the list still
-                                            // scrolls.
-                                            enabled = running[session.id] == null,
-                                            onClick = {
-                                                if (settling(session.id)) return@combinedClickable
-                                                // In selection mode a tap is a selection, so the
-                                                // reader is never one mis-tap away from starting
-                                                // a CLI they were only picking rows for.
-                                                //
-                                                // Outside it, a tap continues the session --
-                                                // except on a row that cannot be continued,
-                                                // where it selects instead. That row's only
-                                                // remaining action is Delete, and a tap that
-                                                // did nothing at all would be a worse answer
-                                                // than one that offers the thing it can do.
-                                                // Two `--resume` processes on one transcript
-                                                // each replay the other's writes, which is why
-                                                // this must not simply try.
-                                                if (selecting || session.inUse == "yes")
-                                                    onToggle(session)
-                                                else onOpen(session)
-                                            },
-                                            onLongClick = {
-                                                if (!settling(session.id)) onToggle(session)
-                                            },
-                                        ),
-                            ) {
-                                Column(Modifier.padding(12.dp)) {
-                                    Row(verticalAlignment = Alignment.Top) {
-                                        Text(
-                                            session.title,
-                                            style = MaterialTheme.typography.bodyLarge,
-                                            modifier = Modifier.weight(1f),
-                                        )
-                                        Spacer(Modifier.width(8.dp))
-                                        // Beside the title, because "which one was I just in" is
-                                        // the question this list answers and the order already
-                                        // reflects it -- the reader should be able to see the
-                                        // ordering they are being given rather than infer it.
-                                        Text(
-                                            relativeTime(session.modified),
-                                            style = MaterialTheme.typography.bodySmall,
-                                            color = MaterialTheme.colorScheme.onSurfaceVariant,
-                                        )
-                                    }
-                                    Spacer(Modifier.height(4.dp))
-                                    // The path first, and the only thing here that is cut: it is
-                                    // one long value with no natural break, where the lines below
-                                    // it are short enough to wrap readably. Cut at the head,
-                                    // because a path is identified by its tail and these all
-                                    // share a long prefix. By the row's real width rather than a
-                                    // character count, which was one guess for every font size
-                                    // and screen.
-                                    session.cwd
-                                        .takeIf { it.isNotEmpty() }
-                                        ?.let { cwd ->
-                                            Text(
-                                                cwd,
-                                                style = MaterialTheme.typography.bodySmall,
-                                                maxLines = 1,
-                                                overflow = TextOverflow.StartEllipsis,
-                                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                                            )
-                                        }
-                                    Text(
-                                        statsOf(session),
-                                        style = MaterialTheme.typography.bodySmall,
-                                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                                    )
-                                    // Its own line and its own colour, because it differs in kind
-                                    // from the stats above rather than in degree: those describe
-                                    // the session, this says whether taking it is safe at all.
-                                    warningOf(session)?.let { warning ->
-                                        Text(
-                                            warning,
-                                            style = MaterialTheme.typography.bodySmall,
-                                            color = warningColor,
-                                        )
-                                    }
-                                    // Reported where it happened, in the server's own words, the
-                                    // way every other failure in this app is shown.
-                                    errors[session.id]?.let { message ->
-                                        Spacer(Modifier.height(4.dp))
-                                        Text(
-                                            message,
-                                            style = MaterialTheme.typography.bodySmall,
-                                            color = MaterialTheme.colorScheme.error,
-                                        )
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-    }
-}
-
-/** A byte count at the coarsest unit that still says something, so rows stay comparable. */
-private fun humanSize(bytes: Long): String? =
-    when {
-        bytes <= 0L -> null
-        bytes >= 1_000_000L -> "${bytes / 1_000_000L} MB"
-        bytes >= 1_000L -> "${bytes / 1_000L} kB"
-        else -> "$bytes B"
-    }
-
-/** What this session is: the measurements, in the order they are worth knowing. */
-private fun statsOf(session: Importable): String =
-    listOfNotNull(
-            // Said, because a name and a last message are different claims: one describes the
-            // session, the other is only what happened last in it.
-            if (session.named) "named" else null,
-            // What continuing it costs, which is the question this list is really asked. First
-            // of the measurements for that reason, and absent rather than zero when nothing has
-            // been measured -- a session with no turns yet has no figure, not a figure of none.
-            session.contextTokens?.let { "${it / 1000}k context" },
-            "${session.lines} lines",
-            // Kept beside the context figure because the two disagree usefully: most of a large
-            // transcript is history from before a compaction, which the model is no longer
-            // given, so a big file can be cheap to continue and a small one expensive.
-            humanSize(session.bytes),
-        )
-        .joinToString(" · ")
-
-/**
- * Why this session might not be safe to take, if it isn't.
- *
- * Words rather than only a colour: "open somewhere else" and "we could not check" differ in kind,
- * and no shade distinguishes them. The colour is what makes it findable; the words are what make it
- * actionable.
- */
-private fun warningOf(session: Importable): String? =
-    when (session.inUse) {
-        // What was measured is that a live process on that machine holds this session open. Which
-        // process is not measured, so it isn't claimed: "a terminal — close it there first" sent
-        // people looking for a window that need not exist. It is just as likely another agent, or
-        // this app on a session it spawned. Naming a place the reader then can't find turns a
-        // correct refusal into a wrong instruction.
-        "yes" -> "something on that machine is running it"
-        "unknown" -> "can't tell if it's open"
-        else -> null
-    }

app/androidApp/src/main/kotlin/com/example/aiapp/ImportableStream.kt

@@ -1,25 +0,0 @@
-package com.example.aiapp
-
-/**
- * What a machine's Claude Code sessions are having done to them, live.
- *
- * The import screen starts and then leaves work behind: the server runs it, so the phone that asked
- * is free to go elsewhere and the answer arrives here rather than as a reply. What the screen shows
- * on arrival comes from the listing, which carries the same state for whoever was not connected
- * when it changed; this is only what keeps a screen somebody is watching current.
- *
- * The connection and its framing belong to [Sse]. Closing is the caller's cancellation path, and
- * the caller owns reconnecting -- there is no cursor to resume from, because anything missed is in
- * the next listing.
- */
-class ImportableStream(settings: ServerSettings, private val setup: String) {
-    private val stream = Sse(settings)
-
-    fun close() = stream.close()
-
-    fun run(onOpen: () -> Unit, onChange: (ImportableChange) -> Unit) {
-        stream.run("/setups/$setup/importable/events", onOpen) { _, data ->
-            if (data.isNotEmpty()) parseImportableChange(data)?.let(onChange)
-        }
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/LoadState.kt

@@ -1,28 +0,0 @@
-package com.example.aiapp
-
-/**
- * What a screen knows about something it had to fetch: still finding out, got it, or couldn't.
- *
- * Three states rather than a value alongside a nullable error, because "we couldn't find out" must
- * not share a representation with "there is nothing" -- a failed fetch would otherwise render as an
- * empty list, which is the one wrong answer that looks like a right one.
- *
- * [Loading] and [Error] carry no payload, so they are `LoadState<Nothing>` and this is covariant in
- * [T]: one `LoadState.Loading` serves every screen rather than each needing its own.
- */
-sealed class LoadState<out T> {
-    data object Loading : LoadState<Nothing>()
-
-    data class Loaded<out T>(val value: T) : LoadState<T>()
-
-    data class Error(val message: String) : LoadState<Nothing>()
-
-    companion object {
-        /**
-         * The failure a fetch produces. Api.kt writes its messages to be read on this screen, so
-         * this passes one through rather than replacing it; the fallback covers only a throwable
-         * with no message at all, which [ApiException] never is.
-         */
-        fun failed(e: ApiException): Error = Error(e.message ?: "Unknown error")
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/MainActivity.kt

@@ -1,184 +0,0 @@
-package com.example.aiapp
-
-import android.Manifest
-import android.content.Intent
-import android.os.Build
-import android.os.Bundle
-import android.widget.Toast
-import androidx.activity.ComponentActivity
-import androidx.activity.compose.setContent
-import androidx.activity.enableEdgeToEdge
-import androidx.activity.result.contract.ActivityResultContracts
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.navigationBarsPadding
-import androidx.compose.foundation.layout.statusBarsPadding
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Surface
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableIntStateOf
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.drawWithContent
-import androidx.compose.ui.graphics.luminance
-import androidx.compose.ui.layout.layout
-import androidx.core.view.WindowCompat
-
-class MainActivity : ComponentActivity() {
-    // Bumped whenever enrollment lands via an aiapp:// intent so the
-    // composition below re-reads the stored settings.
-    private var settingsVersion by mutableIntStateOf(0)
-
-    // The session a notification tap asked for, or null if nothing has. The
-    // serial is what makes a second tap on the same session's notification a
-    // second request: without it the two compare equal and the composition
-    // below has nothing to react to.
-    private var openRequest by mutableStateOf<SessionOpenRequest?>(null)
-    private var opens = 0
-
-    // Registered up front since permission launchers must be registered
-    // before the activity reaches STARTED.
-    private val requestLocalNetworkPermission =
-        registerForActivityResult(ActivityResultContracts.RequestPermission()) {}
-
-    /**
-     * The service starts either way, and posts nothing if this is refused.
-     *
-     * Deliberately not gated on the answer: the permission can be granted later from Android's own
-     * settings, and a service that only ever started at the moment it was granted would then stay
-     * down until the app was launched again -- which is the case notifications exist to avoid.
-     */
-    private val requestNotificationPermission =
-        registerForActivityResult(ActivityResultContracts.RequestPermission()) {}
-
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-
-        // Before anything else that could throw, so the first crash of a launch is caught too.
-        installCrashLog(this)
-
-        // Transparent status bar on every version; the Surface below paints
-        // through underneath it and content insets itself. Same reasoning
-        // as dev-updater's MainActivity.
-        enableEdgeToEdge()
-        // Dark status-bar icons only over a light background, decided from the scheme rather
-        // than fixed. It was hardcoded to `true` -- dark icons -- which was right against the
-        // default light surface and became unreadable the moment the app wore Catppuccin Mocha.
-        // Asking the colour means a future palette change cannot reintroduce that: whatever
-        // `background` becomes, the icons follow it.
-        WindowCompat.getInsetsController(window, window.decorView).isAppearanceLightStatusBars =
-            AiAppColors.background.luminance() > 0.5f
-
-        // Android 17+ silently drops local-network traffic without this;
-        // requested up front because a denial is invisible at the socket
-        // layer (it just times out).
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.CINNAMON_BUN) {
-            requestLocalNetworkPermission.launch(Manifest.permission.ACCESS_LOCAL_NETWORK)
-        }
-
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
-            requestNotificationPermission.launch(Manifest.permission.POST_NOTIFICATIONS)
-        }
-
-        handleIntent(intent)
-        // After enrollment, so a first launch that arrives with a token
-        // starts the service with something to connect to rather than
-        // stopping it and waiting for the next launch.
-        NotificationService.sync(this)
-
-        setContent {
-            MaterialTheme(colorScheme = AiAppColors) {
-                Surface(modifier = Modifier.fillMaxSize()) {
-                    Box(
-                        modifier =
-                            // Timed like the transcript times itself, and for the same reason:
-                            // the frame's draw phase is where Compose's measurement lands, and
-                            // a report saying "draw is high" cannot otherwise say whether the
-                            // cost is the transcript or the chrome around it. The keyboard is
-                            // the case that made it matter -- every frame of the IME animation
-                            // relays out and re-records this whole box.
-                            Modifier.layout { measurable, constraints ->
-                                    val started = System.nanoTime()
-                                    val placeable = measurable.measure(constraints)
-                                    DebugStats.record(
-                                        "measure: the app root",
-                                        System.nanoTime() - started,
-                                    )
-                                    layout(placeable.width, placeable.height) {
-                                        val placing = System.nanoTime()
-                                        placeable.place(0, 0)
-                                        DebugStats.record(
-                                            "place: the app root",
-                                            System.nanoTime() - placing,
-                                        )
-                                    }
-                                }
-                                .drawWithContent {
-                                    val started = System.nanoTime()
-                                    drawContent()
-                                    DebugStats.record(
-                                        "record: the app root",
-                                        System.nanoTime() - started,
-                                    )
-                                }
-                                .fillMaxSize()
-                                .statusBarsPadding()
-                                // The gesture strip at the bottom of most
-                                // phones. Without it the send row sits under
-                                // the swipe area, where a tap is as likely to
-                                // navigate away as to press a button.
-                                //
-                                // No imePadding here, deliberately: applied at the root it
-                                // resizes this whole box on every frame of the keyboard
-                                // animation, which re-measures, re-places and re-records every
-                                // screen's entire tree per frame -- measured above as most of
-                                // the frame budget. Each screen takes the keyboard itself
-                                // (AppRoot wraps the ordinary ones; the session screen moves
-                                // only its composer and transcript), so the per-frame cost is
-                                // scoped to what actually moves.
-                                .navigationBarsPadding()
-                    ) {
-                        AppRoot(settingsVersion, openRequest)
-                    }
-                }
-            }
-        }
-    }
-
-    // launchMode="singleTop": an enrollment scan, or a notification tapped
-    // while the app is open, lands here rather than in a second activity
-    // instance.
-    override fun onNewIntent(intent: Intent) {
-        super.onNewIntent(intent)
-        handleIntent(intent)
-    }
-
-    /**
-     * The one place an incoming `aiapp://` URI is sorted into what it means.
-     *
-     * Two things arrive this way -- an enrollment code and a notification naming a session -- and
-     * they are told apart by the URI's host rather than by two entry points, so a third kind is a
-     * branch here rather than another intent to remember to handle.
-     */
-    private fun handleIntent(intent: Intent?) {
-        val uri = intent?.data ?: return
-        val sessionId = notifiedSessionId(uri)
-        if (sessionId != null) {
-            opens++
-            openRequest = SessionOpenRequest(sessionId, opens)
-            return
-        }
-        val settings = parseEnrollmentUri(uri)
-        if (settings == null) {
-            Toast.makeText(this, "Not a valid enrollment code", Toast.LENGTH_LONG).show()
-            return
-        }
-        saveServerSettings(this, settings)
-        settingsVersion++
-        // Enrolling is the moment there is a backend to watch, and
-        // re-enrolling elsewhere is the moment the old one stops being it.
-        NotificationService.sync(this)
-        Toast.makeText(this, "Enrolled with ${settings.baseUrl}", Toast.LENGTH_LONG).show()
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/MainScreen.kt

@@ -1,140 +0,0 @@
-package com.example.aiapp
-
-import androidx.activity.compose.BackHandler
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.PrimaryTabRow
-import androidx.compose.material3.Tab
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableIntStateOf
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.unit.dp
-import androidx.lifecycle.Lifecycle
-import androidx.lifecycle.compose.LocalLifecycleOwner
-import androidx.lifecycle.repeatOnLifecycle
-
-/**
- * The app's root: one title, and four views of the backend behind it.
- *
- * These were four screens reached by four words in a row under the title, and the row was already
- * full -- the comment it replaced recorded that a fifth would have to go somewhere else. Tabs say
- * the same thing in less space and say one more thing besides: that these are places to be rather
- * than errands to run. Sessions, the machine's importable history, the models on it and the
- * machines themselves are all *the same backend*, looked at four ways, and none of them is a step
- * down from another. Settings still is a step down, which is why it stays a pushed screen and keeps
- * its own Back.
- */
-private enum class MainTab(val label: String) {
-    Sessions("Sessions"),
-    Import("Import"),
-    Models("Models"),
-    Setups("Setups"),
-}
-
-@Composable
-fun MainScreen(
-    settings: ServerSettings,
-    reloadToken: Int,
-    onOpen: (SessionSummary) -> Unit,
-    onSpawn: () -> Unit,
-    onImported: (SessionSummary) -> Unit,
-    onSettings: () -> Unit,
-) {
-    var tab by remember { mutableStateOf(MainTab.Sessions) }
-    var refreshToken by remember { mutableIntStateOf(0) }
-
-    // Coming back to the app asks again, on whichever tab is showing.
-    //
-    // What these four draw is a snapshot of a backend they are not connected to, so it is only as
-    // fresh as the last answer -- and a *failed* answer is the one that outstays its welcome. A
-    // phone that was away while the tunnel was down, or that fetched before the network came up,
-    // came back to "Couldn't reach the server" sitting at the top of a list the server would now
-    // answer for perfectly well, and nothing took it off until somebody pressed Refresh. A stale
-    // failure is worse than a stale list: it is a claim about right now.
-    //
-    // Through the same token the Refresh button uses, so this is one instruction the tabs already
-    // understand rather than a second path into each of them -- which is also what makes it cover
-    // all four rather than the one the report came from.
-    //
-    // Not on the first entry: the tab composing already asks, and bumping here would make every
-    // cold start fetch twice.
-    val lifecycleOwner = LocalLifecycleOwner.current
-    LaunchedEffect(lifecycleOwner) {
-        var opening = true
-        lifecycleOwner.repeatOnLifecycle(Lifecycle.State.STARTED) {
-            if (!opening) refreshToken++
-            opening = false
-        }
-    }
-
-    // A tab the app put over the list has to step back to it rather than fall through to the
-    // system default, which closes the app -- that reads as a crash to somebody who only meant to
-    // get back to their sessions. Nested inside AppRoot's handler, so it wins while it is enabled.
-    BackHandler(enabled = tab != MainTab.Sessions) { tab = MainTab.Sessions }
-
-    Column(Modifier.fillMaxSize()) {
-        Row(
-            verticalAlignment = Alignment.CenterVertically,
-            modifier = Modifier.fillMaxWidth().padding(start = 16.dp, end = 16.dp, top = 16.dp),
-        ) {
-            Text(
-                "AI Sessions",
-                style = MaterialTheme.typography.headlineSmall,
-                modifier = Modifier.weight(1f),
-            )
-            // Glyphs rather than the words they replaced: neither ever changes, both are read
-            // faster than they are spelled, and together they take the width that let the title
-            // keep its own line. They sit on the title's row because they act on the whole
-            // screen -- everything below this row is one tab's business, and a control belongs
-            // with the thing it acts on.
-            // Flush against each other: a glyph button carries its own padding, so two of them
-            // side by side already have two rings between their marks and one ring plus this
-            // row's padding to the screen edge.
-            Row {
-                GlyphButton(REFRESH_GLYPH, "Refresh", { refreshToken++ })
-                GlyphButton(SETTINGS_GLYPH, "Settings", onSettings)
-            }
-        }
-        // Primary rather than the plain TabRow, which is deprecated in favour of the two that
-        // say where they sit: these are the app's top-level destinations.
-        PrimaryTabRow(selectedTabIndex = tab.ordinal) {
-            MainTab.entries.forEach { entry ->
-                Tab(
-                    selected = tab == entry,
-                    onClick = { tab = entry },
-                    text = { Text(entry.label) },
-                )
-            }
-        }
-
-        // Refreshing means "ask again about what I am looking at", so the button feeds the tab
-        // that is showing. The token from above means something else already changed what these
-        // show; the two are the same instruction to the tab below, so they are summed rather than
-        // tracked apart -- either one moving moves the sum, which is all a tab watches.
-        val token = reloadToken + refreshToken
-        when (tab) {
-            MainTab.Sessions ->
-                SessionListScreen(
-                    settings = settings,
-                    reloadToken = token,
-                    onOpen = onOpen,
-                    onSpawn = onSpawn,
-                )
-            MainTab.Import ->
-                ImportScreen(settings = settings, reloadToken = token, onImported = onImported)
-            MainTab.Models -> ModelsScreen(settings = settings, reloadToken = token)
-            MainTab.Setups -> SetupsScreen(settings = settings, reloadToken = token)
-        }
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/Markdown.kt

@@ -1,372 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.Stable
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.text.TextLinkStyles
-import androidx.compose.ui.text.TextStyle
-import androidx.compose.ui.text.font.FontFamily
-import androidx.compose.ui.text.style.TextDecoration
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.Dp
-import androidx.compose.ui.unit.TextUnit
-import androidx.compose.ui.unit.dp
-import com.mikepenz.markdown.compose.components.markdownComponents
-import com.mikepenz.markdown.compose.elements.MarkdownTable
-import com.mikepenz.markdown.compose.elements.MarkdownTableHeader
-import com.mikepenz.markdown.compose.elements.MarkdownTableRow
-import com.mikepenz.markdown.m3.Markdown
-import com.mikepenz.markdown.m3.elements.MarkdownCheckBox
-import com.mikepenz.markdown.m3.markdownColor
-import com.mikepenz.markdown.m3.markdownTypography
-import com.mikepenz.markdown.model.State
-import com.mikepenz.markdown.model.markdownDimens
-import com.mikepenz.markdown.model.parseMarkdown
-import java.util.concurrent.ConcurrentHashMap
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.withContext
-import org.intellij.markdown.ast.ASTNode
-
-/**
- * An assistant's reply, rendered as the markdown it is written in.
- *
- * The parsing is the library's. Markdown is somebody else's specification, and a hand-written
- * subset of one disagrees with it at the edges -- which is where the bug reports come from, one
- * case at a time. This file's whole job is the mapping onto the app's palette and type scale.
- *
- * Colours come from the theme rather than from the renderer's defaults, so code, links and rules
- * are the same Catppuccin values the rest of the app uses. Nothing here picks a colour of its own.
- */
-@Composable
-fun MarkdownText(text: String, replies: ParsedReplies, modifier: Modifier = Modifier) {
-    val body = MaterialTheme.typography.bodyLarge
-    val parsed = parsedMarkdown(text, replies)
-    Markdown(
-        parsed,
-        colors =
-            markdownColor(
-                text = MaterialTheme.colorScheme.onSurface,
-                dividerColor = MaterialTheme.colorScheme.outlineVariant,
-                // The dark surface every verbatim thing in this app sits on -- see [rawSurface],
-                // and the tool call above this reply, which now matches. `surfaceVariant` was
-                // exactly a card's own fill, so a fenced block inside a tool call had no
-                // background at all and one in a reply read as a step *up* out of the page.
-                codeBackground = rawSurface,
-                inlineCodeBackground = rawSurface,
-                // The same tint a code block gets, rather than the renderer's 2%-alpha default:
-                // two adjacent tints that differ by a fiftieth read as one flat block on a phone,
-                // so the table would have had a border-less grid and nothing saying where it began.
-                tableBackground = MaterialTheme.colorScheme.surfaceVariant,
-            ),
-        typography =
-            markdownTypography(
-                // A ladder that starts near the body text and descends, because these are headings
-                // inside a chat message rather than the top of a document. The renderer's defaults
-                // are the Material *display* styles -- `#` came out at 57sp and `##` at 45sp, which
-                // is bigger than this app's own screen titles and reads as the reply shouting.
-                //
-                // Every step is a different size, so two levels of nesting never draw the same:
-                // one clear step per level is the whole job of a heading.
-                h1 = MaterialTheme.typography.headlineSmall,
-                h2 = MaterialTheme.typography.titleLarge,
-                h3 = MaterialTheme.typography.titleMedium,
-                h4 = MaterialTheme.typography.titleSmall,
-                h5 = MaterialTheme.typography.labelMedium,
-                h6 = MaterialTheme.typography.labelSmall,
-                // Body text at the size everything else in the transcript uses.
-                text = body,
-                paragraph = body,
-                ordered = body,
-                bullet = body,
-                list = body,
-                table = body,
-                // Code in a monospace face, in the ordinary text colour. The face and the tinted
-                // background are what say "this is code"; colour is not, and it used to be green
-                // -- the palette's colour for a *literal*. A block of code is not a literal, it
-                // is text that happens to be code, and painting all of it green said the whole
-                // block was one. Where a literal really does appear inside code, the thing that
-                // should colour it is a syntax highlighter looking at the code, which is exactly
-                // what a tool call's input already gets from `catppuccinSyntax`.
-                //
-                // The colour rides on the style here rather than in `markdownColor`, which
-                // stopped carrying `codeText`/`inlineCodeText`/`linkText` when the renderer moved
-                // them onto the typography.
-                code =
-                    MaterialTheme.typography.bodyMedium.copy(
-                        fontFamily = FontFamily.Monospace,
-                        color = MaterialTheme.colorScheme.onSurface,
-                    ),
-                inlineCode =
-                    body.copy(
-                        fontFamily = FontFamily.Monospace,
-                        // Unspecified so an inline span keeps the size of the line it sits in.
-                        fontSize = TextUnit.Unspecified,
-                        color = MaterialTheme.colorScheme.onSurface,
-                    ),
-                textLink =
-                    TextLinkStyles(
-                        style =
-                            body
-                                .copy(
-                                    color = linkColor,
-                                    textDecoration = TextDecoration.Underline,
-                                )
-                                .toSpanStyle()
-                    ),
-            ),
-        dimens =
-            markdownDimens(
-                // Half the renderer's 16dp. Padding is charged on both sides of every cell, so at
-                // the default a fifth of the narrowest column went on space rather than on words
-                // -- and the narrowest column is where the wrapping below has the least room.
-                tableCellPadding = 8.dp,
-                // What a column narrows to before the table starts scrolling sideways instead. It
-                // is the floor, not the width: a table with room to spare spreads across it.
-                //
-                // Down from the renderer's 160dp, and the number is a measurement rather than a
-                // taste. A phone is about 410-450dp wide and a card takes some of that, so 160dp
-                // makes even a three-column table -- the commonest shape there is -- scroll, while
-                // 136dp fits three across the phone this app is read on. Four and up still scroll,
-                // which is the right answer for genuinely too many columns: squeezing six columns
-                // into a phone would give every cell one word per line.
-                //
-                // Narrower would fit more, and stop being readable. This is the widest minimum
-                // that keeps three columns on screen, which is the trade the number is making.
-                tableCellWidth = 136.dp,
-            ),
-        components =
-            markdownComponents(
-                // The m3 renderer's own default, restored: supplying `components` at all replaces
-                // the whole set, and this is the only member of it the Material layer overrides.
-                checkbox = { MarkdownCheckBox(it.content, it.node, it.typography.text) },
-                // Everything that draws a run of text, so a link is a span rather than a node --
-                // see [LinkedText]. Setext headings take the same styles as `#` and `##`, which
-                // is the renderer's own pairing.
-                text = { LinkedText(it, it.typography.text) },
-                paragraph = { LinkedText(it, it.typography.paragraph) },
-                heading1 = { LinkedText(it, it.typography.h1, heading = true) },
-                heading2 = { LinkedText(it, it.typography.h2, heading = true) },
-                heading3 = { LinkedText(it, it.typography.h3, heading = true) },
-                heading4 = { LinkedText(it, it.typography.h4, heading = true) },
-                heading5 = { LinkedText(it, it.typography.h5, heading = true) },
-                heading6 = { LinkedText(it, it.typography.h6, heading = true) },
-                setextHeading1 = { LinkedText(it, it.typography.h1, heading = true) },
-                setextHeading2 = { LinkedText(it, it.typography.h2, heading = true) },
-                table = {
-                    MarkdownTable(
-                        it.content,
-                        it.node,
-                        style = it.typography.table,
-                        headerBlock = ::WrappingTableHeader,
-                        rowBlock = ::WrappingTableRow,
-                    )
-                },
-            ),
-        modifier = modifier,
-    )
-}
-
-/**
- * A table header, and a table row, whose cells wrap rather than being cut off.
- *
- * The renderer draws every cell at `maxLines = 1` with an ellipsis, which on a phone means most of
- * a table is simply not readable: a column is 160dp at its narrowest, so anything past about twenty
- * characters ends in "..." with no way to see the rest. Nothing about the value says it was cut,
- * either -- an elided cell looks like a short one, so a table of measurements reads as a table of
- * plausible shorter measurements.
- *
- * So: as many lines as the cell needs, and [TextOverflow.Clip] rather than an ellipsis, which now
- * never has anything to hide since the height grows to fit. Cells align to the top of the row,
- * because a two-line cell beside a one-line one centred the short one against the middle of the
- * tall one and lost the line the reader was reading across.
- *
- * What the wrapping does *not* do is make a wide table fit. The renderer already gives each column
- * a 160dp minimum and scrolls the whole table sideways when they do not fit the screen, which is
- * the right answer for too many columns -- wrapping a six-column table into the width of a phone
- * would give every cell one word per line. The two work together: the width is what the columns
- * need, and the wrapping is what fills the space that width provides.
- *
- * Two functions rather than one because the renderer's header and row are separate composables --
- * the header is bold and sizes itself to its tallest cell -- and the parameters that matter here
- * are the same three in both.
- */
-@Composable
-private fun WrappingTableHeader(
-    content: String,
-    header: ASTNode,
-    tableWidth: Dp,
-    style: TextStyle,
-) {
-    MarkdownTableHeader(
-        content = content,
-        header = header,
-        tableWidth = tableWidth,
-        style = style,
-        verticalAlignment = Alignment.Top,
-        maxLines = Int.MAX_VALUE,
-        overflow = TextOverflow.Clip,
-    )
-}
-
-@Composable
-private fun WrappingTableRow(content: String, row: ASTNode, tableWidth: Dp, style: TextStyle) {
-    MarkdownTableRow(
-        content = content,
-        header = row,
-        tableWidth = tableWidth,
-        style = style,
-        verticalAlignment = Alignment.Top,
-        maxLines = Int.MAX_VALUE,
-        overflow = TextOverflow.Clip,
-    )
-}
-
-/**
- * [text] parsed: on the composing thread the first time this row is drawn, and off it every time
- * afterwards.
- *
- * The first parse has to be inline. The renderer's own asynchronous path draws an empty loading
- * slot until its result arrives, so a row is measured at nothing before it is measured at its real
- * height, and the transcript above it collapses and springs back. Seen with five replies on screen
- * at once, every one of them blank, the whole conversation shrunk to fit a single screen; a moment
- * later it was all there again. That is the "skipping up and down" this list must never do, and no
- * amount of scroll anchoring can survive a row that lies about its height first.
- *
- * Every parse *after* the first is a different case, and it is the one that was costing: a reply
- * arrives as hundreds of deltas, each one re-parsing the whole message it has grown into. Measured
- * against `/stream 200` on the emulator, that was fifty-eight parses and 78ms of main-thread work
- * in three seconds, with single parses reaching 7ms -- most of a frame at 60Hz and more than one at
- * 120. Those go to a background thread, and the row keeps drawing the parse it already has until
- *      the new one lands, so there is never a frame without a height. What is on screen is always a
- *      real prefix of the reply rather than a guess at it; it is simply one parse behind.
- */
-@Composable
-private fun parsedMarkdown(text: String, replies: ParsedReplies): State {
-    // The text each parse came from, so the first composition's is not immediately repeated.
-    val parsed = remember { mutableStateOf(text to replies.of(text)) }
-    LaunchedEffect(text) {
-        if (parsed.value.first == text) return@LaunchedEffect
-        // Not through [replies]: this is a reply still arriving, and every delta would leave
-        // another copy of a message that is about to be superseded.
-        parsed.value =
-            text to
-                withContext(Dispatchers.Default) {
-                    DebugStats.timed("markdown reparsed while streaming") { parseMarkdown(text) }
-                }
-    }
-    return parsed.value.second
-}
-
-/**
- * Replies parsed before the row that draws them is composed.
- *
- * Parsing is the expensive half of drawing a reply, and it is expensive in proportion to how much
- * was written. Measured against a real Claude Code transcript on the emulator, one message took
- * **51ms** and several took 10-25ms, against 4.6ms for the short synthetic replies this was first
- * tuned on -- so a page of history landing composed several rows that each stalled the frame they
- * appeared in. That is the lag when a block loads.
- *
- * Nothing here changes what a row does when it has no answer waiting: it parses inline, on the
- * composing thread, because a row measured at nothing before it is measured at its real height
- * collapses the transcript above it. The point is only that by the time the reader scrolls to a
- * row, the answer is usually already made -- [warm] runs on a background thread as each page of
- * history arrives, which is seconds before anybody reaches the rows it brought.
- *
- * A miss is not stored, and that is what bounds this: the map holds one entry per message a page
- * warmed and nothing else, so a reply still streaming cannot fill it with hundreds of copies of
- * itself on the way to being finished. It is dropped with the screen, and emptied by the stream
- * reset that drops the rows it describes.
- */
-@Stable
-class ParsedReplies {
-    private val parsed = ConcurrentHashMap<String, State>()
-
-    /**
-     * How each message divides into blocks, cached beside the parses of those blocks.
-     *
-     * Here rather than in a `remember` because the answer is wanted on two threads: by [warm], to
-     * know which strings to make ready, and by the row that draws them. Finding it costs a parse of
-     * the whole message, so doing it twice would undo what splitting is for.
-     */
-    private val blocks = ConcurrentHashMap<String, List<String>>()
-
-    /**
-     * How each message divides into prose and memory notes, cached for the same reason as
-     * [blocksOf]: [transcriptUnits] asks per fold, and the regex scan behind [messageParts] is
-     * proportional to the message every time where a lookup is proportional to nothing.
-     */
-    private val parts = ConcurrentHashMap<String, List<MessagePart>>()
-
-    private val chunks = ConcurrentHashMap<String, List<String>>()
-
-    private val ready = ConcurrentHashMap.newKeySet<String>()
-
-    fun blocksOf(text: String): List<String> =
-        blocks.computeIfAbsent(text) {
-            DebugStats.timed("markdown split into blocks") { markdownBlocks(it) }
-        }
-
-    /** How a long user message divides into slices; cached for the same reason as [blocksOf]. */
-    fun chunksOf(text: String): List<String> =
-        chunks.computeIfAbsent(text) {
-            DebugStats.timed("user message cut into slices") { userChunks(it) }
-        }
-
-    /**
-     * Whether [warm] has made everything drawing [text] as blocks will look up.
-     *
-     * What the flatten asks before drawing a reply that way. Splitting costs a parse of the whole
-     * message and the flatten runs on the composing thread -- so a reply not marked yet stays
-     * whole, drawing the parse it already has, until the screen has warmed it and re-flattens. An
-     * explicit mark rather than a peek into [blocksOf]'s cache, because a message with memory notes
-     * is warmed as its *parts*: nothing ever splits its full text, and inferring readiness from the
-     * cache left exactly that message unsplittable forever, re-warmed on every fold.
-     */
-    fun splitReady(text: String): Boolean = text in ready
-
-    /** The other half of [splitReady]; [warm] calls it once a message's parses exist. */
-    fun markSplitReady(text: String) {
-        ready.add(text)
-    }
-
-    fun partsOf(text: String): List<MessagePart> =
-        parts.computeIfAbsent(text) {
-            DebugStats.timed("message cut into parts") { messageParts(it) }
-        }
-
-    /** The parse of [text] -- the one made ahead, or one made now. */
-    fun of(text: String): State =
-        parsed[text]?.also { DebugStats.count("markdown ready") }
-            ?: DebugStats.timed("markdown parsed while composing") { parseMarkdown(text) }
-
-    /**
-     * Parses whatever is not held yet. Call off the composing thread; that is the whole point.
-     *
-     * Suspending, and yielding between messages, because "off the composing thread" is not the same
-     * as "free". A page of history arrives as hundreds of parses at once -- 1.5 seconds of them in
-     * a twelve second scroll, measured on a Pixel 9 Pro XL -- and on the default dispatcher that is
-     * every core busy, with the frame's own thread waiting for one. That showed up as 21ms of
-     * `waited` at the 90th percentile: the frame could not start, rather than taking too long.
-     */
-    suspend fun warm(texts: List<String>) {
-        texts.forEach { text ->
-            parsed.computeIfAbsent(text) {
-                DebugStats.timed("markdown warmed") { parseMarkdown(it) }
-            }
-        }
-    }
-
-    /** Everything these described is gone; see [ParsedReplies]. */
-    fun clear() {
-        parsed.clear()
-        blocks.clear()
-        parts.clear()
-        chunks.clear()
-        ready.clear()
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/MarkdownLinks.kt

@@ -1,141 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.gestures.detectTapGestures
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.remember
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.geometry.Offset
-import androidx.compose.ui.input.pointer.pointerInput
-import androidx.compose.ui.node.Ref
-import androidx.compose.ui.platform.LocalUriHandler
-import androidx.compose.ui.semantics.heading
-import androidx.compose.ui.semantics.semantics
-import androidx.compose.ui.text.AnnotatedString
-import androidx.compose.ui.text.SpanStyle
-import androidx.compose.ui.text.TextLayoutResult
-import androidx.compose.ui.text.TextStyle
-import com.mikepenz.markdown.annotator.AnnotatorSettings
-import com.mikepenz.markdown.annotator.annotatorSettings
-import com.mikepenz.markdown.annotator.buildMarkdownAnnotatedString
-import com.mikepenz.markdown.compose.components.MarkdownComponentModel
-import com.mikepenz.markdown.compose.elements.MarkdownText
-import com.mikepenz.markdown.model.markdownAnnotator
-import com.mikepenz.markdown.utils.getUnescapedTextInNode
-import org.intellij.markdown.MarkdownElementTypes
-import org.intellij.markdown.ast.ASTNode
-import org.intellij.markdown.ast.findChildOfType
-import org.intellij.markdown.flavours.gfm.GFMTokenTypes
-
-/**
- * A paragraph, heading or bare text whose links are spans of the text rather than nodes of their
- * own.
- *
- * Compose turns every `LinkAnnotation` in a text into a layout node: a clipped, focusable,
- * hoverable, clickable box laid out against the glyphs, with its outline recomputed from the text
- * layout. A paragraph of eight links is therefore nine nodes, and the renderer emits one of those
- * annotations per link. Measured on the emulator against the same paragraphs with each link
- * replaced by its label and address as plain words -- *more* text, the same gestures -- the linked
- * version cost five times the worst measure (26.3ms against 5.2ms) and 1.7x the place time. On a
- * Pixel 9 Pro XL that was the bump at the list of sources in a reply, and nowhere else in it.
- *
- * Here a link is the link colour and underline, a string annotation carrying its address, and one
- * tap detector for the whole text that asks the layout which character was under the finger. What
- * that gives up is a link being its own accessibility node with a pressed state; the app's link
- * style never defined a pressed style, so nothing visible changes.
- *
- * Every block the renderer dispatches through its component table comes here, which includes the
- * paragraphs inside lists, quotes and alerts. Table cells do not: the table draws its own cells and
- * offers no slot for them, so a link in a cell keeps the renderer's path -- correct, and dearer.
- * Reference-style links stay there too; the renderer resolves those against its definitions.
- */
-@Composable
-fun LinkedText(model: MarkdownComponentModel, style: TextStyle, heading: Boolean = false) {
-    val settings = plainLinkSettings()
-    val text =
-        remember(model.content, model.node, style) {
-            model.content.buildMarkdownAnnotatedString(model.node, style, settings)
-        }
-    val uriHandler = LocalUriHandler.current
-    val layout = remember { Ref<TextLayoutResult>() }
-    MarkdownText(
-        content = text,
-        node = model.node,
-        modifier =
-            Modifier.then(if (heading) Modifier.semantics { heading() } else Modifier).pointerInput(
-                text
-            ) {
-                detectTapGestures { position ->
-                    val url = text.linkAt(layout.value, position) ?: return@detectTapGestures
-                    uriHandler.openUri(url)
-                }
-            },
-        style = style,
-        onTextLayout = { result, _ -> layout.value = result },
-    )
-}
-
-/** The address under [position], if a link's glyph is there rather than merely nearest to it. */
-private fun AnnotatedString.linkAt(layout: TextLayoutResult?, position: Offset): String? {
-    layout ?: return null
-    val offset = layout.getOffsetForPosition(position)
-    if (offset >= length || !layout.getBoundingBox(offset).contains(position)) return null
-    return getStringAnnotations(LINK_URL, offset, offset).firstOrNull()?.item
-}
-
-private const val LINK_URL = "url"
-
-/**
- * The renderer's annotator settings with [appendPlainLink] answering for links. The annotator needs
- * the settings to draw a link's label, and the settings hold the annotator, so the reference goes
- * through a cell filled in once both exist.
- */
-@Composable
-private fun plainLinkSettings(): AnnotatorSettings {
-    val cell = remember { Ref<AnnotatorSettings>() }
-    val annotator = remember {
-        markdownAnnotator { content, node -> appendPlainLink(this, content, node, cell.value!!) }
-    }
-    return annotatorSettings(annotator = annotator).also { cell.value = it }
-}
-
-/**
- * Appends [node] as a styled, annotated span if it is a link the renderer would otherwise emit a
- * `LinkAnnotation` for; false leaves anything else to the renderer.
- */
-private fun appendPlainLink(
-    builder: AnnotatedString.Builder,
-    content: String,
-    node: ASTNode,
-    settings: AnnotatorSettings,
-): Boolean {
-    val destination: String
-    val label: List<ASTNode>?
-    when (node.type) {
-        MarkdownElementTypes.INLINE_LINK -> {
-            val text = node.findChildOfType(MarkdownElementTypes.LINK_TEXT) ?: return false
-            destination =
-                node
-                    .findChildOfType(MarkdownElementTypes.LINK_DESTINATION)
-                    ?.getUnescapedTextInNode(content)
-                    ?.removeSurrounding("<", ">") ?: return false
-            // The brackets are the first and last children of the label.
-            label = text.children.drop(1).dropLast(1)
-        }
-        MarkdownElementTypes.AUTOLINK -> {
-            destination = node.getUnescapedTextInNode(content).removeSurrounding("<", ">")
-            label = null
-        }
-        GFMTokenTypes.GFM_AUTOLINK -> {
-            destination = node.getUnescapedTextInNode(content)
-            label = null
-        }
-        else -> return false
-    }
-    builder.pushStringAnnotation(LINK_URL, destination)
-    builder.pushStyle(settings.linkTextSpanStyle.style ?: SpanStyle())
-    if (label == null) builder.append(destination)
-    else builder.buildMarkdownAnnotatedString(content, label, settings)
-    builder.pop()
-    builder.pop()
-    return true
-}

app/androidApp/src/main/kotlin/com/example/aiapp/MemoryNote.kt

@@ -1,163 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.width
-import androidx.compose.material3.Card
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.remember
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.dp
-
-/**
- * An assistant's reply, with anything it says it remembered drawn as a note rather than as markup.
- *
- * Claude Code marks a sentence that came from its stored memory by wrapping it in `<cc-memory
- * filenames="...">`. Markdown has nothing to say about that, so it arrived on screen as literal
- * angle brackets in the middle of a sentence -- which reads as the model having emitted broken
- * HTML. It is really the opposite: a claim about where something came from, which is worth showing,
- * because "I was told this before" and "I worked this out just now" are different things and the
- * reader cannot otherwise tell them apart.
- *
- * A tag that has not finished arriving is left alone. Streaming means the closing tag may be
- * seconds away, and a half-written marker is not a marker yet.
- */
-@Composable
-fun AssistantMessage(
-    text: String,
-    replies: ParsedReplies,
-    /** Which notes are open, by [MessagePart.Remembered.text] -- see [MemoryNote]. */
-    openNotes: Set<String>,
-    onToggleNote: (String) -> Unit,
-    modifier: Modifier = Modifier,
-    live: Boolean = false,
-) {
-    DebugStats.count("message composed")
-    val parts = remember(text) { messageParts(text) }
-    val only = parts.singleOrNull()
-    if (only is MessagePart.Prose) {
-        BlockedMarkdown(only.text, replies, modifier, live)
-        return
-    }
-    Column(modifier.fillMaxWidth(), verticalArrangement = Arrangement.spacedBy(6.dp)) {
-        parts.forEach { part ->
-            when (part) {
-                is MessagePart.Prose -> BlockedMarkdown(part.text, replies, live = live)
-                is MessagePart.Remembered ->
-                    MemoryNote(part, replies, part.text in openNotes) { onToggleNote(part.text) }
-            }
-        }
-    }
-}
-
-/**
- * The pieces [AssistantMessage] draws, which is [splitMemoryNotes] with one correction.
- *
- * A reply carrying no notes is drawn from the message as it arrived rather than from the trimmed
- * prose part made while looking for them -- inspecting a message must not change it. That belongs
- * here rather than at the places that need the answer, because [warm] has to name the same strings
- * the rows draw: a string warmed under a key no row ever looks up is a miss that nothing reports,
- * and the row pays the parse in the frame it appears, which is the cost being removed.
- *
- * Public because [transcriptUnits] flattens settled replies into the same parts; go through
- * [ParsedReplies.partsOf] on any path that runs per fold or per page, so the scan happens once per
- * message.
- */
-fun messageParts(text: String): List<MessagePart> {
-    val parts = splitMemoryNotes(text)
-    return if (parts.singleOrNull() is MessagePart.Prose) listOf(MessagePart.Prose(text)) else parts
-}
-
-/**
- * One sentence the model attributed to a memory file, closed until somebody asks.
- *
- * Closed by default, like a tool call and a peer message and for the same reason: it is not part of
- * what was said to the reader, it is a note about where a claim came from. Left open it breaks the
- * reply in half around a card, which reads as the answer having stopped and restarted -- and these
- * arrive several to a message.
- *
- * What stays visible is which file it came from, because that is the whole of what the note claims
- * and it is the part a reader scanning for "why does it think that" is looking for.
- *
- * Open-ness is the screen's, keyed by the note's own text: a note opened and scrolled past has to
- * still be open on the way back, and a card that remembered for itself would forget the moment the
- * list stopped composing it. The text is a good enough name -- it does not change once the closing
- * tag has arrived, so a note stays open across the moment its reply settles.
- */
-@Composable
-fun MemoryNote(
-    note: MessagePart.Remembered,
-    replies: ParsedReplies,
-    expanded: Boolean,
-    onToggle: () -> Unit,
-) {
-    Card(Modifier.fillMaxWidth().clickable(onClick = onToggle)) {
-        Column(Modifier.padding(12.dp)) {
-            // Named, not just tinted: a colour can say "this one is different", but it cannot say
-            // what kind of different, and "recalled from a file" is a difference in kind.
-            Row(verticalAlignment = Alignment.CenterVertically) {
-                Text(
-                    if (note.files.size == 1) "remembered from ${note.files[0]}"
-                    else "remembered from ${note.files.joinToString(", ")}",
-                    style = MaterialTheme.typography.labelSmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-                if (!expanded) {
-                    Spacer(Modifier.width(8.dp))
-                    Text(
-                        note.text,
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        maxLines = 1,
-                        // The head, not the tail: a sentence is identified by how it opens.
-                        overflow = TextOverflow.Ellipsis,
-                    )
-                }
-            }
-            if (expanded) MarkdownText(note.text, replies, Modifier.padding(top = 4.dp))
-        }
-    }
-}
-
-/** One piece of a reply: ordinary prose, or a sentence attributed to a memory file. */
-sealed class MessagePart {
-    /** The markdown this piece is drawn from. */
-    abstract val text: String
-
-    data class Prose(override val text: String) : MessagePart()
-
-    data class Remembered(override val text: String, val files: List<String>) : MessagePart()
-}
-
-private val MEMORY_NOTE =
-    Regex("""<cc-memory\s+filenames="([^"]*)"\s*>(.*?)</cc-memory>""", RegexOption.DOT_MATCHES_ALL)
-
-/**
- * Splits [text] into prose and memory notes, in order.
- *
- * Always returns at least one part, so a message with no notes in it is one piece of prose and
- * costs nothing extra to draw.
- */
-fun splitMemoryNotes(text: String): List<MessagePart> {
-    val parts = mutableListOf<MessagePart>()
-    var at = 0
-    for (match in MEMORY_NOTE.findAll(text)) {
-        val before = text.substring(at, match.range.first)
-        if (before.isNotBlank()) parts += MessagePart.Prose(before.trim())
-        val files = match.groupValues[1].split(",").map { it.trim() }.filter { it.isNotEmpty() }
-        parts += MessagePart.Remembered(match.groupValues[2].trim(), files)
-        at = match.range.last + 1
-    }
-    val rest = text.substring(at)
-    if (rest.isNotBlank() || parts.isEmpty()) parts += MessagePart.Prose(rest.trim())
-    return parts
-}

