Merge branch 'worktree-agent-a23e63cec86723942' into rustify

The Gradle side of RUST.md's I2: MainActivity, IrisView (extending
android-view's RustView with the two native methods it has no hook
for -- window insets, and unregistering this view's entry in
iris::android::insets's side table), and RustView.java/
RustInputConnection.java vendored from android-view (no published AAR
to depend on) with one deliberate diff noted in a comment: mViewPeer
is protected rather than package-private, so a subclass in a different
package can reach it.

Measured on the emulator (x86_64, API 26, SwiftShader Vulkan):
dumpsys input_method shows the served InputConnection is ours, and
Gboard's suggestion strip reads real buffer content back through
text_before_cursor ("hi | Hi | HI" after typing "hi") -- the same bar
E1 set, met. Not met: nothing draws. The clear colour reaches the
screen (confirmed by swapping it to magenta) and the layout engine
reports the correct widget count and pixel regions (log::debug! calls
left in view.rs's render() for exactly this), but no primitive shows
up, on both Vulkan/SwiftShader and GLES/virgl. Root cause not found;
one unconfirmed lead (a GLES-only D2/D2Array warning that could point
at the glyph atlas) is written up in RUST.md's I2 rather than chased
into core/src/render/, which is mid-flight in a separate benchmark
branch this session.

I2 is therefore built and wired but not tickable -- RUST.md has the
full writeup, what was ruled out, and where to pick this up.

Co-Authored-By: Claude Sonnet <noreply@anthropic.com>

.agents/skills/ai-app-rigs

@@ -1 +0,0 @@
-../../.claude/skills/ai-app-rigs

.claude/skills/ai-app-rigs/SKILL.md

@@ -1,380 +0,0 @@
----
-name: ai-app-rigs
-description: ai-app's test rigs, harness scripts and reference measurements - ui-sandbox.sh, debug-transcript.sh, transcript-bench.sh, stream-bench.sh, trace-draw.sh, the /usage fixture vocabulary, the fake CLI, the rule that no UI-driving script may tap a coordinate, how to test llama.cpp and ssh on this machine, how importing behaves, and the scroll/stream/explorer numbers not worth re-measuring. Read before running or writing a benchmark, driving the app's UI from a script, exercising the session lifecycle, testing a llama or remote session, or touching the import screen.
----
-
-# ai-app: rigs, harnesses and measurements
-
-Moved out of `AGENTS.md` on 2026-09-04 so it is read when it is relevant
-rather than sent with every request in this repo -- it was 12 KB of the 35 KB
-that file cost on every one. Unchanged in the move, and still the only copy.
-
-## The rigs
-
-Each exists because something was invisible without it.
-
-- **`app/ui-sandbox.sh`** — a second `ai-server` with its own `$HOME`, config
-  and data directory, holding eight invented Claude Code transcripts and a
-  `claude` that is two lines of shell. **That isolation is the point**: the
-  import screen lists whatever is in `~/.claude/projects`, which in this VM is
-  real agent transcripts, so exercising *delete* against the ordinary server
-  deletes somebody's conversation and exercising *import* starts a real
-  `--resume` on the owner's account.
-  Its port and root derive from the checkout's name, so two checkouts'
-  sandboxes cannot reach each other, and its token is generated once into
-  `~/.config/ai-app/sandbox-token` and carried across restarts along with any
-  the enrolment flow appended — so the emulator app is enrolled **once** (the
-  start banner prints the command) and stays enrolled. It shares the real TLS
-  certificates, because the installed APK pins that CA.
-  Driving verbs, so none of this is re-derived per session:
-  `./ui-sandbox.sh spawn [title]` (an echo session, prints its id),
-  `./ui-sandbox.sh send SID text|@file`, and
-  `./ui-sandbox.sh api /path [curl args]`.
-  `./ui-sandbox.sh keep` restarts the server without wiping the sessions and
-  enrolment already there — for when the fixture under test was expensive to
-  build; plain `start` wipes them, which is right for the list-screen
-  fixtures and wrong for that.
-  It passes `--delay` by default, and `AI_SANDBOX_BIG_MB` puts one large
-  transcript among the small ones while `AI_SANDBOX_SPAWN_DELAY` makes the
-  fake CLI slow to start. Both exist because operations that finish in
-  milliseconds have states on the way that nothing can observe, and an
-  unobservable state is one where broken and working look identical.
-  It also builds a fixture tree at the sandbox home's `~/files` for the
-  explorer, holding the states otherwise only reachable by finding a real
-  machine in one: an empty directory, a name with a tab and one with an
-  apostrophe, a binary file, one over `FILE_LIMIT`, one `chmod 000`, a
-  symlink to a directory and a broken one, a source file per language, and
-  the three sizes the limits were measured against (`edit-32k.rs`,
-  `edit-128k.rs`, `big-source.rs`). Point a session at it with
-  `./ui-sandbox.sh api /sessions/<id>/cwd -X POST -H 'content-type: application/json' -d '{"cwd":"~/files"}'`.
-  The explorer's 409 is produced by editing the file on the machine
-  (`printf … > file`) between pressing the pencil and pressing save.
-- **`app/debug-transcript.sh`** — a real conversation on the emulator. The
-  echo driver is the right rig for most things and the wrong one for anything
-  whose cost scales with what was actually written: a real reply is longer,
-  is real markdown, and carries tool calls whose input and output are
-  kilobytes. Two faults were invisible until a real transcript was loaded — a
-  page of history landing mid-fling threw the reader back to the newest end,
-  and parsing one real reply took 51ms against 4.6ms for a synthetic one.
-  `-b` takes the biggest conversation on the machine rather than the newest,
-  which is what a scrolling test wants; `--stop` takes it down.
-  It copies the transcript into `/tmp` and gives the server a `HOME` of its
-  own, so the import can only see the copy — importing spawns `claude
-  --resume`, and against the real file that is a second CLI writing to a
-  conversation somebody may still be in. **A transcript never goes in this
-  repository**: they hold whatever was said, read and written in that
-  session, and `~/repos` is shared with the host besides.
-- **`/usage` in an echo session puts up an invented meter**, which is how the
-  rate-limit screens' states are reached without spending quota: `/usage 42`,
-  `/usage 95 20` (minutes left), `/usage 42 never` (the between-blocks window
-  with no reset time), `/usage 42 unreadable`, `/usage notloggedin`,
-  `/usage unreachable`, `/usage failed`, `/usage off`. The vocabulary is
-  `usage::Fixture`'s, since those are its states. With none set an echo
-  session meters nothing, which is the ordinary case and draws no bar.
-- **A fake CLI exercises the process lifecycle without a token.** Point a
-  `claude_cli` provider's `command` at a script that ordinarily runs
-  `cat > /dev/null` and it behaves the way the lifecycle code cares about:
-  it holds the fifo open, records a real pid, writes nothing, and dies on a
-  signal. So adopt, stop, restart and start are all drivable without a real
-  `--resume` and without spending a turn on somebody's account. Reach for
-  this when what is under test is *whether a process is running*, and for
-  `debug-transcript.sh` when it is *what the transcript draws*. The sandbox's
-  version also handles `auth login`: it prints an inert Anthropic-shaped URL,
-  rejects any code except `sandbox-code`, and exits successfully for that one.
-- **`/think [seconds]` in an echo session puts up a thinking card**, long
-  enough to watch it spin before it closes with the span it actually took.
-  The rest of the turn is the ordinary echo reply, so it is also the rig for
-  a block and a reply meeting.
-- **`app/transcript-bench.sh`** is the standard scroll measurement: it opens
-  the first session (or `-k` keeps the current screen), scrolls a fixed
-  gesture loop, and prints the app's render report — the same one the in-app
-  copy button produces, whose `on screen:` line names what the viewport was
-  holding. Compare two runs with the same gestures; the emulator's absolute
-  frame times transfer nothing, the report's accounting does. Run it either
-  side of any change under `Markdown*.kt`, `Transcript*.kt` or
-  `SessionScreen.kt`'s list, and put the report in the commit. The numbers
-  that move first are the worst `record: one block`, the reparse mean while
-  streaming, and the draw phase's accounting line.
-- **`app/stream-bench.sh [-k] FILE`** is that measurement for a reply still
-  arriving. It taps "Jump to latest" so the list is pinned to the newest end,
-  resets the report, sends FILE, waits for the transcript to stop growing,
-  and prints. Both of those are corrections to a first version that measured
-  nothing: a transcript parked further back never redraws while a reply
-  streams into it, and a session is idle at *both* ends of a turn, so polling
-  for idle answers before the turn has started.
-- **`app/trace-draw.sh`** names what a scrolling frame spends inside the
-  framework, from `atrace` text output with no trace processor needed. It is
-  how the cost of a layout node per link was attributed to the framework
-  rather than guessed at.
-
-### Driving the UI
-
-**No script that drives this app's UI presses a coordinate.** Every control
-is found by the name it already carries for assistive technology —
-`ui-trace record --do "tap 'Session settings'"` — which resolves the label
-against the screen at the moment of the gesture and fails the whole run when
-it is not there. `app/bench-lib.sh` is what the bench scripts share for it. A
-coordinate is a position measured once by hand, and anything that moves the
-control makes the tap land on whatever now sits there — the bench then
-reports a number that was never measured, which reads exactly like a result.
-Both bench scripts pressed the render report at `tap 723 205` until that
-button moved into the session settings dialog on 2026-09-03. The check that
-none has crept back:
-
-    grep -n "tap [0-9]" app/*.sh
-
-Swipes are still coordinates, deliberately: a gesture across a scrolling area
-is a distance rather than a control.
-
-**Two traps in the emulator bench loop**, each of which cost a run.
-`adb shell pm clear` removes the enrolment and the notification permission
-along with the saved anchors, so the next run measures a permission dialog —
-re-enrol with the command `ui-sandbox.sh` prints, and
-`pm grant … POST_NOTIFICATIONS`. And a saved scroll anchor is per session id,
-so the only way two builds start a scroll from the same place is a *fresh
-session for each*.
-
-**The emulator is `~/repos/emulator-tools`' business, not this repo's.**
-`emu up` creates and boots the AVD named after this checkout — whatever `emu
-name` prints, never a name typed out here, since this file is the same in
-every clone. `run-android.sh` is that plus a build and an install. The `adb`
-on `PATH` after sourcing `android-env.sh` is that repo's wrapper, which fills
-in `-s` from the same rule. Gradle does not go through it, so a Gradle init
-script from `emulator-tools` runs `emu check` before `installDebug`,
-`uninstallDebug` and `connectedAndroidTest` and fails rather than fanning out
-to every attached device; when it refuses, say which device you mean at the
-moment you use it — `ANDROID_SERIAL=$(emu serial) ./gradlew …`.
-
-### Testing llama.cpp and ssh here
-
-**Both are set up here** and need nothing typed. The prebuilt llama.cpp lives
-outside the repo at `~/.local/opt/llama.cpp-vk` — a **Vulkan** build as of
-2026-09-19, replacing the CPU one that was there before — and is symlinked as
-both `~/.local/bin/llama-server` and `/usr/local/bin/llama-server`. The second
-is what makes **discovery find it over ssh**: `~/.local/bin` is not on the
-PATH a non-interactive ssh session gets. It resolves its own libraries through
-`$ORIGIN`, so no `LD_LIBRARY_PATH` is needed.
-
-Two models are downloaded under `~/.local/share/ai-app/models`:
-
-- `unsloth/Qwen3-0.6B-GGUF/Qwen3-0.6B-Q8_0.gguf`, 639 MB, loads in ~4s. It
-  calls tools correctly and is the right rig for the driver's shape. Do not
-  judge *answers* by it — asked for the second line of a file it read from
-  line 2 and then named the third.
-- `ISTA-DASLab/Qwen3.8-27B-GSQ-RCO-GGUF/Qwen3.8-27B-GSQ-RCO-IQ3_S-mtp.gguf`,
-  12 GB, ~20s to load, and the only one here with a multi-token-prediction
-  head. It is the rig for anything about `loading` being a state of its own,
-  since 20s is long enough to send into.
-
-- `ggml-org/SmolVLM-256M-Instruct-GGUF/SmolVLM-256M-Instruct-Q8_0.gguf`,
-  175 MB, plus the `mmproj-…` beside it, downloaded 2026-09-20 as the rig for
-  **vision**: it is the only model here that reads pictures, it loads in
-  seconds on the CPU, and it described a red circle correctly. The pair is
-  also what exercises the projector being found beside the weights, and the
-  projector being kept out of the models a provider offers. Qwen3-0.6B beside
-  it is the other half of that rig -- the model that answers `refused`.
-
-**A second llama.cpp is installed here, and it is the rig for a custom
-build.** `~/.local/share/ai-app/llama/prism/` is Prism ML's fork
-(`prism` branch, `~/repos/llama.cpp-prism`, Vulkan, `cmake --install
---prefix`), so discovery finds it as a provider called `llama-cpp-prism`
-beside the ordinary `llama-cpp`. It is what exercises that mechanism at all,
-and it serves `prism-ml/Ternary-Bonsai-2-27B-gguf` -- ternary packings stock
-llama.cpp rejects as unknown types. Rebuild it with
-`cmake -B build -DCMAKE_BUILD_TYPE=Release -DGGML_VULKAN=ON
--DCMAKE_INSTALL_LIBDIR=lib -DCMAKE_INSTALL_RPATH='$ORIGIN/../lib'`, about six
-minutes at `-j8`.
-
-**Both of those install flags are load-bearing, and the failure is a session
-that never becomes ready.** `llama-server` is a 16 KB launcher against
-`libllama-server-impl.so`, so a build whose libraries it cannot find dies at
-`exec` with `error while loading shared libraries` -- which reaches the phone
-as the model never answering. The runpath has to be set, *and* the libraries
-have to be where it points: `GNUInstallDirs` chooses `lib64` on some
-distributions (Gentoo's amd64 profiles among them) while the runpath above
-says `lib`. `readelf -d bin/llama-server | grep RUNPATH` and
-`ldd bin/llama-server | grep 'not found'` are the two-second check after any
-install here.
-
-**Which Bonsai packing runs on the GPU is the backend's question, not the
-model's.** Measured 2026-09-21 with `llama-bench -p 512 -n 64 -r 2 -fa 1
--ngl 99` on the free card:
-
-| packing | backend | pp512 | tg64 |
-| --- | --- | ---: | ---: |
-| `PTQ1_0`, 5.53 GiB | Vulkan | 519 t/s | 7.5 t/s |
-| `PQ2_0`, 7.21 GiB | **CPU**, 8 cores | unfinished after 9 min | -- |
-
-The fork's Vulkan port covers `PTQ1_0` only -- shaders, a `mul_mat_vec` and
-the FWHT included -- so `PQ2_0` has no kernel there and every matmul falls
-back to the CPU. That reads exactly like a stuck load: the process sits at
-700% CPU for minutes with the card idle. On CUDA and HIP it is the other way
-round, since `mmq.cu` guards `PTQ1_0` out of the HIP build (it wants Turing
-MMA) and leaves `PQ2_0` in. **ROCm cannot be tested in this VM**: there is no
-`/dev/kfd`, because the GPU here is virtio-gpu rather than a passed-through
-card.
-
-7.5 tok/s is the honest speed of that Vulkan kernel, against 42 for the
-IQ3_S 27B beside it -- smaller weights, slower decode. Nothing is
-misconfigured; the fork's fast kernels are CUDA and Metal.
-
-**Do not test with a 2-bit quant**: the IQ2_XXS of the 0.6B produces fluent
-nonsense, which reads exactly like a broken driver — `llama-cli` produces the
-same from the file directly, which is how to tell the two apart in a hurry.
-
-**The GPU is shared and llama-server dies loudly when it runs out.** A second
-server loading a model while the 27B holds VRAM fails with `radv/amdgpu:
-Failed to allocate a buffer` / `MESA: error: buffer allocation failed` and
-exits mid-request. `-ngl 0` runs it on the 8 cores instead, which is the way
-to test the driver while something else holds the card -- through the app, that
-is the model's "Layers on the GPU" set to 0 in the machines tab's provider
-view, and `--models-max` above 1 is how two models come to be loaded at once
-in the first place.
-
-**Testing tools and MCP without the app**: `llama-server --tools all` publishes
-its built-in tools at `GET /tools` and runs one at `POST /tools` with
-`{"tool": …, "params": …}` and an `x-tool-cwd` header — so a whole agent loop
-is drivable with `curl` and no model at all. The Exa MCP server at
-`https://mcp.exa.ai/mcp` answers **without an API key** and needs a
-`User-Agent` header (Cloudflare answers 403 without one, which reads as a
-refusal rather than a missing header).
-
-There is no second machine, so **ssh this VM to itself**. That is set up
-too: the key is `~/.config/ai-app/ssh-self` (its public half is in
-`~/.ssh/authorized_keys`, labelled removable), and the real config carries a
-machine called **"this vm over ssh"** — `bob@127.0.0.1` with that
-`identityFile` plus
-`options: ["StrictHostKeyChecking=no", "UserKnownHostsFile=/tmp/ai-app-known-hosts"]`
-so it touches nothing real — offering `claude-cli` and `llama-cpp`. It is the
-whole rig for "does a remote llama session work", since the far machine is
-this one and the model file is the same file. For a throwaway machine of your
-own, point a provider's `command` at something harmless like `/bin/echo`
-rather than at `claude`: the transport is what is under test, the process
-exiting immediately is the signal, and it costs no tokens. The remote login
-shell here is **fish**; the
-remote script and `ssh.rs`'s POSIX quoting happen to mean the same thing in
-both, but that is luck rather than design, and a shell that is neither is the
-thing to suspect first if a remote spawn ever mangles an argument.
-
-## Importing
-
-The import list reports each session's **size as well as its line count**,
-because the two disagree in the way that matters: these transcripts embed
-screenshots as base64, so one line can be a megabyte. On this machine a 69 MB
-session has 3,427 lines and a 44 MB one has 6,792 — nothing about a line
-count tells you what continuing a session will cost. Shown, not warned about;
-importing a large session is a choice somebody is entitled to make.
-
-**Never import a Claude Code session that is open in a terminal.** The app
-refuses it — see PLAN.md for the incident that made that a refusal rather
-than a warning.
-
-**One Claude Code session id can name two files, and the listing offers it
-once.** Resuming from a different working directory makes the CLI write a
-second transcript with the same id under that directory's project folder — an
-ordinary state of a machine, not corruption. Everything downstream addresses
-a session by id, and the phone keyed its list on it, so two rows sharing one
-**closed the app** on a Compose duplicate-key throw. `parse_listing` keeps
-the copy with the most lines, because the other is usually a few-hundred-byte
-stub and is often the *newer* of the two, so recency is the wrong key.
-Deleting removes every copy rather than the first, or the row came back after
-a delete that reported success. The phone's half is `uniqueItems`, which
-every list keyed on a server-chosen id goes through: a repeat there must
-never be able to close the app, whatever produced it.
-
-**Deleting a session offers to take the machine's own transcript with it** —
-`DELETE /sessions/{id}?deleteForeign=true`, behind a switch in the
-confirmation, and only where the driver keeps a record of its own
-(`keepsOwnTranscript`, currently Claude Code or Codex). Off by default,
-because leaving that copy is what makes an ordinary delete recoverable — and
-the dialog's paragraph is rewritten when it is on rather than appended to,
-since the sentence promising the conversation "should still be there to
-import again" is exactly the one the switch makes false. The server deletes
-the machine's copy *first*, so a machine it cannot reach leaves the session
-where it was instead of half-deleted.
-
-## Measurements worth not re-taking
-
-- **`-np 1` is what makes the MTP draft head pay.** Taken 2026-09-19 on the
-  27B above, decode speed for a 300-token reply, from `llama-server`'s own
-  timings rather than the clock:
-
-  | flags | tok/s |
-  | --- | --- |
-  | plain, any `-np` | 41.5 |
-  | `--spec-type draft-mtp -np 1` | 61.4 |
-  | `--spec-type draft-mtp -np 2` (n-max 2) | 65.9 |
-  | `--spec-type draft-mtp`, default `-np` (4 slots) | 28 |
-
-  Draft acceptance is 0.53–0.73 in every case, so the head is working in all
-  of them: what changes is that speculating against a KV cache split four ways
-  is slower than not speculating. A model's preset gets `parallel = 1` unless
-  its settings say otherwise (the machines tab's provider view, since
-  2026-09-19), so this is recorded for whoever next sees MTP look broken or
-  next raises the slot count to answer two sessions at once. `--spec-draft-n-max 2` was
-  worth another 7% in a single sample and is deliberately *not* passed — one
-  sample on a virtualised GPU is not a number to hardcode.
-
-- **Prompt processing is the expensive part of a llama turn here, and decode
-  speed falls only slowly with context.** Taken 2026-09-19 on a free GPU, the
-  27B with `--spec-type draft-mtp -np 1`, generating 160 tokens each time:
-
-  | context | decode | prefill of that prompt |
-  | --- | --- | --- |
-  | 88 | 43.4 tok/s (cold) | 21s |
-  | 1,569 | 55.5 tok/s | (model still warming) |
-  | 6,068 | 53.2 tok/s | 9.5s |
-  | 14,068 | 50.3 tok/s | 22s |
-
-  So a turn on a long conversation spends tens of seconds before the first
-  token, and that is what `SessionStatus::Reading` exists to say. The same
-  sweep on the 0.6B **on the CPU** falls much harder -- 30.1 tok/s at 44
-  tokens of context to 11.5 at 6,024 -- which is the shape somebody means by
-  "it gets slower as the conversation goes on". The figure the app draws is
-  `timings.predicted_per_second`, decode only, so prefill is never mixed into
-  it.
-
-- **A busy GPU is a model that will not load at all**, not a slow one:
-  `radv/amdgpu: Failed to allocate a buffer` and `failed to load model` while
-  something else holds VRAM. A 0.6B that had been decoding at 149 tok/s ran at
-  16.7 in that window before its server died, so a tok/s figure taken while
-  the card is shared says nothing about the model.
-
-- **Asking for the head when the file has none is fatal**, not ignored:
-  `context type MTP requested but model doesn't contain MTP layers` and the
-  server exits. Without the flag the same file logs `unused tensor
-  blk.N.nextn.* — ignoring` and runs normally, which is the state to look for
-  when MTP is silently not happening.
-
-- **What the transcript screen costs to scroll.** Taken 2026-08-30 on the GPU
-  emulator against a real imported transcript with the server at
-  `--delay 120`. Settled and flinging fast, both into fresh history and back
-  through rows already drawn: **5.2–5.9% janky frames, 99th percentile
-  29–32ms, 0–2 slow UI-thread frames.** The stock Settings app on the same
-  device is 3.3% and 38ms, so this is at the platform floor. The number that
-  is *not* at the floor is the first few seconds after opening a session,
-  where every row on the way is being composed for the first time; that is
-  inherent to a lazy list and it is why a measurement taken before the screen
-  settles reads three times worse. **Settle first, then reset `gfxinfo`.**
-- **The reset path is not reachable by reopening a session.** Measured
-  2026-09-04 against a session streaming at 20 events a second: reopening one
-  with an anchor 1,800 events back connects **87–119 events behind**, well
-  under `CATCH_UP_LIMIT`'s 200, because the restore is two requests — the
-  opening page, then one span covering the whole distance. To exercise the
-  reset at all you have to lower `CATCH_UP_LIMIT` in a throwaway build; at 5
-  the app takes the reset on a live connection, clears, refills and carries
-  on without reconnecting.
-- **The session screen's stream survives backgrounding here** — 20 seconds at
-  the launcher while 415 events were produced brought no reconnect at all,
-  which is not what the comment above that loop expects, and is most likely
-  this emulator being headless rather than the phone's behaviour.
-- **Reopening a cached session costs one request for one event** (the probe),
-  and scrolling the whole conversation back costs nothing more; a cold open
-  of the same 500-event session is two pages, 100 events. Measured
-  2026-09-04 on the emulator against the sandbox.
-- **Reading is cheap and editing is not.** The viewer handles a 1 MiB,
-  28,000-line file because it draws one row per line; the editor is one
-  `BasicTextField`, which costs two seconds a frame at 128 kB and stops the
-  app at 1 MiB, so `EDIT_LIMIT` caps it at 32 kB with the reason said on
-  screen. If you make the editor faster, that number is what to move.
-  EXPLORER.md's "What the measurements said" has the rest.

.gitignore

@@ -7,6 +7,8 @@ local.properties
 .idea/
 .DS_Store
 server/target/
+event-model/target/
+client-core/target/
 
 # Server logs from a development run (ai-server.log by convention,
 # wg-test.log from ./test-wg-tunnel.sh).
@@ -21,3 +23,7 @@ certs/
 config.ron
 config.json
 sessions/
+
+# iris, the in-house UI library, is vendored at iris/ and built by cargo.
+iris/target/
+iris/android-app/target/

AGENTS.md

@@ -1,6 +1,6 @@
 # ai-app
 
-A phone interface to AI coding sessions (Codex, Claude Code and llama.cpp),
+A phone interface to AI coding sessions (Claude Code and llama.cpp),
 replacing the Claude app for daily use. Rust/Axum backend on the desktop,
 Kotlin/Compose Android app, WireGuard + pinned self-signed TLS + bearer token
 between them.
@@ -9,15 +9,7 @@ between them.
 its rationale, and what was rejected. Read it before changing anything
 structural, and update it in place when a decision changes rather than
 letting this file and the plan become two versions of the truth. This file is
-the working notes layer: layout, commands, and things that have bitten.
-
-**The rigs are the `ai-app-rigs` skill** — the sandbox and bench scripts, the
-rule that no UI-driving script may tap a coordinate, how to test llama.cpp and
-ssh here, how importing behaves, and the measurements not worth re-taking.
-They moved there on 2026-09-04 because they are 12 KB that only matter once
-you are actually running one, and this file is sent with every request. Read
-it before writing or running a benchmark, driving the UI from a script, or
-touching the import screen.
+the working notes layer: layout, commands, rigs, and things that have bitten.
 
 The central design point, worth not undoing by accident: **a session is a
 child process, translated into one common event model.** A new session type
@@ -34,188 +26,10 @@ Module-by-module intent is in PLAN.md's "Backend layout".
 
 - `server/` — the Rust backend (`ai-server`). `routes.rs`'s module doc
   comment is the HTTP table and the surface's source of truth.
-  **A machine's models are served by one shared `llama-server`** (2026-09-19,
-  `session/llama/router.rs`): started with no `-m`, which makes it a
-  **router** — it reads a preset file naming models and their flags, starts a
-  child server per model asked for, and routes by the `model` field in each
-  request. So a session has no process of its own, two sessions on one model
-  share one copy of it in memory, and a backend restart adopts one process
-  rather than one per session. Four things fall out of it and are easy to get
-  wrong again — a session records the router's pid in its own directory as
-  `process::Detail::Shared`, and `process::stop` refuses to signal a `Shared`
-  record, which is what keeps one session ending from unloading everybody's
-  model; **nothing stops a router on its own**, and the only thing that does
-  is the machine's provider view (`POST /machines/{id}/providers/{p}/stop`);
-  how a model is *loaded* is per model on its machine
-  (`ProviderConfig::model_settings`, `LLAMA_MODEL_PARAMS`) rather than per
-  session, and saving those settings rewrites the preset, which **unloads**
-  that model; and the preset is read back before every edit, because a router
-  adopted from an earlier run is serving sections this process has never seen
-  and rewriting without them unloads those.
-  **A machine can have more than one llama.cpp** (2026-09-21,
-  `machines.rs`): anything at `~/.local/share/ai-app/llama/<name>/llama-server`
-  or `.../<name>/bin/llama-server` is discovered beside the one on PATH and
-  becomes a provider called `llama-cpp-<name>`, with its own router, preset
-  and model settings. That is how a model whose kernels are not upstream is
-  served -- Prism ML's ternary Bonsai is the one here, built from the
-  `prism` branch into `~/.local/share/ai-app/llama/prism` -- without the
-  phone ever naming a command, which is the property this module exists for.
-  Both providers offer the machine's whole models directory, since which
-  build reads which packing is not answerable from the file.
-  **A llama.cpp session runs on its configured machine** (built
-  2026-09-04, the last of phase 5): `Transport::reserve_port` returns the
-  port the server binds *there* and the port that reaches it *here*, and
-  `Launch::reaching` puts the `-L` tunnel on the connection already carrying
-  the command. Three things fell out of it and are easy to get wrong again —
-  a forwarded launch gets a pty (`-tt`) and every other one keeps `-T`,
-  because `llama-server` never reads the stdin whose closing ends a CLI and
-  the same kill left it loaded on the far machine; the model is looked for on
-  the machine that will serve it, so the spawn screen offers
-  `GET /machines/{id}/providers/{p}/models` rather than any list of this
-  backend's own; and the
-  readiness poll watches the process as well as the port, since a model that
-  will not load exits in a second and was being reported as "gave up after
-  300s". See PLAN.md's "Transport" and "llama-server management".
-  **A llama session has tools and runs the loop itself** (2026-09-19):
-  `--tools all` gives the router `llama-server`'s built-in set, which it also
-  *runs* (`GET /tools` for the definitions, `POST /tools` to call one), while
-  web search comes from an MCP server this backend connects to directly
-  (`session/llama/mcp.rs`, Exa preset in a discovered provider's
-  `mcpServers`). Driving the loop is what makes the permission gate ours:
-  `manual` asks before every call and remembers a tool you answer
-  "Always allow …" to, `bypassPermissions` never asks, and the allowances are
-  folded back out of the transcript. Which tools a *session* offers is a
-  filter applied to those definitions here, not a flag over there: one shared
-  server has one set, and the filter costs no reload (2,181 tokens of prompt
-  with all seven, 698 with none). Three more things fall out of it and are
-  easy to get wrong again — a model change **asks for another model** and
-  stops nothing, since the one being left may be another session's;
-  `parallel = 1` unless that model's settings say otherwise, and it is what
-  decides whether the MTP draft head is a 50% speed-up or a 33% loss; and
-  `spec-type = draft-mtp` is conditional on the file actually having a head,
-  because asking for one that is not there makes `llama-server` **exit**.
-  **A llama session takes a picture only where the model natively reads one**
-  (2026-09-20): a multimodal model is loaded with the `mmproj` found beside
-  its weights (overridable per model, `off` included), an attachment rides in
-  the request as an `image_url` data URI, and nothing at all is done for a
-  model without a projector. Four things fall out of it and are easy to get
-  wrong again -- whether a session takes pictures is `/props`'s
-  `modalities.vision` from the loaded server and never a guess from this side,
-  with three states because a loading model has not answered yet
-  (`Images::Unknown` is *offered*, since a control withheld because nobody
-  could ask is missing from sessions that would have taken it); a message
-  carrying an image a model cannot read is **stopped rather than stripped**,
-  refused at the door, at the queue and at the steering boundary, because
-  `llama-server` refuses the whole request over one part and a message sent
-  without its picture is a different message; an earlier turn's image folds
-  into a line of words for a model without vision, so switching models does
-  not end the conversation; and a projector is filtered out of the models a
-  provider *offers*, while staying in the machine's own model list.
-  **A llama session's thinking is drawn** (2026-09-19): `reasoning_content`
-  becomes `Event::Thinking` deltas closed by an `Event::ThinkingDone` carrying
-  the span the *driver* measured, and the phone draws a card that spins while
-  the block is open and says "Thought for 12.4s" once it is not. The reasoning
-  is deliberately not part of the next prompt (`conversation` ignores it), and
-  `timings.predicted_per_second` and `timings.prompt_ms` off the same stream
-  become `UsageDelta`'s `tokensPerSecond` and `prefillMs`, which is the
-  "read 9.5s · 50.3 tok/s · 3:00 PM" under a finished reply — nothing else here
-  measures either, so every other driver sends `None`, and the clock is last so
-  that it does not move when a provider reports fewer of them.
-  **A wait that can be measured says how far along it is** (2026-09-21):
-  `GET /sessions/{id}/progress` answers `{of, fraction, stage?}` and `null`
-  for a session that is not in one -- runtime state, asked for twice a second
-  by the session screen while it is drawing a wait, and deliberately never an
-  event, since a load reports five times a second and every event is a
-  transcript line for ever. The two sources are the router's `/models/sse`
-  stream, which is the **only** place a model's load progress appears (`GET
-  /models` says "loading" and no more), and `prompt_progress` chunks that
-  `"return_progress": true` adds to the generation stream. The sample says
-  which status it measures so it cannot be drawn under another one, and
-  `/loading [seconds] [stages]` / `/reading [seconds]` in an echo session are
-  the rig for the phone's half. **Zero is never reported**, being the absence
-  of a sample rather than a measurement -- which matters because
-  `llama-server` reports a model's load as 0 and then 1 with nothing between
-  (measured 2026-09-21 on both the 0.6B and the 27B), and reports prompt
-  processing once a batch; so the bar usually draws for a long prompt and not
-  for a load.
-  **A turn's wait has two halves and says which** (2026-09-19):
-  `SessionStatus::Loading` is the model coming off disk and
-  `SessionStatus::Reading` is `llama-server` processing the prompt -- emitted
-  when the request goes out and cleared by the first thing the model says, of
-  any kind. Prefill is the expensive half here (~10s at 6k tokens, ~22s at
-  14k), and as `running` it looked exactly like thinking. The phone draws
-  both with the working spinner and its own words, "loading model" and
-  "reading prompt".
-  **Thinking effort is a param, and which levels exist is the model's answer**
-  (2026-09-19): the `thinking` param rides on the request as a chat-template
-  argument (`reasoning_effort`, or `enable_thinking: false` for `off`), so it
-  needs no restart -- and the driver asks the loaded server which levels its
-  template actually takes rather than trusting the offered list, because the
-  27B raises on `high` and answers to `xhigh`. A level it cannot take is
-  dropped and said in the transcript, naming the ones it can.
-  **Every one of those is a default rather than a constant** (2026-09-19):
-  `DriverKind::params` declares what a provider takes — key, label, shape,
-  and whether a change waits for a restart — and the phone renders whatever
-  arrives, on the spawn form and in the session settings dialog. Adding a
-  setting to a driver is one entry in that table and no app change. `tools`
-  is in there too, because the seven built-in definitions are ~1,500 tokens
-  of every prompt, which on a small window is the difference between a usable
-  session and one that overruns. `DriverKind::model_params` is the same table
-  for a provider's **models**, drawn in the machines tab's provider view —
-  the settings that decide how a model is loaded, which belong to the machine
-  because one loaded copy answers every session using it.
-  **A model is downloaded onto the machine that will serve it** (2026-09-19,
-  replacing the fetch this backend used to do onto its own disk, and the
-  Models tab that went with it). `models.rs` writes a script and a detached
-  `curl` runs it *there*; the state of a run is a file beside the partial
-  (`x.gguf.download`), so nothing about it is held in this process — it
-  survives the phone closing, this backend restarting and a second device
-  watching, and `kill -0` at each listing is what stops a machine that was
-  rebooted from leaving a download claiming to be running. The progress is
-  `wc -c` of the partial against the size HuggingFace published, the sha256
-  it publishes is what makes a resume safe, and a finished download is not a
-  state: it is a model, in the list beside the one still going.
-  Codex is one persistent `codex app-server --stdio` process per session; its
-  driver uses native turn steering and interruption, persists the protocol
-  state and thread id, and reads subscription limits through the same CLI
-  protocol.
 - `app/` — the Compose app, package `com.example.aiapp`, label "AI Sessions".
-  **Every text field is `LabelledField`** (`Field.kt`): the label is a line
-  above the box rather than a thing floating inside it, and the padding is one
-  line's worth. Material's outlined field spends the height of three lines to
-  hold one, which on a form of a dozen settings is a screen and a half of
-  scrolling. What is *not* shrunk is the value -- the framing is what was
-  expensive. A field's `hint` is what leaving it blank means, drawn inside the
-  empty box: **a setting is a title and a control and nothing else**, so no
-  explanatory line sits between them and no paragraph sits under them.
-  **What a setting costs is asked rather than written down** -- `RestartDialog`
-  is that question wherever it comes up (a model's settings, the shared
-  server's, moving a session's directory, changing its thinking level), because
-  each of them ends something that is running, and a sentence beside the control
-  is read after the decision if at all.
-  **One kind of information gets one control.** A choice is `PickerRow` in a
-  list of settings and `ChipGroup` on a form being filled in, and which of the
-  two is the screen's to say (`ProviderParamFields`' `choices`) rather than the
-  provider's -- a llama session's thinking level and a Claude session's have to
-  look the same.
-  **Session settings is a screen with two tabs** (`SessionSettingsScreen.kt`),
-  drawn over the session like the file explorer so the session stays composed.
-  The second tab is `ProviderScreen` itself -- the same composable the machines
-  tab opens -- so a provider's settings have two ways in and one
-  implementation; it takes `onBack = null` there, since the screen around it
-  has one.
-  `AppRoot.kt` is the navigation `when`; `SidePanels.kt` the one drag that
-  slides the whole main screen over a session from the left (`MainPanel.kt`)
-  and what it has running beside the turn -- its background tasks over its
-  subagents (`BackgroundTasks.kt`, `SubagentPanel.kt`) -- from the right, both keeping
-  the session composed underneath; `MainScreen.kt` the root's three tabs
-  (sessions, import, machines); `Reorder.kt` the drag that moves a row of a
-  lazy list, used by the session list's handles -- **the order of that list is
-  the reader's own and nothing sorts it** (`POST /sessions/order`);
-  `MachineModels.kt` the models on one machine
-  and the downloads putting them there, drawn inside `ProviderScreen.kt` for a
-  provider that serves files off that machine's disk; `Api.kt`/`EventStream.kt`
-  the REST + SSE clients; `Events.kt` the event model mirror; `ServerConfig.kt` settings and
+  `AppRoot.kt` is the navigation `when`; `MainScreen.kt` the root's four tabs
+  (sessions, import, models, setups); `Api.kt`/`EventStream.kt` the REST + SSE
+  clients; `Events.kt` the event model mirror; `ServerConfig.kt` settings and
   the Keystore-sealed token.
 - `wg-app-link/` — a **git submodule** shared with dev-updater: the pinned CA
   and leaf (`certs`), QR enrollment and the bearer token (`enroll`), wg0
@@ -225,23 +39,17 @@ Module-by-module intent is in PLAN.md's "Backend layout".
   build without it, since it is a path dependency, which is what keeps the two
   projects version-locked to the commit this repo pins. What deliberately did
   **not** move is the API surface and the config *schema*: routes, drivers,
-  sessions and machines are what makes this project itself.
-- `SUBAGENTS.md` — a session's subagents as transcripts of their own
-  (`server/src/session/subagent.rs`, the subcards in `SessionListScreen.kt`
-  and the read-only form of `SessionScreen.kt`); `DECISIONS.md` holds the
-  choices made there that are still awaiting review.
-  **The transcript file itself is readable from the session settings dialog**
-  (2026-09-21): *View raw* opens the file explorer on it, from
-  `transcriptFile` on `GET /sessions/{id}` -- which names the machine *this
-  backend* runs on, not the session's. It is the explorer's third caller and
-  needed no new screen; a transcript past `FILE_LIMIT` (1 MiB) is refused the
-  way any other large file is.
+  sessions and setups are what makes this project itself.
 - `EXPLORER.md` — the file explorer's design (`server/src/files.rs` and
   `FilesScreen.kt` / `FileViewer.kt` / `FileEditor.kt`).
 - `TRANSCRIPT_CACHE.md` — the phone's copy of what it has been sent. Read it
   before touching `TranscriptCache.kt`, `TranscriptSource.kt`, or the opening
   and stream effects in `SessionScreen.kt`.
 - `TODO.md` — the working list.
+- `RUST.md` — the plan for moving the app to Rust (on the `rustify`
+  branch of the `ai-app-2` clone): what has to be reproduced, the
+  framework decision, and the ordered experiments with their pass
+  conditions. Read it before touching anything under that branch.
 - `.dev-updater.ron` — what Dev Updater builds here: the server (run as
   `service: Managed(…)`, supervised by Dev Updater's own implementation
   rather than a script kept here) and the APK, in parallel. It points at
@@ -334,6 +142,153 @@ two icon buttons the same width without either being given one — and why
   genuine handshake against 10.66.0.1 with pinned TLS, no router or phone
   involved. That is how to verify the wg0-only posture.
 