app/androidApp/src/main/kotlin/com/example/aiapp/MessageBlocks.kt

@@ -1,116 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.drawWithContent
-import androidx.compose.ui.graphics.graphicsLayer
-import androidx.compose.ui.unit.dp
-import com.mikepenz.markdown.model.State
-import com.mikepenz.markdown.model.parseMarkdown
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.withContext
-
-/**
- * A message's top-level markdown blocks, cut where the parser says the blocks are.
- *
- * The point is the draw phase. A reply's display list holds every glyph of it, and it is
- * re-recorded whenever drawing is invalidated -- so one long message is as expensive to draw as a
- * hundred short ones, and skipping the rows around it cannot help while it is the one on screen.
- * Measured on a Pixel 9 Pro XL: 97% of rows correctly skipped, and the tallest row still being
- * drawn was 36,982px, about twenty-five screens in a single message. Cut into blocks, only the
- * screen or two actually being read is ever recorded.
- *
- * Cut at the parser's own boundaries rather than at blank lines, which is the whole reason this is
- * safe: a heading, a fenced code block, a table and a list are each one node whatever is inside
- * them, so a loose list does not become five one-item lists and a fence is never split down the
- * middle. Guessing at block boundaries with a line scanner gets all three of those wrong.
- *
- * It also bounds parsing, which was the other symptom: one message took **1.4 seconds** to parse as
- * a single unit, and a block is a paragraph.
- */
-fun markdownBlocks(text: String): List<String> {
-    // A reference definition sits at the foot of a message and is used by links above it. Parsed on
-    // its own each block would lose the definition, and the link would draw as literal brackets --
-    // so a message carrying one is kept whole. Rare enough to be worth giving up the split for.
-    if (REFERENCE_DEFINITION.containsMatchIn(text)) return listOf(text)
-    val parsed = parseMarkdown(text) as? State.Success ?: return listOf(text)
-    val blocks =
-        parsed.node.children
-            .map { text.substring(it.startOffset, it.endOffset) }
-            .filter { it.isNotBlank() }
-    return if (blocks.size <= 1) listOf(text) else blocks
-}
-
-/** `[label]: https://…` at the start of a line -- see [markdownBlocks]. */
-private val REFERENCE_DEFINITION = Regex("""^ {0,3}\[[^\]]+]:\s""", RegexOption.MULTILINE)
-
-/**
- * A reply drawn a block at a time.
- *
- * Each block keeps its composition and its layout whichever way it is scrolled -- that is what
- * stops a message being rebuilt when somebody comes back to it. The heights come from the blocks
- * themselves as they are measured, so the running total is the same arrangement the list uses one
- * level up.
- *
- * [live] is the message currently arriving, and it is the only one that gets a layer per block. A
- * layer buys one thing here: when drawing is invalidated, only the block that changed is
- * re-recorded instead of the whole reply. That is worth a great deal while a reply is streaming,
- * because every delta invalidates the message and a finished one can be twenty-five screens tall.
- * It is worth nothing once the message stops changing -- measured on a Pixel 9 Pro XL, whole rows
- * were re-recorded 65 times in fifty seconds of reading -- and it is not free: each layer is a
- * layout node and a display list held for the life of the row, and live node count is what the
- * per-frame cost of the transcript scales with.
- */
-@Composable
-fun BlockedMarkdown(
-    text: String,
-    replies: ParsedReplies,
-    modifier: Modifier = Modifier,
-    live: Boolean = false,
-) {
-    // The first split is inline for the reason [parsedMarkdown]'s first parse is: the row must
-    // have its real height in its first frame. Every split after that is a delta landing, and it
-    // runs off the composing thread with the message drawing the split it already has until the
-    // new one arrives -- when this recomputed wherever composition ran, one streamed reply cost
-    // 815 whole-message parses and 2.9 seconds of them, a few milliseconds per delta, on the
-    // thread that draws. Not through [replies]: a reply mid-stream is a different text per
-    // delta, and each would leave a cache entry nothing reads again.
-    val split = remember { mutableStateOf(text to markdownBlocks(text)) }
-    LaunchedEffect(text) {
-        if (split.value.first == text) return@LaunchedEffect
-        split.value =
-            text to
-                withContext(Dispatchers.Default) {
-                    DebugStats.timed("blocks split while streaming") { markdownBlocks(text) }
-                }
-    }
-    val blocks = split.value.second
-    if (blocks.size == 1) {
-        MarkdownText(blocks.first(), replies, modifier)
-        return
-    }
-    Column(modifier.fillMaxWidth(), verticalArrangement = Arrangement.spacedBy(BLOCK_SPACING)) {
-        blocks.forEach { block ->
-            MarkdownText(
-                block,
-                replies,
-                Modifier.fillMaxWidth()
-                    .then(if (live) Modifier.graphicsLayer() else Modifier)
-                    .drawWithContent {
-                        val started = System.nanoTime()
-                        drawContent()
-                        DebugStats.record("record: one block", System.nanoTime() - started)
-                    },
-            )
-        }
-    }
-}
-
-/** The gap between one block of a reply and the next, here and in [transcriptUnits]. */
-val BLOCK_SPACING = 6.dp

app/androidApp/src/main/kotlin/com/example/aiapp/ModelName.kt

@@ -1,35 +0,0 @@
-package com.example.aiapp
-
-/**
- * What a session with no model of its own is called, in the button and in the list it opens.
- *
- * One constant rather than a literal in each place, because the two have to agree: a picker whose
- * options cannot say every state its button can display is one you can leave and not get back to.
- * It is also the Claude CLI's own word for "whatever is configured", so choosing it is a request
- * the session can act on rather than a name this app made up.
- */
-const val DEFAULT_MODEL = "default"
-
-/**
- * A model's name as a person reads it.
- *
- * Providers answer with their own full identifier -- Claude Code resolves `haiku` to
- * `claude-haiku-4-5-20251001` and reports that, which is the honest answer to "what is this session
- * using" and far too long for a button in a row that also has to hold Stop and Send.
- *
- * So the two ends that identify nothing are dropped and nothing else is: the vendor prefix, which
- * is the same on every model this app can show, and the release date, which distinguishes builds of
- * one model rather than one model from another. What is left is the part somebody chose --
- * `haiku-4-5` -- and anything that does not look like that is returned untouched, since a name this
- * does not recognise is a name it has no business editing.
- *
- * A display decision, not a correction: the full name is what the session reports and what a reader
- * is shown when there is room for it.
- */
-fun modelLabel(model: String?): String {
-    val name = model?.takeIf { it.isNotBlank() } ?: return DEFAULT_MODEL
-    return name.removePrefix("claude-").replace(DATED_SUFFIX, "")
-}
-
-/** A trailing `-YYYYMMDD`, which is how these identifiers carry their release date. */
-private val DATED_SUFFIX = Regex("""-\d{8}$""")

app/androidApp/src/main/kotlin/com/example/aiapp/ModelsScreen.kt

@@ -1,381 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.material3.Card
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.LinearProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.dp
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-/**
- * Models on the backend, and HuggingFace to get more from.
- *
- * Everything here is the server's state rather than this screen's: what is downloaded, and what is
- * downloading, are the same answers on every enrolled device, and a download started here keeps
- * going when this screen closes.
- */
-@Composable
-fun ModelsScreen(settings: ServerSettings, reloadToken: Int) {
-    val scope = rememberCoroutineScope()
-    var state by remember { mutableStateOf<LoadState<Models>>(LoadState.Loading) }
-    var query by remember { mutableStateOf("") }
-    var results by remember { mutableStateOf<LoadState<List<RemoteRepo>>?>(null) }
-    var openRepo by remember { mutableStateOf<String?>(null) }
-    var repoFiles by remember { mutableStateOf<LoadState<List<RemoteFile>>?>(null) }
-    var actionError by remember { mutableStateOf<String?>(null) }
-
-    suspend fun reload() {
-        state =
-            try {
-                withContext(Dispatchers.IO) { LoadState.Loaded(fetchModels(settings)) }
-            } catch (e: ApiException) {
-                LoadState.failed(e)
-            }
-    }
-
-    // Polled rather than pushed: a download belongs to the machine, not to
-    // any session, so it has no event stream of its own. Slow enough not
-    // to matter, frequent enough that a bar moves.
-    // Keyed on the token as well, so the header's Refresh restarts the loop with a read now
-    // rather than leaving the reader watching for up to a second and a half to see whether
-    // anything happened.
-    LaunchedEffect(reloadToken) {
-        while (true) {
-            reload()
-            delay(1500)
-        }
-    }
-
-    Column(Modifier.fillMaxSize().padding(16.dp)) {
-        actionError?.let {
-            Text(it, color = MaterialTheme.colorScheme.error)
-            Spacer(Modifier.height(8.dp))
-        }
-
-        OutlinedTextField(
-            value = query,
-            onValueChange = { query = it },
-            label = { Text("Search HuggingFace") },
-            singleLine = true,
-            modifier = Modifier.fillMaxWidth(),
-        )
-        Spacer(Modifier.height(8.dp))
-        TextButton(
-            enabled = query.isNotBlank(),
-            onClick = {
-                openRepo = null
-                results = LoadState.Loading
-                scope.launch {
-                    results =
-                        try {
-                            withContext(Dispatchers.IO) {
-                                LoadState.Loaded(searchModels(settings, query))
-                            }
-                        } catch (e: ApiException) {
-                            LoadState.failed(e)
-                        }
-                }
-            },
-        ) {
-            Text("Search")
-        }
-
-        Spacer(Modifier.height(8.dp))
-        LazyColumn(Modifier.fillMaxSize()) {
-            when (val current = state) {
-                is LoadState.Loading -> item { CircularProgressIndicator() }
-                is LoadState.Error ->
-                    item { Text(current.message, color = MaterialTheme.colorScheme.error) }
-                is LoadState.Loaded -> {
-                    if (current.value.downloads.isNotEmpty()) {
-                        item { SectionLabel("Downloading") }
-                        uniqueItems(current.value.downloads, key = { it.key + it.run }) { download
-                            ->
-                            DownloadCard(download) {
-                                scope.launch {
-                                    actionError =
-                                        runCatching {
-                                            withContext(Dispatchers.IO) {
-                                                cancelDownload(settings, download.key)
-                                            }
-                                        }
-                                            .exceptionOrNull()
-                                            ?.message
-                                }
-                            }
-                        }
-                    }
-                    item { SectionLabel("On the backend") }
-                    if (current.value.local.isEmpty()) {
-                        item {
-                            Text(
-                                "None yet. Search above to find one.",
-                                style = MaterialTheme.typography.bodyMedium,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                            )
-                        }
-                    }
-                    uniqueItems(current.value.local, key = { it.key }) { model ->
-                        LocalModelCard(model) {
-                            scope.launch {
-                                actionError =
-                                    runCatching {
-                                        withContext(Dispatchers.IO) {
-                                            deleteModel(settings, model.key)
-                                        }
-                                    }
-                                        .exceptionOrNull()
-                                        ?.message
-                                reload()
-                            }
-                        }
-                    }
-                }
-            }
-
-            results?.let { found ->
-                item { SectionLabel("HuggingFace") }
-                when (found) {
-                    is LoadState.Loading -> item { CircularProgressIndicator() }
-                    is LoadState.Error ->
-                        item { Text(found.message, color = MaterialTheme.colorScheme.error) }
-                    is LoadState.Loaded ->
-                        uniqueItems(found.value, key = { it.id }) { repo ->
-                            val open = openRepo == repo.id
-                            RepoRow(repo, expanded = open) {
-                                if (open) {
-                                    openRepo = null
-                                } else {
-                                    openRepo = repo.id
-                                    repoFiles = LoadState.Loading
-                                    scope.launch {
-                                        repoFiles =
-                                            try {
-                                                withContext(Dispatchers.IO) {
-                                                    LoadState.Loaded(
-                                                        fetchRepoFiles(settings, repo.id)
-                                                    )
-                                                }
-                                            } catch (e: ApiException) {
-                                                LoadState.failed(e)
-                                            }
-                                    }
-                                }
-                            }
-                            // Inside the expanded repository's own item
-                            // rather than as a section after the list:
-                            // drawn after every card, a repository's files
-                            // read as belonging to whichever card happened
-                            // to be last.
-                            if (open) {
-                                when (val files = repoFiles) {
-                                    null -> {}
-                                    is LoadState.Loading -> CircularProgressIndicator()
-                                    is LoadState.Error ->
-                                        Text(files.message, color = MaterialTheme.colorScheme.error)
-                                    is LoadState.Loaded ->
-                                        Column {
-                                            val busy =
-                                                (state as? LoadState.Loaded)
-                                                    ?.value
-                                                    ?.downloads
-                                                    .orEmpty()
-                                                    .filter { it.state == "running" }
-                                                    .map { it.key }
-                                                    .toSet()
-                                            files.value.forEach { file ->
-                                                RepoFileRow(
-                                                    file,
-                                                    downloading = "${repo.id}/${file.path}" in busy,
-                                                ) {
-                                                    scope.launch {
-                                                        actionError =
-                                                            runCatching {
-                                                                withContext(Dispatchers.IO) {
-                                                                    startDownload(
-                                                                        settings,
-                                                                        repo.id,
-                                                                        file.path,
-                                                                    )
-                                                                }
-                                                            }
-                                                                .exceptionOrNull()
-                                                                ?.message
-                                                        reload()
-                                                    }
-                                                }
-                                            }
-                                        }
-                                }
-                            }
-                        }
-                }
-            }
-        }
-    }
-}
-
-@Composable
-private fun SectionLabel(text: String) {
-    Spacer(Modifier.height(12.dp))
-    Text(text, style = MaterialTheme.typography.titleSmall)
-    Spacer(Modifier.height(4.dp))
-}
-
-@Composable
-private fun DownloadCard(download: Download, onCancel: () -> Unit) {
-    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
-        Column(Modifier.padding(12.dp)) {
-            Text(download.file, style = MaterialTheme.typography.titleSmall)
-            Text(
-                download.repo,
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-            Spacer(Modifier.height(8.dp))
-            // A determinate bar only when the size is known. The server
-            // sends no total when it was never told one, and a bar drawn
-            // from a guess is worse than one that admits it is counting.
-            if (download.total != null && download.total > 0) {
-                LinearProgressIndicator(
-                    progress = { download.done.toFloat() / download.total.toFloat() },
-                    // Blue at every value, unlike a quota bar: a download nearing its end is
-                    // nearing success, and colouring it like a limit being approached would say
-                    // the opposite of what is happening.
-                    color = progressColor,
-                    modifier = Modifier.fillMaxWidth(),
-                )
-                Text(
-                    "${gigabytes(download.done)} of ${gigabytes(download.total)}",
-                    style = MaterialTheme.typography.bodySmall,
-                )
-            } else {
-                LinearProgressIndicator(color = progressColor, modifier = Modifier.fillMaxWidth())
-                Text(
-                    "${gigabytes(download.done)} so far, total size unknown",
-                    style = MaterialTheme.typography.bodySmall,
-                )
-            }
-            download.error?.let {
-                Text(
-                    it,
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.error,
-                )
-            }
-            Row {
-                Text(
-                    download.state,
-                    style = MaterialTheme.typography.bodySmall,
-                    modifier = Modifier.weight(1f),
-                )
-                if (download.state == "running") {
-                    TextButton(onClick = onCancel) { Text("Cancel") }
-                }
-            }
-        }
-    }
-}
-
-@Composable
-private fun LocalModelCard(model: LocalModel, onDelete: () -> Unit) {
-    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
-        Row(Modifier.padding(12.dp), verticalAlignment = Alignment.CenterVertically) {
-            Column(Modifier.weight(1f)) {
-                Text(model.file, style = MaterialTheme.typography.titleSmall)
-                Text(
-                    "${model.repo} · ${gigabytes(model.bytes)}",
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-            }
-            TextButton(onClick = onDelete) { Text("Delete") }
-        }
-    }
-}
-
-@Composable
-private fun RepoRow(repo: RemoteRepo, expanded: Boolean, onToggle: () -> Unit) {
-    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
-        Row(Modifier.padding(12.dp), verticalAlignment = Alignment.CenterVertically) {
-            Column(Modifier.weight(1f)) {
-                Text(
-                    repo.id,
-                    style = MaterialTheme.typography.titleSmall,
-                    maxLines = 1,
-                    // The owner is the part that repeats; the model name at
-                    // the end is what tells two entries apart.
-                    overflow = TextOverflow.StartEllipsis,
-                )
-                Text(
-                    "${repo.downloads} downloads · ${repo.likes} likes",
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-            }
-            TextButton(onClick = onToggle) { Text(if (expanded) "Hide" else "Files") }
-        }
-    }
-}
-
-@Composable
-private fun RepoFileRow(file: RemoteFile, downloading: Boolean, onDownload: () -> Unit) {
-    Row(
-        Modifier.fillMaxWidth().padding(start = 16.dp, top = 4.dp, bottom = 4.dp),
-        verticalAlignment = Alignment.CenterVertically,
-    ) {
-        Column(Modifier.weight(1f)) {
-            Text(file.path, style = MaterialTheme.typography.bodyMedium)
-            Text(
-                gigabytes(file.bytes),
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-        }
-        // Disabled rather than absent, so the row reads the same whether
-        // this one is absent, already here, or on its way. Offering
-        // "Download" for a file that is downloading would be a button that
-        // does nothing anyone can see -- the server joins the running
-        // download rather than starting a second.
-        TextButton(enabled = !file.have && !downloading, onClick = onDownload) {
-            Text(
-                when {
-                    file.have -> "Downloaded"
-                    downloading -> "Downloading"
-                    else -> "Download"
-                }
-            )
-        }
-    }
-}
-
-private fun gigabytes(bytes: Long): String =
-    if (bytes >= 1_000_000_000) {
-        "%.2f GB".format(bytes / 1_000_000_000.0)
-    } else {
-        "%.0f MB".format(bytes / 1_000_000.0)
-    }

app/androidApp/src/main/kotlin/com/example/aiapp/NerdIcons.kt

@@ -1,219 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.size
-import androidx.compose.material3.IconButton
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.semantics.contentDescription
-import androidx.compose.ui.semantics.semantics
-import androidx.compose.ui.text.font.Font
-import androidx.compose.ui.text.font.FontFamily
-import androidx.compose.ui.unit.TextUnit
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.unit.sp
-
-/**
- * The icons the app draws, as glyphs in a Nerd Fonts subset rather than as vector assets.
- *
- * Drawing them as *text* is what makes them cheap: an icon beside a line of text wants that line's
- * size, colour and baseline, and a `Text` gets all three for free where an `Icon` needs each one
- * set and kept in step by hand.
- *
- * This replaced a hand-drawn canvas gear, whose doc comment argued against icon fonts on the
- * grounds that a system font may not have the glyph and whoever gets the empty box instead is never
- * the person who wrote it. That objection is about *relying* on a system font, and it is exactly
- * right: the answer is not to avoid glyphs but to ship them. The font here is
- * `app/build-icon-font.sh`'s output -- eleven glyphs, 2.1 KB, subset out of the 3 MB symbols font
- * and committed -- so the codepoints below are resolved by an asset in the APK and cannot come back
- * as tofu. Adding one means adding its codepoint in *both* places; a codepoint here that the script
- * did not subset is a glyph that silently isn't there.
- *
- * The subset is the font's **Mono** face, where every glyph is exactly one em wide and one em tall.
- * That is what makes two icons the same size without either of them being given a size: the
- * proportional face's advances run from 0.46 em to 0.92 em, so a Send button and a Stop button side
- * by side came out visibly different widths, and matching them at the call site would have meant
- * one hardcoded measurement per pair. [GLYPH_SIZE] carries the cost.
- *
- * The same arrangement as dev-updater, down to the cog and the refresh arrow being the same two
- * Material Design codepoints. Those two must not drift: an icon that means "settings" in one app
- * and something else in the other is the failure this is worth preventing. The script is copied
- * rather than shared because most of what looks like duplication is the `GLYPHS` list, which has to
- * differ -- the point of subsetting is to ship only the codepoints one app draws. All Material
- * Design bar one, so they read as one family; the exception is noted where it is declared.
- */
-val NerdIcons = FontFamily(Font(R.font.nerd_icons))
-
-/** Nerd Fonts puts these in plane 15, so each is a surrogate pair. */
-private fun glyph(codePoint: Int) = String(Character.toChars(codePoint))
-
-/** `md-cog` -- settings for the thing it sits beside. */
-val SETTINGS_GLYPH = glyph(0xF0493)
-
-/** `md-refresh` -- ask the server again for whatever is on screen. */
-val REFRESH_GLYPH = glyph(0xF0450)
-
-/** `md-send` -- the filled paper plane: submit what is in the composer. */
-val SEND_GLYPH = glyph(0xF048A)
-
-/**
- * `md-stop` -- a filled square: end the process behind this session.
- *
- * The square is what stop has meant since tape decks, and it is spent here on the thing that
- * actually stops rather than on pausing. [PAUSE_GLYPH] is the turn; this is the session.
- */
-val STOP_GLYPH = glyph(0xF04DB)
-
-/**
- * `md-pause` -- two bars: take the running turn away and leave the session there.
- *
- * The pair with [STOP_GLYPH] and [PLAY_GLYPH] is the point: one button in the composer says what
- * pressing it now would do to the process, and the three marks are the three answers. An interrupt
- * ends a turn and nothing else -- the CLI is still there and still holds the conversation -- which
- * is a pause, not a stop, and drawing it as a square said otherwise.
- */
-val PAUSE_GLYPH = glyph(0xF03E4)
-
-/** `md-play` -- start the process again, on the conversation it left. See [PAUSE_GLYPH]. */
-val PLAY_GLYPH = glyph(0xF040A)
-
-/**
- * `md-send_clock` -- the same paper plane with a clock on it: this message will wait its turn.
- *
- * The pair with [SEND_GLYPH] is the point. Sending during a turn queues the message rather than
- * starting one, and the two buttons have to be told apart at a glance -- one glyph doing both jobs
- * while looking identical would promise something immediate and do something that waits.
- */
-val QUEUE_GLYPH = glyph(0xF1163)
-
-/** `md-close` -- take this off again: an attachment picked and not wanted. */
-val CLOSE_GLYPH = glyph(0xF0156)
-
-/** `md-arrow_left` -- back one level, to whatever this was opened from. */
-val BACK_GLYPH = glyph(0xF004D)
-
-/** `md-bell` -- the notifications this session is allowed to raise. */
-val BELL_GLYPH = glyph(0xF009A)
-
-/**
- * `fa-line_chart` -- how much of the account's rate limits is gone.
- *
- * Font Awesome's rather than Material's, which is the one break in the family above: it was asked
- * for by name, and Material's chart glyphs are a bare line where this one has its axes, which is
- * what makes it read as a measurement rather than as a trend.
- */
-val USAGE_GLYPH = glyph(0xF201)
-
-/**
- * `md-speedometer` -- what this session is costing to draw.
- *
- * A speedometer rather than a bug, because what it copies is a measurement rather than a fault
- * report: it is as useful on a screen that feels fine, where the answer is that nothing is slow.
- */
-val SPEED_GLYPH = glyph(0xF04C5)
-
-/**
- * The size an icon draws at beside a line of text.
- *
- * 17 rather than the 20 it was while the font was the proportional face. A glyph there filled at
- * most 0.83 em of its point size and most filled a good deal less, so the number was standing in
- * for the headroom above the tallest one; in the Mono face every glyph fills its em exactly, and
- * keeping 20 would have made every icon in the app step up by a fifth for no reason anybody asked
- * for. This is what the largest of them already drew at.
- */
-private val GLYPH_SIZE = 17.sp
-
-/**
- * The same measurement in dp: a glyph's em box is its point size, and a layout is laid out in dp.
- */
-private val GLYPH_EXTENT = GLYPH_SIZE.value.dp
-
-/**
- * The square a glyph button occupies: the mark, plus the same ring of padding on all four sides.
- *
- * The ring is the whole spacing rule. Every gap around a header icon comes out of it -- one ring to
- * the screen edge, two where a button meets its neighbour -- so nothing outside has to add a gap of
- * its own, and a mark cannot end up further from the button beside it than from the edge of the
- * screen. That is what it was: the box was the size of the mark (28dp) and the separation was
- * bolted on beside it, which left the two header icons 31dp apart and the outer one 14dp from the
- * edge, so a pair that acts on one screen read as two unrelated marks with one falling off it.
- *
- * 48dp is the platform's minimum touch target, so the square is also the whole of what a finger has
- * to find. It is what the pressed-state ripple draws, too: at 28dp that circle was inscribed in the
- * mark's own corners, and beside a title it arrived at the first letter. And it is taller than any
- * header's text, which is what lets the button fill a header row rather than sit in the middle of
- * one -- the rows add no vertical padding of their own for the same reason they add no gap.
- */
-private val GLYPH_BUTTON_SIZE = 48.dp
-
-/**
- * The ring itself, for putting something that is *not* a glyph button next to one -- a title beside
- * a back arrow.
- *
- * Two glyph buttons need nothing between them: each brings its own ring and the two add up, which
- * is why a row of them sets no spacing. Text brings none, so the second ring has to be asked for.
- * Without it the pressed-state circle, which fills the whole square, arrives at the first letter of
- * the title -- and the gap a reader sees between the mark and that title is then half the one
- * between the two marks at the other end of the same row.
- */
-val GLYPH_BUTTON_MARGIN = (GLYPH_BUTTON_SIZE - GLYPH_EXTENT) / 2
-
-/**
- * A glyph you can press: the icon equivalent of a `TextButton`.
- *
- * Its own composable so that every icon button in the app is one size and one colour without each
- * caller saying so, and so the [label] none of them displays is still there for a screen reader --
- * which is all assistive technology has to go on, and also the answer to "what was that button for"
- * six months from now.
- *
- * [enabled] is passed through rather than left to callers hiding the button: a control that comes
- * and goes makes its own absence the signal, and absence cannot say whether there was nothing to do
- * or nobody checked.
- */
-@Composable
-fun GlyphButton(
-    glyph: String,
-    label: String,
-    onClick: () -> Unit,
-    modifier: Modifier = Modifier,
-    enabled: Boolean = true,
-    colour: Color = MaterialTheme.colorScheme.primary,
-) {
-    IconButton(
-        onClick = onClick,
-        enabled = enabled,
-        modifier = modifier.size(GLYPH_BUTTON_SIZE).semantics { contentDescription = label },
-    ) {
-        Glyph(glyph, colour = if (enabled) colour else MaterialTheme.colorScheme.outline)
-    }
-}
-
-/**
- * One icon, drawn as text.
- *
- * Callers that are already inside something pressable use this; [GlyphButton] is the one that adds
- * the press. Either way the caller owes it a description, since neither draws a word.
- */
-@Composable
-fun Glyph(
-    glyph: String,
-    modifier: Modifier = Modifier,
-    colour: Color = MaterialTheme.colorScheme.primary,
-    size: TextUnit = GLYPH_SIZE,
-) {
-    // Line height of the point size, which for this font is the square the glyph draws in: its
-    // ascent and descent add up to exactly one em, and every glyph in the Mono face fills that em.
-    // Left to the inherited body style the line box was 24sp tall around a 17sp-wide mark, so a
-    // glyph took a seventh more vertical space than horizontal wherever one is drawn without a box
-    // around it -- and where there is a box, that leading is what its padding is measured through.
-    Text(
-        glyph,
-        fontFamily = NerdIcons,
-        fontSize = size,
-        lineHeight = size,
-        color = colour,
-        modifier = modifier,
-    )
-}

app/androidApp/src/main/kotlin/com/example/aiapp/Notifications.kt

@@ -1,366 +0,0 @@
-package com.example.aiapp
-
-import android.Manifest
-import android.app.Notification
-import android.app.PendingIntent
-import android.app.Service
-import android.content.Context
-import android.content.Intent
-import android.content.pm.PackageManager
-import android.content.pm.ServiceInfo
-import android.net.Uri
-import android.os.Build
-import android.os.IBinder
-import androidx.core.app.NotificationChannelCompat
-import androidx.core.app.NotificationCompat
-import androidx.core.app.NotificationManagerCompat
-import androidx.core.app.ServiceCompat
-import androidx.core.content.ContextCompat
-import java.io.IOException
-import java.net.HttpURLConnection
-import java.net.URL
-import kotlin.concurrent.thread
-import kotlinx.coroutines.flow.MutableSharedFlow
-import kotlinx.coroutines.flow.SharedFlow
-import kotlinx.coroutines.flow.asSharedFlow
-import org.json.JSONObject
-
-/**
- * Telling somebody a session wants them, when they are not looking at the app.
- *
- * This is a **foreground service**, which on Android is the only way to keep a connection open
- * while the app is closed -- there has been no such thing as a long-lived background service since
- * Android 8. It is what Syncthing does for the same reason. Discord is not a counter-example: it
- * gets a push from Google's servers, which would mean this backend talking to Google about
- * somebody's coding sessions, and the whole point of the tunnel is that it does not.
- *
- * The cost Android charges for it is a notification of its own that cannot be dismissed. That is
- * made as quiet as the platform allows: [ONGOING_CHANNEL] is `IMPORTANCE_MIN`, so it makes no
- * sound, shows no status-bar icon, and sits at the bottom of the shade -- the same arrangement
- * Syncthing's "hide the persistent notification" option produces. It is not hidden outright,
- * because it cannot be and because it should not be: it is the honest indicator that something is
- * holding a connection open.
- */
-class NotificationService : Service() {
-    @Volatile private var stream: HttpURLConnection? = null
-    @Volatile private var stopping = false
-
-    override fun onBind(intent: Intent?): IBinder? = null
-
-    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
-        val settings = loadServerSettings(this)
-        if (settings == null) {
-            // Nothing to connect to. Stopping rather than idling: a service
-            // holding no connection still costs the ongoing notification,
-            // which would then be announcing work that is not happening.
-            stopSelf()
-            return START_NOT_STICKY
-        }
-        // Through ServiceCompat so the type is stated once and ignored on
-        // the versions that predate types, rather than branching here.
-        ServiceCompat.startForeground(this, ONGOING_ID, ongoingNotification(), foregroundType())
-        thread(isDaemon = true, name = "ai-app-notifications") { follow(settings) }
-        // Restarted if Android kills it, which is the whole point: the
-        // window this covers is exactly the one where nobody is watching.
-        return START_STICKY
-    }
-
-    override fun onDestroy() {
-        stopping = true
-        stream?.disconnect()
-    }
-
-    /**
-     * Follows the backend's notification stream, reconnecting until stopped.
-     *
-     * A dropped connection is the ordinary case here rather than an error -- a phone changes
-     * networks, the tunnel comes and goes, the backend restarts -- so it retries quietly and
-     * forever. Nothing is shown when it cannot connect: a notification saying "I could not tell you
-     * whether anything happened" on a phone in somebody's pocket is noise about a condition they
-     * cannot act on, and the session list already says what is waiting when they next look.
-     */
-    private fun follow(settings: ServerSettings) {
-        while (!stopping) {
-            try {
-                readStream(settings)
-            } catch (_: IOException) {
-                // Deliberate: see above.
-            }
-            if (stopping) return
-            try {
-                Thread.sleep(RECONNECT_DELAY_MS)
-            } catch (_: InterruptedException) {
-                return
-            }
-        }
-    }
-
-    private fun readStream(settings: ServerSettings) {
-        val connection =
-            URL("${settings.baseUrl}/notifications").openConnection() as HttpURLConnection
-        stream = connection
-        try {
-            connection.applyPinnedTls()
-            connection.connectTimeout = CONNECT_TIMEOUT_MS
-            // No read timeout, for the reason EventStream gives: between
-            // notifications there is nothing to read, possibly for hours.
-            connection.readTimeout = 0
-            connection.setRequestProperty("Authorization", "Bearer ${settings.token}")
-            connection.setRequestProperty("Accept", "text/event-stream")
-            if (connection.responseCode != 200) {
-                throw IOException("HTTP ${connection.responseCode} for the notification stream")
-            }
-            val reader = connection.inputStream.bufferedReader()
-            val data = StringBuilder()
-            while (!stopping) {
-                val line = reader.readLine() ?: break
-                when {
-                    line.isEmpty() -> {
-                        if (data.isNotEmpty()) show(parseNotification(data.toString()))
-                        data.clear()
-                    }
-                    line.startsWith("data:") -> data.append(line.removePrefix("data:").trim())
-                    else -> {} // comments (keep-alives) and ids: nothing to do
-                }
-            }
-        } finally {
-            connection.disconnect()
-            stream = null
-        }
-    }
-
-    /**
-     * One notification per session, replacing that session's previous one.
-     *
-     * Keyed by session id rather than accumulating: two sessions wanting attention are two things
-     * to know about, but one session that finished and then asked a question is one thing -- the
-     * question. A stack of stale rows for the same conversation is how a notification drawer
-     * becomes something to clear rather than read.
-     */
-    private fun show(notification: SessionNotification) {
-        // Nothing to tell somebody about the session they are reading. The transcript in front of
-        // them is already saying it, and a sound over the top of it would be this app announcing
-        // what the screen is showing.
-        if (isOnScreen(notification.sessionId)) return
-        // The app is up: it says this itself, as a banner over whatever screen they are on. See
-        // [forTheScreen]. Never both -- one thing happened, and a drawer filling up behind an
-        // app that already showed you each one is a drawer nobody reads.
-        if (handOver(notification)) return
-        val manager = NotificationManagerCompat.from(this)
-        // Two different noes, and both are answers rather than faults: the runtime permission
-        // refused, and notifications switched off for the app in Android's own settings. Neither
-        // is reported anywhere -- the person said no, and saying it back to them through the
-        // channel they closed is not available anyway.
-        //
-        // The permission only exists from Android 13. Asking an older version about it gets
-        // "denied" for a name it does not know, which read as the person having said no -- so
-        // every notification on Android 12 and below was silently dropped. Before 13 the
-        // switch in Android's own settings, checked below, is the whole of the answer.
-        val allowed =
-            Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU ||
-                ContextCompat.checkSelfPermission(this, Manifest.permission.POST_NOTIFICATIONS) ==
-                    PackageManager.PERMISSION_GRANTED
-        if (!allowed || !manager.areNotificationsEnabled()) {
-            return
-        }
-        val open =
-            PendingIntent.getActivity(
-                this,
-                0,
-                sessionIntent(this, notification.sessionId),
-                PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
-            )
-        val built =
-            NotificationCompat.Builder(this, ALERT_CHANNEL)
-                .setContentTitle(notification.title)
-                .setContentText(attentionLine(notification.kind))
-                .setSmallIcon(android.R.drawable.stat_notify_chat)
-                .setContentIntent(open)
-                .setAutoCancel(true)
-                .setWhen((notification.at * 1000).toLong())
-                .setShowWhen(true)
-                .build()
-        manager.notify(notification.sessionId, ALERT_ID, built)
-    }
-
-    /**
-     * The type Android 14+ requires a foreground service to declare, and nothing before it.
-     *
-     * Named behind a version check rather than passed as a constant: the value is inlined at
-     * compile time and would be handed to platforms that have no concept of it, which is exactly
-     * the case lint's InlinedApi exists to catch. Zero is what ServiceCompat wants where types do
-     * not apply.
-     */
-    private fun foregroundType(): Int =
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-            ServiceInfo.FOREGROUND_SERVICE_TYPE_SPECIAL_USE
-        } else {
-            0
-        }
-
-    private fun ongoingNotification(): Notification =
-        NotificationCompat.Builder(this, ONGOING_CHANNEL)
-            .setContentTitle("Watching for sessions that need you")
-            .setSmallIcon(android.R.drawable.stat_notify_sync)
-            .setOngoing(true)
-            .setPriority(NotificationCompat.PRIORITY_MIN)
-            .build()
-
-    companion object {
-        /**
-         * Starts the service if there is a server to connect to, and stops it otherwise.
-         *
-         * Called on every launch rather than once: a service Android killed does not restart itself
-         * if the process was replaced, and asking for one that is already running is free.
-         */
-        fun sync(context: Context) {
-            val intent = Intent(context, NotificationService::class.java)
-            if (loadServerSettings(context) == null) {
-                context.stopService(intent)
-                return
-            }
-            createChannels(context)
-            ContextCompat.startForegroundService(context, intent)
-        }
-
-        /**
-         * Two channels, because they are two different things to be told.
-         *
-         * The alerts are what somebody turned this on for, so they get the default importance and
-         * whatever sound and heads-up display the person has chosen for the app. The ongoing one is
-         * the platform's tax for staying connected, so it takes the lowest importance that exists.
-         * Both are created before the service starts, since posting to a channel that does not
-         * exist is silently dropped.
-         */
-        private fun createChannels(context: Context) {
-            val manager = NotificationManagerCompat.from(context)
-            manager.createNotificationChannel(
-                NotificationChannelCompat.Builder(
-                        ALERT_CHANNEL,
-                        NotificationManagerCompat.IMPORTANCE_DEFAULT,
-                    )
-                    .setName("Sessions needing attention")
-                    .build()
-            )
-            manager.createNotificationChannel(
-                NotificationChannelCompat.Builder(
-                        ONGOING_CHANNEL,
-                        NotificationManagerCompat.IMPORTANCE_MIN,
-                    )
-                    .setName("Staying connected")
-                    .build()
-            )
-        }
-
-        /**
-         * The session somebody is looking at, or null when no screen is showing one.
-         *
-         * Process-wide state, which the rest of this app does without: Android constructs the
-         * service and the composition draws the screen, so the two have no common owner a value
-         * could be passed through. [showing] and [stoppedShowing] are the pair, both called from
-         * the one composable that shows a session. Clearing names the session rather than setting
-         * null outright, because moving from one session to another composes the new screen before
-         * the old one's coroutine is cancelled -- an unconditional clear would then throw away the
-         * new screen's claim and start notifying about what is on it.
-         */
-        @Volatile private var onScreen: String? = null
-
-        private fun isOnScreen(sessionId: String) = onScreen == sessionId
-
-        /**
-         * The way a notification reaches the app instead of Android's drawer.
-         *
-         * Whether there is an app to reach is the subscriber count rather than a flag of its own:
-         * [SessionAlerts] collects this exactly while it is on screen, so there is nothing that
-         * could be left saying the app is up after it has gone. `tryEmit` neither suspends nor
-         * blocks the thread reading the stream, and the buffer is there so a handful of sessions
-         * finishing together all land rather than the last one winning.
-         */
-        private val toApp = MutableSharedFlow<SessionNotification>(extraBufferCapacity = 8)
-
-        /** Everything meant for the screen rather than the drawer; see [toApp]. */
-        val forTheScreen: SharedFlow<SessionNotification> = toApp.asSharedFlow()
-
-        private fun handOver(notification: SessionNotification) =
-            toApp.subscriptionCount.value > 0 && toApp.tryEmit(notification)
-
-        /** Somebody is looking at [sessionId]; nothing is posted about it until they stop. */
-        fun showing(context: Context, sessionId: String) {
-            onScreen = sessionId
-            // Whatever was posted about it before is about to be read, so it has nothing left
-            // to say -- and a row in the drawer for the conversation on screen is the same
-            // duplication this whole rule is about.
-            NotificationManagerCompat.from(context).cancel(sessionId, ALERT_ID)
-        }
-
-        /** They have stopped, unless another screen has claimed it since. */
-        fun stoppedShowing(sessionId: String) {
-            if (onScreen == sessionId) onScreen = null
-        }
-
-        private const val ALERT_CHANNEL = "sessions"
-        private const val ONGOING_CHANNEL = "connection"
-        private const val ONGOING_ID = 1
-        /** Shared by every alert; the session id is the tag that separates them. */
-        private const val ALERT_ID = 2
-        private const val RECONNECT_DELAY_MS = 5_000L
-    }
-}
-
-/**
- * The intent that opens one session, and the id it carries back out.
- *
- * The two halves are written together so neither can be changed without the other, and the scheme
- * is enrollment's `aiapp://` under a different host so that [MainActivity] has one thing to look at
- * when an intent arrives rather than two.
- *
- * The id rides in the intent's **data** rather than in an extra, which is not a style choice:
- * PendingIntent identity is `Intent.filterEquals`, and that compares the data while ignoring
- * extras. Carried as an extra, every session's notification would update one shared PendingIntent
- * and every tap would open whichever session was notified last.
- */
-fun sessionIntent(context: Context, sessionId: String): Intent =
-    Intent(context, MainActivity::class.java)
-        .setAction(Intent.ACTION_VIEW)
-        .setData(
-            // Built rather than concatenated so an id needing escaping survives the round trip;
-            // lastPathSegment below decodes what appendPath encoded.
-            Uri.Builder().scheme("aiapp").authority("session").appendPath(sessionId).build()
-        )
-
-/** The session [sessionIntent] named, or null for any other URI -- enrollment's included. */
-fun notifiedSessionId(uri: Uri): String? =
-    if (uri.scheme == "aiapp" && uri.host == "session") uri.lastPathSegment else null
-
-/** One frame of `GET /notifications`. */
-data class SessionNotification(
-    val sessionId: String,
-    val title: String,
-    /** The wire's word: "awaitingInput" or "finished". */
-    val kind: String,
-    val at: Double,
-)
-
-/**
- * What a notification asks of the reader, in the words they see.
- *
- * What they have to do, not what the session did: "awaitingInput" is the wire's word and says
- * nothing to somebody reading a lock screen. One function because the same fact is now shown in two
- * places -- Android's drawer and the app's own banner -- and two mappings of one word drift. The
- * banner colours the line as well, which is its own decision and stays with the drawing.
- */
-fun attentionLine(kind: String): String =
-    when (kind) {
-        "awaitingInput" -> "Waiting for you"
-        else -> "Finished"
-    }
-
-fun parseNotification(json: String): SessionNotification {
-    val body = JSONObject(json)
-    return SessionNotification(
-        sessionId = body.getString("sessionId"),
-        title = body.getString("title"),
-        kind = body.getString("kind"),
-        at = body.optDouble("at", 0.0),
-    )
-}

app/androidApp/src/main/kotlin/com/example/aiapp/PeerMessage.kt

@@ -1,144 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.background
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.width
-import androidx.compose.foundation.shape.CornerSize
-import androidx.compose.material3.CardDefaults
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.dp
-
-/**
- * A message another agent sent this session, closed until somebody asks.
- *
- * Closed by default, like a tool call and for the same reason: these are long, there can be several
- * in a row, and what a reader scanning the transcript needs from one is that it happened and who
- * sent it. The first line comes with the heading because a name alone does not say which message
- * this was.
- *
- * Drawn as its own kind rather than as the reader's own bubble. They did not say this, and a
- * transcript that puts it in their voice is making a claim about who asked for the work that
- * follows -- which is exactly the question a peer message is usually the answer to.
- *
- * Opened, the card is drawn in *pieces* -- this heading and one [PeerBlockRow] per markdown block,
- * each its own item of the transcript list. See [TranscriptUnit.PeerHead] for the measurements that
- * bought; what matters here is that the pieces have to add up to the card that was there before, so
- * the fill, the corner radius and the padding all live in [peerSurface] rather than being written
- * out at each piece.
- */
-@Composable
-fun PeerHeadRow(
-    item: TranscriptItem.PeerNote,
-    open: Boolean,
-    onToggle: () -> Unit,
-    modifier: Modifier = Modifier,
-) {
-    Column(
-        modifier.cardPiece(
-            top = true,
-            bottom = !open,
-            fill = CardDefaults.cardColors().containerColor,
-            onPress = onToggle,
-        )
-    ) {
-        Row(verticalAlignment = Alignment.CenterVertically) {
-            Text("Message from ${item.from}", style = MaterialTheme.typography.titleSmall)
-            if (!open) {
-                Spacer(Modifier.width(8.dp))
-                Text(
-                    item.text.lineSequence().firstOrNull { it.isNotBlank() }.orEmpty(),
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    maxLines = 1,
-                    // The head, not the tail: a message is identified by how it opens.
-                    overflow = TextOverflow.Ellipsis,
-                )
-            }
-        }
-    }
-}
-
-/**
- * One block of an opened peer message, on the same card the heading started.
- *
- * Clickable like the heading, so the card still shuts wherever it is pressed -- it was one control
- * before it was several items, and which piece the finger lands on is not something the reader
- * chose.
- */
-@Composable
-fun PeerBlockRow(
-    text: String,
-    replies: ParsedReplies,
-    last: Boolean,
-    onToggle: () -> Unit,
-    modifier: Modifier = Modifier,
-) {
-    Column(
-        modifier.cardPiece(
-            top = false,
-            bottom = last,
-            fill = CardDefaults.cardColors().containerColor,
-            onPress = onToggle,
-        )
-    ) {
-        // The gap the card's own column used to provide between its heading and its prose, and
-        // between one block and the next. Uniform, because both of those were 6dp already.
-        MarkdownText(text, replies, Modifier.padding(top = BLOCK_SPACING))
-    }
-}
-
-/**
- * One piece of a card drawn in slices: the fill, the corners it owns, and the room inside it.
- *
- * A filled Material card is elevation zero ([CardDefaults] takes it from `FilledCardTokens`, which
- * is `Level0`), so there is no shadow that a seam would show through -- which is the whole reason a
- * card can be cut up at all. Each piece paints the caller's container colour the way a
- * [androidx.compose .material3.Card] would and rounds only the corners at the ends of the message,
- * so the pieces abut into one continuous card. Shared by the two rows that are cut this way -- an
- * opened peer message and a long user message -- because two copies of the corner logic is how one
- * of them grows a seam.
- *
- * The padding is the other half of it: 12dp all round was the card's own, so the top piece keeps
- * the top of it, the bottom piece the bottom, and the middle pieces neither.
- */
-@Composable
-fun Modifier.cardPiece(
-    top: Boolean,
-    bottom: Boolean,
-    fill: Color,
-    onPress: (() -> Unit)? = null,
-): Modifier {
-    val square = CornerSize(0.dp)
-    val shape =
-        MaterialTheme.shapes.medium.copy(
-            topStart = if (top) MaterialTheme.shapes.medium.topStart else square,
-            topEnd = if (top) MaterialTheme.shapes.medium.topEnd else square,
-            bottomStart = if (bottom) MaterialTheme.shapes.medium.bottomStart else square,
-            bottomEnd = if (bottom) MaterialTheme.shapes.medium.bottomEnd else square,
-        )
-    return fillMaxWidth()
-        .clip(shape)
-        .background(fill)
-        .then(if (onPress == null) Modifier else Modifier.clickable(onClick = onPress))
-        .padding(
-            start = CARD_PADDING,
-            end = CARD_PADDING,
-            top = if (top) CARD_PADDING else 0.dp,
-            bottom = if (bottom) CARD_PADDING else 0.dp,
-        )
-}
-
-/** The room inside a sliced card, which was `Card { Column(padding(12.dp)) }`. */
-private val CARD_PADDING = 12.dp

app/androidApp/src/main/kotlin/com/example/aiapp/PendingAttachments.kt

@@ -1,125 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.Image
-import androidx.compose.foundation.background
-import androidx.compose.foundation.border
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.horizontalScroll
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.shape.CircleShape
-import androidx.compose.foundation.shape.RoundedCornerShape
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.layout.ContentScale
-import androidx.compose.ui.semantics.contentDescription
-import androidx.compose.ui.semantics.semantics
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.unit.sp
-
-/**
- * What is about to be sent, directly above the box it will be sent from.
- *
- * The count on the "+" button was the whole of what said an image was attached, so the only way to
- * find out *which* image was to send it. A control belongs with the thing it acts on, and what
- * these are attached to is the message being typed -- which is why they sit here rather than
- * anywhere else on the screen.
- *
- * Scrolls sideways rather than wrapping or shrinking: the row keeps one thumbnail size whatever is
- * in it, so four attachments look like four of the same thing rather than four smaller ones.
- */
-@Composable
-fun PendingAttachments(
-    settings: ServerSettings,
-    sessionId: String,
-    refs: List<String>,
-    onRemove: (String) -> Unit,
-    modifier: Modifier = Modifier,
-) {
-    if (refs.isEmpty()) return
-    Row(
-        modifier = modifier.horizontalScroll(rememberScrollState()).padding(bottom = 8.dp),
-        horizontalArrangement = Arrangement.spacedBy(8.dp),
-    ) {
-        refs.forEach { ref -> PendingThumbnail(settings, sessionId, ref) { onRemove(ref) } }
-    }
-}
-
-/**
- * One attachment, square, tap to take it back off.
- *
- * Removal is here because there is nowhere else it could be: an image picked by mistake could
- * otherwise only be dealt with by sending it. The whole thumbnail is the target rather than a
- * corner cross -- a cross small enough to sit on a 64dp square is smaller than a fingertip -- and
- * the label is what says so, since nothing about the picture does.
- */
-@Composable
-private fun PendingThumbnail(
-    settings: ServerSettings,
-    sessionId: String,
-    ref: String,
-    onRemove: () -> Unit,
-) {
-    val (bitmap, failed) = rememberSessionBitmap(settings, sessionId, ref)
-    val shape = RoundedCornerShape(8.dp)
-    Box(
-        Modifier.size(THUMBNAIL)
-            .clip(shape)
-            // An outline as well as a fill. Most of what gets attached here is a screenshot of a
-            // dark app, and cropped to a square its middle is often near-black -- against this
-            // background the tile then had no edge at all, and the only thing saying an image was
-            // attached was the cross drawn on top of nothing.
-            .border(1.dp, MaterialTheme.colorScheme.outlineVariant, shape)
-            // Behind the picture as well as under a missing one, so the tile is a tile before
-            // anything has arrived to fill it.
-            .background(MaterialTheme.colorScheme.surfaceVariant)
-            .clickable(onClick = onRemove)
-            .semantics { contentDescription = "Attached image, tap to remove" },
-        contentAlignment = Alignment.Center,
-    ) {
-        when (val image = bitmap) {
-            // The two are told apart for the same reason the transcript's images are: one of them
-            // is worth waiting for and the other never resolves.
-            null ->
-                Text(
-                    if (failed) "!" else "…",
-                    style = MaterialTheme.typography.bodyLarge,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-            else ->
-                Image(
-                    bitmap = image,
-                    contentDescription = null,
-                    contentScale = ContentScale.Crop,
-                    modifier = Modifier.size(THUMBNAIL),
-                )
-        }
-        // The whole square removes it, and this only says so. A cross small enough to sit in
-        // the corner of a 64dp thumbnail is smaller than a fingertip, so making it the target
-        // would be a control drawn at a size nobody can hit.
-        //
-        // The disc is sized here and the mark centred inside it, rather than the glyph being
-        // aligned directly: a glyph's box is wider than the cross it draws, so aligning the box
-        // to the corner hung the visible mark over the edge and put its backing somewhere the
-        // eye reads as a second, misplaced square.
-        Box(
-            Modifier.align(Alignment.TopEnd)
-                .padding(2.dp)
-                .size(20.dp)
-                .background(MaterialTheme.colorScheme.surface.copy(alpha = 0.75f), CircleShape),
-            contentAlignment = Alignment.Center,
-        ) {
-            Glyph(CLOSE_GLYPH, colour = MaterialTheme.colorScheme.onSurface, size = 12.sp)
-        }
-    }
-}
-
-private val THUMBNAIL = 64.dp

app/androidApp/src/main/kotlin/com/example/aiapp/PinnedCert.kt

@@ -1,18 +0,0 @@
-package com.example.aiapp
-
-import com.example.wgapplink.PinnedTls
-import java.net.HttpURLConnection
-
-// PINNED_CA_PEM is generated at build time from the CA on the machine doing
-// the build -- see the generatePinnedCert task in build.gradle.kts. It is
-// deliberately not a checked-in constant: the private key that signs against
-// it must never be anywhere this repo is, and an APK should pin whatever CA
-// the backend it was built for actually serves.
-//
-// The pinning itself lives in wg-app-link, since dev-updater needs exactly
-// the same thing. What stays here is the one product-specific fact -- which
-// certificate this app pins.
-private val pinned = PinnedTls(PINNED_CA_PEM)
-
-/** Every request this app makes goes through this -- there is no unpinned path. */
-fun HttpURLConnection.applyPinnedTls() = pinned.applyTo(this)

app/androidApp/src/main/kotlin/com/example/aiapp/RawBlock.kt

@@ -1,38 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.background
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.ColumnScope
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.unit.dp
-
-/**
- * Verbatim text, on the surface that says so: a command about to be run, what a tool printed.
- *
- * A composable rather than a modifier repeated at each site, because the inset is part of it --
- * monospace text drawn hard against the edge of a tinted block reads as a clipping fault, and three
- * copies of "clip, fill, pad" drift apart the first time one of them is adjusted.
- *
- * The colour is [rawSurface], which is also what a code block inside a reply is given; that is the
- * point of having one name for it. Markdown's blocks are painted by the renderer rather than by
- * this, since it draws its own, but they are the same colour on purpose.
- */
-@Composable
-fun RawBlock(modifier: Modifier = Modifier, content: @Composable ColumnScope.() -> Unit) {
-    Column(
-        modifier
-            .fillMaxWidth()
-            // Smaller than a card's radius, and deliberately: this sits *inside* one, and a
-            // rounded rectangle drawn at the same radius as the rounded rectangle behind it reads
-            // as a misprint rather than as nesting.
-            .clip(MaterialTheme.shapes.extraSmall)
-            .background(rawSurface)
-            .padding(horizontal = 8.dp, vertical = 6.dp),
-        content = content,
-    )
-}

app/androidApp/src/main/kotlin/com/example/aiapp/ResetCountdown.kt

@@ -1,57 +0,0 @@
-package com.example.aiapp
-
-import java.time.Duration
-import java.time.OffsetDateTime
-
-// How long is left in a usage window. Shared by the session bar and the usage screen: the
-// arithmetic is the same in both and only the sentence around it differs, so everything here
-// returns the span or the state on its own and leaves the wording to the caller.
-
-/** "1d 4h", "3h 12m", "12m" -- the span alone, with no leading or trailing words. */
-fun formatSpan(until: Duration): String =
-    when {
-        until.toHours() >= 24 -> "${until.toDays()}d ${until.toHours() % 24}h"
-        until.toHours() > 0 -> "${until.toHours()}h ${until.toMinutes() % 60}m"
-        else -> "${until.toMinutes()}m"
-    }
-
-/**
- * What is known about when a usage window ends.
- *
- * Three answers rather than a nullable duration, because two of them shared `null` and they are not
- * the same thing at all. A window the server sent no reset time for is one that is **not running**:
- * the five-hour window is anchored to the block it started in, so between sessions there is nothing
- * counting down and the API says so by omitting the field -- measured against a live response on
- * 2026-08-31, where the five-hour window's reset was exactly five hours after the moment work
- * resumed. A timestamp that did arrive and could not be read is the genuinely unknown case, and it
- * is the only one worth those words.
- *
- * Collapsing them put "reset time unknown" on the session bar for a machine behaving perfectly, on
- * the one row somebody reads before starting something big -- and the usage dialog, looking at the
- * same field, quietly drew nothing. Two rules for one missing value; this is the rule.
- */
-sealed class WindowEnd {
-    /** No reset time was sent, so nothing is running in this window. Not a failure to find out. */
-    data object NotRunning : WindowEnd()
-
-    /** A timestamp arrived and could not be read. The one case that is actually unknown. */
-    data object Unreadable : WindowEnd()
-
-    /** How long is left. Negative once the window is past, which each caller words for itself. */
-    data class Ends(val until: Duration) : WindowEnd()
-}
-
-/**
- * [resetsAt] as the server sent it -- absent, unreadable, or a moment -- against [now].
- *
- * [now] is a parameter rather than read here so a caller can drive it from state and have the
- * countdown recompute on its own schedule.
- */
-fun windowEnd(resetsAt: String?, now: OffsetDateTime): WindowEnd {
-    if (resetsAt == null) return WindowEnd.NotRunning
-    return try {
-        WindowEnd.Ends(Duration.between(now, OffsetDateTime.parse(resetsAt)))
-    } catch (_: Exception) {
-        WindowEnd.Unreadable
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/ScrollAnchor.kt

@@ -1,57 +0,0 @@
-package com.example.aiapp
-
-import android.content.Context
-import androidx.core.content.edit
-
-private const val ANCHORS = "session-scroll"
-
-/**
- * Where a session's transcript was left, so reopening it lands where reading stopped.
- *
- * Named by a **sequence number** -- see [TranscriptRow.startSeq] -- rather than by an index or by
- * the row key the list draws with. An index means nothing across a reopen, since the transcript is
- * fetched newest-first and a session that has said anything since has renumbered every position.
- * The row key looks stable and is not: a tool row is named after its run, `joinPages` gives a run
- * the name of its newest half, and the newest half is whatever the newest page happened to start
- * with -- so an active session renames its tool runs every time it is reopened, and an anchor
- * naming one is never found. A seq is the server's own numbering, assigned once and never moved.
- *
- * [unit] is which unit of the row the viewport started at -- see [TranscriptUnit.ordinal] -- and
- * [offset] how far that unit was scrolled past the viewport's newest edge, in pixels. A seq alone
- * is not a place: a reply is one seq and can be forty blocks long, and a reader stopped halfway
- * down it is put back at that block, not at the reply.
- */
-data class ScrollAnchor(val seq: Long, val offset: Int, val unit: Int = 0)
-
-/**
- * On this device rather than on the backend, which is where this app otherwise keeps state so every
- * device sees it. Scroll position is the same exception a draft is: it is where the phone in
- * somebody's hand is pointed, and having one device jump because another was scrolled would be a
- * surprise rather than a convenience.
- */
-fun loadScrollAnchor(context: Context, sessionId: String): ScrollAnchor? {
-    val stored =
-        context.getSharedPreferences(ANCHORS, Context.MODE_PRIVATE).getString(sessionId, null)
-            ?: return null
-    val fields = stored.split(':')
-    val seq = fields.getOrNull(0)?.toLongOrNull() ?: return null
-    val offset = fields.getOrNull(1)?.toIntOrNull() ?: return null
-    // Positions saved before the unit was recorded name the row's oldest unit, which is the
-    // closest older place -- the same choice [unitIndexFor] makes when a unit is gone.
-    return ScrollAnchor(seq, offset, fields.getOrNull(2)?.toIntOrNull() ?: 0)
-}
-
-/**
- * Records where [sessionId] is being read, or forgets it when [anchor] is null.
- *
- * The path out is reading to the newest end, which is what the caller passes null for: a session
- * left at the bottom has nothing to restore and should open at the bottom, which is also the cheap
- * case. A session *deleted* while it held an anchor leaves its key behind, for the reason and at
- * the cost `Drafts.kt` describes.
- */
-fun saveScrollAnchor(context: Context, sessionId: String, anchor: ScrollAnchor?) {
-    context.getSharedPreferences(ANCHORS, Context.MODE_PRIVATE).edit {
-        if (anchor == null) remove(sessionId)
-        else putString(sessionId, "${anchor.seq}:${anchor.offset}:${anchor.unit}")
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/ServerConfig.kt

@@ -1,28 +0,0 @@
-package com.example.aiapp
-
-import android.content.Context
-import android.net.Uri
-import com.example.wgapplink.ServerStore
-
-/**
- * Where the backend is and how to authenticate to it. Absent until the phone is enrolled -- by
- * scanning the server's terminal QR (an `aiapp://enroll` URI the camera app hands to MainActivity)
- * or by typing the fields into the settings screen.
- */
-typealias ServerSettings = com.example.wgapplink.ServerSettings
-
-/**
- * This app's enrollment, which is the whole of what is product-specific about it.
- *
- * Both values are load-bearing and neither may be changed casually. The scheme is what routes a
- * scanned QR here rather than to Dev Updater, and the key alias names the Android Keystore key the
- * token is already sealed under on every enrolled phone -- changing it would leave those phones
- * reading as not enrolled, with no error to explain why.
- */
-private val store = ServerStore(scheme = "aiapp", keyAlias = "aiapp-token-key")
-
-fun loadServerSettings(context: Context): ServerSettings? = store.load(context)
-
-fun saveServerSettings(context: Context, settings: ServerSettings) = store.save(context, settings)
-
-fun parseEnrollmentUri(uri: Uri): ServerSettings? = store.parseEnrollmentUri(uri)

app/androidApp/src/main/kotlin/com/example/aiapp/SessionAlerts.kt

@@ -1,186 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.animation.core.Animatable
-import androidx.compose.animation.core.LinearEasing
-import androidx.compose.animation.core.tween
-import androidx.compose.foundation.BorderStroke
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.material3.Card
-import androidx.compose.material3.CardDefaults
-import androidx.compose.material3.LinearProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.SwipeToDismissBox
-import androidx.compose.material3.SwipeToDismissBoxValue
-import androidx.compose.material3.Text
-import androidx.compose.material3.rememberSwipeToDismissBoxState
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.key
-import androidx.compose.runtime.mutableIntStateOf
-import androidx.compose.runtime.mutableStateListOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.dp
-import androidx.lifecycle.Lifecycle
-import androidx.lifecycle.compose.LocalLifecycleOwner
-import androidx.lifecycle.repeatOnLifecycle
-
-/**
- * A session wanting attention, said over the app rather than through Android's drawer.
- *
- * Two places can carry the same fact and only one of them is right at a time. A row in the shade is
- * for somebody looking at something else: it makes a sound, it waits however long it has to, and
- * acting on it means leaving whatever they were doing. Somebody with this app open needs none of
- * that -- they are already here, and what a tap on the notification would have done is what a tap
- * on this does. So while these are on screen the stream is delivered here instead, which is
- * arranged by the collection below and nothing else; see `NotificationService.forTheScreen`.
- *
- * A banner can go three ways, and each is somebody deciding something different: tapped, which
- * opens the session; pushed off either side; or left alone, in which case it goes by itself when
- * the bar across its foot runs out.
- */
-@Composable
-fun SessionAlerts(onOpen: (SessionOpenRequest) -> Unit, modifier: Modifier = Modifier) {
-    val queue = remember { mutableStateListOf<SessionAlert>() }
-    // What tells two notifications about one session apart, and what a replaced banner gets a new
-    // one of so its timer starts again rather than inheriting the remains of the last one's.
-    var arrivals by remember { mutableIntStateOf(0) }
-    val lifecycleOwner = LocalLifecycleOwner.current
-    LaunchedEffect(lifecycleOwner) {
-        lifecycleOwner.repeatOnLifecycle(Lifecycle.State.RESUMED) {
-            try {
-                NotificationService.forTheScreen.collect { notification ->
-                    arrivals++
-                    val alert = SessionAlert(notification, arrivals)
-                    // One banner per session, replacing that session's own -- the same rule the
-                    // drawer follows, and for the same reason: a session that finished and then
-                    // asked a question is one thing to know about, the question. It keeps its
-                    // place in the queue rather than moving to the end, because the reader may
-                    // already be reaching for it.
-                    val already = queue.indexOfFirst {
-                        it.notification.sessionId == notification.sessionId
-                    }
-                    if (already >= 0) queue[already] = alert else queue.add(alert)
-                }
-            } finally {
-                // Leaving the app hands the job back to the drawer, so nothing arriving while it
-                // is away is lost. What would be lost is the truth of what is already up: these
-                // say a session wants somebody *now*, and one still sitting here on a return
-                // several minutes later is a claim nobody checked. Frozen, too -- Compose stops
-                // the clock with the window, so the timer that was going to retire it has been
-                // standing still the whole time.
-                queue.clear()
-            }
-        }
-    }
-    // Oldest at the top, so a new one appears below the ones already being read instead of
-    // shoving them down the screen mid-reach.
-    Column(modifier.fillMaxWidth().padding(8.dp)) {
-        queue.forEach { alert ->
-            key(alert.arrival) {
-                AlertBanner(
-                    alert = alert,
-                    onOpen = {
-                        queue.remove(alert)
-                        onOpen(SessionOpenRequest(alert.notification.sessionId, alert.arrival))
-                    },
-                    onGone = { queue.remove(alert) },
-                )
-            }
-        }
-    }
-}
-
-/** One notification queued for the screen, with the arrival that tells it from its predecessor. */
-private data class SessionAlert(val notification: SessionNotification, val arrival: Int)
-
-/**
- * One banner: what wants attention, and how long this has left to say so.
- *
- * The bar and the going away are one value rather than a bar beside a timer, because two of them
- * would be two accounts of the same countdown and only one can be the one that fires. What is drawn
- * is therefore the thing that decides, which is the only arrangement where a bar that has emptied
- * cannot be sitting under a banner that is still there.
- */
-@Composable
-private fun AlertBanner(alert: SessionAlert, onOpen: () -> Unit, onGone: () -> Unit) {
-    val swipe = rememberSwipeToDismissBoxState()
-    val life = remember { Animatable(1f) }
-    LaunchedEffect(Unit) {
-        life.animateTo(0f, animationSpec = tween(ALERT_LIFE_MS, easing = LinearEasing))
-        onGone()
-    }
-    // Settled is "still where it started"; anything else is a push that carried far enough for the
-    // gesture to commit, which the platform decides rather than this screen.
-    LaunchedEffect(swipe.currentValue) {
-        if (swipe.currentValue != SwipeToDismissBoxValue.Settled) onGone()
-    }
-    SwipeToDismissBox(
-        state = swipe,
-        // Nothing behind it. Pushing one of these away means the same thing whichever way it went,
-        // so a coloured ground with an icon would be drawing a distinction that isn't there.
-        backgroundContent = {},
-        modifier = Modifier.padding(bottom = 8.dp),
-    ) {
-        Card(
-            onClick = onOpen,
-            colors =
-                CardDefaults.cardColors(
-                    containerColor = MaterialTheme.colorScheme.surfaceContainerHigh
-                ),
-            // Outlined, because the step it needs to make is not one this palette can make with a
-            // tint: the card under a banner on the session list is the same surface, so a banner
-            // relying on colour alone reads as one more row that happens to be in the way. The
-            // border is the one cue, and the elevation beside it is the platform's shadow rather
-            // than a second tint -- Material draws no tonal overlay over a container stated here.
-            border = BorderStroke(1.dp, MaterialTheme.colorScheme.outline),
-            elevation = CardDefaults.cardElevation(defaultElevation = 6.dp),
-        ) {
-            Column(Modifier.padding(start = 12.dp, end = 12.dp, top = 12.dp, bottom = 10.dp)) {
-                Text(
-                    alert.notification.title,
-                    style = MaterialTheme.typography.titleSmall,
-                    // One line, cut at the tail: a session is identified by the start of its
-                    // name, and a banner that grew with the name would move the one below it.
-                    maxLines = 1,
-                    overflow = TextOverflow.Ellipsis,
-                )
-                Text(
-                    attentionLine(alert.notification.kind),
-                    style = MaterialTheme.typography.labelLarge,
-                    // The list's own colour for a session waiting on a person, so the banner and
-                    // the row behind it are saying one thing rather than two.
-                    color =
-                        if (alert.notification.kind == "awaitingInput") awaitingColor
-                        else MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-            }
-            LinearProgressIndicator(
-                progress = { life.value },
-                // Blue because it is reporting how much of something is left rather than passing
-                // judgement on it -- the reason `progressColor` exists. Stated beside the track,
-                // which is the card's own colour so that the spent part reads as empty rather
-                // than as a second bar.
-                color = progressColor,
-                trackColor = MaterialTheme.colorScheme.surfaceContainerHigh,
-                drawStopIndicator = {},
-                gapSize = 0.dp,
-                modifier = Modifier.fillMaxWidth(),
-            )
-        }
-    }
-}
-
-/**
- * How long a banner stays if nobody touches it.
- *
- * Long enough to read a session name and a line, short enough that a stack of them clears itself
- * while somebody is still on the screen that produced them. The bar makes the number visible, so
- * this is a duration the reader can watch rather than one they have to learn.
- */
-private const val ALERT_LIFE_MS = 6_000

app/androidApp/src/main/kotlin/com/example/aiapp/SessionImage.kt

@@ -1,234 +0,0 @@
-package com.example.aiapp
-
-import android.graphics.BitmapFactory
-import androidx.compose.foundation.Image
-import androidx.compose.foundation.background
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.gestures.detectTransformGestures
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableFloatStateOf
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.graphics.FilterQuality
-import androidx.compose.ui.graphics.ImageBitmap
-import androidx.compose.ui.graphics.asImageBitmap
-import androidx.compose.ui.graphics.graphicsLayer
-import androidx.compose.ui.input.pointer.pointerInput
-import androidx.compose.ui.layout.ContentScale
-import androidx.compose.ui.platform.LocalDensity
-import androidx.compose.ui.unit.Dp
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.unit.isSpecified
-import androidx.compose.ui.window.Dialog
-import androidx.compose.ui.window.DialogProperties
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.withContext
-
-/**
- * One image from the session's files route: the bitmap once it arrives, and whether it never will.
- *
- * [failed] exists because the two empty states differ in kind -- still coming and never coming --
- * and a reader can act on the second; each caller supplies its own words for them.
- */
-data class SessionBitmap(val bitmap: ImageBitmap?, val failed: Boolean)
-
-/**
- * Fetches (authenticated, pinned) and decodes one transcript image, remembered per ref so scrolling
- * does not refetch.
- *
- * Shared by the transcript's images and the composer's pending attachments, because the fetch, the
- * decode and the two-state answer are one block of logic that had been written twice.
- */
-@Composable
-fun rememberSessionBitmap(settings: ServerSettings, sessionId: String, ref: String): SessionBitmap {
-    var state by remember(ref) { mutableStateOf(SessionBitmap(null, failed = false)) }
-    LaunchedEffect(ref) {
-        state =
-            try {
-                val bytes =
-                    withContext(Dispatchers.IO) { fetchSessionFile(settings, sessionId, ref) }
-                val decoded = BitmapFactory.decodeByteArray(bytes, 0, bytes.size)?.asImageBitmap()
-                SessionBitmap(decoded, failed = decoded == null)
-            } catch (_: ApiException) {
-                SessionBitmap(null, failed = true)
-            }
-    }
-    return state
-}
-
-/**
- * An image in the transcript: a fixed-height thumbnail that opens full screen.
- *
- * The height is decided before the bytes arrive and never changes. An image row that grew when it
- * finished loading pushed everything below it, so a transcript being read scrolled itself while
- * somebody was looking at it -- and in a bottom-anchored list, images loading above the viewport
- * moved the text under the reader's eyes. Reserving the final height makes loading invisible, which
- * is what it should be.
- *
- * Four lines of body text, so a screenshot reads as an attachment beside the conversation rather
- * than as a page of its own. Full size is one tap away -- but the full-size view itself is not
- * here. [onOpen] hands the ref to the screen, which draws [SessionImageViewer] outside the list;
- * see that function for the reason.
- */
-@Composable
-fun SessionImage(
-    settings: ServerSettings,
-    sessionId: String,
-    ref: String,
-    onOpen: (String) -> Unit,
-) {
-    val (bitmap, failed) = rememberSessionBitmap(settings, sessionId, ref)
-    val height = thumbnailHeight()
-    val heightPx = with(LocalDensity.current) { height.roundToPx() }
-    Box(Modifier.fillMaxWidth().height(height), contentAlignment = Alignment.CenterStart) {
-        when (val image = bitmap) {
-            null ->
-                Text(
-                    // Two states, not one: an image still arriving and an image that will never
-                    // arrive look nothing alike to a reader who can do something about the second.
-                    if (failed) "[image $ref unavailable]" else "[loading image…]",
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-            else ->
-                Image(
-                    bitmap = image,
-                    contentDescription = "Attached image, tap to view full screen",
-                    contentScale = ContentScale.Fit,
-                    filterQuality = enlargingFilter(image.height, heightPx),
-                    modifier = Modifier.fillMaxSize().clickable { onOpen(ref) },
-                    alignment = Alignment.CenterStart,
-                )
-        }
-    }
-}
-
-/**
- * The image somebody opened, drawn by the screen rather than by the row it was tapped in.
- *
- * The row is the wrong place to hold this, and it took a real fault to see why: an image from a
- * `Read` on its own is a row of one call, and the moment the next call arrives the two become a
- * group -- a different composable in a different part of the tree, so everything the old subtree
- * remembered goes, the dialog included. Somebody looking at a screenshot was thrown back to the
- * transcript because the session made another tool call. The same happens to a row regrouped by a
- * page of history landing.
- *
- * Held by the screen, none of that reaches it: what is open is a property of the screen, not of
- * whichever row happened to draw the thumbnail.
- *
- * The cost is one fetch, since the thumbnail's decoded bitmap belongs to a row this does not go
- * through. Paid deliberately rather than plumbed around: it is one request for a picture somebody
- * asked to see, and the loading and unavailable states below are the same two the thumbnail draws.
- */
-@Composable
-fun SessionImageViewer(
-    settings: ServerSettings,
-    sessionId: String,
-    ref: String,
-    onClose: () -> Unit,
-) {
-    val (bitmap, failed) = rememberSessionBitmap(settings, sessionId, ref)
-    Dialog(
-        onDismissRequest = onClose,
-        properties = DialogProperties(usePlatformDefaultWidth = false),
-    ) {
-        Box(
-            Modifier.fillMaxSize().background(Color.Black).clickable(onClick = onClose),
-            contentAlignment = Alignment.Center,
-        ) {
-            when (val image = bitmap) {
-                // Two states, not one, exactly as the thumbnail has them: still coming, and never
-                // coming. Stated in white because this box paints its own black behind them and a
-                // theme colour would be picked against a surface that is not there.
-                null ->
-                    Text(
-                        if (failed) "Image $ref is unavailable" else "Loading image…",
-                        color = Color.White,
-                        style = MaterialTheme.typography.bodyMedium,
-                    )
-                else -> ZoomableImage(image)
-            }
-        }
-    }
-}
-
-/**
- * Four lines of the body style the transcript is set in.
- *
- * Measured from the type rather than written as a dp, so it stays four lines when the text size
- * changes -- including when the reader has scaled fonts up, which is exactly when a hardcoded
- * height would be wrong.
- */
-@Composable
-private fun thumbnailHeight(): Dp {
-    val line = MaterialTheme.typography.bodyLarge.lineHeight
-    val density = LocalDensity.current
-    return remember(line, density) {
-        with(density) { if (line.isSpecified) (line * 4).toDp() else 96.dp }
-    }
-}
-
-/**
- * Nearest neighbour when the image is being enlarged, smooth when it is being shrunk.
- *
- * A small image blown up with interpolation turns into a blur that hides what it is -- the same
- * image with hard pixel edges stays readable. Shrinking wants the opposite, so this is a decision
- * per image rather than a preference set once.
- */
-private fun enlargingFilter(sourceHeight: Int, drawnHeight: Int): FilterQuality =
-    if (sourceHeight < drawnHeight) FilterQuality.None else FilterQuality.High
-
-/**
- * The image on its own, as large as it fits, with pinch to zoom.
- *
- * Inside a dialog rather than a screen -- see [SessionImageViewer] -- so the platform's back
- * gesture returns to the transcript instead of leaving the app. It opens fitted, the whole image
- * visible, which is the thing a reader wants first; zoom is theirs from there.
- */
-@Composable
-private fun ZoomableImage(image: ImageBitmap) {
-    var scale by remember { mutableFloatStateOf(1f) }
-    var offsetX by remember { mutableFloatStateOf(0f) }
-    var offsetY by remember { mutableFloatStateOf(0f) }
-    Image(
-        bitmap = image,
-        contentDescription = "Attached image",
-        contentScale = ContentScale.Fit,
-        // Zoomed in, the reader is looking at pixels on purpose.
-        filterQuality = FilterQuality.None,
-        modifier =
-            Modifier.fillMaxSize()
-                .pointerInput(Unit) {
-                    detectTransformGestures { _, pan, zoom, _ ->
-                        // Floor of 1 so the image cannot be pinched smaller than fitted, which is
-                        // already the whole of it; a ceiling so it cannot be lost off-screen.
-                        scale = (scale * zoom).coerceIn(1f, 8f)
-                        if (scale > 1f) {
-                            offsetX += pan.x
-                            offsetY += pan.y
-                        } else {
-                            offsetX = 0f
-                            offsetY = 0f
-                        }
-                    }
-                }
-                .graphicsLayer {
-                    scaleX = scale
-                    scaleY = scale
-                    translationX = offsetX
-                    translationY = offsetY
-                },
-    )
-}

app/androidApp/src/main/kotlin/com/example/aiapp/SessionListScreen.kt

@@ -1,377 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.ExperimentalFoundationApi
-import androidx.compose.foundation.combinedClickable
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.width
-import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.material3.AlertDialog
-import androidx.compose.material3.Card
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.FloatingActionButton
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Switch
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.unit.dp
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-/**
- * The sessions tab: sessions awaiting an answer sort to the top, which is the "your turn" inbox.
- *
- * No title and no Back of its own -- [MainScreen] owns the header and the tab that names this one.
- * What stays here is the button that adds a session, because that acts on this list and nothing
- * else.
- */
-@Composable
-fun SessionListScreen(
-    settings: ServerSettings,
-    reloadToken: Int,
-    onOpen: (SessionSummary) -> Unit,
-    onSpawn: () -> Unit,
-) {
-    val scope = rememberCoroutineScope()
-    var listState by remember { mutableStateOf<LoadState<List<SessionSummary>>>(LoadState.Loading) }
-    var confirmingDelete by remember { mutableStateOf<SessionSummary?>(null) }
-
-    // Failures that belong to one session rather than to the list, keyed by
-    // its id and shown on its own card. The two scopes are decided by
-    // whether the server answered: it answered and refused, so this says
-    // nothing about the other rows, where a server that has stopped
-    // answering leaves every row stale and is `listState`'s to report.
-    //
-    // Cleared on the next successful load below -- an entry outlives its
-    // session otherwise, and would reappear against whatever the phone
-    // fetched next.
-    var deleteErrors by remember { mutableStateOf<Map<String, String>>(emptyMap()) }
-
-    // Which sessions have a delete in flight. A set of ids rather than a flag on the row,
-    // because the rows are rebuilt from whatever the server last said and this belongs to the
-    // request rather than to the session.
-    var deleting by remember { mutableStateOf<Set<String>>(emptySet()) }
-
-    fun refresh() {
-        listState = LoadState.Loading
-        scope.launch {
-            listState =
-                try {
-                    val loaded =
-                        withContext(Dispatchers.IO) { LoadState.Loaded(fetchSessions(settings)) }
-                    deleteErrors = emptyMap()
-                    loaded
-                } catch (e: ApiException) {
-                    LoadState.failed(e)
-                }
-        }
-    }
-
-    LaunchedEffect(reloadToken) { refresh() }
-
-    Box(Modifier.fillMaxSize()) {
-        Column(Modifier.fillMaxSize().padding(16.dp)) {
-            when (val state = listState) {
-                is LoadState.Loading -> CircularProgressIndicator()
-                // The message as Api.kt wrote it, with nothing added: it is
-                // already a whole sentence naming the address and what to
-                // check, so a prefix here read "Couldn't reach the server:
-                // Couldn't reach the server at ...". It was also a guess --
-                // a delete that the server itself refused had reached it
-                // fine.
-                is LoadState.Error ->
-                    Text(
-                        state.message,
-                        color = MaterialTheme.colorScheme.error,
-                    )
-                is LoadState.Loaded -> {
-                    if (state.value.isEmpty()) {
-                        Text(
-                            "No sessions. Tap + to spawn one.",
-                            style = MaterialTheme.typography.bodyMedium,
-                            color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        )
-                    }
-                    // Awaiting-answer first (the point of the screen), then
-                    // most recently active.
-                    val ordered =
-                        state.value.sortedWith(
-                            compareByDescending<SessionSummary> { it.status == "awaitingInput" }
-                                .thenByDescending { it.lastActivity }
-                        )
-                    LazyColumn {
-                        uniqueItems(ordered, key = { it.id }) { session ->
-                            SessionCard(
-                                session = session,
-                                error = deleteErrors[session.id],
-                                deleting = session.id in deleting,
-                                onOpen = { onOpen(session) },
-                                onLongPress = { confirmingDelete = session },
-                            )
-                            Spacer(Modifier.height(12.dp))
-                        }
-                    }
-                }
-            }
-        }
-
-        FloatingActionButton(
-            onClick = onSpawn,
-            modifier = Modifier.align(Alignment.BottomEnd).padding(24.dp),
-        ) {
-            Text("+", style = MaterialTheme.typography.headlineMedium)
-        }
-    }
-
-    confirmingDelete?.let { session ->
-        // Reset per session, so a toggle turned on for one conversation is not still on for the
-        // next one somebody opens this dialog for. Off to begin with: see [deleteSession].
-        var alsoDeleteForeign by remember(session.id) { mutableStateOf(false) }
-        AlertDialog(
-            onDismissRequest = { confirmingDelete = null },
-            title = { Text("Delete \"${session.title}\"?") },
-            text = {
-                // Two different acts behind one button, so it says which one this is. What
-                // separates them is whether the *driver* keeps its own record of the
-                // conversation -- the Claude Code CLI does, under ~/.claude/projects, whether
-                // this app spawned the session or imported it; echo and llama.cpp do not, and
-                // for those the app's transcript is the only copy there is.
-                //
-                // This used to branch on `imported`, above a comment asserting that "a session
-                // started here has no copy anywhere". That was simply false for every
-                // claude-cli session this app spawned, and the two warnings disagreed about
-                // sessions that were equally recoverable. Getting it wrong in that direction
-                // is the expensive one: "this can't be undone", said of something that can,
-                // spends the credibility the sentence needs on the sessions where it is true.
-                //
-                // Neither branch promises a restore. The recoverable one says what is known --
-                // the driver keeps its own record -- rather than that the file is still there,
-                // which nothing here checked; and it names what goes either way, because this
-                // app's transcript holds images, peer messages and commands that the CLI's own
-                // record never had.
-                Column {
-                    Text(
-                        when {
-                            !session.keepsOwnTranscript ->
-                                "Kills the process and deletes the conversation. Nothing else " +
-                                    "keeps a copy, so this can't be undone."
-                            // The sentence below is the one the toggle makes false, which is why
-                            // it is written twice rather than appended to: leaving "should still
-                            // be there to import again" on screen beside a switch that removes it
-                            // is the reassurance being read at the moment it stops being true.
-                            alsoDeleteForeign ->
-                                "Kills the process and deletes both copies of the conversation: " +
-                                    "this app's, and Claude Code's own transcript on the " +
-                                    "machine. Nothing keeps another, so this can't be undone."
-                            else ->
-                                "Stops the process and deletes this app's copy of the " +
-                                    "conversation, including any images, peer messages and " +
-                                    "commands recorded only here. Claude Code keeps its own " +
-                                    "transcript on the machine, so the conversation itself " +
-                                    "should still be there to import again."
-                        }
-                    )
-                    // Only where there is a second copy to decide about. Absent rather than
-                    // disabled, because this is not a capability being withheld: for echo and
-                    // llama.cpp there is no other transcript, and a switch offering to delete
-                    // one would be asking about something that does not exist.
-                    if (session.keepsOwnTranscript) {
-                        Spacer(Modifier.height(16.dp))
-                        // Its own row rather than beside the paragraph: a switch is taller than
-                        // a line of text and re-centres whatever shares a row with it.
-                        Row(verticalAlignment = Alignment.CenterVertically) {
-                            Text(
-                                "Delete Claude Code's transcript too",
-                                style = MaterialTheme.typography.bodyMedium,
-                                modifier = Modifier.weight(1f),
-                            )
-                            Spacer(Modifier.width(12.dp))
-                            Switch(
-                                checked = alsoDeleteForeign,
-                                onCheckedChange = { alsoDeleteForeign = it },
-                            )
-                        }
-                    }
-                }
-            },
-            confirmButton = {
-                TextButton(
-                    onClick = {
-                        confirmingDelete = null
-                        // Marked here rather than after the request returns: the row has to say
-                        // something is happening to it from the moment it is asked for, which
-                        // is the whole of what this state is for.
-                        deleting = deleting + session.id
-                        deleteErrors = deleteErrors - session.id
-                        scope.launch {
-                            try {
-                                withContext(Dispatchers.IO) {
-                                    deleteSession(settings, session.id, alsoDeleteForeign)
-                                }
-                                // Only this row, and only what changed. Refetching the list
-                                // instead put every other session back through loading and
-                                // handed the reader an empty screen -- to report on something
-                                // that was never in doubt.
-                                val loaded = listState
-                                if (loaded is LoadState.Loaded) {
-                                    listState =
-                                        LoadState.Loaded(
-                                            loaded.value.filterNot { it.id == session.id }
-                                        )
-                                }
-                            } catch (e: ApiException) {
-                                // Kept, because it is still there: the server refused, so the
-                                // session it refused about is exactly as it was.
-                                deleteErrors =
-                                    deleteErrors + (session.id to (e.message ?: "Delete failed"))
-                            } finally {
-                                deleting = deleting - session.id
-                            }
-                        }
-                    }
-                ) {
-                    // Coloured by consequence: this takes something away, and does so wherever
-                    // it appears -- the same rule the import screen's Delete follows.
-                    Text("Delete", color = MaterialTheme.colorScheme.error)
-                }
-            },
-            dismissButton = {
-                TextButton(onClick = { confirmingDelete = null }) { Text("Cancel") }
-            },
-        )
-    }
-}
-
-@OptIn(ExperimentalFoundationApi::class)
-@Composable
-private fun SessionCard(
-    session: SessionSummary,
-    /** What went wrong acting on *this* session, if anything has. */
-    error: String?,
-    /**
-     * Whether this session is being deleted right now.
-     *
-     * Suspended rather than removed while it is -- see [BusyItem] -- which says the row is on its
-     * way out without claiming it has gone: a row removed the moment Delete is pressed is a promise
-     * about a request that has not been answered yet, and putting it back when the server refuses
-     * is worse than never having taken it away.
-     */
-    deleting: Boolean,
-    onOpen: () -> Unit,
-    onLongPress: () -> Unit,
-) {
-    BusyItem(label = if (deleting) "deleting" else null) {
-        Card(
-            // Off while the delete is in flight: a card that still opens a session it is
-            // deleting is a race the reader can start by tapping. On the card rather than in
-            // [BusyItem], which leaves gestures alone so the list still scrolls.
-            Modifier.fillMaxWidth()
-                .combinedClickable(
-                    enabled = !deleting,
-                    onClick = onOpen,
-                    onLongClick = onLongPress,
-                )
-        ) {
-            Column(Modifier.padding(16.dp)) {
-                Row(
-                    verticalAlignment = Alignment.CenterVertically,
-                    modifier = Modifier.fillMaxWidth(),
-                ) {
-                    Text(
-                        session.title,
-                        style = MaterialTheme.typography.titleMedium,
-                        modifier = Modifier.weight(1f),
-                    )
-                    StatusText(session.status)
-                }
-                Spacer(Modifier.height(4.dp))
-                Row(modifier = Modifier.fillMaxWidth()) {
-                    Text(
-                        // Machine, then what runs on it, then what it is set to: the same order
-                        // and separator as the session screen's header and the usage dialog, so
-                        // one pair of facts is not written three ways.
-                        listOfNotNull(
-                                session.setupName,
-                                session.provider,
-                                session.model?.let { modelLabel(it) },
-                            )
-                            .joinToString(" · "),
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        modifier = Modifier.weight(1f),
-                    )
-                    Text(
-                        relativeTime(session.lastActivity),
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-                error?.let {
-                    Spacer(Modifier.height(8.dp))
-                    // The server's own words, unprefixed, the way every other
-                    // failure in this app is shown.
-                    Text(
-                        it,
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.error,
-                    )
-                }
-            }
-        }
-    }
-}
-
-@Composable
-fun StatusText(status: String) {
-    val (label, color) =
-        when (status) {
-            "awaitingInput" -> "your turn" to awaitingColor
-            "running" -> "running" to runningColor
-            "compacting" -> "compacting" to commandColor
-            "exited" -> "exited" to MaterialTheme.colorScheme.onSurfaceVariant
-            // Said in words, because it differs in kind from the others rather than in degree:
-            // the session is not idle and has not exited, nobody has been able to find out
-            // which. A muted colour alone would read as one of the quiet states.
-            "unknown" -> "can't tell" to MaterialTheme.colorScheme.onSurfaceVariant
-            else -> status to MaterialTheme.colorScheme.onSurfaceVariant
-        }
-    Row(verticalAlignment = Alignment.CenterVertically) {
-        if (sessionWorking(status)) {
-            // The same colour as the word beside it: the two are one signal, and a spinner in
-            // the theme's accent says the state is something other than what the label says.
-            CircularProgressIndicator(
-                modifier = Modifier.width(14.dp).height(14.dp),
-                strokeWidth = 2.dp,
-                color = color,
-            )
-            Spacer(Modifier.width(6.dp))
-        }
-        Text(label, style = MaterialTheme.typography.labelLarge, color = color)
-    }
-}
-
-fun relativeTime(epochSeconds: Double): String {
-    val seconds = (System.currentTimeMillis() / 1000.0 - epochSeconds).toLong()
-    return when {
-        seconds < 60 -> "just now"
-        seconds < 3600 -> "${seconds / 60}m ago"
-        seconds < 86400 -> "${seconds / 3600}h ago"
-        else -> "${seconds / 86400}d ago"
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/SessionSettingsDialog.kt

@@ -1,272 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.width
-import androidx.compose.foundation.text.KeyboardActions
-import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.material3.AlertDialog
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.Switch
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.text.input.ImeAction
-import androidx.compose.ui.unit.dp
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-/**
- * What can be changed about one session, as opposed to about this app.
- *
- * Over the session rather than a step down from it: everything here is about the conversation
- * behind it, and a dialog keeps that conversation on screen while it is being adjusted. It was a
- * screen of its own until 2026-08-30, which put a page transition and a back stack around two
- * controls and hid the thing they act on.
- *
- * The model and the permission mode are deliberately still on the session's own bar, because those
- * are changed *while* reading a turn -- "not this model, try that one" -- and a control belongs
- * with the thing it acts on.
- *
- * Nothing here is captioned. Each control is a labelled noun with a switch or a field beside it,
- * and a paragraph under every one of them made the dialog longer than the conversation it covers.
- * Failures still get their words: those are what the reader cannot work out by looking.
- */
-@Composable
-fun SessionSettingsDialog(
-    settings: ServerSettings,
-    sessionId: String,
-    /**
-     * What the session is called now, as the screen behind this knows it -- see the rename below.
-     */
-    title: String,
-    onRenamed: (String) -> Unit,
-    onDismiss: () -> Unit,
-) {
-    val scope = rememberCoroutineScope()
-    var name by remember(sessionId) { mutableStateOf(title) }
-    var saving by remember { mutableStateOf(false) }
-    var error by remember { mutableStateOf<String?>(null) }
-    // Null until the server has been asked. The row this dialog was opened over is a snapshot of
-    // whenever the list was last fetched, so drawing the switch straight from it would show a
-    // position that may have been changed since -- from here or from another device -- with
-    // nothing to say so. Until the answer arrives the switch is disabled and a spinner sits beside
-    // it, which is what not knowing looks like: distinguishable from off, and from a refusal.
-    var notify by remember(sessionId) { mutableStateOf<Boolean?>(null) }
-    var notifyError by remember { mutableStateOf<String?>(null) }
-    // Where the session works. Null until the server has been asked, for the same reason the
-    // switch above is: the row this dialog opened over is a snapshot, and a path drawn from it
-    // could be one somebody changed from another device. An empty answer is a session that was
-    // never given a directory, which is not the same as one whose directory is unknown -- the
-    // field is only enabled once one of those two is settled.
-    var cwd by remember(sessionId) { mutableStateOf<String?>(null) }
-    var typedCwd by remember(sessionId) { mutableStateOf("") }
-    var cwdError by remember { mutableStateOf<String?>(null) }
-    var movingCwd by remember { mutableStateOf(false) }
-
-    LaunchedEffect(sessionId) {
-        try {
-            val fresh = withContext(Dispatchers.IO) { fetchSession(settings, sessionId) }
-            notify = fresh.notify
-            cwd = fresh.cwd.orEmpty()
-            typedCwd = fresh.cwd.orEmpty()
-        } catch (e: ApiException) {
-            // Left unknown rather than falling back to the stale row: the switch stays
-            // disabled, instead of offering a position nothing confirmed.
-            notifyError = e.message
-            notify = null
-        }
-    }
-
-    /**
-     * Moves the session, which ends the process that is in the old directory.
-     *
-     * Said plainly beside the field rather than confirmed in a second dialog: what it costs is a
-     * process, and a stopped session is a state this app already has a word and a button for.
-     */
-    fun moveCwd() {
-        val chosen = typedCwd.trim()
-        if (movingCwd || chosen.isEmpty() || chosen == cwd) return
-        movingCwd = true
-        cwdError = null
-        scope.launch {
-            try {
-                withContext(Dispatchers.IO) { setSessionCwd(settings, sessionId, chosen) }
-                cwd = chosen
-            } catch (e: ApiException) {
-                // Where it happened: this field is the only thing on screen that knows a move was
-                // asked for, and the reason is usually the path itself.
-                cwdError = e.message
-            } finally {
-                movingCwd = false
-            }
-        }
-    }
-
-    // Moved optimistically so the switch answers the finger that moved it, and put back if the
-    // request is refused -- a switch that waits for a round trip reads as broken on a slow
-    // tunnel, and one that stays moved after a refusal lies.
-    fun setNotify(wanted: Boolean) {
-        val was = notify
-        notify = wanted
-        notifyError = null
-        scope.launch {
-            try {
-                withContext(Dispatchers.IO) { setSessionNotify(settings, sessionId, wanted) }
-            } catch (e: ApiException) {
-                notify = was
-                notifyError = e.message
-            }
-        }
-    }
-
-    // Nothing to do when the name has not changed, so the button says so rather than sending a
-    // request whose success would look exactly like the failure of having typed nothing.
-    val changed = name.trim().isNotEmpty() && name.trim() != title
-
-    fun save() {
-        if (!changed || saving) return
-        val chosen = name.trim()
-        saving = true
-        error = null
-        scope.launch {
-            try {
-                withContext(Dispatchers.IO) { renameSession(settings, sessionId, chosen) }
-                onRenamed(chosen)
-            } catch (e: ApiException) {
-                // Reported here, where it happened, because this dialog is the only place that
-                // knows a rename was attempted -- the session behind it shows nothing about it.
-                error = e.message
-                saving = false
-            }
-        }
-    }
-
-    AlertDialog(
-        onDismissRequest = onDismiss,
-        title = { Text("Session settings") },
-        text = {
-            Column {
-                OutlinedTextField(
-                    value = name,
-                    onValueChange = { name = it },
-                    label = { Text("Name") },
-                    singleLine = true,
-                    enabled = !saving,
-                    modifier = Modifier.fillMaxWidth(),
-                    // The keyboard's own action does what the button does: a one-field form
-                    // where the return key does nothing is a form people press return at anyway.
-                    keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
-                    keyboardActions = KeyboardActions(onDone = { save() }),
-                )
-                Spacer(Modifier.height(8.dp))
-                Row(
-                    verticalAlignment = Alignment.CenterVertically,
-                    modifier = Modifier.fillMaxWidth(),
-                ) {
-                    Glyph(BELL_GLYPH, colour = MaterialTheme.colorScheme.onSurface)
-                    Spacer(Modifier.width(8.dp))
-                    Text("Notifications", modifier = Modifier.weight(1f))
-                    if (notify == null && notifyError == null) {
-                        CircularProgressIndicator(
-                            modifier = Modifier.width(16.dp).height(16.dp),
-                            strokeWidth = 2.dp,
-                        )
-                        Spacer(Modifier.width(8.dp))
-                    }
-                    Switch(
-                        checked = notify == true,
-                        onCheckedChange = { setNotify(it) },
-                        enabled = notify != null,
-                    )
-                }
-                // Beside the switch that failed, not with the rename's error: they are two
-                // requests and a reader has to be able to tell which one the server refused.
-                notifyError?.let {
-                    Text(
-                        it,
-                        color = MaterialTheme.colorScheme.error,
-                        style = MaterialTheme.typography.bodySmall,
-                    )
-                }
-                Spacer(Modifier.height(8.dp))
-                Row(
-                    verticalAlignment = Alignment.CenterVertically,
-                    modifier = Modifier.fillMaxWidth(),
-                ) {
-                    OutlinedTextField(
-                        value = typedCwd,
-                        onValueChange = { typedCwd = it },
-                        label = { Text("Working directory") },
-                        // What the field cannot say by being empty: a session that was never
-                        // given one starts wherever its launcher does, and this names that
-                        // rather than showing a path nobody chose.
-                        placeholder = { Text("wherever the session was started") },
-                        singleLine = true,
-                        enabled = cwd != null && !movingCwd,
-                        modifier = Modifier.weight(1f),
-                        keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
-                        keyboardActions = KeyboardActions(onDone = { moveCwd() }),
-                    )
-                    TextButton(
-                        onClick = { moveCwd() },
-                        enabled =
-                            cwd != null &&
-                                !movingCwd &&
-                                typedCwd.trim().isNotEmpty() &&
-                                typedCwd.trim() != cwd,
-                    ) {
-                        Text(if (movingCwd) "Moving..." else "Move")
-                    }
-                }
-                // The whole of what pressing Move does, where it is about to be pressed. A
-                // directory is settled when the process is spawned, so there is no changing one
-                // under a running session -- it is ended, and the next thing said to the session
-                // starts it in the new place.
-                Text(
-                    "Moving stops the session's process. It starts again in the new directory " +
-                        "with the next message, or with Start.",
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-                cwdError?.let {
-                    Text(
-                        it,
-                        color = MaterialTheme.colorScheme.error,
-                        style = MaterialTheme.typography.bodySmall,
-                    )
-                }
-                error?.let {
-                    Spacer(Modifier.height(8.dp))
-                    Text(
-                        it,
-                        color = MaterialTheme.colorScheme.error,
-                        style = MaterialTheme.typography.bodySmall,
-                    )
-                }
-            }
-        },
-        // Disabled rather than absent while there is nothing to save: a button that comes and
-        // goes makes its own presence the signal, and its absence cannot say why.
-        confirmButton = {
-            TextButton(onClick = { save() }, enabled = changed && !saving) {
-                Text(if (saving) "Saving..." else "Save")
-            }
-        },
-        dismissButton = { TextButton(onClick = onDismiss) { Text("Close") } },
-    )
-}