+## The rigs
+
+Each exists because something was invisible without it.
+
+- **`app/ui-sandbox.sh`** — a second `ai-server` with its own `$HOME`, config
+  and data directory, holding eight invented Claude Code transcripts and a
+  `claude` that is two lines of shell. **That isolation is the point**: the
+  import screen lists whatever is in `~/.claude/projects`, which in this VM is
+  real agent transcripts, so exercising *delete* against the ordinary server
+  deletes somebody's conversation and exercising *import* starts a real
+  `--resume` on the owner's account.
+  Its port and root derive from the checkout's name, so two checkouts'
+  sandboxes cannot reach each other, and its token is generated once into
+  `~/.config/ai-app/sandbox-token` and carried across restarts along with any
+  the enrolment flow appended — so the emulator app is enrolled **once** (the
+  start banner prints the command) and stays enrolled. It shares the real TLS
+  certificates, because the installed APK pins that CA.
+  Driving verbs, so none of this is re-derived per session:
+  `./ui-sandbox.sh spawn [title]` (an echo session, prints its id),
+  `./ui-sandbox.sh send SID text|@file`, and
+  `./ui-sandbox.sh api /path [curl args]`.
+  `./ui-sandbox.sh keep` restarts the server without wiping the sessions and
+  enrolment already there — for when the fixture under test was expensive to
+  build; plain `start` wipes them, which is right for the list-screen
+  fixtures and wrong for that.
+  It passes `--delay` by default, and `AI_SANDBOX_BIG_MB` puts one large
+  transcript among the small ones while `AI_SANDBOX_SPAWN_DELAY` makes the
+  fake CLI slow to start. Both exist because operations that finish in
+  milliseconds have states on the way that nothing can observe, and an
+  unobservable state is one where broken and working look identical.
+  It also builds a fixture tree at the sandbox home's `~/files` for the
+  explorer, holding the states otherwise only reachable by finding a real
+  machine in one: an empty directory, a name with a tab and one with an
+  apostrophe, a binary file, one over `FILE_LIMIT`, one `chmod 000`, a
+  symlink to a directory and a broken one, a source file per language, and
+  the three sizes the limits were measured against (`edit-32k.rs`,
+  `edit-128k.rs`, `big-source.rs`). Point a session at it with
+  `./ui-sandbox.sh api /sessions/<id>/cwd -X POST -H 'content-type: application/json' -d '{"cwd":"~/files"}'`.
+  The explorer's 409 is produced by editing the file on the machine
+  (`printf … > file`) between pressing the pencil and pressing save.
+- **`app/debug-transcript.sh`** — a real conversation on the emulator. The
+  echo driver is the right rig for most things and the wrong one for anything
+  whose cost scales with what was actually written: a real reply is longer,
+  is real markdown, and carries tool calls whose input and output are
+  kilobytes. Two faults were invisible until a real transcript was loaded — a
+  page of history landing mid-fling threw the reader back to the newest end,
+  and parsing one real reply took 51ms against 4.6ms for a synthetic one.
+  `-b` takes the biggest conversation on the machine rather than the newest,
+  which is what a scrolling test wants; `--stop` takes it down.
+  It copies the transcript into `/tmp` and gives the server a `HOME` of its
+  own, so the import can only see the copy — importing spawns `claude
+  --resume`, and against the real file that is a second CLI writing to a
+  conversation somebody may still be in. **A transcript never goes in this
+  repository**: they hold whatever was said, read and written in that
+  session, and `~/repos` is shared with the host besides.
+- **A fake CLI exercises the process lifecycle without a token.** Point a
+  `claude_cli` provider's `command` at a two-line script — `#!/bin/sh` and
+  `cat > /dev/null` — and it behaves the way the lifecycle code cares about:
+  it holds the fifo open, records a real pid, writes nothing, and dies on a
+  signal. So adopt, stop, restart and start are all drivable without a real
+  `--resume` and without spending a turn on somebody's account. Reach for
+  this when what is under test is *whether a process is running*, and for
+  `debug-transcript.sh` when it is *what the transcript draws*.
+- **`app/transcript-bench.sh`** is the standard scroll measurement: it opens
+  the first session (or `-k` keeps the current screen), scrolls a fixed
+  gesture loop, and prints the app's render report — the same one the in-app
+  copy button produces, whose `on screen:` line names what the viewport was
+  holding. Compare two runs with the same gestures; the emulator's absolute
+  frame times transfer nothing, the report's accounting does. Run it either
+  side of any change under `Markdown*.kt`, `Transcript*.kt` or
+  `SessionScreen.kt`'s list, and put the report in the commit. The numbers
+  that move first are the worst `record: one block`, the reparse mean while
+  streaming, and the draw phase's accounting line.
+- **`app/stream-bench.sh [-k] FILE`** is that measurement for a reply still
+  arriving. It taps "Jump to latest" so the list is pinned to the newest end,
+  resets the report, sends FILE, waits for the transcript to stop growing,
+  and prints. Both of those are corrections to a first version that measured
+  nothing: a transcript parked further back never redraws while a reply
+  streams into it, and a session is idle at *both* ends of a turn, so polling
+  for idle answers before the turn has started.
+- **`app/trace-draw.sh`** names what a scrolling frame spends inside the
+  framework, from `atrace` text output with no trace processor needed. It is
+  how the cost of a layout node per link was attributed to the framework
+  rather than guessed at.
+
+### Driving the UI
+
+**No script that drives this app's UI presses a coordinate.** Every control
+is found by the name it already carries for assistive technology —
+`ui-trace record --do "tap 'Session settings'"` — which resolves the label
+against the screen at the moment of the gesture and fails the whole run when
+it is not there. `app/bench-lib.sh` is what the bench scripts share for it. A
+coordinate is a position measured once by hand, and anything that moves the
+control makes the tap land on whatever now sits there — the bench then
+reports a number that was never measured, which reads exactly like a result.
+Both bench scripts pressed the render report at `tap 723 205` until that
+button moved into the session settings dialog on 2026-09-03. The check that
+none has crept back:
+
+    grep -n "tap [0-9]" app/*.sh
+
+Swipes are still coordinates, deliberately: a gesture across a scrolling area
+is a distance rather than a control.
+
+**Two traps in the emulator bench loop**, each of which cost a run.
+`adb shell pm clear` removes the enrolment and the notification permission
+along with the saved anchors, so the next run measures a permission dialog —
+re-enrol with the command `ui-sandbox.sh` prints, and
+`pm grant … POST_NOTIFICATIONS`. And a saved scroll anchor is per session id,
+so the only way two builds start a scroll from the same place is a *fresh
+session for each*.
+
+**The emulator is `~/repos/emulator-tools`' business, not this repo's.**
+`emu up` creates and boots the AVD named after this checkout — whatever `emu
+name` prints, never a name typed out here, since this file is the same in
+every clone. `run-android.sh` is that plus a build and an install. The `adb`
+on `PATH` after sourcing `android-env.sh` is that repo's wrapper, which fills
+in `-s` from the same rule. Gradle does not go through it, so a Gradle init
+script from `emulator-tools` runs `emu check` before `installDebug`,
+`uninstallDebug` and `connectedAndroidTest` and fails rather than fanning out
+to every attached device; when it refuses, say which device you mean at the
+moment you use it — `ANDROID_SERIAL=$(emu serial) ./gradlew …`.
+
+### Testing llama.cpp and ssh here
+
+The prebuilt CPU llama.cpp lives outside the repo at
+`~/.local/opt/llama.cpp` (the 15 MB `ubuntu-x64` release asset). It needs its
+own directory on `LD_LIBRARY_PATH`, so start the server as
+`LD_LIBRARY_PATH=~/.local/opt/llama.cpp ai-server …` and point a provider's
+`command` at `~/.local/opt/llama.cpp/llama-server`. A 0.6B Q8_0 answers at
+usable speed on this VM's 8 cores. **Do not test with a 2-bit quant**: the
+IQ2_XXS of that model produces fluent nonsense, which reads exactly like a
+broken driver — `llama-cli` produces the same from the file directly, which
+is how to tell the two apart in a hurry.
+
+There is no second machine, so **ssh this VM to itself**: generate a
+throwaway key, append the public half to `~/.ssh/authorized_keys`, and
+configure a host of `bob@127.0.0.1` with `identityFile` pointing at it plus
+`options: ["StrictHostKeyChecking=no", "UserKnownHostsFile=…"]` so it touches
+nothing real. Point a provider's `command` at something harmless like
+`/bin/echo` rather than at `claude`: the transport is what is under test, the
+process exiting immediately is the signal, and it costs no tokens. **Take the
+key back out afterwards.** The remote login shell here is **fish**; the
+remote script and `ssh.rs`'s POSIX quoting happen to mean the same thing in
+both, but that is luck rather than design, and a shell that is neither is the
+thing to suspect first if a remote spawn ever mangles an argument.
+
 ## Where things run (host vs this VM)
 
 The machine itself — the two boxes, the shared `~/repos` mount, and why the
@@ -342,7 +297,7 @@ means here:
 
 - **`ai-server` belongs on the host in production.** That is where the LAN
   address the phone can reach is, and where WireGuard terminates.
-  `wg-machine-host.sh` sets that up (keys, `wg0.conf`, the phone's QR); run it
+  `wg-setup-host.sh` sets that up (keys, `wg0.conf`, the phone's QR); run it
   there with `sudo WG_ENDPOINT=<ddns name>`.
 - **The tunnel and the real phone can never terminate in the VM**, because
   nothing outside can open a connection into it. Phone bring-up is host work.
@@ -375,99 +330,47 @@ day to day:
   keep what a development server spawns. The flag decides only what **new**
   sessions are marked as; what happens on the way out is decided by the
   **mark**.
-- **A llama.cpp router is not cleaned up by any of that**, throwaway sessions
-  included: it belongs to the machine rather than to a session, and a
-  development server that has loaded a model leaves it loaded — gigabytes of
-  VRAM — after `pkill ai-server`. Stop it from the machines tab's provider
-  view, or `pkill -f "[l]lama-server"` when testing.
 - Each session directory holds `process.json`, `stdin.fifo`, `stdout.log` and
   `stderr.log`. `stdout.log` is the driver's input, read from the byte offset
   in `process.json`; removing either by hand while the session is live loses
   output or replays it.
 
-## Auto-resume
+## Importing
 
-**A session switched to it sends itself a message once the account's usage
-limit lifts** — off by default, per session, in the session settings dialog.
-PLAN.md's "Auto-resume" is the design; day to day:
+The import list reports each session's **size as well as its line count**,
+because the two disagree in the way that matters: these transcripts embed
+screenshots as base64, so one line can be a megabyte. On this machine a 69 MB
+session has 3,427 lines and a 44 MB one has 6,792 — nothing about a line
+count tells you what continuing a session will cost. Shown, not warned about;
+importing a large session is a choice somebody is entitled to make.
 
-- **The schedule is a plan to ask.** `resume.rs` wakes at the scheduled time,
-  asks `GET /usage`'s meter for that machine and provider, and only sends when
-  it answers `ok` with nothing at 100%. Anything else — still spent, logged
-  out, unreachable — is a longer wait, and a still-spent window reschedules to
-  the reset time the *meter* now gives.
-- **Test it with echo, never with a real account.** `/limit [minutes]` reports
-  the same `limitReached` event a real driver does, and `/usage 100 5` sets
-  what the meter answers. They are deliberately separate: the two disagreeing
-  is the case the design exists for. `/usage 20` is the limit lifting.
-- The wait is on the session in `config.ron` (`resume`), so it survives a
-  backend restart. A day after the limit was hit it gives up and says so in
-  the transcript.
+**Never import a Claude Code session that is open in a terminal.** The app
+refuses it — see PLAN.md for the incident that made that a refusal rather
+than a warning.
 
-## A session waiting on its own work
+**One Claude Code session id can name two files, and the listing offers it
+once.** Resuming from a different working directory makes the CLI write a
+second transcript with the same id under that directory's project folder — an
+ordinary state of a machine, not corruption. Everything downstream addresses
+a session by id, and the phone keyed its list on it, so two rows sharing one
+**closed the app** on a Compose duplicate-key throw. `parse_listing` keeps
+the copy with the most lines, because the other is usually a few-hundred-byte
+stub and is often the *newer* of the two, so recency is the wrong key.
+Deleting removes every copy rather than the first, or the row came back after
+a delete that reported success. The phone's half is `uniqueItems`, which
+every list keyed on a server-chosen id goes through: a repeat there must
+never be able to close the app, whatever produced it.
 
-Since 2026-09-06 a session whose turn ended with a **backgrounded subagent or
-command still running** reports `waiting` rather than `idle` — its own status,
-drawn as the word "waiting" in `waitingColor` on both screens. `idle` means
-"waiting for a person" and this means the opposite, so it also suppresses the
-"finished" notification, which used to arrive at the one moment it was untrue.
-Two things fall out of it and are easy to get wrong again: the queue and the
-held-command boundary release on **either** end-of-turn status, so a message
-sent while a subagent runs is not held until the subagent finishes; and
-`sessionWorking("waiting")` is deliberately **false** — nothing is being
-written, and the fold uses that same predicate to decide a reply is settled.
-
-- **Nothing subagent-specific goes in the main agent's transcript** unless a
-  subagent sends it a real message that wakes it — which is the peer path, and
-  already has a row. A row per finished background task was tried and was a
-  screenful of dividers about work nobody was asking after, one of them a whole
-  shell command. A subagent's report is its own transcript's closing text and
-  is read in the subcard.
-- **A backgrounded command has no subagent, so its report lands in the tool
-  card that launched it** — a `ToolUpdate` against the call's own id, replacing
-  the launch result that says it is still running. `/background [seconds]` in
-  an echo session is that shape end to end.
-- **Two replies that meet are separated by a `TurnBreak`** — a hairline, no
-  words. The reply that follows a turn boundary is a **new** message: the fold
-  refuses to grow a settled reply, and without that the two ran together
-  mid-sentence. `./ui-sandbox.sh` plus `/subagent 3` or `/background 5` in an
-  echo session is the whole rig; the helpers stagger a second apart so each
-  reply is its own.
-- **Claude's background-task level is authority; two edge sources are the
-  fallback.** Since Claude Code 2.1.261,
-  `background_tasks_changed { tasks: [...] }` replaces the live set and repairs
-  a missed ending edge. Its array size is also the measured `backgroundTasks`
-  count exposed on the session row and event stream; the phone draws a nonzero
-  count beside the status rather than deriving one from `waiting` or from the
-  subagent directory. **What those tasks are is `GET /sessions/{id}/background`**,
-  listed in the session's right panel above the subagents: runtime state, so it
-  is never persisted and `null` -- not an empty list -- is what a session with
-  no process answers. **A task is drawn as the command it ran, and tapping it
-  goes to the call that started it** -- both from the transcript rather than
-  from the provider: a driver reports which tool call its task belongs to and
-  `Session::background_tasks` resolves that id into a seq and, for a provider
-  that says nothing (Codex names a terminal by a process id), the command on
-  the call. The phone travels there with `travelTo`, the same journey a
-  reopened session makes to put a reader back where they stopped. An `ambient` task is dropped from both the list and the
-  count, on the CLI's own instruction: a live-update watcher is not activity,
-  and counting one leaves a session `waiting` for ever. An adopted CLI is sent a repeated `initialize` to ask
-  for the current set. Reconcile only between turns or at a result boundary:
-  a foreground agent is legitimately absent from a background-only snapshot.
-  Older CLIs still need both edge sources: `open_tasks` knows about a
-  backgrounded command, while `Subagents::any_open` finds a subagent whose
-  `task_started` is behind an adopted stdout offset.
-- **A usage limit a subagent hits reaches the session**, not just the
-  subagent's own transcript; auto-resume can only schedule against a session.
-  That is the case where the main agent is idle and a background Task is
-  still burning quota.
-- **Codex's count is two id sets added together.** Open child thread ids come
-  from the subagent registry; live background command process ids come from
-  app-server's experimental `thread/backgroundTerminals/list`. The command set
-  is runtime state, refreshed at lifecycle edges and once a second while
-  nonempty. Never decrement it from an unmatched completion.
-- **The status word and its colour are `sessionStatusWord` /
-  `sessionStatusColour`**, shared by the list and the session screen. They
-  were two `when`s, and the second one silently missed `waiting`.
+**Deleting a session offers to take the machine's own transcript with it** —
+`DELETE /sessions/{id}?deleteForeign=true`, behind a switch in the
+confirmation, and only where the driver keeps a record of its own
+(`keepsOwnTranscript`, which today means Claude Code). Off by default,
+because leaving that copy is what makes an ordinary delete recoverable — and
+the dialog's paragraph is rewritten when it is on rather than appended to,
+since the sentence promising the conversation "should still be there to
+import again" is exactly the one the switch makes false. The server deletes
+the machine's copy *first*, so a machine it cannot reach leaves the session
+where it was instead of half-deleted.
 
 ## Shared appearance
 
@@ -480,136 +383,10 @@ written, and the fold uses that same predicate to decide a reply is settled.
   swallowed the drag along with the tap, so a list could not be scrolled
   while anything in it was busy.
 
-- **A rate-limit bar belongs to a session's provider, not to its machine.**
-  One machine offers echo, the Claude CLI and a local model at once and only
-  the CLI spends anything, so a session says which meter reports on it
-  (`usageProvider`, from `DriverKind::usage_provider`, which
-  `usage::providers_for` reads too so the two lists cannot disagree) and the
-  phone matches a snapshot on machine *and* provider. Nothing meters a llama
-  or echo session, and the phone draws **nothing** for one — not a zero, and
-  not "unknown". Nothing while the first fetch is out either: "checking"
-  under a session that turns out to meter nothing is a row the screen then
-  has to withdraw.
-
 ## Things that have bitten
 
-- **A server started with no `--tools` answers 403 at `GET /tools`, not an
-  empty list.** The route is off rather than empty, so reading that as a
-  failure made "no tools" — the one setting whose entire purpose is to have
-  none — a session that never started. The router is always given
-  `--tools all` now and the choice is a filter here, so this is a trap for
-  whoever next changes how the server is started.
-
-- **`POST /models/load` answers 400 for a model that is already loaded**, and
-  that is the *ordinary* case once one server is shared: a second session
-  naming a model somebody else loaded. The router driver asks what is loaded
-  first and treats "it is there" as the answer whatever the request said.
-
-- **Starting a process from a blocking thread needs the runtime.** Loading a
-  model is minutes of disk, so it runs on a `std::thread` — and tokio's
-  `Command::spawn` registers the child with the reactor, so calling it with no
-  runtime context panics. The panic kills only that thread: the session said
-  `loading` for ever and nothing appeared in the log. `Routers` holds a
-  `tokio::runtime::Handle` and enters it around the spawn.
-
-- **A llama session reports `loading`, and a message sent into it queues.**
-  Before 2026-09-19 the session showed `running` from the moment the process
-  started, so a minute of reading a model off disk was indistinguishable from
-  a minute of thinking -- and anything sent in that window came back as an
-  error, because `llama-server` refuses everything until the model is in
-  memory. `SessionStatus::Loading` is the state. A driver that reports
-  `Loading` owes the holding as well as the word, and **the queue is where it
-  holds**: held inside the turn instead (until 2026-09-20) the message was
-  recorded as read on arrival, so the phone drew it as sent while nothing was
-  reading it, and the turn then folded it out of the transcript *and*
-  appended it, sending it to the model twice. `Shared::await_ready` is now
-  only for a turn whose model was changed under it.
-
-- **A llama turn that says nothing said something that was thrown away.** Two
-  silent endings were found on 2026-09-20 and both looked, on the phone, like
-  a message that was sent and never answered: an `{"error": ...}` chunk
-  arriving mid-stream on an otherwise successful response (a GPU that ran out
-  of memory mid-decode), and a stream that simply stops without its `[DONE]`
-  (the model unloaded under the session). Neither is an ordinary end, and
-  `generate` now fails the turn for both -- a reply that stops early is not a
-  reply, and the transcript keeps whatever arrived before it.
-
-- **`<__media__>` in a llama prompt is a picture, wherever it came from.**
-  llama.cpp takes an image out of the request and leaves that marker in the
-  rendered text, then pairs each marker with a decoded image at tokenize time
-  -- so one in words nobody attached a picture to fails the turn with `number
-  of media markers in text (1) exceeds number of bitmaps (0)`, which reaches
-  the phone as "Failed to tokenize prompt". A model saying it back is enough,
-  and then *every* later message fails too, since the conversation is folded
-  out of a transcript that now holds it. `Message::new` and
-  `Message::from_user` take it out of anything that is text (`without_marker`),
-  which is every message with words in it.
-
-- **A cancel flag is only as prompt as the next place somebody looks.** A
-  llama turn waits on three things that look nowhere at all: a permission
-  question, a tool call `llama-server` is running (a shell command there runs
-  to its own timeout, up to a minute), and the completion itself, which says
-  nothing for as long as the prompt takes to read -- tens of seconds on a long
-  conversation. Setting `cancel` left the turn exactly where it was until
-  whichever it was came back, so Pause did nothing on screen for all of it.
-  **The wait is what ends, not the work**: `awaiting` runs each of those on a
-  thread of its own and `Shared::abandon_turn` answers the wait, so the turn
-  ends in milliseconds (measured 43ms in every state) and the abandoned thread
-  finishes into a channel nobody is reading. Nothing here can stop a shell
-  command or a model mid-reply, and pretending otherwise is what the old code
-  did.
-  **Which is why cancellation is a token per turn** (`Cancel`), not a flag on
-  the session: the abandoned thread wakes up some time later, and a flag the
-  next turn had reset would let it write into a conversation it is no longer
-  part of. Its own token stays set for ever, so it says nothing -- and the
-  open thinking block is closed by `Shared::abandon_turn` rather than by that
-  thread, since the one that knows is not the one that ends the turn.
-
-- **Stop ends a llama session and takes the model with it, if nobody else
-  wants it** (2026-09-21). Until then Stop did *nothing at all* to one:
-  `stop_session` signals the session's recorded process, and `process::stop`
-  refuses a `Shared` record -- so the session sat at `idle` with no sign
-  anything had happened. A `Shared` record now routes to `Driver::stop`,
-  because what stopping means for a session that borrows somebody else's
-  process is the driver's to say. The llama driver ends the turn, says
-  `exited` itself (nothing else will -- there is no process of its own to
-  die), and asks `Router::release`: each live session claims the model it is
-  on, and the model comes out of memory only when the last claim goes. A model
-  another session is using stays.
-
-- **A path is stored as it was typed, and `~` is expanded where it is used.**
-  `~/repos/x` and `/home/someone/repos/x` are a path and a snapshot of where it
-  pointed, and the snapshot is what breaks when an account is renamed or the
-  value is read on another machine -- so nothing at the boundary rewrites one
-  in either direction (`machines::tidy` used to expand and `shorten_home` used
-  to contract; both are gone). Expansion belongs to the machine the path is on:
-  `ssh::quote_path` and `files::PATH_PRELUDE` for a remote one,
-  `ssh::expand_home` for one here. The exception that proves it is
-  **`llama-server`'s tools**, which take the working directory as an
-  `x-tool-cwd` header and `chdir` to it with no shell in the way: a `~` arrives
-  there as a directory of that name and *every* tool using one answers "failed
-  to spawn process\n[exit code: -1]", which on the phone looks like a session
-  whose tools are all broken. `files::resolve_blocking` is what the llama
-  driver resolves it with at launch, on the machine that will serve the
-  session.
-
-- **A transcript outlives the enum.** Removing `Event::TaskNote` hours after
-  adding it made every transcript that had recorded one unreadable, so
-  `launch` failed for those sessions and `SessionManager::new` skipped them —
-  no status, nothing sendable, no new messages, for every live session that
-  had run a background task. **The set of kinds a transcript can hold only
-  ever grows**: a line may come from a newer server or from an older one that
-  wrote a kind since dropped, and one unfamiliar word must never be able to
-  end the file. `Indexed::parse_at` degrades a line it cannot read to
-  `Event::Unreadable { kind }`, keeping its seq — which is what everything
-  downstream is addressed by — and the phone draws it as a placeholder saying
-  which kind. Never delete a variant instead of retiring it; `Event::TaskNote`
-  is what retiring looks like, and the phone folds it to no row.
-
-Project-specific only. A lesson that would bite any project on this machine
-belongs in `~/.claude/MACHINE.md` or the `this-machine-*` skill for its
-subject; one that would bite any project anywhere belongs in the
-`code-lessons` skill, under the admission test at its end.
+Project-specific only — a lesson that would bite any project on this machine
+belongs in `~/.claude/TOOLCHAIN.md` or `~/.claude/MACHINE.md` instead.
 
 - **tracing caches callsite interest process-wide.** A test that hits a
   `tracing::warn!` with no subscriber installed can poison the interest cache
@@ -703,19 +480,6 @@ subject; one that would bite any project anywhere belongs in the
   the reader hit the end of what was loaded on every swipe and stood there
   for a round trip. It is `HISTORY_SCREENS` viewports now, counted from what
   is actually on screen.
-- **A page landing while the history observer was fetching it must trigger its
-  own successor.** The observer once collected only `LazyListState.layoutInfo`;
-  while its collector was suspended in `loadOlderPage`, a compact page could
-  be composed and laid out without leaving another change to observe afterward.
-  Keying the effect on `oldestSeq` still missed the opening prefetch: that key
-  changed while `loadingHistory` was true, so the restarted effect declined to
-  overlap it and never noticed the flag returning to false. Codex exposes both
-  failures because a page full of calls collapses into one tool group: loading
-  stopped until expanding that group forced a layout. The observer now collects
-  the cursor, loading, restoring and failure state with the layout, so returning
-  to not-loading always rechecks the settled height. A failed page turns the
-  history boundary into a Try again control rather than retrying in a loop or
-  requiring another scroll.
 - **Only `fetchTranscript` was off the main thread; the fold was not.**
   `foldEvent` returns a new list per event, so a page is that many copies of
   a growing list — fine at 80 events and about 300,000 element copies at 800,
@@ -723,12 +487,38 @@ subject; one that would bite any project anywhere belongs in the
   shape: the `markdownIn` scan that decides *what* to parse ran before the
   hop to `Dispatchers.Default`. The shape to watch for is a `withContext`
   that wraps the *fetch* and leaves the work done with the result outside it.
-- **A transcript snapshot cannot survive a suspension and then be assigned.**
-  `loadOlderPage` joined its page to `items`, suspended while `warm` parsed
-  markdown, and then assigned the joined snapshot. An SSE event arriving in
-  that gap appeared and vanished; reopening brought it back because the
-  transcript and cache had it all along. Warm against a candidate if needed,
-  then join against the current `items` and assign without another suspension.
-  Also keep the page's original `oldestSeq`: a stream reset while the fetch or
-  warm is suspended makes the page stale, and it must be discarded rather
-  than joined into the reset window.
+
+## Measurements worth not re-taking
+
+- **What the transcript screen costs to scroll.** Taken 2026-08-30 on the GPU
+  emulator against a real imported transcript with the server at
+  `--delay 120`. Settled and flinging fast, both into fresh history and back
+  through rows already drawn: **5.2–5.9% janky frames, 99th percentile
+  29–32ms, 0–2 slow UI-thread frames.** The stock Settings app on the same
+  device is 3.3% and 38ms, so this is at the platform floor. The number that
+  is *not* at the floor is the first few seconds after opening a session,
+  where every row on the way is being composed for the first time; that is
+  inherent to a lazy list and it is why a measurement taken before the screen
+  settles reads three times worse. **Settle first, then reset `gfxinfo`.**
+- **The reset path is not reachable by reopening a session.** Measured
+  2026-09-04 against a session streaming at 20 events a second: reopening one
+  with an anchor 1,800 events back connects **87–119 events behind**, well
+  under `CATCH_UP_LIMIT`'s 200, because the restore is two requests — the
+  opening page, then one span covering the whole distance. To exercise the
+  reset at all you have to lower `CATCH_UP_LIMIT` in a throwaway build; at 5
+  the app takes the reset on a live connection, clears, refills and carries
+  on without reconnecting.
+- **The session screen's stream survives backgrounding here** — 20 seconds at
+  the launcher while 415 events were produced brought no reconnect at all,
+  which is not what the comment above that loop expects, and is most likely
+  this emulator being headless rather than the phone's behaviour.
+- **Reopening a cached session costs one request for one event** (the probe),
+  and scrolling the whole conversation back costs nothing more; a cold open
+  of the same 500-event session is two pages, 100 events. Measured
+  2026-09-04 on the emulator against the sandbox.
+- **Reading is cheap and editing is not.** The viewer handles a 1 MiB,
+  28,000-line file because it draws one row per line; the editor is one
+  `BasicTextField`, which costs two seconds a frame at 128 kB and stops the
+  app at 1 MiB, so `EDIT_LIMIT` caps it at 32 kB with the reason said on
+  screen. If you make the editor faster, that number is what to move.
+  EXPLORER.md's "What the measurements said" has the rest.

CLIENT_CORE.md

@@ -0,0 +1,130 @@
+# client-core
+
+`client-core/` is the app's pure logic held once instead of twice, per
+RUST.md's recommendation item 1. It is a plain Rust library crate with no UI
+framework dependency of any kind, so it can outlive whichever one the app
+ends up drawing with (Masonry, iris, or something else -- see RUST.md).
+`event-model/` is its sibling: the wire shape both this crate and `server/`
+share, extracted from `server/src/session/driver.rs` and
+`session/transcript.rs` on 2026-09-04.
+
+Neither crate is wired into anything yet. `server/` re-exports `event-model`
+so its own behaviour is unchanged (`./run-tests.sh` covers it); `client-core`
+has no caller -- it exists for whichever experiment in RUST.md picks it up
+next (a Masonry or iris transcript screen, most likely).
+
+## What's here, and what Kotlin file it replaces
+
+| `client-core/src/…`                     | Kotlin original                          | Status |
+|------------------------------------------|-------------------------------------------|--------|
+| `event-model/src/lib.rs` (shared crate)   | `Events.kt` (the enum mirror)             | Done   |
+| `ansi.rs`                                 | `Ansi.kt`                                 | Done, ported test-for-test |
+| `highlight/mod.rs`, `languages.rs`        | `Highlighter.kt`, `Languages.kt`          | Done, ported test-for-test |
+| `highlight/markdown.rs`                   | `MarkdownSyntax.kt`                       | Done, ported test-for-test |
+| `transcript_cache.rs`                     | `TranscriptCache.kt`                      | Done, ported test-for-test |
+| `sse.rs`                                  | `Sse.kt` (the framing half)               | Done, new tests (Kotlin had none of its own beyond integration) |
+| `api.rs`                                  | `Api.kt`                                  | Partial -- see below |
+| `event_stream.rs`                         | `EventStream.kt`                          | Done |
+| `transcript_fold.rs`                      | `TranscriptItems.kt`, `ToolRows.kt`       | Partial -- see below |
+| *(not started)*                           | `TranscriptSource.kt`                     | Not started |
+| *(not ported, and may never be)*          | `TranscriptUnits.kt`                      | Out of scope -- see below |
+
+Every file above whose Kotlin counterpart had a JVM unit test (`AnsiTest`,
+`HighlighterTest`, `TranscriptCacheTest`) has had every one of those test
+cases ported alongside it, plus new tests for the pieces that had none
+(`sse.rs`, `api.rs`, `event_stream.rs`, `transcript_fold.rs`). Test count by
+crate as of this writing: **85 in `client-core`**, 0 in `event-model` (its
+types carry no logic of their own to test -- `server/`'s own tests exercise
+them via `session::transcript`'s round-trip coverage).
+
+## Correspondence notes worth knowing before touching either side
+
+- **`ansi.rs`'s `StyledText`/`Style`/`Rgb`** stand in for Compose's
+  `AnnotatedString`/`SpanStyle`/`Color`, since this crate has no Compose.
+  `StyledText` is plain text plus a `Vec<(Range<usize>, Style)>` of
+  non-overlapping spans. Whatever UI framework ends up consuming this
+  crate maps `Style` onto its own text-styling type; nothing here should
+  change to accommodate a particular one.
+- **`highlight`'s `Span`/`Kind`** use **char indices, not byte offsets**
+  (`Vec<char>` internally), mirroring the Kotlin original's `Char`-indexed
+  strings. `highlight::span_text` turns a `Span` back into text for a
+  caller working the same way; a caller that wants byte offsets into a
+  `&str` has to convert.
+- **`transcript_cache.rs`'s `SessionCache::guard`** found a real
+  translation bug while it was being written: an early draft let a
+  *damaged* chunk (one file unreadable, discard just this session) and a
+  genuine I/O failure (disk gone, disable the whole cache) both surface as
+  the same `Err` from one closure, which would have disabled every
+  session's cache over a single corrupt chunk. Fixed by checking a
+  thread-local "was this damage" flag before deciding which failure mode
+  it was -- see the comment on `guard` and the commit message for
+  `transcript_cache.rs`.
+
+## What `api.rs` covers, and what it does not yet
+
+`ApiClient` wraps a `Transport` trait (network I/O kept out from behind, so
+`ApiClient` and `event_stream::follow_session_events` are tested with a
+fake transport and no server). `UreqTransport` is the only real
+implementation, backed by `ureq` -- see its Cargo.toml comment for why
+(blocking, already a project dependency, no extra TLS crate needed since
+`ureq::tls::Certificate::from_pem` reads the pinned CA directly).
+
+Covered: session list/read, message send, unqueue, answer, interrupt,
+stop, start, rename, cwd, model, permission-mode, notify, command,
+compact, delete, and one transcript page.
+
+**Not covered, and each is real work rather than a stub to fill in:**
+setups (`/setups*`, machine and provider discovery), the file explorer
+(`/setups/{id}/dir|file`), usage (`/usage`), models
+(`/models*`, HuggingFace browsing and downloads), attachments
+(`/sessions/{id}/attachments`), importing (`/setups/{id}/importable*`),
+and the `/notifications` stream. `server/src/routes.rs`'s module doc is
+the full table to work from when one of these is next.
+
+## What `transcript_fold.rs` covers, and what it does not yet
+
+`fold_event` covers every `Event` variant server/ can produce today,
+including tool-call/question/image attachment and peer-message placement.
+`group_tool_runs` groups adjacent calls into `TranscriptRow::Tools`.
+
+**Not ported:** `TranscriptItems.kt`'s `joinPages` (and its
+`healSplitMessage`/`adoptRun` helpers) -- the page-boundary healing that
+merges a tool call split across two fetched pages and re-merges a run a
+boundary cut through. This matters the moment paging backward through
+history is exercised; it is deliberately left rather than rushed, since
+it is exactly the kind of boundary logic this project's own "things that
+have bitten" section warns reads fine and is wrong at the edges.
+
+**Known gap, and a decision for whoever closes it:** `event_model::Event`
+has no `Unknown`/catch-all variant, unlike `Events.kt`'s hand-kept mirror.
+A server newer than this build that adds an event type will fail to parse
+that line rather than degrading to a placeholder row. Closing this means
+deciding how `event_model` itself represents "a shape I don't recognise"
+-- a shared-model decision affecting `server/` too, not a `client-core`-only
+fix, so it is recorded here rather than silently worked around.
+
+## What is not started at all
+
+- **`TranscriptSource.kt`** -- the layer that decides whether a page comes
+  from the transcript cache or the server, and stitches the two. Needs
+  `transcript_cache.rs` and `api.rs`'s transcript-page method, both of
+  which exist now, so this is unblocked whenever picked up.
+- **The markdown *block* model beyond syntax spans** -- `highlight/markdown.rs`
+  colours a `.md` file or fence for the highlighter, but does not build the
+  block tree (headings, lists, tables, fences as distinct nodes) that a
+  renderer walks to lay out prose versus code versus a table.
+  `CodeFence.kt`'s use of `org.intellij.markdown` for that full CommonMark
+  AST is Compose rendering plumbing, not something to port as-is; a Rust
+  UI layer will want its own block parser or a crate for it, decided
+  alongside the framework choice in RUST.md.
+- **`TranscriptUnits.kt`** (see above) -- deliberately out of scope, since
+  it flattens a row into bounded units for a *specific* lazy-list
+  framework's composition cost, which is a fact about that framework
+  rather than about the transcript.
+
+## Verifying
+
+`./run-tests.sh` from the repo root now runs `event-model`, `client-core`
+and `server` in that order (each `cargo test`, forwarding arguments the
+same way it always has). From `client-core/` directly: `cargo test`,
+`cargo clippy --all-targets`, `cargo fmt` -- all clean as of this writing.

DECISIONS.md

@@ -1,44 +0,0 @@
-# Decisions awaiting review
-
-Choices made while working autonomously, for Bryan to keep or change. Each
-says what was picked and why; the detail is in the design doc it names.
-Delete an entry once it has been looked at.
-
-## Subagent views (2026-09-05, `SUBAGENTS.md`)
-
-Made on my own judgement, limited blast radius:
-
-1. **A subagent is a transcript, not a session.** It has no process,
-   controls or settings; it is addressed as `/sessions/{id}/subagents/{sub}`
-   and stored under the session's directory, so deleting the session takes
-   it. Alternative rejected: registering it as a session of its own, which
-   would give it a card in the main list and a driver that can do nothing.
-2. **Read-only view is the session screen minus its controls**, rather than
-   a second, simpler transcript screen. Keeps paging, caching, selection
-   and rendering in one place. Cost: a `readOnly` mode threaded through
-   `SessionScreen`.
-3. **The list only carries a count.** Each session row says how many
-   subagents it has; their titles and statuses are fetched when the card is
-   expanded. Keeps `GET /sessions` from reading every subagent transcript.
-   Consequence: an expanded card's statuses refresh with the list, not live.
-4. **Expanded/collapsed is remembered per session on the phone**, not on
-   the server. Collapsed by default, per the transcript convention that new
-   things arrive collapsed.
-5. **Subagents of imported sessions are not shown.** The import path still
-   skips `isSidechain` records; the CLI's own `subagents/agent-*.jsonl` files
-   are not read. Only subagents run while this backend was watching exist.
-6. **Echo grows `/subagent [n]`** as the test rig, so nothing here needs a
-   paid turn to exercise.
-
-Deferred, because they reach further than this feature:
-
-- **Live status on the list.** Whether the session list should follow a
-  stream at all (it refreshes on demand today) decides whether subagent
-  status can ever be live there. Not changed.
-- **Nested subagents.** A subagent's own Task calls are shown as tool calls
-  in its transcript and are not given transcripts of their own. Supporting
-  that is the same mechanism one level down, but the UI would need nested
-  expanders.
-
-- **The subagent status row says "context unknown".** Nothing measures a
-  subagent's context; the row could leave it out rather than admit it.

EXPLORER.md

@@ -14,7 +14,7 @@ AGENTS.md. `server/src/files.rs` is the backend and `FilesScreen.kt` /
 ## What it is, in one paragraph
 
 A machine's filesystem, seen from the phone through the backend. The explorer
-belongs to a **machine** (a machine), not to a session: a session only says
+belongs to a **setup** (a machine), not to a session: a session only says
 where to start. Every operation — list, read, write, create — is one shell
 script run through `Transport`, exactly the way the import listing and the
 usage fetch already work, so the local and the ssh case are one
@@ -25,30 +25,18 @@ message. The phone draws what came back.
 
 ### 1. Keyed on the machine, opened from the session
 
-Routes live under `/machines/{id}/…`, beside `importable`, because a filesystem
+Routes live under `/setups/{id}/…`, beside `importable`, because a filesystem
 is a property of a machine. The session screen's folder button opens the
-explorer with the session's machine and its `cwd`; a session with no `cwd`
+explorer with the session's setup and its `cwd`; a session with no `cwd`
 opens at the machine's home, which the **machine** resolves (`cd` with no
 argument and `pwd -P`), never a path the phone guessed. Nothing in the
-explorer knows what a session is, so a later entry point from the machines tab
+explorer knows what a session is, so a later entry point from the setups tab
 is one more caller and no new code.
 
 Rejected: routes under `/sessions/{id}/`. The session would be a detour to
-find the machine, and "browse this machine" from anywhere else would need a
+find the setup, and "browse this machine" from anywhere else would need a
 session to exist first.
 
-The third caller arrived 2026-09-21 and cost no code here, which is the
-property this decision was made for: **View raw** in the session settings
-dialog opens the explorer on the session's own transcript file
-(`fileTarget`), so the record can be read as it is on disk rather than only
-as the conversation drawn from it. The session says where the file is
-(`transcriptFile` on `GET /sessions/{id}`) because only the backend knows --
-and it names **this backend's** machine rather than the session's, which for
-a remote session are two different filesystems. Back from the file lands in
-the session's own directory, where the log and the process record are.
-A transcript past `FILE_LIMIT` is refused the same way any other large file
-is, which is the known limit of this as a debugging tool.
-
 ### 2. One shell script per operation, over `Transport`, on both transports
 
 Each operation is a small POSIX script handed to `sh -c script sh "$path" …`
@@ -80,7 +68,7 @@ Elsewhere the phone picks an **id** and the server resolves which file it
 names, so an enrolled token cannot become "read me an arbitrary file". The
 explorer's whole purpose is the path, so it takes one. Recorded in PLAN.md's
 Security section in these terms: the token already gates spawning a
-bypass-permissions agent in any directory on any configured machine, and
+bypass-permissions agent in any directory on any machine a setup names, and
 that agent can already read and write every file its user can. The explorer
 is a shorter path to authority the token already holds, not new authority.
 The import rule stands where it is, because there a path was unnecessary and
@@ -94,14 +82,13 @@ writing are fixed scripts; the phone chooses only the path and the bytes.
 Same rule as `POST /sessions/{id}/cwd`, with the same wording, because where
 a relative path would be depends on something the reader cannot see. Every
 listing answers with `pwd -P` of the directory it listed, so the phone
-navigates on a resolved absolute path. The phone also resolves `~` through the
-same route, then shortens that directory and every path beneath it back to
-tilde notation for display; it never guesses where a local or ssh user's home
-is. The phone never resolves `..` itself.
+navigates on a resolved absolute path — the parent is a string operation on
+that, and a `~` the session was spawned with is shown as what it turned out
+to be. The phone never resolves `..` itself.
 
 ### 5. A read is capped and typed, and every state it can be in has a word
 
-`GET /machines/{id}/file` answers with one of `text` (content, size, mtime,
+`GET /setups/{id}/file` answers with one of `text` (content, size, mtime,
 sha256), `binary` (not UTF-8; size reported, nothing shown), `tooBig` (over
 `FILE_LIMIT`, 1 MiB; size reported so the reader knows what they are looking
 at), or the machine's own error.
@@ -114,7 +101,7 @@ what it is.
 
 ### 6. A write is conditional on what the reader saw
 
-`PUT /machines/{id}/file` carries the sha256 the read reported. The script
+`PUT /setups/{id}/file` carries the sha256 the read reported. The script
 compares it against the file as it is now and exits distinctly if it differs;
 the server answers **409**. Agents edit files while people read them; this is
 the common case, not the exotic one, and silently overwriting an agent's edit
@@ -135,9 +122,9 @@ precondition is fresh without a second read.
 
 ### 7. Create refuses to overwrite
 
-`POST /machines/{id}/file` runs under `set -C` (noclobber) and `: > "$1"`, so a
+`POST /setups/{id}/file` runs under `set -C` (noclobber) and `: > "$1"`, so a
 name that exists fails with the shell's own message rather than truncating
-somebody's file; `POST /machines/{id}/dir` is `mkdir --` with the same
+somebody's file; `POST /setups/{id}/dir` is `mkdir --` with the same
 property. The modal names one thing in the current directory and has a switch
 for "directory"; a created file opens straight into edit mode, because an
 empty file is not something to look at.
@@ -221,21 +208,17 @@ absence the signal. Back with unsaved changes asks, and says the edits will
 be lost. The explorer draws over the session, which deliberately has no
 `imePadding`, so the explorer's own box adds it.
 
-### 10. The explorer draws over the session, and back follows what is open
+### 10. The explorer draws over the session, and back closes it first
 
 `Screen.Session` in `AppRoot` gains a `files: FilesTarget?`. When set, the
 `FilesScreen` is composed **on top of** the session in the same `Box`, and
 the session stays composed under it: its event stream keeps flowing, its
 scroll position and draft stay where they were, and returning from a file
-costs nothing. From an open file, both the header's back button and Android back
-return to its containing directory. From a directory, the header's back button
-clears `files` and returns to the session. Android back instead walks toward the
-session's project directory: upward to the common ancestor, then down one path
-segment per press, and at the project it returns to the session. This makes
-Back from `/etc` visibly travel through `/`, `/home`, and onward to a project
-under `~/repos`, rather than leading away from it. The `..` row remains explicit
-parent navigation. An editor with unsaved changes asks before either route
-discards them. "Back returns; it does not exit."
+costs nothing. Back — the button and the platform gesture — clears `files`
+when set and goes to the list otherwise. Inside the explorer the same back
+steps one level: editor → viewer (with the unsaved question) → listing →
+parent directory, and only from the starting directory does it close. "Back
+returns; it does not exit."
 