app/androidApp/src/main/kotlin/com/example/aiapp/SessionUsageBar.kt

@@ -1,224 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.material3.LinearProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.unit.dp
-import java.time.Duration
-import java.time.OffsetDateTime
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.withContext
-
-/** What one machine's rate limits came back as, or why they didn't. */
-sealed class SessionUsage {
-    /** Nothing has come back yet. Distinct from every answer, including an empty one. */
-    data object Waiting : SessionUsage()
-
-    /** Every window the machine reported, in the order it reported them. */
-    data class Known(val windows: List<UsageWindow>) : SessionUsage()
-
-    /**
-     * This machine meters nothing, so there is no window to show.
-     *
-     * Separate from [Unavailable], and the distinction is the whole point: a session on `echo` or
-     * on a local llama.cpp has no paid quota at all, which is a fact about how it was set up and
-     * not a failure to find something out. The backend never asks such a machine, so it returns no
-     * snapshot for it -- and reading that silence as "couldn't find out" is exactly the mistake of
-     * answering with the nearest available word. Drawn as nothing, because there is nothing.
-     */
-    data object NotMetered : SessionUsage()
-
-    /**
-     * The question could not be answered, and why.
-     *
-     * Its own state because "we couldn't find out" and "none of it is used" are the pair that must
-     * never share an appearance: a bar sitting at zero because a machine is unreachable reads as
-     * plenty of headroom, which is the opposite of the truth.
-     */
-    data class Unavailable(val why: String) : SessionUsage()
-}
-
-/** How often to ask again. The backend caches, so this re-reads its cache rather than the API. */
-private const val REFRESH_MS = 60_000L
-
-/**
- * One machine's rate limits, polled.
- *
- * Hoisted out of [SessionUsageBar] because two things on a session's screen show this same answer
- * -- the bar, and the colour of the button that opens the usage dialog. Fetching it twice would
- * cost two round trips to say one thing, and the two copies would disagree for up to a minute at a
- * time, which is the interface contradicting itself about a number somebody is deciding on.
- */
-@Composable
-fun rememberSessionUsage(settings: ServerSettings, setup: String): SessionUsage {
-    var usage by remember(setup) { mutableStateOf<SessionUsage>(SessionUsage.Waiting) }
-    LaunchedEffect(setup) {
-        while (true) {
-            usage =
-                try {
-                    usageFor(withContext(Dispatchers.IO) { fetchUsage(settings) }, setup)
-                } catch (e: ApiException) {
-                    SessionUsage.Unavailable(e.message ?: "couldn't reach the backend")
-                }
-            delay(REFRESH_MS)
-        }
-    }
-    return usage
-}
-
-/**
- * The colour for a control that reports on [usage] as a whole: the worst window's.
- *
- * Worst rather than the five-hour one, because the button it colours opens *all* of them, and a
- * blue icon over a weekly quota at 97% would be the interface answering a question nobody asked.
- * Taken over however many windows came back rather than the three Claude sends today -- the backend
- * deliberately passes windows it does not recognise straight through, so a fourth one is a thing
- * that happens rather than a thing to notice later.
- *
- * Every state that is not a measurement takes the ordinary control colour instead. That is the
- * point where colour stops being able to help: blue is the low end of a scale here, so colouring an
- * unknown blue would say "measured, and fine" about a machine nobody could reach. The dialog behind
- * the button is where those say, in words, which one they are.
- */
-@Composable
-fun usageGlyphColour(usage: SessionUsage): Color =
-    when (usage) {
-        is SessionUsage.Known ->
-            usage.windows.maxOfOrNull { it.percent }?.let { quotaColor(it) }
-                ?: MaterialTheme.colorScheme.primary
-        else -> MaterialTheme.colorScheme.primary
-    }
-
-/**
- * The five-hour window for the machine this session runs on, under the session's own header.
- *
- * Here rather than only in the usage dialog because it is the number that decides whether to keep
- * going, and it was a screen away from the place that decision gets made. It reports on this
- * session's machine alone -- the dialog is still where every machine is compared.
- *
- * What it shows is the paid service's own metering, fetched from the machine that holds the
- * account. It is never derived from what this app has watched go past: the transcript's token
- * counts are a different quantity, measured differently, and a bar shaped like a quota gauge built
- * out of them would be a guess wearing a measurement's clothes.
- */
-@Composable
-fun SessionUsageBar(usage: SessionUsage, modifier: Modifier = Modifier) {
-    DebugStats.count("usage bar recomposed")
-    // The countdown moves even when the numbers do not, so it is driven by a clock of its own
-    // rather than recomputed at draw time: a percentage that comes back unchanged is an equal
-    // value, Compose skips the recomposition, and a "left" that only ticked when the quota
-    // happened to move would sit at a stale figure for hours.
-    var now by remember { mutableStateOf(OffsetDateTime.now()) }
-    LaunchedEffect(Unit) {
-        while (true) {
-            delay(REFRESH_MS)
-            now = OffsetDateTime.now()
-        }
-    }
-
-    // Nothing at all for a machine that meters nothing: a row saying "unknown" there would
-    // report a problem about a setup somebody chose, on every screen, forever.
-    if (usage is SessionUsage.NotMetered) {
-        return
-    }
-
-    Row(
-        verticalAlignment = Alignment.CenterVertically,
-        modifier = modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 2.dp),
-    ) {
-        // Words, not a colour and not an empty bar: every one of these is a different kind of
-        // answer from "this much is used", and only words carry a difference in kind.
-        when (val state = usage) {
-            SessionUsage.NotMetered -> Unit
-            is SessionUsage.Unavailable -> UsageNote("5-hour usage unknown -- ${state.why}")
-            SessionUsage.Waiting -> UsageNote("5-hour usage: checking")
-            is SessionUsage.Known -> {
-                val window = state.windows.firstOrNull { it.kind == "session" }
-                if (window == null) {
-                    UsageNote("5-hour usage unknown -- no five-hour window reported")
-                } else {
-                    LinearProgressIndicator(
-                        progress = { (window.percent / 100.0).toFloat().coerceIn(0f, 1f) },
-                        // The same step at the same percentages as the dialog's bars: this is the
-                        // same measurement, and a reader who learned the colour there has to be
-                        // able to read it here without checking which screen they are on.
-                        color = quotaColor(window.percent),
-                        modifier = Modifier.weight(1f),
-                    )
-                    Text(
-                        fiveHourLabel(window, now),
-                        style = MaterialTheme.typography.labelSmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        modifier = Modifier.padding(start = 8.dp),
-                    )
-                }
-            }
-        }
-    }
-}
-
-/** Anything this row says instead of drawing a bar, so all of them look the same. */
-@Composable
-private fun UsageNote(text: String) {
-    Text(
-        text,
-        style = MaterialTheme.typography.labelSmall,
-        color = MaterialTheme.colorScheme.onSurfaceVariant,
-    )
-}
-
-/**
- * "42% -- 2h 15m left": how much is gone, then how long what is left has to last.
- *
- * The percentage on its own does not answer the question it gets asked, which is whether to start
- * something now; 80% with twenty minutes to go and 80% with four hours to go are opposite answers.
- *
- * The window's end has two missing cases and they are worded differently on purpose; see
- * [WindowEnd]. A window that is not running gets the percentage and nothing else, because there is
- * no countdown to report and inventing one would be the same fault as inventing the number.
- */
-private fun fiveHourLabel(window: UsageWindow, now: OffsetDateTime): String {
-    val percent = "${window.percent.toInt()}%"
-    return when (val end = windowEnd(window.resetsAt, now)) {
-        // Between blocks the five-hour window has no reset time, and saying so is a fact about
-        // nothing: there is no window to run out. The percentage is the whole answer.
-        WindowEnd.NotRunning -> percent
-        WindowEnd.Unreadable -> "$percent · reset time unreadable"
-        is WindowEnd.Ends ->
-            // Under a minute, including past the end: the number would round to "0m left", which
-            // reads as a measurement rather than as the window having run out.
-            if (end.until < Duration.ofMinutes(1)) "$percent · refresh soon"
-            else "$percent · ${formatSpan(end.until)} left"
-    }
-}
-
-/**
- * One machine's snapshot, out of every machine's.
- *
- * Every way of having *failed* to get numbers is [SessionUsage.Unavailable] with the reason in it:
- * a machine nobody logged into, one that could not be reached, a snapshot that came back empty.
- * None of them may look like zero, and none may look like [SessionUsage.NotMetered], which is the
- * machine having no quota rather than the question going unanswered.
- */
-fun usageFor(snapshots: List<UsageSnapshot>, setup: String): SessionUsage {
-    // No snapshot at all means the backend never asked, which it only does for a machine with
-    // nothing metered on it. That is a different answer from having asked and failed.
-    val mine = snapshots.firstOrNull { it.setup == setup } ?: return SessionUsage.NotMetered
-    if (mine.state != "ok") {
-        return SessionUsage.Unavailable(mine.detail ?: mine.state)
-    }
-    return SessionUsage.Known(mine.windows)
-}

app/androidApp/src/main/kotlin/com/example/aiapp/SettingsScreen.kt

@@ -1,202 +0,0 @@
-package com.example.aiapp
-
-import android.Manifest
-import android.content.pm.PackageManager
-import androidx.activity.compose.rememberLauncherForActivityResult
-import androidx.activity.result.contract.ActivityResultContracts
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.width
-import androidx.compose.material3.Button
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedButton
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.unit.dp
-import androidx.core.net.toUri
-import com.example.wgapplink.EnrollmentScanActivity
-import com.google.zxing.client.android.Intents
-import com.journeyapps.barcodescanner.ScanContract
-import com.journeyapps.barcodescanner.ScanIntentResult
-import com.journeyapps.barcodescanner.ScanOptions
-
-/**
- * Server address and token. The normal path is the "Scan QR code" button below, which decodes the
- * server's terminal QR itself; these fields are the fallback for typing the same three values by
- * hand. [onBack] is null on first run, when there is nothing to go back to.
- */
-@Composable
-fun SettingsScreen(
-    existing: ServerSettings?,
-    onSaved: (ServerSettings) -> Unit,
-    onBack: (() -> Unit)?,
-) {
-    val context = LocalContext.current
-    var host by remember { mutableStateOf(existing?.host ?: "10.66.0.1") }
-    var port by remember { mutableStateOf((existing?.port ?: 8443).toString()) }
-    // Never pre-filled from the stored token: this screen shouldn't be a
-    // way to read the credential back off the device.
-    var token by remember { mutableStateOf("") }
-    var error by remember { mutableStateOf<String?>(null) }
-
-    val scanLauncher =
-        rememberLauncherForActivityResult(ScanContract()) { result: ScanIntentResult ->
-            // Null contents means the user backed out of the scanner -- not an
-            // error, so nothing to report.
-            val contents = result.contents ?: return@rememberLauncherForActivityResult
-            val settings = parseEnrollmentUri(contents.toUri())
-            if (settings == null) {
-                error = "Not a valid enrollment code"
-            } else {
-                saveServerSettings(context, settings)
-                onSaved(settings)
-            }
-        }
-
-    val requestCamera =
-        rememberLauncherForActivityResult(ActivityResultContracts.RequestPermission()) { granted ->
-            if (granted) {
-                scanLauncher.launch(enrollmentScanOptions())
-            } else {
-                error =
-                    "Scanning needs the camera. Grant it in the system settings, " +
-                        "or type the host, port and token in below."
-            }
-        }
-
-    Column(Modifier.fillMaxSize().padding(16.dp)) {
-        Row(verticalAlignment = Alignment.CenterVertically, modifier = Modifier.fillMaxWidth()) {
-            // Leading, where a back arrow points at what it returns to. Trailing it would put a
-            // left-pointing arrow at the right edge, aimed across the title it sits beside.
-            //
-            // Absent rather than disabled on first run, which is the one place this app lets a
-            // control come and go: there is no screen underneath yet, so a Back here would not be
-            // a capability being withheld but a promise it could not keep.
-            if (onBack != null) {
-                GlyphButton(BACK_GLYPH, "Back", onBack)
-                Spacer(Modifier.width(GLYPH_BUTTON_MARGIN))
-            }
-            Text(
-                "Server",
-                style = MaterialTheme.typography.headlineSmall,
-                modifier = Modifier.weight(1f),
-            )
-        }
-        Spacer(Modifier.height(8.dp))
-        Text(
-            "The easy way: run ai-server on the backend and scan the QR it prints. " +
-                "Or type the same values here.",
-            style = MaterialTheme.typography.bodyMedium,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
-        )
-        Spacer(Modifier.height(16.dp))
-
-        OutlinedButton(
-            onClick = {
-                // Hold the camera permission before the scanner starts.
-                // Letting its activity ask on our behalf is what the
-                // library does by default, and it opens the camera without
-                // waiting for the answer: the first-ever scan comes up as
-                // a live preview with "Sorry, the Android camera
-                // encountered a problem" over it, and works on the second
-                // try. Nothing is wrong with the camera, so nothing should
-                // say there is.
-                if (
-                    context.checkSelfPermission(Manifest.permission.CAMERA) ==
-                        PackageManager.PERMISSION_GRANTED
-                ) {
-                    scanLauncher.launch(enrollmentScanOptions())
-                } else {
-                    requestCamera.launch(Manifest.permission.CAMERA)
-                }
-            },
-            modifier = Modifier.fillMaxWidth(),
-        ) {
-            Text("Scan QR code")
-        }
-        Spacer(Modifier.height(16.dp))
-
-        OutlinedTextField(
-            value = host,
-            onValueChange = { host = it },
-            label = { Text("Host") },
-            singleLine = true,
-            modifier = Modifier.fillMaxWidth(),
-        )
-        Spacer(Modifier.height(8.dp))
-        OutlinedTextField(
-            value = port,
-            onValueChange = { port = it },
-            label = { Text("Port") },
-            singleLine = true,
-            modifier = Modifier.fillMaxWidth(),
-        )
-        Spacer(Modifier.height(8.dp))
-        OutlinedTextField(
-            value = token,
-            onValueChange = { token = it },
-            label = { Text(if (existing != null) "Token (unchanged if left blank)" else "Token") },
-            singleLine = true,
-            modifier = Modifier.fillMaxWidth(),
-        )
-        Spacer(Modifier.height(24.dp))
-
-        error?.let {
-            Text(it, color = MaterialTheme.colorScheme.error)
-            Spacer(Modifier.height(8.dp))
-        }
-
-        Button(
-            onClick = {
-                val portNumber = port.trim().toIntOrNull()
-                val effectiveToken = token.trim().ifEmpty { existing?.token ?: "" }
-                when {
-                    host.isBlank() -> error = "Host is required"
-                    portNumber == null || portNumber !in 1..65535 -> error = "Port must be 1-65535"
-                    effectiveToken.isEmpty() ->
-                        error = "Token is required -- scan the server's QR or paste it"
-                    else -> {
-                        val settings = ServerSettings(host.trim(), portNumber, effectiveToken)
-                        saveServerSettings(context, settings)
-                        onSaved(settings)
-                    }
-                }
-            }
-        ) {
-            Text("Save")
-        }
-    }
-}
-
-/**
- * How the enrollment QR is scanned, in one place because two callers reach it -- straight from the
- * button when the camera permission is already held, and from the permission result when it has
- * just been granted.
- *
- * MIXED_SCAN is the load-bearing part: ZXing otherwise looks only for a dark code on a light
- * ground, and ai-server's QR is block characters in the terminal's foreground colour, so on a
- * dark-themed terminal it comes out as a photographic negative the scanner silently never matches.
- * Which way round it renders is the terminal's business, not something this app should depend on.
- * The mixed decoder alternates normal and inverted frames, costing half the frame rate at each
- * polarity and nothing else.
- */
-private fun enrollmentScanOptions(): ScanOptions =
-    ScanOptions()
-        .setDesiredBarcodeFormats(ScanOptions.QR_CODE)
-        .setCaptureActivity(EnrollmentScanActivity::class.java)
-        // Follow the phone, not the library's landscape pin.
-        .setOrientationLocked(false)
-        .addExtra(Intents.Scan.SCAN_TYPE, Intents.Scan.MIXED_SCAN)

app/androidApp/src/main/kotlin/com/example/aiapp/SetupsScreen.kt

@@ -1,394 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.material3.AlertDialog
-import androidx.compose.material3.Card
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.unit.dp
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-/**
- * The machines this backend can run things on.
- *
- * Note what this screen cannot do: name a program. Providers are what the server found when it
- * asked the machine, so adding one is "here is how to reach it" and never "here is what to run" --
- * which is what keeps the enrolled token from being able to introduce commands.
- */
-@Composable
-fun SetupsScreen(settings: ServerSettings, reloadToken: Int) {
-    val scope = rememberCoroutineScope()
-    var state by remember { mutableStateOf<LoadState<List<Setup>>>(LoadState.Loading) }
-    var adding by remember { mutableStateOf(false) }
-    var renaming by remember { mutableStateOf<Setup?>(null) }
-    var confirmingDelete by remember { mutableStateOf<Setup?>(null) }
-    var busy by remember { mutableStateOf<String?>(null) }
-    var actionError by remember { mutableStateOf<String?>(null) }
-
-    suspend fun reload() {
-        state =
-            try {
-                withContext(Dispatchers.IO) { LoadState.Loaded(fetchSetups(settings)) }
-            } catch (e: ApiException) {
-                LoadState.failed(e)
-            }
-    }
-
-    LaunchedEffect(reloadToken) { reload() }
-
-    Column(Modifier.fillMaxSize().padding(16.dp)) {
-        // The heading and Back are the tab row's now; adding a machine is this tab's own work
-        // and stays with the list it adds to.
-        Row(verticalAlignment = Alignment.CenterVertically, modifier = Modifier.fillMaxWidth()) {
-            TextButton(onClick = { adding = true }) { Text("Add machine") }
-        }
-        Spacer(Modifier.height(8.dp))
-
-        actionError?.let {
-            Text(it, color = MaterialTheme.colorScheme.error)
-            Spacer(Modifier.height(8.dp))
-        }
-        busy?.let {
-            Row(verticalAlignment = Alignment.CenterVertically) {
-                CircularProgressIndicator(Modifier.height(16.dp).padding(end = 8.dp))
-                Text(it, style = MaterialTheme.typography.bodySmall)
-            }
-            Spacer(Modifier.height(8.dp))
-        }
-
-        when (val current = state) {
-            is LoadState.Loading -> CircularProgressIndicator()
-            is LoadState.Error -> Text(current.message, color = MaterialTheme.colorScheme.error)
-            is LoadState.Loaded ->
-                LazyColumn(Modifier.fillMaxSize()) {
-                    uniqueItems(current.value, key = { it.id }) { setup ->
-                        SetupCard(
-                            setup = setup,
-                            onRename = { renaming = setup },
-                            onRediscover = {
-                                scope.launch {
-                                    busy = "Asking ${setup.name} what it has…"
-                                    actionError =
-                                        runCatching {
-                                            withContext(Dispatchers.IO) {
-                                                updateSetup(
-                                                    settings,
-                                                    setup.id,
-                                                    rediscover = true,
-                                                )
-                                            }
-                                        }
-                                            .exceptionOrNull()
-                                            ?.message
-                                    busy = null
-                                    reload()
-                                }
-                            },
-                            onDelete = { confirmingDelete = setup },
-                        )
-                    }
-                }
-        }
-    }
-
-    if (adding) {
-        AddSetupDialog(
-            onDismiss = { adding = false },
-            onAdd = { name, ssh ->
-                adding = false
-                scope.launch {
-                    busy = "Asking $name what it has…"
-                    actionError =
-                        runCatching {
-                            withContext(Dispatchers.IO) { addSetup(settings, name, ssh) }
-                        }
-                            .exceptionOrNull()
-                            ?.message
-                    busy = null
-                    reload()
-                }
-            },
-            onTest = { ssh -> withContext(Dispatchers.IO) { probeSetup(settings, ssh) } },
-        )
-    }
-
-    renaming?.let { setup ->
-        RenameDialog(
-            setup = setup,
-            onDismiss = { renaming = null },
-            onRename = { name ->
-                renaming = null
-                scope.launch {
-                    actionError =
-                        runCatching {
-                            withContext(Dispatchers.IO) {
-                                updateSetup(settings, setup.id, name = name)
-                            }
-                        }
-                            .exceptionOrNull()
-                            ?.message
-                    reload()
-                }
-            },
-        )
-    }
-
-    confirmingDelete?.let { setup ->
-        AlertDialog(
-            onDismissRequest = { confirmingDelete = null },
-            title = { Text("Remove \"${setup.name}\"?") },
-            text = {
-                Text(
-                    "The machine is left alone -- this only stops this app offering it. " +
-                        "Sessions still running on it must be deleted first."
-                )
-            },
-            confirmButton = {
-                TextButton(
-                    onClick = {
-                        confirmingDelete = null
-                        scope.launch {
-                            actionError =
-                                runCatching {
-                                    withContext(Dispatchers.IO) { deleteSetup(settings, setup.id) }
-                                }
-                                    .exceptionOrNull()
-                                    ?.message
-                            reload()
-                        }
-                    }
-                ) {
-                    Text("Remove")
-                }
-            },
-            dismissButton = {
-                TextButton(onClick = { confirmingDelete = null }) { Text("Cancel") }
-            },
-        )
-    }
-}
-
-@Composable
-private fun SetupCard(
-    setup: Setup,
-    onRename: () -> Unit,
-    onRediscover: () -> Unit,
-    onDelete: () -> Unit,
-) {
-    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
-        Column(Modifier.padding(12.dp)) {
-            Text(setup.name, style = MaterialTheme.typography.titleSmall)
-            Text(
-                // Not "this machine": the seeded setup is *called* that,
-                // and the card read "this machine / this machine". The
-                // line has to say something the name cannot also be.
-                setup.address ?: "runs where the backend does",
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-            Spacer(Modifier.height(4.dp))
-            Text(
-                if (setup.providers.isEmpty()) {
-                    "Nothing found on it. Install something and rediscover."
-                } else {
-                    setup.providers.joinToString(" · ") { it.name }
-                },
-                style = MaterialTheme.typography.bodySmall,
-            )
-            Row(verticalAlignment = Alignment.CenterVertically) {
-                TextButton(onClick = onRename) { Text("Rename") }
-                TextButton(onClick = onRediscover) { Text("Rediscover") }
-                Spacer(Modifier.weight(1f))
-                TextButton(onClick = onDelete) { Text("Remove") }
-            }
-        }
-    }
-}
-
-@Composable
-private fun AddSetupDialog(
-    onDismiss: () -> Unit,
-    onAdd: (String, SshDetails?) -> Unit,
-    onTest: suspend (SshDetails?) -> List<Provider>,
-) {
-    val scope = rememberCoroutineScope()
-    var name by remember { mutableStateOf("") }
-    var address by remember { mutableStateOf("") }
-    var identity by remember { mutableStateOf("") }
-    var tested by remember { mutableStateOf<String?>(null) }
-    var testing by remember { mutableStateOf(false) }
-
-    fun details(): SshDetails? =
-        address
-            .trim()
-            .takeIf { it.isNotEmpty() }
-            ?.let { typed ->
-                val (host, typedPort) = splitHostAndPort(typed)
-                SshDetails(
-                    address = host,
-                    port = typedPort,
-                    identityFile = identity.trim().ifEmpty { null },
-                )
-            }
-
-    AlertDialog(
-        onDismissRequest = onDismiss,
-        title = { Text("Add a machine") },
-        text = {
-            Column {
-                Text(
-                    "Leave the address blank for the machine the backend runs on. " +
-                        "What it can run is discovered, not typed.",
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-                Spacer(Modifier.height(8.dp))
-                OutlinedTextField(
-                    value = name,
-                    onValueChange = { name = it },
-                    label = { Text("Name") },
-                    singleLine = true,
-                )
-                OutlinedTextField(
-                    value = address,
-                    onValueChange = { address = it },
-                    // Just the shape. What a blank one means is said once, in the text above
-                    // this form -- repeating it here wrapped the label onto a second line and
-                    // made this field taller than the two beside it for no information.
-                    label = { Text("user@host[:port]") },
-                    singleLine = true,
-                )
-                OutlinedTextField(
-                    value = identity,
-                    onValueChange = { identity = it },
-                    label = { Text("Key path on the backend") },
-                    singleLine = true,
-                )
-                tested?.let {
-                    Spacer(Modifier.height(8.dp))
-                    Text(it, style = MaterialTheme.typography.bodySmall)
-                }
-            }
-        },
-        confirmButton = {
-            TextButton(enabled = name.isNotBlank(), onClick = { onAdd(name.trim(), details()) }) {
-                Text("Add")
-            }
-        },
-        dismissButton = {
-            Row {
-                // Tried before saving, so a wrong address or an
-                // unauthorised key is caught while this form is still on
-                // screen rather than at the first spawn.
-                TextButton(
-                    enabled = !testing,
-                    onClick = {
-                        testing = true
-                        tested = "Asking…"
-                        scope.launch {
-                            tested =
-                                runCatching { onTest(details()) }
-                                    .fold(
-                                        onSuccess = { found ->
-                                            if (found.isEmpty()) {
-                                                "Reached it, but found nothing it can run."
-                                            } else {
-                                                "Found ${found.joinToString(", ") { it.name }}"
-                                            }
-                                        },
-                                        onFailure = { it.message ?: "Couldn't reach it" },
-                                    )
-                            testing = false
-                        }
-                    },
-                ) {
-                    Text("Test")
-                }
-                TextButton(onClick = onDismiss) { Text("Cancel") }
-            }
-        },
-    )
-}
-
-@Composable
-private fun RenameDialog(setup: Setup, onDismiss: () -> Unit, onRename: (String) -> Unit) {
-    var name by remember { mutableStateOf(setup.name) }
-    AlertDialog(
-        onDismissRequest = onDismiss,
-        title = { Text("Rename") },
-        text = {
-            Column {
-                OutlinedTextField(
-                    value = name,
-                    onValueChange = { name = it },
-                    label = { Text("Name") },
-                    singleLine = true,
-                )
-                Spacer(Modifier.height(8.dp))
-                Text(
-                    "Sessions already running on it keep working -- they refer to the machine, " +
-                        "not to what it is called.",
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-            }
-        },
-        confirmButton = {
-            TextButton(enabled = name.isNotBlank(), onClick = { onRename(name.trim()) }) {
-                Text("Rename")
-            }
-        },
-        dismissButton = { TextButton(onClick = onDismiss) { Text("Cancel") } },
-    )
-}
-
-/**
- * Splits `user@host:port` into its two halves, with the port left null when none was typed.
- *
- * One field rather than two because that is how an address is written and read everywhere else --
- * and because a port that is almost always 22 does not deserve a box of its own on a phone
- * keyboard. Null rather than 22: the backend already decides the default, and writing 22 here would
- * put a second answer to that question in a second place.
- *
- * A colon only means "port" when it can. A bracketed IPv6 literal is unwrapped as ssh writes it,
- * `[::1]:22`; a bare `::1` keeps every colon, because an address with several is an address, not an
- * address and a port. So the rule is: brackets, or exactly one colon followed by digits.
- */
-private fun splitHostAndPort(typed: String): Pair<String, Int?> {
-    if (typed.startsWith("[")) {
-        val close = typed.indexOf(']')
-        if (close > 0) {
-            val host = typed.substring(1, close)
-            val rest = typed.substring(close + 1)
-            val port = rest.removePrefix(":").toIntOrNull().takeIf { rest.startsWith(":") }
-            return host to port
-        }
-    }
-    if (typed.count { it == ':' } == 1) {
-        val host = typed.substringBeforeLast(':')
-        val port = typed.substringAfterLast(':').toIntOrNull()
-        if (port != null && host.isNotEmpty()) return host to port
-    }
-    return typed to null
-}

app/androidApp/src/main/kotlin/com/example/aiapp/SpawnScreen.kt

@@ -1,358 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.ExperimentalLayoutApi
-import androidx.compose.foundation.layout.FlowRow
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.Button
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.FilterChip
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.unit.dp
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-/**
- * The spawn screen: what to run, where to run it, and the per-kind fields.
- *
- * Providers and hosts both come from the server, so adding either to its config.ron shows up here
- * with no app rebuild -- and because they are independent, any provider can be sent to any host.
- */
-@Composable
-fun SpawnScreen(
-    settings: ServerSettings,
-    onSpawned: (SessionSummary) -> Unit,
-    onBack: () -> Unit,
-) {
-    val scope = rememberCoroutineScope()
-    // What the form is made of, and whether we have it yet. A failure here
-    // is not the same as a server with nothing to offer, so it must not
-    // reach the pickers as empty lists -- see LoadState.
-    var options by remember { mutableStateOf<LoadState<List<Setup>>>(LoadState.Loading) }
-
-    // Setup first, then one of its providers. Choosing a setup can
-    // invalidate the provider, so the provider is stored by name and
-    // resolved against the current setup rather than held as an object
-    // that could outlive the list it came from.
-    var setupName by remember { mutableStateOf<String?>(null) }
-    var providerName by remember { mutableStateOf<String?>(null) }
-    var title by remember { mutableStateOf("") }
-    var model by remember { mutableStateOf("") }
-    var cwd by remember { mutableStateOf("") }
-    // "auto" rather than "manual": on a phone every ask is a round trip to
-    // a question card, and answering "allow Bash?" dozens of times per task
-    // is what this app exists to avoid. Manual stays one tap away for a
-    // session that warrants it.
-    var permissionMode by remember { mutableStateOf("auto") }
-    var busy by remember { mutableStateOf(false) }
-    // Only the spawn's own failure. The fetch's lives in `options`: this
-    // one leaves a filled-in form worth keeping, and that one leaves
-    // nothing to fill in.
-    var spawnError by remember { mutableStateOf<String?>(null) }
-    // Downloaded models, for a llama provider to choose between. Fetched
-    // beside the setups but kept separate: a Claude session needs none, so
-    // failing to list them must not stop the screen rendering.
-    var models by remember { mutableStateOf<List<LocalModel>>(emptyList()) }
-    var modelKey by remember { mutableStateOf<String?>(null) }
-    var contextSize by remember { mutableStateOf("") }
-    var temperature by remember { mutableStateOf("") }
-
-    LaunchedEffect(Unit) {
-        options =
-            try {
-                val fetched = withContext(Dispatchers.IO) { fetchSetups(settings) }
-                val first = fetched.firstOrNull()
-                setupName = first?.name
-                providerName = first?.providers?.firstOrNull()?.name
-                LoadState.Loaded(fetched)
-            } catch (e: ApiException) {
-                LoadState.failed(e)
-            }
-        models =
-            runCatching { withContext(Dispatchers.IO) { fetchModels(settings).local } }
-                .getOrDefault(emptyList())
-    }
-
-    Column(Modifier.fillMaxSize().verticalScroll(rememberScrollState()).padding(16.dp)) {
-        Row(verticalAlignment = Alignment.CenterVertically, modifier = Modifier.fillMaxWidth()) {
-            Text(
-                "New session",
-                style = MaterialTheme.typography.headlineSmall,
-                modifier = Modifier.weight(1f),
-            )
-            TextButton(onClick = onBack) { Text("Cancel") }
-        }
-        Spacer(Modifier.height(16.dp))
-
-        // Nothing below is fillable until the options are here, and a
-        // failure to fetch them leaves no form worth showing -- so this
-        // reports and stops, rather than offering empty pickers under an
-        // error message.
-        val setups =
-            when (val state = options) {
-                is LoadState.Loading -> {
-                    CircularProgressIndicator()
-                    return@Column
-                }
-                is LoadState.Error -> {
-                    Text(state.message, color = MaterialTheme.colorScheme.error)
-                    return@Column
-                }
-                is LoadState.Loaded -> state.value
-            }
-        val setup = setups.firstOrNull { it.name == setupName }
-        val current = setup?.providers?.firstOrNull { it.name == providerName }
-        // Only the Claude CLI has models, a working directory and
-        // permission modes; keying the extra fields on the kind rather
-        // than the provider name keeps a second Claude provider from
-        // needing anything here.
-        val isClaude = current?.kind == "claude_cli"
-        val isLlama = current?.kind == "llama_cpp"
-
-        // The machine first, because it decides what can be run at all.
-        ChipGroup(
-            label = "Setup",
-            options = setups.map { it.name },
-            selected = setupName,
-            onSelect = { name ->
-                setupName = name
-                // The provider list changes with the machine, so a name
-                // carried over from the previous one would be a selection
-                // that isn't in the picker. Take that machine's first.
-                providerName =
-                    setups.firstOrNull { it.name == name }?.providers?.firstOrNull()?.name
-            },
-        )
-        setup?.address?.let {
-            Text(
-                it,
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-            // The address belongs to the setup above it, not to the
-            // provider label below; without this they read as one block.
-            Spacer(Modifier.height(8.dp))
-        }
-
-        // Only what this machine actually has. A setup with none says so
-        // rather than showing an empty row that reads as a failure.
-        if (setup != null && setup.providers.isEmpty()) {
-            Text(
-                "\"${setup.name}\" has no providers configured.",
-                style = MaterialTheme.typography.bodyMedium,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-        } else {
-            ChipGroup(
-                label = "Provider",
-                options = setup?.providers?.map { it.name }.orEmpty(),
-                selected = providerName,
-                onSelect = { providerName = it },
-            )
-        }
-
-        Spacer(Modifier.height(16.dp))
-
-        OutlinedTextField(
-            value = title,
-            onValueChange = { title = it },
-            label = { Text("Title") },
-            singleLine = true,
-            modifier = Modifier.fillMaxWidth(),
-        )
-
-        if (isLlama) {
-            // A llama session names one of the models this backend has
-            // downloaded, so the choice is that list rather than free
-            // text -- there is nothing sensible to type here, and a name
-            // that is not on disk is a session that cannot start.
-            if (models.isEmpty()) {
-                Text(
-                    "No models downloaded yet. Get one from the Models screen first.",
-                    style = MaterialTheme.typography.bodyMedium,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-            } else {
-                ChipGroup(
-                    label = "Model",
-                    // The file, not the whole key: the repository is the
-                    // same for every quantisation of a model, so the file
-                    // name is what tells two of them apart.
-                    options = models.map { it.file },
-                    selected = models.firstOrNull { it.key == modelKey }?.file,
-                    onSelect = { file -> modelKey = models.first { it.file == file }.key },
-                )
-            }
-            Spacer(Modifier.height(16.dp))
-
-            OutlinedTextField(
-                value = contextSize,
-                onValueChange = { contextSize = it },
-                label = { Text("Context size (blank = the model's default)") },
-                singleLine = true,
-                modifier = Modifier.fillMaxWidth(),
-            )
-            Spacer(Modifier.height(16.dp))
-
-            OutlinedTextField(
-                value = temperature,
-                onValueChange = { temperature = it },
-                label = { Text("Temperature (blank = llama.cpp's default)") },
-                singleLine = true,
-                modifier = Modifier.fillMaxWidth(),
-            )
-            Spacer(Modifier.height(16.dp))
-        }
-
-        if (isClaude) {
-            if (current.models.isNotEmpty()) {
-                Spacer(Modifier.height(16.dp))
-                ChipGroup(
-                    label = "Model",
-                    options = current.models,
-                    selected = model.ifEmpty { null },
-                    onSelect = { chosen -> model = if (model == chosen) "" else chosen },
-                )
-            }
-            Spacer(Modifier.height(8.dp))
-            OutlinedTextField(
-                value = model,
-                onValueChange = { model = it },
-                label = { Text("Model (blank = the CLI's default)") },
-                singleLine = true,
-                modifier = Modifier.fillMaxWidth(),
-            )
-            Spacer(Modifier.height(16.dp))
-
-            OutlinedTextField(
-                value = cwd,
-                onValueChange = { cwd = it },
-                label = { Text("Working directory") },
-                placeholder = { Text("/home/…") },
-                singleLine = true,
-                modifier = Modifier.fillMaxWidth(),
-            )
-            Spacer(Modifier.height(16.dp))
-
-            ChipGroup(
-                label = "Permissions",
-                options = PERMISSION_MODES,
-                selected = permissionMode,
-                onSelect = { permissionMode = it },
-            )
-        }
-        Spacer(Modifier.height(24.dp))
-
-        // Beside the button that produced it.
-        spawnError?.let {
-            Text(it, color = MaterialTheme.colorScheme.error)
-            Spacer(Modifier.height(8.dp))
-        }
-
-        Button(
-            onClick = {
-                val chosen = current ?: return@Button
-                busy = true
-                scope.launch {
-                    try {
-                        val spawned =
-                            withContext(Dispatchers.IO) {
-                                spawnSession(
-                                    settings,
-                                    // The id, not the label: labels are
-                                    // editable and the server resolves by
-                                    // id.
-                                    // Non-null here: `chosen` came from
-                                    // `setup`'s own provider list, so
-                                    // reaching this point proves there was
-                                    // a setup to take it from.
-                                    setup = setup.id,
-                                    provider = chosen.name,
-                                    title = title.trim(),
-                                    model =
-                                        if (isLlama) modelKey else model.trim().takeIf { isClaude },
-                                    cwd = cwd.trim().takeIf { isClaude },
-                                    permissionMode = permissionMode.takeIf { isClaude },
-                                    // Sent only when set, so blank means
-                                    // "whatever llama.cpp does by default"
-                                    // rather than a zero.
-                                    params =
-                                        buildMap {
-                                            if (isLlama) {
-                                                contextSize
-                                                    .trim()
-                                                    .takeIf { it.isNotEmpty() }
-                                                    ?.let { put("contextSize", it) }
-                                                temperature
-                                                    .trim()
-                                                    .takeIf { it.isNotEmpty() }
-                                                    ?.let { put("temperature", it) }
-                                            }
-                                        },
-                                )
-                            }
-                        onSpawned(spawned)
-                    } catch (e: ApiException) {
-                        spawnError = e.message
-                        busy = false
-                    }
-                }
-            },
-            enabled = !busy && current != null && !(isLlama && modelKey == null),
-        ) {
-            Text(if (busy) "Spawning..." else "Spawn")
-        }
-    }
-}
-
-/**
- * A labeled row of choices that wraps onto as many lines as it needs.
- *
- * FlowRow rather than Row: a plain Row gives every chip an equal share of a single line, so once
- * the options don't fit, the text inside each one wraps to one character per line instead of the
- * row wrapping.
- */
-@OptIn(ExperimentalLayoutApi::class)
-@Composable
-fun ChipGroup(
-    label: String,
-    options: List<String>,
-    selected: String?,
-    onSelect: (String) -> Unit,
-) {
-    Text(label, style = MaterialTheme.typography.labelLarge)
-    FlowRow(
-        horizontalArrangement = Arrangement.spacedBy(8.dp),
-        verticalArrangement = Arrangement.spacedBy(4.dp),
-        modifier = Modifier.fillMaxWidth(),
-    ) {
-        options.forEach { option ->
-            FilterChip(
-                selected = selected == option,
-                onClick = { onSelect(option) },
-                label = { Text(option) },
-            )
-        }
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/Sse.kt

@@ -1,104 +0,0 @@
-package com.example.aiapp
-
-import java.io.IOException
-import java.net.HttpURLConnection
-import java.net.URL
-
-/**
- * How long to wait before opening a dropped stream again.
- *
- * Shared by every screen that follows one, so a reconnect is not paced differently depending on
- * which stream dropped. Short enough that a tunnel coming back is not noticed, long enough that a
- * server which is genuinely down is not being asked several times a second.
- */
-const val RECONNECT_DELAY_MS = 1500L
-
-/**
- * One server-sent-events connection, framed.
- *
- * The framing is the part worth having once: `data:` and `event:` lines accumulate until a blank
- * line ends the frame, comments (keep-alives) start with `:`, and a frame is either named with no
- * payload or a payload with no name. Two screens follow two different streams — a session's
- * transcript and what a machine's import list is doing — and neither should be re-deriving that.
- *
- * Blocking: [run] occupies its thread until the stream ends. [close], from any thread, is the
- * cancellation path — it disconnects the socket, which unblocks the read, and [run] then returns
- * rather than throwing, so a deliberate close is not reported as a connection error. Reconnecting
- * belongs to the caller, which is the only one that knows where to resume from.
- */
-class Sse(private val settings: ServerSettings) {
-    @Volatile private var connection: HttpURLConnection? = null
-    @Volatile private var closed = false
-
-    fun close() {
-        closed = true
-        connection?.disconnect()
-    }
-
-    /**
-     * Follows the stream at [path], handing each frame to [onFrame] as its name (null for an
-     * ordinary data frame) and its payload. The path is given here rather than at construction
-     * because a caller that reconnects usually resumes from somewhere new -- a cursor it has
-     * advanced past -- and that lives in the query string.
-     *
-     * [onOpen] fires once the server has accepted the connection. That is the measured moment the
-     * stream is live, and the only honest thing to clear a previous failure on: clearing on the
-     * first *event* instead left an idle stream displaying a connection error it had already
-     * recovered from, indefinitely.
-     */
-    fun run(path: String, onOpen: () -> Unit, onFrame: (name: String?, data: String) -> Unit) {
-        // Opening is inside the try, not before it. Everything this method can fail at owes the
-        // caller the same kind of failure -- both callers retry an [ApiException] and let anything
-        // else reach the top of the app -- and a connection that could not even be constructed
-        // used to escape as a raw `IOException` from a line no `catch` covered.
-        var connection: HttpURLConnection? = null
-        try {
-            connection =
-                (URL("${settings.baseUrl}$path").openConnection() as HttpURLConnection).also {
-                    this.connection = it
-                }
-            connection.applyPinnedTls()
-            connection.connectTimeout = CONNECT_TIMEOUT_MS
-            // No read timeout: between events there is nothing to read for as long as the thing
-            // being followed is idle; the server's keep-alives and a dead socket erroring out are
-            // the liveness story.
-            connection.readTimeout = 0
-            connection.setRequestProperty("Authorization", "Bearer ${settings.token}")
-            connection.setRequestProperty("Accept", "text/event-stream")
-            if (connection.responseCode != 200) {
-                val detail = connection.errorStream?.bufferedReader()?.readText()?.trim()
-                throw ApiException(detail ?: "HTTP ${connection.responseCode} for the event stream")
-            }
-
-            onOpen()
-            val reader = connection.inputStream.bufferedReader()
-            val data = StringBuilder()
-            var name: String? = null
-            while (true) {
-                val line = reader.readLine() ?: break
-                when {
-                    line.isEmpty() -> {
-                        if (name != null || data.isNotEmpty()) onFrame(name, data.toString())
-                        data.clear()
-                        name = null
-                    }
-                    line.startsWith("data:") -> data.append(line.removePrefix("data:").trim())
-                    line.startsWith("event:") -> name = line.removePrefix("event:").trim()
-                    else -> {} // id:, comments -- nothing to do
-                }
-            }
-        } catch (e: ApiException) {
-            throw e
-        } catch (e: IOException) {
-            if (!closed) {
-                throw ApiException(
-                    "Can't reach the server -- retrying. (${e.message ?: e::class.simpleName})",
-                    e,
-                )
-            }
-        } finally {
-            connection?.disconnect()
-            this.connection = null
-        }
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/Theme.kt

@@ -1,282 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.material3.ButtonColors
-import androidx.compose.material3.ButtonDefaults
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.darkColorScheme
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.graphics.toArgb
-import dev.snipme.highlights.model.SyntaxTheme
-
-/**
- * Catppuccin Mocha, as published in `catppuccin/palette`.
- *
- * Named rather than used as literals at the point of need, so the mapping below reads as the
- * decision it is -- "a card is Surface 0" -- and so a value can be checked against the upstream
- * palette without reading the layout that uses it.
- */
-private object Mocha {
-    val Rosewater = Color(0xFFF5E0DC)
-    val Mauve = Color(0xFFCBA6F7)
-    val Red = Color(0xFFF38BA8)
-    val Peach = Color(0xFFFAB387)
-    val Yellow = Color(0xFFF9E2AF)
-    val Green = Color(0xFFA6E3A1)
-    val Teal = Color(0xFF94E2D5)
-    val Sky = Color(0xFF89DCEB)
-    val Blue = Color(0xFF89B4FA)
-    val Lavender = Color(0xFFB4BEFE)
-    val Text = Color(0xFFCDD6F4)
-    val Subtext0 = Color(0xFFA6ADC8)
-    val Overlay0 = Color(0xFF6C7086)
-    val Surface2 = Color(0xFF585B70)
-    val Surface1 = Color(0xFF45475A)
-    val Surface0 = Color(0xFF313244)
-    val Base = Color(0xFF1E1E2E)
-    val Mantle = Color(0xFF181825)
-    val Crust = Color(0xFF11111B)
-}
-
-/**
- * The app's colour scheme: Catppuccin Mocha mapped onto Material's roles.
- *
- * Copied from dev-updater rather than shared, which is a deliberate line: wg-app-link is the *link*
- * -- the tunnel, the pinned CA, enrollment -- and a palette is not that. The two apps looking alike
- * is a preference, not a contract, and the moment one wants a different accent the shared version
- * becomes a thing to fight rather than a thing to use.
- *
- * The mapping that matters is the surface ladder. Mocha names its darks in order -- Crust, Mantle,
- * Base, Surface 0, Surface 1 -- and Material asks for the same thing under different names, so the
- * page is Base, a component's outlined card stays Base beside it, and a project's card is Surface
- * 0: one visible step up, which is the whole of what the nesting has to say.
- *
- * Accents on this palette are light, so anything filled with one takes Crust for its text rather
- * than the near-white the roles default to.
- */
-val AiAppColors =
-    darkColorScheme(
-        primary = Mocha.Mauve,
-        onPrimary = Mocha.Crust,
-        primaryContainer = Mocha.Surface1,
-        onPrimaryContainer = Mocha.Mauve,
-        secondary = Mocha.Lavender,
-        onSecondary = Mocha.Crust,
-        secondaryContainer = Mocha.Surface1,
-        onSecondaryContainer = Mocha.Lavender,
-        tertiary = Mocha.Rosewater,
-        onTertiary = Mocha.Crust,
-        background = Mocha.Base,
-        onBackground = Mocha.Text,
-        surface = Mocha.Base,
-        onSurface = Mocha.Text,
-        surfaceVariant = Mocha.Surface0,
-        onSurfaceVariant = Mocha.Subtext0,
-        surfaceContainerLowest = Mocha.Crust,
-        surfaceContainerLow = Mocha.Mantle,
-        surfaceContainer = Mocha.Base,
-        surfaceContainerHigh = Mocha.Surface0,
-        surfaceContainerHighest = Mocha.Surface0,
-        inverseSurface = Mocha.Text,
-        inverseOnSurface = Mocha.Base,
-        inversePrimary = Mocha.Mauve,
-        outline = Mocha.Overlay0,
-        outlineVariant = Mocha.Surface2,
-        error = Mocha.Red,
-        onError = Mocha.Crust,
-        errorContainer = Mocha.Surface1,
-        onErrorContainer = Mocha.Red,
-        scrim = Mocha.Crust,
-    )
-
-/**
- * What a session is doing, said in colour.
- *
- * Here rather than beside each screen that shows a status. These were separate literals in two
- * other files -- an amber, a green and a red picked off Material's defaults -- so the same state
- * was a slightly different colour depending which screen you looked at, and none of them belonged
- * to this palette at all. A colour that carries meaning is part of the scheme, not a value typed
- * where it happened to be needed.
- */
-val runningColor: Color
-    @Composable get() = Mocha.Green
-
-/**
- * "This went wrong on its own": a session that fell over.
- *
- * The scheme's error colour, and deliberately not "the same red as a destructive button" even
- * though it is the same red. They are the same red for different reasons, and a state is not an
- * action -- nothing here is a button.
- */
-val failedColor: Color
-    @Composable get() = MaterialTheme.colorScheme.error
-
-/**
- * About the session rather than about the task: a command, and the compaction one of them starts.
- *
- * Its own colour because it is its own kind of work. Everything else a session does is progress
- * through what was asked of it; this is the session acting on itself -- rewriting what it
- * remembers, taking a new name -- and none of it appears in the transcript as an answer to
- * anything. A reader who has learned that blue means "not stuck, but not replying to you either"
- * has learned the thing that distinguishes it from a session that has hung.
- */
-val commandColor: Color
-    @Composable get() = Mocha.Blue
-
-/**
- * A clear: the conversation taken out of what the session is given.
- *
- * Red because of what it does, not because anything went wrong -- somebody asked for this, and a
- * deliberate choice is not a problem to report. It is the same red as [failedColor] and [stopColor]
- * for a third reason, which is worth naming rather than collapsing: this is neither a fault nor a
- * button, it is the mark left where something was taken away. The reader never has to tell the
- * three apart, because no two of them can appear as the same kind of thing.
- */
-val clearedColor: Color
-    @Composable get() = Mocha.Red
-
-/** Waiting on a person: a question, a permission, a turn that is theirs. */
-val awaitingColor: Color
-    @Composable get() = Mocha.Peach
-
-/** Approaching a limit -- still fine, worth seeing. */
-val warningColor: Color
-    @Composable get() = Mocha.Yellow
-
-/**
- * The fill of a progress bar that is only reporting how far along something is.
- *
- * Blue because a bar like this reports a quantity rather than a verdict, and the scheme's primary
- * made it the loudest thing on a screen the reader opened to do something else. A download, or a
- * compaction, has no limit to be near: it finishes. Only a bar measuring a *quota* escalates, and
- * that one is [quotaColor].
- */
-val progressColor: Color
-    @Composable get() = Mocha.Blue
-
-/**
- * The fill of a bar measuring how much of a quota is gone: blue, then yellow, then red.
- *
- * One function rather than the same `when` written beside each bar, because the whole point of
- * colouring by consequence is that the reader learns the step once -- two bars showing the same 80%
- * in different colours teaches nothing except that the colour cannot be trusted. It reads as a
- * difference in degree, which is all colour can carry: the states that differ in *kind* from this
- * -- a window nobody could read, a machine that meters nothing -- are said in words elsewhere,
- * because a reader has no way to tell those from an ordinary low number by colour alone.
- *
- * [percent] is the API's own 0-100 rather than a fraction, so callers pass what the server sent
- * without each converting it first and one of them getting it wrong by a factor of a hundred.
- */
-@Composable
-fun quotaColor(percent: Double): Color =
-    when {
-        percent >= OVER_LIMIT_PERCENT -> overLimitColor
-        percent >= WARNING_PERCENT -> warningColor
-        else -> progressColor
-    }
-
-/** Close enough to the limit to be worth seeing before starting something big. */
-private const val WARNING_PERCENT = 75.0
-
-/** Close enough that the next turn may be the one that is refused. */
-private const val OVER_LIMIT_PERCENT = 90.0
-
-/**
- * The surface verbatim text sits on: a command, a tool's output, a code block in a reply.
- *
- * The darkest value in the palette rather than a step up from the page, and that is the whole point
- * -- everything else on this screen is somebody's prose, and this is what a machine was handed and
- * what it said back, character for character. Crust sits *below* Base, so the same colour reads as
- * one clear step down both on the page, where a reply is drawn, and on a card, where a tool call
- * is; a tint chosen upwards has to be picked twice and still collides with the card it lands on.
- * The renderer's default code background was `surfaceVariant`, which is exactly a card's own fill
- * -- so a code block inside a tool call had no background at all.
- *
- * One colour for all three, so "this is verbatim" is learnable once.
- */
-val rawSurface: Color
-    @Composable get() = Mocha.Crust
-
-/**
- * Catppuccin Mocha as a syntax theme, for the highlighter used on a tool call's input.
- *
- * Here with the rest of the palette rather than beside the code that highlights: a library's own
- * theme would otherwise be the one surface in the app whose colours came from somewhere else, and
- * the accents below are the same ones every other coloured thing already uses.
- */
-fun catppuccinSyntax(): SyntaxTheme =
-    SyntaxTheme(
-        key = "catppuccin-mocha",
-        code = Mocha.Text.toArgb(),
-        keyword = Mocha.Mauve.toArgb(),
-        string = Mocha.Green.toArgb(),
-        literal = Mocha.Peach.toArgb(),
-        comment = Mocha.Overlay0.toArgb(),
-        metadata = Mocha.Yellow.toArgb(),
-        multilineComment = Mocha.Overlay0.toArgb(),
-        punctuation = Mocha.Subtext0.toArgb(),
-        mark = Mocha.Sky.toArgb(),
-    )
-
-/**
- * A link. Blue is what a link is on every Catppuccin surface, and the one colour to leave alone.
- */
-val linkColor: Color
-    @Composable get() = Mocha.Blue
-
-/** Past a limit. The scheme's error colour, for the reason [failedColor] gives. */
-val overLimitColor: Color
-    @Composable get() = MaterialTheme.colorScheme.error
-
-/**
- * The composer's buttons, coloured by what pressing one does rather than by where it sits.
- *
- * Green makes something happen now, blue makes it happen later, orange takes back what is in
- * flight, red ends the process. The near-collisions with the states above are deliberate and worth
- * naming rather than collapsing: [runningColor] is green because a session is working,
- * [failedColor] is red because one fell over, [awaitingColor] is the same orange because a session
- * is waiting on somebody -- those are *states*, and these are *actions*. A reader never has to tell
- * them apart, because nothing here is a state and nothing there is pressable.
- */
-val sendColor: Color
-    @Composable get() = Mocha.Green
-
-/** Sending while a turn runs: the message waits rather than starting one. See [sendColor]. */
-val queueColor: Color
-    @Composable get() = Mocha.Blue
-
-/**
- * Interrupting the running turn: the work stops and the session stays.
- *
- * Orange rather than red because of how much it takes: only what is in flight. The process is still
- * there holding the conversation, and the next message starts a turn as though nothing had
- * happened. Red is spent on [stopColor], which is the same button in the same place when what it
- * would end is the session's process.
- */
-val pauseColor: Color
-    @Composable get() = Mocha.Peach
-
-/** Ending the session's process -- the one button here that takes something away. */
-val stopColor: Color
-    @Composable get() = Mocha.Red
-
-/**
- * Starting the process again, on the conversation it left.
- *
- * The same green as [sendColor] on purpose: both mean "this happens now", and they are never the
- * same button -- the process button only offers to start when there is nothing running to stop.
- */
-val startColor: Color
-    @Composable get() = Mocha.Green
-
-/**
- * A filled button in one of the action colours above.
- *
- * The content colour is stated here beside the fill rather than inherited. A semantic colour has to
- * carry its own contrast: these fills are fixed whatever the surface under them does, so the theme
- * will not change to rescue a foreground that stops being readable on one of them. Crust is what
- * every accent on this palette takes, which is the same reason `onPrimary` is Crust above.
- */
-@Composable
-fun actionButtonColors(fill: Color): ButtonColors =
-    ButtonDefaults.buttonColors(containerColor = fill, contentColor = Mocha.Crust)

app/androidApp/src/main/kotlin/com/example/aiapp/ToolInput.kt

@@ -1,188 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.horizontalScroll
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.remember
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.text.AnnotatedString
-import androidx.compose.ui.text.SpanStyle
-import androidx.compose.ui.text.buildAnnotatedString
-import androidx.compose.ui.text.font.FontFamily
-import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.unit.dp
-import dev.snipme.highlights.Highlights
-import dev.snipme.highlights.model.BoldHighlight
-import dev.snipme.highlights.model.ColorHighlight
-import dev.snipme.highlights.model.SyntaxLanguage
-import org.json.JSONObject
-
-/**
- * A tool call's input, read rather than dumped.
- *
- * Every tool's input arrives as JSON, and showing it raw makes the reader parse `{"command":"…",
- * "timeout":120000}` themselves to find the one line they care about. So the fields that carry the
- * meaning are pulled out -- the command a shell will run, what it is for, how long it may take --
- * and anything left over is still shown, because dropping a field would be claiming the tool has no
- * other input when it might.
- */
-data class ToolInput(
-    /** The thing that will actually be run or read, if this tool has one. */
-    val subject: String?,
-    /** The language [subject] is written in, for highlighting. */
-    val language: SyntaxLanguage?,
-    /** The tool's own one-line summary, when it wrote one. */
-    val description: String?,
-    /**
-     * How long the call may take, as the tool expressed it. Shown apart because it is a limit on
-     * the call rather than part of what the call does.
-     */
-    val timeout: String?,
-    /** Everything else, as `name: value` lines. Never dropped. */
-    val rest: List<String>,
-) {
-    /** The one line to show when there is only room for one: what this call is for. */
-    val title: String?
-        get() = description ?: subject
-}
-
-/**
- * Which field of which tool is the subject.
- *
- * A table rather than a chain of `if`s: adding a tool is a row, and the shape stops any of them
- * from being the special case that gets its own code path. Unknown tools fall through to "no
- * subject, everything is rest", which is what the card always did.
- */
-private val SUBJECTS: Map<String, Pair<String, SyntaxLanguage?>> =
-    mapOf(
-        "Bash" to ("command" to SyntaxLanguage.SHELL),
-        "Read" to ("file_path" to null),
-        "Write" to ("file_path" to null),
-        "Edit" to ("file_path" to null),
-        "Glob" to ("pattern" to null),
-        "Grep" to ("pattern" to null),
-        "WebFetch" to ("url" to null),
-    )
-
-/** Fields that are the tool's own prose about itself rather than input to it. */
-private val DESCRIPTIONS = listOf("description", "prompt")
-
-fun parseToolInput(tool: String, input: String): ToolInput {
-    val json =
-        try {
-            JSONObject(input)
-        } catch (_: org.json.JSONException) {
-            // Not an object: older transcripts and some tools send a bare
-            // string. It is still the input, so it is still shown.
-            return ToolInput(
-                null,
-                null,
-                null,
-                null,
-                input.takeIf { it.isNotBlank() }?.let { listOf(it) }.orEmpty(),
-            )
-        }
-    val (subjectKey, language) = SUBJECTS[tool] ?: (null to null)
-    val subject = subjectKey?.let { json.optString(it) }?.takeIf { it.isNotBlank() }
-    val description = DESCRIPTIONS.firstNotNullOfOrNull {
-        json.optString(it).takeIf { v -> v.isNotBlank() }
-    }
-    val timeout = json.optString("timeout").takeIf { it.isNotBlank() }
-    val rest =
-        json
-            .keys()
-            .asSequence()
-            .filter { it != subjectKey || subject == null }
-            .filter { it !in DESCRIPTIONS || description == null }
-            .filter { it != "timeout" || timeout == null }
-            .sorted()
-            .map { key -> "$key: ${json.get(key)}" }
-            .toList()
-    return ToolInput(subject, language, description, timeout, rest)
-}
-
-/**
- * A tool call's input: its subject highlighted, then whatever else it carried.
- *
- * On the dark surface every verbatim thing in the app sits on -- see [RawBlock]. Drawn as nothing
- * at all when the call carried neither, rather than as an empty block: a tinted rectangle with
- * nothing in it is a rendering fault, and it is the shape a tool with no input actually has.
- *
- * The description is *not* here. It is the tool's own prose about what it is doing, so it belongs
- * with the reader's text rather than inside the machine's; [ToolCard] draws it above this.
- */
-@Composable
-fun ToolInputView(tool: String, input: String, modifier: Modifier = Modifier) {
-    val parsed = remember(tool, input) { parseToolInput(tool, input) }
-    if (parsed.subject == null && parsed.rest.isEmpty()) return
-    RawBlock(modifier) {
-        parsed.subject?.let { subject ->
-            // Not wrapped: a wrapped command hides where its arguments end,
-            // and the long one is the one being read closely.
-            Text(
-                highlighted(subject, parsed.language),
-                style = MaterialTheme.typography.bodySmall,
-                fontFamily = FontFamily.Monospace,
-                softWrap = false,
-                modifier = Modifier.fillMaxWidth().horizontalScroll(rememberScrollState()),
-            )
-        }
-        parsed.rest.forEach {
-            Text(
-                it,
-                style = MaterialTheme.typography.bodySmall,
-                fontFamily = FontFamily.Monospace,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                modifier = Modifier.padding(top = 2.dp),
-            )
-        }
-    }
-}
-
-/**
- * [code] with its keywords and strings coloured, or plain if there is no language for it.
- *
- * The lexing is dev.snipme:highlights. The colours are this app's, mapped in [catppuccinSyntax] --
- * a library's default theme would be the one place in the app whose palette came from somewhere
- * else.
- */
-@Composable
-private fun highlighted(code: String, language: SyntaxLanguage?): AnnotatedString {
-    val theme = catppuccinSyntax()
-    val plain = MaterialTheme.colorScheme.onSurface
-    return remember(code, language, theme, plain) {
-        if (language == null) return@remember AnnotatedString(code)
-        val marks =
-            Highlights.Builder(code = code, language = language, theme = theme)
-                .build()
-                .getHighlights()
-        buildAnnotatedString {
-            append(code)
-            marks.forEach { mark ->
-                when (mark) {
-                    is ColorHighlight ->
-                        addStyle(
-                            SpanStyle(
-                                color =
-                                    androidx.compose.ui.graphics.Color(
-                                        mark.rgb or 0xFF000000.toInt()
-                                    )
-                            ),
-                            mark.location.start,
-                            mark.location.end,
-                        )
-                    is BoldHighlight ->
-                        addStyle(
-                            SpanStyle(fontWeight = FontWeight.Bold),
-                            mark.location.start,
-                            mark.location.end,
-                        )
-                }
-            }
-        }
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/ToolRows.kt

@@ -1,437 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.background
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.width
-import androidx.compose.foundation.shape.CornerBasedShape
-import androidx.compose.foundation.shape.CornerSize
-import androidx.compose.material3.Card
-import androidx.compose.material3.CardDefaults
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.Immutable
-import androidx.compose.runtime.remember
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.graphics.Shape
-import androidx.compose.ui.platform.LocalDensity
-import androidx.compose.ui.semantics.contentDescription
-import androidx.compose.ui.semantics.semantics
-import androidx.compose.ui.text.font.FontFamily
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.Dp
-import androidx.compose.ui.unit.dp
-
-/**
- * One row as the transcript draws it: a run of consecutive tool calls, or anything else.
- *
- * Grouping is decided here rather than when events are folded, because it is a display decision:
- * the transcript's own order is what paging and the event stream depend on, and one screen's idea
- * of "these belong together" must not reach back into it.
- *
- * Immutable, and said so, because Compose cannot tell.
- *
- * A row is a value: it is rebuilt from the transcript rather than edited, and two rows describing
- * the same events are equal. Compose infers stability from a class's fields, and a `List` field --
- * which several of these carry -- makes it assume the worst, so every composable taking one
- * recomposed whenever anything above it did. A page of history landing recomposed all 148 loaded
- * rows including the markdown inside them, measured as 701 compositions for 148 rows in one scroll,
- * and that is what a page landing costs on top of the fetch itself.
- *
- * The promise this makes is real and has to stay true: nothing here is mutated after it is built.
- */
-@Immutable
-sealed class TranscriptRow {
-    /**
-     * This row's identity in the list, which must survive everything that can happen to the row.
-     *
-     * The list is keyed by this so that inserting a new message at one end, or a page of history at
-     * the other, moves the rows and not the reader. That makes it the load-bearing value on this
-     * screen: when a key changes, the list loses its anchor and the transcript steps under whoever
-     * is reading it.
-     *
-     * A tool row therefore keys on [TranscriptItem.ToolRun.runId] rather than on a sequence number,
-     * and it is the *same* value whether the run is drawn as one card or as a group. A lone call
-     * that gains a neighbour becomes a group without changing identity, which is the case a
-     * seq-based key got wrong: the row the reader was looking at was replaced rather than updated.
-     * Which value that is belongs to the item ([TranscriptItem.key]), not to a `when` here: a row
-     * is one item and the item is what knows what it is called.
-     */
-    abstract val key: Any
-
-    /**
-     * Where this row starts in the transcript: the sequence number of the oldest event behind it.
-     *
-     * Separate from [key], and deliberately so. [key] is the list's identity and is a display
-     * decision -- a tool row is named after its run, and a run takes its name from whichever call
-     * was first when it was folded, which changes as pages arrive. A seq is the server's own
-     * numbering: it is assigned once, never moves, and means the same thing to every device. So
-     * anything that has to point at a place in the conversation and still find it later -- a saved
-     * scroll position is the one -- points with this, and anything that has to identify a row
-     * within one composition uses [key].
-     */
-    abstract val startSeq: Long
-
-    data class Single(val item: TranscriptItem) : TranscriptRow() {
-        override val key: Any
-            get() = item.key
-
-        override val startSeq: Long
-            get() = item.seq
-    }
-
-    /** Two or more calls with nothing between them; drawn as one collapsed card. */
-    data class Tools(val calls: List<TranscriptItem.ToolRun>) : TranscriptRow() {
-        /** The run's own name, which every call in it already carries. */
-        val id: String
-            get() = calls.first().runId
-
-        override val key: Any
-            get() = id
-
-        override val startSeq: Long
-            get() = calls.first().seq
-    }
-}
-
-/**
- * Runs of adjacent tool calls become one row; everything else passes through.
- *
- * A single call is left alone: "Called 1 tool" hides a card to say the same thing in more words,
- * and the run this exists for is the burst of five greps nobody wants to scroll past.
- */
-fun groupToolRuns(items: List<TranscriptItem>): List<TranscriptRow> =
-    DebugStats.timed("grouped tool runs") { groupRuns(items) }
-
-private fun groupRuns(items: List<TranscriptItem>): List<TranscriptRow> {
-    val rows = mutableListOf<TranscriptRow>()
-    var run = mutableListOf<TranscriptItem.ToolRun>()
-
-    fun flush() {
-        when (run.size) {
-            0 -> {}
-            1 -> rows += TranscriptRow.Single(run.first())
-            else -> rows += TranscriptRow.Tools(run.toList())
-        }
-        run = mutableListOf()
-    }
-
-    items.forEach { item ->
-        // Grouped by the run each call says it belongs to, not by adjacency worked out here.
-        // Adjacency is the same answer most of the time and a worse one at the edges: a call
-        // arriving next to an existing run, or a page of history arriving in front of one, both
-        // change which call is *first*, and a group named after its first member is a different
-        // group every time that happens.
-        if (item is TranscriptItem.ToolRun && (run.isEmpty() || run.first().runId == item.runId)) {
-            run += item
-        } else {
-            flush()
-            if (item is TranscriptItem.ToolRun) run += item else rows += TranscriptRow.Single(item)
-        }
-    }
-    flush()
-    return rows
-}
-
-/**
- * Several calls under one heading, closed until somebody asks.
- *
- * What says the calls belong together is the surface behind them, which is the one cue rather than
- * two half-cues -- rounded to the same corner every other card in the app has, so a group reads as
- * one object rather than as a square patch behind round things. The calls sit on it inset by
- * [GROUP_INSET], which is the container's own padding rather than an indent: they are the same rows
- * they would be on their own, and a rounded corner drawn hard against a rounded corner reads as a
- * notch.
- *
- * Inside, the calls are a connected stack. Facing corners are square and the outer ones are not, so
- * the run reads as one thing broken into its parts; [GROUP_GAP] keeps the parts legible without
- * separating them. See [connectedShape].
- *
- * It closes from either end. A long group's header scrolls off while its last call is still on
- * screen, and the reader who wants it shut is looking at the bottom, not hunting for the top. The
- * bar at the foot is the same height as the heading at the top, so the surface the calls sit on is
- * as thick below them as above.
- */
-@Composable
-fun ToolGroup(
-    group: TranscriptRow.Tools,
-    expanded: Boolean,
-    /**
-     * Where it was pressed is the row's business rather than the control's -- a group has a control
-     * at each end, and only the row knows where its own ends are, so the row records the touch
-     * itself and this just says that one happened.
-     */
-    onToggle: () -> Unit,
-    isToolExpanded: (String) -> Boolean,
-    onToolToggle: (String) -> Unit,
-    onAnswer: (questionId: String, answers: List<String>) -> Unit,
-    image: @Composable (String) -> Unit,
-) {
-    val heading = "Called ${group.calls.size} tools"
-    if (!expanded) {
-        Card(Modifier.fillMaxWidth().clickable(onClick = onToggle)) {
-            Text(
-                heading,
-                style = MaterialTheme.typography.titleSmall,
-                modifier = Modifier.padding(GROUP_INSET_LARGE),
-            )
-        }
-        return
-    }
-    Column(
-        Modifier.fillMaxWidth()
-            .clip(MaterialTheme.shapes.medium)
-            .background(MaterialTheme.colorScheme.surfaceContainerLow)
-    ) {
-        val barHeight = groupBarHeight()
-        Row(
-            Modifier.fillMaxWidth().height(barHeight).clickable(onClick = onToggle),
-            verticalAlignment = Alignment.CenterVertically,
-        ) {
-            Text(
-                heading,
-                style = MaterialTheme.typography.titleSmall,
-                modifier = Modifier.padding(horizontal = GROUP_INSET_LARGE),
-            )
-        }
-        Column(
-            Modifier.padding(horizontal = GROUP_INSET),
-            verticalArrangement = Arrangement.spacedBy(GROUP_GAP),
-        ) {
-            group.calls.forEachIndexed { index, call ->
-                ToolCard(
-                    tool = call,
-                    expanded = isToolExpanded(call.id),
-                    onToggle = { onToolToggle(call.id) },
-                    onAnswer = onAnswer,
-                    image = image,
-                    shape = connectedShape(index, group.calls.size),
-                )
-            }
-        }
-        // Shutting it from here anchors the other end: the reader is at the bottom of a long
-        // group, and what they are looking at is what follows it.
-        CollapseBar(barHeight, onToggle)
-    }
-}
-
-/**
- * The height of a group's heading, and so of the bar at its foot.
- *
- * Derived from the type the heading is set in rather than written down, because the two have to
- * match and a pair of numbers chosen to look equal stops being equal the moment either the style or
- * the density changes. Taking the line height also means the heading cannot be clipped by it.
- */
-@Composable
-private fun groupBarHeight(): Dp {
-    val line = MaterialTheme.typography.titleSmall.lineHeight
-    return with(LocalDensity.current) { line.toDp() } + GROUP_INSET_LARGE * 2
-}
-
-/**
- * The bottom half of a group's toggle: an arrow back up to its heading.
- *
- * Given the heading's height rather than padded to something that looks close, so the surface the
- * calls sit on is the same thickness at both ends. See [groupBarHeight].
- */
-@Composable
-private fun CollapseBar(height: Dp, onToggle: () -> Unit) {
-    val colour = MaterialTheme.colorScheme.onSurfaceVariant
-    Row(
-        Modifier.fillMaxWidth().height(height).clickable(onClick = onToggle).semantics {
-            contentDescription = "Collapse these tool calls"
-        },
-        horizontalArrangement = Arrangement.Center,
-        verticalAlignment = Alignment.CenterVertically,
-    ) {
-        Chevron(pointingUp = true, colour = colour)
-    }
-}
-
-/**
- * The shape of one card in a stack of [count]: square where it faces a neighbour, rounded where it
- * does not.
- *
- * Written once and given an index rather than branched at each end, because a stack has three cases
- * that are one rule -- and the middle one is the case a hand-written first/last pair gets wrong
- * when a run turns out to have three calls in it.
- */
-@Composable
-private fun connectedShape(index: Int, count: Int): CornerBasedShape {
-    val shape = MaterialTheme.shapes.medium
-    val square = CornerSize(0.dp)
-    return shape.copy(
-        topStart = if (index == 0) shape.topStart else square,
-        topEnd = if (index == 0) shape.topEnd else square,
-        bottomStart = if (index == count - 1) shape.bottomStart else square,
-        bottomEnd = if (index == count - 1) shape.bottomEnd else square,
-    )
-}
-
-/** The padding inside a card, and so the height a bar of one line of text comes to. */
-private val GROUP_INSET_LARGE = 12.dp
-
-/** How far the stack of calls is held off the edge of the surface it sits on. */
-private val GROUP_INSET = 4.dp
-
-/** Enough to read the join as a join rather than as one tall card. */
-private val GROUP_GAP = 2.dp
-
-/**
- * One tool call.
- *
- * Closed, it is a single line: the tool's name and what the call is for. The command itself is not
- * on it, because a wrapped command turns one row into four and a run of them into a wall -- and the
- * name plus the intent is what somebody scanning the transcript is reading for.
- *
- * Open, it shows the command, whatever else the input carried, and the output. The timeout sits at
- * the top right: it is a limit on the call rather than part of what the call does, and it is worth
- * seeing beside the command it constrains rather than buried in the fields below it.
- *
- * A call waiting on permission is shown open whatever the reader last chose, since the command is
- * the thing being decided and a row saying only "Bash" cannot be decided on.
- */
-@Composable
-fun ToolCard(
-    tool: TranscriptItem.ToolRun,
-    expanded: Boolean,
-    onToggle: () -> Unit,
-    onAnswer: (questionId: String, answers: List<String>) -> Unit,
-    image: @Composable (String) -> Unit = {},
-    /** Square where this card faces another in a group; see [connectedShape]. */
-    shape: Shape = CardDefaults.shape,
-) {
-    val parsed = remember(tool.tool, tool.input) { parseToolInput(tool.tool, tool.input) }
-    val deciding = tool.asks.any { it.answers.isEmpty() }
-    val open = expanded || deciding
-    Card(Modifier.fillMaxWidth().clickable(onClick = onToggle), shape = shape) {
-        Column(Modifier.padding(GROUP_INSET_LARGE)) {
-            Row(verticalAlignment = Alignment.CenterVertically) {
-                Text(tool.tool, style = MaterialTheme.typography.titleSmall)
-                if (open) {
-                    Spacer(Modifier.weight(1f))
-                    parsed.timeout?.let {
-                        Text(
-                            "timeout $it",
-                            style = MaterialTheme.typography.labelSmall,
-                            color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        )
-                    }
-                } else {
-                    parsed.title?.let {
-                        Text(
-                            it,
-                            style = MaterialTheme.typography.bodySmall,
-                            color = MaterialTheme.colorScheme.onSurfaceVariant,
-                            maxLines = 1,
-                            overflow = TextOverflow.Ellipsis,
-                            modifier = Modifier.weight(1f).padding(start = 8.dp),
-                        )
-                    } ?: Spacer(Modifier.weight(1f))
-                }
-                // A spinner says the machine is working. While this call is waiting on an
-                // answer the machine is doing nothing at all -- the turn is stopped on the
-                // person reading it -- so it says whose move it is instead, in the colour this
-                // app uses everywhere for that.
-                if (deciding) {
-                    Spacer(Modifier.width(8.dp))
-                    Text(
-                        "your turn",
-                        style = MaterialTheme.typography.labelLarge,
-                        color = awaitingColor,
-                    )
-                } else if (!tool.done) {
-                    Spacer(Modifier.width(8.dp))
-                    CircularProgressIndicator(
-                        modifier = Modifier.width(16.dp).height(16.dp),
-                        strokeWidth = 2.dp,
-                    )
-                }
-            }
-            if (open) {
-                parsed.description?.let {
-                    Text(
-                        it,
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        modifier = Modifier.padding(top = 4.dp),
-                    )
-                }
-                // Everything AskUserQuestion carries is the questions, and those are drawn
-                // below as something answerable; dumping the same JSON above them would be the
-                // decision stated twice, once unreadably.
-                if (tool.tool != ASK_USER_QUESTION) {
-                    ToolInputView(tool.tool, tool.input, Modifier.padding(top = 4.dp))
-                }
-                if (tool.output.isNotEmpty()) {
-                    Spacer(Modifier.height(8.dp))
-                    Text("Output", style = MaterialTheme.typography.labelSmall)
-                    // What the tool printed, on the surface everything verbatim gets and in the
-                    // face it was written for: this is column-aligned far more often than it is
-                    // prose -- a directory listing, a diff, a table of numbers -- and a
-                    // proportional font silently destroys the alignment that carried the meaning.
-                    RawBlock(Modifier.padding(top = 2.dp)) {
-                        Text(
-                            tool.output,
-                            style = MaterialTheme.typography.bodySmall,
-                            fontFamily = FontFamily.Monospace,
-                        )
-                    }
-                }
-            }
-            // Shown open or closed. A call that produced a picture is one
-            // whose result *is* the picture, and a row that hides it says
-            // less than the one line it replaced -- unlike a command, which
-            // is what the closed line already summarises.
-            tool.images.forEach { ref -> image(ref) }
-            if (tool.asks.isNotEmpty()) {
-                if (tool.tool == ASK_USER_QUESTION) {
-                    AskUserQuestionBody(tool.asks, onAnswer)
-                } else {
-                    tool.asks.forEach { ask ->
-                        PermissionAsk(ask) { answers -> onAnswer(ask.id, answers) }
-                    }
-                }
-            }
-        }
-    }
-}
-
-/**
- * The permission ask on the call it is about.
- *
- * Only the question, not the prompt's second half: the backend sends the tool's input with it so
- * the ask can stand alone, and here it does not have to -- the card above is showing exactly that.
- */
-@Composable
-private fun PermissionAsk(ask: TranscriptItem.QuestionCard, onAnswer: (List<String>) -> Unit) {
-    Spacer(Modifier.height(8.dp))
-    Text(
-        ask.prompt.substringBefore('\n'),
-        style = MaterialTheme.typography.bodyMedium,
-        color = awaitingColor,
-    )
-    // Answered or not, the options stay and the one that was taken is marked -- see
-    // [AskedQuestion], which is the same rule on the question card. A permission is where it
-    // matters most: "Answered: Deny" alone does not say that Allow was the alternative, and
-    // whether a tool was allowed or refused is the thing a reader comes back to this row for.
-    AnswerOptions(ask.options, ask.answers, onAnswer.takeIf { ask.answers.isEmpty() })
-}
-
-/**
- * The tool whose input is a question rather than a command; see [AskUserQuestionBody].
- *
- * Also what [runIdFor] breaks a run of calls on, so the row a reader answered is never folded
- * inside a collapsed group.
- */
-const val ASK_USER_QUESTION = "AskUserQuestion"

app/androidApp/src/main/kotlin/com/example/aiapp/TranscriptItems.kt

@@ -1,583 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.runtime.Immutable
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.withContext
-
-/**
- * What the transcript renders: the event stream folded into displayable rows (see [foldEvent]). The
- * stream is the only data source -- opening a session screen replays from seq 0, and a reconnect
- * resumes from the last seq seen, so there is no separate history fetch to drift from it.
- */
-@Immutable
-sealed class TranscriptItem {
-    /**
-     * The transcript sequence number this row started at, and its identity on screen.
-     *
-     * The list is drawn newest-first, so every new message is an insertion at index 0 and every
-     * page of history is an insertion at the far end. Without an identity that survives both, the
-     * list is addressed by position: whatever somebody had scrolled to keeps its index while the
-     * content underneath it slides, which reads as the view scrolling on its own.
-     *
-     * A seq is the right identity because it is what the transcript itself is ordered by, it never
-     * changes, and it is already carried by every event. A row built from several events -- a
-     * streaming message, a tool call and its result -- keeps the seq of the first, so it holds
-     * still while the rest of it arrives.
-     */
-    abstract val seq: Long
-
-    /**
-     * This item's identity on screen, which is its [seq] for everything that has one of its own.
-     *
-     * Here rather than in [TranscriptRow.Single] because the two items that need something else are
-     * the two that know why: a tool call is named after its run, and a peer note is *sorted* by the
-     * turn it started rather than by where it arrived. Asking each item what it is called is also
-     * what stops the next such item being missed -- a `when` over concrete types in the row would
-     * have to gain a case, silently, and nothing says when it did not.
-     */
-    open val key: Any
-        get() = seq
-
-    data class UserMsg(
-        override val seq: Long,
-        val text: String,
-        /** Refs of what was attached, drawn inside the bubble. */
-        val images: List<String> = emptyList(),
-    ) : TranscriptItem()
-
-    data class AssistantMsg(
-        override val seq: Long,
-        val text: String,
-        /**
-         * Whether this reply is finished: the session has stopped working since its last delta.
-         *
-         * What it buys is the split. [transcriptUnits] keeps the newest reply whole because a
-         * streaming reply's text changes per delta and splitting a changing text is a parse per
-         * delta -- but "newest" outlives the turn, so a session that ends on a long reply was
-         * drawing it as one item indefinitely, with every node of it alive. Measured on a Pixel 9
-         * Pro XL: one 34,996px reply on screen put the frame's draw phase at 13.8ms, 79% of it the
-         * framework's own bookkeeping, which grows with alive nodes.
-         *
-         * Folded from the status event that ended the turn, rather than read off the screen's
-         * status, because rows only change through the held-events gate: the split changes the
-         * newest row's list identity, and doing that from a status flip while somebody is reading
-         * inside that reply would step the list under them. An event has to wait for the reader to
-         * be at the newest end; a screen state does not.
-         */
-        val settled: Boolean = false,
-    ) : TranscriptItem()
-
-    data class ToolRun(
-        override val seq: Long,
-        val id: String,
-        /**
-         * The run of adjacent calls this one belongs to, named once when the call is folded in and
-         * never recomputed.
-         *
-         * Carried rather than derived because a run can gain members at *either* end -- a new call
-         * arriving beside it, or a page of history arriving in front of it -- so no function of its
-         * current members is stable. It is the first call's id at the moment the run started, which
-         * is a name rather than a description: [joinPages] hands it to older calls that turn out to
-         * belong to the same run, instead of renaming the run they joined.
-         */
-        val runId: String,
-        val tool: String,
-        val input: String,
-        val output: String,
-        val done: Boolean,
-        /**
-         * The questions this call is waiting on, in the order they were asked.
-         *
-         * On the call's own row rather than beside it: an ask used to arrive as a second card
-         * repeating the input verbatim, so the reader saw the same command twice and had to work
-         * out that it was one event. The backend says which call a question is about, so this is a
-         * fact rather than a match on the input.
-         *
-         * A list because AskUserQuestion asks up to four at once, and they are one decision to make
-         * -- a permission is the case of exactly one, not a different shape.
-         */
-        val asks: List<QuestionCard> = emptyList(),
-        /**
-         * Images this call's result carried, drawn under it.
-         *
-         * Beside it they had to be paired by position, and position is the thing a page boundary
-         * breaks -- a screenshot loaded on one page and its call on the next read as unrelated.
-         */
-        val images: List<String> = emptyList(),
-    ) : TranscriptItem() {
-        /** A run, not a seq: see [TranscriptRow.key] for what that identity has to survive. */
-        override val key: Any
-            get() = runId
-    }
-
-    data class QuestionCard(
-        override val seq: Long,
-        val id: String,
-        val prompt: String,
-        /** A few words naming what this is about, when the asker offered one. */
-        val header: String?,
-        val options: List<QuestionOption>,
-        /** Whether several options may be chosen at once. */
-        val multiSelect: Boolean,
-        /** What was chosen, once something was; empty until then. */
-        val answers: List<String>,
-    ) : TranscriptItem()
-
-    data class ErrorMsg(override val seq: Long, val message: String) : TranscriptItem()
-
-    /** An image by server-side ref, fetched from the session's files route. */
-    data class ImageItem(override val seq: Long, val ref: String) : TranscriptItem()
-
-    /**
-     * A message another agent sent this session.
-     *
-     * Its own row rather than a [UserMsg]: see [PeerMessageRow] for why the voice matters.
-     */
-    data class PeerNote(
-        override val seq: Long,
-        val from: String,
-        val text: String,
-        /**
-         * The seq of the event this note came in on, which is what makes it itself.
-         *
-         * [seq] is where the note *sorts*, and [placePeerNote] sets it to the seq the turn began at
-         * so the note is drawn above the reply it caused. Two messages that arrive during one turn
-         * therefore share a seq -- and sharing an identity as well killed the app, because the
-         * transcript list refuses two items with one key. Two agents writing to a session mid-turn
-         * is an ordinary afternoon, not a corner.
-         */
-        val arrived: Long = seq,
-    ) : TranscriptItem() {
-        override val key: Any
-            get() = arrived
-    }
-
-    /**
-     * A command the session ran on itself -- `/compact`, `/rename`.
-     *
-     * Kept in the transcript rather than only shown while it waits, because it explains what
-     * follows: a conversation that suddenly has half the context, or a session with a new name.
-     */
-    data class CommandRow(override val seq: Long, val text: String) : TranscriptItem()
-
-    /** Placeholder row for events this build can't render (newer kinds). */
-    data class Note(override val seq: Long, val text: String) : TranscriptItem()
-
-    /**
-     * A clear that happened: everything above it left the session's context and stayed on screen.
-     *
-     * Carries only its position, because that is all it means.
-     */
-    data class ClearedNote(override val seq: Long) : TranscriptItem()
-
-    /**
-     * A compaction that happened, and what it recovered.
-     *
-     * In the transcript rather than only in the status line, because the status is gone the moment
-     * it finishes and this is the part worth keeping: it is the explanation for a gap in the
-     * conversation, and for a minute or two in which the session was busy with nothing to show.
-     *
-     * The wire also says what triggered it, and this deliberately does not carry that: the row says
-     * the two sizes and nothing else (see [compactionSummary]), so keeping the trigger here would
-     * be a field nothing can read.
-     */
-    data class CompactedNote(
-        override val seq: Long,
-        val preTokens: Long?,
-        val postTokens: Long?,
-    ) : TranscriptItem()
-}
-
-/**
- * The run a call joins: the one it lands next to, or a new one named after itself.
- *
- * Only ever consulted when the call is first folded in. That is what makes the name stable -- a run
- * keeps whatever it was called when it started, however many calls arrive at either end of it
- * afterwards.
- *
- * A question to the reader is in a run of its own, which is what puts it on the transcript as a row
- * rather than inside a collapsed "Called 6 tools" card. Two things follow from being alone: it is
- * always visible, since a run of one is drawn as itself rather than as a group; and the calls
- * around it fall into a group before it and a group after it, so where the reader was asked
- * something is legible in the shape of the transcript without opening anything. It ends the run
- * before it as well as starting a fresh one after -- the moment somebody was asked is a boundary in
- * the work, not a gap in the middle of one run.
- */
-private fun runIdFor(items: List<TranscriptItem>, id: String, tool: String): String {
-    val previous = items.lastOrNull() as? TranscriptItem.ToolRun ?: return id
-    if (tool == ASK_USER_QUESTION || previous.tool == ASK_USER_QUESTION) return id
-    return previous.runId
-}
-
-/**
- * Puts a page of older items in front of the ones already loaded, healing whatever the page
- * boundary cut in two.
- *
- * Two things straddle a boundary: a tool call separated from its result, and a message separated
- * from the rest of itself. Both were one thing before the transcript was cut into pages, and both
- * have to be one thing again -- a reply drawn as two messages is the same defect as a call drawn
- * twice, arriving from the same cause.
- *
- * A boundary lands wherever it lands, and roughly half the time that is between a call and its
- * result. The newer page then holds a `ToolEnd` whose start it never saw, which [foldEvent] draws
- * as a row of its own -- correctly, because a call that renders as nothing is indistinguishable
- * from one that never happened. When the older page arrives it brings the real `ToolStart`, and
- * concatenating the two lists left *both*: the same call twice, once as a proper card and once as a
- * nameless placeholder. Visible as a run of four calls reporting "Called 5 tools", and worse than
- * the miscount -- the extra row is at the join, so it also moves everything the reader was looking
- * at.
- *
- * Merged by the call's own id rather than by position, because position is exactly what a page
- * boundary destroys. The older row wins on what a start knows (the tool's name, its input) and the
- * newer on what an end knows (the output, and whether it finished), which is the only way round
- * that loses nothing.
- *
- * The third thing is the *run*, and it is the one that used to be missed. Every page ends up here,
- * but [adoptRun] only ran on the path where a split call had been found -- so the boundary that
- * falls cleanly between two finished calls, which is most of them, went straight to concatenation
- * and left the older page's calls under the run name they were folded with. On screen: one run of
- * tool calls drawn as two groups, with the seam wherever the reader happened to have paged. The two
- * early returns were an optimisation on a list the size of one page, and they were skipping work
- * rather than saving it.
- */
-fun joinPages(earlier: List<TranscriptItem>, later: List<TranscriptItem>): List<TranscriptItem> {
-    val (older, newer) = healSplitMessage(earlier, later)
-    val startedEarlier =
-        older.filterIsInstance<TranscriptItem.ToolRun>().mapTo(mutableSetOf()) { it.id }
-    val endedLater =
-        newer
-            .filterIsInstance<TranscriptItem.ToolRun>()
-            .associateBy { it.id }
-            .filterKeys { it in startedEarlier }
-    val healed = older.map { row ->
-        val half = (row as? TranscriptItem.ToolRun)?.let { endedLater[it.id] }
-        if (row is TranscriptItem.ToolRun && half != null) {
-            row.copy(
-                output = half.output,
-                done = half.done,
-                // Kept from both halves: a question or an image can be attached to either,
-                // depending on which side of the boundary its event fell.
-                asks = row.asks + half.asks,
-                images = row.images + half.images,
-            )
-        } else {
-            row
-        }
-    }
-    val kept = newer.filterNot { it is TranscriptItem.ToolRun && it.id in endedLater }
-    return adoptRun(healed, kept) + kept
-}
-
-/**
- * Rejoins a message the page boundary cut, and hands back the two pages to concatenate.
- *
- * [foldEvent] never leaves two assistant messages next to each other inside one page -- deltas
- * accumulate into the message before them -- so two meeting at a join are always the two halves of
- * one reply, and leaving them apart drew a single answer as two, with a paragraph break through the
- * middle of a sentence.
- *
- * The newer half keeps its identity, for the reason [adoptRun] gives: it is the row already on
- * screen, and renaming that is how the list loses its anchor. It grows by what the older half
- * brings, which is safe here and nowhere else -- the join is at the oldest end of what is loaded,
- * so the growth extends off the top of the screen, away from the row the list anchors to.
- */
-private fun healSplitMessage(
-    earlier: List<TranscriptItem>,
-    later: List<TranscriptItem>,
-): Pair<List<TranscriptItem>, List<TranscriptItem>> {
-    val head = earlier.lastOrNull()
-    val tail = later.firstOrNull()
-    if (head !is TranscriptItem.AssistantMsg || tail !is TranscriptItem.AssistantMsg) {
-        return earlier to later
-    }
-    return earlier.dropLast(1) to (listOf(tail.copy(text = head.text + tail.text)) + later.drop(1))
-}
-
-/**
- * Hands the older calls at the join the name of the run they are joining.
- *
- * The two pages were folded separately, so a run split by the boundary came back as two runs with
- * two names. Naming the joined run after the *older* half would be the obvious way round and is the
- * wrong one: the newer half is the part already on screen, and renaming it is renaming the row the
- * reader is looking at, which is how a list loses its anchor and steps under them. So the arriving
- * calls take the name of the ones already there, and nothing visible changes identity.
- */
-private fun adoptRun(
-    earlier: List<TranscriptItem>,
-    later: List<TranscriptItem>,
-): List<TranscriptItem> {
-    val first = later.firstOrNull() as? TranscriptItem.ToolRun ?: return earlier
-    // A question is in a run of its own on both sides of the join, the same as it would be had
-    // the two pages been folded as one -- see `runIdFor`. Without this the heal would merge a
-    // group straight through the row the reader was asked something on.
-    if (first.tool == ASK_USER_QUESTION) return earlier
-    val joining = first.runId
-    val tail = earlier.takeLastWhile {
-        it is TranscriptItem.ToolRun && it.tool != ASK_USER_QUESTION
-    }
-    if (tail.isEmpty()) return earlier
-    return earlier.dropLast(tail.size) +
-        tail.map { (it as TranscriptItem.ToolRun).copy(runId = joining) }
-}
-
-/**
- * A peer message goes above the turn it started, not where it happened to arrive.
- *
- * The live Claude Code path cannot record it in place: the CLI says nothing about a peer message
- * until the turn's `result`, so the event lands below the whole reply it caused -- the answer
- * printed above the question. The server stamps it with where that turn began
- * ([SessionEvent.PeerMessage.turnStart]) and the note takes that seq, so it sorts into the list
- * where it belongs rather than being drawn out of order at the end.
- *
- * Taking the turn's opening seq as its own is also what keeps the list sorted, which anchors and
- * paging both depend on. It is only a *position*, though, and the note keeps its own arrival seq as
- * its identity ([TranscriptItem.PeerNote.arrived]). The argument for sharing was that the turn's
- * seq belongs to a status change and a status draws no row -- true, and it answered the wrong
- * question: what two notes stamped with the same turn collide with is each other.
- *
- * Without a stamp -- a message replayed out of a session file, which is already in the right place
- * -- it stays where it arrived.
- */
-private fun placePeerNote(
-    items: List<TranscriptItem>,
-    seq: Long,
-    event: SessionEvent.PeerMessage,
-): List<TranscriptItem> {
-    val at = event.turnStart ?: return items + TranscriptItem.PeerNote(seq, event.from, event.text)
-    val note = TranscriptItem.PeerNote(at, event.from, event.text, arrived = seq)
-    val index = items.indexOfFirst { it.seq > at }
-    if (index < 0) return items + note
-    val behind = (items.getOrNull(index - 1) as? TranscriptItem.ToolRun)?.runId
-    return items.subList(0, index) + note + splitRun(items.subList(index, items.size), behind)
-}
-
-/**
- * The calls the note now sits in front of, renamed if they were sharing a run with the calls behind
- * it.
- *
- * A run is named from what a call landed next to (see [runIdFor]), and nothing there knows about
- * turns -- so a turn opening with a tool call, straight after one that ended with one, folds them
- * into a single run. Left alone, [groupToolRuns] would flush at the note and hand both halves the
- * same name: two rows with one key, which a keyed list cannot draw at all.
- *
- * The later half is the one renamed, which is the opposite of a page join ([adoptRun]) and right
- * for the opposite reason. There the two halves were always one run and the newer was already on
- * screen; here they were never one turn's work, and both halves change appearance at the same
- * moment the note appears between them.
- */
-private fun splitRun(tail: List<TranscriptItem>, behind: String?): List<TranscriptItem> {
-    val first = tail.firstOrNull() as? TranscriptItem.ToolRun ?: return tail
-    if (behind == null || first.runId != behind) return tail
-    val run = tail.takeWhile { it is TranscriptItem.ToolRun && it.runId == behind }
-    return run.map { (it as TranscriptItem.ToolRun).copy(runId = first.id) } + tail.drop(run.size)
-}
-
-fun foldEvent(items: List<TranscriptItem>, entry: SeqEvent): List<TranscriptItem> =
-    when (val event = entry.event) {
-        is SessionEvent.UserMessage ->
-            items + TranscriptItem.UserMsg(entry.seq, event.text, event.images)
-        is SessionEvent.AssistantText -> {
-            // Deltas accumulate into the message they're streaming, which keeps the seq of the
-            // first of them: a row whose identity changed with every delta would be a new row on
-            // every frame, and the list would jump for the whole of a streamed answer.
-            val last = items.lastOrNull()
-            if (last is TranscriptItem.AssistantMsg) {
-                // A message growing again is not finished, whatever a status said in between.
-                items.dropLast(1) + last.copy(text = last.text + event.delta, settled = false)
-            } else {
-                items + TranscriptItem.AssistantMsg(entry.seq, event.delta)
-            }
-        }
-        is SessionEvent.ToolStart ->
-            items +
-                TranscriptItem.ToolRun(
-                    entry.seq,
-                    event.id,
-                    runIdFor(items, event.id, event.tool),
-                    event.tool,
-                    event.input,
-                    "",
-                    done = false,
-                )
-        is SessionEvent.ToolUpdate -> updateTool(items, event.id) { it.copy(output = event.output) }
-        is SessionEvent.ToolEnd ->
-            // Created when its start is not here, rather than dropped. A
-            // fold that only ever *updates* loses the whole call when the
-            // start fell outside the loaded window, and a tool call that
-            // renders as nothing is indistinguishable from one that never
-            // happened. The name is unknown from an end alone; loading the
-            // page before this one replaces the row with the real thing.
-            if (items.any { it is TranscriptItem.ToolRun && it.id == event.id }) {
-                updateTool(items, event.id) { it.copy(output = event.output, done = true) }
-            } else {
-                items +
-                    TranscriptItem.ToolRun(
-                        entry.seq,
-                        event.id,
-                        // The name is not known from an end alone, so a call that was an ask
-                        // cannot be recognised as one here; loading the page before this
-                        // replaces the row with the real thing, which is when it splits out.
-                        runIdFor(items, event.id, "tool"),
-                        "tool",
-                        "",
-                        event.output,
-                        done = true,
-                    )
-            }
-        is SessionEvent.Question -> {
-            val card =
-                TranscriptItem.QuestionCard(
-                    entry.seq,
-                    event.id,
-                    event.prompt,
-                    event.header,
-                    event.options,
-                    event.multiSelect,
-                    emptyList(),
-                )
-            // A question with no tool behind it -- AskUserQuestion, or an ask
-            // whose call fell outside the loaded window -- is a card of its
-            // own, which is what every question was before this.
-            if (
-                event.about != null &&
-                    items.any { it is TranscriptItem.ToolRun && it.id == event.about }
-            ) {
-                updateTool(items, event.about) { it.copy(asks = it.asks + card) }
-            } else {
-                items + card
-            }
-        }
-        is SessionEvent.Answered ->
-            // Resolved wherever it is drawn: a card of its own, or a tool
-            // row's ask. Missing the second left an Allow/Deny pair live on
-            // a question already answered from another device.
-            items.map {
-                when {
-                    it is TranscriptItem.QuestionCard && it.id == event.id ->
-                        it.copy(answers = event.answers)
-                    it is TranscriptItem.ToolRun && it.asks.any { ask -> ask.id == event.id } ->
-                        it.copy(
-                            asks =
-                                it.asks.map { ask ->
-                                    if (ask.id == event.id) ask.copy(answers = event.answers)
-                                    else ask
-                                }
-                        )
-                    else -> it
-                }
-            }
-        is SessionEvent.PeerMessage -> placePeerNote(items, entry.seq, event)
-        is SessionEvent.CommandSent -> items + TranscriptItem.CommandRow(entry.seq, event.text)
-        // Screen-level state, not transcript rows -- see SessionScreen.
-        is SessionEvent.CommandQueued -> items
-        // No row of its own: a message that is still waiting is drawn as a pending bubble below
-        // the transcript, and becomes an ordinary one where the session read it.
-        is SessionEvent.MessageQueued -> items
-        // The bubble goes away and nothing takes its place: the message was never read, so there
-        // is nothing it belongs above.
-        is SessionEvent.MessageDropped -> items
-        is SessionEvent.Settings -> items
-        is SessionEvent.Status -> settleReply(items, event.state)
-        is SessionEvent.Error -> items + TranscriptItem.ErrorMsg(entry.seq, event.message)
-        is SessionEvent.Image ->
-            // Under the call that produced it when there is one, and a row of
-            // its own when there is not -- a person's own attachment belongs
-            // to no call, and neither does one whose call fell outside the
-            // loaded window.
-            if (
-                event.about != null &&
-                    items.any { it is TranscriptItem.ToolRun && it.id == event.about }
-            ) {
-                updateTool(items, event.about) { it.copy(images = it.images + event.ref) }
-            } else {
-                items + TranscriptItem.ImageItem(entry.seq, event.ref)
-            }
-        is SessionEvent.Cleared -> items + TranscriptItem.ClearedNote(entry.seq)
-        is SessionEvent.Compacted ->
-            items + TranscriptItem.CompactedNote(entry.seq, event.preTokens, event.postTokens)
-        is SessionEvent.Unknown -> items + TranscriptItem.Note(entry.seq, "[${event.type}]")
-        // Screen-level state, not transcript rows -- see SessionScreen.
-        is SessionEvent.UsageDelta -> items
-    }
-
-/**
- * A status saying the session stopped working is the moment its newest reply is finished.
- *
- * See [TranscriptItem.AssistantMsg.settled] for what the mark buys and why it is made here in the
- * fold. Status changes are transcript events with seqs of their own, so a replayed session settles
- * its replies the same way a live one does.
- */
-private fun settleReply(items: List<TranscriptItem>, state: String): List<TranscriptItem> {
-    if (sessionWorking(state)) return items
-    val last = items.lastOrNull() as? TranscriptItem.AssistantMsg ?: return items
-    if (last.settled) return items
-    return items.dropLast(1) + last.copy(settled = true)
-}
-
-private fun updateTool(
-    items: List<TranscriptItem>,
-    id: String,
-    change: (TranscriptItem.ToolRun) -> TranscriptItem.ToolRun,
-): List<TranscriptItem> = items.map {
-    if (it is TranscriptItem.ToolRun && it.id == id) change(it) else it
-}
-
-/**
- * Where markdown is parsed ahead of being drawn: two threads, never all of them.
- *
- * The default dispatcher sizes itself to the machine, which is right for work somebody is waiting
- * on and wrong for work nobody is. A page of history is hundreds of parses arriving at once, and
- * taking every core for them leaves the thread that draws the frame queueing behind one -- measured
- * on a Pixel 9 Pro XL as 21ms of `waited` at the 90th percentile, which is the frame failing to
- * *start* rather than taking too long once it had.
- */
-@OptIn(kotlinx.coroutines.ExperimentalCoroutinesApi::class)
-private val parsingThreads = Dispatchers.Default.limitedParallelism(2)
-
-/**
- * Parses the markdown among [rows], off whatever thread is drawing.
- *
- * Called where a page of transcript is folded rather than where a row is composed, which is the
- * whole point: the work happens seconds before the reader reaches the rows it was done for. See
- * [ParsedReplies].
- *
- * What is warmed mirrors what the rows draw, unit by unit -- prose split into its blocks, a memory
- * note whole, a peer message split the same way prose is -- because a string warmed under a key no
- * row ever looks up is a miss that nothing reports; see [transcriptUnits], which is the flatten
- * this has to agree with. It reads the same [ParsedReplies.partsOf] and [ParsedReplies.blocksOf]
- * caches the flatten does, so a message is scanned once however many pages hand it back through
- * here, while the whole loaded transcript crosses this on every page.
- *
- * Every kind of row that draws markdown belongs in the `when` below. That is the rule the peer
- * message was missing: this used to filter for assistant replies alone, so the one row type nobody
- * had thought about paid its whole parse in the frame it appeared in, with no counter saying which
- * row it was.
- */
-suspend fun warm(replies: ParsedReplies, rows: List<TranscriptItem>) {
-    withContext(parsingThreads) {
-        val texts = rows.flatMap { row ->
-            when (row) {
-                is TranscriptItem.AssistantMsg ->
-                    replies.partsOf(row.text).flatMap { part ->
-                        when (part) {
-                            is MessagePart.Prose -> replies.blocksOf(part.text)
-                            // Drawn as one MarkdownText, so its whole text is the key
-                            // looked up.
-                            is MessagePart.Remembered -> listOf(part.text)
-                        }
-                    }
-                // A message from another agent is markdown too, and it is the longest thing
-                // in a transcript often enough that leaving it out was the whole of why one
-                // cost a fifth of a second to open: it was the only markdown in the app
-                // parsed on the thread that draws. Its blocks, not its text, because
-                // [PeerMessageRow] draws it a block at a time.
-                is TranscriptItem.PeerNote -> replies.blocksOf(row.text)
-                else -> emptyList()
-            }
-        }
-        if (texts.isNotEmpty()) replies.warm(texts)
-        // After the parses exist, not before: [ParsedReplies.splitReady] is the flatten's
-        // licence to draw these as blocks on the composing thread.
-        rows.forEach { if (it is TranscriptItem.AssistantMsg) replies.markSplitReady(it.text) }
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/TranscriptList.kt