 Rejected: a `Screen.Files` beside `Screen.Session`. Every route back from a
 leaf screen goes to Main today, and a session disposed and re-created on each
@@ -284,18 +267,6 @@ The speedometer went; the report is a "Copy render timings" row in
 already are. **Moving it is where the no-coordinate-taps rule got enforced**
 (Bryan, 2026-09-03) — see AGENTS.md's "Driving the UI".
 
-### 14. File links in a session open in the explorer
-
-A markdown destination that is an absolute path or a local `file:` URI opens that document in the
-session's explorer, on the session's machine. A trailing editor line and optional column are removed;
-the viewer opens the file but does not yet scroll to a line. Web links, relative links and `file:`
-URIs naming another host keep their ordinary external behaviour. The distinction is deliberately
-narrow: a relative link might be a web reference, and the phone must not silently reinterpret it as
-a path on another machine.
-
-The markdown link handler is provided around the session rather than taught about machines. That
-keeps the renderer reusable and makes the explorer's existing machine target the one navigation path.
-
 ## HTTP surface
 
 In `routes.rs`'s module doc with the rest. Bodies use `deny_unknown_fields`

IRIS.md

@@ -0,0 +1,110 @@
+# iris: notable public API changes
+
+For Iris to read on her own time. Each entry is a change to iris's public
+surface that a widget author or app author would notice: a trait method
+added, removed or re-shaped; a type that callers construct differently; a
+capability that moved. Small and trivial changes do not go here.
+
+An entry gives the date, what changed, why, and a short before/after where
+it helps judge the change without the session that made it. Newest first.
+
+## 2026-09-05: a second backend (android-view), and what moved to make room for it
+
+RUST.md's I2. Three changes a widget or app author would notice, all in
+service of the same thing: `default` (winit) and the new `android`
+(android-view) backends sharing what does not depend on windowing.
+
+- **`Selector`/`Selectable`'s bound changed from `Rsc::State:
+  HasDefaultUiState` to `Rsc::State: FocusHost`** (new trait, `attr.rs`).
+  `HasDefaultUiState` still exists and still works — `default/attr.rs` now
+  implements `FocusHost` for anything that has it — so a winit app's
+  existing code is unaffected. An Android app implements `FocusHost` via
+  `HasAndroidUiState` instead. Affects only an app that referenced
+  `HasDefaultUiState` directly at a `Selectable`/`Selector` call site
+  rather than through `.attr::<Selectable>(())`, which nothing in-tree
+  does.
+- **`Tasks::init` takes `Arc<dyn RequestRedraw>` instead of
+  `Arc<winit::window::Window>`.** `RequestRedraw` (`task.rs`) is one method,
+  `fn request_redraw(&self)`; `winit::window::Window` implements it
+  (`default/render.rs`), so `Tasks::init(window)` at a call site is
+  unchanged by inference. Only matters if something constructed a `Tasks`
+  directly rather than through `DefaultRsc`/`AndroidRsc`.
+- **`TextEdit::apply_event`/`TextInputResult` are `#[cfg(not(target_os =
+  "android"))]`** — they take a `winit::event::KeyEvent`, which does not
+  exist on Android; `android/input.rs` drives the same primitives
+  (`backspace`/`delete`/`motion`/`insert`, all still unconditional) from
+  `ndk::event::Keycode` directly instead. New unconditional getters on the
+  way: `TextEdit::text()`/`selection_range()`/`caret()`, and
+  `TextEditCtx::delete_byte_range`/`set_cursor_byte` — the primitives
+  `android/ime.rs`'s `InputConnection` bridge needed and that were not
+  previously exposed publicly.
+
+## 2026-09-04: `Widget::draw` reports the size it used; `desired_width`/`desired_height` are gone
+
+A widget used to implement three methods (`draw`, `desired_width`,
+`desired_height`); it now implements one, `fn draw(&mut self, painter: &mut
+Painter) -> Size`, which draws into `painter.region()` and returns how much
+of it was used. Why: the two extra methods routinely re-simulated what
+`draw` was about to do anyway (`Span::desired_ortho` copied its own draw
+loop to get cross-axis sizing right) — one visit per widget per frame
+instead of up to three. A container that needs a child's size before
+placing it (alignment, centering) draws the child once at a provisional
+region, reads the returned `Size`, and calls the new `Painter::reposition`
+to move it into its final spot — an O(1) offset write, not a second draw. A
+widget whose drawn output never depends on the size it's given (a
+fixed-size `Rect`, a decoded `Image`) overrides the new `fn
+is_size_independent(&self) -> bool { false }` to `true`, which skips
+redrawing it when only its offered region changes shape.
+
+```rust
+// before
+fn draw(&mut self, painter: &mut Painter) { /* ... */ }
+fn desired_width(&mut self, ctx: &mut SizeCtx) -> Len { /* ... */ }
+fn desired_height(&mut self, ctx: &mut SizeCtx) -> Len { /* ... */ }
+
+// after
+fn draw(&mut self, painter: &mut Painter) -> Size { /* ... */ }
+```
+
+`SizeCtx` and `Cache` are gone with it — see `LAYOUT.md` for the full
+design, the move-offset mechanism this shipped alongside, and the file
+list.
+
+## 2026-09-04: texture pipeline rebuilt off the binding array
+
+`Textures`/`TextureHandle`, `GlyphPrimitive`, and `UiRenderNode::new` all
+changed shape. Why: the old pipeline bound every texture ever drawn in one
+`binding_array<texture_2d<f32>>` and asked every device, unconditionally,
+for `VK_EXT_descriptor_indexing` — a real share of Android GPUs lack it,
+and it failed outright on the Android emulator's software Vulkan. See
+TEXTURES.md's "Recommended shape" and "Implemented, 2026-09-04".
+
+- **`UiRenderNode::new` drops its `limits: UiLimits` parameter, and
+  `UiLimits` is gone.** Before: `UiRenderNode::new(&device, &queue,
+  &config, UiLimits::default())`. After: `UiRenderNode::new(&device,
+  &queue, &config)`. Nothing replaces it — there are no more
+  binding-array limits to size.
+- **`src/default/render.rs`'s device request asks for no features and no
+  binding-array limits.** Before: `required_features:
+  Features::TEXTURE_BINDING_ARRAY | Features::PARTIALLY_BOUND_BINDING_ARRAY
+  | Features::SAMPLED_TEXTURE_AND_STORAGE_BUFFER_ARRAY_NON_UNIFORM_INDEXING`
+  plus two `max_binding_array_*` limits. After: `Features::empty()` (the
+  `DeviceDescriptor` default) and only `max_buffer_size` set, which was
+  never about the binding array.
+- **`TextureHandle` has no `primitive()` method any more**; a caller
+  outside `iris` shouldn't have been calling it (it fed the old renderer's
+  internals), but if something did: use `image_index()` for a standalone
+  image's bind-group index. There is no equivalent for a page — a page has
+  no bind group of its own now, see below.
+- **`GlyphPrimitive` has no public constructor from a struct literal.**
+  Before: `GlyphPrimitive { uv_min, uv_max, view_idx, sampler_idx, color,
+  flags }`. After: `GlyphPrimitive::new(uv_min, uv_max, layer, color,
+  flags)` — one `layer` (the shared atlas array's layer) instead of a
+  `view_idx`/`sampler_idx` pair, since a page is now a layer of one array
+  texture rather than its own bound texture.
+- **A widget author drawing images is unaffected**: `Painter::texture`/
+  `texture_at`/`texture_within` and `Textures::add` keep their signatures.
+  What changed underneath is that each standalone image now gets its own
+  `wgpu::BindGroup` and draw call instead of a slot in the shared array —
+  invisible from the widget API, visible only in `UiRenderNode`'s internals
+  and in `iris`'s device requirements.

IRIS_TODO.md

@@ -0,0 +1,170 @@
+# iris: known problems and things still to build
+
+Iris's own list for the library, recorded 2026-09-04 in her words where it
+matters, so the agents working through RUST.md pick these up in a sensible
+order rather than rediscovering them. Each item says where it sits in the
+order and what "done" looks like. Tick and date them in place.
+
+## Fix
+
+- [x] **Input does not fall through by input type (2026-09-04).**
+  `SensorUi::run_sensors` (`src/default/sense.rs`) used to set "consumed,
+  stop checking lower layers" from mere hover — a widget registered for
+  nothing but `click()` blocked a `Scroll` meant for whatever was behind
+  it, since "the cursor is over this widget" and "this widget handled the
+  event" were the same check. Fixed by judging consumption per input
+  kind: with no button transition and no scroll happening this frame
+  ("momentary" activity), the topmost hovered widget still wins, same as
+  before; when something momentary *is* happening, only a widget whose
+  registered senses actually include a matching non-hover one (checked
+  via a new `TypeEventManager::registered`, which lists what a widget
+  registered without running anything) consumes it, so a widget with only
+  `Hovering`/click handlers can no longer block a scroll from reaching a
+  list underneath. `iris/src/sense_tests.rs` builds a button-over-a-list
+  `Stack` with a plain `HasEvents` impl (no GPU or window) and checks both
+  directions: a scroll over the button reaches the list, and a real click
+  still reaches the button — confirmed to fail on the pre-fix code and
+  pass after.
+
+- [ ] **Appending one image to an already-loaded list rebuilds every other
+  image's bind group (2026-09-05).** Found by the benchmark below, not
+  designed against: `GpuTextures::update` (`core/src/render/texture.rs`)
+  triggers `rebuild_image_bind_groups` — a loop over *every live
+  standalone image*, rebuilding its `BindGroup` — whenever the shared
+  `masks` or `move_offsets` GPU buffer is resized (`masks_resized ||
+  moves_resized` in `UiRenderNode::update`, `core/src/render/mod.rs`), and
+  a widget getting its *first* move-offset slot (LAYOUT.md section 2 —
+  every widget gets one on first draw) can be exactly what grows that
+  buffer. So one new message with one new image, appended to a transcript
+  that already has N images loaded, does not cost O(1): it costs one
+  `create_image` for the new image plus one `make_image_bind_group` per
+  *existing* image, because the new widget's own move slot pushed the
+  arena past its capacity. Measured directly in
+  `iris/examples/bench_images.rs`: appending a 1,001st image to 1,000
+  already-settled ones reports **1,001** bind-group creates for that one
+  frame, not 1 (`./run-bench.sh images`, frame 5 in the transcript below).
+  This is the same class of cost LAYOUT.md's move chain exists to avoid
+  elsewhere in the codebase, just not yet closed off here — the fix is
+  presumably to size `masks`/`move_offsets` with headroom (the array
+  texture already grows by doubling, `grow_array`, for the same reason) so
+  an ordinary append does not cross a capacity boundary, or to stop tying
+  the *image* bind group's contents to a buffer that changes on every new
+  widget in the whole tree, image or not. Not designed further here per
+  the "do not redesign, record it" instruction this benchmark was built
+  under.
+- [ ] **Bind-group creation takes two frames to reach the steady state, not
+  one (2026-09-05).** Same benchmark: loading 1,000 images cold reports
+  1,000 creates on frame 1 (expected — this is `create_image`, one per
+  new image) *and again* 1,000 on frame 2, with nothing between the two
+  frames marked dirty, before settling to 0 from frame 3. The second
+  frame's 1,000 is `rebuild_image_bind_groups` again, for the same
+  masks/move-offsets buffer-growth reason as the item above — the arena
+  apparently does not finish growing to its steady size within the first
+  frame the tree is drawn. Not chased further; recorded so whoever fixes
+  the item above checks whether the fix also closes this one, since they
+  look like the same root cause measured two different ways.
+
+## Build
+
+- [x] **Benchmarks**, not unit tests, run on demand (2026-09-05; a
+  `benches/` or a script under `iris/`, never in `cargo test`). The
+  scenario that matters most is a **message list** — chat apps and this
+  app's transcript alike — stressed with many messages and many images.
+  One case in particular: **resizing an input box** (typing enough text to
+  grow it) that pushes a long list of messages above it must stay very
+  fast and recalculate almost nothing — a move of everything above, not a
+  re-layout. That is exactly the O(1) move chain in LAYOUT.md; the
+  benchmark is what proves it. Done when the numbers are in this file with
+  the command, and the input-box case reports draws re-run, not just frame
+  time.
+
+  **Built as two rigs**, chosen per scenario by whether a real `wgpu`
+  device is needed (`UiRenderState`/`Widgets` touch no GPU or window, so
+  most of this runs as an ordinary binary — the same property
+  `layout_tests.rs` relies on):
+
+  - `iris/benches/message_list.rs` — a plain `Instant`-timed binary
+    (`[[bench]] harness = false` in `iris/Cargo.toml`), not criterion: see
+    the file's own header for why (short version — every scenario here
+    reduces to a *count* `UiRenderState::take_counters` already produces,
+    which criterion's statistical machinery adds nothing to and which a
+    new dependency is not worth pulling in for). Covers (a) first-frame
+    cost of a message list of N wrapped-text rows (one in 20 also carrying
+    a small in-memory image) for N = 100/1,000/10,000; (b) per-frame cost
+    of scrolling that list, 200 ticks; (c) the input-box case — a
+    fixed-height field at the bottom of the screen growing by a line 40
+    times, with the message list above it filling the rest of the screen.
+    Run: `cd iris && cargo bench --bench message_list` (always release —
+    `cargo bench` builds the `bench` profile, which is optimized).
+  - `iris/examples/bench_images.rs` — needs a real device, so it runs
+    through `iris/run-headless.sh bench_images`, printing
+    `UiRenderNode::take_image_bind_group_creates()` (a new counter, added
+    in `core/src/render/texture.rs` and `core/src/render/mod.rs`,
+    mirroring `UiRenderState::take_counters`) each frame. Covers (d): 1,000
+    image rows, checked both cold (does bind-group creation reach zero
+    once loaded) and after appending one more image once settled (does
+    *that* stay cheap) — the second question is what actually matters for
+    a live transcript and is what turned up the two Fix items above.
+  - `iris/run-bench.sh [list|images]` runs either or both and is what to
+    run before/after touching `Scroll`, `Span`, `Sized`, the move-offset
+    chain, or `GpuTextures`.
+
+  **Numbers (2026-09-05, release, `cargo bench`/`run-headless.sh`, this
+  VM: AMD Ryzen 7 3800X, 8 cores, rustc 1.98.0 nightly-2026-09-03):**
+
+      cd iris && cargo bench --bench message_list
+      (a) first frame, N=100:    30.30ms  draws=227   rewrites=15   moves=0
+      (a) first frame, N=1000:  186.04ms  draws=2252  rewrites=150  moves=0
+      (a) first frame, N=10000:1770.36ms  draws=22502 rewrites=1500 moves=0
+      (b) scroll, N=100/1000/10000, 200 ticks each:
+          draws=200 rewrites=0 moves=200 (identical at every N)
+          per-tick average: 0.0002ms (identical at every N)
+      (c) input grows 40 lines, N=100/1000/10000 rows above it:
+          draws=320 rewrites=40 moves=160 (identical at every N)
+          per-line average: 0.0012-0.0013ms (identical at every N)
+
+      cd iris && ./run-bench.sh images
+      frame=1 bind_group_creates=1000   (cold load)
+      frame=2 bind_group_creates=1000   (see Fix item above)
+      frame=3 bind_group_creates=0
+      frame=4 bind_group_creates=0
+      (append one image here)
+      frame=5 bind_group_creates=1001   (see Fix item above)
+      frame=6 bind_group_creates=0
+
+  **Reading it**: (a) is real, necessary work — shaping and laying out N
+  never-before-seen text rows — and scales with N as it must, ~10x cost
+  per 10x N. (b) and (c) are the pass conditions that matter: both are
+  **exactly flat across N = 100 to 10,000**, confirming LAYOUT.md's O(1)
+  move chain holds for both scrolling and for a growing input box pushing
+  the message list — draws/moves per tick or per line do not grow with
+  list size, and the per-operation cost (a fraction of a microsecond) is
+  nowhere near a frame budget. (d)'s cold-load and steady-state halves
+  behave as designed; its *append* half did not, which is the two Fix
+  items above.
+- [ ] **Masks defined relative to each other.** Wanted: mask A multiplies
+  by something *and also* applies mask B — a mask can reference a parent
+  mask, the way the move chain references a parent offset. Today masks
+  are independent regions. Design it beside the move chain (same shape:
+  a parent index and a bounded walk in the shader); do it when a real
+  widget needs it, not before.
+- [ ] **Positions as a single float per scroll.** Iris raised, and half
+  rejected, letting a scroll update one float rather than positions:
+  input handling cares about most elements in a list, so absolute
+  positions must be computed on the CPU anyway. LAYOUT.md's design
+  already lands here (GPU walks the chain, CPU resolves on demand for
+  hit tests). Keep the CPU resolution lazy and per query; do not
+  materialise every row's absolute position per frame.
+- [ ] **Animations, last.** Cosmetic, so after everything above. Must be
+  **modular — a piece of the library rather than a core part forced into
+  everything, the same way input is**. Whatever the mechanism, a widget
+  that does not animate must pay nothing and import nothing for it.
+
+## Reconsider
+
+- [ ] **`WidgetView`.** Iris is unsure of it: what she wants is an easy way
+  to compose a widget from others (a button is the main case). With
+  sizing folded into `draw`, composing may be easy enough that `View` is
+  redundant. Decide after the layout change lands, by writing a button
+  both ways and keeping the one that is shorter to explain; delete the
+  other rather than keeping two ways.