@@ -1,130 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.PaddingValues
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
-import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.foundation.lazy.LazyListState
-import androidx.compose.foundation.text.selection.SelectionContainer
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.drawWithContent
-import androidx.compose.ui.layout.layout
-import androidx.compose.ui.unit.Dp
-import androidx.compose.ui.unit.dp
-
-/**
- * The transcript: a lazy list of [TranscriptUnit]s, laid out in reverse.
- *
- * Reverse layout is what makes the two insertions this list gets free rather than corrected. Item
- * zero is the newest content and sits at the bottom, so a message arriving extends the end the
- * viewport is pinned to and following it is not an effect -- and a page of older history lands at
- * indices past everything visible, which moves nothing on screen. The keyboard is the same case
- * from the other side: the viewport shrinks and the anchored item stays against its bottom edge. A
- * conversation shorter than the screen stacks from the bottom, hanging from the composer.
- *
- * The lazy list is also the whole of the windowing. Only what is near the viewport is composed and
- * alive, so the per-frame cost is bounded by the screen rather than by how much is loaded -- the
- * property a plain column here had to approximate with retained ranges and stand-in spacers, each
- * of which was a way to flicker. An item the framework composes is drawn the same frame it is
- * placed, and an item off screen is not a node at all.
- *
- * What keeps a unit's arrival cheap enough to happen mid-fling: a unit is at most one block of a
- * reply, and its parse is already made by [warm] before the fold that introduces it -- so entering
- * composition costs laying out one paragraph, not parsing a message.
- *
- * The whole list sits in a [SelectionContainer], which is what makes every word in the transcript
- * selectable by the platform's own press-and-hold. Here rather than at each place text is drawn: a
- * transcript is one body of text to a reader, and a container per row would mean a selection could
- * never cross from a reply into the tool output that follows it -- and would leave whatever was
- * drawn without one silently unselectable, which is a state nothing on screen reports. Rows keep
- * their tap handlers: selection is a long press, and the container passes an ordinary click through
- * to the card under it.
- */
-@Composable
-fun TranscriptList(
-    units: List<TranscriptUnit>,
-    state: LazyListState,
-    moreHistory: Boolean,
-    modifier: Modifier = Modifier,
-    below: @Composable () -> Unit,
-    unit: @Composable (TranscriptUnit) -> Unit,
-) {
-    SelectionContainer {
-        LazyColumn(
-            state = state,
-            reverseLayout = true,
-            contentPadding = TRANSCRIPT_PADDING,
-            modifier =
-                // Timed in two halves because the frame's draw phase is where Compose's measurement
-                // lands, and "draw is high while nothing is being recorded" does not say which
-                // half;
-                // see [drawAccounting]. Measure includes composing the items that scrolled in.
-                modifier
-                    .layout { measurable, constraints ->
-                        val started = System.nanoTime()
-                        val placeable = measurable.measure(constraints)
-                        DebugStats.record(
-                            "measure: the whole transcript",
-                            System.nanoTime() - started,
-                        )
-                        layout(placeable.width, placeable.height) {
-                            val placing = System.nanoTime()
-                            placeable.place(0, 0)
-                            DebugStats.record(
-                                "place: the whole transcript",
-                                System.nanoTime() - placing,
-                            )
-                        }
-                    }
-                    .drawWithContent {
-                        val started = System.nanoTime()
-                        drawContent()
-                        DebugStats.record("draw: the whole transcript", System.nanoTime() - started)
-                    },
-        ) {
-            // The bottom of the screen: what is waiting to be read sits under the newest message.
-            // The one item before the units, which is what [UNITS_START] counts.
-            item(key = "below", contentType = "below") { below() }
-            items(count = units.size, key = { units[it].key }, contentType = { units[it]::class }) {
-                val u = units[it]
-                DebugStats.count("unit composed")
-                Box(Modifier.fillMaxWidth().padding(top = u.gap)) { unit(u) }
-            }
-            // Standing in for everything not fetched yet. Only here while there is more -- its
-            // appearance at the top edge is also roughly when the next page is asked for, so what
-            // it
-            // reports is a fetch in flight rather than an end reached.
-            if (moreHistory) {
-                item(key = "history", contentType = "history") {
-                    Box(Modifier.fillMaxWidth().padding(vertical = 24.dp)) {
-                        CircularProgressIndicator(
-                            Modifier.align(Alignment.Center).size(HISTORY_SPINNER)
-                        )
-                    }
-                }
-            }
-        }
-    }
-}
-
-/**
- * How many of the list's own items come before the first unit -- the waiting-messages slot.
- *
- * Named once because two things count on it: the list building itself, and [visibleUnits] turning a
- * list index back into the unit that was drawn there. Read off by hand at the second of those, it
- * is an off-by-one that misnames every row in a report and looks like a plausible answer.
- */
-const val UNITS_START = 1
-
-/** The gap between rows, and the room around the whole conversation. */
-val TRANSCRIPT_SPACING: Dp = 8.dp
-
-val TRANSCRIPT_PADDING: PaddingValues = PaddingValues(16.dp)
-
-/** Smaller than the whole-screen loading spinner: it stands in for a page, not for everything. */
-private val HISTORY_SPINNER = 24.dp

app/androidApp/src/main/kotlin/com/example/aiapp/TranscriptUnits.kt

@@ -1,395 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.lazy.LazyListItemInfo
-import androidx.compose.runtime.Immutable
-import androidx.compose.ui.unit.Dp
-import androidx.compose.ui.unit.dp
-
-/**
- * One item of the transcript list: a whole row, or one block of a settled reply.
- *
- * The unit of laziness is deliberately smaller than a message. A lazy list pays to compose an item
- * at the moment it scrolls into view, and that cost is proportional to the item -- a reply can be
- * twenty-five screens of markdown, which as one item is a hundred-millisecond frame exactly when
- * the list is moving fastest. A *block* is a paragraph, a fence, a table: bounded, so the worst
- * frame is bounded. This is the piece that was missing when a lazy list was last tried here; the
- * block splitting existed only inside the row, where the list could not see it.
- *
- * Everything else about the row model is unchanged: rows come from [groupToolRuns], and a unit
- * points back at its row. The list draws units; anchors and paging still speak seq.
- */
-@Immutable
-sealed class TranscriptUnit {
-    /** The list identity; must survive pages landing at either end. See [TranscriptRow.key]. */
-    abstract val key: Any
-
-    /** Where this unit's row starts in the transcript -- the anchor identity, never the key. */
-    abstract val seq: Long
-
-    /**
-     * This unit's position within its row, counted from the row's oldest end.
-     *
-     * What a saved scroll position carries besides the seq: a reply split into forty blocks needs
-     * more than "somewhere in this row" to put a reader back where they stopped.
-     */
-    abstract val ordinal: Int
-
-    /** The gap drawn above this unit -- between rows, or between blocks of one reply. */
-    abstract val gap: Dp
-
-    /** A row drawn as itself: a bubble, a tool card, a group -- or the reply still arriving. */
-    data class Whole(val row: TranscriptRow, override val gap: Dp) : TranscriptUnit() {
-        override val key: Any
-            get() = row.key
-
-        override val seq: Long
-            get() = row.startSeq
-
-        override val ordinal: Int
-            get() = 0
-    }
-
-    /** One markdown block of a settled reply. */
-    data class Block(
-        override val seq: Long,
-        override val ordinal: Int,
-        val text: String,
-        override val gap: Dp,
-    ) : TranscriptUnit() {
-        override val key: Any
-            get() = "b$seq:$ordinal"
-    }
-
-    /**
-     * The heading of a message from another agent: who sent it, and the control that opens it.
-     *
-     * A peer message is the one row whose *opened* size is unbounded -- these are the longest
-     * things a transcript holds -- so it is flattened the same way a settled reply is, and for the
-     * same reason: as one item, every block of it is composed, measured, placed and kept alive
-     * while any part of it is on screen. Measured on the emulator, opening a 43KB one took the
-     * transcript's share of the draw phase from 0.81ms a frame to 3.85ms, and the framework's own
-     * per-frame bookkeeping -- which grows with how many nodes are *alive* -- from 0.39ms to
-     * 3.15ms.
-     *
-     * The card is drawn in pieces rather than given up: a filled Material card is elevation zero,
-     * so it has no shadow to break, and each piece paints the same fill with only the corners it
-     * owns. See [PeerHeadRow] and [PeerBlockRow].
-     */
-    data class PeerHead(
-        override val seq: Long,
-        val item: TranscriptItem.PeerNote,
-        val open: Boolean,
-        override val gap: Dp,
-    ) : TranscriptUnit() {
-        /**
-         * The note's own key, so opening and shutting does not change what the list is anchored on
-         * -- and so two notes stamped with one turn's seq are still two items. See
-         * [TranscriptItem.PeerNote].
-         */
-        override val key: Any
-            get() = item.key
-
-        override val ordinal: Int
-            get() = 0
-    }
-
-    /** One markdown block of an opened peer message; [last] is the piece that closes the card. */
-    data class PeerBlock(
-        override val seq: Long,
-        override val ordinal: Int,
-        val text: String,
-        val last: Boolean,
-        override val gap: Dp,
-        /** The note this block belongs to; its key, not its seq. See [TranscriptItem.PeerNote]. */
-        val note: Any,
-    ) : TranscriptUnit() {
-        override val key: Any
-            get() = "p$note:$ordinal"
-    }
-
-    /**
-     * One slice of a long user message; see [userChunks].
-     *
-     * A user message is plain text, so cutting it costs a scan rather than a parse -- but the
-     * reason is the same as for a settled reply: as one item, a pasted log is a hundred thousand
-     * pixels of `Text` whose layout lands in the frame the row scrolls into. Measured as the
-     * `measure: the whole transcript ... 112.1ms worst` in an otherwise smooth report.
-     */
-    data class UserChunk(
-        override val seq: Long,
-        override val ordinal: Int,
-        val text: String,
-        val first: Boolean,
-        val last: Boolean,
-        /** The message's attachments, drawn under the words -- so only the last slice has any. */
-        val images: List<String>,
-        override val gap: Dp,
-    ) : TranscriptUnit() {
-        override val key: Any
-            get() = "u$seq:$ordinal"
-    }
-
-    /** One memory note of a settled reply; see [MemoryNote]. */
-    data class Memory(
-        override val seq: Long,
-        override val ordinal: Int,
-        val part: MessagePart.Remembered,
-        override val gap: Dp,
-    ) : TranscriptUnit() {
-        override val key: Any
-            get() = "m$seq:$ordinal"
-    }
-}
-
-/**
- * The rows flattened into list units, newest first -- index zero is the item at the bottom of the
- * screen, which is what a reversed lazy list calls the start.
- *
- * Every settled reply is cut into its blocks ([markdownBlocks], via the caches on [replies] so a
- * message is only ever split once), and so is an *opened* peer message -- [openNotes] is which ones
- * those are, which is why the flatten needs it. A shut one is a single heading and cannot be worth
- * splitting. The reply still arriving -- the newest row, until the status event that ends its turn
- * marks it [TranscriptItem.AssistantMsg.settled] -- stays whole: its text changes with every delta,
- * and splitting it here would parse the whole message per delta on whichever thread is composing.
- * [AssistantMessage]'s own streaming path already parses deltas off the main thread and gives the
- * live message a layer per block. Once settled it splits like every other reply, which is what
- * bounds the newest row's cost after a session ends on a long one.
- *
- * Runs per fold, so it must stay proportional to what is loaded with no parsing in it on the warm
- * path: [ParsedReplies.partsOf] and [ParsedReplies.blocksOf] are lookups for any text [warm] has
- * seen, and a miss -- the one message that just finished streaming -- costs its split exactly once.
- */
-fun transcriptUnits(
-    rows: List<TranscriptRow>,
-    replies: ParsedReplies,
-    openNotes: Set<Long>,
-): List<TranscriptUnit> {
-    val started = System.nanoTime()
-    val units = ArrayList<TranscriptUnit>(rows.size)
-    rows.forEachIndexed { index, row ->
-        val rowGap = if (index == 0) 0.dp else TRANSCRIPT_SPACING
-        val item = (row as? TranscriptRow.Single)?.item
-        if (item is TranscriptItem.PeerNote) {
-            val open = item.seq in openNotes
-            units += TranscriptUnit.PeerHead(row.startSeq, item, open, rowGap)
-            // No gap between the pieces: they are one card, and a card with a stripe through it is
-            // what any spacing here would draw.
-            if (open) {
-                val blocks = replies.blocksOf(item.text)
-                blocks.forEachIndexed { at, block ->
-                    units +=
-                        TranscriptUnit.PeerBlock(
-                            row.startSeq,
-                            at + 1,
-                            block,
-                            last = at == blocks.lastIndex,
-                            gap = 0.dp,
-                            note = item.key,
-                        )
-                }
-            }
-        } else if (item is TranscriptItem.UserMsg && item.text.length > USER_SPLIT_CHARS) {
-            // A scan, not a parse, so it is cheap enough for the fold path -- and cached like
-            // the markdown splits so the scan too happens once per message, not once per fold.
-            val chunks = replies.chunksOf(item.text)
-            chunks.forEachIndexed { at, chunk ->
-                units +=
-                    TranscriptUnit.UserChunk(
-                        row.startSeq,
-                        at,
-                        chunk,
-                        first = at == 0,
-                        last = at == chunks.lastIndex,
-                        images = if (at == chunks.lastIndex) item.images else emptyList(),
-                        gap = if (at == 0) rowGap else 0.dp,
-                    )
-            }
-        } else if (
-            item is TranscriptItem.AssistantMsg &&
-                splitWanted(item, index, rows.lastIndex) &&
-                replies.splitReady(item.text)
-        ) {
-            var ordinal = 0
-            fun gap() = if (ordinal == 0) rowGap else BLOCK_SPACING
-            replies.partsOf(item.text).forEach { part ->
-                when (part) {
-                    is MessagePart.Prose ->
-                        replies.blocksOf(part.text).forEach { block ->
-                            units += TranscriptUnit.Block(row.startSeq, ordinal, block, gap())
-                            ordinal++
-                        }
-                    is MessagePart.Remembered -> {
-                        units += TranscriptUnit.Memory(row.startSeq, ordinal, part, gap())
-                        ordinal++
-                    }
-                }
-            }
-        } else {
-            units += TranscriptUnit.Whole(row, rowGap)
-        }
-    }
-    units.reverse()
-    reportDuplicateKeys(units)
-    // Timed because this runs per fold on the composing thread: "loading messages feels bumpy"
-    // is this number growing, and it was invisible until it was written down.
-    DebugStats.record("units flattened", System.nanoTime() - started)
-    return units
-}
-
-/**
- * Whether this reply should be drawn as blocks: settled, or anywhere but the newest row.
- *
- * Wanting is not being ready -- the flatten also asks [ParsedReplies.splitReady], and the two
- * questions are separate because they are answered by different things: this one by the fold, the
- * other by whether [warm] has run for the text. [unwarmedReplies] is the gap between them.
- */
-private fun splitWanted(item: TranscriptItem.AssistantMsg, index: Int, lastIndex: Int) =
-    item.settled || index != lastIndex
-
-/**
- * The replies among [rows] that should draw as blocks but whose parses are not made yet.
- *
- * Normally empty: every page's rows are warmed before the fold lands. The one row that can be cold
- * is the reply that just finished streaming -- nothing warms live deltas, so at the moment its turn
- * ends its split would cost a whole-message parse on the composing thread. The session screen warms
- * what this returns off-thread and re-flattens, so the whole-to-blocks swap always composes against
- * ready parses.
- */
-fun unwarmedReplies(rows: List<TranscriptRow>, replies: ParsedReplies): List<TranscriptItem> =
-    rows.mapIndexedNotNull { index, row ->
-        val item = (row as? TranscriptRow.Single)?.item as? TranscriptItem.AssistantMsg
-        item?.takeIf { splitWanted(it, index, rows.lastIndex) && !replies.splitReady(it.text) }
-    }
-
-/**
- * Above this many characters, a user message is drawn in slices rather than as one bubble.
- *
- * Not zero, because a bubble's width wraps its content: slices have to fill the row to look like
- * one bubble, and forcing that on a short message would visibly widen it. A message past this
- * length has lines that wrap, so its bubble is at the full width already and the slices match it
- * exactly. Below it, one item of at most a few screens is nothing the list minds composing.
- */
-const val USER_SPLIT_CHARS = 4000
-
-/**
- * Roughly how much text one slice holds -- bounded, like a markdown block, is the whole point.
- *
- * About one viewport of wrapped text: a slice is composed whole in the frame it scrolls into, so
- * its size is a frame-budget decision, and one screenful keeps that to a few milliseconds on the
- * phone. Smaller buys nothing -- the seams are free -- but the units multiply.
- */
-private const val USER_CHUNK_CHARS = 1000
-
-/**
- * A long user message cut at line starts into slices of roughly [USER_CHUNK_CHARS].
- *
- * At newlines only, never mid-line: text layout runs per line, so slices that own whole lines stack
- * back into exactly the lines the single `Text` drew, and a cut inside one would reflow it. The
- * newline at each cut is dropped -- the boundary between two stacked slices *is* that line break. A
- * single line longer than a slice (minified JSON, a base64 blob) stays whole in its slice, so a
- * slice is bounded by the longest line rather than absolutely.
- */
-fun userChunks(text: String): List<String> {
-    val chunks = ArrayList<String>()
-    var start = 0
-    while (start < text.length) {
-        if (text.length - start <= USER_CHUNK_CHARS) {
-            chunks += text.substring(start)
-            break
-        }
-        var cut = text.lastIndexOf('\n', start + USER_CHUNK_CHARS)
-        if (cut <= start) cut = text.indexOf('\n', start + USER_CHUNK_CHARS)
-        if (cut < 0) {
-            chunks += text.substring(start)
-            break
-        }
-        chunks += text.substring(start, cut)
-        start = cut + 1
-    }
-    return chunks
-}
-
-/**
- * Says which two units share a key, before the list dies of it.
- *
- * A duplicate key is fatal -- `LazyColumn` throws, and the app goes down in the middle of somebody
- * reading a conversation -- and all the framework's message carries is the key. When that key is a
- * seq it names neither row, and there is no way back from it to how the two came to share one: it
- * took an afternoon and a fixture that could reproduce it. Two lines here answered it immediately,
- * naming both rows and the field they had in common ([TranscriptItem.PeerNote.arrived]).
- *
- * Always on, for the same reason [DebugStats] is: an instrument that is only in the build nobody is
- * holding when it breaks is not an instrument. It costs one map over the units that were just
- * built, beside a loop that already allocates one entry per unit.
- */
-private fun reportDuplicateKeys(units: List<TranscriptUnit>) {
-    val seen = HashMap<Any, TranscriptUnit>()
-    units.forEach { unit ->
-        val had = seen.put(unit.key, unit)
-        if (had != null) {
-            android.util.Log.w("ai-app", "duplicate unit key ${unit.key}: $had  AND  $unit")
-        }
-    }
-}
-
-/**
- * What is on screen right now, a unit at a time: what each one is and how tall it is.
- *
- * For the render report, and it is the line every "it is slow here" report has needed. The
- * framework's own per-frame cost grows with how many nodes are *alive* rather than how many are on
- * screen, so a screen holding one enormous item is slow in a way that no counter of ours
- * distinguishes from a screen holding twenty ordinary ones -- and "2 units visible" says one of
- * them is enormous without saying which. This says which.
- *
- * [first] is the index the list gave the first *unit*: the list also holds the waiting-messages
- * slot at index zero and the history spinner past the end, and both are named here rather than
- * silently reported as whichever unit is nearest.
- */
-fun visibleUnits(units: List<TranscriptUnit>, visible: List<LazyListItemInfo>, first: Int): String =
-    if (visible.isEmpty()) "  nothing on screen"
-    else
-        "  on screen: " +
-            visible.joinToString(", ") { info ->
-                "${units.getOrNull(info.index - first).kind} ${info.size}px"
-            }
-
-/** What a unit is, in a word, for [visibleUnits]. Null is one of the list's own non-unit items. */
-private val TranscriptUnit?.kind: String
-    get() =
-        when (this) {
-            null -> "the list's own"
-            is TranscriptUnit.Block -> "reply block"
-            is TranscriptUnit.PeerHead -> if (open) "peer heading (open)" else "peer heading"
-            is TranscriptUnit.PeerBlock -> "peer block"
-            is TranscriptUnit.UserChunk -> "user slice"
-            is TranscriptUnit.Memory -> "memory note"
-            is TranscriptUnit.Whole ->
-                when (val row = row) {
-                    is TranscriptRow.Tools -> "tool group"
-                    // The class name rather than a word per kind: this is a diagnostic, and a
-                    // `when` here would be one more place that has to gain a case whenever the
-                    // transcript does -- silently naming a new row after an old one until somebody
-                    // noticed.
-                    is TranscriptRow.Single -> row.item::class.simpleName.orEmpty()
-                }
-        }
-
-/**
- * Where the unit named by a saved position sits in [units], or null if its row is not loaded.
- *
- * The row is found by [seq] and the unit within it by [ordinal], settling for the nearest older
- * unit when the exact one is gone -- a reply regrouped by a page boundary can split into a
- * different number of blocks than it had when the position was saved, and "a little above where
- * they stopped" loses less than the newest end does.
- */
-fun unitIndexFor(units: List<TranscriptUnit>, seq: Long, ordinal: Int): Int? {
-    var best: Int? = null
-    var bestOrdinal = -1
-    units.forEachIndexed { index, unit ->
-        if (unit.seq == seq && unit.ordinal <= ordinal && unit.ordinal > bestOrdinal) {
-            best = index
-            bestOrdinal = unit.ordinal
-        }
-    }
-    return best ?: units.indexOfFirst { it.seq == seq }.takeIf { it >= 0 }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/UniqueItems.kt

@@ -1,44 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.lazy.LazyItemScope
-import androidx.compose.foundation.lazy.LazyListScope
-import androidx.compose.foundation.lazy.items
-import androidx.compose.runtime.Composable
-
-/**
- * Keyed [items], with anything repeating a key already used left out.
- *
- * A lazy list throws when two of its items claim the same key, and the throw happens during measure
- * on the main thread -- so it is not an error the screen can show, it closes the app. That is a
- * disproportionate answer to a list with a repeat in it, and it lands on the reader rather than on
- * whoever produced the repeat: on 2026-08-31 the import list crashed on a Claude Code session id
- * recorded under two project directories, which is an ordinary state of a machine and not something
- * the phone did.
- *
- * Every list in this app keyed on an id keyed it on an id *the server chose*, so all of them shared
- * the hazard and none of them could rule it out locally. Hence one function they all go through
- * rather than a `distinctBy` remembered at each call site.
- *
- * Dropping the repeat is the right answer here because the key is the whole identity: two rows with
- * one id are two rows every action would treat as the same thing, so there is nothing to show about
- * the second that the first is not already showing. Where the duplicate means something -- the
- * import list's did -- the fix belongs at the source, and this is only what stops a data problem
- * from being a crash. It is counted so the render report says it happened rather than leaving a
- * silently shorter list.
- *
- * The transcript's own list is deliberately not on this: its keys are made here rather than
- * received, and it is the one list where an extra pass over the items is measurable.
- */
-inline fun <T> LazyListScope.uniqueItems(
-    items: List<T>,
-    crossinline key: (T) -> Any,
-    noinline contentType: (T) -> Any? = { null },
-    crossinline itemContent: @Composable LazyItemScope.(T) -> Unit,
-) {
-    val seen = HashSet<Any>(items.size)
-    val unique = items.filter { seen.add(key(it)) }
-    if (unique.size != items.size) {
-        DebugStats.count("list items dropped for a repeated key")
-    }
-    items(unique, key = { key(it) }, contentType = contentType) { itemContent(it) }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/UsageDialog.kt

@@ -1,233 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.LinearProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Surface
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.window.Dialog
-import java.time.OffsetDateTime
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-/**
- * Window bars for the account's rate limits, with reset times.
- *
- * A dialog rather than a screen. Usage is something you check *against* what you were reading --
- * "can I start this" is asked with the transcript still on screen -- and pushing a whole screen for
- * it took the session away to answer a question about the session. It also has no navigation of its
- * own: there is nothing here to open, so the only thing its Back could ever have meant was "put
- * this away", which is what dismissing does. The system back gesture dismisses it, since a `Dialog`
- * handles that itself.
- */
-@Composable
-fun UsageDialog(settings: ServerSettings, onDismiss: () -> Unit) {
-    val scope = rememberCoroutineScope()
-    var state by remember { mutableStateOf<LoadState<List<UsageSnapshot>>>(LoadState.Loading) }
-
-    fun refresh() {
-        state = LoadState.Loading
-        scope.launch {
-            state =
-                try {
-                    withContext(Dispatchers.IO) { LoadState.Loaded(fetchUsage(settings)) }
-                } catch (e: ApiException) {
-                    LoadState.failed(e)
-                }
-        }
-    }
-    LaunchedEffect(Unit) { refresh() }
-
-    // A plain Dialog rather than an AlertDialog, for the spacing alone. AlertDialog fixes the
-    // gaps between its title, its content and its buttons at sizes meant for a sentence of prose
-    // and a decision; this is a dense read-out, and those gaps left a band of empty dialog above
-    // Close that was taller than a bar. Everything else here is what AlertDialog would have
-    // drawn -- the same container colour, the same corner -- so nothing about it looks foreign.
-    Dialog(onDismissRequest = onDismiss) {
-        Surface(
-            shape = MaterialTheme.shapes.extraLarge,
-            color = MaterialTheme.colorScheme.surfaceContainerHigh,
-        ) {
-            Column(Modifier.padding(horizontal = 24.dp, vertical = 16.dp)) {
-                Row(
-                    verticalAlignment = Alignment.CenterVertically,
-                    modifier = Modifier.fillMaxWidth(),
-                ) {
-                    // Deliberately not subtitled with the provider this was opened from. These
-                    // numbers belong to an account on a particular machine, reported by whichever
-                    // paid service answered there -- naming the session's provider here made an
-                    // echo session's screen read "echo" above a line reading "claude", which is a
-                    // claim about echo that nothing measured. Each machine names itself and the
-                    // service it came from, which is the true scope.
-                    Text(
-                        "Usage",
-                        style = MaterialTheme.typography.headlineSmall,
-                        modifier = Modifier.weight(1f),
-                    )
-                    GlyphButton(REFRESH_GLYPH, "Refresh usage", { refresh() })
-                }
-                Spacer(Modifier.height(8.dp))
-                // Scrolls rather than being trimmed: a machine can report any number of windows
-                // and there can be any number of machines, and a dialog is the one place where
-                // running out of room is silent. `fill = false` so a short read-out keeps a short
-                // dialog instead of stretching to the window.
-                Column(Modifier.weight(1f, fill = false).verticalScroll(rememberScrollState())) {
-                    UsageBody(state)
-                }
-                TextButton(onClick = onDismiss, modifier = Modifier.align(Alignment.End)) {
-                    Text("Close")
-                }
-            }
-        }
-    }
-}
-
-/** What came back, or why nothing did. Split out so the dialog above reads as its own shape. */
-@Composable
-private fun UsageBody(state: LoadState<List<UsageSnapshot>>) {
-    Column {
-        when (val current = state) {
-            is LoadState.Loading -> CircularProgressIndicator()
-            is LoadState.Error -> Text(current.message, color = MaterialTheme.colorScheme.error)
-            is LoadState.Loaded ->
-                if (current.value.isEmpty()) {
-                    // Not an error and not a blank screen: no machine offers a paid service,
-                    // so there is genuinely nothing to report and saying so is the answer.
-                    Text(
-                        "No machine here runs anything with usage limits.",
-                        style = MaterialTheme.typography.bodyMedium,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                } else {
-                    // No card around each machine. A card is a step up the surface ladder, and
-                    // inside a dialog -- itself a raised surface -- the step barely renders while
-                    // costing 16dp of padding on every side. What separates one machine from the
-                    // next is the line naming it, which is enough for a list this short.
-                    current.value.forEachIndexed { index, snapshot ->
-                        if (index > 0) {
-                            Spacer(Modifier.height(20.dp))
-                        }
-                        // Machine and service on one line: which account these numbers belong to
-                        // is decided by both together, and stacked as a heading over a subtitle
-                        // they read as a section of their own rather than as the label they are.
-                        // Small and quiet, because the numbers below are what somebody opened
-                        // this to see.
-                        Text(
-                            "${snapshot.setupName.ifEmpty { snapshot.setup }} · ${snapshot.provider}",
-                            style = MaterialTheme.typography.bodySmall,
-                            color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        )
-                        SnapshotState(snapshot)
-                        snapshot.windows.forEachIndexed { windowIndex, window ->
-                            // Between the bars, not after the last one: a trailing gap here is
-                            // what put a band of empty dialog above the Close button.
-                            if (windowIndex > 0) {
-                                Spacer(Modifier.height(12.dp))
-                            }
-                            WindowBar(window)
-                        }
-                    }
-                }
-        }
-    }
-}
-
-/**
- * Anything other than numbers: why this machine has none.
- *
- * The distinction the old single message could not draw. A machine nobody has logged in on is
- * working exactly as somebody set it up, so it reads as a plain statement -- marking it would be
- * the interface nagging about a decision already made, and would dilute the marks that do mean
- * something. Only the two faults are coloured as faults.
- */
-@Composable
-private fun SnapshotState(snapshot: UsageSnapshot) {
-    when (snapshot.state) {
-        "ok" -> {}
-        "notLoggedIn" ->
-            Text(
-                "No Claude account on this machine.",
-                style = MaterialTheme.typography.bodyMedium,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-        // Reached but refused, versus never reached at all: different things to go and do,
-        // so they say different things rather than sharing one "unavailable".
-        "failed" ->
-            Text(
-                snapshot.detail ?: "Couldn't read the limits from this machine.",
-                style = MaterialTheme.typography.bodyMedium,
-                color = failedColor,
-            )
-        else ->
-            Text(
-                snapshot.detail ?: "Couldn't reach this machine.",
-                style = MaterialTheme.typography.bodyMedium,
-                color = failedColor,
-            )
-    }
-}
-
-@Composable
-private fun WindowBar(window: UsageWindow) {
-    Column {
-        Row(modifier = Modifier.fillMaxWidth()) {
-            Text(
-                window.label + if (window.active) " (active)" else "",
-                style = MaterialTheme.typography.bodyMedium,
-                modifier = Modifier.weight(1f),
-            )
-            Text("${window.percent.toInt()}%", style = MaterialTheme.typography.bodyMedium)
-        }
-        Spacer(Modifier.height(4.dp))
-        LinearProgressIndicator(
-            progress = { (window.percent / 100.0).toFloat().coerceIn(0f, 1f) },
-            color = quotaColor(window.percent),
-            modifier = Modifier.fillMaxWidth(),
-        )
-        resetLine(window)?.let {
-            Spacer(Modifier.height(2.dp))
-            Text(
-                it,
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-        }
-    }
-}
-
-/**
- * "resets in 3h 12m" -- close enough for deciding whether to start a big task -- or nothing.
- *
- * Null for a window that is not running, which is the case this row has always drawn as nothing and
- * is right to: there is no end to report. What it used to get wrong is the other missing case, a
- * timestamp that arrived and could not be read: that was printed raw, so a parse failure appeared
- * as an ISO string in the middle of a sentence written for a person. Both cases are named in
- * [WindowEnd], and the session bar words them the same way.
- */
-private fun resetLine(window: UsageWindow): String? =
-    when (val end = windowEnd(window.resetsAt, OffsetDateTime.now())) {
-        WindowEnd.NotRunning -> null
-        WindowEnd.Unreadable -> "reset time unreadable"
-        is WindowEnd.Ends ->
-            if (end.until.isNegative) "resets soon" else "resets in ${formatSpan(end.until)}"
-    }

app/assets/fonts/NERD_FONTS_LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Ryan L McIntyre
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

app/bench-fixture/README.md

@@ -0,0 +1,44 @@
+# The P0 benchmark fixture
+
+`transcript.jsonl` is a synthetic transcript in the app's event model (the JSON lines
+`GET /sessions/{id}/transcript` returns; see `event-model` and
+`server/src/session/driver.rs`) -- never a real one. The `bench` build opens it without a
+server so renderer measurements use deterministic data.
+
+Generated by `./generate.py` (Python stdlib only, seeded -- `SEED = 20260905` -- so re-running it
+reproduces the same file byte for byte). It writes into `assets/`; only those generated assets are
+embedded in the benchmark APK.
+
+- `transcript.jsonl` -- 3,603 events. The first 3,202 (`BACKLOG_COUNT`) are the scrolled-back
+  history the benchmark opens with: user turns, tool calls with kilobyte-scale input/output,
+  assistant replies built from headings, bold/italic/inline code, a link, fenced code blocks that
+  rotate through rust/kotlin/python/sh/json/toml, a markdown table, two embedded images, and
+  periodic `usageDelta`/`compacted` events. The remaining 400 (`STREAM_COUNT`) are not part of the
+  opening window -- both bench harnesses replay them at a fixed rate (20/s) through the same live
+  fold path a real SSE reply arrives on, which is P0's "streaming phase."
+
+  **The streamed reply has a blank line every few deltas** (2026-09-09), so the markdown block a
+  delta lands in stays the size a real reply's blocks are -- 53 blocks, longest 502 characters,
+  against a measured p50 of 147 and a largest-ever 1,580 over 7,706 blocks of real assistant
+  messages. It used to be one run-on 14,888-character block, and since a row re-shapes the block a
+  delta lands in, every delta re-shaped all of it: quadratic in the reply's length, and 9.5ms of
+  frame time on a phone spent on a shape that does not occur. docs/RUST.md's "Incremental text"
+  has the measurements.
+
+  **The run-on message is kept**, as the first two events of the backlog: 14,824 characters in a
+  single block, just under `text_cap`'s 16 KiB `MESSAGE_BYTES` so it draws in full rather than
+  behind a "Show all". It is deliberately *not* streamed -- the repeated-reshape pathology needs a
+  growing block, and that lives in the UI profiling rig where it can be iterated on
+  in a second rather than in a two-minute phone run. It is emitted with the random state saved and
+  restored around it, so adding it left every other backlog event byte-identical; that is what
+  keeps `phone_screen.rs`'s recorded gestures landing on the content they were recorded against.
+- `bench1.png`, `bench2.png` -- tiny (8x8) flat-colour PNGs, base64-free on disk but served the
+  same way a real attachment is (`GET /sessions/{id}/files/{name}`), referenced by the two
+  `"type":"image"` events in the transcript.
+
+`BACKLOG_COUNT` lives here, in `generate.py`, and in `app/src/ui/fixture.rs`; change all three
+together. The split is by line index.
+
+Regenerate after changing the shape (a new event type, a different backlog/stream split) with
+`./generate.py`, and commit the result -- it is checked in rather than generated at build time so
+the benchmark embeds identical bytes without needing this script at build time.

app/bench-fixture/generate.py

@@ -0,0 +1,247 @@
+#!/usr/bin/env python3
+"""Generates transcript.jsonl -- the synthetic fixture the benchmark opens.
+
+Deterministic (fixed seed), so runs draw byte-identical content.
+
+Never a real transcript -- see AGENTS.md's ui-sandbox.sh, which this borrows its vocabulary
+style from (headings, code fences, a table, a link) rather than reusing its Claude-Code JSONL
+shape. This file's shape is the *app's own event model* instead: one JSON object per line,
+matching what GET /sessions/{id}/transcript returns
+(server/src/session/driver.rs is the source of truth for the field names).
+
+    ./generate.py                      writes transcript.jsonl and bench1.png/bench2.png here
+
+BACKLOG_COUNT events (seq 1..BACKLOG_COUNT) are the scrolled-back history the benchmark opens
+with. A further STREAM_COUNT events (seq BACKLOG_COUNT+1..) are not part of the opening window;
+both bench harnesses replay them at a fixed rate as the "streaming reply" phase, appended through
+the same live path a real SSE reply arrives on. Keeping both halves in one file means one
+generator and one seed to keep in sync, rather than two fixtures that can drift apart.
+"""
+import base64
+import json
+import random
+import struct
+import zlib
+from pathlib import Path
+
+SEED = 20260905
+# The stress message below, two events, added to the 3,200 the backlog used to be. Both apps
+# hardcode this to split the file by line index (`fixture.rs`'s `BACKLOG_COUNT`,
+# `BenchFixture.kt`'s), so it moves in three places or none.
+STRESS_EVENTS = 2
+BACKLOG_COUNT = 3200 + STRESS_EVENTS
+STREAM_COUNT = 400
+
+# How many deltas fold into one markdown block of the streamed reply.
+#
+# **The blank line between them is the point** (2026-09-09). Until this run the streaming tail
+# appended `paragraph(5) + " "` STREAM_COUNT times with no blank line anywhere, so all 400 deltas
+# folded into a *single* 14,888-character block -- and a row re-shapes the block a delta lands in
+# (`RowBlocks::apply_delta`), so every delta re-shaped the whole thing. That is quadratic in the
+# reply's length, and it put 9.5ms of frame time on Iris's phone into a shape that does not occur:
+# measured over 7,706 top-level blocks from 3,675 real assistant messages, block length is p50 147
+# characters, p90 449, p99 836, largest 1,580, nothing above 4,000. `paragraph(5)` is ~35
+# characters, so 4-12 of them per block lands in that range.
+#
+# The run-on version is kept, as STRESS_CHARS below -- Iris, 2026-09-09: "let's switch to new
+# lines for the test, and also let's keep the single line around for stress".
+DELTAS_PER_BLOCK = (4, 12)
+
+# One deliberately pathological message in the backlog: a single markdown block with no blank line
+# in it, the shape the streaming tail used to have. Sized just under `text_cap`'s MESSAGE_BYTES
+# (16 KiB) so it is drawn in full rather than behind a "Show all" -- which makes it a genuine
+# stress for one-shot shaping and puts a row right on the cap boundary, where nothing else is.
+#
+# It is *not* streamed: the repeated-reshape pathology needs a growing block, and that lives in
+# the UI profiling rig's `what_reshaping_a_growing_message_costs`, where it can be
+# iterated on in a second rather than in a two-minute phone run. Note that the cap would not save
+# a real one anyway -- `row::build_row`'s `cap` is deliberately `false` for the live tail, because
+# a row that grew while capped would appear to stop growing, so a streamed block's shaping cost
+# has no ceiling.
+STRESS_CHARS = 14_800
+HERE = Path(__file__).resolve().parent / "assets"
+
+random.seed(SEED)
+
+LANGUAGES = ["rust", "kotlin", "python", "sh", "json", "toml"]
+
+CODE_SNIPPETS = {
+    "rust": '''fn fold_event(items: Vec<Item>, seq: u64) -> Vec<Item> {
+    // a comment worth keeping: this is the fold the app's own screen runs
+    let mut out = items;
+    out.push(Item::new(seq));
+    out
+}''',
+    "kotlin": '''fun foldEvent(items: List<TranscriptItem>, entry: SeqEvent): List<TranscriptItem> {
+    // mirrors the server's own event model, one item per line
+    return items + TranscriptItem.from(entry)
+}''',
+    "python": '''def render_report(frames, cpu_ms, rss_kb):
+    # printed for a human to paste back, so every number carries its unit
+    return f"{frames} frames, {cpu_ms}ms cpu, {rss_kb}kb peak rss"''',
+    "sh": '''#!/bin/sh
+# scripted scroll loop, the shape transcript-bench.sh drives on a phone
+for i in $(seq 1 24); do
+    ui-trace record --do "swipe 540 700 540 1600 200"
+done''',
+    "json": '{"seq": 1, "type": "status", "state": "running"}',
+    "toml": '''[package]
+name = "bench-fixture"
+version = "0.1.0"''',
+}
+
+HEADINGS = [
+    "## Plan",
+    "## What changed",
+    "## Why this approach",
+    "### Open questions",
+    "## Results",
+]
+
+WORDS = (
+    "session render report frame budget scroll transcript fold event cache "
+    "cursor probe stream backlog swipe fixture bench compose iris widget layout "
+    "measure place draw tool call token context window anchor"
+).split()
+
+
+def paragraph(n=24):
+    words = [random.choice(WORDS) for _ in range(n)]
+    words[0] = words[0].capitalize()
+    text = " ".join(words) + "."
+    # Sprinkle markdown inline spans so the syntax highlighter/markdown parser sees a real mix.
+    text = text.replace(" fold ", " **fold** ", 1)
+    text = text.replace(" cursor ", " *cursor* ", 1)
+    text = text.replace(" cache ", " `cache` ", 1)
+    if "bench" in text:
+        text = text.replace(
+            " bench ", " [bench](https://example.com/bench) ", 1
+        )
+    return text
+
+
+def make_png(rgb, size=8):
+    """A tiny, valid PNG -- flat colour, no external dependency."""
+
+    def chunk(tag, data):
+        c = tag + data
+        return struct.pack(">I", len(data)) + c + struct.pack(">I", zlib.crc32(c))
+
+    sig = b"\x89PNG\r\n\x1a\n"
+    ihdr = struct.pack(">IIBBBBB", size, size, 8, 2, 0, 0, 0)
+    raw = b""
+    for _ in range(size):
+        raw += b"\x00" + bytes(rgb) * size
+    idat = zlib.compress(raw)
+    return sig + chunk(b"IHDR", ihdr) + chunk(b"IDAT", idat) + chunk(b"IEND", b"")
+
+
+def main():
+    HERE.mkdir(exist_ok=True)
+    lines = []
+    seq = 1
+    ts = 1_788_000_000.0
+
+    def emit(type_, **fields):
+        nonlocal seq, ts
+        obj = {"seq": seq, "ts": round(ts, 3), "type": type_}
+        obj.update(fields)
+        lines.append(json.dumps(obj, separators=(",", ":")))
+        seq += 1
+        ts += random.uniform(0.05, 2.0)
+
+    emit("status", state="running")
+    emit("settings", model="bench-model", permissionMode="auto")
+
+    # The stress message, emitted first and with the random state put back afterwards, so that
+    # adding it is **purely additive**: every turn the loop below generates is byte-identical to
+    # what it generated before this existed, and only the streaming tail changed. That matters
+    # because the fixture's opening view is what `phone_screen.rs`'s recorded gestures press --
+    # `a_long_press_and_drag_selects_text` drives a real recording at (300, 1000) and fails the
+    # moment different content lands under it. `ts` still shifts by the two draws, which nothing
+    # reads.
+    rng_state = random.getstate()
+    emit(
+        "userMessage",
+        text="And the pathological one: a reply with no paragraph break in it.",
+        id=None,
+        attachments=[],
+    )
+    run_on = ""
+    while len(run_on) < STRESS_CHARS:
+        run_on += paragraph(5) + " "
+    emit("assistantText", delta=run_on.rstrip())
+    random.setstate(rng_state)
+
+    image_refs = []
+    turn = 0
+    while seq <= BACKLOG_COUNT:
+        turn += 1
+        emit("userMessage", text=f"Turn {turn}: {paragraph(12)}", id=None, attachments=[])
+
+        # A tool call with kilobyte-scale input/output every few turns.
+        if turn % 3 == 0:
+            tool_id = f"tool-{turn}"
+            big_input = json.dumps({"path": f"/repo/file_{turn}.rs", "content": paragraph(400)})
+            emit("toolStart", id=tool_id, tool="Edit", input=big_input)
+            big_output = "\n".join(paragraph(60) for _ in range(20))
+            emit("toolUpdate", id=tool_id, output=big_output[: len(big_output) // 2])
+            emit("toolEnd", id=tool_id, output=big_output)
+
+        # A reply: a heading, prose, a fenced block in a rotating language, a table, then deltas.
+        emit("assistantText", delta=f"{random.choice(HEADINGS)}\n\n")
+        emit("assistantText", delta=paragraph(30) + "\n\n")
+        lang = LANGUAGES[turn % len(LANGUAGES)]
+        emit("assistantText", delta=f"```{lang}\n{CODE_SNIPPETS[lang]}\n```\n\n")
+        if turn % 5 == 0:
+            emit(
+                "assistantText",
+                delta="| column | value |\n|---|---|\n| a | " + paragraph(3) + " |\n\n",
+            )
+        # A run of small deltas -- the shape a live reply actually streams in.
+        for _ in range(random.randint(3, 8)):
+            emit("assistantText", delta=paragraph(6) + " ")
+
+        # A couple of images, base64 PNGs, the way a real transcript embeds a screenshot.
+        if turn in (10, 40):
+            ref = f"bench{len(image_refs) + 1}.png"
+            image_refs.append(ref)
+            emit("image", ref=ref, about=None)
+
+        emit("usageDelta", tokens=random.randint(200, 4000), context=random.randint(2000, 180000))
+
+        if turn % 15 == 0:
+            emit(
+                "compacted",
+                preTokens=180000,
+                postTokens=20000,
+                trigger="auto",
+            )
+
+    # The streaming-phase tail: one reply built entirely from text deltas, the shape a bench
+    # harness replays at a fixed events/sec through the live fold path -- with a blank line every
+    # few deltas, so the block a delta lands in stays the size a real reply's blocks are. See
+    # DELTAS_PER_BLOCK for what the alternative measured.
+    emit("userMessage", text="One more, streamed live for the benchmark's timing phase.", id=None, attachments=[])
+    until_break = random.randint(*DELTAS_PER_BLOCK)
+    while seq <= BACKLOG_COUNT + STREAM_COUNT:
+        until_break -= 1
+        if until_break <= 0:
+            # The break rides on the last delta of the block rather than being an event of its
+            # own, so STREAM_COUNT still counts deltas a reader sees text arrive from.
+            emit("assistantText", delta=paragraph(5) + "\n\n")
+            until_break = random.randint(*DELTAS_PER_BLOCK)
+        else:
+            emit("assistantText", delta=paragraph(5) + " ")
+    emit("status", state="idle")
+
+    (HERE / "transcript.jsonl").write_text("\n".join(lines) + "\n")
+
+    (HERE / "bench1.png").write_bytes(make_png((220, 90, 90)))
+    (HERE / "bench2.png").write_bytes(make_png((90, 150, 220)))
+
+    print(f"wrote {len(lines)} events ({BACKLOG_COUNT} backlog + {STREAM_COUNT} stream) to transcript.jsonl")
+
+
+if __name__ == "__main__":
+    main()

app/build-apk.sh

@@ -1,153 +1,108 @@
 #!/bin/sh
-# Builds the app's APK, ready to install on a phone through Dev Updater.
+# Builds the Rust cdylib with cargo-ndk, packages it with Gradle, and
+# verifies the resulting APK.
 #
-#   ./build-apk.sh            the release build, signed (what the phone runs)
-#   ./build-apk.sh debug      the debug build, for reproducing something the
-#                             emulator scripts would build anyway
-#
-# Dev Updater's `.dev-updater.ron` at the checkout root spells these out as
-# build modes, one command line each; it passes nothing else, so the word
-# here is the whole interface.
-#
-# The APK pins the CA on *this* machine ($XDG_CONFIG_HOME/ai-app/certs/ca.pem,
-# or AI_APP_CA), so build it on the machine that runs the backend: an app
-# built somewhere else trusts a CA that backend can't present, and simply
-# won't connect. Start ai-server once first if there are no certificates
-# yet -- it generates them; the build stops with that instruction if it
-# can't find one.
-#
-# Unlike ./run-android.sh, this touches no emulator: it only produces the
-# file. Installing on a real phone goes through Dev Updater, which serves
-# whatever is under this project's build directory.
+# Usage: ./build-apk.sh [debug|release] [--abi arm64-v8a|x86_64] [--features "a b c"]
+#   debug/release default to debug (matches this-machine-android's "the
+#   emulator stays on debug" rule -- pass `release` explicitly for a phone
+#   build). --abi defaults to arm64-v8a (a phone/real device); pass
+#   x86_64 for this checkout's own AVD. --features defaults to
+#   "screens". Pass "screens bench" for the retained benchmark app. Never
+#   force GLES for a phone or emulator build; Iris's
+#   runtime selects the available hardware backend.
 set -eu
+cd "$(dirname "$0")"
 
-VARIANT=${1:-release}
-case "$VARIANT" in
-release) TASK=assembleRelease ;;
-debug) TASK=assembleDebug ;;
-*)
-    echo "build-apk.sh: unknown variant '$VARIANT' (release, debug)" >&2
-    exit 2
-    ;;
+BUILD_TYPE="debug"
+ABI="arm64-v8a"
+FEATURES="screens"
+case "${1:-}" in
+    debug|release) BUILD_TYPE="$1"; shift ;;
+esac
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --abi) ABI="$2"; shift 2 ;;
+        --features) FEATURES="$2"; shift 2 ;;
+        *) echo "build-apk.sh: unknown argument: $1" >&2; exit 1 ;;
+    esac
+done
+
+SDK_ROOT="$HOME/Android/Sdk"
+export ANDROID_HOME="$SDK_ROOT"
+export ANDROID_SDK_ROOT="$SDK_ROOT"
+NDK_DIR=$(ls -d "$SDK_ROOT"/ndk/*/ 2>/dev/null | sort -V | tail -1)
+if [ -z "$NDK_DIR" ]; then
+    echo "build-apk.sh: no NDK found under $SDK_ROOT/ndk" >&2
+    exit 1
+fi
+export ANDROID_NDK_HOME="$NDK_DIR"
+
+# Only the ABI asked for goes into the APK. cargo ndk adds its output beside
+# whatever earlier builds left here, and Gradle packages every directory it
+# finds -- a debug x86_64 emulator build left behind made an arm64 "release"
+# 339 MB on 2026-09-06.
+rm -rf android-project/app/src/main/jniLibs
+# ...and Gradle's own copy of them, which `rm -rf jniLibs` does not reach.
+# `mergeReleaseNativeLibs` is *up to date* against its cached inputs, so a
+# build that switches ABI packages the previous ABI: an `--abi x86_64`
+# release APK containing `lib/arm64-v8a/libmain.so` installed fine and
+# aborted at startup with `Could not get adapter!: NotFound {
+# active_backends: VULKAN }` under libndk_translation -- which reads
+# exactly like the phone's own Vulkan problem and is nothing of the kind.
+# Scoped to the merge task's directory rather than all of `app/build`, so
+# an ABI change costs the native merge and not the whole Gradle build.
+rm -rf android-project/app/build/intermediates/merged_native_libs \
+       android-project/app/build/intermediates/stripped_native_libs \
+       android-project/app/build/intermediates/merged_jni_libs
+echo "build-apk.sh: cargo ndk -t $ABI build ${BUILD_TYPE:+(${BUILD_TYPE})} --features \"$FEATURES\""
+if [ "$BUILD_TYPE" = "release" ]; then
+    cargo ndk -t "$ABI" -P 29 -o android-project/app/src/main/jniLibs/ build --lib \
+        --profile android-release --no-default-features --features "$FEATURES"
+else
+    cargo ndk -t "$ABI" -P 29 -o android-project/app/src/main/jniLibs/ build --lib \
+        --profile android-dev --no-default-features --features "$FEATURES"
+fi
+
+GRADLE_TASK="assembleDebug"
+APK_DIR="android-project/app/build/outputs/apk/debug"
+APK_NAME="app-debug.apk"
+if [ "$BUILD_TYPE" = "release" ]; then
+    GRADLE_TASK="assembleRelease"
+    APK_DIR="android-project/app/build/outputs/apk/release"
+    APK_NAME="app-release.apk"
+    export AI_APP_KEYSTORE="${XDG_CONFIG_HOME:-$HOME/.config}/ai-app/release.jks"
+    if [ ! -f "$AI_APP_KEYSTORE" ]; then
+        KEYTOOL="${JAVA_HOME:+$JAVA_HOME/bin/keytool}"
+        KEYTOOL="${KEYTOOL:-keytool}"
+        if ! command -v "$KEYTOOL" >/dev/null 2>&1; then
+            echo "build-apk.sh: no release key and no keytool to create one" >&2
+            exit 1
+        fi
+        mkdir -p "$(dirname "$AI_APP_KEYSTORE")"
+        AI_APP_KEYSTORE_PASSWORD=$(head -c 24 /dev/urandom | base64 | tr -d '/+=')
+        (umask 077 && printf '%s\n' "$AI_APP_KEYSTORE_PASSWORD" > "$AI_APP_KEYSTORE.password")
+        (umask 077 && "$KEYTOOL" -genkeypair -keystore "$AI_APP_KEYSTORE" \
+            -alias ai-app -keyalg RSA -keysize 2048 -validity 10000 \
+            -storepass "$AI_APP_KEYSTORE_PASSWORD" -keypass "$AI_APP_KEYSTORE_PASSWORD" \
+            -dname "CN=ai-app" >/dev/null 2>&1)
+    fi
+    export AI_APP_KEYSTORE_PASSWORD
+    AI_APP_KEYSTORE_PASSWORD=$(cat "$AI_APP_KEYSTORE.password")
+fi
+
+unset AI_APP_BENCH
+case " $FEATURES " in
+    *" bench "*) export AI_APP_BENCH=1 ;;
 esac
 
-SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
-cd "$SCRIPT_DIR"
+(cd android-project && gradle ":app:$GRADLE_TASK" --console=plain)
 
-# Prefer an SDK this machine has already configured -- the host and the dev
-# VM don't keep it in the same place, and android-env.sh is written for the
-# VM's layout (it also installs missing packages, which isn't wanted here).
-if [ -n "${ANDROID_HOME:-}" ] && [ -d "${ANDROID_HOME}" ]; then
-    echo "==> Using ANDROID_HOME=$ANDROID_HOME"
-elif [ -n "${ANDROID_SDK_ROOT:-}" ] && [ -d "${ANDROID_SDK_ROOT}" ]; then
-    ANDROID_HOME="$ANDROID_SDK_ROOT"
-    export ANDROID_HOME
-    echo "==> Using ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT"
-elif [ -d "$HOME/Android/Sdk" ]; then
-    ANDROID_HOME="$HOME/Android/Sdk"
-    ANDROID_SDK_ROOT="$ANDROID_HOME"
-    export ANDROID_HOME ANDROID_SDK_ROOT
-    echo "==> Using $ANDROID_HOME"
-else
-    echo "No Android SDK found. Set ANDROID_HOME to it, or install one" >&2
-    echo "(Android Studio's default location is ~/Android/Sdk)." >&2
-    exit 1
+APK_PATH="$(pwd)/$APK_DIR/$APK_NAME"
+BUILD_TOOLS=$(ls -d "$SDK_ROOT"/build-tools/*/ | sort -V | tail -1)
+echo "--- aapt2 dump badging ---"
+"${BUILD_TOOLS}aapt2" dump badging "$APK_PATH" | head -5
+if [ "$BUILD_TYPE" = "release" ]; then
+    echo "--- apksigner verify ---"
+    "${BUILD_TOOLS}apksigner" verify --print-certs "$APK_PATH"
 fi
-
-CA="${AI_APP_CA:-${XDG_CONFIG_HOME:-$HOME/.config}/ai-app/certs/ca.pem}"
-if [ -f "$CA" ]; then
-    # Printed so a wrong or stale certificate is visible here rather than
-    # as a handshake failure on the phone -- compare it against the CA the
-    # backend is actually presenting.
-    FINGERPRINT=$(openssl x509 -in "$CA" -pubkey -noout 2>/dev/null \
-        | openssl pkey -pubin -outform der 2>/dev/null \
-        | openssl dgst -sha256 -binary 2>/dev/null \
-        | openssl base64 2>/dev/null || echo "(openssl unavailable)")
-    echo "==> Pinning the CA at $CA"
-    echo "    fingerprint: $FINGERPRINT"
-else
-    echo "No CA certificate at $CA -- start ai-server once on this machine" >&2
-    echo "(it generates them), or set AI_APP_CA. The APK embeds it at build time." >&2
-    exit 1
-fi
-
-# The phone runs the release build. A debuggable build runs Compose at a
-# fraction of the speed -- ART keeps the process debugger-friendly and the
-# compiler leaves its inspection hooks in -- so a frame time measured on one
-# says little about the app; that cost a day of tuning against the wrong
-# number. A release build must be signed, and the key is what the phone
-# recognises the app by, so it lives beside the CA, outside any checkout,
-# and is generated once here. Switching from an installed debug build means
-# uninstalling it first: the signatures differ, and Android refuses to
-# update across them.
-KEYSTORE="${AI_APP_KEYSTORE:-${XDG_CONFIG_HOME:-$HOME/.config}/ai-app/release.jks}"
-if [ "$VARIANT" = release ] && [ ! -f "$KEYSTORE" ]; then
-    KEYTOOL="${JAVA_HOME:+$JAVA_HOME/bin/keytool}"
-    KEYTOOL="${KEYTOOL:-keytool}"
-    if ! command -v "$KEYTOOL" >/dev/null 2>&1; then
-        echo "No signing key at $KEYSTORE and no keytool to make one -- set" >&2
-        echo "JAVA_HOME to the JDK Gradle uses, or AI_APP_KEYSTORE to an existing key." >&2
-        exit 1
-    fi
-    echo "==> No signing key at $KEYSTORE -- generating one"
-    mkdir -p "$(dirname "$KEYSTORE")"
-    PASSWORD=$(head -c 24 /dev/urandom | base64 | tr -d '/+=')
-    (umask 077 && printf '%s\n' "$PASSWORD" > "$KEYSTORE.password")
-    (umask 077 && "$KEYTOOL" -genkeypair -keystore "$KEYSTORE" -alias ai-app \
-        -keyalg RSA -keysize 2048 -validity 10000 \
-        -storepass "$PASSWORD" -keypass "$PASSWORD" -dname "CN=ai-app" >/dev/null 2>&1)
-fi
-if [ "$VARIANT" = release ]; then
-    AI_APP_KEYSTORE="$KEYSTORE"
-    AI_APP_KEYSTORE_PASSWORD=$(cat "$KEYSTORE.password")
-    export AI_APP_KEYSTORE AI_APP_KEYSTORE_PASSWORD
-    echo "==> Signing with $KEYSTORE"
-fi
-
-# Dev Updater draws a real progress bar from "@@progress done/total" lines,
-# and ignores anything that isn't exactly that shape. Gradle can't be asked
-# for this directly: an init script using taskGraph.afterTask is rejected
-# outright by the configuration cache, and whenReady never fires on a cache
-# hit. --dry-run costs about a second, is cache-friendly, and prints one
-# ":task SKIPPED" line per task the real build will run, which is exactly
-# the total. The build then prints one "> Task :x" line per task as it
-# goes, so counting those against it is the whole mechanism.
-#
-# Task count is not time -- the Kotlin compile and dexBuilder are most of
-# the wall clock -- so the bar moves unevenly. It is still counted work
-# rather than a guess at how long last time took.
-TASKS=$(./gradlew :androidApp:$TASK --dry-run --console=plain 2>/dev/null \
-    | grep -c '^:[A-Za-z:]* SKIPPED' || true)
-
-echo "==> Building"
-if [ "${TASKS:-0}" -gt 0 ]; then
-    echo "@@progress 0/$TASKS"
-    DONE=0
-    ./gradlew :androidApp:$TASK --console=plain 2>&1 | while IFS= read -r line; do
-        echo "$line"
-        case "$line" in
-            "> Task "*)
-                DONE=$((DONE + 1))
-                echo "@@progress $DONE/$TASKS"
-                ;;
-        esac
-    done
-    # The pipeline's exit status is the shell's, not gradle's, so ask
-    # gradle again rather than reporting a failed build as a success. It is
-    # up to date by now, so this is a second or two.
-    ./gradlew :androidApp:$TASK --console=plain >/dev/null
-else
-    ./gradlew :androidApp:$TASK
-fi
-
-APK="$SCRIPT_DIR/androidApp/build/outputs/apk/$VARIANT/androidApp-$VARIANT.apk"
-echo
-echo "==> Built $APK"
-[ -f "$APK" ] && ls -lh "$APK" | awk '{print "    " $5}'
-echo
-echo "To get it onto the phone: add this project to Dev Updater (or hit"
-echo "Update on it if it's already there) and install from there."
-echo "Debug and release are signed with different keys, so switching from"
-echo "one to the other means uninstalling the installed one first."
-echo "Then start the backend and scan the enrollment QR it prints:"
-echo "    ./server/target/release/ai-server --rotate-token"
+echo "$APK_PATH"

app/build-icon-font.sh

@@ -1,49 +1,36 @@
 #!/usr/bin/env bash
-# Rebuilds androidApp/src/main/res/font/nerd_icons.ttf.
+# Rebuilds app/assets/fonts/nerd_icons.ttf.
 #
-# The app draws a handful of icons -- a cog, a refresh arrow, send, stop --
-# as text in a Nerd Fonts glyph rather than as vector assets or as ordinary
-# Unicode. Unicode has no character for most of these, and the ones it does
-# have are not reliably in an Android system font, so they land as tofu
-# boxes on somebody's phone. Shipping the subset removes the hope: the
-# glyph is in the APK.
+# ai-app draws its icons as glyphs in a Nerd Fonts subset it ships, rather
+# than as ordinary Unicode out of whatever the platform resolved. Unicode's
+# own geometric shapes are what this replaced: `tool.rs` set its disclosure
+# mark with U+25B8/25BE/25B4, and once iris stopped bundling fonts
+# (2026-09-07) Iris's phone drew an empty box for them and this VM drew a
+# dot. UI_RULES: "don't rely on characters the platform might not have --
+# ship the glyph or the asset rather than hoping."
 #
 # The whole symbols font is 3 MB for the handful below, so what is
-# committed is a subset. Add a codepoint to GLYPHS below and to NerdIcons.kt
-# (the two lists have to agree -- a codepoint in the Kotlin but not here is
-# a glyph that silently doesn't exist), then run this and commit the result.
+# committed is a subset. Add a codepoint to GLYPHS *and* to
+# `app/src/ui/icon.rs` (the two lists have to agree -- a codepoint in
+# the Rust that this script did not subset is a glyph that silently isn't
+# there), then run this and commit the result.
 #
 # Needs python3 and network access; fontTools is fetched into a temporary
 # venv, so nothing has to be installed on the machine.
 #
-# Copied from dev-updater's script of the same name rather than shared
-# through wg-app-link, for the reason Theme.kt gives about the palette: the
-# link is the tunnel, the pinned CA and enrollment, and an icon set is a
-# preference rather than part of that contract.
+# The Mono face makes icon metrics stable; the Material Design family keeps
+# their meanings conventional.
 set -euo pipefail
 
-# Codepoint, then the Nerd Fonts glyph name it came from. Material Design
-# Icons bar one, so they read as one family -- and the first two are
-# deliberately the same two dev-updater uses, since a cog and a refresh
-# arrow mean the same thing in both apps. The exception is noted on its
-# own line, as dev-updater's script does with its two.
 GLYPHS=(
-    U+F0493  # md-cog
-    U+F0450  # md-refresh
-    U+F048A  # md-send
-    U+F04DB  # md-stop
-    U+F03E4  # md-pause
-    U+F040A  # md-play
-    U+F1163  # md-send_clock
-    U+F0156  # md-close
-    U+F004D  # md-arrow_left
-    U+F009A  # md-bell
-    U+F04C5  # md-speedometer
-    U+F201   # fa-line_chart -- Font Awesome's, asked for by name
+    U+F035D  # md-menu_down -- a card that is open
+    U+F035F  # md-menu_right -- a card that opens
+    U+F0360  # md-menu_up -- collapse this group again
 )
 
 url=https://github.com/ryanoasis/nerd-fonts/releases/latest/download/NerdFontsSymbolsOnly.zip
-out="$(cd "$(dirname "$0")" && pwd)/androidApp/src/main/res/font/nerd_icons.ttf"
+here="$(cd "$(dirname "$0")" && pwd)"
+out="$here/assets/fonts/nerd_icons.ttf"
 work="$(mktemp -d)"
 trap 'rm -rf "$work"' EXIT
 
@@ -56,23 +43,14 @@ python3 -m venv "$work/venv"
 
 unicodes="$(IFS=,; echo "${GLYPHS[*]}")"
 mkdir -p "$(dirname "$out")"
-# The Mono face rather than the proportional one, which this used until
-# 2026-08-30. Every glyph in it is one em wide and one em tall, so two
-# icons drawn at the same size are the same size -- which is what makes two
-# icon buttons beside each other match without either of them being told a
-# width. In the proportional face the advances run from 0.46 em (play) to
-# 0.92 em (line chart), so the composer's Send button came out visibly wider
-# than the Stop button next to it, and any fix at the call site would have
-# been one measurement hardcoded per pair.
-#
-# The trade is the one the old comment named: an icon inline beside text is
-# padded out to a cell. That is worth it, and it is also why GLYPH_SIZE in
-# NerdIcons.kt came down when this changed -- a glyph that fills its em
-# draws bigger at the same point size than one that does not.
+# The Mono face, where every glyph is one em wide and one em tall, so two
+# icons at the same font size are the same size without either being given
+# one, which makes an icon's box predictable beside a line of text.
 "$work/venv/bin/pyftsubset" "$work/SymbolsNerdFontMono-Regular.ttf" \
     --unicodes="$unicodes" \
     --layout-features= \
     --drop-tables+=DSIG \
     --output-file="$out"
+cp "$work/LICENSE" "$here/assets/fonts/NERD_FONTS_LICENSE.txt"
 
 echo "Wrote $out ($(stat -c %s "$out") bytes) with ${#GLYPHS[@]} glyphs"

app/build.gradle.kts

@@ -1,6 +0,0 @@
-plugins {
-    alias(libs.plugins.androidApplication) apply false
-    alias(libs.plugins.androidLibrary) apply false
-    alias(libs.plugins.composeMultiplatform) apply false
-    alias(libs.plugins.composeCompiler) apply false
-}

app/debug-transcript.sh

@@ -1,149 +0,0 @@
-#!/bin/sh
-# Puts a real Claude Code conversation on the emulator, for looking at the
-# transcript screen under content it was not written against.
-#
-# The echo driver's fixtures (`/mixed`, `/stream`) are the right rig for most
-# things and the wrong one for anything whose cost scales with what was
-# actually written: a real reply is longer, is real markdown, and carries tool
-# calls whose input and output are kilobytes rather than a word. Two faults
-# were invisible until a real transcript was loaded -- a page of history
-# landing mid-fling threw the reader back to the newest end, and parsing one
-# real reply took 51ms against 4.6ms for a synthetic one.
-#
-#   ./debug-transcript.sh                 # newest transcript in ~/.claude/projects
-#   ./debug-transcript.sh dev-updater     # newest one whose project path matches
-#   ./debug-transcript.sh -b dev-updater  # the biggest one instead of the newest
-#   ./debug-transcript.sh -d 350          # hold every response back 350ms
-#
-# **The transcript never enters the repository.** These files are private --
-# they hold whatever was said, read and written in that session -- so this
-# copies one into /tmp and points an isolated server at it. Nothing it makes
-# is committed, and ~/repos is shared with the host besides.
-#
-# What it builds, all of it disposable:
-#   /tmp/ai-app-debug/home       a HOME holding only the copied transcript, so
-#                                the import cannot see or resume a live session
-#   /tmp/ai-app-debug/sessions   that server's own data directory
-#   a server on PORT, with its own config and the real CA (so the installed
-#   APK, which pins the CA of the machine that built it, still trusts it)
-set -eu
-
-PORT="${PORT:-8455}"
-DELAY=0
-MATCH=""
-BIGGEST=""
-STOP=""
-while [ $# -gt 0 ]; do
-    case "$1" in
-        -d|--delay) DELAY="$2"; shift 2 ;;
-        -b|--biggest) BIGGEST=yes; shift ;;
-        --stop) STOP=yes; shift ;;
-        -h|--help) sed -n '2,29p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
-        *) MATCH="$1"; shift ;;
-    esac
-done
-
-SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
-cd "$SCRIPT_DIR"
-REPO=$(dirname "$SCRIPT_DIR")
-WORK=/tmp/ai-app-debug
-PROJECTS="$HOME/.claude/projects"
-
-# Whatever the last run left, before this one takes the port again.
-#
-# Importing spawns `claude --resume` so the conversation can be continued, and
-# those outlive the server that started them: twelve accumulated over one
-# afternoon of re-running this. They are found by the scratch HOME and nothing
-# else, because every other `claude` on this machine is somebody's live session
-# -- including the one that may be running this script.
-stop_previous() {
-    for pid in $(pgrep -x claude 2>/dev/null); do
-        home=$(tr '\0' '\n' <"/proc/$pid/environ" 2>/dev/null | sed -n 's/^HOME=//p')
-        if [ "$home" = "$WORK/home" ]; then kill "$pid" 2>/dev/null || true; fi
-    done
-    pkill -f "[a]i-server --bind 127.0.0.1 --port $PORT" 2>/dev/null || true
-    # Gone, not merely signalled: the next start binds the same port.
-    while pgrep -f "[a]i-server --bind 127.0.0.1 --port $PORT" >/dev/null 2>&1; do sleep 1; done
-}
-
-stop_previous
-if [ -n "$STOP" ]; then
-    echo "Stopped the debug server on port $PORT and anything it spawned."
-    exit 0
-fi
-
-# Newest first, so with no argument you get the conversation you were just in.
-# `--biggest` is the other question worth asking of this directory, and the one
-# a scrolling test wants: the longest conversation on the machine is the one
-# with enough rows to page backwards through, and the newest is routinely a
-# session five minutes old with nothing in it.
-if [ -n "$BIGGEST" ]; then
-    SRC=$(ls -S "$PROJECTS"/*"$MATCH"*/*.jsonl 2>/dev/null | head -1)
-else
-    SRC=$(ls -t "$PROJECTS"/*"$MATCH"*/*.jsonl 2>/dev/null | head -1)
-fi
-if [ -z "$SRC" ]; then
-    echo "No Claude Code transcript under $PROJECTS matching '${MATCH:-anything}'." >&2
-    echo "Sessions are written there as <encoded-cwd>/<session-id>.jsonl." >&2
-    exit 1
-fi
-ID=$(basename "$SRC" .jsonl)
-PROJECT=$(basename "$(dirname "$SRC")")
-echo "==> Using $PROJECT/$ID ($(wc -l < "$SRC") lines, $(du -h "$SRC" | cut -f1))"
-
-# A HOME of its own is the isolation: `import::list` enumerates
-# "$HOME"/.claude/projects/*/*.jsonl through the transport, so a server started
-# with this one can only ever see the copy. That matters for more than tidiness
-# -- importing spawns `claude --resume <id>`, and against the real file that
-# would be a second CLI writing to a conversation somebody may still be in.
-rm -rf "$WORK"
-mkdir -p "$WORK/home/.claude/projects/$PROJECT"
-cp "$SRC" "$WORK/home/.claude/projects/$PROJECT/$ID.jsonl"
-
-CERTS="${XDG_CONFIG_HOME:-$HOME/.config}/ai-app/certs"
-if [ ! -f "$CERTS/ca.pem" ]; then
-    echo "No CA at $CERTS/ca.pem -- start ai-server once normally first." >&2
-    exit 1
-fi
-
-SERVER="$REPO/server/target/debug/ai-server"
-[ -x "$SERVER" ] || (cd "$REPO/server" && cargo build)
-
-echo "==> Starting server on port $PORT (delay ${DELAY}ms)"
-HOME="$WORK/home" setsid nohup "$SERVER" \
-    --bind 127.0.0.1 --port "$PORT" \
-    --config "$WORK/config.ron" --data-dir "$WORK/sessions" --certs "$CERTS" \
-    --delay "$DELAY" >"$WORK/server.log" 2>&1 </dev/null &
-until grep -q "serving https" "$WORK/server.log" 2>/dev/null; do sleep 1; done
-TOKEN=$(grep -o 'token=[A-Za-z0-9_-]*' "$WORK/server.log" | head -1 | cut -d= -f2)
-
-api() { curl -s --cacert "$CERTS/ca.pem" -H "Authorization: Bearer $TOKEN" "$@"; }
-
-echo "==> Importing"
-SETUP=$(api "https://127.0.0.1:$PORT/setups" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p' | head -1)
-SESSION=$(api -H 'Content-Type: application/json' -X POST \
-    "https://127.0.0.1:$PORT/sessions" \
-    -d "{\"setup\":\"$SETUP\",\"provider\":\"claude-cli\",\"title\":\"$PROJECT\",\"import\":\"$ID\"}" \
-    | sed -n 's/.*"id":"\([^"]*\)".*/\1/p' | head -1)
-echo "    session $SESSION, $(wc -l < "$WORK/sessions/$SESSION/transcript.jsonl") events"
-
-# 10.0.2.2 is the emulator's route to this VM's loopback. The `&` are quoted
-# on the *device* side: adb runs its argument through a shell there, which
-# would otherwise cut the URI at the first one and enrol with no token.
-if command -v adb >/dev/null 2>&1 && [ -n "$(adb devices | awk '$2=="device"{print $1}')" ]; then
-    echo "==> Enrolling the app"
-    adb shell "am start -a android.intent.action.VIEW \
-        -d 'aiapp://enroll?host=10.0.2.2&port=$PORT&token=$TOKEN'" >/dev/null
-fi
-
-cat <<EOF
-
-Ready. Open "$PROJECT" in the app; press Refresh if the list is stale.
-
-  token   $TOKEN
-  log     $WORK/server.log
-  stop    $SCRIPT_DIR/debug-transcript.sh --stop
-
-The imported session is a claude-cli one, so **do not send it a message**:
-that continues a real conversation on a real account. It is for reading.
-EOF

app/examples/phone.rs

@@ -0,0 +1,96 @@
+use iris::prelude::*;
+use winit::{dpi::PhysicalSize, window::WindowAttributes};
+
+fn ime_argv() -> Option<f32> {
+    let mut args = std::env::args().skip(1);
+    while let Some(arg) = args.next() {
+        if arg == "--ime" {
+            return args.next()?.parse().ok();
+        }
+    }
+    None
+}
+
+fn message_argv() -> Option<String> {
+    let mut args = std::env::args().skip(1);
+    while let Some(arg) = args.next() {
+        if arg == "--message" {
+            return Some(args.next()?.replace("\\n", "\n"));
+        }
+    }
+    None
+}
+
+fn typed_argv() -> Option<String> {
+    let mut args = std::env::args().skip(1);
+    while let Some(arg) = args.next() {
+        if arg == "--typed" {
+            return Some(args.next()?.replace("\\n", "\n"));
+        }
+    }
+    None
+}
+
+fn main() {
+    DesktopApp::<Client>::run();
+}
+
+#[derive(DesktopUiState)]
+pub struct Client {
+    ui_state: DesktopUiState,
+    #[allow(dead_code)]
+    screen: Option<ai_app::ui::TranscriptScreen>,
+}
+
+impl DesktopAppState for Client {
+    fn window_attributes() -> WindowAttributes {
+        WindowAttributes::default()
+            .with_title("iris transcript (bench fixture)")
+            .with_inner_size(PhysicalSize::new(
+                ai_app::ui::fixture::PHONE_WIDTH,
+                ai_app::ui::fixture::PHONE_HEIGHT,
+            ))
+    }
+
+    fn new(mut ui_state: DesktopUiState, rsc: &mut StdRsc<Self>) -> Self {
+        let screen = match ai_app::ui::fixture::open(rsc, &mut ui_state) {
+            Ok(opened) => {
+                if let Some(message) = message_argv() {
+                    (opened.screen.composer.field)(rsc).set(&message);
+                }
+                if let Some(text) = typed_argv() {
+                    let field = opened.screen.composer.field;
+                    rsc.spawn_task(async move |mut ctx| {
+                        for ch in text.chars() {
+                            tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+                            ctx.update(move |state: &mut Client, rsc| {
+                                state.set_focus(Some(field));
+                                let end = rsc[field].text().len();
+                                let edit = field(rsc);
+                                if edit.caret().is_none() {
+                                    edit.set_cursor_byte(end);
+                                }
+                                edit.insert(&ch.to_string());
+                            });
+                        }
+                    });
+                }
+                if let Some(inset) = ime_argv() {
+                    opened.screen.composer.set_bottom_inset(rsc, inset);
+                }
+                Some(opened.screen)
+            }
+            Err(message) => {
+                let text = wtext(format!("Couldn't fold the bench fixture: {message}"))
+                    .color(PaintId::WHITE)
+                    .overflow(TextOverflow::Wrap)
+                    .pad(dp(16))
+                    .add_strong(rsc)
+                    .any();
+                ui_state.set_root(rsc, text);
+                None
+            }
+        };
+        Self { ui_state, screen }
+    }
+}

app/examples/transcript.rs

@@ -0,0 +1,204 @@
+use ai_app::client::QuestionOption;
+use ai_app::client::transcript_fold::{QuestionCard, TranscriptItem, TranscriptRow as FoldedRow};
+use iris::prelude::*;
+
+fn main() {
+    DesktopApp::<Client>::run();
+}
+
+#[derive(DesktopUiState)]
+pub struct Client {
+    ui_state: DesktopUiState,
+    #[allow(dead_code)]
+    screen: ai_app::ui::TranscriptScreen,
+}
+
+fn msg(seq: u64, from_user: bool, text: &str) -> FoldedRow {
+    FoldedRow::Single(if from_user {
+        TranscriptItem::UserMsg {
+            seq,
+            text: text.to_string(),
+            attachments: Vec::new(),
+        }
+    } else {
+        TranscriptItem::AssistantMsg {
+            seq,
+            text: text.to_string(),
+            settled: true,
+        }
+    })
+}
+
+fn tool_call(id: &str, tool: &str, input: &str, result: Option<(&str, bool)>) -> TranscriptItem {
+    tool_call_in("run1", id, tool, input, result)
+}
+
+fn tool_call_in(
+    run: &str,
+    id: &str,
+    tool: &str,
+    input: &str,
+    result: Option<(&str, bool)>,
+) -> TranscriptItem {
+    TranscriptItem::ToolRun {
+        seq: 3,
+        id: id.into(),
+        run_id: run.into(),
+        tool: tool.into(),
+        input: input.into(),
+        output: result.map(|(out, _)| out.to_string()).unwrap_or_default(),
+        done: result.is_some(),
+        failed: result.is_some_and(|(_, failed)| failed),
+        asks: Vec::new(),
+        images: Vec::new(),
+    }
+}
+
+fn asking(id: &str, tool: &str, input: &str) -> TranscriptItem {
+    let mut call = tool_call_in("run2", id, tool, input, None);
+    if let TranscriptItem::ToolRun { asks, .. } = &mut call {
+        asks.push(QuestionCard {
+            seq: 9,
+            id: format!("{id}-q"),
+            prompt: "Allow this command?".into(),
+            header: None,
+            options: vec![
+                QuestionOption {
+                    label: "Allow".into(),
+                    description: None,
+                    preview: None,
+                },
+                QuestionOption {
+                    label: "Deny".into(),
+                    description: None,
+                    preview: None,
+                },
+            ],
+            multi_select: false,
+            answers: Vec::new(),
+        });
+    }
+    call
+}
+
+fn long_output() -> String {
+    (0..200)
+        .map(|i| format!("test ai_app::ui::case_{i} ... ok"))
+        .collect::<Vec<_>>()
+        .join("\n")
+}
+
+fn synthetic_rows() -> Vec<FoldedRow> {
+    vec![
+        msg(
+            1,
+            true,
+            "Can you show me a **bold** word, some *italic* text, and `inline code`?",
+        ),
+        msg(
+            2,
+            false,
+            "# Sure\n\nHere's a [link to the repo](https://example.com/ai-app-2) and a fenced block:\n\n```rust\nfn main() {\n    println!(\"hi\");\n}\n```",
+        ),
+        FoldedRow::Tools(vec![
+            tool_call(
+                "t1",
+                "Read",
+                r#"{"file_path": "src/main.rs"}"#,
+                Some(("fn main() {}\n", false)),
+            ),
+            tool_call(
+                "t2",
+                "Bash",
+                r#"{"command": "cargo build --release", "timeout": 480000, "description": "Build it"}"#,
+                Some((
+                    "error: could not compile `iris`\nCaused by: linker not found",
+                    true,
+                )),
+            ),
+            tool_call("t3", "Grep", r#"{"pattern": "fn fold_event"}"#, None),
+        ]),
+        FoldedRow::Single(tool_call(
+            "t5",
+            "Bash",
+            r#"{"command": "cargo test -p transcript-ui -- --nocapture"}"#,
+            Some((&long_output(), false)),
+        )),
+        msg(6, true, "Looks good, thanks!"),
+        msg(7, false, BLOCK_SAMPLER),
+    ]
+}
+
+const BLOCK_SAMPLER: &str = "\
+## What changed
+
+Iris **fold** render measure session window anchor context transcript \
+iris measure iris scroll call transcript layout *cursor* context, and a \
+[bench](https://example.com/bench) link.
+
+```rust
+fn fold_event(items: Vec<Item>, seq: u64) -> Vec<Item> {
+    let mut out = items;
+    out.push(Item::new(seq));
+    out
+}
+```
+
+| column | value |
+|---|---|
+| a | measure place draw tool call token context window anchor |
+
+- one bullet
+- another, with `inline code`
+    - nested one level
+1. first numbered
+2. second numbered
+
+> A quoted line, to show the bar and the indent.
+";
+
+impl DesktopAppState for Client {
+    fn new(mut ui_state: DesktopUiState, rsc: &mut StdRsc<Self>) -> Self {
+        let mut screen = ai_app::ui::build(rsc, &mut ui_state, synthetic_rows());
+        screen.push_row(
+            rsc,
+            &FoldedRow::Single(TranscriptItem::CommandRow {
+                seq: 8,
+                text: "clear".into(),
+            }),
+        );
+        screen.push_row(
+            rsc,
+            &FoldedRow::Tools(vec![
+                tool_call_in(
+                    "run2",
+                    "t6",
+                    "Read",
+                    r#"{"file_path": "docs/RUST.md"}"#,
+                    Some(("# Moving the app to Rust\n", false)),
+                ),
+                tool_call_in(
+                    "run2",
+                    "t7",
+                    "Bash",
+                    r#"{"command": "cargo clippy --workspace --all-targets"}"#,
+                    Some(("error: unused variable `x`", true)),
+                ),
+                tool_call_in("run2", "t8", "Glob", r#"{"pattern": "**/*.rs"}"#, None),
+                asking(
+                    "t9",
+                    "Bash",
+                    r#"{"command": "rm -rf target", "timeout": 120000, "description": "Clear the build"}"#,
+                ),
+            ]),
+        );
+        screen.set_session_working(rsc, true);
+        if std::env::var_os("IRIS_TOOLS_EXPANDED").is_some() {
+            assert!(
+                screen.expand_tail_tools(rsc, true),
+                "the newest row must be the tool run this flag is about"
+            );
+        }
+        Self { ui_state, screen }
+    }
+}

app/gradle.properties

@@ -1,7 +0,0 @@
-org.gradle.jvmargs=-Xmx2048M -Dfile.encoding=UTF-8
-org.gradle.parallel=true
-org.gradle.caching=true
-org.gradle.configuration-cache=true
-kotlin.code.style=official
-android.useAndroidX=true
-android.nonTransitiveRClass=true

app/gradle/libs.versions.toml

@@ -1,87 +0,0 @@
-# Latest stable versions as of 2026-08-28 (checked against Google Maven /
-# Maven Central; prereleases deliberately skipped). zxing-embedded checked
-# 2026-08-25.
-[versions]
-agp = "9.3.2"
-kotlin = "2.4.10"
-compose-multiplatform = "1.12.0"
-# material3 ships on its own release train, separate from the CMP version.
-compose-material3 = "1.9.0"
-androidx-activityCompose = "1.13.0"
-# Declared rather than inherited because this
-# code now calls its extensions directly (SharedPreferences.edit, String
-# .toUri), and a transitive it merely inherited could change under it.
-androidx-core-ktx = "1.19.0"
-zxing-embedded = "4.3.0"
-# Markdown rendering for assistant replies. The widely-used Compose
-# Multiplatform renderer; markdown is somebody else's specification and a
-# hand-written subset disagrees with it at the edges, one bug report at a
-# time.
-#
-# Read the version from `maven-metadata.xml`, not from the search API:
-# `search.maven.org/solrsearch` still answers 0.26.0 with 0.27.0 only as
-# release candidates, which is what pinned this nineteen releases behind
-# and cost us table support -- tables arrived in 0.30.0 and simply
-# rendered as run-together text until then.
-# https://repo1.maven.org/maven2/com/mikepenz/multiplatform-markdown-renderer-m3/maven-metadata.xml
-# Latest stable there, checked 2026-08-29.
-markdown-renderer = "0.45.0"
-# Syntax highlighting for a tool call's input. Same reasoning as the markdown
-# renderer: a language's lexical rules are somebody else's specification.
-# Latest stable, checked 2026-08-31 against Maven Central.
-highlights = "1.1.0"
-# The support ExifInterface rather than android.media's, which lint warns off:
-# the framework one is missing formats and the fixes for parsing hostile
-# images, and images here arrive from outside the phone. Latest stable,
-# checked 2026-08-31 against Google Maven.
-androidx-exifinterface = "1.4.2"
-# Declared rather than inherited for the same reason as core-ktx: SessionScreen
-# now calls repeatOnLifecycle/LocalLifecycleOwner directly, to hold the event
-# stream open only while the screen is on screen. Latest stable, checked
-# 2026-08-29 against Google Maven; activity-compose alone would have pulled
-# 2.9.4.
-androidx-lifecycle = "2.11.0"
-# The Kotlin formatter, run at its defaults (see CODE_RULES rule 27). ktfmt
-# itself is Kotlin-org owned and has almost nothing to configure, which is
-# the point; this is the Gradle wrapper for it. Checked 2026-08-28.
-ktfmt-gradle = "0.27.0"
-# Backports java.time (and more) to API 24, which UsageScreen needs: its
-# reset countdown is OffsetDateTime/Duration, both API 26. Checked
-# 2026-08-28 against Google Maven.
-desugar-jdk-libs = "2.1.5"
-
-[libraries]
-androidx-activity-compose = { module = "androidx.activity:activity-compose", version.ref = "androidx-activityCompose" }
-androidx-core-ktx = { module = "androidx.core:core-ktx", version.ref = "androidx-core-ktx" }
-androidx-lifecycle-runtime-compose = { module = "androidx.lifecycle:lifecycle-runtime-compose", version.ref = "androidx-lifecycle" }
-# In-app QR scanner: a ready-made scanning Activity (camera preview, runtime
-# permission prompt, flashlight toggle) reached through the AndroidX Activity
-# Result API (ScanContract, added in 4.3.0). Fully offline -- no Play
-# Services / ML Kit model download involved.
-zxing-embedded = { module = "com.journeyapps:zxing-android-embedded", version.ref = "zxing-embedded" }
-desugar-jdk-libs = { module = "com.android.tools:desugar_jdk_libs", version.ref = "desugar-jdk-libs" }
-# The -m3 flavour: it takes its colours and type from the ambient Material 3
-# theme, so the app's Catppuccin scheme is what it draws with.
-markdown-renderer = { module = "com.mikepenz:multiplatform-markdown-renderer-m3", version.ref = "markdown-renderer" }
-highlights = { module = "dev.snipme:highlights", version.ref = "highlights" }
-androidx-exifinterface = { module = "androidx.exifinterface:exifinterface", version.ref = "androidx-exifinterface" }
-# Declared directly rather than through the plugin's `compose.*` accessors,
-# which are deprecated as of CMP 1.11.
-compose-runtime = { module = "org.jetbrains.compose.runtime:runtime", version.ref = "compose-multiplatform" }
-# Names composables in a system trace, which is how a per-frame cost on the
-# phone gets attributed to a composable rather than to "Compose". Inert until
-# a trace is being recorded. Its own release train: 1.12.0 was the newest
-# stable on Google Maven on 2026-09-02.
-compose-runtime-tracing = { module = "androidx.compose.runtime:runtime-tracing", version = "1.12.0" }
-compose-foundation = { module = "org.jetbrains.compose.foundation:foundation", version.ref = "compose-multiplatform" }
-compose-material3 = { module = "org.jetbrains.compose.material3:material3", version.ref = "compose-material3" }
-compose-ui = { module = "org.jetbrains.compose.ui:ui", version.ref = "compose-multiplatform" }
-
-[plugins]
-androidApplication = { id = "com.android.application", version.ref = "agp" }
-# For the :link subproject (wg-app-link/app), which resolves its plugins
-# from the build including it rather than from its own catalog.
-androidLibrary = { id = "com.android.library", version.ref = "agp" }
-composeMultiplatform = { id = "org.jetbrains.compose", version.ref = "compose-multiplatform" }
-composeCompiler = { id = "org.jetbrains.kotlin.plugin.compose", version.ref = "kotlin" }
-ktfmt = { id = "com.ncorti.ktfmt.gradle", version.ref = "ktfmt-gradle" }

app/gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +0,0 @@
-distributionBase=GRADLE_USER_HOME
-distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.7.1-bin.zip
-networkTimeout=10000
-validateDistributionUrl=true
-zipStoreBase=GRADLE_USER_HOME
-zipStorePath=wrapper/dists

app/gradlew

@@ -1,248 +0,0 @@
-#!/bin/sh
-
-#
-# Copyright © 2015 the original authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-##############################################################################
-#
-#   gradlew start up script for POSIX generated by Gradle.
-#
-#   Important for running:
-#
-#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
-#       noncompliant, but you have some other compliant shell such as ksh or
-#       bash, then to run this script, type that shell name before the whole
-#       command line, like:
-#
-#           ksh gradlew
-#
-#       Busybox and similar reduced shells will NOT work, because this script
-#       requires all of these POSIX shell features:
-#         * functions;
-#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
-#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
-#         * compound commands having a testable exit status, especially «case»;
-#         * various built-in commands including «command», «set», and «ulimit».
-#
-#   Important for patching:
-#
-#   (2) This script targets any POSIX shell, so it avoids extensions provided
-#       by Bash, Ksh, etc; in particular arrays are avoided.
-#
-#       The "traditional" practice of packing multiple parameters into a
-#       space-separated string is a well documented source of bugs and security
-#       problems, so this is (mostly) avoided, by progressively accumulating
-#       options in "$@", and eventually passing that to Java.
-#
-#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
-#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
-#       see the in-line comments for details.
-#
-#       There are tweaks for specific operating systems such as AIX, CygWin,
-#       Darwin, MinGW, and NonStop.
-#
-#   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/3d91ce3b8caaf77ad09f381f43615b715b53f72c/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
-#       within the Gradle project.
-#
-#       You can find Gradle at https://github.com/gradle/gradle/.
-#
-##############################################################################
-
-# Attempt to set APP_HOME
-
-# Resolve links: $0 may be a link
-app_path=$0
-
-# Need this for daisy-chained symlinks.
-while
-    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
-    [ -h "$app_path" ]
-do
-    ls=$( ls -ld "$app_path" )
-    link=${ls#*' -> '}
-    case $link in             #(
-      /*)   app_path=$link ;; #(
-      *)    app_path=$APP_HOME$link ;;
-    esac
-done
-
-# This is normally unused
-# shellcheck disable=SC2034
-APP_BASE_NAME=${0##*/}
-# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
-APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
-
-# Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD=maximum
-
-warn () {
-    echo "$*"
-} >&2
-
-die () {
-    echo
-    echo "$*"
-    echo
-    exit 1
-} >&2
-
-# OS specific support (must be 'true' or 'false').
-cygwin=false
-msys=false
-darwin=false
-nonstop=false
-case "$( uname )" in                #(
-  CYGWIN* )         cygwin=true  ;; #(
-  Darwin* )         darwin=true  ;; #(
-  MSYS* | MINGW* )  msys=true    ;; #(
-  NONSTOP* )        nonstop=true ;;
-esac
-
-
-
-# Determine the Java command to use to start the JVM.
-if [ -n "$JAVA_HOME" ] ; then
-    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
-        # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD=$JAVA_HOME/jre/sh/java
-    else
-        JAVACMD=$JAVA_HOME/bin/java
-    fi
-    if [ ! -x "$JAVACMD" ] ; then
-        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
-
-Please set the JAVA_HOME variable in your environment to match the
-location of your Java installation."
-    fi
-else
-    JAVACMD=java
-    if ! command -v java >/dev/null 2>&1
-    then
-        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-
-Please set the JAVA_HOME variable in your environment to match the
-location of your Java installation."
-    fi
-fi
-
-# Increase the maximum file descriptors if we can.
-if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
-    case $MAX_FD in #(
-      max*)
-        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC2039,SC3045
-        MAX_FD=$( ulimit -H -n ) ||
-            warn "Could not query maximum file descriptor limit"
-    esac
-    case $MAX_FD in  #(
-      '' | soft) :;; #(
-      *)
-        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC2039,SC3045
-        ulimit -n "$MAX_FD" ||
-            warn "Could not set maximum file descriptor limit to $MAX_FD"
-    esac
-fi
-
-# Collect all arguments for the java command, stacking in reverse order:
-#   * args from the command line
-#   * the main class name
-#   * -classpath
-#   * -D...appname settings
-#   * --module-path (only if needed)
-#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
-
-# For Cygwin or MSYS, switch paths to Windows format before running java
-if "$cygwin" || "$msys" ; then
-    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
-
-    JAVACMD=$( cygpath --unix "$JAVACMD" )
-
-    # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    for arg do
-        if
-            case $arg in                                #(
-              -*)   false ;;                            # don't mess with options #(
-              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
-                    [ -e "$t" ] ;;                      #(
-              *)    false ;;
-            esac
-        then
-            arg=$( cygpath --path --ignore --mixed "$arg" )
-        fi
-        # Roll the args list around exactly as many times as the number of
-        # args, so each arg winds up back in the position where it started, but
-        # possibly modified.
-        #
-        # NB: a `for` loop captures its iteration list before it begins, so
-        # changing the positional parameters here affects neither the number of
-        # iterations, nor the values presented in `arg`.
-        shift                   # remove old arg
-        set -- "$@" "$arg"      # push replacement arg
-    done
-fi
-
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='-Dfile.encoding=UTF-8 "-Xmx64m" "-Xms64m"'
-
-# Collect all arguments for the java command:
-#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
-#     and any embedded shellness will be escaped.
-#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
-#     treated as '${Hostname}' itself on the command line.
-
-set -- \
-        "-Dorg.gradle.appname=$APP_BASE_NAME" \
-        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
-        "$@"
-
-# Stop when "xargs" is not available.
-if ! command -v xargs >/dev/null 2>&1
-then
-    die "xargs is not available"
-fi
-
-# Use "xargs" to parse quoted args.
-#
-# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
-#
-# In Bash we could simply go:
-#
-#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
-#   set -- "${ARGS[@]}" "$@"
-#
-# but POSIX shell has neither arrays nor command substitution, so instead we
-# post-process each arg (as a line of input to sed) to backslash-escape any
-# character that might be a shell metacharacter, then use eval to reverse
-# that process (while maintaining the separation between arguments), and wrap
-# the whole thing up as a single "set" statement.
-#
-# This will of course break if any of these variables contains a newline or
-# an unmatched quote.
-#
-
-eval "set -- $(
-        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
-        xargs -n1 |
-        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
-        tr '\n' ' '
-    )" '"$@"'
-
-exec "$JAVACMD" "$@"