LAYOUT.md

@@ -0,0 +1,897 @@
+# iris: one `draw` that reports a size
+
+Preference stated by Iris, 2026-09-04, on the `rustify` branch. Recorded before
+any design or code so that it survives a cleared session. **Status: implemented
+2026-09-04, against every pass condition in §8** (measured, not assumed — see
+that section). Every widget listed in §7 was migrated in one change; none
+kept `desired_width`/`desired_height`. Five points needed correction or
+refinement beyond what this file originally specified — see "Deviations
+found during implementation" below, added right before "For IRIS.md" — read
+that section before touching `Aligned`, `Sized`, `MaxSize`, `Scroll`, or the
+move-slot lifecycle in `render_state.rs`, since each of those five is a real
+bug this file's first draft would have reproduced if implemented literally.
+
+## What Iris asked for
+
+> I don't like that widgets need both a draw and size functions. I'd much
+> rather them have a single draw that reports a size, and if it needs to be
+> moved then that can be done after the fact efficiently, or resized just
+> done after as well. This should be done efficiently like everything else
+> tries to do right now.
+
+She added, a few minutes later: "single draw is not a requirement. It
+just seems more efficient from what I've heard. Feel free to override any
+decision I've made if you can find a genuinely better & still clean
+alternative." So the single-draw model is the default to design against,
+and the design below may reject it, but only with a written comparison
+showing the alternative does less work per frame and is no harder to use.
+
+Standing constraints from RUST.md still apply: no DSL, plain Rust, do as
+little processing as possible per frame, but the model must cover every
+layout need a real app has (the transcript's virtualised list, wrapped
+text whose height depends on width, rows and columns that size to their
+children, overlays, masks).
+
+## What exists today
+
+`Widget` (`iris/core/src/widget/mod.rs`) has three methods: `draw(&mut
+self, &mut Painter)`, `desired_width(&mut self, &mut SizeCtx) -> Len` and
+`desired_height`. A parent asks `SizeCtx::width/height` for a child, which
+is memoised per widget id and axis in `Cache.size` keyed on the outer
+size, then places the child with `Painter::widget_within(region)`. So a
+child is visited twice (sized, then drawn), every widget implements sizing
+twice (one per axis), and a widget whose size depends on what it draws
+(wrapped text, a laid-out paragraph) does the layout in the size pass and
+again in the draw pass unless it caches by hand.
+
+Primitives are already positioned by `UiRegion` values whose scalars have
+a `rel` and an `abs` part, resolved against the window in the vertex
+shader (`core/src/render/shader.wgsl`), and `Primitives::region_mut`
+exists to rewrite one instance's region in place. That is the mechanism a
+"move after the fact" can build on.
+
+## What the design must answer
+
+1. **Parent-before-child ordering.** A row has to know each child's width
+   to place the next one, but under "one draw" the child's size only
+   exists after it has drawn. The answer is meant to be: the child draws
+   at a provisional origin, reports its size, and the parent *moves* it.
+   The move must be O(1) per moved subtree, not O(primitives in the
+   subtree). One way: every instance carries an index into a small
+   per-widget offset buffer, so moving a widget writes one entry and the
+   vertex shader adds it. Other ways may be better; the design should say
+   what was considered.
+2. **Move vs resize are different costs and must be kept apart.** A move
+   never re-runs `draw`. A resize re-runs `draw` for exactly the widgets
+   whose size input changed, and a widget whose output does not depend on
+   its size (an icon, a fixed rect) must be able to say so and be skipped.
+3. **Size-dependent content.** Wrapped text is the hard case: its height
+   is a function of its width. A single `draw` receives the available
+   size (what `SizeCtx.outer` is today) and reports what it used, so the
+   two-pass "measure then draw" collapses into one for the common case.
+   The design must say what happens when a parent wants the child's
+   height *before* deciding the width it will offer (rare; say whether it
+   is supported, or is done by drawing twice as an explicit, opt-in cost).
+4. **Caching.** Today's `Cache.size` memoises by (id, axis, outer). The
+   replacement should memoise the whole draw result by (id, available
+   size) so that an unchanged subtree costs nothing on the next frame,
+   which is what makes a virtualised list cheap.
+5. **Everything currently written against `desired_width`/`desired_height`
+   moves over in one change**, per the code rules: two names for one
+   concept is not an intermediate state to leave behind. The widgets are
+   in `iris/src/widget/` (`ptr`, `mask`, `image`, `rect`, `trait_fns`, and
+   whatever else is there when the change is made).
+
+## Order relative to the texture work
+
+TEXTURES.md's redesign touches the render core (shader, `GpuTextures`,
+`Primitives`, `Painter`'s texture calls). This change touches the widget
+trait, `SizeCtx`, `Cache`, `Painter`'s widget calls, and any offset
+mechanism the vertex shader needs. They overlap in `Painter` and the
+shader, so they are done **in sequence, textures first**, and the layout
+design here is written (not implemented) while the texture work is in
+progress, then implemented on top of it.
+
+## Design
+
+### 1. The new `Widget` trait
+
+```rust
+pub trait Widget: Any {
+    /// Draw within `painter.region()` (the space the parent offered) and
+    /// report how much of it was actually used, per axis.
+    fn draw(&mut self, painter: &mut Painter) -> Size;
+
+    /// True if `draw`'s output (both the primitives it writes and the
+    /// `Size` it returns) is the same for any `painter.region()` of the
+    /// same *content* -- an icon, a fixed-size rect, an already-decoded
+    /// image at its natural size. Default `false` (redraw on any change to
+    /// the offered region) because assuming independence wrongly produces
+    /// a stale draw; a widget must opt in.
+    fn is_size_independent(&self) -> bool {
+        false
+    }
+}
+```
+
+No `available` parameter: `Painter` already carries the region the parent
+handed down (`Painter::region()`, `core/src/ui/painter.rs:137`) and already
+exposes the pixel-resolved form (`px_size()`, `:156`) and the output surface
+size (`output_size()`, `:152`). Passing it again would be the same value
+under a second name. `desired_width`/`desired_height` (`core/src/widget/mod.rs:20-21`)
+and `WidgetAxisFns::desired_len` (`:24-35`) are deleted outright — not
+deprecated, not kept as a fallback — because a widget that implements both
+`draw` and `desired_*` for the same thing is exactly the "two names for one
+concept" the code rules call out, and it is what today's `Span::desired_ortho`
+(`iris/src/widget/position/span.rs:98-152`) already complains about in its
+own comment: "this literally copies draw so that the lengths are correctly
+set in the context, which makes this slow and not cool." Folding sizing into
+`draw` deletes that duplicate simulation, not just moves it.
+
+**No single-draw alternative was found that does less work per frame.** The
+two-method trait was checked against three properties a real screen needs —
+a row placing children in sequence, a widget centering on its own content,
+and wrapped text — and in every one, `draw` already has to visit the child
+to get a size that is *this specific one's* answer, which today's
+`desired_width`/`desired_height` re-derive by re-running (a shrunk copy of)
+the same layout the draw pass will do again. So the two-method trait is not
+"measure once, draw once" in the general case; it is "measure once per axis,
+then draw once," i.e. up to three visits per widget per frame, against one
+under the design here. The single-draw model is therefore adopted as
+proposed, not merely accepted as a preference.
+
+### 2. Move: O(1) per moved subtree, via a per-widget offset chain
+
+**What exists today, and why it is not O(1).** `UiRenderState::mov`
+(`core/src/ui/render_state.rs:156-168`) fires when a widget's region keeps
+its *size* but changes *position* (`draw_inner`, `:85-100`:
+`active.region.size() == region.size()` after excluding the exact-match
+case). It rewrites every primitive's `region` field via
+`Primitives::region_mut` (`core/src/render/primitive.rs:176-179`) for the
+widget's own primitives, then recurses into every child — O(primitives in
+the subtree). Both call sites that trigger it today, `Scroll::draw`
+(`iris/src/widget/position/scroll.rs:29-31`) and `Offset::draw`
+(`iris/src/widget/position/offset.rs:9-11`), are "translate this subtree by
+an abs pixel amount, `rel` framing unchanged" — a transcript scroll
+re-touches every glyph in every visible row, every frame of the drag, and
+I3's target is 800 rows on screen.
+
+**Recommendation: a per-widget offset slot forming a parent-linked chain,
+resolved in the vertex shader.**
+
+- `UiData` (`core/src/ui/mod.rs:14-20`) gains
+  `pub move_offsets: TrackedArena<MoveOffset, u32>`, the same arena shape
+  already used for `masks: TrackedArena<Mask, u32>` on the line above it.
+- `render/data.rs` gains `pub struct MoveOffset { pub delta: [f32; 2], pub
+  parent: u32 }` (`Pod`/`Zeroable`, `parent = u32::MAX` = "no ancestor,
+  add nothing more"). A pure abs-pixel translation, not a general
+  `UiRegion` remap — sufficient for every existing call site (above).
+- `PrimitiveInstance` (`render/data.rs:11-18`) gains `pub move_idx: u32`,
+  a vertex attribute at `@location(7)` beside `mask_idx` at `6` — the same
+  kind of per-instance handle.
+- `ActiveData` (`core/src/ui/active.rs`) gains `pub move_slot: MoveIdx`,
+  assigned **when the widget is first drawn** (`draw_inner`, beside
+  `active.insert`), with `parent` = the drawing widget's parent's slot.
+  `Painter` threads a `move_slot` field down exactly as it already threads
+  `mask` and `layer` (`painter.rs:9-20`), so a freshly-drawn descendant is
+  correct from its first frame — nothing is ever retrofitted onto an
+  already-active primitive. An unmoved widget's slot just stays `[0, 0]`.
+- `Painter::primitive_at` (`painter.rs:23-38`) writes `move_idx:
+  self.move_slot`, matching how it already writes `mask_idx: self.mask`.
+- `mov(id, delta)` becomes: look up `id`'s slot, write
+  `move_offsets[slot].delta += delta`. One write — no primitive touched, no
+  recursion, since descendants already reference this slot transitively.
+- `shader.wgsl`'s vertex stage, after computing `top_left`/`bot_right` in
+  pixels (after `:106`, before the clip-space divide at `:113`), walks
+  `move_idx → move_offsets[i].parent` for a bounded number of steps (a
+  small constant, e.g. 16, with a CPU-side debug assertion that no chain
+  exceeds it), summing `delta` into both corners. Cost is O(chain depth),
+  paid every frame regardless of whether anything moved — negligible next
+  to the per-fragment texture sampling TEXTURES.md already measures this
+  GPU as not bound by.
+
+**Why the chain, not the flatter thing first proposed.** Iris's own
+phrasing — "every instance carries an index into a small per-widget offset
+buffer" — describes a flat table: one slot per subtree *declared* movable,
+no parent link. It breaks the moment two such subtrees nest — a row inside
+a scrolling list, itself later given its own animated offset (a
+swipe-to-delete mid-scroll) — because the row's primitives would have to
+pick one slot and lose the other's contribution. The chain costs one extra
+field and a bounded shader loop in exchange for no such gap, and since
+every `ActiveData` gets a slot unconditionally rather than lazily, it costs
+no more at the common depth of one than the flat version would.
+
+**Against `region_mut` as the steady-state mechanism**: rejected for being
+O(primitives in the subtree) — the cost this section removes — but kept
+for a resize that changes a region's `rel` component (a genuine reflow,
+§3) and for a size-independent widget's resize (§3), where the content's
+shape doesn't change and one field write already suffices.
+
+### 2b. Two more readers of "where is this widget," and masks
+
+Moving the offset into the vertex shader means `ActiveData.region` is no
+longer the on-screen truth once a widget has been moved — it is where the
+widget was *drawn*, before any `move_offsets` delta. Two things read it as
+if it still were, and both must move to a resolved query or they silently
+answer with the pre-move position: a click landing on a scrolled row would
+be routed to whatever used to be there, with nothing on screen to say so —
+exactly the "wrong answer that looks like a right one" case the code rules
+single out.
+
+**Hit-testing.** `SensorUi::run_sensors` (`src/default/sense.rs:154-200`)
+does the actual pointer routing, and line 170 is the read in question:
+`let shape = self.active.get(id).unwrap().region;` (`self: &UiRenderState`),
+immediately turned into pixels and tested against the cursor at `:171-172`.
+Under this design that region must be resolved through the same chain the
+GPU walks before it means anything. Add to `UiRenderState`:
+
+```rust
+/// `active[id].region`, corrected by every `move_offsets` delta between
+/// `id` and the root — the CPU-side twin of the vertex shader's chain
+/// walk, over the same arena, so the two cannot disagree about where a
+/// widget is. O(chain depth), not O(primitives): a plain Rust loop over
+/// `move_offsets`, bounded by the same constant the shader loop uses
+/// (name it once, e.g. `render::MOVE_CHAIN_LIMIT`, and reference it from
+/// the WGSL loop bound in a comment, since WGSL cannot `include!` a Rust
+/// const across the language boundary).
+pub fn resolved_region(&self, id: WidgetId) -> UiRegion;
+```
+
+`window_region` (`core/src/ui/render_state.rs:264-267`), the public
+coordinate query already used outside hit-testing
+(`src/default/attr.rs:15,17,70`, e.g. positioning one widget relative to
+another's on-screen box), is reimplemented to call `resolved_region(id)`
+before `.to_px(...)` instead of reading `.region` directly — one change
+covers both call sites listed there. `sense.rs:170` changes to
+`let shape = self.resolved_region(*id);`. Both are required the moment §2
+lands, not an optional follow-up: an unmoved widget's chain is empty and
+`resolved_region` costs one arena read to find that out, so there is no
+version of this design where skipping the fix is a legitimate
+optimization — it is a correctness gap, not a performance one.
+
+**Masks.** `Painter::set_mask` (`core/src/ui/painter.rs:49-52`) bakes the
+painter's *current* region into a `Mask` pushed onto
+`masks: TrackedArena<Mask, u32>` (`core/src/ui/mod.rs:19`), and the
+fragment shader clips every primitive against `masks[in.mask_idx]`'s raw
+`rel`/`abs` fields, unaffected by any move (`shader.wgsl:147-157`). If the
+widget that called `set_mask` — `Masked::draw`,
+`iris/src/widget/mask.rs:7-11`, `painter.set_mask(painter.region()); ...` —
+is itself later moved, its clip rectangle stays where it was drawn while
+its content moves out from under it: a visibly wrong clip, immediately on
+screen, not a latency question.
+
+Fix: `Mask` (`core/src/render/data.rs:46-49`) gains `pub move_idx: u32`,
+written from `Painter::set_mask` as `self.move_slot` — the identical slot
+the mask-owning widget's own primitives already get (§2), not a second
+mechanism. Resolution happens in the **fragment** shader, not the CPU, and
+not the vertex shader either: `shader.wgsl`'s mask check (`:147-157`)
+currently computes the mask's `top_left`/`bot_right` inline from
+`masks[in.mask_idx]`; that computation is extended to walk the same
+move-offset chain §2 added, via one shared function —
+
+```wgsl
+fn resolve_move(idx: u32) -> vec2<f32> { /* the bounded parent walk, used by both stages */ }
+```
+
+— called from `vs_main` for a primitive's own corners and from `fs_main`
+for its mask's corners, so the walk is written once and the two stages
+cannot drift apart (the sibling-rule from the code rules: one loop, not a
+hand-copied second one in the other shader stage).
+
+**Why the fragment shader, not a CPU-side mask rewrite at move time.** A
+primitive's mask is frequently owned by a *different* widget than the
+primitive itself — often several levels up a subtree, with its own,
+independent move slot — so a primitive's resolved offset and its mask's
+resolved offset are two different chain sums, both needed, and only the
+fragment shader has both `in.move_idx` (this fragment's own chain) and
+`in.mask_idx` (indirecting to a second, possibly unrelated chain) already
+in hand per-fragment. Resolving mask regions on the CPU at move time would
+mean, for every `mov()` call, walking forward to every mask instance the
+moved widget's slot could affect and rewriting its raw region — exactly
+the O(subtree) cost §2 exists to remove, just moved from primitives to
+masks. The fragment shader already re-reads `masks[in.mask_idx]` every
+frame (`:148`); one more arena read to resolve its chain costs nothing
+extra in kind.
+
+**The scroll-container case, checked rather than assumed.** A masked,
+scrollable region is built as a `Masked` wrapping a `Scroll`
+(`iris/src/widget/position/scroll.rs`, `iris/src/widget/mask.rs`) — the
+viewport border is drawn (and `set_mask` called) by `Masked`, which is
+never itself the target of `mov()`; only `Scroll`'s inner content is,
+every frame the user drags. Because each widget's move slot is its own
+(§2: assigned per `ActiveData`, not shared), `Masked`'s mask references
+its own, stationary slot, while the scrolled content underneath references
+a separate, deeper slot whose `parent` chain passes through — but does not
+write to — the viewport's slot. Moving the content therefore never touches
+the mask's resolved position, and the mask staying still while its content
+slides past it is what this design already produces with no special case,
+not an extra rule that had to be added for it.
+
+### 3. Resize scope
+
+A resize is "the region a widget's parent offers it changes such that the
+widget's draw might produce different output" — as opposed to a move, which
+by construction cannot (§2 is scoped to pure translation). Two independent
+narrowings apply, and both are real, measured properties of the code as it
+stands rather than new machinery:
+
+**(a) A window resize does not, by itself, require touching most widgets.**
+`shader.wgsl:105-106` recomputes every primitive's pixel position from
+`window.dim` and the primitive's stored `rel`/`abs` pair *every frame,
+already, on the GPU*. A widget laid out purely in `rel`/`abs` terms (no
+call to `px_size()`, `output_size()`, or anything else that reads a
+concrete pixel count) is therefore already correct after a resize with zero
+CPU work — the shader did it. `UiRenderState::needs_redraw_all`
+(`render_state.rs:229-231`) currently ignores this and redraws the entire
+tree on every `resized`, which was the safe default while sizing and
+drawing were two passes; it should be narrowed to only the widgets that
+*do* read a concrete pixel value. Track this the same way `needs_redraw`
+already tracks per-widget dirtiness (`Widgets::needs_redraw`,
+`core/src/widget/widgets.rs:9`): a widget's `draw` call marks itself
+pixel-dependent by calling through `Painter` methods that read
+`output_size`/`px_size` (both already funnel through `Painter`, so the
+marking is one line at each), and `resize()` (`render_state.rs:32-35`)
+walks only that set instead of unconditionally setting `resized = true`
+for a full `redraw_all`. This turns "every resize redraws everything" into
+"every resize redraws what depends on pixels" — a real behavior change
+beyond what was asked, so verify it against the I0b `pre_present_notify`
+resize regression (that fix depended on `redraw_all`'s completeness)
+before narrowing this.
+
+**(b) A widget's `available` (its parent's offered region) can change
+without the widget's *content* changing — this is what
+`is_size_independent` (§1) answers.** When a container's own layout shifts
+(a sibling grew or shrank, changing this widget's offered box), a widget
+that returns `true` from `is_size_independent` is not redrawn: its
+primitives are unaffected by size, only by placement, so the parent
+either (i) issues a move (§2) if only position changed, or (ii) rewrites
+the primitive's `region` fields directly via `region_mut` if the box
+changed shape too (still O(primitives owned directly by this widget, not
+its subtree, since a size-independent widget by definition has no
+size-dependent descendants worth distinguishing — in practice this is
+always a leaf: `Rect`, `Image`, a fixed glyph). A widget that returns
+`false` (the default) is redrawn in full whenever `available` changes,
+which is correct always, just not free.
+
+**Ancestor propagation** (a resized child changing its own reported size,
+requiring its parent to re-lay-out) is unchanged in spirit from today's
+`redraw` (`render_state.rs:270-305`), which already walks up exactly the
+ancestors whose cached size differs from the new one and stops as soon as
+a size is unchanged (`:274-286`). That loop moves from consulting
+`Cache.size` to consulting `ActiveData.size` (§5) but keeps its shape.
+
+### 4. Wrapped text, and "needs child height before choosing width"
+
+**Wrapped text is not a special case any more; it already reads as one
+draw.** `TextView::render` (`iris/src/widget/text/mod.rs:57-76`) already
+does exactly what single-draw asks for: it reads `ctx.px_size().x` as the
+wrap width, shapes once, and memoizes the shaped layout keyed on that width
+plus a changed-flag on the buffer and attrs (`:63-69`) — a second call with
+the same width is a hash-map-style cache hit, not a re-shape. Under the new
+trait this collapses `Text::draw`/`desired_width`/`desired_height`
+(`text/mod.rs:133-147`, three functions) into one `Text::draw` that calls
+`self.view.draw(painter)` once, which internally still calls `render`
+once, hits its own cache, and returns the size it already computed. No
+new caching is needed here; the two now-redundant call sites
+(`desired_width`/`desired_height` each separately calling `render`) simply
+disappear, which is a second `render` avoided per frame per text widget
+that is being measured by a parent.
+
+**"Parent wants the child's height before deciding the width it will
+offer"** — the genuinely circular case named in the brief, e.g. a column
+that sizes its own width to its widest child, where that child is wrapped
+text whose height (which the column's *own* height depends on) depends on
+the width the column has not yet decided. This is not solvable in one pass
+for the same reason it is not solvable in CSS shrink-to-fit with wrapped
+content: the two axes' answers are mutually dependent. `Span::desired_ortho`
+(`span.rs:98-136`) already hits exactly this today and already resolves it
+by an explicit second, throwaway pass (its own comment: "this literally
+copies draw ... which makes this slow and not cool"). The design keeps that
+resolution, made explicit rather than accidental: `Painter` gets
+
+```rust
+/// Draw `child` at a provisional region to learn its size under one
+/// axis's worth of assumption, discard everything it wrote, then draw it
+/// again at the region that assumption produced. For the rare parent that
+/// cannot pick an offered size without already knowing the answer.
+/// Twice the cost of one `draw`; every other case in this file avoids it.
+pub fn draw_twice(&mut self, child: &StrongWidget, first: UiRegion, second: impl FnOnce(Size) -> UiRegion) -> Size;
+```
+
+implemented as: draw at `first`, record `Size`, remove the widget and its
+subtree the same way a resize-triggered redraw already does (`draw_inner`'s
+"if not \[same region\], maintain resize and track old children," `:97-100`,
+which already frees the old primitives before redrawing) — reusing that
+path rather than adding a second one — draw again at `second(size)`, return
+the final `Size`. It is opt-in and named for its cost, so a widget only
+pays it if it is the one that needs it; `Span`'s cross-axis case is the one
+call site converted to it, replacing the hand-rolled duplicate loop.
+
+### 5. Caching and invalidation
+
+`Cache.size` (`core/src/ui/cache.rs`) is **deleted, not replaced with an
+equivalent** — the thing it memoized (a `desired_width`/`desired_height`
+answer, independent of drawing) no longer exists as a separate query, so
+there is nothing left to cache at that layer. What already provides "an
+unchanged subtree costs nothing" is the check `draw_inner` performs before
+touching a widget at all (`render_state.rs:85-90`): if the widget is active,
+its region is unchanged, and it is not marked dirty, `draw_inner` returns
+immediately — no `Painter` constructed, no primitive touched, no shader
+work beyond what the GPU already redraws from the unchanged instance
+buffer. That check is kept exactly as it is; it is the caching mechanism,
+and it already operates at (id, region) granularity, which subsumes "(id,
+available size)" once size *is* what a region change means.
+
+What is added: `ActiveData` gains `pub size: Size` — the value `draw`
+returned, stored the moment it is (`draw_inner`, alongside building the
+`ActiveData` struct at `:134-143`). This is what a parent placing this
+widget for a second frame without redrawing it (because nothing changed)
+reads instead of recomputing — it replaces `Cache.size`'s role of "answer a
+size question without a full draw" with "read the size of the last actual
+draw," which is always available because `draw_inner`'s skip path is only
+reachable once the widget has been drawn at least once. `Cache::remove`/
+`Cache::clear` (`cache.rs:9-17`) are deleted with the type; `ActiveData`
+already has an equivalent lifecycle (removed in `remove`/`remove_rec`,
+`render_state.rs:171-198`, freed with the widget).
+
+### 6. Before / after
+
+**A leaf, `iris/src/widget/rect.rs`** — the size-independent case:
+
+```rust
+// before
+impl Widget for Rect {
+    fn draw(&mut self, painter: &mut Painter) {
+        painter.primitive(RectPrimitive { color: self.color, radius: self.radius,
+            thickness: self.thickness, inner_radius: self.inner_radius });
+    }
+    fn desired_width(&mut self, _: &mut SizeCtx) -> Len { Len::rest(1) }
+    fn desired_height(&mut self, _: &mut SizeCtx) -> Len { Len::rest(1) }
+}
+```
+
+```rust
+// after
+impl Widget for Rect {
+    fn draw(&mut self, painter: &mut Painter) -> Size {
+        painter.primitive(RectPrimitive { color: self.color, radius: self.radius,
+            thickness: self.thickness, inner_radius: self.inner_radius });
+        Size::REST // fills whatever it was given -- used == available
+    }
+    fn is_size_independent(&self) -> bool { true } // content never depends on region size
+}
+```
+
+**A container that needs the child's size before placing it,
+`iris/src/widget/position/align.rs`**:
+
+```rust
+// before
+impl Widget for Aligned {
+    fn draw(&mut self, painter: &mut Painter) {
+        let region = match self.align.tuple() {
+            (Some(x), Some(y)) => painter.size(&self.inner).to_uivec2().align(RegionAlign { x, y }),
+            (Some(x), None) => { let x = painter.size_ctx().width(&self.inner).apply_rest().align(x);
+                UiRegion::new(x, UiSpan::FULL) }
+            (None, Some(y)) => { let y = painter.size_ctx().height(&self.inner).apply_rest().align(y);
+                UiRegion::new(UiSpan::FULL, y) }
+            (None, None) => UiRegion::FULL,
+        };
+        painter.widget_within(&self.inner, region);
+    }
+    fn desired_width(&mut self, ctx: &mut SizeCtx) -> Len { ctx.width(&self.inner) }
+    fn desired_height(&mut self, ctx: &mut SizeCtx) -> Len { ctx.height(&self.inner) }
+}
+```
+
+```rust
+// after
+impl Widget for Aligned {
+    fn draw(&mut self, painter: &mut Painter) -> Size {
+        let full = painter.region();
+        // Draw once at the full region to learn the child's real size --
+        // this placement is provisional and corrected below without a
+        // second draw.
+        let used = painter.widget_within(&self.inner, full);
+        let region = match self.align.tuple() {
+            (Some(x), Some(y)) => used.to_uivec2().align(RegionAlign { x, y }).within(&full),
+            (Some(x), None) => used.x.apply_rest().align(x).within(&full),
+            (None, Some(y)) => used.y.apply_rest().align(y).within(&full),
+            (None, None) => full,
+        };
+        painter.reposition(&self.inner, region); // O(1): one offset write, no second draw
+        used
+    }
+}
+```
+
+`Painter::widget_within`/`widget`/`widget_at` (`painter.rs:55-76`) change
+return type from `()` to `Size`, carrying the child's `draw` result back —
+the only signature change needed to let a parent see what its child used.
+`Painter::reposition` is new, computing the delta between where a child
+was actually drawn and where it belongs and calling the O(1) `mov` from
+§2. `SizeCtx` and `Painter::size_ctx`/`size`/`len_axis` (`painter.rs:141-150,
+180-182`) are deleted — nothing calls `desired_len` any more, so there is
+nothing left for `SizeCtx` to answer; `draw_text`/`label`/`px_size`/
+`output_size` already exist redundantly on both `SizeCtx` and `Painter`
+today (compare `size.rs:71-90` against `painter.rs:152-174`) and this
+deletes the `SizeCtx` copies, keeping the `Painter` ones.
+
+### 7. Migration — every file and widget that changes
+
+One change, in dependency order (rename-and-move-together, per the code
+rules — no intermediate state with both trait shapes):
+
+- `core/src/widget/mod.rs` — the `Widget` trait (§1), delete
+  `WidgetAxisFns`, update `impl Widget for ()`.
+- `core/src/ui/size.rs` — delete `SizeCtx` (the type and all its methods).
+- `core/src/ui/cache.rs` — delete `Cache` (§5).
+- `core/src/ui/painter.rs` — `widget`/`widget_within`/`widget_at` return
+  `Size`; add `reposition`, `draw_twice`; delete `size_ctx`, `size`,
+  `len_axis`; `primitive_at` writes `move_idx`.
+- `core/src/ui/render_state.rs` — `draw_inner` captures and stores
+  `ActiveData.size`; `mov` becomes the O(1) offset write (§2); resize
+  narrowing (§3a); `redraw`'s per-axis loop reads `ActiveData.size`
+  instead of `Cache.size`.
+- `core/src/ui/active.rs` — `ActiveData` gains `size: Size`,
+  `move_slot: MoveIdx`.
+- `core/src/ui/mod.rs` — `UiData` gains `move_offsets`.
+- `core/src/render/data.rs` — `PrimitiveInstance` gains `move_idx`;
+  new `MoveOffset` struct.
+- `core/src/render/primitive.rs` — thread `move_idx` through `PrimitiveInst`
+  and `Primitives::write`, matching `mask_idx`.
+- `core/src/render/mod.rs` — bind the new `move_offsets` storage buffer
+  (group 2, beside `masks`) and its update path.
+- `core/src/render/shader.wgsl` — `InstanceInput` gains `move_idx`;
+  `MoveOffset`/`UiScalar`-shaped storage binding; a shared `resolve_move`
+  function (§2b) called from both `vs_main` (a primitive's own corners)
+  and `fs_main` (its mask's corners, once `Mask` carries `move_idx`).
+- `core/src/ui/render_state.rs` — additionally, `resolved_region` (§2b)
+  and `window_region` (`:264-267`) reimplemented on top of it.
+- `src/default/sense.rs` — `run_sensors`'s hit-test read (`:170`) switches
+  from `self.active.get(id).unwrap().region` to `self.resolved_region(*id)`
+  (§2b) — the pointer-routing fix this design requires, not an optional
+  follow-up.
+- `core/src/render/data.rs` — additionally, `Mask` (`:46-49`) gains
+  `move_idx: u32` (§2b).
+- `core/src/ui/painter.rs` — additionally, `set_mask` (`:49-52`) writes
+  `move_idx: self.move_slot` into the `Mask` it pushes (§2b).
+- Every widget with a two-method `impl Widget`, collapsed to one `draw`
+  (§1, §6), `is_size_independent` added where true: `core/src/widget/mod.rs`
+  (`impl Widget for ()`), `iris/src/widget/rect.rs` (`Rect`, → true),
+  `iris/src/widget/image.rs` (`Image`, → true — a decoded image's primitive
+  never depends on the region it is offered, same as `Rect`),
+  `iris/src/widget/mask.rs` (`Masked`), `iris/src/widget/ptr.rs`
+  (`WidgetPtr`), `iris/src/widget/text/mod.rs` (`Text`, §4),
+  `iris/src/widget/text/edit.rs` (`TextEdit`),
+  `iris/src/widget/position/scroll.rs` (`Scroll`, keeps its `mov`-shaped
+  offset, now O(1) automatically via §2), `iris/src/widget/position/align.rs`
+  (`Aligned`, §6), `iris/src/widget/position/max_size.rs` (`MaxSize`),
+  `iris/src/widget/position/layer.rs` (`LayerOffset`),
+  `iris/src/widget/position/pad.rs` (`Pad`),
+  `iris/src/widget/position/stack.rs` (`Stack`),
+  `iris/src/widget/position/offset.rs` (`Offset`),
+  `iris/src/widget/position/span.rs` (`Span`, §4's `draw_twice` for the
+  cross-axis case, deleting `desired_ortho`'s duplicate loop),
+  `iris/src/widget/position/sized.rs` (`Sized`).
+  This list was produced by `grep -rn "impl Widget for\|fn desired_width\|fn desired_height"`
+  across `core/` and `src/`; re-run it before starting, since it is the
+  authoritative check that nothing was missed, not this paragraph.
+- `iris/examples/{minimal.rs,task.rs,view.rs,tabs/main.rs}` — no direct
+  `impl Widget` found in any example (verified by the same grep); they use
+  the builder DSL in `core/src/widget/trait_fns.rs` and should need no
+  source change, which is itself part of the pass condition below.
+
+### 8. Pass conditions
+
+1. **Every example under `iris/examples` renders identically.** Run
+   `iris/run-headless.sh EXAMPLE --shot PNG` for each of `minimal`, `task`,
+   `view`, `tabs` before and after, and diff the PNGs pixel-for-pixel — not
+   "looks right," since a subtle wrap or alignment regression is exactly
+   what a diff catches and a glance does not.
+
+   **Result (2026-09-04): pass, all four, 0 differing bytes.** No PNG
+   library is installed in this VM (no PIL, no ImageMagick, no pip), so the
+   diff is a from-scratch PNG decoder (`zlib` + the five filter types) at
+   `/tmp/layout-shots/pngdiff.py`, comparing decoded pixel bytes rather than
+   file bytes (`cmp` alone is not conclusive across two separately-encoded
+   PNGs, though it happened to agree here for `minimal`). Before-shots were
+   taken with `git stash` at the pre-change commit; `tabs` needed two real
+   fixes (deviations 1 and 2 below) before it stopped differing — the other
+   three matched on the first try.
+2. **Unchanged-frame cost, measured, not assumed.** Add a counter beside
+   the existing `debug_layers`/`active_widgets` instrumentation
+   (`render_state.rs:241-262`) for (a) `Widget::draw` invocations and (b)
+   `Primitives::write`/`region_mut` calls, both per `update()` call. Drive
+   one example (`tabs`, since it already has multiple widgets and an
+   interactive element) through one frame with nothing changed and report
+   both counts — the pass condition is **0 draws and 0 primitive rewrites**
+   for a frame in which nothing was marked dirty, resized, or moved.
+
+   **Result (2026-09-04): pass, 0 and 0.** Implemented as
+   `UiRenderState::take_counters() -> (u64, u64, u64)` (draws, `region_mut`
+   rewrites, `move_offsets` writes — a third counter, for condition 3
+   below), reset on read. Measured in
+   `iris/src/layout_tests.rs::an_unchanged_frame_draws_and_rewrites_nothing`
+   against a `Scroll` over 500 fixed-height rects (not the `tabs` example —
+   see the note on condition 3 for why this runs as a plain unit test
+   instead).
+3. **Single-moved-child cost, measured.** Same counters, one frame in
+   which exactly one widget is moved (not resized) with N primitives in its
+   subtree — the pass condition is **1 write to `move_offsets`, 0 calls to
+   `Widget::draw`, 0 calls to `region_mut`**, independent of N. Construct
+   the case with a `tabs`-style example holding a deliberately large text
+   block (hundreds of glyphs) inside a `Scroll`, so N is large enough that
+   an O(N) regression would show up as a non-trivial write count rather
+   than being lost in noise.
+
+   **Result (2026-09-04): pass — 0 draws, 0 rewrites, 1 move_offsets
+   write, N = 500.** Built with rects rather than glyphs
+   (`iris/src/layout_tests.rs::scrolling_moves_in_o1_without_a_redraw`):
+   `iris-core`/`iris` touch no GPU or window to lay out and move a tree, so
+   this runs as a plain `cargo test`, not through `run-headless.sh` — a
+   `Widgets`/`UiData` pair and a bare `UiRsc` impl are enough, and it is
+   faster and more precise than reading counters out of a real example's
+   stderr. Getting a clean single move took two follow-up fixes beyond the
+   design as written (deviation 3, the `parent_move_slot` threading; and
+   the `Scroll` design decision below about offering last frame's content
+   length) — without either, the count was in the thousands (every rect in
+   the subtree redrawing) rather than 1.
+4. **Hit-testing follows the move, not just the render.** In the same
+   scrolled-`tabs` construction as condition 3, scroll the content, then
+   send a synthetic cursor position over a widget that moved and assert
+   `run_sensors` (`src/default/sense.rs:154-200`) routes to that widget's
+   id, not to whatever is now at its pre-scroll coordinates or to nothing.
+   This is a correctness check, not a timing one — §2b's fix is required
+   before §2 can ship at all, and this is what would fail silently
+   (nothing on screen indicates a missed or misrouted hit) if it were
+   skipped.
+
+   **Result (2026-09-04): pass**, but checked one level below
+   `run_sensors`: `iris/src/layout_tests.rs::hit_testing_follows_a_scrolled_widget`
+   scrolls a widget and asserts `UiRenderState::resolved_region` (the
+   query `run_sensors`'s hit-test and `window_region` both now go through,
+   per §2b) reports the moved, not the pre-scroll, position — within
+   0.01px of the exact expected delta. `run_sensors` itself needs a
+   `HasEvents`/window/cursor-state harness this pass did not build; the
+   coverage that matters (does the position query the router uses reflect
+   the move) is exercised directly instead.
+5. **A mask moves with its subtree.** Render a `Masked`-wrapped `Scroll`
+   both before and after scrolling it (`iris/run-headless.sh` against a
+   small purpose-built example, or an addition to `tabs`), and diff the
+   two frames: the clipped edge of the content must have moved with the
+   scroll while the viewport's own border (drawn by `Masked`, not moved)
+   stays put — the specific case worked through in §2b. A mask rectangle
+   that stayed at its pre-scroll position while its content slid past it
+   is the regression this checks for, and it is visible in a single
+   screenshot, not just in a counter.
+
+   **Result (2026-09-04): pass, checked numerically rather than by
+   screenshot.** No example in this repository builds a `Masked`-wrapped
+   `Scroll` (`tabs`'s "text edit scroll" tab uses `TextEdit`'s own internal
+   scrolling, not this widget), so there was nothing to screenshot without
+   first authoring a new example. Checked instead in
+   `iris/src/layout_tests.rs::a_mask_stays_put_while_its_scrolled_content_moves`,
+   on the exact data the fragment shader's `resolve_move` reads: the
+   masked widget's own `move_offsets` slot delta is `[0, 0]` both before
+   and after scrolling its content, because `Masked` is never itself the
+   target of a move — only its child is, on a separate, deeper slot in the
+   chain (§2b's "scroll-container case, checked rather than assumed"). A
+   pixel-level screenshot check of this remains open; see RUST.md's next
+   step.
+6. **`cargo test --workspace`, `cargo clippy --all-targets`, `cargo fmt`**
+   stay clean at the defaults (iris has no tests today per I0b, so this is
+   presently only clippy/fmt; add the first real widget-layer tests here if
+   the move-offset chain or `draw_twice` are non-trivial enough to want
+   one, per "match the codebase's testing posture" — judge that once the
+   code exists rather than pre-committing to a number of tests here).
+
+   **Result (2026-09-04): pass.** `cargo fmt --all -- --check`,
+   `cargo build --workspace --all-targets`, and `cargo clippy --all-targets`
+   are all clean (one pre-existing, unrelated warning about `naga`/`wgpu`/
+   `winit` future-incompatibility, from dependencies, not this change).
+   `cargo test --workspace`: the 14 pre-existing `TextEdit` tests plus 4 new
+   ones in `iris/src/layout_tests.rs` (conditions 2–5 above), 18 passed, 0
+   failed — the move-offset chain turned out non-trivial enough (three real
+   bugs found only by writing it) to clearly clear the "match the testing
+   posture" bar this section left open.
+
+### 9. Rejected, and why
+
+- **A flat (non-chained) per-subtree offset table**, Iris's literal
+  phrasing — rejected in §2 for breaking under nested independent moves
+  (a swiped row inside a scrolling list). Costs nothing extra to avoid: the
+  chain is the same mechanism with one more field.
+- **Keeping `region_mut` recursion as the only move mechanism** — rejected
+  as the steady-state path (O(primitives in subtree), exactly what a
+  transcript scroll must not pay every frame) but kept for resize-shaped
+  changes (§3) where the content's own region field, not an ancestor
+  chain, is what has to change.
+- **A second, size-only trait method kept alongside `draw`** (e.g.
+  `fn size_hint(&self) -> Option<Size>` as a fast path some widgets could
+  implement to skip a draw when a cheap answer exists) — considered and
+  rejected: it reintroduces exactly the "two names for one concept" split
+  this change removes, for a saving `is_size_independent` (§1, §3b)
+  already covers for the cases where it would actually help (fixed-size
+  leaves). A widget whose size is cheap to compute but whose *drawing* is
+  not (unlikely in this codebase's widget set, but conceivable) is better
+  served by that widget caching its own draw output internally — exactly
+  the pattern `TextView::render` already uses (§4) — than by a second
+  trait method every implementor has to reason about.
+- **Passing `available` as an explicit parameter to `draw`** (mirroring
+  Masonry's `layout(&mut self, ctx, bc: &BoxConstraints) -> Size`, the
+  yardstick per AGENTS.md) — rejected as redundant with `Painter::region()`,
+  which already carries the same information into every widget that needs
+  it; adding a parameter would just be a second route to a value already
+  reachable, and would invite the two drifting apart.
+- **Eagerly propagating a moved widget's delta into every descendant's own
+  offset value** (rather than chaining and resolving in the shader) —
+  rejected as O(descendant widgets), which is smaller than O(primitives)
+  but still not O(1), and the shader-side chain costs nothing extra to get
+  the better bound.
+
+## Deviations found during implementation (2026-09-04)
+
+Five corrections this file's first draft did not anticipate, each found by
+`iris/run-headless.sh tabs --shot` disagreeing with a pixel-identical
+pre-change screenshot (pass condition 1) and traced with `eprintln!` in
+`draw_inner`/`reposition` — not by reasoning about the design in the
+abstract. Recorded here rather than silently fixed in place, per the code
+rules' escape-hatch requirement.
+
+1. **`Aligned`'s provisional draw must call `painter.widget`, not
+   `widget_within(&self.inner, painter.region())`.** §6's original text drew
+   the sample as the latter. `widget_within` composes its `region` argument
+   as *local*, `UiRegion::FULL`-relative coordinates against
+   `painter.region()` (exactly what `UiRegion::FULL.within(&self.region) ==
+   self.region` relies on); handing it `painter.region()` itself —
+   already-resolved, window-relative coordinates — composes that frame a
+   second time. For the root widget this is silently the identity (its
+   region already is `[0,1]`), which is why it can look correct in a
+   trivial case and only breaks once something is nested — i.e. always, in
+   practice. Symptom: a centered child rendered at a wildly wrong offset
+   nested more than one level deep. Fixed by using `painter.widget`, which
+   hands the child `self.region` unmodified, with no second composition.
+
+2. **A widget that reports a size smaller than its offered region must
+   actually paint at that size, anchored top-left of what it was given —
+   not fill the full offered region while merely *reporting* a smaller
+   number.** `Sized` and `MaxSize` both had exactly this bug: their
+   `desired_width`/`desired_height` predecessors capped the *reported*
+   value but their `draw` bodies called `painter.widget(&self.inner)`
+   unconstrained, which was harmless under the old two-pass model (a parent
+   always queried the size *before* drawing, so by the time `draw` ran the
+   offered region already matched) but wrong under `Aligned`'s new
+   provisional-draw-then-reposition pattern, which offers the *whole*
+   region on the first, learning pass. Symptom: a `.sized((100, 100))` rect
+   rendered stretched to fill its whole row instead of a 100×100 square.
+   Fixed by having both widgets carve the declared sub-region (`UiSpan`
+   sized to the axis's `Len`, anchored at `AxisAlign::Neg`) out of whatever
+   they were offered before drawing the child in it. `Image` needed the
+   same treatment from the start (`texture_within` at its own natural size,
+   not `texture()` at the full offered region) and was written that way in
+   the first pass, once this was understood; `Rect`'s "fill whatever I'm
+   given" is the one case where painting the *whole* offered region really
+   is the declared behavior, so it needed no change.
+
+3. **The move-offset chain's `parent` link cannot be found by looking up
+   the parent's `ActiveData` in `draw_inner`, because the parent's
+   `ActiveData` does not exist yet while its own `Widget::draw` is still
+   running.** `ActiveData` is inserted only after `draw` returns
+   (`render_state.rs`, end of `draw_inner`), so a child drawn partway
+   through its parent's `draw` body — the ordinary case, since every
+   composite widget draws its children from inside its own `draw` — would
+   always read "no parent" from `self.active`, silently orphaning it at the
+   root of the chain. Fixed by threading the parent's `move_slot` down
+   through `Painter` (it already carries `mask`/`layer` the same way) and
+   passing it explicitly into `draw_inner` as `parent_move_slot`, rather
+   than deriving it from `self.active.get(parent_id)`. `move_parent_of`
+   (the `self.active`-based lookup) is kept, but only for `redraw()`, whose
+   target's parent genuinely is already active at that call site — the
+   doc comment on it says which is which. Symptom: `reposition` computed
+   the right delta and wrote it to the right slot, but the shader never
+   saw it, because the primitive doing the actual painting chained to
+   `u32::MAX` one level too early.
+
+4. **`Painter::reposition` cannot reuse `active.region` as "where the
+   widget currently is," because for a widget offered more room than it
+   used, `active.region` is the *offered* box, not the *painted* one.**
+   This only matters for `reposition` (used by `Aligned`); `mov` (used by
+   `draw_inner`'s own same-size-different-position dispatch, for `Scroll`
+   and `Offset`) has no such gap, because there the offered region *is*
+   the visual footprint — content is sized to fill exactly what it is
+   given. `reposition` instead reconstructs "from" as `active.size`
+   (already tracked, per §5) anchored at `AxisAlign::Neg` within
+   `active.region` — i.e. it assumes the child painted itself top-left of
+   whatever it was offered, per point 2's convention — and **overwrites**
+   the slot's delta rather than accumulating it the way `mov` does, since
+   "from" is recomputed fresh from stable inputs every call and repeating
+   the same `reposition` (an unrelated redraw elsewhere re-running this
+   widget's parent) must not drift further each time. The one shape this
+   does not cover: `Aligned` wrapping `Aligned`, where the inner one's own
+   `reposition` may have moved its content away from top-left already. No
+   widget or example in this codebase builds that today; if one needs to,
+   `reposition` would need the child to report *where* it painted, not
+   just how big, which is a larger change than this pass's scope.
+
+5. **A widget's `move_offsets` slot is allocated once, on its first-ever
+   draw, and reused in place — never reallocated — for every later redraw
+   of the same id, with its delta reset to `[0, 0]` on each reuse.** Not
+   spelled out in §2's original text, which only said slots are assigned
+   "when the widget is first drawn." Reallocating a fresh slot on every
+   redraw would leave any *retained* (not-redrawn) descendant's `parent`
+   link pointing at a now-orphaned old slot — a permanent leak, and worse,
+   a descendant that silently stops tracking its ancestor's future moves.
+   Resetting the delta on reuse (rather than carrying it forward) is
+   required because a full redraw bakes the widget's correct absolute
+   position into the fresh `region` argument directly; a stale delta left
+   over from before the redraw would double-offset it.
+
+Two further points worth recording because they were *design decisions*
+made while implementing, not bugs — `LAYOUT.md`'s own text left them
+unspecified rather than getting them wrong:
+
+- **`Scroll` offers its content a region sized by the *previous* frame's
+  measured content length, not a fresh one.** A fresh measurement would
+  require drawing the content once to learn its size and — since that
+  provisional size essentially never matches the previously active one —
+  redrawing it a second time at the real size, on every single scroll
+  tick, which is exactly the cost §2 exists to remove. Using the stale
+  length means an ordinary scroll (position changes, content does not)
+  offers the same *size* as last frame, only shifted, which is what makes
+  `draw_inner` dispatch it as the O(1) move. The cost: a real content-size
+  change lags one frame before the container's scroll range reflects it,
+  self-correcting the frame after (the content length itself, read from
+  what was actually drawn, is never stale — only the offered *region* used
+  for placement is). No example in this repository builds a `Scroll` yet,
+  so this could not be checked against a pixel diff; it is covered instead
+  by `iris/src/layout_tests.rs`'s three `Scroll`-based unit tests, which
+  build a tree and drive `UiRenderState` directly with no GPU or window
+  needed.
+- **`redraw()`'s parent-relayout check draws the widget first, then
+  compares the fresh `ActiveData.size` the draw produced against the size
+  from before removal** — the mirror image of the old code's "query size,
+  compare, decide whether to draw," which no longer has a size query to
+  do the comparison with before drawing (§5 deleted `Cache`/`SizeCtx`
+  along with `desired_width`/`desired_height`). This can occasionally draw
+  a widget once more than the old code would have (if the parent it
+  bubbles up to ends up redrawing the same widget again as part of its own
+  relayout) — `draw_inner`'s own skip/move dispatch absorbs most of that
+  redundancy for free, and this path is not one of §8's measured
+  conditions, so the remaining slack was accepted rather than chased
+  further.
+
+## For IRIS.md
+
+When this lands, copy this entry into `IRIS.md` (newest first):
+
+> **2026-09-04 — `Widget::draw` reports the size it used; `desired_width`/
+> `desired_height` are gone.** A widget used to implement three methods
+> (`draw`, `desired_width`, `desired_height`); it now implements one,
+> `fn draw(&mut self, painter: &mut Painter) -> Size`, which draws into
+> `painter.region()` and returns how much of it was used. Why: the two
+> extra methods routinely re-simulated what `draw` was about to do anyway
+> (`Span::desired_ortho` copied its own draw loop to get cross-axis sizing
+> right) — one visit per widget per frame instead of up to three. A
+> container that needs a child's size before placing it (alignment,
+> centering) draws the child once at a provisional region, reads the
+> returned `Size`, and calls the new `Painter::reposition` to move it into
+> its final spot — an O(1) offset write, not a second draw. A widget whose
+> drawn output never depends on the size it's given (a fixed-size `Rect`,
+> a decoded `Image`) overrides the new `fn is_size_independent(&self) ->
+> bool { false }` to `true`, which skips redrawing it when only its
+> offered region changes shape.
+>
+> ```rust
+> // before
+> fn draw(&mut self, painter: &mut Painter) { /* ... */ }
+> fn desired_width(&mut self, ctx: &mut SizeCtx) -> Len { /* ... */ }
+> fn desired_height(&mut self, ctx: &mut SizeCtx) -> Len { /* ... */ }
+>
+> // after
+> fn draw(&mut self, painter: &mut Painter) -> Size { /* ... */ }
+> ```
+>
+> `SizeCtx` and `Cache` are gone with it — see `LAYOUT.md` for the full
+> design, the move-offset mechanism this shipped alongside, and the file
+> list.

SUBAGENTS.md

@@ -1,289 +0,0 @@
-# Subagents
-
-A session's subagents -- helpers started by Claude Code's Task tool or Codex's
-collaboration tools -- each get a transcript of their own, listed in a panel
-over the open session and readable in the same transcript view the session has.
-Designed 2026-09-05; extended to Codex's multiplexed app-server threads on
-2026-09-13. The decisions Bryan has not yet reviewed are in `DECISIONS.md`.
-
-## What a subagent is here
-
-**A subagent is a second transcript owned by a session, in the same event
-model, with no process and no controls.** It is not a session: it cannot be
-messaged, stopped or started, and it has no machine, model or usage of its
-own. Everything it shares with a session -- the transcript file format, the
-paging routes, the SSE stream, the phone's cache and rendering -- is reused
-by addressing, not by copying.
-
-Claude reports a subagent's messages on the parent's own stream-json output,
-each carrying `parent_tool_use_id` = the id of the Task `tool_use` that started
-it. Before this the translator dropped those lines
-(`subagent_events_are_not_duplicated_into_the_transcript`); now it routes
-them to that subagent's own translator and transcript. The parent's
-transcript still shows only the Task call itself.
-
-Codex app-server multiplexes every thread in the session tree onto the root
-process's stdout. Its notifications carry `threadId`; `subAgentActivity`
-items name the child thread and its lifecycle, and `collabAgentToolCall`
-items carry the spawn prompt. The Codex translator routes a non-root
-`threadId` exactly as Claude routes a `parent_tool_use_id`. The child thread
-id is the subagent id on disk. An asynchronously delivered `agentMessage` is
-a `PeerMessage`, not assistant text from the recipient. Its delta notification
-does not repeat the completed item's `delivery` field, so the translator
-remembers that field from `item/started` and suppresses those deltas. Letting
-one into the recipient's provisional assistant row makes its next completed
-message replace the combined row, visibly erasing text that Codex still has.
-The parent draws the initial `spawnAgent` as its ordinary `Task` card and
-closes it when the matching `subAgentActivity.started` arrives. The remaining
-collaboration calls remain visible as coordination -- waiting, messaging,
-listing and lifecycle controls -- rather than being mistaken for generic task
-output. Null optional fields and a bare `completed` status carry no information
-and are omitted; their useful result is the child transcript, status or peer
-message beside them.
-
-## Storage
-
-Under the session directory:
-
-```
-<session>/subagents/<subagent_id>/meta.json         {title, created}
-<session>/subagents/<subagent_id>/transcript.jsonl  same SeqEvent lines as the session's
-```
-
-The id is Claude's Task tool_use id (`toolu_…`) or Codex's child thread id.
-Both are unique, stable across a backend restart, and already the key their
-parent-side lifecycle uses.
-Only ids matching `[A-Za-z0-9_-]+` are ever created or looked up, since the
-id becomes a path.
-
-The transcript's sequence numbers are its own, starting at 1. `Transcript`,
-`read_window`, `catch_up` and `read_after` work on it unchanged.
-
-Its path out: deleting the session deletes its directory, subagents included,
-and `POST /sessions/{id}/subagents/delete` removes finished ones on their own
--- all or nothing, and refused while any named one is still running, since its
-transcript is still being written to and its process is the session's to stop.
-
-## Lifecycle, as events in the subagent's transcript
-
-1. Created when the parent Task/Agent call is seen. A current Claude CLI's
-   `task_started` with `task_type: local_agent` is a recovery source when an
-   adopted stream begins after that call. A bare `parent_tool_use_id` is not
-   enough: other operations can also parent nested lines, and treating one as
-   proof created false subagents named after their first subcommand.
-   First lines written:
-   `Status Running`, then `UserMessage { text: <the Task's prompt> }` when
-   the prompt is known -- it genuinely is the subagent's first user turn.
-2. Every child line is translated by that subagent's own `Translator`
-   (one per subagent: tool ids are unique but streaming deltas are by
-   content-block index, and parallel subagents interleave).
-3. **What ends a subagent is the CLI's own task lifecycle**, on top-level
-   `system` lines that carry no `parent_tool_use_id`: `task_started`
-   (`task_id`, `tool_use_id`, `task_type`, `is_backgrounded`, the prompt),
-   `task_progress` repeatedly, then `task_updated` (`patch.status`, naming the
-   *task* only) and `task_notification` (`tool_use_id`, `status`, and `summary`
-   -- the agent's own report). `translate_task` keeps the
-   `task_id -> tool_use_id` mapping from the first so the update can be
-   attributed, records the summary as the subagent's closing text, and writes
-   `Status Exited`. A
-   `completed` update is deliberately not the end: its notification carries
-   the summary and would otherwise land after the ending. Any other terminal
-   status ends it from the update, since the failure to avoid is a subagent
-   nothing ever finishes.
-
-   Since Claude Code 2.1.261, `background_tasks_changed { tasks: [...] }` is
-   the authoritative level beside those edges: its set replaces the previous
-   set, so a missed terminal edge cannot leave a subagent running forever. Its
-   ids are deliberately not correlated with the edge stream; what is read off
-   each entry is its own description and kind, and what is read off the set is
-   whether it is empty and how large. The session API and stream expose that
-   size as `backgroundTasks`, which the phone draws beside the status, and
-   `GET /sessions/{id}/background` serves the entries themselves -- listed in
-   the session's panel *above* the subagents and never as subagent cards. An
-   `ambient` entry is excluded from both, on the CLI's own instruction: a
-   live-update watcher is not activity. A backgrounded subagent is legitimately
-   in both lists, since it is both running and a transcript. The edges still
-   carry mapping, outcome and closing summary. On adoption the driver sends a repeated `initialize`,
-   which makes a current CLI send the full set; an older CLI accepts it and sends no level,
-   leaving the edge-based path unchanged. A snapshot is reconciled immediately
-   when the persisted parent status proves it is between turns, and otherwise
-   at the next `result` boundary -- while a turn is open, a foreground agent is
-   legitimately absent from the background set. Reconciliation writes
-   `Status Exited`, which is also what makes a formerly stale row deletable;
-   a task notification ordered after the level can still add its summary.
-
-   The two rules this replaces were both wrong, in opposite directions. The
-   parent's `tool_result` is not it: a backgrounded Task's arrives at launch
-   ("Async agent launched..."), so ending there truncated a running agent's
-   transcript at the moment it started. Nor is the subagent's own
-   `end_turn`: measured against 2.1.237 on 2026-09-06, **a subagent's lines
-   carry no `stream_event` at all** -- they are whole `user`/`assistant`
-   lines with a null `stop_reason`, no `result` line is sent for one, and the
-   sub's final report never appears as a child line -- so that rule could
-   never fire and every subagent stayed `running` for ever. `ends_a_turn` is
-   kept as a second detector for a dialect that does say either, and must
-   never be the only one again.
-
-   `Status Exited` either way; the subagent's vocabulary has no `Idle` or
-   `Waiting`, so the end-of-turn status `dispatch` produces for an ordinary
-   session is dropped rather than written.
-
-   **The ending reaches the parent's transcript as nothing at all**
-   (2026-09-06). It was tried, and a row per finished subagent is a screenful
-   of dividers about work the reader was not asking after; the closing report
-   is *this* transcript's last line and here is where somebody reads it. What
-   the parent gets a row for is a message a subagent genuinely sends it, which
-   arrives by the peer path. A backgrounded *command* is the other half of
-   this and goes the other way: it has no transcript of its own, so its report
-   updates the tool card that launched it, which was still saying the command
-   was running. The two lifecycle shapes are still handled once:
-   whichever gets there first is the one that finds the task still open, and
-   `finish` below closes it. See PLAN.md's "Two turns must never be drawn as
-   one".
-
-   **While any task is outstanding the session's turn ends in
-   `Status Waiting` rather than `Idle`.** `Idle` means "waiting for a person",
-   and a session with a backgrounded subagent is not doing that. The edge
-   fallback has two sources: the translator's `open_tasks`, and
-   `Subagents::any_open` -- which covers a subagent launched before a backend
-   restart adopted the session, whose `task_started` is behind the durable
-   stdout offset. On current Claude versions the replace-semantics level above
-   reconciles both at a safe turn boundary.
-
-   **A limit the account hits inside a subagent is hoisted to the session**
-   as well as recorded here, because `resume.rs` can only schedule against a
-   session, and a background subagent outliving its parent's turn is the
-   ordinary case -- see PLAN.md's "A limit a subagent hits is the session's".
-4. **A child line for a subagent that already finished reopens it**
-   (`Status Running`) rather than being dropped: a background Task can be
-   sent another message long after its first turn ended, and that is
-   exactly what a further line for it means. Same transcript, same child
-   `Translator`, just picking back up.
-5. When the parent session's process exits (`Status Exited` on the
-   session), every subagent still `Running` gets `Status Exited` too: its
-   process was the parent's. Read from the directory rather than from the
-   live map, because one left `Running` by a previous run of the server is
-   precisely the one nothing in this process has touched -- and it would
-   otherwise read `running` again every time its session was started.
-
-For Codex the same lifecycle is expressed by app-server rather than Claude's
-task notices: `subAgentActivity.started` creates the child,
-`subAgentActivity.interacted` reopens it, and `completed` or `interrupted`
-finishes it. A child's own `turn/completed` is not its end; it remains running
-until that activity edge. The root's `turn/completed` reports `waiting` while
-the registry contains an open child, and the last activity completion reports
-`idle` if the root is between turns. Because the child thread id is also the
-on-disk id, an adopted driver can route and finish a child whose spawn record
-is already behind the durable stdout offset. The registry's open count is also
-Codex's `backgroundTasks` measurement: lifecycle changes send it through the
-same event and session-summary fields as Claude's provider snapshot. The other
-part of that measurement is app-server's runtime
-`thread/backgroundTerminals/list` set. Its process ids are held only in memory
-and added to the open-child count; the driver refreshes the set at terminal
-boundaries and while it remains nonempty, rather than decrementing for an
-unmatched ending edge.
-
-A subagent that was mid-flight when the backend restarted keeps working:
-the registry reopens the existing transcript on the next child line, and
-the file continues its sequence -- the same reopening #4 describes, whether
-what closed it was a restart or its own `end_turn`. If its turn ended while
-the backend was down nothing recorded that until the next line arrives, so
-its last status stays `Running`, which the list reports as **unknown**
-rather than as running (see the wire shape) until then.
-
-Title: for Claude, the Task call's `description` input, then
-` (<subagent_type>)` when one is given; falling back to `Task` when the
-description is absent. An adopted current CLI can recover the same fields from
-its `local_agent` lifecycle record. For Codex, the first lifecycle record uses
-the spawned thread's name or the last segment of `agentPath`, with underscores
-shown as spaces, then falls back to `subagent`.
-
-## Server layout
-
-- `session/subagent.rs` -- the registry: `Subagents` (per session, in
-  `Shared`), `Subagent` (its `Transcript` behind a mutex plus a
-  `broadcast::Sender<SeqEvent>`), `record(id, event)`, `start(id, title,
-  prompt)`, `finish(id)`, `reopen(id)`, `finish_all()`, `list()` from disk, and
-  `delete(ids)` -- its path out. Drivers get an
-  `Arc<Subagents>` beside their `EventSink`; llama ignores it.
-- `session/claude/translate.rs` -- routes child lines by parent id, holds
-  one child `Translator` per subagent, remembers pending Task calls'
-  description/prompt/subagent_type.
-- `session/codex/translate.rs` -- routes multiplexed app-server notifications
-  by thread id, remembers collaboration prompts, and translates activity
-  edges into the same registry lifecycle.
-- `session/echo.rs` -- `/subagent [n]`: the test rig. Starts *n* (default 1)
-  subagents at once, each named "helper k". Each writes the prompt as its
-  user message, streams a few words of text, runs one `Bash` tool call, then
-  finishes about three seconds after starting, and the parent's Task calls
-  end when their subagent does. Three seconds so the running state can be
-  seen on the phone.
-- `routes.rs` -- four routes, in the doc table.
-
-## Wire shape
-
-```
-GET /sessions/{id}                       SessionInfo gains `subagents: N` (count, 0 when none)
-GET /sessions                            same field on each row
-GET /sessions/{id}/subagents             [{id, title, status, created, lastActivity}], oldest first
-GET /sessions/{id}/subagents/{sub}/transcript   exactly the session transcript's query and answer
-GET /sessions/{id}/subagents/{sub}/events?after=N  exactly the session events stream
-POST /sessions/{id}/subagents/delete     {subagents} -> 204; refused whole if one is running
-```
-
-The delete is a batch rather than a `DELETE` per id for the reason the import
-list's is: the phone deletes what a reader selected, and one request per row
-means a batch can half-arrive, leaving the rows that were missed looking
-exactly like rows nobody picked. Unlike an import delete it is local file
-removal, so it is done by the time the reply is sent and there is no per-row
-state to follow afterwards. What decides "running" is
-`Subagents::list`'s own rule, shared through `routes::has_a_process` so the
-list and the delete cannot disagree about it.
-
-`status` is the transcript's last `Status` event, serialised like a session's
-(`running`, `exited`), except that a subagent whose session is not itself
-running cannot be running: the list answers `unknown` for that one. A
-subagent never reports `waiting`: that is a session's word for having
-outstanding work of its own, and a subagent has none. The
-phone words these as *running*, *finished* and *unknown* on the subcard.
-
-The count on `SessionInfo` is a directory listing, so the list stays cheap.
-The per-subagent status is only read when the list route is asked for.
-
-## Phone
-
-- The subcards are ordered **still running first, then most recently
-  active** -- a display decision made on the phone (`subagentOrder`), over the
-  server's stable oldest-first answer. Two keys rather than activity alone
-  because a subagent that is thinking reports nothing meanwhile and would sink
-  below one that just finished.
-- **Holding a subcard selects it, and several at a time**, exactly as the
-  import list works, with the selection bar drawn inside the panel rather than
-  at the bottom of the session: this selection belongs to the subagent list,
-  and a bar under the composer would read as acting on the conversation.
-  Delete is
-  *disabled*, with the reason in words, while anything selected is still
-  running. Deleting confirms first, dims the rows it is acting on
-  (`BusyItem`), and on success takes them out of the panel without refetching
-  anything else. The phone's cached copy of
-  a deleted subagent's transcript is purged with it.
-- The main session list does not expand or count subagents. Swiping left over
-  an open session pulls an 88%-wide panel in from the right and fetches
-  `/sessions/{id}/subagents`; it draws one `OutlinedCard` per subagent: title,
-  then the status word and a relative time. The transcript remains composed
-  under the panel, so its event stream, draft and scroll position stay live.
-  Horizontal scrollers inside the transcript win the gesture. Collapsing one,
-  or starting over any ordinary part of the session, gives the gesture back to
-  the panel; Android keeps its own edge Back gesture. Swiping right on the
-  panel, tapping outside it, or Back closes it.
-- Tapping a subcard opens a `SessionScreen` layer in **read-only** form: the
-  same transcript, paging, cache, selection,
-  images and status row, with the composer, the process button, the model
-  picker, the files button, the settings cog and the usage bar left out.
-  The header shows the subagent's title with the session's title beneath it.
-  It is another layer over the still-composed session and its panel; Back
-  returns to the panel.
-- Addressing: `fetchTranscript`, `EventStream`, `TranscriptSource` and the
-  cache take a transcript address rather than a session id --
-  `sessions/{id}` or `sessions/{id}/subagents/{sub}` -- so the cache nests a
-  subagent's copy under its session's and the same code serves both.

TEXTURES.md

@@ -0,0 +1,496 @@
+# How iris should render an unbounded number of images
+
+## Status (2026-09-04)
+
+**Implemented**, on the `rustify` branch of `ai-app-2`, in `iris/core` and
+`iris/src/default/render.rs`. See "Implemented, 2026-09-04" at the bottom for
+what landed, what differs from the proposal below and why, and what was
+verified versus merely reasoned about. The short version: the binding array
+is gone, `request_device` asks for no features and no binding-array limits,
+and that is now proven on the emulator's software Vulkan
+(`rigs/gpu-probe`), not just read from the code. `RUST.md`'s blocking item
+is resolved.
+
+Iris (the person) asked whether iris's (the library's) approach to
+"draw however many images happen to be on screen" — relevant here because a
+transcript can hold an unbounded number of attached screenshots — actually
+works on mobile, her recollection being that it does not. Checked rather
+than assumed, on 2026-09-04, on the `rustify` branch of `ai-app-2`. This
+file is that investigation and the resulting recommendation, written for a
+second agent to review before anything in iris's render core changes — no
+code has been written against this yet.
+
+## The problem
+
+Every texture iris ever creates — every `Image` widget
+(`iris/src/widget/image.rs`) and every glyph atlas page — gets a permanent
+slot in one array via `Textures::add` (`iris/core/src/primitive/texture.rs:65`).
+Both of iris's texture-sampling primitives (`TEXTURE` and `GLYPH`) read that
+array by index: `core/src/render/shader.wgsl:56` declares
+`var views: binding_array<texture_2d<f32>>`, sized by
+`UiLimits::default()` (`core/src/render/mod.rs:347`) at **100,000 textures,
+1,000 samplers**. Getting a device to accept that layout needs three wgpu
+features — `TEXTURE_BINDING_ARRAY`,
+`SAMPLED_TEXTURE_AND_STORAGE_BUFFER_ARRAY_NON_UNIFORM_INDEXING`,
+`PARTIALLY_BOUND_BINDING_ARRAY` — which correspond to Vulkan's
+`VK_EXT_descriptor_indexing` ("bindless"), promoted to Vulkan core at 1.2.
+
+A transcript with an unbounded number of image attachments is exactly the
+case that grows this array without bound: each attachment becomes its own
+`Image` widget, which takes its own permanent array slot until dropped.
+
+## What was measured
+
+**A new rig, `rigs/gpu-probe`**, asks a device for exactly iris's features
+and limits with no window and no APK — a plain executable pushed with
+`adb push` and run from `/data/local/tmp`. It has two parts:
+`wgpu::Adapter::request_device` with iris's exact `Features`/`Limits`
+(`src/main.rs`), and a raw Vulkan query bypassing wgpu entirely via `ash`
+(`src/vk.rs`), to tell "the driver doesn't have it" apart from "wgpu didn't
+detect it."
+
+- **On this VM's own GPU** (Vulkan via Venus onto an RX 7900 XT):
+  `IRIS DEVICE: ok`. Not the case that matters — nobody's phone is a
+  discrete desktop GPU — but it is why the design was never checked before
+  now: it always worked in the one place it was tried.
+- **On the Android emulator's guest Vulkan**, both ICDs it ships
+  (`vk_swiftshader_icd.json` and, cold-booted, `lvp_icd.json`/lavapipe):
+  `request_device` **fails** —
+  `Unsupported features were requested: TEXTURE_BINDING_ARRAY |
+  SAMPLED_TEXTURE_AND_STORAGE_BUFFER_ARRAY_NON_UNIFORM_INDEXING |
+  PARTIALLY_BOUND_BINDING_ARRAY`. The raw `ash` query on lavapipe shows the
+  driver itself reporting all seven descriptor-indexing sub-features as
+  `true` at device API version 1.3 — so wgpu-hal's own feature detection is
+  being more conservative than the driver here, for a reason not chased
+  further (a likely instance-version negotiation gap, since the extension
+  only promoted to core at 1.2). That part is a wgpu-hal/emulator question,
+  not the finding that matters, and is **not** why this design is rejected.
+
+**The finding that matters is about real phones, sourced rather than
+recalled:**
+
+- The **Android Vulkan Profile 2025** — Google and Khronos's current
+  baseline, covering **80.1% of active Vulkan-capable Android devices** as
+  of October 2025
+  ([developer.android.com/ndk/guides/graphics/android-vulkan-profile](https://developer.android.com/ndk/guides/graphics/android-vulkan-profile)) —
+  does **not** require `VK_EXT_descriptor_indexing` or any descriptor-
+  indexing feature. It requires `shaderSampledImageArrayDynamicIndexing`
+  (indexing by a value uniform across the invocation — Vulkan 1.0 baseline,
+  unrelated to bindless) and stops there; true of the 2021 and 2022
+  profiles as well.
+- Arm's own developer documentation states **"`VK_EXT_descriptor_indexing`
+  is supported on all Valhall and 5th Gen GPUs"**
+  ([developer.arm.com/mobile-graphics-and-gaming/vulkan-api-best-practices-on-arm-gpus](https://developer.arm.com/mobile-graphics-and-gaming/vulkan-api-best-practices-on-arm-gpus)) —
+  Mali generations from roughly 2019 (Mali-G77) onward, with no claim made
+  for Bifrost, Midgard or Utgard, which are still common in budget and
+  older Android phones that are still in daily use.
+- A search engine's summarized claim of "1% support on Android" for this
+  extension was checked against its cited source (an Arm blog post from
+  2021) and **was not actually there** — that number does not appear in
+  any primary source found and should not be repeated. The baseline-
+  profile finding above is the one with an attributable source; use it
+  instead.
+
+So this is not a software-renderer artifact. A real, currently-shipping
+share of the Android fleet lacks the feature iris's texture pipeline asks
+for unconditionally, and neither the emulator's failure nor the current
+official hardware baseline gives any reason to expect that to change soon.
+
+## What growth already costs today, before any redesign
+
+Checked directly in `core/src/render/mod.rs` and `core/src/render/texture.rs`,
+because "does this redesign make things worse" needs the current baseline
+first:
+
+- The `RenderPipeline` (`UiRenderNode::new`) is created **once** and never
+  rebuilt for any reason related to texture count — its bind group
+  *layouts* declare fixed slot counts (`limits.max_textures`,
+  `limits.max_samplers`) up front and that never changes at runtime. Growth
+  was never at risk of recreating the pipeline, in the current design or
+  any redesign discussed below.
+- What **does** get rebuilt: `UiRenderNode::update` calls
+  `self.textures.update(&mut ui.textures)`, and if that reports any change,
+  rebuilds `self.rsc_group` — one `BindGroup` whose entries are
+  `BindingResource::TextureViewArray(&tex_manager.views())`, collected
+  fresh over **every currently-live texture**, plus the sampler array and
+  the mask buffer. This happens on every texture `Push`, `Set`, or `Free`
+  — an image added anywhere in the whole app rebuilds one shared structure
+  referencing every other image too.
+- The one path already excluded from this, on purpose, is a `Patch` —
+  writing into an existing texture's pixels without changing which
+  textures exist. The code says why directly
+  (`core/src/render/texture.rs`, in `GpuTextures::update`): *"A patch
+  changes texture contents, not the binding array, so it must not report
+  `changed` — rebuilding the bind group per glyph is the cost this exists
+  to avoid."* This is exactly the mechanism I1 built for the glyph atlas:
+  growing an existing atlas page costs a `write_texture` into a sub-rect,
+  nothing else.
+
+So today, growth that stays inside an existing texture (glyphs added to an
+atlas page) is already free. Growth that adds a *new* texture — a new atlas
+page, or any standalone image — already rebuilds the one shared array
+regardless of how the array is populated, before any change discussed
+below. That existing cost is O(live texture count) in CPU work to collect
+the view list and in however expensive the driver finds a
+descriptor-set-sized-for-N-descriptors to be.
+
+## Prior art, checked rather than assumed
+
+Two independent projects were checked to see whether "atlas for images"
+is actually how this is normally done, rather than a guess:
+
+- **egui_wgpu** (`crates/egui-wgpu/src/renderer.rs` in emilk/egui), the
+  closest prior art to iris — an immediate-mode wgpu-backed UI library that
+  ships on Android. It keeps a `HashMap<TextureId, Texture>` and gives
+  **each texture its own ordinary `BindGroup`** — one texture, one sampler,
+  no array, no descriptor indexing of any kind. Draw calls are batched by
+  texture id and the bind group is switched between batches within the
+  render pass.
+- **Vello** — the renderer Masonry (E1/E2's Linebender stack) draws
+  through — hit the identical problem and wrote down why in their own
+  roadmap document
+  ([github.com/linebender/vello/blob/main/doc/roadmap_2023.md](https://github.com/linebender/vello/blob/main/doc/roadmap_2023.md)):
+  *"The number of images that may appear in a scene is not bounded, which
+  is not a good fit for the basic descriptor binding model... Until then,
+  we'll do a workaround of having a single atlas image containing all the
+  images in the scene."* Their reason is broader than Android — WebGPU 1.0
+  has no descriptor indexing at all — but it reaches the same conclusion
+  for the same shape of problem: atlas, not a bigger bindless array.
+
+**This is also a live hazard, not a solved one.** Vello's own changelog
+(Sparse Strips v0.2.0) lists a fix titled *"WebGL image-atlas allocation
+and growth on Mali-G52 GPUs, avoiding application-not-responding errors"*
+— an actual ANR, from atlas growth, on an actual mid-range Android GPU,
+in the renderer Masonry is built on. The same release added
+`AtlasSpaceDiagnostics`/`AtlasLayerDiagnostics` (per-layer free-space,
+utilization, fragmentation) because growth needed instrumenting in
+production, not because it turned out to be free.
+
+## Recommendation (not yet implemented)
+
+1. **Small, plentiful textures** — glyphs (already done, I1), thumbnails,
+   downscaled attachment previews, icons — go through a shared atlas, the
+   same technique as `core/src/render/atlas.rs` generalized beyond glyphs.
+   Adding one to an existing page is a `Patch`, already free per the
+   section above.
+2. **Large or one-off images** — a photo attachment opened at full
+   resolution, anything that would fragment a shared page — get their
+   **own ordinary, non-array bind group**, the egui_wgpu way. Creating one
+   is O(1): it references only itself, and does not touch any other
+   texture's binding, unlike today's shared array where every push
+   rebuilds a structure listing everything.
+3. **Opening a new atlas page** is the one case that still resembles
+   today's rebuild — infrequent (bounded by how many *pages* are needed,
+   not by how many images have ever been attached) but not free, and
+   Vello's Mali-G52 fix says this specifically deserves care: it should
+   never be allowed to block a frame, and it is worth having the
+   equivalent of Vello's atlas diagnostics before trusting it under load.
+4. **Net effect**: dropping `TEXTURE_BINDING_ARRAY`,
+   `SAMPLED_TEXTURE_AND_STORAGE_BUFFER_ARRAY_NON_UNIFORM_INDEXING`, and
+   `PARTIALLY_BOUND_BINDING_ARRAY` from iris's device request entirely.
+   Every path above is plain Vulkan 1.0 / GLES-level texture sampling.
+   This is also what fixes the emulator failure measured above, regardless
+   of the unresolved wgpu-hal question: a device that never asks for the
+   feature cannot be refused for lacking it.
+
+## What this touches, and what is still open
+
+Implementing this reworks iris's rendering core: the shader's binding
+group layout (`shader.wgsl`), `Textures` and `GpuTextures`
+(`core/src/primitive/texture.rs`, `core/src/render/texture.rs`), both
+texture-sampling primitives, and `core/src/ui/painter.rs`'s draw-call
+batching (today one draw call can reference any texture by index; the
+per-texture-bind-group path needs draws grouped by which bind group they
+use). Nothing has been started.
+
+Open questions a reviewer should weigh in on:
+
+- **The size threshold** between "goes in an atlas page" and "gets its own
+  bind group." Too low and ordinary attachment thumbnails end up as
+  one-off bind groups, losing the batching benefit the atlas exists for;
+  too high and a page fragments on a handful of medium images.
+- **Eviction policy** for atlas pages once the working set does not fit —
+  today's `GlyphAtlas` never evicts, because a font's glyph set is small
+  and bounded; images are not. An LRU at the page level, or at the
+  individual-image level within a page, has not been designed.
+- **Whether iris should keep any binding array at all**, even a small
+  fixed one (say, capped at a few dozen slots) for atlas pages themselves,
+  or whether every atlas page should also be its own ordinary bind group
+  like standalone images — the array's only remaining justification would
+  be avoiding a bind-group-per-draw-call switch cost that has not been
+  measured on this project's actual target hardware.
+- **How this interacts with I2/E2's virtualised list** (I3): a
+  bottom-anchored transcript composes only visible rows, so the live
+  texture set should already be bounded by what is on screen rather than
+  by the whole conversation — worth confirming that invariant holds before
+  relying on it to keep atlas/bind-group churn small.
+
+## Review, 2026-09-04
+
+A second pass over the file above against the code, done before anything
+is implemented. Iris's worry going in: a bind group per texture means a
+draw call per image, and she wants this as efficient as it can be.
+
+### What checked out
+
+Every code reference above is accurate as of this commit: the 100,000 /
+1,000 limits, the one-time pipeline, the `rsc_group` rebuild on every
+`Push`/`Set`/`Free`, and the `Patch` exclusion. The device request that
+asks for the three features is `iris/src/default/render.rs:96`, which the
+text above does not name. egui-wgpu and Vello are described correctly.
+
+### The emulator refusal is a wgpu-hal gap, now located
+
+The file guessed "a likely instance-version negotiation gap." It is
+narrower than that and it is in wgpu-hal, not the emulator. wgpu-hal
+28.0.0 (`src/vulkan/adapter.rs:1618`) only queries
+`PhysicalDeviceDescriptorIndexingFeaturesEXT` **when the device advertises
+the `VK_EXT_descriptor_indexing` extension string**. A Vulkan 1.2+ driver
+that has descriptor indexing as core need not list the extension, and
+lavapipe at 1.3 evidently does not, so wgpu never asks and reports the
+features absent, which is why `ash` sees seven `true`s and wgpu sees none.
+The properties query beside it (line 1486) correctly accepts
+`device_api_version >= 1.2 || extension`; the features query does not.
+wgpu-hal 30.0.1 in the local registry has the same asymmetry (lines
+1872 and 2036). Worth an upstream issue, but not a reason to keep the
+design: on real phones the gate that matters is stricter still.
+
+**wgpu's `TEXTURE_BINDING_ARRAY` needs six sub-features, not one**
+(`adapter.rs:160-177`): non-uniform indexing *and* update-after-bind for
+sampled images, storage images and storage buffers, all together, because
+wgpu marks every array-bearing descriptor set update-after-bind. So Arm's
+"the extension is supported on Valhall" is necessary but not sufficient;
+a driver with sampled-image indexing and without storage-buffer
+update-after-bind is refused too. That widens the excluded set beyond
+what the Arm quote suggests and strengthens the conclusion.
+
+### A live bug in the current code, found on the way
+
+`GpuTextures::update` (`core/src/render/texture.rs:33`) implements
+"a patch must not report changed" as `changed = false`, unconditionally,
+which also **cancels a `Push` earlier in the same batch**. That ordering is
+exactly what opening a new atlas page produces: `GlyphAtlas::allocate`
+pushes the page and `insert` patches it in the same frame, so the bind
+group is not rebuilt and the new page's view is not bound until some
+unrelated texture change happens to rebuild it. It is hidden today only
+because the masks path also sets `changed`. The fix is one line
+(`changed |= !matches!(update, Patch)` in spirit); it should go in with
+the redesign since that code is being replaced, and it is recorded here
+so it is not rediscovered.
+
+### In-layer draw order is already undefined
+
+Relevant to any batching redesign: `Primitives::apply_free`
+(`core/src/render/primitive.rs:147`) uses `swap_remove`, so the instance
+order within a layer is permuted whenever anything is freed. Overlap order
+inside one layer is therefore not something the renderer promises today;
+ordering is done with layers. That means grouping a layer's draws by
+texture, or drawing a layer's images after its rects and glyphs, loses
+nothing that currently exists. It should be written down as an invariant
+when the redesign lands, because the new code will depend on it.
+
+### On "a draw call per image"
+
+Two corrections to the worry. First, it is a draw per *distinct texture per
+layer*, not per image primitive: every glyph quad in a layer shares the
+atlas and stays one instanced draw, and a thumbnail atlas would do the same
+for previews. Second, the count is bounded by what is on screen, which I3's
+virtualised transcript already bounds, and a mobile GPU is not draw-call
+bound at tens of draws per frame; egui ships exactly this on Android. What
+does cost is per-frame *bind group creation* and per-frame *sorting*, and
+the current code already creates a `primitive_group` bind group every time
+a layer updates (`render/mod.rs:103`), so one more per new image is not a
+regression in kind.
+
+### Recommended shape (proposal, for Iris to accept or change)
+
+Aimed at the fewest moving parts that need no feature beyond Vulkan 1.0:
+
+1. **Atlas pages become layers of one `texture_2d_array`**, not separate
+   textures. Every page is already `PAGE`x`PAGE` RGBA8, which is the one
+   constraint an array texture imposes. A layer index is an ordinary
+   sampling operand in WGSL and needs no indexing feature, so `GLYPH`
+   (and any future atlased-image primitive) carries a layer instead of a
+   `view_idx` and all of a layer's text stays **one draw**. This answers
+   the open question above about keeping a small binding array: no. Cost
+   of opening a page: recreate the array with one more layer and
+   `copy_texture_to_texture` the old ones, GPU-side, no readback; grow
+   with headroom (double) so it is rare. wgpu's default
+   `max_texture_array_layers` is 256, at 4 MB each, so the cap is memory
+   rather than the API.
+2. **Every standalone image is its own texture with its own bind group**,
+   and its instances live in a **separate per-layer instance list**, not
+   the main one. Then the main instance buffer never contains an image,
+   there is nothing to sort, no handle remapping beyond what
+   `apply_free` already does, and each image is `draw(0..4, k..k+1)` with
+   its bind group set first. Group 2's layout becomes `{atlas array,
+   one image texture, sampler, masks}`; the main draw binds a 1x1 null
+   image in the image slot, each image draw binds its own. One pipeline,
+   one shader, one layout.
+3. **No thumbnail atlas in the first version.** With images on their own
+   textures, the threshold and eviction questions above disappear: an
+   image is freed when the row that owns its `TextureHandle` scrolls out.
+   Add an image atlas only if a measured screen shows enough small images
+   to matter, which a transcript rarely does.
+4. **Drop the three features and the two `max_binding_array_*` limits from
+   `src/default/render.rs`**, and the `UiLimits` counts with them.
+5. **Sampling is `NonFiltering` today** (`render/mod.rs:290,299`), so a
+   downscaled attachment will alias. Either request a filtering sampler
+   for the image slot or downscale on the CPU before upload; decide when
+   the image widget is touched, not as part of this.
+
+What this costs against the file's original recommendation: `Textures`
+needs to know an image from a page (two kinds of handle, or a kind on
+`TextureHandle`), and `Primitives` gets a second instance list per layer.
+What it saves: the sort, the size threshold, the eviction policy, and any
+per-page bind group switch.
+
+## Implemented, 2026-09-04
+
+The shape above, built as proposed with one structural addition the proposal
+didn't need to spell out and one bug it predicted made moot rather than
+literally fixed. Files: `core/src/primitive/texture.rs` (`Textures`,
+`TextureHandle`), `core/src/render/texture.rs` (`GpuTextures`),
+`core/src/render/primitive.rs` (`Primitives`, `GlyphPrimitive`),
+`core/src/render/atlas.rs`, `core/src/ui/painter.rs`,
+`core/src/render/mod.rs` (`UiRenderNode`, `UiLimits` removed),
+`core/src/render/shader.wgsl`, `src/default/render.rs`, and
+`rigs/gpu-probe/src/main.rs`.
+
+**1. Atlas pages as array layers.** `GpuTextures` owns one
+`texture_2d_array` (`array_texture`/`array_view`), grown by doubling
+(`grow_array`): a new texture is created at twice the layer capacity, the
+old layers are copied across with `copy_texture_to_texture` (GPU-side, no
+readback), and every bind group that referenced the old view — the main
+one and every live standalone image's — is rebuilt, since the view's
+identity changed. `GlyphPrimitive` carries `layer: u32` instead of
+`view_idx`/`sampler_idx`; the layer number is assigned synchronously in
+`Textures::add_page` (a plain counter, `next_page_layer`), not by the
+renderer, because `GlyphAtlas::insert` needs it in the same call, before
+any GPU sync happens — the renderer only finds out later, when it
+processes the queued `Push`.
+
+**2. Standalone images, one bind group each.** `TextureKind` on
+`TextureHandle`/`Textures` distinguishes `Image` (a plain bind-group index,
+`slot`) from `Page { layer }`. `Primitives` gained a second per-layer list
+— `images: Vec<PrimitiveInstance>`, tagged `IMAGE_BINDING` — separate from
+`instances` (rects and glyphs), written by `Painter::write_image` rather
+than through the generic `Primitive` trait, since an image has nowhere in
+`PrimitiveData` to put a per-instance entry once the bind group already
+picks the texture. `UiRenderNode::draw` draws a layer's `instance` buffer
+once as before, then walks `image_instance` one entry at a time, binding
+that texture's `BindGroup` (`GpuTextures::image_bind_group`) and issuing
+`draw(0..4, k..k+1)` per image. Group 2's layout is exactly the proposed
+`{atlas array, one image texture, sampler, masks}`; the main draw binds a
+1x1 null view in the image slot.
+
+**The one addition beyond the proposal**: the masks storage buffer lives
+in every per-image bind group (group 2, binding 3), and `ArrBuf<Mask>`
+recreates its buffer whenever the mask count changes size
+(`render/util/mod.rs`'s `ArrBuf::update` now returns whether it resized).
+A resize invalidates every bind group holding the old buffer, not just the
+main one, so `GpuTextures::update` takes a `masks_resized: bool` and calls
+`rebuild_image_bind_groups` when it's set, alongside the same rebuild the
+array-growth path already needed. This wasn't a design question the
+proposal had to answer (it treated bind-group construction as a given),
+but it's exactly the shape of trap layer growth already had, so it uses
+the same fix.
+
+**3. No thumbnail atlas.** Not built, as proposed.
+
+**4. Removed**: `TEXTURE_BINDING_ARRAY`, `PARTIALLY_BOUND_BINDING_ARRAY`,
+`SAMPLED_TEXTURE_AND_STORAGE_BUFFER_ARRAY_NON_UNIFORM_INDEXING` from
+`src/default/render.rs`'s `request_device`, and `UiLimits` (the type
+itself, not just its binding-array methods — once its two fields were
+gone there was nothing left in it, and `UiRenderNode::new` no longer takes
+a limits parameter). `binding_array` no longer appears anywhere in
+`shader.wgsl`.
+
+**5. Sampling** is still `NonFiltering`, unchanged, per the proposal's own
+note that this is a separate decision for whenever the image widget itself
+is touched.
+
+**The `changed = false` bug is structurally gone, not patched.** The old
+`GpuTextures::update` held one `changed: bool` that a `Patch` reset
+unconditionally, which could erase an earlier `Push` in the same batch (a
+new atlas page's `Push` immediately followed by `GlyphAtlas::insert`'s
+`Patch`, both queued before the renderer ever runs). The new `update`
+computes the rebuild signal by OR-ing each event's own answer
+(`rebuild_main |= self.push(...)`), and `Patch`'s arm simply never
+contributes to it — there is no shared mutable flag left for a `Patch` to
+stomp on. Documented at the call site
+(`core/src/render/texture.rs`, `GpuTextures::update`'s doc comment and the
+`Patch` match arm's comment) rather than fixed as a one-line diff, since
+the mechanism that could go wrong no longer exists.
+
+**In-layer draw order is an explicit invariant now, not just a fact about
+`swap_remove`.** `UiRenderNode::draw` draws every layer's images after its
+rects and glyphs, and `Primitives::apply_free`'s doc comment states
+directly that both of a layer's lists (`instances` and `images`) free with
+`swap_remove` and that nothing may assume adjacency survives a free —
+recorded there because `apply_free` is the one place a change to either
+list's ordering would have to be reconciled.
+
+**Verified:**
+
+- `cargo fmt --all -- --check`, `cargo build --workspace --all-targets`,
+  `cargo clippy --all-targets`, `cargo test --workspace` all clean in
+  `iris/`, on the pinned `nightly-2026-09-03` toolchain. 14 tests pass
+  (unchanged from I1; nothing here is pure-logic enough to add a unit
+  test to — it's all GPU resource wiring).
+- `iris/run-headless.sh minimal --shot /tmp/minimal.png` and
+  `iris/run-headless.sh tabs --shot /tmp/tabs.png`: both render correctly
+  on this VM's GPU (Venus) — `tabs`'s glyph-atlas text renders in every
+  panel, confirming `GlyphPrimitive.layer` addresses the array correctly.
+- The standalone-image path specifically: a throwaway example (not
+  committed) with an `image(...)` widget as part of the root, run the same
+  way, rendered the image next to glyph-atlas text in one frame —
+  confirming a live `BindGroup` built by `GpuTextures::create_image` and
+  bound per-`draw()` call actually samples the right texture. `tabs`'s own
+  "image span" tab exercises the same widget but needs a click to reach,
+  which the headless compositor can't deliver (no seat devices, per I1's
+  own note on this file) — the throwaway example is what stood in for it.
+- **Exercised, 2026-09-04: `grow_array` under real load, on `tabs`.**
+  Rather than building a purpose-made glyph flood, `PAGE`
+  (`core/src/render/atlas.rs`) was temporarily dropped from 1024 to 64 —
+  small enough that `tabs`'s ordinary mix of sizes and families (nothing
+  exotic: a handful of `Text` widgets at a few sizes, one at
+  `Family::Monospace`) already exceeds one page's worth of distinct
+  glyphs. A one-line `eprintln!` in `grow_array` confirmed two real grows
+  in a single run (`GROW_ARRAY: 1 -> 2` then `GROW_ARRAY: 2 -> 4`, i.e.
+  glyphs landed on at least a third layer), and
+  `iris/run-headless.sh tabs --shot` showed every tab's text rendering
+  correctly with no corruption or missing glyphs — confirming the
+  `copy_texture_to_texture` grow-and-relocate path and cross-layer
+  sampling (`GlyphPrimitive.layer` addressing a layer beyond the first)
+  both work. Command:
+  `sed -i 's/PAGE: u32 = 1024/PAGE: u32 = 64/' core/src/render/atlas.rs`,
+  rebuild, `./run-headless.sh tabs --shot /tmp/x.png`, then
+  `git checkout -- core/src/render/atlas.rs` to revert — this is a
+  throwaway diagnostic value, never a committed change, since a real
+  1024px page holding only a handful of glyphs at a time would be mostly
+  wasted space in normal use. Confirmed the revert left `tabs` and
+  `minimal` byte-identical to the pre-check screenshots afterward.
+- **The decisive check**, `rigs/gpu-probe` rewritten to request iris's new
+  (empty) feature/limit set and run on this checkout's own emulator
+  (`ai-app-2`, via `emu`), booted with `EMU_GPU=software` so the guest gets
+  a real Vulkan device (SwiftShader) rather than the `-gpu host` default,
+  which disables Vulkan in this VM entirely (`-feature -Vulkan`, because
+  gfxstream can't pair Venus with the real GPU here — worth remembering,
+  since the *default* `emu up` gives a device with **no** Vulkan adapter
+  at all, which reads exactly like the old bindless failure if you don't
+  know to ask for `EMU_GPU=software`):
+
+      cd rigs/gpu-probe
+      ANDROID_NDK_HOME=$HOME/Android/Sdk/ndk/29.0.14206865 \
+        cargo ndk -t arm64-v8a -P 26 build --release
+      EMU_GPU=software emu up   # from ~/repos/emulator-tools
+      adb push target/aarch64-linux-android/release/gpu-probe /data/local/tmp/
+      adb shell chmod 755 /data/local/tmp/gpu-probe
+      adb shell /data/local/tmp/gpu-probe
+
+  Output: `adapters: 1 — Vulkan SwiftShader Device (Subzero) (Cpu)`,
+  `features iris requires:` (none listed — the set is empty),
+  `max_buffer_size … ok`, and **`IRIS DEVICE: ok`**. This is the fix
+  measured working, on the exact rig that first measured it failing.
+  Emulator stopped afterward (`emu down`); nothing was left running.

TODO.md

@@ -5,10 +5,6 @@ one in place when it turns out to need a decision.
 
 ## App — transcript
 
-- [ ] Decide how running background tasks can be inspected. For now the session
-      status shows only the provider-reported count; command details stay in
-      their existing tool cards and must not become subagent cards.
-
 - [ ] Messages received from other agents are inconsistent — sometimes they
       appear, sometimes they don't. **Needs a rig.** Read the code rather than
       measured: a live Claude session only learns of a peer message from the
@@ -37,21 +33,3 @@ one in place when it turns out to need a decision.
       that would work today, for Claude sessions, and it is the option that was
       not chosen.
 
-
-## A session the server could not load
-
-- [ ] **A session whose transcript will not parse is skipped with nothing but a
-      log line, and from the phone it looks exactly like an idle unresponsive
-      one.** `SessionManager::new` catches a failing `launch` and logs
-      "couldn't relaunch session <id>", so the session has no pump and no
-      driver: no status, no history, nothing sendable. That is what the
-      `taskNote` incident (fd71d87) looked like from Bryan's phone, and why it
-      needed a report from him rather than being visible in the app.
-      `Event::Unreadable` removes the cause that time, but not the class — an
-      unreadable `process.json`, a provider edited away and an unreachable host
-      all reach the same place.
-      This is the "design the unknown state first" rule: a session the server
-      could not load is not a session with nothing to say, and only the phone
-      can show the difference. It needs a status the wire can carry for it —
-      the failure with its reason, reported on the session itself — rather than
-      the reader having to tell it apart from silence.

app/androidApp/src/main/kotlin/com/example/aiapp/AppRoot.kt

@@ -1,9 +1,7 @@
 package com.example.aiapp
 
 import androidx.activity.compose.BackHandler
-import androidx.compose.foundation.background
 import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.imePadding
 import androidx.compose.foundation.layout.padding
 import androidx.compose.material3.AlertDialog
@@ -11,7 +9,6 @@ import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
-import androidx.compose.runtime.CompositionLocalProvider
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.key
@@ -22,7 +19,6 @@ import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.semantics.clearAndSetSemantics
 import androidx.compose.ui.unit.dp
 import com.example.wgapplink.localNetworkAllowed
 import kotlinx.coroutines.Dispatchers
@@ -33,39 +29,25 @@ import kotlinx.coroutines.withContext
  * One `when` rather than a navigation library: a handful of screens, with [Screen.Main] as the root
  * and the back button the only other way between them.
  *
- * Import, models and machines are tabs inside [MainScreen] -- four views of the same backend, none
- * of them a step down from another -- and what is left here is only what genuinely is a step down:
- * one session, spawning one, and settings.
+ * Import, models and setups are tabs inside [MainScreen] -- four views of the same backend, none of
+ * them a step down from another -- and what is left here is only what genuinely is a step down: one
+ * session, spawning one, and settings.
  */
 private sealed class Screen {
     data object Main : Screen()
 
     /**
-     * One session, with the file explorer or a subagent transcript over it when set.
+     * One session, with the file explorer over it when [files] is set.
      *
-     * Both are layers on this screen rather than screens of their own, so the session under them
-     * stays composed: its event stream keeps flowing, its scroll position and draft stay put, and
-     * coming back costs nothing. As sibling `Screen`s they would dispose and recreate it on every
-     * return, refetching the transcript over the tunnel.
+     * The explorer is a layer on this screen rather than a screen of its own, so the session under
+     * it stays composed: its event stream keeps flowing, its scroll position and draft stay put,
+     * and coming back from a file costs nothing. As a sibling `Screen` it would be disposed and re-
+     * created on every return, refetching the transcript over the tunnel.
      */
-    data class Session(
-        val summary: SessionSummary,
-        val files: FilesTarget? = null,
-        val subagent: SubagentSummary? = null,
-    ) : Screen()
+    data class Session(val summary: SessionSummary, val files: FilesTarget? = null) : Screen()
 
     data object Spawn : Screen()
 
-    /**
-     * One provider on one machine: its settings, and what its shared server is holding.
-     *
-     * A step down from the machines tab rather than a tab of its own, because it is about one
-     * machine rather than about the backend. Addressed by ids and names rather than by the
-     * [Provider] it was tapped from: what it shows is fetched, and a stale copy of a card would be
-     * a second version of the same truth.
-     */
-    data class ProviderSettings(val machineId: String, val provider: String) : Screen()
-
     data object Settings : Screen()
 }
 
@@ -196,7 +178,7 @@ fun AppRoot(
     // deliberately does not: resizing a whole screen on every frame of the keyboard animation is
     // the cost that made it lag, so it moves only its composer and transcript.
     when (val here = screen) {
-        Screen.Main ->
+        is Screen.Main ->
             Box(Modifier.imePadding()) {
                 MainScreen(
                     settings = current,
@@ -209,9 +191,6 @@ fun AppRoot(
                         screen = Screen.Session(imported)
                     },
                     onSettings = { screen = Screen.Settings },
-                    onProvider = { machineId, provider ->
-                        screen = Screen.ProviderSettings(machineId, provider)
-                    },
                 )
             }
         is Screen.Session ->
@@ -225,77 +204,6 @@ fun AppRoot(
                 // A Box so the explorer can be drawn *over* the session rather than instead of it.
                 // No imePadding here, for the reason above -- the explorer adds its own.
                 Box {
-                    val fileLinkHandler = rememberFileLinkHandler { path ->
-                        screen = here.copy(files = here.summary.filesTarget(path))
-                    }
-                    Box(
-                        Modifier.then(
-                            if (here.subagent != null || here.files != null)
-                                Modifier.clearAndSetSemantics {}
-                            else Modifier
-                        )
-                    ) {
-                        // How much background work the session has, from the one subscription
-                        // to its events the screen below holds. Here because the panel and that
-                        // screen both draw it, and must draw the same number.
-                        var backgroundTasks by
-                            remember(here.summary.id) {
-                                mutableIntStateOf(here.summary.backgroundTasks)
-                            }
-                        // Where the panel has asked the session screen to put the reader: the
-                        // call a background task was started by. Held here rather than inside
-                        // either, because the two are siblings -- the panel is the one being
-                        // tapped and the transcript is the one that can travel.
-                        var goTo by remember(here.summary.id) { mutableStateOf<CallSite?>(null) }
-                        // The two panels this session can be pulled aside for: its subagents
-                        // from the right, and the whole main screen from the left. Both are here
-                        // rather than screens of their own for the same reason the explorer is --
-                        // the session under them stays composed. The main panel exists only
-                        // inside a session, which is what makes it unswipeable until one has been
-                        // opened.
-                        SidePanels(
-                            left = { active, close ->
-                                MainPanel(
-                                    settings = current,
-                                    sessionId = here.summary.id,
-                                    active = active,
-                                    onOpen = { screen = Screen.Session(it) },
-                                    onSpawn = { screen = Screen.Spawn },
-                                    onImported = { imported ->
-                                        reloadToken++
-                                        screen = Screen.Session(imported)
-                                    },
-                                    onSettings = { screen = Screen.Settings },
-                                    onProvider = { machineId, provider ->
-                                        screen = Screen.ProviderSettings(machineId, provider)
-                                    },
-                                    onClose = close,
-                                    onGone = goToMain,
-                                )
-                            },
-                            // The whole width: it stands in for the screen Back would have shown,
-                            // rather than sitting over the session the way the subagents do.
-                            leftFraction = 1f,
-                            right = { active, close ->
-                                SubagentPanel(
-                                    settings = current,
-                                    summary = here.summary,
-                                    active = active,
-                                    backgroundTasks = backgroundTasks,
-                                    onOpenSubagent = { screen = here.copy(subagent = it) },
-                                    // Closed with it: what the reader asked to see is under this
-                                    // panel, and a panel left open over the answer is the one
-                                    // thing the tap cannot have meant.
-                                    onOpenCall = {
-                                        goTo = it
-                                        close()
-                                    },
-                                )
-                            },
-                        ) {
-                            CompositionLocalProvider(
-                                LocalFileLinkHandler provides fileLinkHandler
-                            ) {
                     SessionScreen(
                         settings = current,
                         summary = here.summary,
@@ -303,29 +211,7 @@ fun AppRoot(
                         onFiles = { screen = here.copy(files = it) },
                         share = share,
                         onShareTaken = { share = null },
-                                    onBackgroundTasks = { backgroundTasks = it },
-                                    goTo = goTo,
-                                    onGoToTaken = { goTo = null },
                     )
-                            }
-                        }
-                    }
-                    here.subagent?.let { subagent ->
-                        BackHandler { screen = here.copy(subagent = null) }
-                        Box(
-                            Modifier.fillMaxSize().background(MaterialTheme.colorScheme.background)
-                        ) {
-                            key(subagent.id) {
-                                SessionScreen(
-                                    settings = current,
-                                    summary = here.summary,
-                                    onBack = { screen = here.copy(subagent = null) },
-                                    onFiles = {},
-                                    subagent = subagent,
-                                )
-                            }
-                        }
-                    }
                     // Its own back handler is registered after this screen's, so it is the one the
                     // platform asks first, and it steps back inside itself before closing.
                     here.files?.let { target ->
@@ -337,15 +223,6 @@ fun AppRoot(
                     }
                 }
             }
-        is Screen.ProviderSettings ->
-            Box(Modifier.imePadding()) {
-                ProviderScreen(
-                    settings = current,
-                    machineId = here.machineId,
-                    provider = here.provider,
-                    onBack = goToMain,
-                )
-            }
         is Screen.Spawn ->
             Box(Modifier.imePadding()) {
                 SpawnScreen(

app/androidApp/src/main/kotlin/com/example/aiapp/AskQuestion.kt

@@ -20,6 +20,7 @@ import androidx.compose.material3.LocalContentColor
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedButton
 import androidx.compose.material3.OutlinedCard
+import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Surface
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
@@ -334,11 +335,12 @@ private fun OtherAnswer(text: String, onText: (String) -> Unit) {
     // No Send of its own: this is one more way to answer the question, and the card's Submit is
     // what sends it. A second send button beside the field made the shorter half of the card look
     // like the one that finishes it.
-    LabelledField(
-        label = "Other",
+    OutlinedTextField(
         value = text,
         onValueChange = onText,
-        modifier = Modifier.padding(top = 8.dp),
+        label = { Text("Other") },
+        singleLine = true,
+        modifier = Modifier.fillMaxWidth().padding(top = 8.dp),
     )
 }
 

app/androidApp/src/main/kotlin/com/example/aiapp/Attachment.kt

@@ -11,30 +11,6 @@ import androidx.compose.ui.text.font.FontFamily
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 
-/**
- * Whether a session can be sent a picture, as the server answers it.
- *
- * Three states rather than a switch, because for a local model the answer belongs to the server
- * that loaded it: one still coming off disk genuinely has not said. [UNKNOWN] is offered -- a
- * control withheld because nobody could ask is a photo button missing from a session that would
- * have read the photo perfectly well, and the send path says so if the guess was wrong.
- */
-enum class ImageSupport {
-    ACCEPTED,
-    REFUSED,
-    UNKNOWN,
-}
-
-/**
- * What the server called it; anything else -- an older server, a newer word -- is not an answer.
- */
-fun imageSupport(word: String): ImageSupport =
-    when (word) {
-        "accepted" -> ImageSupport.ACCEPTED
-        "refused" -> ImageSupport.REFUSED
-        else -> ImageSupport.UNKNOWN
-    }
-
 /**
  * Whether [ref] names an image the server stored as one -- `<hex>.<extension>`, with an extension
  * from the list it writes -- rather than a file kept under its own name. Mirrors the server's

app/androidApp/src/main/kotlin/com/example/aiapp/Attachments.kt

@@ -38,11 +38,6 @@ suspend fun uploadPickedImage(
  * Uploads whatever [uri] names, the way its kind needs. An image goes through [uploadPickedImage]
  * and is shrunk; anything else goes whole, under the name the other app or the file chooser gave
  * it, because the session is told that name rather than shown the bytes.
- *
- * A picture is refused here, before anything is read or sent, when [images] says this session's
- * model cannot read one. Here rather than beside the photo button because this is where every way
- * of attaching meets: the picker, the file chooser, and another app's share sheet -- and only the
- * first of those has a button to disable.
  */
 suspend fun uploadPicked(
     context: Context,
@@ -50,16 +45,10 @@ suspend fun uploadPicked(
     sessionId: String,
     uri: Uri,
     maxEdge: Int?,
-    images: ImageSupport,
 ): String {
     val resolver = context.contentResolver
     val mime = resolver.getType(uri)
     if (mime != null && mime.startsWith("image/")) {
-        if (images == ImageSupport.REFUSED) {
-            throw ApiException(
-                "this session's model can't read pictures, so that one wasn't attached"
-            )
-        }
         return uploadPickedImage(context, settings, sessionId, uri, maxEdge)
     }
     // Opened before the request starts, so a provider that refuses says so here and not from inside