app/gradlew.bat

@@ -1,82 +0,0 @@
-@rem
-@rem Copyright 2015 the original author or authors.
-@rem
-@rem Licensed under the Apache License, Version 2.0 (the "License");
-@rem you may not use this file except in compliance with the License.
-@rem You may obtain a copy of the License at
-@rem
-@rem      https://www.apache.org/licenses/LICENSE-2.0
-@rem
-@rem Unless required by applicable law or agreed to in writing, software
-@rem distributed under the License is distributed on an "AS IS" BASIS,
-@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-@rem See the License for the specific language governing permissions and
-@rem limitations under the License.
-@rem
-@rem SPDX-License-Identifier: Apache-2.0
-@rem
-
-@if "%DEBUG%"=="" @echo off
-@rem ##########################################################################
-@rem
-@rem  gradlew startup script for Windows
-@rem
-@rem ##########################################################################
-
-@rem Set local scope for the variables, and ensure extensions are enabled
-setlocal EnableExtensions
-
-set DIRNAME=%~dp0
-if "%DIRNAME%"=="" set DIRNAME=.
-@rem This is normally unused
-set APP_BASE_NAME=%~n0
-set APP_HOME=%DIRNAME%
-
-@rem Resolve any "." and ".." in APP_HOME to make it shorter.
-for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
-
-@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-set DEFAULT_JVM_OPTS=-Dfile.encoding=UTF-8 "-Xmx64m" "-Xms64m"
-
-@rem Find java.exe
-if defined JAVA_HOME goto findJavaFromJavaHome
-
-set JAVA_EXE=java.exe
-%JAVA_EXE% -version >NUL 2>&1
-if %ERRORLEVEL% equ 0 goto execute
-
-echo. 1>&2
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
-echo. 1>&2
-echo Please set the JAVA_HOME variable in your environment to match the 1>&2
-echo location of your Java installation. 1>&2
-
-"%COMSPEC%" /c exit 1
-
-:findJavaFromJavaHome
-set JAVA_HOME=%JAVA_HOME:"=%
-set JAVA_EXE=%JAVA_HOME%/bin/java.exe
-
-if exist "%JAVA_EXE%" goto execute
-
-echo. 1>&2
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
-echo. 1>&2
-echo Please set the JAVA_HOME variable in your environment to match the 1>&2
-echo location of your Java installation. 1>&2
-
-"%COMSPEC%" /c exit 1
-
-:execute
-@rem Setup the command line
-
-
-
-@rem Execute gradlew
-@rem endlocal doesn't take effect until after the line is parsed and variables are expanded
-@rem which allows us to clear the local environment before executing the java command
-endlocal & "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* & call :exitWithErrorLevel
-
-:exitWithErrorLevel
-@rem Use "%COMSPEC%" /c exit to allow operators to work properly in scripts
-"%COMSPEC%" /c exit %ERRORLEVEL%

app/run-android.sh

@@ -1,48 +0,0 @@
-#!/bin/sh
-# Builds this app and runs it on this checkout's emulator.
-#
-# The emulator half of this -- which AVD this checkout means, creating it,
-# booting it headless, and refusing to start one the machine has no room for
-# -- lives in ~/repos/emulator-tools and is shared with every other Android
-# checkout here. This script kept its own copy of that sequence until
-# 2026-08-30, as did dev-updater's and ai-app's, and three copies of "boot an
-# emulator" is three places for the memory check that was missing from all of
-# them.
-#
-# Environment setup (SDK location, PATH, ...) lives in ./android-env.sh,
-# which can also be sourced directly for one-off commands.
-set -eu
-
-APP_ID="com.example.aiapp"
-
-SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
-cd "$SCRIPT_DIR"
-
-# shellcheck source=./android-env.sh
-. ./android-env.sh
-
-if ! command -v emu >/dev/null 2>&1; then
-    echo "run-android.sh: no 'emu' command." >&2
-    echo "  It comes from ~/repos/emulator-tools; run that repo's ./install.sh." >&2
-    exit 127
-fi
-
-# Prints the serial, having created and booted the AVD if it had to. Named
-# after the checkout, so this cannot land on another session's emulator --
-# and refuses rather than starting one when the machine is short of memory,
-# because what an OOM kills is somebody else's work rather than the emulator
-# that asked for the memory.
-echo "==> Emulator"
-SERIAL=$(emu up)
-export ANDROID_SERIAL="$SERIAL"
-
-echo "==> Building debug APK"
-./gradlew :androidApp:assembleDebug
-
-APK="androidApp/build/outputs/apk/debug/androidApp-debug.apk"
-echo "==> Installing and launching $APK"
-# ANDROID_SERIAL above is what aims these; the adb wrapper would work it out
-# from the checkout anyway, but a script that says which device it means does
-# not depend on being run from the right directory.
-adb install -r "$APK"
-adb shell am start -n "$APP_ID/.MainActivity"

app/run-bench.sh

@@ -0,0 +1,90 @@
+#!/bin/sh
+# Installs and runs the iris `bench` build on this checkout's own emulator
+# (per this-machine-android's per-checkout-AVD rule; `emu serial` picks it)
+# and prints the report. No coordinates: the button is found by its
+# accessibility label through `ui-trace`.
+#
+# Usage: ./run-bench.sh [--apk PATH]
+#   Defaults to this checkout's own release APK
+#   (android-project/app/build/outputs/apk/release/app-release.apk) if it
+#   exists, else the
+#   debug one. Build it first with:
+#   ./build-apk.sh release --features "screens bench"
+set -eu
+cd "$(dirname "$0")"
+
+APK=""
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --apk) APK="$2"; shift 2 ;;
+        *) echo "run-bench.sh: unknown argument: $1" >&2; exit 1 ;;
+    esac
+done
+if [ -z "$APK" ]; then
+    if [ -f android-project/app/build/outputs/apk/release/app-release.apk ]; then
+        APK=android-project/app/build/outputs/apk/release/app-release.apk
+    else
+        APK=android-project/app/build/outputs/apk/debug/app-debug.apk
+    fi
+fi
+if [ ! -f "$APK" ]; then
+    echo "run-bench.sh: no APK at $APK -- run ./build-apk.sh first" >&2
+    exit 1
+fi
+
+SERIAL=$(emu serial)
+PKG=$(aapt2 dump badging "$APK" 2>/dev/null | sed -n "s/^package: name='\\([^']*\\)'.*/\\1/p")
+if [ -z "$PKG" ]; then
+    BUILD_TOOLS=$(ls -d "$HOME"/Android/Sdk/build-tools/*/ | sort -V | tail -1)
+    PKG=$("${BUILD_TOOLS}aapt2" dump badging "$APK" | sed -n "s/^package: name='\\([^']*\\)'.*/\\1/p")
+fi
+
+echo "run-bench.sh: installing $APK ($PKG) on $SERIAL"
+adb -s "$SERIAL" install -r "$APK" >/dev/null
+adb -s "$SERIAL" shell am force-stop "$PKG"
+adb -s "$SERIAL" logcat -c
+adb -s "$SERIAL" shell am start -n "$PKG/dev.iris.android.demo.MainActivity" >/dev/null
+
+ui-trace record -s "$SERIAL" -d 3000 --do "tap 'Run benchmark'" -o /tmp/run-bench-tap.txt >/dev/null
+
+# Which adapter drew, before any number is printed. The emulator is a GLES
+# machine -- its guest has no hardware Vulkan (docs/RUST.md, "What the
+# emulator gives a GPU app") -- so iris's runtime fallback lands on `Gl`,
+# and `Gl (... virgl ...)` is the host's real GPU while `Gl (...
+# SwiftShader ...)` is the CPU. Those two produce frame times an order of
+# magnitude apart and are otherwise indistinguishable in this report, so
+# the line is printed rather than left in logcat for somebody to think of.
+ADAPTER=$(adb -s "$SERIAL" logcat -d -s iris-android-app:I 2>/dev/null \
+    | sed -n 's/.*\(iris renderer: .*\)/\1/p' | tail -1)
+if [ -n "$ADAPTER" ]; then
+    echo "run-bench.sh: $ADAPTER"
+else
+    echo "run-bench.sh: no 'iris renderer:' line in logcat -- cannot say what drew this run" >&2
+fi
+
+# Poll for the report line rather than a fixed sleep -- the run itself is
+# a fixed script (RUST.md's "Benchmark v2": 16 flings, a 20s streaming
+# phase, ~61s of typing, 10s of keyboard toggles, roughly 2.5 minutes end
+# to end) but device speed varies. 260s cap rather than v1's 90s -- v2 is
+# a longer script than v1's swipe-loop-only run.
+# The report's own first line, not the bare "iris bench report:" prefix:
+# `copy_report` logs that prefix too ("nothing to copy -- run the benchmark
+# first", which the app emits at startup), so polling for the prefix
+# returned instantly and the script printed a report that was never run.
+REPORT_LINE="iris bench report: iris bench report"
+i=0
+while [ "$i" -lt 260 ]; do
+    LINE=$(adb -s "$SERIAL" logcat -d -s iris-android-app:I 2>/dev/null | grep "$REPORT_LINE" || true)
+    if [ -n "$LINE" ]; then
+        break
+    fi
+    i=$((i + 1))
+    sleep 1
+done
+if [ -z "$LINE" ]; then
+    echo "run-bench.sh: no report after 260s -- check logcat by hand" >&2
+    exit 1
+fi
+# -A 60 rather than v1's -A 6 -- v2's report has a per-phase block (four
+# phases, four lines each) on top of the frames/bench sections v1 had.
+adb -s "$SERIAL" logcat -d -s iris-android-app:I | grep -A 60 "$REPORT_LINE"

app/rust-toolchain.toml

@@ -0,0 +1,4 @@
+[toolchain]
+channel = "nightly"
+components = ["clippy", "rustfmt"]
+targets = ["aarch64-linux-android", "x86_64-linux-android"]

app/settings.gradle.kts

@@ -1,25 +0,0 @@
-rootProject.name = "AiApp"
-
-pluginManagement {
-    repositories {
-        google()
-        gradlePluginPortal()
-        mavenCentral()
-    }
-}
-
-dependencyResolutionManagement {
-    repositories {
-        google()
-        mavenCentral()
-    }
-}
-
-include(":androidApp")
-
-// The app half of wg-app-link, resolved by path through the submodule so
-// this checkout and the crate it consumes move together -- the same
-// arrangement `server/` uses for the Rust half. See that repo's README.
-include(":link")
-
-project(":link").projectDir = file("../wg-app-link/app")

app/src/android/app_log.rs

@@ -0,0 +1,101 @@
+//! The platform half of this app's logging: what
+//! `crate::client::log_ring` needs that only Android can supply, which is
+//! `android_logger` as the logger to forward to and nothing else.
+
+use crate::client::log_ring::{self, LogRing};
+use std::{
+    fs, panic,
+    path::{Path, PathBuf},
+    sync::OnceLock,
+};
+
+/// Installs the in-process ring in front of Android's logger.
+pub fn install(max_level: log::LevelFilter) {
+    let inner = android_logger::AndroidLogger::new(
+        android_logger::Config::default()
+            .with_max_level(max_level)
+            .with_tag("iris-android-app"),
+    );
+    if log_ring::install_process_logger(
+        Box::new(inner),
+        max_level,
+        iris::diagnostics::trace_enabled,
+    )
+    .is_err()
+    {
+        log::warn!("iris app log: a logger was already installed, so there is no ring");
+    }
+    install_panic_hook();
+}
+
+pub fn ring() -> &'static LogRing {
+    log_ring::process_ring()
+}
+
+#[cfg(feature = "bench")]
+pub fn diagnostics_line() -> String {
+    let where_to_read = match crate::android::devlog::authority() {
+        Some(authority) => format!("devlog provider: content://{authority}"),
+        None => "devlog provider: declared, not created yet".to_string(),
+    };
+    format!("{}\n{where_to_read}", ring().summary())
+}
+
+/// Where the panic hook leaves its report, under the app's private
+/// directory. Read back and dropped by [`set_crash_dir`] on the next
+/// start.
+const CRASH_FILE: &str = "last-panic.txt";
+
+/// Enough preceding log lines to explain a crash without evicting the next run.
+const CRASH_CONTEXT_LINES: usize = 80;
+
+const PREVIOUS_RUN_TARGET: &str = "previous_run";
+
+static CRASH_PATH: OnceLock<PathBuf> = OnceLock::new();
+
+/// Copies aborting panics into the device-readable log ring.
+fn install_panic_hook() {
+    let previous = panic::take_hook();
+    panic::set_hook(Box::new(move |info| {
+        let where_at = match info.location() {
+            Some(at) => format!("{}:{}:{}", at.file(), at.line(), at.column()),
+            None => "an unknown location".to_string(),
+        };
+        let message = info.payload_as_str().unwrap_or("Box<dyn Any>");
+        let line = format!("iris panic at {where_at}: {message}");
+        log::error!("{line}");
+        if let Some(path) = CRASH_PATH.get() {
+            let context = ring()
+                .try_tail_text(CRASH_CONTEXT_LINES)
+                .unwrap_or_else(|| {
+                    "(the log ring was locked as this run died; no context)".to_string()
+                });
+            let _ = fs::write(path, format!("{line}\n{context}"));
+        }
+        previous(info);
+    }));
+}
+
+/// Configures crash persistence and replays a report left by the previous run.
+pub fn set_crash_dir(dir: &Path) {
+    let path = dir.join(CRASH_FILE);
+    if let Ok(previous) = fs::read_to_string(&path) {
+        // Delete first so a panic during replay cannot create a replay loop.
+        let _ = fs::remove_file(&path);
+        replay_crash(&previous);
+    }
+    let _ = CRASH_PATH.set(path);
+}
+
+/// Puts a previous run's report back in the ring: its context lines in
+/// the order they happened, then the panic itself.
+fn replay_crash(report: &str) {
+    let (panic_line, context) = report.split_once('\n').unwrap_or((report, ""));
+    for line in context.lines().filter(|line| !line.is_empty()) {
+        ring().push(log::Level::Info, PREVIOUS_RUN_TARGET, line.to_string());
+    }
+    log::error!(
+        "iris app log: the previous run died -- {}",
+        panic_line.trim()
+    );
+}

app/src/android/bench_client.rs

@@ -0,0 +1,841 @@
+use crate::android::bench_jni::PlatformHandle;
+use crate::client::transcript_fold::{TranscriptItem, fold_event};
+use crate::ui::{self, TranscriptScreen};
+use android_view::jni::{JavaVM, objects::GlobalRef};
+use event_model::SeqEvent;
+use iris::android::{AndroidAppState, AndroidUiState};
+use iris::prelude::*;
+use std::{
+    fs, mem,
+    sync::{
+        Arc, Mutex,
+        atomic::{AtomicBool, Ordering},
+        mpsc,
+    },
+    time::{Duration, Instant},
+};
+
+const STREAM_EVENTS_PER_SEC: u64 = 20;
+const STREAM_SECONDS: u64 = 20;
+
+const LEGACY_CYCLES: usize = 6;
+
+const FLING_VELOCITY_PX_S: f32 = 12_000.0;
+const FLING_COUNT: usize = 8;
+const FLING_SETTLE_CAP_MS: u64 = 3_000;
+const FLING_PAUSE_MS: u64 = 300;
+
+const TYPE_TEXT: &str = "Benchmarking this transcript screen requires unusually long, \
+multisyllabic words so wrapping and reflow are properly exercised: internationalization, \
+counterproductiveness, disproportionately, incomprehensibility, deinstitutionalization, \
+uncharacteristically, overenthusiastically, misunderstanding, straightforwardness, \
+telecommunications, and interdisciplinary collaboration all push a narrow composer field to \
+wrap across several lines while the transcript above is pushed upward by the growing \
+keyboard-adjacent box, which is exactly what a real reader typing a long message sees \
+happening now!!!";
+const TYPE_CHAR_MS: u64 = 50;
+
+const KEYBOARD_CYCLES: usize = 5;
+const KEYBOARD_WAIT_MS: u64 = 1_000;
+
+const POLL_MS: u64 = 16;
+
+const REPORT_MAX_HEIGHT_DP: f32 = 260.0;
+
+#[derive(AndroidUiState)]
+pub struct BenchClient {
+    ui_state: AndroidUiState,
+    content: WeakWidget<WidgetPtr>,
+    report_display: WeakWidget<TextEdit>,
+    top_bar: WeakWidget<WidgetPtr>,
+    screen: Option<TranscriptScreen>,
+    items: Vec<TranscriptItem>,
+    stream_tail: Vec<SeqEvent>,
+    platform: Option<Arc<PlatformHandle>>,
+    last_report: Option<String>,
+    running: bool,
+    ime_state: Arc<Mutex<ImeState>>,
+    keyboard_was_visible: bool,
+    last_top_pad: f32,
+}
+
+#[derive(Default)]
+struct ImeState {
+    visible: bool,
+    shown_events: u32,
+    hidden_events: u32,
+}
+
+fn placeholder<Rsc: HasEvents>(rsc: &mut Rsc, message: &str) -> StrongWidget {
+    wtext(message.to_string())
+        .color(PaintId::WHITE)
+        .overflow(TextOverflow::Wrap)
+        .pad(16)
+        .add_strong(rsc)
+        .any()
+}
+
+fn process_cpu_ms() -> Option<u64> {
+    // SAFETY: `rusage` is a plain-old-data struct `getrusage` fully
+    // initialises on success; on failure it is never read.
+    unsafe {
+        let mut usage: libc::rusage = mem::zeroed();
+        if libc::getrusage(libc::RUSAGE_SELF, &mut usage) != 0 {
+            return None;
+        }
+        let user_ms = usage.ru_utime.tv_sec as u64 * 1000 + usage.ru_utime.tv_usec as u64 / 1000;
+        let sys_ms = usage.ru_stime.tv_sec as u64 * 1000 + usage.ru_stime.tv_usec as u64 / 1000;
+        Some(user_ms + sys_ms)
+    }
+}
+
+fn peak_rss_kb() -> Option<u64> {
+    fs::read_to_string("/proc/self/status")
+        .ok()?
+        .lines()
+        .find_map(|line| line.strip_prefix("VmHWM:"))
+        .and_then(|rest| rest.trim().strip_suffix("kB"))
+        .and_then(|n| n.trim().parse().ok())
+}
+
+fn battery_line(samples: &[i32]) -> String {
+    if samples.is_empty() {
+        return "  battery current: unavailable on this device".to_string();
+    }
+    let mean = samples.iter().map(|&v| v as i64).sum::<i64>() / samples.len() as i64;
+    let (Some(min), Some(max)) = (samples.iter().min(), samples.iter().max()) else {
+        unreachable!("samples is non-empty, checked above");
+    };
+    format!(
+        "  battery current: mean {mean}\u{b5}A over {} samples (min {min}, max {max})",
+        samples.len()
+    )
+}
+
+impl BenchClient {
+    pub(super) fn new(mut ui_state: AndroidUiState, rsc: &mut StdRsc<Self>) -> Self {
+        crate::ui::register_fonts(&mut rsc.ui);
+        let content = WidgetPtr::new().add(rsc);
+        let loading = placeholder(rsc, "Loading fixture...");
+        content(rsc).set(loading);
+
+        let report_display = wtext("")
+            .editable(EditMode::MultiLine)
+            .text_align(Align::LEFT)
+            .overflow(TextOverflow::Wrap)
+            .size(14)
+            .color(PaintId::WHITE)
+            .attr::<Selectable>(())
+            .label("Benchmark report")
+            .add(rsc);
+
+        let top_bar = WidgetPtr::new().add(rsc);
+        let controls = bench_controls(rsc, 0.0);
+        top_bar(rsc).set(controls);
+        let tree = (
+            top_bar,
+            report_display
+                .pad(dp(8))
+                .max_height(dp(REPORT_MAX_HEIGHT_DP)),
+            content.height(rest(1)),
+        )
+            .span(Dir::DOWN)
+            .add_strong(rsc)
+            .any();
+        ui_state.set_root(rsc, tree);
+
+        let font = rsc.ui.text.borrow_mut().font_diagnostics();
+        log::info!(
+            "iris fonts: {} families found, default={:?} mono={:?}, resolved regular={:?} \
+             bold={:?} italic={:?} mono={:?}",
+            font.families_found,
+            font.default_family,
+            font.default_mono_family,
+            font.regular_resolved,
+            font.bold_resolved,
+            font.italic_resolved,
+            font.mono_resolved,
+        );
+
+        let mut client = Self {
+            ui_state,
+            content,
+            report_display,
+            top_bar,
+            screen: None,
+            items: Vec::new(),
+            stream_tail: Vec::new(),
+            platform: None,
+            last_report: None,
+            running: false,
+            ime_state: Arc::new(Mutex::new(ImeState::default())),
+            keyboard_was_visible: false,
+            last_top_pad: 0.0,
+        };
+
+        match ui::fixture::build_screen(rsc) {
+            Ok((opened, tree)) => {
+                client.items = opened.items;
+                client.stream_tail = opened.stream_tail;
+                (client.content)(rsc).set(tree);
+                client.screen = Some(opened.screen);
+            }
+            Err(message) => {
+                client.show_message(rsc, &format!("Couldn't fold the bench fixture: {message}"))
+            }
+        }
+        client
+    }
+}
+
+impl AndroidAppState for BenchClient {
+    type Resources = StdRsc<Self>;
+
+    fn platform_ready(&mut self, _rsc: &mut Self::Resources, vm: JavaVM, view: GlobalRef) {
+        self.platform = Some(Arc::new(PlatformHandle::new(vm, view)));
+    }
+
+    fn back_pressed(&mut self, _rsc: &mut Self::Resources) -> bool {
+        false
+    }
+
+    fn on_insets_changed(
+        &mut self,
+        rsc: &mut Self::Resources,
+        insets: iris::android::WindowInsets,
+    ) {
+        if insets.top != self.last_top_pad {
+            self.last_top_pad = insets.top;
+            let controls = bench_controls(rsc, insets.top);
+            (self.top_bar)(rsc).set(controls);
+        }
+
+        if let Some(screen) = &self.screen {
+            screen
+                .composer
+                .set_bottom_inset(rsc, insets.bottom.max(insets.ime_bottom));
+        }
+
+        // The platform's own answer, not `ime_bottom > 0.0` -- see
+        // `iris::android::WindowInsets::ime_bottom`. The height is still
+        // climbing while the keyboard slides in, so a frame or two of a
+        // real opening reads as "closed" when the boolean is inferred from
+        // it, and `shown_events`/`hidden_events` below count transitions.
+        let ime_visible = insets.ime_visible;
+
+        let mut ime = self.ime_state.lock().unwrap();
+        if ime_visible && !ime.visible {
+            ime.shown_events += 1;
+        }
+        if !ime_visible && ime.visible {
+            ime.hidden_events += 1;
+        }
+        ime.visible = ime_visible;
+        drop(ime);
+
+        if ime_visible && !self.keyboard_was_visible {
+            self.keyboard_was_visible = true;
+            rsc.spawn_task(async move |mut ctx| {
+                tokio::time::sleep(Duration::from_millis(KEYBOARD_DIAGNOSTICS_DELAY_MS)).await;
+                ctx.update(|state: &mut BenchClient, rsc| {
+                    state.capture_keyboard_diagnostics(rsc);
+                });
+            });
+        } else if !ime_visible {
+            self.keyboard_was_visible = false;
+        }
+    }
+}
+
+const KEYBOARD_DIAGNOSTICS_DELAY_MS: u64 = 500;
+
+type Rsc = StdRsc<BenchClient>;
+
+/// What a report says about the `iris::input`/`iris::frame` trace, from
+/// the flag read at the start of what is being reported and again at the
+/// end.
+///
+/// Three answers rather than two. Those lines are default-off and the
+/// switch that turns them on is on screen while a benchmark runs, so
+/// "somebody moved it half way through" is a state that actually happens
+/// -- and reported as either "on" or "off" it is a confident sentence
+/// about a log that only covers part of the run. The "on" wording also
+/// says what it costs, because a traced run fills the ring in seconds and
+/// a reader looking at a log with nothing else in it should know why.
+fn trace_line(at_start: bool, at_end: bool) -> String {
+    match (at_start, at_end) {
+        (true, true) => "input/frame trace: on (iris::input and iris::frame lines are in \
+                         the app log, and a traced run fills the ring in seconds)"
+            .to_string(),
+        (false, false) => "input/frame trace: off".to_string(),
+        _ => "input/frame trace: switched during this run, so those lines cover only part \
+              of it"
+            .to_string(),
+    }
+}
+
+/// The header row's own backdrop -- see `bench_controls`'s doc comment on
+/// why it needs one at all. A dark neutral rather than pure black
+/// (`android::render::CLEAR_COLOR`) so the row reads as a distinct panel
+/// instead of a hole in the background the buttons happen to float in.
+const HEADER_SURFACE: Srgba8 = Srgba8::new(28, 28, 34, 255);
+
+/// `top_pad` is the status-bar inset in physical pixels (0.0 until
+/// `on_insets_changed` has run once) -- folded in here, rather than
+/// exposing the unadded builder for a caller to `.pad()` itself, because
+/// naming that builder's type at each call site is more machinery than a
+/// top-of-screen padding number is worth.
+const HEADER_TEXT: f32 = 18.0;
+
+const HEADER_ROW_HEIGHT_DP: f32 = 56.0;
+
+fn bench_controls(rsc: &mut Rsc, top_pad: f32) -> StrongWidget {
+    let run_rect = rect(Srgba8::rgb(40, 70, 40))
+        .on(
+            CursorSense::click(),
+            |ctx: EventIdCtx<'_, Rsc, _, _>, rsc: &mut Rsc| {
+                ctx.state.start_benchmark(rsc);
+            },
+        )
+        .label("Run benchmark");
+    let run = (
+        run_rect,
+        wtext("Run benchmark")
+            .size(HEADER_TEXT)
+            .text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(dp(8))
+        .add(rsc);
+
+    let copy_rect = rect(Srgba8::rgb(50, 50, 60))
+        .on(
+            CursorSense::click(),
+            |ctx: EventIdCtx<'_, Rsc, _, _>, rsc: &mut Rsc| {
+                ctx.state.copy_report(rsc);
+            },
+        )
+        .label("Copy report");
+    let copy = (
+        copy_rect,
+        wtext("Copy report")
+            .size(HEADER_TEXT)
+            .text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(dp(8))
+        .add(rsc);
+
+    let diag_rect = rect(Srgba8::rgb(60, 45, 70))
+        .on(
+            CursorSense::click(),
+            |ctx: EventIdCtx<'_, Rsc, _, _>, rsc: &mut Rsc| {
+                ctx.state.show_diagnostics(rsc);
+            },
+        )
+        .label("Diagnostics");
+    let diagnostics = (
+        diag_rect,
+        wtext("Diagnostics")
+            .size(HEADER_TEXT)
+            .text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(dp(8))
+        .add(rsc);
+
+    // A switch rather than a button, so its own appearance says which
+    // state it is in: the two `iris::input`/`iris::frame` targets are
+    // default-off (`iris::diagnostics`'s module doc) because a 120Hz
+    // session fills the 2000-line ring in seconds, so "is it on right
+    // now" is the question somebody has while looking at a log that is
+    // either full of trace or has none.
+    let tracing = iris::diagnostics::trace_enabled();
+    let trace_rect = rect(if tracing {
+        Srgba8::rgb(90, 70, 30)
+    } else {
+        Srgba8::rgb(50, 50, 60)
+    })
+    .on(
+        CursorSense::click(),
+        |ctx: EventIdCtx<'_, Rsc, _, _>, rsc: &mut Rsc| {
+            ctx.state.toggle_trace(rsc);
+        },
+    )
+    .label("Trace input and frames");
+    let trace = (
+        trace_rect,
+        wtext(if tracing { "Trace on" } else { "Trace off" })
+            .size(HEADER_TEXT)
+            .text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(dp(8))
+        .add(rsc);
+
+    let row1 = (run, copy).span(Dir::RIGHT).add(rsc);
+    let row2 = (diagnostics, trace).span(Dir::RIGHT).add(rsc);
+    let buttons = (row1, row2).span(Dir::DOWN).add(rsc);
+
+    (rect(HEADER_SURFACE), buttons)
+        .stack()
+        .height(dp(2.0 * HEADER_ROW_HEIGHT_DP))
+        .pad(Padding::top(top_pad))
+        .add_strong(rsc)
+        .any()
+}
+
+impl BenchClient {
+    fn show_message(&mut self, rsc: &mut Rsc, message: &str) {
+        let widget = placeholder(rsc, message);
+        (self.content)(rsc).set(widget);
+        self.screen = None;
+    }
+
+    fn rebuild_transcript(&mut self, rsc: &mut Rsc) {
+        let (screen, tree) = ui::build_tree(rsc, ui::fixture::rows(&self.items));
+        (self.content)(rsc).set(tree);
+        self.screen = Some(screen);
+    }
+
+    fn show_diagnostics(&mut self, rsc: &mut Rsc) {
+        let report = self.diagnostics_text(rsc);
+        self.report_display(rsc).set(&report);
+        self.last_report = Some(report);
+    }
+
+    /// Turns the `iris::input`/`iris::frame` trace on or off, redraws the
+    /// switch that says so, and shows the pane that now reports it.
+    fn toggle_trace(&mut self, rsc: &mut Rsc) {
+        let on = !iris::diagnostics::trace_enabled();
+        iris::diagnostics::set_trace(on);
+        log::info!(
+            "iris diagnostics: input/frame trace {}",
+            if on { "on" } else { "off" }
+        );
+        let controls = bench_controls(rsc, self.last_top_pad);
+        (self.top_bar)(rsc).set(controls);
+        self.show_diagnostics(rsc);
+    }
+
+    /// The diagnostics report as text, with no side effect on what is on
+    /// screen -- shared by the `Diagnostics` button (which shows it) and
+    /// the keyboard-open capture (which only logs it), so the two can
+    /// never drift into reporting different things.
+    fn diagnostics_text(&self, rsc: &mut Rsc) -> String {
+        let font = rsc.ui.text.borrow_mut().font_diagnostics();
+        let frame_report = match self.android_state().frame_report.report() {
+            Some(stats) => format!("{stats}"),
+            None => "no frames recorded yet".to_string(),
+        };
+        let renderer = match &self.android_state().renderer {
+            Some(renderer) => renderer.diagnostics_report(&font, &frame_report),
+            None => "iris diagnostics: no renderer yet (no surface)".to_string(),
+        };
+        // Insets must be visible without adb so a missing callback can be
+        // distinguished from a callback reporting zero IME height.
+        format!(
+            "{renderer}\n{}\n{}\n{}\n{}",
+            trace_line(
+                iris::diagnostics::trace_enabled(),
+                iris::diagnostics::trace_enabled()
+            ),
+            self.android_state().insets_report(),
+            // Which server this build talks to, and what to do when the
+            // answer is "none" -- the bench itself opens a checked-in
+            // fixture and needs no server, so this pane is the only place
+            // an enrolment can be seen to have taken.
+            crate::android::enrollment::status_line(),
+            crate::android::app_log::diagnostics_line()
+        )
+    }
+
+    fn capture_keyboard_diagnostics(&mut self, rsc: &mut Rsc) {
+        let report = self.diagnostics_text(rsc);
+        log::info!("iris keyboard diagnostics:\n{report}");
+    }
+
+    fn copy_report(&mut self, rsc: &mut Rsc) {
+        let Some(platform) = &self.platform else {
+            log::info!("iris bench report: no platform handle, can't reach the clipboard");
+            return;
+        };
+        let report = match self.last_report.clone() {
+            Some(report) => report,
+            None => format!(
+                "no benchmark has run yet -- these are the diagnostics instead:\n\n{}",
+                self.diagnostics_text(rsc)
+            ),
+        };
+        if platform.copy_to_clipboard("iris bench report", &report) {
+            log::info!("iris bench report: copied to clipboard");
+        } else {
+            log::info!("iris bench report: clipboard copy failed");
+        }
+    }
+
+    fn start_benchmark(&mut self, rsc: &mut Rsc) {
+        if self.running {
+            log::info!("iris bench report: already running");
+            return;
+        }
+        self.running = true;
+        self.android_state_mut().frame_report.reset();
+        self.report_display(rsc).set("Running benchmark...");
+
+        let platform = self.platform.clone();
+        let stream_tail = self.stream_tail.clone();
+        let ime_state = self.ime_state.clone();
+        let platform_hz = platform.as_ref().and_then(|p| p.refresh_rate_hz());
+        let cpu_start = process_cpu_ms();
+        // Read at the start as well as the end, because the switch is on
+        // screen while a run is going: a report that only asked afterwards
+        // would say "on" about a run whose first half has no trace in it
+        // -- the inferred answer presented as the measured one.
+        let trace_at_start = iris::diagnostics::trace_enabled();
+        let run_started_at = Instant::now();
+
+        rsc.spawn_task(async move |mut ctx| {
+            // The battery sampler runs for the whole run, once a second,
+            // the benchmark's established battery-sampling cadence
+            // -- via its own JNI-attached thread, not `ctx.update`, since
+            // a sample needs no widget-tree access.
+            let sampler_done = Arc::new(AtomicBool::new(false));
+            let samples = Arc::new(Mutex::new(Vec::<i32>::new()));
+            let sampler = platform.clone().map(|platform| {
+                let done = sampler_done.clone();
+                let samples = samples.clone();
+                tokio::spawn(async move {
+                    while !done.load(Ordering::Relaxed) {
+                        if let Some(value) = platform.battery_current_ua() {
+                            samples.lock().unwrap().push(value);
+                        }
+                        tokio::time::sleep(Duration::from_secs(1)).await;
+                    }
+                })
+            });
+
+            let travel = run_fling_phase(&mut ctx).await;
+            let (sent, total) = run_stream_phase(&mut ctx, stream_tail).await;
+            run_type_phase(&mut ctx, &platform).await;
+            let keyboard = run_keyboard_phase(&mut ctx, &platform, &ime_state).await;
+
+            sampler_done.store(true, Ordering::Relaxed);
+            if let Some(sampler) = sampler {
+                let _ = sampler.await;
+            }
+            let battery = battery_line(&samples.lock().unwrap());
+            let cpu_line = match (cpu_start, process_cpu_ms()) {
+                (Some(start), Some(end)) => {
+                    format!(
+                        "  process CPU time over this run: {}ms",
+                        end.saturating_sub(start)
+                    )
+                }
+                _ => "  process CPU time over this run: unavailable".to_string(),
+            };
+            let rss_line = match peak_rss_kb() {
+                Some(kb) => format!("  peak RSS: {kb}kB"),
+                None => "  peak RSS: unavailable (/proc/self/status unreadable)".to_string(),
+            };
+            let total_seconds = run_started_at.elapsed().as_secs_f64();
+
+            ctx.update(move |state: &mut BenchClient, rsc| {
+                state.running = false;
+                let now = Instant::now();
+                let drawn_hz = state.android_state().frame_report.sustained_frame_hz();
+                let refresh_hz = match (drawn_hz, platform_hz) {
+                    (Some(d), Some(p)) => d.max(p),
+                    (Some(d), None) => d,
+                    (None, Some(p)) => p,
+                    (None, None) => 60.0,
+                };
+                let hz_line = match (drawn_hz, platform_hz) {
+                    (Some(d), Some(p)) if d > p + 5.0 => format!(
+                        " (sustained {d:.0}fps, so at least that; the display reported {p:.0}Hz)"
+                    ),
+                    (Some(d), Some(_)) => format!(" (as the display reports it; drew {d:.0}fps)"),
+                    (Some(d), None) => {
+                        format!(" (sustained {d:.0}fps; the display would not say)")
+                    }
+                    (None, Some(_)) => {
+                        " (as the display reports it; too few frames to measure)".to_string()
+                    }
+                    (None, None) => " (assumed -- neither measured nor reported)".to_string(),
+                };
+                let phase_lines: String = state
+                    .android_state()
+                    .frame_report
+                    .phase_stats(now, refresh_hz)
+                    .iter()
+                    .map(|p| format!("{p}\n"))
+                    .collect();
+                let per_phase = if phase_lines.is_empty() {
+                    String::new()
+                } else {
+                    format!("per phase:\n{phase_lines}\n")
+                };
+                let frames_block = match state.android_state().frame_report.report() {
+                    Some(stats) => {
+                        let (late, late_pct) =
+                            state.android_state().frame_report.late_at_hz(refresh_hz);
+                        format!(
+                            "frames:\n  {} frames over {:.1}s at {:.0}Hz{hz_line} ({:.1}ms \
+                             budget)\n  \
+                             late: {late} ({late_pct:.1}%)\n  total  p50 {:.1}ms  p90 {:.1}ms  \
+                             p99 {:.1}ms\n  worst {:.1}ms\n  build_p50 {:.1}ms  acquire_p50 \
+                             {:.1}ms  submit_p50 {:.1}ms",
+                            stats.total_frames,
+                            total_seconds,
+                            refresh_hz,
+                            1000.0 / refresh_hz as f64,
+                            stats.p50.as_secs_f64() * 1000.0,
+                            stats.p90.as_secs_f64() * 1000.0,
+                            stats.p99.as_secs_f64() * 1000.0,
+                            stats.worst.as_secs_f64() * 1000.0,
+                            stats.cpu_p50.as_secs_f64() * 1000.0,
+                            stats.acquire_p50.as_secs_f64() * 1000.0,
+                            stats.gpu_wait_p50.as_secs_f64() * 1000.0,
+                        )
+                    }
+                    None => "frames:\n  no frames recorded".to_string(),
+                };
+                let scroll_line = format!(
+                    "  scroll: {LEGACY_CYCLES} cycles ({} swipes, legacy tween), streamed \
+                     {sent}/{total} fixture events",
+                    LEGACY_CYCLES * 4
+                );
+                let fling_line = format!(
+                    "  fling: {FLING_COUNT} flings out + {FLING_COUNT} back at \
+                     {FLING_VELOCITY_PX_S}px/s, travel {travel}"
+                );
+                let type_line = format!(
+                    "  type: {} characters inserted then deleted, one per {TYPE_CHAR_MS}ms",
+                    TYPE_TEXT.chars().count()
+                );
+                let traced = trace_line(trace_at_start, iris::diagnostics::trace_enabled());
+                let report = format!(
+                    "iris bench report\n{traced}\n{per_phase}{frames_block}\n\nbench:\n\
+                     {fling_line}\n{scroll_line}\n{type_line}\n{keyboard}\n{cpu_line}\n\
+                     {rss_line}\n{battery}"
+                );
+                log::info!("iris bench report: {report}");
+                state.report_display(rsc).set(&report);
+                state.last_report = Some(report);
+            });
+        });
+    }
+}
+
+/// Runs `f` against the real `BenchClient`/`Rsc` on the main thread (the
+/// same `ctx.update` every other mutation here goes through) and returns
+/// its result to the caller's async task. `ctx.update` wakes the UI thread,
+/// whose task callback drains Iris's update queue before checking whether the
+/// retained widget tree needs another frame.
+/// Polls rather than assuming one `POLL_MS` sleep is enough, since a
+/// slow device's frame callback can lag further than that.
+async fn read_from_state<T, F>(ctx: &mut iris::task::TaskCtx<Rsc>, f: F) -> T
+where
+    T: Send + 'static,
+    F: FnOnce(&mut BenchClient, &mut Rsc) -> T + Send + 'static,
+{
+    let (tx, rx) = mpsc::channel();
+    ctx.update(move |state: &mut BenchClient, rsc| {
+        let _ = tx.send(f(state, rsc));
+    });
+    loop {
+        if let Ok(value) = rx.try_recv() {
+            return value;
+        }
+        tokio::time::sleep(Duration::from_millis(POLL_MS)).await;
+    }
+}
+
+async fn run_fling_phase(ctx: &mut iris::task::TaskCtx<Rsc>) -> String {
+    ctx.update(|state: &mut BenchClient, _rsc| {
+        state.android_state_mut().frame_report.mark_phase("fling");
+    });
+    ctx.update(|state: &mut BenchClient, rsc| {
+        if let Some(screen) = &state.screen {
+            (screen.list)(rsc).jump_to_end();
+        }
+    });
+    // Lets the next frame's `repair_anchor` resolve `jump_to_end`'s
+    // `anchor = None` into a real slot before `start` is read.
+    tokio::time::sleep(Duration::from_millis(POLL_MS * 2)).await;
+    let start = read_anchor_position(ctx).await;
+
+    for _ in 0..FLING_COUNT {
+        ctx.update(|state: &mut BenchClient, rsc| {
+            if let Some(screen) = &state.screen {
+                (screen.list)(rsc).fling(FLING_VELOCITY_PX_S);
+            }
+        });
+        wait_for_fling_settle(ctx).await;
+        tokio::time::sleep(Duration::from_millis(FLING_PAUSE_MS)).await;
+    }
+    let outward = read_anchor_position(ctx).await;
+
+    for _ in 0..FLING_COUNT {
+        ctx.update(|state: &mut BenchClient, rsc| {
+            if let Some(screen) = &state.screen {
+                (screen.list)(rsc).fling(-FLING_VELOCITY_PX_S);
+                animate_scroll(screen.list, rsc);
+            }
+        });
+        wait_for_fling_settle(ctx).await;
+        tokio::time::sleep(Duration::from_millis(FLING_PAUSE_MS)).await;
+    }
+    let end = read_anchor_position(ctx).await;
+
+    format!("start={start} outward={outward} end={end} ticked=frame-loop")
+}
+
+async fn read_anchor_position(ctx: &mut iris::task::TaskCtx<Rsc>) -> String {
+    read_from_state(ctx, |state, rsc| match &state.screen {
+        Some(screen) => (screen.list)(rsc).anchor_position_display(),
+        None => "idx=none".to_string(),
+    })
+    .await
+}
+
+async fn wait_for_fling_settle(ctx: &mut iris::task::TaskCtx<Rsc>) {
+    let cap = Duration::from_millis(FLING_SETTLE_CAP_MS);
+    let started = Instant::now();
+    while started.elapsed() < cap {
+        let still_scrolling = read_from_state(ctx, |state, rsc| match &state.screen {
+            Some(screen) => (screen.list)(rsc).is_scrolling(),
+            None => false,
+        })
+        .await;
+        if !still_scrolling {
+            return;
+        }
+        tokio::time::sleep(Duration::from_millis(POLL_MS)).await;
+    }
+}
+
+async fn run_stream_phase(
+    ctx: &mut iris::task::TaskCtx<Rsc>,
+    stream_tail: Vec<SeqEvent>,
+) -> (usize, usize) {
+    ctx.update(|state: &mut BenchClient, _rsc| {
+        state.android_state_mut().frame_report.mark_phase("stream");
+    });
+    ctx.update(|state: &mut BenchClient, rsc| {
+        if let Some(screen) = &state.screen {
+            (screen.list)(rsc).jump_to_end();
+        }
+    });
+
+    let total = (STREAM_EVENTS_PER_SEC * STREAM_SECONDS) as usize;
+    let mut sent = 0usize;
+    for event in stream_tail.into_iter().take(total) {
+        ctx.update(move |state: &mut BenchClient, rsc| {
+            let old_items = state.items.clone();
+            state.items = fold_event(&state.items, &event);
+            match state.screen.as_mut() {
+                Some(screen) => screen.apply(rsc, &old_items, &state.items),
+                None => state.rebuild_transcript(rsc),
+            }
+        });
+        sent += 1;
+        tokio::time::sleep(Duration::from_millis(1000 / STREAM_EVENTS_PER_SEC)).await;
+    }
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    (sent, total)
+}
+
+async fn run_type_phase(
+    ctx: &mut iris::task::TaskCtx<Rsc>,
+    platform: &Option<Arc<PlatformHandle>>,
+) {
+    ctx.update(|state: &mut BenchClient, _rsc| {
+        state.android_state_mut().frame_report.mark_phase("type");
+    });
+    ctx.update(|state: &mut BenchClient, rsc| {
+        if let Some(screen) = &state.screen {
+            (screen.list)(rsc).jump_to_end();
+            state.set_focus(Some(screen.composer.field));
+        }
+    });
+    if let Some(p) = platform {
+        p.show_ime();
+    }
+    tokio::time::sleep(Duration::from_millis(300)).await;
+
+    let mut typed = String::new();
+    for ch in TYPE_TEXT.chars() {
+        typed.push(ch);
+        let text = typed.clone();
+        ctx.update(move |state: &mut BenchClient, rsc| {
+            if let Some(screen) = &state.screen {
+                (screen.composer.field)(rsc).set(&text);
+            }
+        });
+        tokio::time::sleep(Duration::from_millis(TYPE_CHAR_MS)).await;
+    }
+    tokio::time::sleep(Duration::from_millis(200)).await;
+    while !typed.is_empty() {
+        typed.pop();
+        let text = typed.clone();
+        ctx.update(move |state: &mut BenchClient, rsc| {
+            if let Some(screen) = &state.screen {
+                (screen.composer.field)(rsc).set(&text);
+            }
+        });
+        tokio::time::sleep(Duration::from_millis(TYPE_CHAR_MS)).await;
+    }
+}
+
+async fn run_keyboard_phase(
+    ctx: &mut iris::task::TaskCtx<Rsc>,
+    platform: &Option<Arc<PlatformHandle>>,
+    ime_state: &Arc<Mutex<ImeState>>,
+) -> String {
+    ctx.update(|state: &mut BenchClient, _rsc| {
+        state
+            .android_state_mut()
+            .frame_report
+            .mark_phase("keyboard");
+    });
+    let mut shown = 0;
+    let mut hidden = 0;
+    for _ in 0..KEYBOARD_CYCLES {
+        let before_shown = ime_state.lock().unwrap().shown_events;
+        if let Some(p) = platform {
+            p.show_ime();
+        }
+        tokio::time::sleep(Duration::from_millis(KEYBOARD_WAIT_MS)).await;
+        if ime_state.lock().unwrap().shown_events > before_shown {
+            shown += 1;
+        }
+
+        let before_hidden = ime_state.lock().unwrap().hidden_events;
+        if let Some(p) = platform {
+            p.hide_ime();
+        }
+        tokio::time::sleep(Duration::from_millis(KEYBOARD_WAIT_MS)).await;
+        if ime_state.lock().unwrap().hidden_events > before_hidden {
+            hidden += 1;
+        }
+    }
+    if shown == 0 {
+        format!("  keyboard: could not be shown ({KEYBOARD_CYCLES} attempts, 0 confirmed visible)")
+    } else {
+        format!(
+            "  keyboard: shown {shown}/{KEYBOARD_CYCLES}, hidden {hidden}/{KEYBOARD_CYCLES} \
+             (confirmed via on_insets_changed)"
+        )
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::TYPE_TEXT;
+
+    #[test]
+    fn type_text_is_exactly_600_characters() {
+        assert_eq!(TYPE_TEXT.chars().count(), 600);
+    }
+}