app/androidApp/src/main/kotlin/com/example/aiapp/BackgroundTasks.kt

@@ -1,244 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.background
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.heightIn
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.width
-import androidx.compose.foundation.lazy.LazyListScope
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.LocalContentColor
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedCard
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.remember
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.semantics.contentDescription
-import androidx.compose.ui.semantics.semantics
-import androidx.compose.ui.text.font.FontFamily
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.dp
-
-/**
- * The background work a session has going, above its subagents in the panel [SidePanels] slides
- * over it from the right.
- *
- * Collapsed to its one-line count by default, the way everything else this app adds to a screen
- * arrives: what a reader came to the panel for is the subagents, and a run of cards about work
- * nobody asked after would push them off it. Expanding pushes them down instead of covering them,
- * so the two are read together.
- *
- * The count is drawn even when it is zero, in the same words. A section that appeared only once
- * something was running made its own presence the answer, and no heading at all draws "nothing is
- * running" and "nobody has asked yet" identically. There is then nothing to expand, so the heading
- * carries no chevron either: it is a statement rather than a control.
- */
-fun LazyListScope.backgroundTaskSection(
-    count: Int,
-    tasks: LoadState<List<BackgroundTaskSummary>?>,
-    expanded: Boolean,
-    onToggle: () -> Unit,
-    onRetry: () -> Unit,
-    onOpenCall: (CallSite) -> Unit,
-) {
-    item(key = "background-heading") {
-        Row(
-            verticalAlignment = Alignment.CenterVertically,
-            modifier =
-                Modifier.fillMaxWidth()
-                    .heightIn(min = 48.dp)
-                    .then(if (count == 0) Modifier else Modifier.clickable(onClick = onToggle)),
-        ) {
-            Text(
-                "${backgroundTaskLabel(count)} running",
-                style = MaterialTheme.typography.titleMedium,
-                modifier = Modifier.weight(1f),
-            )
-            if (count > 0) Chevron(if (expanded) Pointing.Up else Pointing.Down)
-        }
-    }
-    // The count as well as the switch: [tasks] is the last answer anybody got, so a section left
-    // expanded as the work finished would draw cards for tasks that have ended.
-    if (count == 0 || !expanded) return
-    when (tasks) {
-        is LoadState.Loading ->
-            item(key = "background-loading") {
-                CircularProgressIndicator(modifier = Modifier.width(24.dp).height(24.dp))
-            }
-        is LoadState.Error ->
-            item(key = "background-error") {
-                Column {
-                    Text(
-                        tasks.message,
-                        color = MaterialTheme.colorScheme.error,
-                        style = MaterialTheme.typography.bodySmall,
-                    )
-                    TextButton(onClick = onRetry) { Text("Try again") }
-                }
-            }
-        // Null is the provider declining to say, which a session whose process has gone answers.
-        // Said in words: the count above came from somewhere, and an empty space under it would
-        // read as the tasks having finished rather than as nobody being left to ask.
-        is LoadState.Loaded ->
-            when (val rows = tasks.value) {
-                null ->
-                    item(key = "background-unknown") {
-                        Text(
-                            "This session isn't saying what these are.",
-                            color = MaterialTheme.colorScheme.onSurfaceVariant,
-                            style = MaterialTheme.typography.bodyMedium,
-                        )
-                    }
-                else ->
-                    uniqueItems(rows, key = { "background-${it.id}" }) { task ->
-                        BackgroundTaskCard(
-                            task,
-                            onOpen = task.call?.let { call -> { onOpenCall(call) } },
-                        )
-                    }
-            }
-    }
-}
-
-/**
- * One background task: what it is doing, drawn as one line that says what kind it is by how it
- * looks.
- *
- * The kind used to be a second line under the words, which on a list of backgrounded commands was
- * "background command" repeated down the panel -- and for a provider that names a task by a process
- * id it was the *whole* card, so every row said the same two words. A mark carries the same
- * difference in a width the text does not have to make room for, and it is the [Glyph]'s
- * description that keeps the words for anybody who cannot see it.
- *
- * A command needs no mark: drawn the way every other verbatim thing here is -- highlighted,
- * monospace, on [rawSurface] -- it says "this is a command" in the same appearance the tool card it
- * came from uses, and a mark beside that would be the same fact twice.
- *
- * [onOpen] is where the call that started this is in the transcript, for the readers who tap it:
- * null where the provider never said which call it was, or where that call is no longer in the
- * transcript, and the card is then a statement rather than a control. The chevron is what says
- * which of the two this is, since a card that quietly does nothing when pressed is worse than one
- * that never invited the press.
- */
-@Composable
-private fun BackgroundTaskCard(task: BackgroundTaskSummary, onOpen: (() -> Unit)?) {
-    val look = backgroundTaskLook(task.kind)
-    // Null where a provider named the task by a process id and nothing resolved a command out of
-    // it: there is no code to draw, so the row takes the mark and the words instead.
-    val command = task.description?.takeIf { look.code }
-    OutlinedCard(Modifier.fillMaxWidth()) {
-        Row(
-            verticalAlignment = Alignment.CenterVertically,
-            modifier =
-                Modifier.fillMaxWidth()
-                    .then(
-                        if (onOpen == null) Modifier
-                        else
-                            Modifier.clickable(
-                                onClickLabel = "Show where this started",
-                                onClick = onOpen,
-                            )
-                    )
-                    .padding(horizontal = 12.dp, vertical = 10.dp),
-        ) {
-            if (command == null) {
-                Glyph(
-                    look.glyph,
-                    colour = MaterialTheme.colorScheme.onSurfaceVariant,
-                    modifier = Modifier.semantics { contentDescription = look.words },
-                )
-                Spacer(Modifier.width(10.dp))
-                // The kind stands in as the words where the provider gave no description, rather
-                // than the id it named the task by: Codex reports a process number, which says
-                // nothing to the person reading and would look like a name somebody chose.
-                Text(
-                    task.description ?: look.words,
-                    style = MaterialTheme.typography.bodyMedium,
-                    color =
-                        if (task.description == null) MaterialTheme.colorScheme.onSurfaceVariant
-                        else LocalContentColor.current,
-                    maxLines = 2,
-                    overflow = TextOverflow.Ellipsis,
-                    modifier = Modifier.weight(1f),
-                )
-            } else {
-                // Cut at its tail: what identifies a command is the program at its head, and the
-                // long ones are exactly the ones being read closely.
-                Text(
-                    // Not cached: one command line lexes in microseconds -- the cache exists for a
-                    // fence with two hundred lines in it.
-                    remember(command) { highlight(command, Language.SHELL) },
-                    style =
-                        MaterialTheme.typography.bodyMedium.copy(fontFamily = FontFamily.Monospace),
-                    maxLines = 2,
-                    overflow = TextOverflow.Ellipsis,
-                    modifier =
-                        Modifier.weight(1f)
-                            // Smaller than the card's own radius, for the reason [RawBlock] rounds
-                            // its corners that way: this sits inside one.
-                            .clip(MaterialTheme.shapes.extraSmall)
-                            .background(rawSurface)
-                            .padding(horizontal = 6.dp, vertical = 4.dp)
-                            // The fill says "command" to everybody else; this says it to a reader
-                            // who cannot see the fill.
-                            .semantics { contentDescription = "${look.words} $command" },
-                )
-            }
-            if (onOpen != null) {
-                Spacer(Modifier.width(8.dp))
-                Chevron(Pointing.Right)
-            }
-        }
-    }
-}
-
-/**
- * How one kind of background task is drawn: see [backgroundTaskLook].
- *
- * [code] is the kind whose description is verbatim text rather than prose, which is drawn as code
- * and takes no [glyph]; the glyph is still what a task of that kind falls back to when nothing said
- * what it ran.
- */
-private data class TaskLook(val glyph: String, val words: String, val code: Boolean)
-
-/**
- * Everything a [BackgroundTaskSummary.kind] decides, answered by one `when`.
- *
- * One rather than three, which is the rule this screen already learned once with the status word
- * and its colour: three `when`s over one set is two of them waiting to miss a member.
- *
- * A kind this build has not heard of takes the question mark and is named by what every one of them
- * has in common. The nearest word or mark we do know -- a robot, a terminal -- would be this screen
- * deciding what the server meant by a word it invented after this build shipped.
- */
-private fun backgroundTaskLook(kind: String) =
-    when (kind) {
-        // A command is drawn in the face a command is drawn in everywhere else here.
-        "command" -> TaskLook(COMMAND_GLYPH, "background command", code = true)
-        "agent" -> TaskLook(AGENT_GLYPH, "subagent", code = false)
-        "workflow" -> TaskLook(WORKFLOW_GLYPH, "workflow", code = false)
-        else -> TaskLook(UNKNOWN_GLYPH, "background task", code = false)
-    }
-
-/**
- * The heading over one group in the panel, so neither list is a run of cards with no name.
- *
- * The same band as the background section's own heading row above, rather than a gap chosen to look
- * right here: what separates a heading from the cards above it is that both headings sit in a row
- * of one height.
- */
-@Composable
-fun PanelSectionHeading(text: String) {
-    Row(verticalAlignment = Alignment.CenterVertically, modifier = Modifier.heightIn(min = 48.dp)) {
-        Text(text, style = MaterialTheme.typography.titleMedium)
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/Bubble.kt

@@ -1,15 +1,10 @@
 package com.example.aiapp
 
-import androidx.compose.foundation.layout.PaddingValues
-import androidx.compose.foundation.layout.size
-import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.foundation.shape.RoundedCornerShape
-import androidx.compose.material3.Button
 import androidx.compose.material3.ButtonDefaults
 import androidx.compose.material3.OutlinedButton
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Modifier
-import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.Shape
 import androidx.compose.ui.unit.dp
 
@@ -54,49 +49,3 @@ val BubbleShape: Shape = RoundedCornerShape(percent = 50)
  * ends that tall would bow its sides.
  */
 val BubbleMenuShape: Shape = RoundedCornerShape(20.dp)
-
-/**
- * A round button sized to the mark it draws.
- *
- * The composer's three actions -- attach, stop, send -- are single glyphs, and a pill's word-shaped
- * padding around one glyph was width taken from the pickers beside it: with a long model name on
- * the row, the permission mode ended up too small to hit. One diameter for all three, and it is the
- * platform's minimum touch target rather than a button's shorter default height.
- *
- * [fill] null draws the outlined form, for the one of the three that does not act on the session.
- */
-@Composable
-fun CircleButton(
-    onClick: () -> Unit,
-    modifier: Modifier = Modifier,
-    fill: Color? = null,
-    enabled: Boolean = true,
-    content: @Composable () -> Unit,
-) {
-    val sized = modifier.size(CircleButtonSize)
-    if (fill == null) {
-        OutlinedButton(
-            onClick = onClick,
-            enabled = enabled,
-            shape = CircleShape,
-            contentPadding = PaddingValues(0.dp),
-            modifier = sized,
-        ) {
-            content()
-        }
-    } else {
-        Button(
-            onClick = onClick,
-            enabled = enabled,
-            shape = CircleShape,
-            colors = actionButtonColors(fill),
-            contentPadding = PaddingValues(0.dp),
-            modifier = sized,
-        ) {
-            content()
-        }
-    }
-}
-
-/** How wide and tall one of those is; see [CircleButton]. */
-val CircleButtonSize = 48.dp

app/androidApp/src/main/kotlin/com/example/aiapp/CodeFence.kt

@@ -160,7 +160,6 @@ private val FENCE_LANGUAGES: Map<String, Language> =
         "shell" to Language.SHELL,
         "zsh" to Language.SHELL,
         "console" to Language.SHELL,
-        "diff" to Language.DIFF,
         "python" to Language.PYTHON,
         "py" to Language.PYTHON,
         "javascript" to Language.JAVASCRIPT,

app/androidApp/src/main/kotlin/com/example/aiapp/Compaction.kt

@@ -60,23 +60,3 @@ fun compactingLabel(seconds: Long?): String =
         seconds < 60 -> "compacting ${seconds}s"
         else -> "compacting ${seconds / 60}m ${seconds % 60}s"
     }
-
-/**
- * How full the session is, as the status row says it.
- *
- * Three states, not two, and the third is the one that needed the words: a session whose occupancy
- * is known and whose ceiling is not. That one keeps the bare figure, and a session with a ceiling
- * gets both — the reader can see which they are looking at. What must not happen is a missing
- * ceiling drawn as a number, or as a proportion of some assumed window, which would be this screen
- * inventing the very fact it does not have.
- *
- * A llama.cpp session always has one, since the window is a flag its own server was started with. A
- * coding CLI's is the vendor's business and neither control protocol states it, so those keep the
- * bare figure they have always had.
- */
-fun contextLabel(held: Long?, limit: Long?): String =
-    when {
-        held == null -> "context unknown"
-        limit == null -> "context ${tokens(held)}"
-        else -> "context ${tokens(held)} / ${tokens(limit)}"
-    }

app/androidApp/src/main/kotlin/com/example/aiapp/Dividers.kt

@@ -12,10 +12,6 @@ import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.unit.dp
-import java.time.Instant
-import java.time.ZoneId
-import java.time.format.DateTimeFormatter
-import java.time.format.FormatStyle
 
 /**
  * A line across the transcript saying what left the session's context.
@@ -40,28 +36,6 @@ fun TranscriptDivider(text: String, color: Color, modifier: Modifier = Modifier)
     }
 }
 
-/**
- * The rule between two replies that met with nothing said in between -- see
- * [TranscriptItem.TurnBreak].
- *
- * No words and no colour. Every other divider here reports something that happened and is worth
- * finding by scanning; this one only says "these are two", and it appears once per turn that
- * started without anybody typing. Saying more was a screenful of announcements about background
- * work the reader was not asking after -- one of them a whole shell command, drawn as centred prose
- * because the words came from somewhere that had no reason to keep them short.
- *
- * The outline colour is the scheme's one for structure rather than for meaning, which is what this
- * is. Inset from both edges so it reads as a separator between two rows rather than as the top edge
- * of the one under it.
- */
-@Composable
-fun TurnBreakRow(modifier: Modifier = Modifier) {
-    HorizontalDivider(
-        modifier.fillMaxWidth().padding(horizontal = 48.dp, vertical = 6.dp),
-        color = MaterialTheme.colorScheme.outlineVariant,
-    )
-}
-
 /**
  * The mark a clear leaves.
  *
@@ -73,40 +47,3 @@ fun TurnBreakRow(modifier: Modifier = Modifier) {
 fun ClearedRow(modifier: Modifier = Modifier) {
     TranscriptDivider("Context cleared", clearedColor, modifier)
 }
-
-/**
- * The mark running out of quota leaves.
- *
- * The same red the usage bar takes when a window is spent, because it is the same fact in a second
- * place: colour by consequence, so "there is nothing left to spend" is learned once.
- *
- * A time rather than a countdown. The row is folded once and never re-measured, so a span would go
- * stale on screen the moment it was drawn; and this is when the *account* said it would reset,
- * which is not a promise about when the session picks back up. A limit the session was told no
- * reset time for says nothing about one -- that state has its own words rather than a plausible
- * number.
- */
-@Composable
-fun LimitRow(item: TranscriptItem.LimitNote, modifier: Modifier = Modifier) {
-    TranscriptDivider(limitSummary(item.resetsAt, ZoneId.systemDefault()), overLimitColor, modifier)
-}
-
-/**
- * What the row says. Split out so the wording is testable without a screen, since the two states it
- * has to keep apart -- a reset time that arrived and one that never did -- are exactly the pair
- * that reads the same when it goes wrong.
- *
- * [zone] is a parameter rather than read here so a test says the same thing wherever it runs.
- */
-fun limitSummary(resetsAt: Double?, zone: ZoneId): String {
-    val at = resetsAt?.let {
-        try {
-            DateTimeFormatter.ofLocalizedTime(FormatStyle.SHORT)
-                .withZone(zone)
-                .format(Instant.ofEpochSecond(it.toLong()))
-        } catch (_: Exception) {
-            null
-        }
-    }
-    return if (at == null) "Usage limit reached" else "Usage limit reached • resets $at"
-}

app/androidApp/src/main/kotlin/com/example/aiapp/EventStream.kt

@@ -14,7 +14,7 @@ private const val RESET_EVENT = "reset"
  * mean. [close] from any thread ends it, and the caller owns reconnecting -- with the last seq it
  * saw as the new cursor.
  */
-class EventStream(settings: ServerSettings, private val address: TranscriptAddress) {
+class EventStream(settings: ServerSettings, private val sessionId: String) {
     private val stream = Sse(settings)
 
     fun close() = stream.close()
@@ -35,7 +35,7 @@ class EventStream(settings: ServerSettings, private val address: TranscriptAddre
         // one and the screen folds the other, and they have to be the same line.
         onEvent: (raw: String, event: SeqEvent) -> Unit,
     ) {
-        stream.run("/${address.urlPath}/events?after=$after", onOpen) { name, data ->
+        stream.run("/sessions/$sessionId/events?after=$after", onOpen) { name, data ->
             // A named frame carries no payload and a data frame has no name.
             if (name == RESET_EVENT) onReset()
             else if (data.isNotEmpty()) onEvent(data, parseSeqEvent(data))

app/androidApp/src/main/kotlin/com/example/aiapp/Events.kt

@@ -61,24 +61,6 @@ sealed class SessionEvent {
 
     data class AssistantText(val delta: String) : SessionEvent()
 
-    /** The durable value of the open assistant message, replacing its provisional deltas. */
-    data class AssistantTextFinal(val text: String) : SessionEvent()
-
-    /**
-     * The model's working, streamed the way its reply is: its own card, and deliberately not part
-     * of what the session said. Only a provider that actually streams its reasoning sends it.
-     */
-    data class Thinking(val delta: String) : SessionEvent()
-
-    /**
-     * The thinking above this finished, having taken [ms].
-     *
-     * Measured by the driver, because only it can see when the model stopped: this app knows when
-     * an event *arrived*, and the last fragment of a block followed by a slow tool call looks
-     * exactly like thinking that went on that long.
-     */
-    data class ThinkingDone(val ms: Long) : SessionEvent()
-
     data class ToolStart(val id: String, val tool: String, val input: String) : SessionEvent()
 
     data class ToolUpdate(val id: String, val output: String) : SessionEvent()
@@ -126,26 +108,6 @@ sealed class SessionEvent {
         val turnStart: Long? = null,
     ) : SessionEvent()
 
-    /**
-     * A line in the transcript this build cannot read: a kind a newer server wrote, or one an older
-     * server wrote that has since been dropped.
-     *
-     * [kind] is the word the line called itself, so the row can say what is missing rather than
-     * that something is. The server makes these when reading; no driver sends one.
-     */
-    data class Unreadable(val kind: String) : SessionEvent()
-
-    /**
-     * Retired on 2026-09-06, hours after it was added: a background task finishing, which turned
-     * out to be a screenful of notices about work nobody was asking after.
-     *
-     * Kept because a transcript is append-only -- the sessions that ran a background task in that
-     * window have these lines for ever. It draws no row, which is the whole reason it is still
-     * named here rather than left to fall through to [Unknown]: that would draw a placeholder per
-     * background task, which is the same wall the row was removed for.
-     */
-    object RetiredTaskNote : SessionEvent()
-
     /**
      * A command the session was asked to run on itself and cannot run yet. Resolved by
      * [CommandSent] with the same id; a command that ran straight away has only that one.
@@ -155,9 +117,6 @@ sealed class SessionEvent {
     /** The same command, handed to the session. */
     data class CommandSent(val id: String, val text: String) : SessionEvent()
 
-    /** Provider-reported number of background tasks alive now. */
-    data class BackgroundTasks(val count: Int) : SessionEvent()
-
     data class Status(val state: String) : SessionEvent()
 
     /**
@@ -168,16 +127,6 @@ sealed class SessionEvent {
      */
     data class Settings(val model: String?, val permissionMode: String?) : SessionEvent()
 
-    /**
-     * Whether a picture can be sent to this session now, as the thing serving its model answered.
-     *
-     * Only a llama.cpp session says this, and it says it twice per model: unknown the moment the
-     * old one is left, then the loaded server's answer. It carries no row -- it is what the
-     * composer's photo button is drawn from, and a line in the transcript about a control is not
-     * something anybody asked after.
-     */
-    data class Images(val images: ImageSupport) : SessionEvent()
-
     /**
      * What a turn cost, and how much the model was holding when it ended.
      *
@@ -186,25 +135,7 @@ sealed class SessionEvent {
      * so adding turns up would report a figure the session stopped being true of. Null where the
      * dialect did not say, which leaves the context unmeasured rather than unchanged.
      */
-    data class UsageDelta(
-        val tokens: Long,
-        val context: Long?,
-        /**
-         * How fast the reply came out, where the provider measured it -- null everywhere else,
-         * which is most of them. Never worked out here: the time this app watched a reply arrive
-         * over includes the network and whatever the server was doing between tokens.
-         */
-        val tokensPerSecond: Double? = null,
-        /**
-         * How long the provider spent reading the prompt before it began answering; null where
-         * nothing measured it. The same rule as [tokensPerSecond]: the provider's own figure, or
-         * nothing at all.
-         */
-        val prefillMs: Long? = null,
-    ) : SessionEvent()
-
-    /** How much context this session's model has, which is what [UsageDelta.context] is out of. */
-    data class ContextWindow(val tokens: Long) : SessionEvent()
+    data class UsageDelta(val tokens: Long, val context: Long?) : SessionEvent()
 
     /**
      * A compaction that finished, and how much context it recovered.
@@ -226,20 +157,6 @@ sealed class SessionEvent {
      */
     data object Cleared : SessionEvent()
 
-    /**
-     * The session stopped because its account's usage limit was reached.
-     *
-     * Its own event rather than an [Error] carrying the CLI's sentence, because it is a state
-     * rather than something that went wrong -- and because the raw sentence is `Claude AI usage
-     * limit reached|1788546972`, which is not readable by the person it is shown to.
-     *
-     * [resetsAt] is epoch seconds and null where the session was told nothing. Only the server acts
-     * on it; what this draws it as is a time, not a countdown, because nothing here re-measures it.
-     */
-    data class LimitReached(val resetsAt: Double?) : SessionEvent()
-
-    data class AuthenticationRequired(val message: String) : SessionEvent()
-
     data class Error(val message: String) : SessionEvent()
 
     /**
@@ -276,9 +193,6 @@ fun parseSeqEvent(json: String): SeqEvent {
                 )
             "messageDropped" -> SessionEvent.MessageDropped(body.getString("id"))
             "assistantText" -> SessionEvent.AssistantText(body.getString("delta"))
-            "assistantTextFinal" -> SessionEvent.AssistantTextFinal(body.getString("text"))
-            "thinking" -> SessionEvent.Thinking(body.getString("delta"))
-            "thinkingDone" -> SessionEvent.ThinkingDone(body.getLong("ms"))
             "toolStart" ->
                 SessionEvent.ToolStart(
                     id = body.getString("id"),
@@ -326,26 +240,19 @@ fun parseSeqEvent(json: String): SeqEvent {
                     body.getString("text"),
                     if (body.has("turnStart")) body.getLong("turnStart") else null,
                 )
-            "unreadable" -> SessionEvent.Unreadable(body.getString("kind"))
-            "taskNote" -> SessionEvent.RetiredTaskNote
             "commandQueued" ->
                 SessionEvent.CommandQueued(body.getString("id"), body.getString("text"))
             "commandSent" -> SessionEvent.CommandSent(body.getString("id"), body.getString("text"))
-            "backgroundTasks" -> SessionEvent.BackgroundTasks(body.getInt("count"))
             "status" -> SessionEvent.Status(body.getString("state"))
             "settings" ->
                 SessionEvent.Settings(
                     model = body.optString("model").ifEmpty { null },
                     permissionMode = body.optString("permissionMode").ifEmpty { null },
                 )
-            "images" -> SessionEvent.Images(imageSupport(body.optString("images")))
-            "contextWindow" -> SessionEvent.ContextWindow(body.getLong("tokens"))
             "usageDelta" ->
                 SessionEvent.UsageDelta(
                     body.getLong("tokens"),
                     if (body.has("context")) body.getLong("context") else null,
-                    if (body.has("tokensPerSecond")) body.getDouble("tokensPerSecond") else null,
-                    if (body.has("prefillMs")) body.getLong("prefillMs") else null,
                 )
             "compacted" ->
                 SessionEvent.Compacted(
@@ -354,12 +261,6 @@ fun parseSeqEvent(json: String): SeqEvent {
                     trigger = body.optString("trigger").ifEmpty { null },
                 )
             "cleared" -> SessionEvent.Cleared
-            "limitReached" ->
-                SessionEvent.LimitReached(
-                    if (body.has("resetsAt")) body.getDouble("resetsAt") else null
-                )
-            "authenticationRequired" ->
-                SessionEvent.AuthenticationRequired(body.getString("message"))
             "error" -> SessionEvent.Error(body.getString("message"))
             else -> SessionEvent.Unknown(type)
         }
@@ -374,21 +275,7 @@ fun parseSeqEvent(json: String): SeqEvent {
  * first time the server grows a state, and the drift would be a reply that never splits or one
  * split mid-stream.
  */
-fun sessionWorking(state: String): Boolean =
-    state == "running" || state == "compacting" || state == "loading" || state == "reading"
-
-/** Whether the latest events still say this session needs an explicit provider login. */
-internal fun authenticationPromptAfter(open: Boolean, event: SessionEvent): Boolean =
-    when (event) {
-        is SessionEvent.AuthenticationRequired -> true
-        // A later provider response proves an older authentication failure in a replayed page is
-        // no longer current. Without this, one old failure reopened sign-in after every later
-        // successful turn.
-        is SessionEvent.AssistantText,
-        is SessionEvent.AssistantTextFinal,
-        is SessionEvent.ToolStart -> false
-        else -> open
-    }
+fun sessionWorking(state: String): Boolean = state == "running" || state == "compacting"
 
 /**
  * The context after [event], given what it was before.
@@ -412,18 +299,3 @@ fun contextAfter(current: Long?, event: SessionEvent): Long? =
         is SessionEvent.Cleared -> null
         else -> current
     }
-
-/**
- * The context window after [event], mirroring the server's `context_limit_after` for the same
- * reason [contextAfter] mirrors its neighbour: the screen has to keep up between page loads.
- *
- * A window belongs to the process, so a session whose process has exited has none — left standing,
- * a session restarted on a different model would draw its occupancy against the old model's
- * ceiling.
- */
-fun contextLimitAfter(current: Long?, event: SessionEvent): Long? =
-    when (event) {
-        is SessionEvent.ContextWindow -> event.tokens
-        is SessionEvent.Status -> if (event.state == "exited") null else current
-        else -> current
-    }

app/androidApp/src/main/kotlin/com/example/aiapp/Field.kt

@@ -1,127 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.background
-import androidx.compose.foundation.border
-import androidx.compose.foundation.interaction.MutableInteractionSource
-import androidx.compose.foundation.interaction.collectIsFocusedAsState
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.shape.RoundedCornerShape
-import androidx.compose.foundation.text.BasicTextField
-import androidx.compose.foundation.text.KeyboardActions
-import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.material3.LocalTextStyle
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.remember
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.graphics.SolidColor
-import androidx.compose.ui.text.TextStyle
-import androidx.compose.ui.unit.dp
-
-/**
- * A text field whose label is a line above it rather than a thing floating inside it.
- *
- * Every field in this app goes through here, and the reason is vertical space. Material's outlined
- * field reserves room for a label that animates into its own border and pads the value by half a
- * line top and bottom, so one setting costs the height of three lines of text to hold one. A form
- * of ten settings is then a screen and a half of scrolling to read ten short answers.
- *
- * What is *not* shrunk is the value itself: it stays at body size, because what is expensive here
- * is the framing rather than the text, and a field whose contents are smaller than the text beside
- * it is a field the reader has to lean in to check. See UI_RULES on never shrinking text to fit.
- *
- * [hint] is what leaving it blank means, drawn inside the empty box. It had a grey line of its own
- * above the box until 2026-09-21: a form of a dozen settings was then mostly explanation, and a
- * setting should be a title and a box to type in. Inside, it costs no height and is gone the moment
- * anybody types -- which is the trade, since that is also when somebody might look back at it.
- */
-@Composable
-fun LabelledField(
-    label: String,
-    value: String,
-    onValueChange: (String) -> Unit,
-    modifier: Modifier = Modifier,
-    hint: String? = null,
-    enabled: Boolean = true,
-    /**
-     * How many lines the box is, at rest. One for a value; several for prose, where the reader is
-     * writing rather than filling in -- see `ParamKind::Prose`.
-     */
-    lines: Int = 1,
-    keyboardOptions: KeyboardOptions = KeyboardOptions.Default,
-    /** What the keyboard's own action key does, which is usually what the button beside it does. */
-    keyboardActions: KeyboardActions = KeyboardActions.Default,
-) {
-    Column(modifier.fillMaxWidth()) {
-        // Body size in the ordinary text colour, which is what a setting's label is where the
-        // control beside it is a switch or a picker. Smaller and greyer on the ones that are
-        // fields reads as two ranks of setting where there is one.
-        Text(label, modifier = Modifier.padding(bottom = 2.dp))
-        FieldBox(value, onValueChange, enabled, lines, keyboardOptions, keyboardActions, hint)
-    }
-}
-
-/** The box itself: the border, the padding, and the text. Shared so the two fields agree. */
-@Composable
-private fun FieldBox(
-    value: String,
-    onValueChange: (String) -> Unit,
-    enabled: Boolean,
-    lines: Int,
-    keyboardOptions: KeyboardOptions,
-    keyboardActions: KeyboardActions,
-    hint: String?,
-) {
-    val interactions = remember { MutableInteractionSource() }
-    val focused by interactions.collectIsFocusedAsState()
-    // The focused border is the accent at the same width as the resting one. Growing it instead
-    // would move the text inside by a pixel on every focus, which is a whole form twitching as the
-    // reader moves down it.
-    val edge =
-        when {
-            !enabled -> MaterialTheme.colorScheme.outlineVariant
-            focused -> MaterialTheme.colorScheme.primary
-            else -> MaterialTheme.colorScheme.outline
-        }
-    val shape = RoundedCornerShape(8.dp)
-    val style =
-        LocalTextStyle.current.merge(
-            TextStyle(
-                color =
-                    if (enabled) MaterialTheme.colorScheme.onSurface
-                    else MaterialTheme.colorScheme.onSurfaceVariant
-            )
-        )
-    BasicTextField(
-        value = value,
-        onValueChange = onValueChange,
-        enabled = enabled,
-        singleLine = lines == 1,
-        minLines = lines,
-        textStyle = style,
-        keyboardOptions = keyboardOptions,
-        keyboardActions = keyboardActions,
-        interactionSource = interactions,
-        cursorBrush = SolidColor(MaterialTheme.colorScheme.primary),
-        modifier =
-            Modifier.fillMaxWidth()
-                .background(MaterialTheme.colorScheme.surfaceContainerHighest, shape)
-                .border(1.dp, edge, shape)
-                .padding(horizontal = 10.dp, vertical = 8.dp),
-        decorationBox = { field ->
-            Box {
-                // Under the text rather than beside it: the value is what the box is for, and a
-                // hint that pushed it sideways would move every character as somebody typed.
-                if (value.isEmpty() && hint != null) {
-                    Text(hint, color = MaterialTheme.colorScheme.onSurfaceVariant)
-                }
-                field()
-            }
-        },
-    )
-}

app/androidApp/src/main/kotlin/com/example/aiapp/FilesScreen.kt

@@ -20,6 +20,7 @@ import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Switch
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
@@ -43,60 +44,26 @@ import kotlinx.coroutines.withContext
 /**
  * Which machine's files to show, and where to start.
  *
- * A **machine**, not a session: a filesystem is a property of a machine, and a session only says
- * where it was working. That is what makes a second way in -- from the machines tab -- one more
+ * A **setup**, not a session: a filesystem is a property of a machine, and a session only says
+ * where it was working. That is what makes a second way in -- from the setups tab -- one more
  * caller rather than any new code here.
  */
-data class FilesTarget(
-    val machine: String,
-    val machineName: String,
-    val start: String,
-    /** A document to open immediately; [start] remains the fallback directory. */
-    val file: String? = null,
-)
-
-/**
- * The explorer opened on one file, wherever that file is.
- *
- * Its directory is what the reader lands in on the way back, which for a session's transcript is
- * that session's own directory -- the log, the process record and the rest of what it wrote.
- */
-fun fileTarget(file: FileOnMachine) =
-    FilesTarget(
-        machine = file.machine,
-        machineName = file.machineName,
-        start = parentOf(file.path) ?: "/",
-        file = file.path,
-    )
-
-/** The explorer target for this session's machine, optionally opened on [file]. */
-fun SessionSummary.filesTarget(file: String? = null) =
-    FilesTarget(
-        machine = machine,
-        machineName = machineName,
-        start = cwd?.takeIf { it.isNotBlank() } ?: "~",
-        file = file,
-    )
+data class FilesTarget(val setup: String, val setupName: String, val start: String)
 
 /** Where the explorer is: in a directory, or in one file. */
 private sealed class Spot(val path: String) {
     class Dir(path: String) : Spot(path)
 
-    class Doc(path: String, val directory: Dir) : Spot(path)
-}
-
-private enum class UnsavedDestination {
-    Directory,
-    Session,
+    class Doc(path: String) : Spot(path)
 }
 
 /**
  * The files on the machine a session runs on: browse them, read one, change one.
  *
  * Drawn **over** the session rather than instead of it (see [AppRoot]), so its event stream keeps
- * flowing and coming back from a file costs nothing. Both back controls return from a file to its
- * directory. In a directory, Android back walks toward the session's project directory and closes
- * the explorer once it gets there; the header's back button closes it immediately.
+ * flowing and coming back from a file costs nothing. Back steps one level inside here -- editor to
+ * viewer, viewer to the directory it came from, directory to the one above -- and only closes from
+ * where it opened.
  *
  * Every directory that has been visited is kept for as long as this is open; the refresh glyph is
  * how one gets asked again on purpose, and creating something refetches the directory it was
@@ -105,82 +72,51 @@ private enum class UnsavedDestination {
 @Composable
 fun FilesScreen(settings: ServerSettings, target: FilesTarget, onClose: () -> Unit) {
     val scope = rememberCoroutineScope()
-    val initialDirectory =
-        target.file?.let(::parentOf)?.let { Spot.Dir(it) } ?: Spot.Dir(target.start)
-    var here by
-        remember(target) {
-            mutableStateOf<Spot>(
-                target.file?.let { Spot.Doc(it, initialDirectory) } ?: initialDirectory
-            )
-        }
+    var stack by remember { mutableStateOf(listOf<Spot>(Spot.Dir(target.start))) }
     val listings = remember { mutableStateMapOf<String, LoadState<Listing>>() }
     var creating by remember { mutableStateOf(false) }
     // Edit mode and whether anything has been typed live here rather than in the pane below,
-    // because both ways out have to ask before discarding it.
+    // because they are what back has to know about -- and back arrives from two places, the arrow
+    // and the platform's own gesture, which must mean the same thing.
     var editing by remember { mutableStateOf(false) }
     var dirty by remember { mutableStateOf(false) }
-    var unsavedDestination by remember { mutableStateOf<UnsavedDestination?>(null) }
+    var askUnsaved by remember { mutableStateOf(false) }
+
+    val here = stack.last()
 
     fun go(spot: Spot) {
         editing = false
         dirty = false
-        here = spot
+        stack = stack + spot
     }
 
-    fun leave(destination: UnsavedDestination) {
-        if (editing && dirty) {
-            unsavedDestination = destination
-        } else if (destination == UnsavedDestination.Directory) {
-            go((here as Spot.Doc).directory)
-        } else {
-            onClose()
+    fun back() {
+        when {
+            editing && dirty -> askUnsaved = true
+            editing -> editing = false
+            stack.size > 1 -> {
+                stack = stack.dropLast(1)
+                editing = false
+                dirty = false
+            }
+            else -> onClose()
         }
     }
 
     suspend fun load(path: String, again: Boolean) {
-        val existing = listings[path]
-        if (!again && (existing is LoadState.Loaded || existing is LoadState.Loading)) return
+        if (!again && listings[path] is LoadState.Loaded) return
         listings[path] = LoadState.Loading
         listings[path] =
             try {
                 withContext(Dispatchers.IO) {
-                    LoadState.Loaded(fetchDir(settings, target.machine, path))
+                    LoadState.Loaded(fetchDir(settings, target.setup, path))
                 }
             } catch (e: ApiException) {
                 LoadState.failed(e)
             }
     }
 
-    val projectDirectory = (listings[target.start] as? LoadState.Loaded)?.value?.path
-    val homeDirectory =
-        if (target.start == "~") projectDirectory
-        else (listings["~"] as? LoadState.Loaded)?.value?.path
-
-    fun systemBack() {
-        when (val spot = here) {
-            is Spot.Doc -> leave(UnsavedDestination.Directory)
-            is Spot.Dir -> {
-                val path = (listings[spot.path] as? LoadState.Loaded)?.value?.path ?: spot.path
-                when {
-                    path == projectDirectory || path == target.start -> onClose()
-                    projectDirectory != null ->
-                        nextDirectoryToward(path, projectDirectory)?.let { go(Spot.Dir(it)) }
-                            ?: onClose()
-                    else -> parentOf(path)?.let { go(Spot.Dir(it)) } ?: onClose()
-                }
-            }
-        }
-    }
-
-    // A file link can open without visiting the project first, but Back still needs to know where
-    // the project is. Home is likewise resolved by the machine rather than guessed on the phone;
-    // it is what lets every path beneath it be displayed with `~`, including over ssh.
-    LaunchedEffect(target.machine, target.start) {
-        if (target.file != null) load(target.start, again = false)
-        if (target.start != "~") load("~", again = false)
-    }
-
-    BackHandler(onBack = ::systemBack)
+    BackHandler(onBack = ::back)
 
     Box(
         Modifier.fillMaxSize()
@@ -193,15 +129,14 @@ fun FilesScreen(settings: ServerSettings, target: FilesTarget, onClose: () -> Un
             when (val spot = here) {
                 is Spot.Dir -> {
                     val state = listings[spot.path] ?: LoadState.Loading
-                    // Navigate with the resolved path, but name anything under the machine's home
-                    // the way somebody working there would write it.
+                    // The resolved path once there is one: a directory opened as `~` is called what
+                    // it turned out to be, not what it was asked for.
                     val at = (state as? LoadState.Loaded)?.value?.path ?: spot.path
-                    val shownAt = tildePath(at, homeDirectory)
                     FilesHeader(
-                        title = baseName(shownAt),
-                        path = shownAt,
-                        machine = target.machineName,
-                        onBack = { leave(UnsavedDestination.Session) },
+                        title = baseName(at),
+                        path = at,
+                        machine = target.setupName,
+                        onBack = ::back,
                     ) {
                         GlyphButton(
                             REFRESH_GLYPH,
@@ -217,7 +152,7 @@ fun FilesScreen(settings: ServerSettings, target: FilesTarget, onClose: () -> Un
                         )
                     }
                     LaunchedEffect(spot.path) { load(spot.path, again = false) }
-                    DirectoryBody(state, directory = spot, onOpen = ::go)
+                    DirectoryBody(state, onOpen = ::go)
                 }
                 is Spot.Doc ->
                     DocPane(
@@ -226,26 +161,22 @@ fun FilesScreen(settings: ServerSettings, target: FilesTarget, onClose: () -> Un
                         path = spot.path,
                         name = baseName(spot.path),
                         editing = editing,
-                        homeDirectory = homeDirectory,
                         onEditing = { editing = it },
                         onDirty = { dirty = it },
-                        onBack = { leave(UnsavedDestination.Directory) },
+                        onBack = ::back,
                     )
             }
         }
     }
 
-    unsavedDestination?.let { destination ->
+    if (askUnsaved) {
         UnsavedDialog(
             onDiscard = {
-                unsavedDestination = null
-                if (destination == UnsavedDestination.Directory) {
-                    go((here as Spot.Doc).directory)
-                } else {
-                    onClose()
-                }
+                askUnsaved = false
+                editing = false
+                dirty = false
             },
-            onCancel = { unsavedDestination = null },
+            onCancel = { askUnsaved = false },
         )
     }
 
@@ -254,7 +185,7 @@ fun FilesScreen(settings: ServerSettings, target: FilesTarget, onClose: () -> Un
     if (creating && dir != null && listing != null) {
         CreateDialog(
             settings = settings,
-            machine = target.machine,
+            setup = target.setup,
             directory = listing.path,
             onDismiss = { creating = false },
             onCreated = { path, isDirectory ->
@@ -265,7 +196,7 @@ fun FilesScreen(settings: ServerSettings, target: FilesTarget, onClose: () -> Un
                     load(dir.path, again = true)
                     // A new file has nothing to look at, so it opens where it can be filled in.
                     if (!isDirectory) {
-                        go(Spot.Doc(path, dir))
+                        go(Spot.Doc(path))
                         editing = true
                     }
                 }
@@ -317,11 +248,7 @@ private fun FilesHeader(
  * looks like a right one.
  */
 @Composable
-private fun ColumnScope.DirectoryBody(
-    state: LoadState<Listing>,
-    directory: Spot.Dir,
-    onOpen: (Spot) -> Unit,
-) {
+private fun ColumnScope.DirectoryBody(state: LoadState<Listing>, onOpen: (Spot) -> Unit) {
     when (state) {
         is LoadState.Loading -> CircularProgressIndicator(Modifier.padding(16.dp))
         is LoadState.Error ->
@@ -362,9 +289,7 @@ private fun ColumnScope.DirectoryBody(
                         name = entry.name,
                         trailing = trailingOf(entry),
                         onClick = {
-                            onOpen(
-                                if (entry.isDirectory) Spot.Dir(path) else Spot.Doc(path, directory)
-                            )
+                            onOpen(if (entry.isDirectory) Spot.Dir(path) else Spot.Doc(path))
                         },
                     )
                 }
@@ -432,7 +357,6 @@ private fun ColumnScope.DocPane(
     path: String,
     name: String,
     editing: Boolean,
-    homeDirectory: String?,
     onEditing: (Boolean) -> Unit,
     onDirty: (Boolean) -> Unit,
     onBack: () -> Unit,
@@ -457,7 +381,7 @@ private fun ColumnScope.DocPane(
         state = LoadState.Loading
         state =
             try {
-                val got = withContext(Dispatchers.IO) { fetchFile(settings, target.machine, path) }
+                val got = withContext(Dispatchers.IO) { fetchFile(settings, target.setup, path) }
                 if (got is FileContent.Text) draft = TextFieldValue(got.content)
                 LoadState.Loaded(got)
             } catch (e: ApiException) {
@@ -480,7 +404,7 @@ private fun ColumnScope.DocPane(
             try {
                 val written =
                     withContext(Dispatchers.IO) {
-                        writeFile(settings, target.machine, path, draft.text, against)
+                        writeFile(settings, target.setup, path, draft.text, against)
                     }
                 state =
                     LoadState.Loaded(
@@ -506,12 +430,7 @@ private fun ColumnScope.DocPane(
         }
     }
 
-    FilesHeader(
-        title = name,
-        path = tildePath(path, homeDirectory),
-        machine = target.machineName,
-        onBack = onBack,
-    ) {
+    FilesHeader(title = name, path = path, machine = target.setupName, onBack = onBack) {
         if (editing) {
             if (saving) {
                 GlyphSpinner("Saving")
@@ -608,9 +527,7 @@ private fun ColumnScope.DocPane(
                 scope.launch {
                     val fresh =
                         try {
-                            withContext(Dispatchers.IO) {
-                                fetchFile(settings, target.machine, path)
-                            }
+                            withContext(Dispatchers.IO) { fetchFile(settings, target.setup, path) }
                         } catch (e: ApiException) {
                             saveError = e.message
                             conflict = null
@@ -654,7 +571,7 @@ private fun Note(text: String) {
 @Composable
 private fun CreateDialog(
     settings: ServerSettings,
-    machine: String,
+    setup: String,
     directory: String,
     onDismiss: () -> Unit,
     onCreated: (String, Boolean) -> Unit,
@@ -674,8 +591,8 @@ private fun CreateDialog(
         scope.launch {
             try {
                 withContext(Dispatchers.IO) {
-                    if (isDirectory) createDir(settings, machine, path)
-                    else createFile(settings, machine, path)
+                    if (isDirectory) createDir(settings, setup, path)
+                    else createFile(settings, setup, path)
                 }
                 onCreated(path, isDirectory)
             } catch (e: ApiException) {
@@ -692,11 +609,13 @@ private fun CreateDialog(
         title = { Text("Create in ${baseName(directory)}") },
         text = {
             Column {
-                LabelledField(
-                    label = "Name",
+                OutlinedTextField(
                     value = name,
                     onValueChange = { name = it },
+                    label = { Text("Name") },
+                    singleLine = true,
                     enabled = !busy,
+                    modifier = Modifier.fillMaxWidth(),
                 )
                 Spacer(Modifier.height(8.dp))
                 Row(verticalAlignment = Alignment.CenterVertically) {
@@ -759,35 +678,6 @@ internal fun parentOf(path: String): String? {
     }
 }
 
-/**
- * The next directory on the filesystem path from [current] to [destination], or null when there.
- *
- * Moving between two branches first walks upward to their common ancestor. Once [current] is that
- * ancestor, the next press walks one segment down toward [destination]. Both paths are answers from
- * the machine, so they are absolute and have no symlinks or `..` left to resolve here.
- */
-internal fun nextDirectoryToward(current: String, destination: String): String? {
-    val here = current.trimEnd('/').ifEmpty { "/" }
-    val there = destination.trimEnd('/').ifEmpty { "/" }
-    if (here == there) return null
-    val beneathHere = if (here == "/") there.startsWith('/') else there.startsWith("$here/")
-    if (!beneathHere) return parentOf(here)
-    val next = there.removePrefix(here).trimStart('/').substringBefore('/')
-    return join(here, next)
-}
-
-/** A path as somebody on [home] writes it, leaving paths outside that home unchanged. */
-internal fun tildePath(path: String, home: String?): String {
-    val at = path.trimEnd('/').ifEmpty { "/" }
-    val resolvedHome = home?.trimEnd('/')?.ifEmpty { "/" } ?: return at
-    return when {
-        at == resolvedHome -> "~"
-        resolvedHome != "/" && at.startsWith("$resolvedHome/") ->
-            "~${at.removePrefix(resolvedHome)}"
-        else -> at
-    }
-}
-
 /** What a path names: its last segment, with `/` naming itself. */
 internal fun baseName(path: String): String {
     val trimmed = path.trimEnd('/')

app/androidApp/src/main/kotlin/com/example/aiapp/Highlighter.kt

@@ -7,8 +7,6 @@ import androidx.compose.ui.text.buildAnnotatedString
 
 /** What a span of code is, in the terms the palette has a colour for. */
 enum class Kind {
-    ADDITION,
-    DELETION,
     KEYWORD,
     STRING,
     LITERAL,
@@ -26,8 +24,6 @@ data class Span(val start: Int, val end: Int, val kind: Kind)
  * one instance and lives with the rest of the palette.
  */
 data class SyntaxPalette(
-    val addition: Color,
-    val deletion: Color,
     val keyword: Color,
     val string: Color,
     val literal: Color,
@@ -38,8 +34,6 @@ data class SyntaxPalette(
 ) {
     fun of(kind: Kind): Color =
         when (kind) {
-            Kind.ADDITION -> addition
-            Kind.DELETION -> deletion
             Kind.KEYWORD -> keyword
             Kind.STRING -> string
             Kind.LITERAL -> literal
@@ -50,26 +44,6 @@ data class SyntaxPalette(
         }
 }
 
-/** A unified diff is line-oriented: colour the changed lines and leave context untouched. */
-fun scanDiff(code: String): List<Span> {
-    val spans = ArrayList<Span>()
-    var start = 0
-    while (start < code.length) {
-        val end = code.indexOf('\n', start).let { if (it == -1) code.length else it }
-        val kind =
-            when {
-                code.startsWith("+++", start) || code.startsWith("---", start) -> Kind.METADATA
-                code.startsWith("+", start) -> Kind.ADDITION
-                code.startsWith("-", start) -> Kind.DELETION
-                code.startsWith("@@", start) -> Kind.METADATA
-                else -> null
-            }
-        if (kind != null) spans.add(Span(start, end, kind))
-        start = if (end == code.length) end else end + 1
-    }
-    return spans
-}
-
 /**
  * [code] with its keywords, strings and comments coloured, or plain if there is no language for it.
  *

app/androidApp/src/main/kotlin/com/example/aiapp/ImportScreen.kt

@@ -82,8 +82,8 @@ private const val SETTLE_MS = 500L
 @Composable
 fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (SessionSummary) -> Unit) {
     val scope = rememberCoroutineScope()
-    var machines by remember { mutableStateOf<LoadState<List<Machine>>>(LoadState.Loading) }
-    var chosen by remember { mutableStateOf<Machine?>(null) }
+    var setups by remember { mutableStateOf<LoadState<List<Setup>>>(LoadState.Loading) }
+    var chosen by remember { mutableStateOf<Setup?>(null) }
     var sessions by remember { mutableStateOf<LoadState<List<Importable>>>(LoadState.Loading) }
 
     // What is happening to each row right now, as the word the row shows. A map keyed by id rather
@@ -100,8 +100,9 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
     // Deleting a transcript cannot be undone, so it is asked rather than done. Held as the rows
     // themselves, not a flag, so the dialog can say what it is about.
     var confirming by remember { mutableStateOf<List<Importable>?>(null) }
-    // Set from the selected Claude provider rather than repeated in the app.
-    var permissionMode by remember { mutableStateOf("") }
+    // Same default as the spawn screen: a phone is the wrong place to answer "allow Bash?" forty
+    // times.
+    var permissionMode by remember { mutableStateOf("auto") }
     // When each row last slid upwards, as a plain map rather than state: nothing is drawn from it,
     // so a tap reading it needs no recomposition.
     val movedAt = remember { mutableMapOf<String, Long>() }
@@ -113,9 +114,9 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
      * Taken from the answer rather than kept across the load: the server is what knows what is
      * running, and this screen may be opening on work another phone started.
      */
-    suspend fun fetchInto(machine: Machine): LoadState<List<Importable>> =
+    suspend fun fetchInto(setup: Setup): LoadState<List<Importable>> =
         try {
-            val rows = withContext(Dispatchers.IO) { fetchImportable(settings, machine.id) }
+            val rows = withContext(Dispatchers.IO) { fetchImportable(settings, setup.id) }
             running = rows.mapNotNull { row -> row.pending?.let { row.id to it } }.toMap()
             rowErrors = rows.mapNotNull { row -> row.error?.let { row.id to it } }.toMap()
             LoadState.Loaded(rows)
@@ -123,10 +124,10 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
             LoadState.Error(err.message ?: "Couldn't list sessions")
         }
 
-    fun loadSessions(machine: Machine) {
+    fun loadSessions(setup: Setup) {
         sessions = LoadState.Loading
         selected = emptySet()
-        scope.launch { sessions = fetchInto(machine) }
+        scope.launch { sessions = fetchInto(setup) }
     }
 
     /** Takes a row out of the list, once the machine no longer has it to offer. */
@@ -140,9 +141,9 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
     }
 
     LaunchedEffect(reloadToken) {
-        machines =
+        setups =
             try {
-                val found = withContext(Dispatchers.IO) { fetchMachines(settings) }
+                val found = withContext(Dispatchers.IO) { fetchSetups(settings) }
                 found.firstOrNull()?.let {
                     chosen = it
                     loadSessions(it)
@@ -170,7 +171,7 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
         selected = emptySet()
         running = running + targets.associate { it.id to WAITING }
         rowErrors = rowErrors - targets.map { it.id }.toSet()
-        val machine = chosen
+        val setup = chosen
         val ids = targets.map { it.id }
         scope.launch {
             // One request for the whole batch, not one per row. Sent row by row, a handover was
@@ -197,28 +198,25 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
             // The listing is the repair, because it carries the same state the events do. Only when
             // something still looks outstanding, so the ordinary case does not pay for a second
             // listing, which is the most expensive call this screen makes.
-            if (machine != null && targets.any { running.containsKey(it.id) }) {
+            if (setup != null && targets.any { running.containsKey(it.id) }) {
                 // Quietly: no Loading, because blanking the list to report on rows that are already
                 // saying what is happening to them is the flicker this screen avoids everywhere
                 // else.
-                sessions = fetchInto(machine)
+                sessions = fetchInto(setup)
             }
         }
     }
 
     val provider = chosen?.providers?.firstOrNull { it.kind == "claude_cli" }
-    LaunchedEffect(chosen?.id, provider?.name) {
-        permissionMode = provider?.defaultPermissionMode.orEmpty()
-    }
 
     /** Continues [targets] in the background, leaving the screen where it is. */
     fun importAll(targets: List<Importable>) {
-        val machine = chosen ?: return
+        val setup = chosen ?: return
         val useProvider = provider ?: return
         handOver(targets) { ids ->
             startImport(
                 settings,
-                machine = machine.id,
+                setup = setup.id,
                 sessionIds = ids,
                 provider = useProvider.name,
                 permissionMode = permissionMode,
@@ -234,7 +232,7 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
      * it, which is the case where waiting is the right thing anyway.
      */
     fun importAndOpen(target: Importable) {
-        val machine = chosen ?: return
+        val setup = chosen ?: return
         val useProvider = provider ?: return
         running = running + (target.id to IMPORTING)
         rowErrors = rowErrors - target.id
@@ -244,7 +242,7 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
                     withContext(Dispatchers.IO) {
                         spawnSession(
                             settings,
-                            machine = machine.id,
+                            setup = setup.id,
                             provider = useProvider.name,
                             // Nothing to say: the server titles it from the session it continues.
                             title = "",
@@ -272,10 +270,10 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
         java.util.concurrent.atomic.AtomicReference<ImportableStream?>(null)
     }
     LaunchedEffect(chosen?.id) {
-        val machine = chosen?.id ?: return@LaunchedEffect
+        val setup = chosen?.id ?: return@LaunchedEffect
         try {
             while (true) {
-                val stream = ImportableStream(settings, machine)
+                val stream = ImportableStream(settings, setup)
                 liveChanges.set(stream)
                 try {
                     withContext(Dispatchers.IO) {
@@ -343,24 +341,24 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
             )
             Spacer(Modifier.height(12.dp))
 
-            when (val loaded = machines) {
+            when (val loaded = setups) {
                 is LoadState.Loading -> CircularProgressIndicator()
                 is LoadState.Error -> Text(loaded.message, color = MaterialTheme.colorScheme.error)
                 is LoadState.Loaded -> {
                     // Only worth choosing when there is a choice.
                     if (loaded.value.size > 1) {
                         Row(Modifier.fillMaxWidth()) {
-                            loaded.value.forEach { machine ->
+                            loaded.value.forEach { setup ->
                                 TextButton(
                                     onClick = {
-                                        chosen = machine
-                                        loadSessions(machine)
+                                        chosen = setup
+                                        loadSessions(setup)
                                     }
                                 ) {
                                     Text(
-                                        machine.name,
+                                        setup.name,
                                         color =
-                                            if (machine.id == chosen?.id)
+                                            if (setup.id == chosen?.id)
                                                 MaterialTheme.colorScheme.primary
                                             else MaterialTheme.colorScheme.onSurfaceVariant,
                                     )
@@ -377,7 +375,7 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
                     } else {
                         ChipGroup(
                             label = "Permissions",
-                            options = provider?.permissionModes.orEmpty(),
+                            options = PERMISSION_MODES,
                             selected = permissionMode,
                             onSelect = { permissionMode = it },
                         )
@@ -441,9 +439,9 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
             confirmButton = {
                 TextButton(
                     onClick = {
-                        val machine = chosen ?: return@TextButton
+                        val setup = chosen ?: return@TextButton
                         confirming = null
-                        handOver(targets) { ids -> deleteImportable(settings, machine.id, ids) }
+                        handOver(targets) { ids -> deleteImportable(settings, setup.id, ids) }
                     }
                 ) {
                     // Coloured by consequence: this takes something away, wherever it appears.

app/androidApp/src/main/kotlin/com/example/aiapp/ImportableStream.kt

@@ -12,13 +12,13 @@ package com.example.aiapp
  * the caller owns reconnecting -- there is no cursor to resume from, because anything missed is in
  * the next listing.
  */
-class ImportableStream(settings: ServerSettings, private val machine: String) {
+class ImportableStream(settings: ServerSettings, private val setup: String) {
     private val stream = Sse(settings)
 
     fun close() = stream.close()
 
     fun run(onOpen: () -> Unit, onChange: (ImportableChange) -> Unit) {
-        stream.run("/machines/$machine/importable/events", onOpen) { _, data ->
+        stream.run("/setups/$setup/importable/events", onOpen) { _, data ->
             if (data.isNotEmpty()) parseImportableChange(data)?.let(onChange)
         }
     }

app/androidApp/src/main/kotlin/com/example/aiapp/Languages.kt

@@ -16,7 +16,6 @@ enum class Language {
     CPP,
     CSHARP,
     DART,
-    DIFF,
     FISH,
     GO,
     JAVA,
@@ -101,7 +100,7 @@ fun spansOf(code: String, language: Language): List<Span> = SCANNERS.getValue(la
 // Lazy for the same reason [RULES] is, since it reads it.
 private val SCANNERS: Map<Language, (String) -> List<Span>> by lazy {
     RULES.mapValues { (_, rules) -> { code: String -> scan(code, rules) } } +
-        mapOf(Language.DIFF to ::scanDiff, Language.MARKDOWN to ::scanMarkdown)
+        mapOf(Language.MARKDOWN to ::scanMarkdown)
 }
 
 private val C_STYLE = BlockComment("/*", "*/", nests = false)

app/androidApp/src/main/kotlin/com/example/aiapp/MachineModels.kt

@@ -1,402 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.lazy.LazyListScope
-import androidx.compose.foundation.text.KeyboardActions
-import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.material3.Card
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.LinearProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.Stable
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.LocalSoftwareKeyboardController
-import androidx.compose.ui.text.input.ImeAction
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.dp
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-/**
- * The models on one machine, the downloads putting more there, and HuggingFace to find them in.
- *
- * This was a tab of its own, about the backend's own disk. It moved under the machine's llama.cpp
- * provider on 2026-09-19, when a download came to run on the machine that will serve the file:
- * there is no such thing as "the models", only this machine's, and the screen that decides how a
- * model is loaded is the screen that should be able to fetch one.
- *
- * Everything here is the machine's state rather than this screen's. A download is a process on that
- * machine with its progress written beside the partial file, so closing the app, locking the phone
- * or restarting the backend does not touch it, and a second device watching sees the same numbers.
- */
-@Stable
-class MachineModelsState(
-    private val settings: ServerSettings,
-    private val machineId: String,
-    private val scope: CoroutineScope,
-) {
-    var state by mutableStateOf<LoadState<Models>>(LoadState.Loading)
-        private set
-
-    var query by mutableStateOf("")
-
-    var results by mutableStateOf<LoadState<List<RemoteRepo>>?>(null)
-        private set
-
-    var openRepo by mutableStateOf<String?>(null)
-        private set
-
-    var repoFiles by mutableStateOf<LoadState<List<RemoteFile>>?>(null)
-        private set
-
-    /** What the last action said went wrong, shown above the list that action was taken in. */
-    var actionError by mutableStateOf<String?>(null)
-        private set
-
-    val models: Models?
-        get() = (state as? LoadState.Loaded)?.value
-
-    val downloads: List<Download>
-        get() = models?.downloads.orEmpty()
-
-    /** How big each downloaded model is, by key, for the cards the provider screen draws. */
-    val sizes: Map<String, Long>
-        get() = models?.local.orEmpty().associate { it.key to it.bytes }
-
-    suspend fun reload() {
-        state =
-            try {
-                withContext(Dispatchers.IO) {
-                    LoadState.Loaded(fetchMachineModels(settings, machineId))
-                }
-            } catch (e: ApiException) {
-                LoadState.failed(e)
-            }
-    }
-
-    /** Runs [action], says what it said if it failed, and asks the machine again either way. */
-    private fun act(action: suspend () -> Unit) {
-        scope.launch {
-            actionError =
-                runCatching { withContext(Dispatchers.IO) { action() } }.exceptionOrNull()?.message
-            reload()
-        }
-    }
-
-    fun search() {
-        openRepo = null
-        results = LoadState.Loading
-        scope.launch {
-            results =
-                try {
-                    withContext(Dispatchers.IO) { LoadState.Loaded(searchModels(settings, query)) }
-                } catch (e: ApiException) {
-                    LoadState.failed(e)
-                }
-        }
-    }
-
-    fun toggleRepo(repo: String) {
-        if (openRepo == repo) {
-            openRepo = null
-            return
-        }
-        openRepo = repo
-        repoFiles = LoadState.Loading
-        scope.launch {
-            repoFiles =
-                try {
-                    withContext(Dispatchers.IO) {
-                        LoadState.Loaded(fetchRepoFiles(settings, machineId, repo))
-                    }
-                } catch (e: ApiException) {
-                    LoadState.failed(e)
-                }
-        }
-    }
-
-    fun download(repo: String, file: String) = act {
-        startDownload(settings, machineId, repo, file)
-    }
-
-    fun cancel(key: String) = act { cancelDownload(settings, machineId, key) }
-
-    fun remove(key: String) = act { deleteModel(settings, machineId, key) }
-}
-
-/**
- * One machine's models, asked for again while this screen is open.
- *
- * Polled rather than pushed: a download belongs to a machine, not to any session, so it has no
- * event stream of its own. Faster while something is downloading, because that is the only thing
- * here that changes by itself -- each ask is a round trip to that machine, and once a minute would
- * be a progress bar that moved in jumps.
- *
- * [onLocalChange] fires when the set of models on the machine changes, which is how the screen
- * around this learns that a download has become a model it must now draw settings for.
- *
- * [enabled] is false for a provider that holds no files of its own -- the Claude CLI names its
- * models rather than storing them -- and then nothing is asked of the machine at all. Taken as a
- * parameter rather than decided by the caller's `if`, so that this is composed unconditionally and
- * keeps its search results across the moment the provider's kind arrives.
- */
-@Composable
-fun rememberMachineModels(
-    settings: ServerSettings,
-    machineId: String,
-    enabled: Boolean,
-    onLocalChange: () -> Unit,
-): MachineModelsState {
-    val scope = rememberCoroutineScope()
-    val state = remember(settings, machineId) { MachineModelsState(settings, machineId, scope) }
-    LaunchedEffect(state, enabled) {
-        if (!enabled) return@LaunchedEffect
-        var known: List<String>? = null
-        while (true) {
-            state.reload()
-            val local = state.models?.local?.map { it.key }
-            if (local != null) {
-                if (known != null && known != local) onLocalChange()
-                known = local
-            }
-            delay(if (state.downloads.any { it.state == "running" }) 1500 else 5000)
-        }
-    }
-    return state
-}
-
-/** What is being fetched onto this machine, above the models it already has. */
-fun LazyListScope.downloadCards(state: MachineModelsState) {
-    uniqueItems(state.downloads, key = { "download:" + it.key }) { download ->
-        DownloadCard(
-            download = download,
-            onCancel = { state.cancel(download.key) },
-            onResume = { state.download(download.repo, download.file) },
-            onRemove = { state.remove(download.key) },
-        )
-    }
-}
-
-/**
- * Finding a model to fetch: a search, and what it found.
- *
- * Below the models this machine has rather than above them, because what is here is what the reader
- * came for and getting another is the rarer errand.
- */
-fun LazyListScope.modelSearch(state: MachineModelsState) {
-    item("search") {
-        Spacer(Modifier.height(16.dp))
-        Text("Get another model", style = MaterialTheme.typography.titleSmall)
-        Text(
-            "Downloaded onto this machine, which is where llama.cpp reads it from.",
-            style = MaterialTheme.typography.bodySmall,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
-        )
-        Spacer(Modifier.height(8.dp))
-        val keyboard = LocalSoftwareKeyboardController.current
-        LabelledField(
-            label = "Search HuggingFace",
-            value = state.query,
-            onValueChange = { state.query = it },
-            // The keyboard's own key searches, and puts itself away to show what it found. The
-            // button below this is under the keyboard while it is up, so without this the only
-            // way to press it is to dismiss the keyboard first -- which nothing on screen says.
-            keyboardOptions = KeyboardOptions(imeAction = ImeAction.Search),
-            keyboardActions =
-                KeyboardActions(
-                    onSearch = {
-                        keyboard?.hide()
-                        state.search()
-                    }
-                ),
-            modifier = Modifier.fillMaxWidth(),
-        )
-        TextButton(
-            enabled = state.query.isNotBlank(),
-            onClick = {
-                keyboard?.hide()
-                state.search()
-            },
-        ) {
-            Text("Search")
-        }
-    }
-    when (val found = state.results) {
-        null -> {}
-        is LoadState.Loading -> item("searching") { CircularProgressIndicator() }
-        is LoadState.Error ->
-            item("search-failed") { Text(found.message, color = MaterialTheme.colorScheme.error) }
-        is LoadState.Loaded ->
-            uniqueItems(found.value, key = { "repo:" + it.id }) { repo ->
-                val open = state.openRepo == repo.id
-                RepoRow(repo, expanded = open) { state.toggleRepo(repo.id) }
-                // Inside the expanded repository's own item rather than as a section after the
-                // list: drawn after every card, a repository's files read as belonging to
-                // whichever card happened to be last.
-                if (open) {
-                    when (val files = state.repoFiles) {
-                        null -> {}
-                        is LoadState.Loading -> CircularProgressIndicator()
-                        is LoadState.Error ->
-                            Text(files.message, color = MaterialTheme.colorScheme.error)
-                        is LoadState.Loaded ->
-                            Column {
-                                val busy = state.downloads.map { it.key }.toSet()
-                                files.value.forEach { file ->
-                                    RepoFileRow(
-                                        file,
-                                        downloading = "${repo.id}/${file.path}" in busy,
-                                    ) {
-                                        state.download(repo.id, file.path)
-                                    }
-                                }
-                            }
-                    }
-                }
-            }
-    }
-}
-
-@Composable
-private fun DownloadCard(
-    download: Download,
-    onCancel: () -> Unit,
-    onResume: () -> Unit,
-    onRemove: () -> Unit,
-) {
-    val running = download.state == "running" || download.state == "verifying"
-    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
-        Column(Modifier.padding(12.dp)) {
-            Text(download.file, style = MaterialTheme.typography.titleSmall)
-            Text(
-                download.repo,
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-            Spacer(Modifier.height(8.dp))
-            // A determinate bar only when the size is known. HuggingFace sends no size when it
-            // was never told one, and a bar drawn from a guess is worse than one that admits it
-            // is counting.
-            if (download.total != null && download.total > 0) {
-                LinearProgressIndicator(
-                    progress = { download.done.toFloat() / download.total.toFloat() },
-                    // Blue at every value, unlike a quota bar: a download nearing its end is
-                    // nearing success, and colouring it like a limit being approached would say
-                    // the opposite.
-                    color = progressColor,
-                    modifier = Modifier.fillMaxWidth(),
-                )
-                Text(
-                    "${gigabytes(download.done)} of ${gigabytes(download.total)}",
-                    style = MaterialTheme.typography.bodySmall,
-                )
-            } else if (running) {
-                LinearProgressIndicator(color = progressColor, modifier = Modifier.fillMaxWidth())
-                Text(
-                    "${gigabytes(download.done)} so far, total size unknown",
-                    style = MaterialTheme.typography.bodySmall,
-                )
-            }
-            download.error?.let {
-                Text(
-                    it,
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.error,
-                )
-            }
-            Row(verticalAlignment = Alignment.CenterVertically) {
-                Text(
-                    download.state,
-                    style = MaterialTheme.typography.bodySmall,
-                    modifier = Modifier.weight(1f),
-                )
-                if (running) {
-                    TextButton(onClick = onCancel) { Text("Cancel") }
-                } else {
-                    // A stopped download kept its partial file, so carrying on is the cheap
-                    // answer and starting again is not the only one offered.
-                    TextButton(onClick = onResume) { Text("Resume") }
-                    TextButton(onClick = onRemove) { Text("Remove") }
-                }
-            }
-        }
-    }
-}
-
-@Composable
-private fun RepoRow(repo: RemoteRepo, expanded: Boolean, onToggle: () -> Unit) {
-    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
-        Row(Modifier.padding(12.dp), verticalAlignment = Alignment.CenterVertically) {
-            Column(Modifier.weight(1f)) {
-                Text(
-                    repo.id,
-                    style = MaterialTheme.typography.titleSmall,
-                    maxLines = 1,
-                    // The owner is the part that repeats; the model name at the end is what tells
-                    // two entries apart.
-                    overflow = TextOverflow.StartEllipsis,
-                )
-                Text(
-                    "${repo.downloads} downloads · ${repo.likes} likes",
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-            }
-            TextButton(onClick = onToggle) { Text(if (expanded) "Hide" else "Files") }
-        }
-    }
-}
-
-@Composable
-private fun RepoFileRow(file: RemoteFile, downloading: Boolean, onDownload: () -> Unit) {
-    Row(
-        Modifier.fillMaxWidth().padding(start = 16.dp, top = 4.dp, bottom = 4.dp),
-        verticalAlignment = Alignment.CenterVertically,
-    ) {
-        Column(Modifier.weight(1f)) {
-            Text(file.path, style = MaterialTheme.typography.bodyMedium)
-            Text(
-                gigabytes(file.bytes),
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-        }
-        // Disabled rather than absent, so the row reads the same whether this one is absent,
-        // already here, or on its way. Offering "Download" for a file that is downloading would be
-        // a button that does nothing anyone can see.
-        TextButton(enabled = !file.have && !downloading, onClick = onDownload) {
-            Text(
-                when {
-                    file.have -> "Downloaded"
-                    downloading -> "Downloading"
-                    else -> "Download"
-                }
-            )
-        }
-    }
-}
-
-fun gigabytes(bytes: Long): String =
-    if (bytes >= 1_000_000_000) {
-        "%.2f GB".format(bytes / 1_000_000_000.0)
-    } else {
-        "%.0f MB".format(bytes / 1_000_000.0)
-    }

app/androidApp/src/main/kotlin/com/example/aiapp/MainPanel.kt

@@ -1,53 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableIntStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
-
-/**
- * The app's root screen, in the full-width panel [SidePanels] slides over a session from the left.
- *
- * Not a list of its own but [MainScreen] itself, and the whole width of the screen: what a right
- * swipe gets is the screen Back would have got, moved over the session instead of replacing it. The
- * session stays composed underneath, with its stream open and its draft and scroll position where
- * they were, so swiping the panel back off returns to it for nothing -- where Back and a tap costs
- * the whole transcript over the tunnel again.
- *
- * Tapping the session already open is that same swipe back rather than a fresh screen: reopening it
- * would hand [SessionScreen] a new summary for the conversation it is already showing.
- *
- * [onGone] is the one thing the list can do that this panel cannot survive -- deleting the very
- * session it is drawn over. There is nothing left to swipe back into, so that closes the screen.
- */
-@Composable
-fun MainPanel(
-    settings: ServerSettings,
-    sessionId: String,
-    active: Boolean,
-    onOpen: (SessionSummary) -> Unit,
-    onSpawn: () -> Unit,
-    onImported: (SessionSummary) -> Unit,
-    onSettings: () -> Unit,
-    onProvider: (String, String) -> Unit,
-    onClose: () -> Unit,
-    onGone: () -> Unit,
-) {
-    // Asked again each time the panel opens: who is working and who is waiting on an answer is
-    // exactly what changed while the session underneath was being read.
-    var reloadToken by remember(sessionId) { mutableIntStateOf(0) }
-    LaunchedEffect(active) { if (active) reloadToken++ }
-
-    MainScreen(
-        settings = settings,
-        reloadToken = reloadToken,
-        onOpen = { if (it.id == sessionId) onClose() else onOpen(it) },
-        onSpawn = onSpawn,
-        onImported = onImported,
-        onSettings = onSettings,
-        onProvider = onProvider,
-        onDeleted = { if (it == sessionId) onGone() },
-    )
-}

app/androidApp/src/main/kotlin/com/example/aiapp/MainScreen.kt

@@ -26,23 +26,19 @@ import androidx.lifecycle.compose.LocalLifecycleOwner
 import androidx.lifecycle.repeatOnLifecycle
 
 /**
- * The app's root: one title, and three views of the backend behind it.
+ * The app's root: one title, and four views of the backend behind it.
  *
- * These were screens reached by words in a row under the title, and the row was already full. Tabs
- * say the same thing in less space and say one more thing besides: that these are places to be
- * rather than errands to run. Sessions, the machine's importable history and the machines
- * themselves are all *the same backend*, looked at three ways, and none is a step down from
- * another. Settings still is, which is why it stays a pushed screen with its own Back.
- *
- * Models were a fourth tab until 2026-09-19. They are a machine's models now -- downloaded onto the
- * machine that has to serve them -- so they live under that machine's llama.cpp provider, beside
- * the settings deciding how each one is loaded. A tab about "the models" was a claim that there is
- * one such set, and there is one per machine.
+ * These were four screens reached by four words in a row under the title, and the row was already
+ * full. Tabs say the same thing in less space and say one more thing besides: that these are places
+ * to be rather than errands to run. Sessions, the machine's importable history, the models on it
+ * and the machines themselves are all *the same backend*, looked at four ways, and none is a step
+ * down from another. Settings still is, which is why it stays a pushed screen with its own Back.
  */
 private enum class MainTab(val label: String) {
     Sessions("Sessions"),
     Import("Import"),
-    Machines("Machines"),
+    Models("Models"),
+    Setups("Setups"),
 }
 
 @Composable
@@ -55,10 +51,6 @@ fun MainScreen(
     onSpawn: () -> Unit,
     onImported: (SessionSummary) -> Unit,
     onSettings: () -> Unit,
-    /** One machine's provider, opened from the machines tab. */
-    onProvider: (String, String) -> Unit,
-    /** A session the list has just deleted; see [SessionListScreen]. */
-    onDeleted: (String) -> Unit = {},
 ) {
     var tab by remember { mutableStateOf(MainTab.Sessions) }
     var refreshToken by remember { mutableIntStateOf(0) }
@@ -148,12 +140,11 @@ fun MainScreen(
                     reloadToken = token,
                     onOpen = onOpen,
                     onSpawn = onSpawn,
-                    onDeleted = onDeleted,
                 )
             MainTab.Import ->
                 ImportScreen(settings = settings, reloadToken = token, onImported = onImported)
-            MainTab.Machines ->
-                MachinesScreen(settings = settings, reloadToken = token, onProvider = onProvider)
+            MainTab.Models -> ModelsScreen(settings = settings, reloadToken = token)
+            MainTab.Setups -> SetupsScreen(settings = settings, reloadToken = token)
         }
     }
 }

app/androidApp/src/main/kotlin/com/example/aiapp/MarkdownLinks.kt

@@ -32,7 +32,6 @@ import com.mikepenz.markdown.model.markdownAnnotator
 import com.mikepenz.markdown.utils.getUnescapedTextInNode
 import com.mikepenz.markdown.utils.resolveImageAlt
 import com.mikepenz.markdown.utils.resolveImageLink
-import java.net.URI
 import org.intellij.markdown.MarkdownElementTypes
 import org.intellij.markdown.MarkdownTokenTypes
 import org.intellij.markdown.ast.ASTNode
@@ -90,7 +89,6 @@ fun LinkedText(content: String, node: ASTNode, style: TextStyle, modifier: Modif
             content.buildMarkdownAnnotatedString(node, style, settings)
         }
     val uriHandler = LocalUriHandler.current
-    val fileLinkHandler = LocalFileLinkHandler.current
     val onPlainTap = LocalMarkdownTap.current
     val layout = remember { Ref<TextLayoutResult>() }
     // The renderer's own rule for a style that names no colour: the theme's text colour.
@@ -129,7 +127,7 @@ fun LinkedText(content: String, node: ASTNode, style: TextStyle, modifier: Modif
                     when {
                         url != null -> {
                             up.consume()
-                            if (fileLinkHandler?.invoke(url) != true) uriHandler.openUri(url)
+                            uriHandler.openUri(url)
                         }
                         onPlainTap != null -> {
                             up.consume()
@@ -166,55 +164,6 @@ fun LinkedText(content: String, node: ASTNode, style: TextStyle, modifier: Modif
  */
 val LocalMarkdownTap = compositionLocalOf<(() -> Unit)?> { null }
 
-/**
- * Opens a markdown destination inside the current session when it names a file on that session's
- * machine. Null outside a session, where every link keeps its ordinary URI behaviour.
- */
-val LocalFileLinkHandler = compositionLocalOf<((String) -> Boolean)?> { null }
-
-/**
- * A stable markdown link handler whose behaviour follows the latest [onFile]. Keeping its identity
- * stable matters: every visible markdown paragraph reads it, and a session recomposes on every
- * streamed event.
- */
-@Composable
-fun rememberFileLinkHandler(onFile: (String) -> Unit): (String) -> Boolean {
-    val latest = rememberUpdatedState(onFile)
-    return remember {
-        { destination ->
-            val path = filePathOf(destination)
-            if (path == null) false
-            else {
-                latest.value(path)
-                true
-            }
-        }
-    }
-}
-
-/**
- * The path named by a local-file markdown destination.
- *
- * Only absolute paths and local `file:` URIs are claimed. A relative destination might be a web
- * link, and sending one to a machine's filesystem would silently give an ordinary link a different
- * meaning. Editors commonly append a line and optional column; the current viewer opens the file
- * itself, so those coordinates are removed here.
- */
-internal fun filePathOf(destination: String): String? {
-    val uri = runCatching { URI(destination) }.getOrNull()
-    val path =
-        when {
-            destination.startsWith("/") && !destination.startsWith("//") ->
-                uri?.path ?: destination.substringBefore('#').substringBefore('?')
-            uri != null &&
-                uri.scheme.equals("file", ignoreCase = true) &&
-                (uri.host.isNullOrEmpty() || uri.host == "localhost") -> uri.path
-            else -> null
-        }
-    if (path.isNullOrEmpty() || !path.startsWith('/')) return null
-    return path.replace(Regex(":\\d+(?::\\d+)?$"), "")
-}
-
 /**
  * [onTap] as a stable value to provide for [LocalMarkdownTap]. The identity stays put while the
  * behaviour follows the latest [onTap], which is what keeps providing it from invalidating the text

app/androidApp/src/main/kotlin/com/example/aiapp/ModelName.kt

@@ -21,25 +21,12 @@ const val DEFAULT_MODEL = "default"
  * one model rather than one model from another. Anything that does not look like that is returned
  * untouched.
  *
- * A llama.cpp session's model is not an identifier at all -- it is `owner/repo/file.gguf`, where
- * the file was downloaded from -- so what is kept is the file, which is the part that tells two
- * models apart, and the extension goes with the directories. The model's *own* name is better still
- * and is not derivable here: it is inside the file, and only the server has ever opened it. Where a
- * screen has the server's answer it should prefer it; this is the floor under every screen that
- * does not.
- *
  * A display decision, not a correction: the full name is what the session reports.
  */
 fun modelLabel(model: String?): String {
     val name = model?.takeIf { it.isNotBlank() } ?: return DEFAULT_MODEL
-    if (name.endsWith(GGUF)) {
-        return name.substringAfterLast('/').removeSuffix(GGUF)
-    }
     return name.removePrefix("claude-").replace(DATED_SUFFIX, "")
 }
 
 /** A trailing `-YYYYMMDD`, which is how these identifiers carry their release date. */
 private val DATED_SUFFIX = Regex("""-\d{8}$""")
-
-/** What every model a llama.cpp session can run is stored as. */
-private const val GGUF = ".gguf"

app/androidApp/src/main/kotlin/com/example/aiapp/ModelsScreen.kt

@@ -0,0 +1,374 @@
+package com.example.aiapp
+
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.material3.Card
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.LinearProgressIndicator
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+/**
+ * Models on the backend, and HuggingFace to get more from.
+ *
+ * Everything here is the server's state rather than this screen's: what is downloaded, and what is
+ * downloading, are the same answers on every enrolled device, and a download started here keeps
+ * going when this screen closes.
+ */
+@Composable
+fun ModelsScreen(settings: ServerSettings, reloadToken: Int) {
+    val scope = rememberCoroutineScope()
+    var state by remember { mutableStateOf<LoadState<Models>>(LoadState.Loading) }
+    var query by remember { mutableStateOf("") }
+    var results by remember { mutableStateOf<LoadState<List<RemoteRepo>>?>(null) }
+    var openRepo by remember { mutableStateOf<String?>(null) }
+    var repoFiles by remember { mutableStateOf<LoadState<List<RemoteFile>>?>(null) }
+    var actionError by remember { mutableStateOf<String?>(null) }
+
+    suspend fun reload() {
+        state =
+            try {
+                withContext(Dispatchers.IO) { LoadState.Loaded(fetchModels(settings)) }
+            } catch (e: ApiException) {
+                LoadState.failed(e)
+            }
+    }
+
+    // Polled rather than pushed: a download belongs to the machine, not to any session, so it has
+    // no event stream of its own. Keyed on the token as well, so the header's Refresh restarts the
+    // loop with a read now rather than leaving the reader watching for a second and a half.
+    LaunchedEffect(reloadToken) {
+        while (true) {
+            reload()
+            delay(1500)
+        }
+    }
+
+    Column(Modifier.fillMaxSize().padding(16.dp)) {
+        actionError?.let {
+            Text(it, color = MaterialTheme.colorScheme.error)
+            Spacer(Modifier.height(8.dp))
+        }
+
+        OutlinedTextField(
+            value = query,
+            onValueChange = { query = it },
+            label = { Text("Search HuggingFace") },
+            singleLine = true,
+            modifier = Modifier.fillMaxWidth(),
+        )
+        Spacer(Modifier.height(8.dp))
+        TextButton(
+            enabled = query.isNotBlank(),
+            onClick = {
+                openRepo = null
+                results = LoadState.Loading
+                scope.launch {
+                    results =
+                        try {
+                            withContext(Dispatchers.IO) {
+                                LoadState.Loaded(searchModels(settings, query))
+                            }
+                        } catch (e: ApiException) {
+                            LoadState.failed(e)
+                        }
+                }
+            },
+        ) {
+            Text("Search")
+        }
+
+        Spacer(Modifier.height(8.dp))
+        LazyColumn(Modifier.fillMaxSize()) {
+            when (val current = state) {
+                is LoadState.Loading -> item { CircularProgressIndicator() }
+                is LoadState.Error ->
+                    item { Text(current.message, color = MaterialTheme.colorScheme.error) }
+                is LoadState.Loaded -> {
+                    if (current.value.downloads.isNotEmpty()) {
+                        item { SectionLabel("Downloading") }
+                        uniqueItems(current.value.downloads, key = { it.key + it.run }) { download
+                            ->
+                            DownloadCard(download) {
+                                scope.launch {
+                                    actionError =
+                                        runCatching {
+                                            withContext(Dispatchers.IO) {
+                                                cancelDownload(settings, download.key)
+                                            }
+                                        }
+                                            .exceptionOrNull()
+                                            ?.message
+                                }
+                            }
+                        }
+                    }
+                    item { SectionLabel("On the backend") }
+                    if (current.value.local.isEmpty()) {
+                        item {
+                            Text(
+                                "None yet. Search above to find one.",
+                                style = MaterialTheme.typography.bodyMedium,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                            )
+                        }
+                    }
+                    uniqueItems(current.value.local, key = { it.key }) { model ->
+                        LocalModelCard(model) {
+                            scope.launch {
+                                actionError =
+                                    runCatching {
+                                        withContext(Dispatchers.IO) {
+                                            deleteModel(settings, model.key)
+                                        }
+                                    }
+                                        .exceptionOrNull()
+                                        ?.message
+                                reload()
+                            }
+                        }
+                    }
+                }
+            }
+
+            results?.let { found ->
+                item { SectionLabel("HuggingFace") }
+                when (found) {
+                    is LoadState.Loading -> item { CircularProgressIndicator() }
+                    is LoadState.Error ->
+                        item { Text(found.message, color = MaterialTheme.colorScheme.error) }
+                    is LoadState.Loaded ->
+                        uniqueItems(found.value, key = { it.id }) { repo ->
+                            val open = openRepo == repo.id
+                            RepoRow(repo, expanded = open) {
+                                if (open) {
+                                    openRepo = null
+                                } else {
+                                    openRepo = repo.id
+                                    repoFiles = LoadState.Loading
+                                    scope.launch {
+                                        repoFiles =
+                                            try {
+                                                withContext(Dispatchers.IO) {
+                                                    LoadState.Loaded(
+                                                        fetchRepoFiles(settings, repo.id)
+                                                    )
+                                                }
+                                            } catch (e: ApiException) {
+                                                LoadState.failed(e)
+                                            }
+                                    }
+                                }
+                            }
+                            // Inside the expanded repository's own item rather than as a section
+                            // after the list: drawn after every card, a repository's files read as
+                            // belonging to whichever card happened to be last.
+                            if (open) {
+                                when (val files = repoFiles) {
+                                    null -> {}
+                                    is LoadState.Loading -> CircularProgressIndicator()
+                                    is LoadState.Error ->
+                                        Text(files.message, color = MaterialTheme.colorScheme.error)
+                                    is LoadState.Loaded ->
+                                        Column {
+                                            val busy =
+                                                (state as? LoadState.Loaded)
+                                                    ?.value
+                                                    ?.downloads
+                                                    .orEmpty()
+                                                    .filter { it.state == "running" }
+                                                    .map { it.key }
+                                                    .toSet()
+                                            files.value.forEach { file ->
+                                                RepoFileRow(
+                                                    file,
+                                                    downloading = "${repo.id}/${file.path}" in busy,
+                                                ) {
+                                                    scope.launch {
+                                                        actionError =
+                                                            runCatching {
+                                                                withContext(Dispatchers.IO) {
+                                                                    startDownload(
+                                                                        settings,
+                                                                        repo.id,
+                                                                        file.path,
+                                                                    )
+                                                                }
+                                                            }
+                                                                .exceptionOrNull()
+                                                                ?.message
+                                                        reload()
+                                                    }
+                                                }
+                                            }
+                                        }
+                                }
+                            }
+                        }
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun SectionLabel(text: String) {
+    Spacer(Modifier.height(12.dp))
+    Text(text, style = MaterialTheme.typography.titleSmall)
+    Spacer(Modifier.height(4.dp))
+}
+
+@Composable
+private fun DownloadCard(download: Download, onCancel: () -> Unit) {
+    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
+        Column(Modifier.padding(12.dp)) {
+            Text(download.file, style = MaterialTheme.typography.titleSmall)
+            Text(
+                download.repo,
+                style = MaterialTheme.typography.bodySmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+            Spacer(Modifier.height(8.dp))
+            // A determinate bar only when the size is known. The server sends no total when it was
+            // never told one, and a bar drawn from a guess is worse than one that admits it is
+            // counting.
+            if (download.total != null && download.total > 0) {
+                LinearProgressIndicator(
+                    progress = { download.done.toFloat() / download.total.toFloat() },
+                    // Blue at every value, unlike a quota bar: a download nearing its end is
+                    // nearing success, and colouring it like a limit being approached would say the
+                    // opposite.
+                    color = progressColor,
+                    modifier = Modifier.fillMaxWidth(),
+                )
+                Text(
+                    "${gigabytes(download.done)} of ${gigabytes(download.total)}",
+                    style = MaterialTheme.typography.bodySmall,
+                )
+            } else {
+                LinearProgressIndicator(color = progressColor, modifier = Modifier.fillMaxWidth())
+                Text(
+                    "${gigabytes(download.done)} so far, total size unknown",
+                    style = MaterialTheme.typography.bodySmall,
+                )
+            }
+            download.error?.let {
+                Text(
+                    it,
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.error,
+                )
+            }
+            Row {
+                Text(
+                    download.state,
+                    style = MaterialTheme.typography.bodySmall,
+                    modifier = Modifier.weight(1f),
+                )
+                if (download.state == "running") {
+                    TextButton(onClick = onCancel) { Text("Cancel") }
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun LocalModelCard(model: LocalModel, onDelete: () -> Unit) {
+    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
+        Row(Modifier.padding(12.dp), verticalAlignment = Alignment.CenterVertically) {
+            Column(Modifier.weight(1f)) {
+                Text(model.file, style = MaterialTheme.typography.titleSmall)
+                Text(
+                    "${model.repo} · ${gigabytes(model.bytes)}",
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+            TextButton(onClick = onDelete) { Text("Delete") }
+        }
+    }
+}
+
+@Composable
+private fun RepoRow(repo: RemoteRepo, expanded: Boolean, onToggle: () -> Unit) {
+    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
+        Row(Modifier.padding(12.dp), verticalAlignment = Alignment.CenterVertically) {
+            Column(Modifier.weight(1f)) {
+                Text(
+                    repo.id,
+                    style = MaterialTheme.typography.titleSmall,
+                    maxLines = 1,
+                    // The owner is the part that repeats; the model name at the end is what tells
+                    // two entries apart.
+                    overflow = TextOverflow.StartEllipsis,
+                )
+                Text(
+                    "${repo.downloads} downloads · ${repo.likes} likes",
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+            TextButton(onClick = onToggle) { Text(if (expanded) "Hide" else "Files") }
+        }
+    }
+}
+
+@Composable
+private fun RepoFileRow(file: RemoteFile, downloading: Boolean, onDownload: () -> Unit) {
+    Row(
+        Modifier.fillMaxWidth().padding(start = 16.dp, top = 4.dp, bottom = 4.dp),
+        verticalAlignment = Alignment.CenterVertically,
+    ) {
+        Column(Modifier.weight(1f)) {
+            Text(file.path, style = MaterialTheme.typography.bodyMedium)
+            Text(
+                gigabytes(file.bytes),
+                style = MaterialTheme.typography.bodySmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+        }
+        // Disabled rather than absent, so the row reads the same whether this one is absent,
+        // already here, or on its way. Offering "Download" for a file that is downloading would be
+        // a button that does nothing anyone can see.
+        TextButton(enabled = !file.have && !downloading, onClick = onDownload) {
+            Text(
+                when {
+                    file.have -> "Downloaded"
+                    downloading -> "Downloading"
+                    else -> "Download"
+                }
+            )
+        }
+    }
+}
+
+private fun gigabytes(bytes: Long): String =
+    if (bytes >= 1_000_000_000) {
+        "%.2f GB".format(bytes / 1_000_000_000.0)
+    } else {
+        "%.0f MB".format(bytes / 1_000_000.0)
+    }

app/androidApp/src/main/kotlin/com/example/aiapp/NerdIcons.kt

@@ -28,7 +28,7 @@ import androidx.compose.ui.unit.sp
  * This replaced a hand-drawn canvas gear, whose doc comment argued against icon fonts on the
  * grounds that a system font may not have the glyph. That objection is about *relying* on a system
  * font, and it is exactly right: the answer is not to avoid glyphs but to ship them. The font here
- * is `app/build-icon-font.sh`'s output -- eighteen glyphs, 2.9 KB, subset out of the 3 MB symbols
+ * is `app/build-icon-font.sh`'s output -- seventeen glyphs, 2.8 KB, subset out of the 3 MB symbols
  * font and committed. Adding one means adding its codepoint in *both* places; a codepoint here that
  * the script did not subset is a glyph that silently isn't there.
  *
@@ -136,34 +136,6 @@ val EDIT_GLYPH = glyph(0xF03EB)
  */
 val SAVE_GLYPH = glyph(0xF0193)
 
-/**
- * `md-menu` -- the burger: three stacked rules, drawn as the handle a row is dragged by.
- *
- * The mark for "take hold of this and move it" rather than for a menu, which is what it means on a
- * row that has one: three rules look like the rows of a list, and the only thing here that draws
- * them is a list being rearranged. Nothing else in this app opens a menu from a burger, so the two
- * senses cannot be confused.
- */
-val DRAG_GLYPH = glyph(0xF035C)
-
-/**
- * `md-console_line` -- a shell prompt: a backgrounded command, in the panel beside the turn.
- *
- * The four marks here are one set, drawn by `backgroundTaskLook`: they exist because the kind of a
- * background task used to be a word on a line of its own, which on a list of commands was the same
- * two words down the whole panel. Each keeps its words as the description a screen reader is given.
- */
-val COMMAND_GLYPH = glyph(0xF07B7)
-
-/** `md-robot` -- a subagent: something running that is doing its own reasoning. */
-val AGENT_GLYPH = glyph(0xF06A9)
-
-/** `md-sitemap` -- a workflow: steps arranged by something other than the agent itself. */
-val WORKFLOW_GLYPH = glyph(0xF04AA)
-
-/** `md-help_circle_outline` -- a background task of a kind this build has not heard of. */
-val UNKNOWN_GLYPH = glyph(0xF0625)
-
 /**
  * The size an icon draws at beside a line of text.
  *
@@ -193,7 +165,7 @@ private val GLYPH_EXTENT = GLYPH_SIZE.value.dp
  * own corners and beside a title it arrived at the first letter. And it is taller than any header's
  * text, which is what lets the button fill a header row rather than sit in the middle of one.
  */
-val GLYPH_BUTTON_SIZE = 48.dp
+private val GLYPH_BUTTON_SIZE = 48.dp
 
 /**
  * The ring itself, for putting something that is *not* a glyph button next to one -- a title beside

app/androidApp/src/main/kotlin/com/example/aiapp/Notifications.kt

@@ -34,8 +34,6 @@ import org.json.JSONObject
  * gets a push from Google's servers, which would mean this backend talking to Google about
  * somebody's coding sessions, and the whole point of the tunnel is that it does not.
  *
- * Every moment it hears about goes to the drawer; [show] decides what else is done with it.
- *
  * The cost Android charges is a notification of its own that cannot be dismissed. That is made as
  * quiet as the platform allows: [ONGOING_CHANNEL] is `IMPORTANCE_MIN`, so it makes no sound, shows
  * no status-bar icon, and sits at the bottom of the shade. It is not hidden outright, because it
@@ -140,11 +138,10 @@ class NotificationService : Service() {
         // Nothing to tell somebody about the session they are reading. The transcript in front of
         // them is already saying it.
         if (isOnScreen(notification.sessionId)) return
-        // The app is up, so it says this itself as a banner over whatever screen they are on --
-        // which interrupts, where the drawer's row records: a banner lasts seconds and reaches only
-        // somebody already looking. Both go up, and the banner having done the interrupting is what
-        // makes the row a silent one.
-        val banner = handOver(notification)
+        // The app is up: it says this itself, as a banner over whatever screen they are on. Never
+        // both -- one thing happened, and a drawer filling up behind an app that already showed you
+        // each one is a drawer nobody reads.
+        if (handOver(notification)) return
         val manager = NotificationManagerCompat.from(this)
         // Two different noes, and both are answers rather than faults: the runtime permission
         // refused, and notifications switched off for the app in Android's own settings.
@@ -175,7 +172,6 @@ class NotificationService : Service() {
                 .setAutoCancel(true)
                 .setWhen((notification.at * 1000).toLong())
                 .setShowWhen(true)
-                .setSilent(banner)
                 .build()
         manager.notify(notification.sessionId, ALERT_ID, built)
     }
@@ -266,8 +262,7 @@ class NotificationService : Service() {
          * Whether there is an app to reach is the subscriber count rather than a flag of its own:
          * [SessionAlerts] collects this exactly while it is on screen. `tryEmit` neither suspends
          * nor blocks the thread reading the stream, and the buffer is there so a handful of
-         * sessions finishing together all land rather than the last one winning. Reaching the app
-         * does not stop the drawer's row; it makes it a silent one.
+         * sessions finishing together all land rather than the last one winning.
          */
         private val toApp = MutableSharedFlow<SessionNotification>(extraBufferCapacity = 8)
 
@@ -277,11 +272,7 @@ class NotificationService : Service() {
         private fun handOver(notification: SessionNotification) =
             toApp.subscriptionCount.value > 0 && toApp.tryEmit(notification)
 
-        /**
-         * Somebody is looking at [sessionId]; nothing is posted about it until they stop, and
-         * whatever the drawer is already holding about it goes now rather than waiting to be swiped
-         * away. Opening the session *is* reading the notification, whichever way they got here.
-         */
+        /** Somebody is looking at [sessionId]; nothing is posted about it until they stop. */
         fun showing(context: Context, sessionId: String) {
             onScreen = sessionId
             // Whatever was posted about it before is about to be read, so it has nothing left to

app/androidApp/src/main/kotlin/com/example/aiapp/PendingMessages.kt

@@ -1,121 +0,0 @@
-package com.example.aiapp
-
-import android.content.Context
-import androidx.core.content.edit
-import java.util.UUID
-import org.json.JSONArray
-import org.json.JSONObject
-
-private const val PENDING_MESSAGES = "pending-messages"
-
-/** A quiet user bubble below the durable transcript. */
-internal data class QueuedMessage(
-    val id: String,
-    val text: String,
-    val attachments: List<String>,
-    val refusal: String? = null,
-    /** This phone is still waiting for any durable event that says the server accepted it. */
-    val local: Boolean = false,
-    /** The HTTP request returned successfully; the provider event is still outstanding. */
-    val serverAccepted: Boolean = false,
-)
-
-internal fun localPendingMessage(text: String, attachments: List<String>) =
-    QueuedMessage("local-${UUID.randomUUID()}", text, attachments, local = true)
-
-private fun QueuedMessage.matches(text: String, attachments: List<String>) =
-    this.text == text && this.attachments == attachments
-
-/** Replaces the local bridge with the server's durable waiting message, without drawing both. */
-internal fun reconcileQueuedMessage(
-    queued: List<QueuedMessage>,
-    event: SessionEvent.MessageQueued,
-): List<QueuedMessage> {
-    if (queued.any { !it.local && it.id == event.id }) return queued
-    val at = queued.indexOfFirst { it.local && it.matches(event.text, event.attachments) }
-    if (at < 0) return queued + QueuedMessage(event.id, event.text, event.attachments)
-    return queued.mapIndexed { index, message ->
-        if (index == at) QueuedMessage(event.id, event.text, event.attachments) else message
-    }
-}
-
-/** Removes exactly the pending bubble that became a provider-received user message. */
-internal fun reconcileUserMessage(
-    queued: List<QueuedMessage>,
-    event: SessionEvent.UserMessage,
-): List<QueuedMessage> {
-    val at =
-        event.id?.let { id -> queued.indexOfFirst { !it.local && it.id == id }.takeIf { it >= 0 } }
-            ?: queued.indexOfFirst { it.local && it.matches(event.text, event.attachments) }
-    return if (at < 0) queued else queued.filterIndexed { index, _ -> index != at }
-}
-
-/** Keeps a failed send in place and puts its actionable failure in that message's bubble. */
-internal fun markPendingFailure(
-    queued: List<QueuedMessage>,
-    id: String,
-    failure: String,
-): List<QueuedMessage> = queued.map { message ->
-    if (message.local && message.id == id) message.copy(refusal = failure) else message
-}
-
-/** Stops persisting a send once the server owns it, while its bubble awaits the provider event. */
-internal fun markPendingAccepted(queued: List<QueuedMessage>, id: String): List<QueuedMessage> =
-    queued.map { message ->
-        if (message.local && message.id == id) message.copy(serverAccepted = true) else message
-    }
-
-internal fun discardPendingMessage(
-    queued: List<QueuedMessage>,
-    id: String,
-): List<QueuedMessage> = queued.filterNot { it.local && it.id == id }
-
-/** Restores sends for which this phone has not yet seen a durable server event. */
-internal fun loadPendingMessages(context: Context, key: String): List<QueuedMessage> {
-    val encoded =
-        context.getSharedPreferences(PENDING_MESSAGES, Context.MODE_PRIVATE).getString(key, null)
-            ?: return emptyList()
-    return try {
-        val messages = JSONArray(encoded)
-        List(messages.length()) { index ->
-            val message = messages.getJSONObject(index)
-            val attachments = message.optJSONArray("attachments") ?: JSONArray()
-            QueuedMessage(
-                id = message.getString("id"),
-                text = message.getString("text"),
-                attachments = List(attachments.length()) { attachments.getString(it) },
-                refusal = message.optString("refusal").takeIf { it.isNotEmpty() },
-                local = true,
-            )
-        }
-    } catch (_: org.json.JSONException) {
-        // A corrupt local outbox is not useful on the next open either. Remove it rather than
-        // repeatedly pretending it decoded to an intentionally empty one.
-        context.getSharedPreferences(PENDING_MESSAGES, Context.MODE_PRIVATE).edit { remove(key) }
-        emptyList()
-    }
-}
-
-/** Stores only sends the server has not confirmed; everything accepted is the server's to keep. */
-internal fun savePendingMessages(context: Context, key: String, queued: List<QueuedMessage>) {
-    val local = queued.filter { it.local && !it.serverAccepted }
-    context.getSharedPreferences(PENDING_MESSAGES, Context.MODE_PRIVATE).edit {
-        if (local.isEmpty()) {
-            remove(key)
-        } else {
-            putString(
-                key,
-                JSONArray(
-                        local.map { message ->
-                            JSONObject()
-                                .put("id", message.id)
-                                .put("text", message.text)
-                                .put("attachments", JSONArray(message.attachments))
-                                .put("refusal", message.refusal ?: "")
-                        }
-                    )
-                    .toString(),
-            )
-        }
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/ProviderLoginDialog.kt

@@ -1,211 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.height
-import androidx.compose.material3.AlertDialog
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableIntStateOf
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.LocalUriHandler
-import androidx.compose.ui.unit.dp
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-/**
- * Relays a provider CLI's headless browser login without ever owning its credentials.
- *
- * The URL and code live only in this composition. The CLI process on [machineId] remains the one
- * OAuth client and the only writer of its credential file.
- */
-@Composable
-fun ProviderLoginDialog(
-    settings: ServerSettings,
-    machineId: String,
-    machineName: String,
-    provider: String,
-    onDismiss: () -> Unit,
-    onSignedIn: () -> Unit,
-) {
-    val scope = rememberCoroutineScope()
-    val uriHandler = LocalUriHandler.current
-    var login by remember(machineId, provider) { mutableStateOf<ProviderLogin?>(null) }
-    var code by remember(machineId, provider) { mutableStateOf("") }
-    var error by remember(machineId, provider) { mutableStateOf<String?>(null) }
-    var retry by remember(machineId, provider) { mutableIntStateOf(0) }
-
-    suspend fun follow(initial: ProviderLogin): ProviderLogin {
-        var current = initial
-        val wasSubmitting = initial.state == "submitting"
-        while (current.state == "starting" || current.state == "submitting") {
-            delay(400)
-            current =
-                withContext(Dispatchers.IO) {
-                    fetchProviderLogin(
-                        settings,
-                        machineId,
-                        provider,
-                        current.attempt,
-                    )
-                }
-            login = current
-        }
-        if (wasSubmitting && current.state == "waitingForCode" && current.detail == null) {
-            current =
-                current.copy(
-                    detail = "That code was not accepted. Copy the complete code and try again."
-                )
-            login = current
-        }
-        return current
-    }
-
-    LaunchedEffect(machineId, provider, retry) {
-        error = null
-        code = ""
-        login = null
-        try {
-            val started =
-                withContext(Dispatchers.IO) { startProviderLogin(settings, machineId, provider) }
-            login = started
-            if (follow(started).state == "succeeded") {
-                onSignedIn()
-            }
-        } catch (e: ApiException) {
-            error = e.message
-        }
-    }
-
-    fun dismiss() {
-        login
-            ?.takeUnless { it.state in setOf("succeeded", "failed", "cancelled") }
-            ?.let {
-                scope.launch(Dispatchers.IO) {
-                    runCatching { cancelProviderLogin(settings, machineId, provider, it.attempt) }
-                }
-            }
-        onDismiss()
-    }
-
-    AlertDialog(
-        onDismissRequest = ::dismiss,
-        title = { Text("Sign in to Claude") },
-        text = {
-            Column {
-                Text(
-                    "Claude will sign in on $machineName. Open the authorization page, then " +
-                        "paste the code it gives you here."
-                )
-                Spacer(Modifier.height(12.dp))
-                when (val current = login) {
-                    null ->
-                        if (error == null) {
-                            Row(verticalAlignment = Alignment.CenterVertically) {
-                                CircularProgressIndicator()
-                                Text("Starting sign-in…")
-                            }
-                        }
-                    else ->
-                        when (current.state) {
-                            "starting",
-                            "submitting" ->
-                                Row(verticalAlignment = Alignment.CenterVertically) {
-                                    CircularProgressIndicator()
-                                    Text(
-                                        if (current.state == "submitting") "Checking code…"
-                                        else "Starting sign-in…"
-                                    )
-                                }
-                            "waitingForCode" -> {
-                                TextButton(
-                                    onClick = {
-                                        runCatching {
-                                            current.authorizationUrl?.let(uriHandler::openUri)
-                                        }
-                                            .onFailure {
-                                                error = "Couldn't open the authorization page."
-                                            }
-                                    },
-                                    enabled = current.authorizationUrl != null,
-                                ) {
-                                    Text("Open authorization page")
-                                }
-                                LabelledField(
-                                    label = "Authorization code",
-                                    value = code,
-                                    onValueChange = { code = it },
-                                )
-                                current.detail?.let {
-                                    Text(it, color = MaterialTheme.colorScheme.error)
-                                }
-                            }
-                            "succeeded" -> Text("Signed in on $machineName.")
-                            "cancelled" -> Text("Sign-in was cancelled.")
-                            else ->
-                                Text(
-                                    current.detail ?: "Sign-in failed.",
-                                    color = MaterialTheme.colorScheme.error,
-                                )
-                        }
-                }
-                error?.let { Text(it, color = MaterialTheme.colorScheme.error) }
-            }
-        },
-        confirmButton = {
-            val current = login
-            when {
-                current?.state == "waitingForCode" ->
-                    TextButton(
-                        onClick = {
-                            scope.launch {
-                                error = null
-                                try {
-                                    val submitted =
-                                        withContext(Dispatchers.IO) {
-                                            submitProviderLoginCode(
-                                                settings,
-                                                machineId,
-                                                provider,
-                                                current.attempt,
-                                                code,
-                                            )
-                                        }
-                                    login = submitted
-                                    if (follow(submitted).state == "succeeded") {
-                                        onSignedIn()
-                                    }
-                                } catch (e: ApiException) {
-                                    error = e.message
-                                }
-                            }
-                        },
-                        enabled = code.isNotBlank(),
-                    ) {
-                        Text("Continue")
-                    }
-                error != null || current?.state == "failed" || current?.state == "cancelled" ->
-                    TextButton(onClick = { retry++ }) { Text("Try again") }
-                current?.state == "succeeded" -> TextButton(onClick = onDismiss) { Text("Done") }
-            }
-        },
-        dismissButton = {
-            if (login?.state != "succeeded") {
-                TextButton(onClick = ::dismiss) { Text("Cancel") }
-            }
-        },
-    )
-}

app/androidApp/src/main/kotlin/com/example/aiapp/ProviderParams.kt

@@ -1,111 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.text.input.KeyboardType
-import androidx.compose.ui.unit.dp
-
-/**
- * The controls for whatever settings a provider says it takes.
- *
- * One composable for both screens that offer them — the spawn form and the session settings dialog
- * — and for every provider, because the server declares the list (see `DriverKind::params`) rather
- * than this file knowing it. A driver that grows a setting gets a control here with no change to
- * the app, which is the whole point: the values that suit one machine ship as defaults, and every
- * one of them stays reachable from a phone.
- *
- * [values] is the whole map and [onChange] hands back the whole map. A key absent from it means the
- * setting is unset, which is what every [ParamSpec.unset] describes — so clearing a field and never
- * touching it are deliberately the same state.
- */
-@Composable
-fun ProviderParamFields(
-    specs: List<ParamSpec>,
-    values: Map<String, String>,
-    onChange: (Map<String, String>) -> Unit,
-    /**
-     * How a choice is drawn here, which is the screen's to decide rather than the setting's: chips
-     * on a form somebody is filling in, a picker row in a list of settings. A provider's choices
-     * have to look like the choices beside them, whichever screen that is.
-     */
-    choices: ChoiceStyle,
-    modifier: Modifier = Modifier,
-) {
-    if (specs.isEmpty()) return
-    Column(modifier.fillMaxWidth()) {
-        specs.forEach { spec ->
-            val set = { value: String ->
-                onChange(
-                    // Blank clears rather than storing an empty string: the server reads an absent
-                    // key as "use the default", and an empty one would be a value it then failed
-                    // to parse.
-                    if (value.isBlank()) values - spec.key else values + (spec.key to value)
-                )
-            }
-            when (spec.kind) {
-                "choice" -> {
-                    // The first option is what unset means, so selecting it clears the key — see
-                    // `ParamKind::Choice`. Without that the picker could show a default it could
-                    // not return to.
-                    val default = spec.options.firstOrNull().orEmpty()
-                    val selected = values[spec.key] ?: default
-                    val pick = { chosen: String -> set(if (chosen == default) "" else chosen) }
-                    when (choices) {
-                        ChoiceStyle.Chips ->
-                            ChipGroup(
-                                label = spec.label,
-                                options = spec.options,
-                                selected = selected,
-                                onSelect = pick,
-                            )
-                        ChoiceStyle.Picker -> PickerRow(spec.label, selected, spec.options, pick)
-                    }
-                }
-                else ->
-                    LabelledField(
-                        label = spec.label,
-                        value = values[spec.key].orEmpty(),
-                        onValueChange = set,
-                        hint = spec.unset,
-                        // Prose is written rather than filled in, so it gets the room to be read
-                        // back -- see `ParamKind::Prose`.
-                        lines = if (spec.kind == "prose") 4 else 1,
-                        keyboardOptions = KeyboardOptions(keyboardType = keyboardFor(spec.kind)),
-                    )
-            }
-            Spacer(Modifier.height(12.dp))
-        }
-    }
-}
-
-/** Which control a [ParamKind.Choice] gets -- see [ProviderParamFields]'s `choices`. */
-enum class ChoiceStyle {
-    Chips,
-    Picker,
-}
-
-/**
- * The keyboard for a value's shape. A number field that opens the letter keyboard is one every
- * entry is made harder by, and these are nearly all numbers.
- */
-private fun keyboardFor(kind: String): KeyboardType =
-    when (kind) {
-        "integer" -> KeyboardType.Number
-        "decimal" -> KeyboardType.Decimal
-        else -> KeyboardType.Text
-    }
-
-/**
- * How long typing has to stop before edited settings are sent.
- *
- * Long enough that a number is one request rather than one per digit, short enough that closing the
- * dialog straight after typing still saves — the save runs on the screen behind it, which outlives
- * the dialog, so this delay is not a window the value can be lost in.
- */
-const val PARAM_SAVE_DELAY_MS = 700L

app/androidApp/src/main/kotlin/com/example/aiapp/ProviderScreen.kt

@@ -1,509 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.imePadding
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.AlertDialog
-import androidx.compose.material3.Card
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableIntStateOf
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.text.font.FontFamily
-import androidx.compose.ui.text.input.KeyboardType
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.window.DialogProperties
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-/**
- * One provider on one machine: what it is, what its shared server is holding, and how each of its
- * models is loaded.
- *
- * This is where a setting that belongs to a *machine* lives, as opposed to one that belongs to a
- * session. The two were one list until llama.cpp sessions came to share one server per machine: how
- * a model is loaded stopped being anything a single session could decide, because one copy of it in
- * memory is what several sessions are talking to.
- *
- * It is also the only place a loaded model is taken out of memory. Nothing does that on its own —
- * closing a session leaves the model loaded on purpose, since the next one to want it would
- * otherwise pay the load again — so the memory is freed here, where what it costs everybody is
- * visible.
- */
-@Composable
-fun ProviderScreen(
-    settings: ServerSettings,
-    machineId: String,
-    provider: String,
-    /**
-     * The way back, or null where this is drawn inside something that has one of its own -- the
-     * session settings screen's second tab. Two ways out stacked above each other is a reader
-     * asking which of them goes where.
-     */
-    onBack: (() -> Unit)?,
-) {
-    val scope = rememberCoroutineScope()
-    var state by remember { mutableStateOf<LoadState<ProviderView>>(LoadState.Loading) }
-    var reload by remember { mutableIntStateOf(0) }
-    var editing by remember { mutableStateOf<ProviderModel?>(null) }
-    var confirmingStop by remember { mutableStateOf(false) }
-    // What is being done to the server or to one of its models, in a word, and what went wrong
-    // when it did. Both here rather than per row: these act on the whole machine.
-    var busy by remember { mutableStateOf<String?>(null) }
-    var actionError by remember { mutableStateOf<String?>(null) }
-    var confirmingDelete by remember { mutableStateOf<ProviderModel?>(null) }
-
-    // The machine's own models and what is being fetched onto it. Only for a provider that serves
-    // files off that machine's disk -- everything else names its models rather than holding them,
-    // and a search for a GGUF under the Claude CLI would be an offer that leads nowhere.
-    val kind = (state as? LoadState.Loaded)?.value?.kind
-    val machineModels =
-        rememberMachineModels(
-            settings = settings,
-            machineId = machineId,
-            enabled = kind == "llama_cpp",
-            // A download that became a model is a model this screen has no settings for yet, so
-            // the view it is drawing is now one model short of the truth.
-            onLocalChange = { reload++ },
-        )
-
-    LaunchedEffect(reload) {
-        state =
-            try {
-                withContext(Dispatchers.IO) {
-                    LoadState.Loaded(fetchProvider(settings, machineId, provider))
-                }
-            } catch (e: ApiException) {
-                LoadState.failed(e)
-            }
-    }
-
-    // Say what is happening, do it, say what went wrong, refetch: every action on this screen
-    // changes what it is showing.
-    val act = { what: String, action: suspend () -> Unit ->
-        scope.launch {
-            busy = what
-            actionError =
-                runCatching { withContext(Dispatchers.IO) { action() } }.exceptionOrNull()?.message
-            busy = null
-            reload++
-        }
-        Unit
-    }
-
-    // The models search at the bottom takes the keyboard, and everything below the field it is
-    // typed in -- the Search button, the results -- is behind it without this.
-    Column(Modifier.fillMaxSize().imePadding().padding(16.dp)) {
-        onBack?.let {
-            Row(
-                verticalAlignment = Alignment.CenterVertically,
-                modifier = Modifier.fillMaxWidth(),
-            ) {
-                TextButton(onClick = it) { Text("Back") }
-            }
-        }
-        when (val current = state) {
-            is LoadState.Loading -> CircularProgressIndicator()
-            is LoadState.Error -> Text(current.message, color = MaterialTheme.colorScheme.error)
-            is LoadState.Loaded -> {
-                val view = current.value
-                Text(view.name, style = MaterialTheme.typography.titleMedium)
-                Text(
-                    "on ${view.machine}",
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-                view.command?.let {
-                    Text(
-                        it,
-                        style = MaterialTheme.typography.bodySmall,
-                        fontFamily = FontFamily.Monospace,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-                Spacer(Modifier.height(12.dp))
-                actionError?.let {
-                    Text(it, color = MaterialTheme.colorScheme.error)
-                    Spacer(Modifier.height(8.dp))
-                }
-                busy?.let {
-                    Row(verticalAlignment = Alignment.CenterVertically) {
-                        CircularProgressIndicator(Modifier.height(16.dp).padding(end = 8.dp))
-                        Text(it, style = MaterialTheme.typography.bodySmall)
-                    }
-                    Spacer(Modifier.height(8.dp))
-                }
-
-                LazyColumn(Modifier.fillMaxSize()) {
-                    view.server?.let { server ->
-                        item("server") {
-                            ServerCard(
-                                server = server,
-                                maxLoaded = view.maxLoaded,
-                                enabled = busy == null,
-                                onStop = { confirmingStop = true },
-                                onMaxLoaded = { chosen ->
-                                    act("Saving…") {
-                                        setProviderSettings(
-                                            settings,
-                                            machineId,
-                                            provider,
-                                            chosen,
-                                        )
-                                    }
-                                },
-                            )
-                            Spacer(Modifier.height(12.dp))
-                        }
-                    }
-                    if (view.models.isNotEmpty() && view.modelParams.isNotEmpty()) {
-                        item("models-heading") {
-                            Text("Models", style = MaterialTheme.typography.titleSmall)
-                            Spacer(Modifier.height(8.dp))
-                        }
-                    }
-                    machineModels.actionError?.let { failure ->
-                        item("models-error") {
-                            Text(failure, color = MaterialTheme.colorScheme.error)
-                        }
-                    }
-                    // Above the models: this is what is about to be one of them.
-                    downloadCards(machineModels)
-                    val sizes = machineModels.sizes
-                    uniqueItems(view.models, key = { it.id }) { model ->
-                        ModelCard(
-                            model = model,
-                            specs = view.modelParams,
-                            bytes = sizes[model.id],
-                            onDelete =
-                                if (model.id in sizes) ({ confirmingDelete = model }) else null,
-                            // Tapping opens the settings; a provider whose models take none has
-                            // nothing to open, so the row is not a control.
-                            onEdit =
-                                if (view.modelParams.isEmpty()) null else ({ editing = model }),
-                            onUnload =
-                                if (model.status == "loaded" || model.status == "sleeping") {
-                                    {
-                                        act("Unloading ${model.label}…") {
-                                            unloadProviderModel(
-                                                settings,
-                                                machineId,
-                                                provider,
-                                                model.id,
-                                            )
-                                        }
-                                    }
-                                } else null,
-                            enabled = busy == null,
-                        )
-                    }
-                    if (kind == "llama_cpp") modelSearch(machineModels)
-                    if (view.mcpServers.isNotEmpty()) {
-                        item("mcp") {
-                            Spacer(Modifier.height(12.dp))
-                            Text("Tool servers", style = MaterialTheme.typography.titleSmall)
-                            Text(
-                                view.mcpServers.joinToString(", ") +
-                                    " — configured on the backend, in its config file.",
-                                style = MaterialTheme.typography.bodySmall,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                            )
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    editing?.let { model ->
-        val view = (state as? LoadState.Loaded)?.value
-        ModelSettingsDialog(
-            model = model,
-            specs = view?.modelParams.orEmpty(),
-            onDismiss = { editing = null },
-            onSave = { params ->
-                editing = null
-                act("Saving ${model.label}…") {
-                    setModelSettings(settings, machineId, provider, model.id, params)
-                }
-            },
-        )
-    }
-
-    confirmingDelete?.let { model ->
-        AlertDialog(
-            onDismissRequest = { confirmingDelete = null },
-            title = { Text("Delete ${model.label}?") },
-            text = {
-                Text(
-                    "The file is removed from ${(state as? LoadState.Loaded)?.value?.machine ?: "this machine"}. " +
-                        "Nothing here can get it back -- downloading it again is the whole file again. " +
-                        "Sessions using it keep their conversations and cannot start it."
-                )
-            },
-            confirmButton = {
-                TextButton(
-                    onClick = {
-                        confirmingDelete = null
-                        machineModels.remove(model.id)
-                    }
-                ) {
-                    Text("Delete")
-                }
-            },
-            dismissButton = {
-                TextButton(onClick = { confirmingDelete = null }) { Text("Cancel") }
-            },
-        )
-    }
-
-    if (confirmingStop) {
-        AlertDialog(
-            onDismissRequest = { confirmingStop = false },
-            title = { Text("Stop this server?") },
-            text = {
-                // Said plainly rather than hidden: this is the only thing that frees the memory,
-                // and what it costs is that every session on this machine reloads its model.
-                Text(
-                    "Every model it is holding is unloaded. Sessions using it will show as " +
-                        "exited, and the next message to one loads its model again — which is " +
-                        "the slow part, not the sending."
-                )
-            },
-            confirmButton = {
-                TextButton(
-                    onClick = {
-                        confirmingStop = false
-                        act("Stopping…") { stopProviderServer(settings, machineId, provider) }
-                    }
-                ) {
-                    Text("Stop")
-                }
-            },
-            dismissButton = { TextButton(onClick = { confirmingStop = false }) { Text("Cancel") } },
-        )
-    }
-}
-
-@Composable
-private fun ServerCard(
-    server: ServerState,
-    maxLoaded: Int?,
-    enabled: Boolean,
-    onStop: () -> Unit,
-    onMaxLoaded: (Int?) -> Unit,
-) {
-    // The saved value is what this starts at and what Save is compared against, so a field left
-    // half-typed is visibly not saved rather than quietly either way.
-    val saved = maxLoaded?.toString().orEmpty()
-    var typed by remember(saved) { mutableStateOf(saved) }
-    var confirming by remember { mutableStateOf(false) }
-    Card(Modifier.fillMaxWidth()) {
-        Column(Modifier.padding(12.dp)) {
-            Text("Model server", style = MaterialTheme.typography.titleSmall)
-            Text(
-                if (server.running) {
-                    "Running" + (server.port?.let { ", reached on port $it" } ?: "")
-                } else {
-                    // Not a fault: nothing is loaded because nothing has asked. Saying it in
-                    // words rather than colouring the row, since "stopped" and "we could not
-                    // ask" would otherwise look the same.
-                    "Not running. A session starts it when it needs a model."
-                },
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-            Spacer(Modifier.height(8.dp))
-            LabelledField(
-                label = "Models loaded at once",
-                value = typed,
-                onValueChange = { typed = it.filter(Char::isDigit) },
-                hint = "one -- a second model replaces the first",
-                keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Number),
-            )
-            Row(verticalAlignment = Alignment.CenterVertically) {
-                // Shown whether or not it is running, and disabled when there is nothing to stop:
-                // a button that comes and goes makes its own absence the message.
-                TextButton(enabled = enabled && server.running, onClick = onStop) { Text("Stop") }
-                Spacer(Modifier.weight(1f))
-                TextButton(
-                    enabled = enabled && typed != saved,
-                    // Saving this while the server is up changes nothing until it comes down
-                    // again, which is asked rather than written underneath -- see [RestartDialog].
-                    onClick = {
-                        if (server.running) confirming = true else onMaxLoaded(typed.toIntOrNull())
-                    },
-                ) {
-                    Text("Save")
-                }
-            }
-        }
-    }
-    if (confirming) {
-        RestartDialog(
-            title = "Save for the next start?",
-            text =
-                "This server is running, and how many models it keeps loaded was decided when it " +
-                    "started. Saving now changes what it does the next time it starts -- stop it " +
-                    "here to have that be now.",
-            onConfirm = {
-                confirming = false
-                onMaxLoaded(typed.toIntOrNull())
-            },
-            onDismiss = { confirming = false },
-        )
-    }
-}
-
-@Composable
-private fun ModelCard(
-    model: ProviderModel,
-    specs: List<ParamSpec>,
-    /** How big the file is on the machine, for a provider whose models are files. */
-    bytes: Long?,
-    onEdit: (() -> Unit)?,
-    onUnload: (() -> Unit)?,
-    onDelete: (() -> Unit)?,
-    enabled: Boolean,
-) {
-    Card(
-        Modifier.fillMaxWidth()
-            .padding(vertical = 4.dp)
-            .then(if (onEdit != null && enabled) Modifier.clickable(onClick = onEdit) else Modifier)
-    ) {
-        Column(Modifier.padding(12.dp)) {
-            Row(verticalAlignment = Alignment.CenterVertically) {
-                Text(
-                    model.label,
-                    style = MaterialTheme.typography.bodyMedium,
-                    modifier = Modifier.weight(1f),
-                )
-                bytes?.let {
-                    Text(
-                        gigabytes(it),
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-            }
-            // What the server is doing with it, in its own word. Absent means nobody could ask --
-            // the server is not running -- and the line is left out rather than guessed at.
-            model.status?.let {
-                Text(
-                    it,
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-            }
-            if (model.settings.isNotEmpty()) {
-                Text(
-                    // In the words the dialog uses, and in the order it draws them: a summary
-                    // naming `contextSize` is a summary of a different screen than the one it
-                    // sits under.
-                    specs
-                        .mapNotNull { spec ->
-                            model.settings[spec.key]?.let { "${spec.label} $it" }
-                        }
-                        .joinToString(", "),
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-            }
-            if (onUnload != null || onDelete != null) {
-                Row(verticalAlignment = Alignment.CenterVertically) {
-                    // Both shown whenever this kind of model has them, disabled rather than
-                    // absent: unloading frees memory and deleting frees disk, and a button that
-                    // comes and goes makes its own absence the message.
-                    onUnload?.let { TextButton(enabled = enabled, onClick = it) { Text("Unload") } }
-                    Spacer(Modifier.weight(1f))
-                    onDelete?.let { TextButton(enabled = enabled, onClick = it) { Text("Delete") } }
-                }
-            }
-        }
-    }
-}
-
-/**
- * How one model is loaded.
- *
- * Saved on Save rather than as it is typed, unlike the session settings dialog: writing this
- * unloads the model for everybody using it, which is not something to do once per keystroke.
- */
-@Composable
-private fun ModelSettingsDialog(
-    model: ProviderModel,
-    specs: List<ParamSpec>,
-    onDismiss: () -> Unit,
-    onSave: (Map<String, String>) -> Unit,
-) {
-    var params by remember(model.id) { mutableStateOf(model.settings) }
-    // Asked over this dialog rather than instead of it, so Cancel comes back to the edits rather
-    // than throwing them away.
-    var confirming by remember(model.id) { mutableStateOf(false) }
-    // Whether saving costs anything worth asking about: something has to be in memory, and at
-    // least one of these settings has to be one it read on the way in.
-    val reloads =
-        (model.status == "loaded" || model.status == "sleeping") && specs.any { it.restart }
-    AlertDialog(
-        onDismissRequest = onDismiss,
-        // Every control here is a number, so the keyboard is up for most of this dialog's life --
-        // and a dialog that keeps its own size under the keyboard puts Save off the bottom of the
-        // screen, where nothing on screen says it is there. Taking the insets ourselves is what
-        // lets `imePadding` shrink it instead.
-        properties = DialogProperties(decorFitsSystemWindows = false),
-        modifier = Modifier.imePadding(),
-        title = { Text(model.label) },
-        text = {
-            Column(Modifier.verticalScroll(rememberScrollState())) {
-                ProviderParamFields(
-                    specs = specs,
-                    values = params,
-                    onChange = { params = it },
-                    // Chips: this is a form of its own rather than a row in a list of settings.
-                    choices = ChoiceStyle.Chips,
-                )
-            }
-        },
-        confirmButton = {
-            TextButton(onClick = { if (reloads) confirming = true else onSave(params) }) {
-                Text("Save")
-            }
-        },
-        dismissButton = { TextButton(onClick = onDismiss) { Text("Cancel") } },
-    )
-    if (confirming) {
-        RestartDialog(
-            title = "Unload ${model.label}?",
-            text =
-                "It is in memory now, and these are read when it is loaded. Saving takes it out " +
-                    "of memory; the sessions using it load it again with these settings on their " +
-                    "next message.",
-            onConfirm = {
-                confirming = false
-                onSave(params)
-            },
-            onDismiss = { confirming = false },
-        )
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/RawBlock.kt

@@ -1,12 +1,10 @@
 package com.example.aiapp
 
 import androidx.compose.foundation.background
-import androidx.compose.foundation.horizontalScroll
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.ColumnScope
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.rememberScrollState
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Modifier
@@ -20,14 +18,6 @@ import androidx.compose.ui.unit.dp
  * monospace text drawn hard against the edge of a tinted block reads as a clipping fault, and three
  * copies of "clip, fill, pad" drift apart the first time one is adjusted.
  *
- * **Nothing in here wraps; it scrolls sideways instead.** This is column-aligned far more often
- * than it is prose -- a diff, a table, a test run, a command and its arguments -- and wrapping
- * destroys exactly the alignment that was carrying the meaning, while turning one line into four
- * and a run of them into a wall. The scroll belongs to the block rather than to each line so that
- * the lines stay aligned with each other as it moves: one offset for the whole column is what makes
- * a shifted diff still read as a diff. Every [Text] inside is therefore drawn with `softWrap =
- * false`, which is the half of this a caller has to remember.
- *
  * The colour is [rawSurface], which is also what a code block inside a reply is given.
  */
 @Composable
@@ -39,10 +29,6 @@ fun RawBlock(modifier: Modifier = Modifier, content: @Composable ColumnScope.()
             // rectangle drawn at the same radius as the one behind it reads as a misprint.
             .clip(MaterialTheme.shapes.extraSmall)
             .background(rawSurface)
-            // Clipped and filled before this, so the tint is the viewport and does not scroll away
-            // from under the text; padded after it, so the inset travels with the content and the
-            // last column does not end flush against the edge.
-            .horizontalScroll(rememberScrollState())
             .padding(horizontal = 8.dp, vertical = 6.dp),
         content = content,
     )

app/androidApp/src/main/kotlin/com/example/aiapp/Reorder.kt

@@ -1,284 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.gestures.detectDragGestures
-import androidx.compose.foundation.gestures.scrollBy
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.size
-import androidx.compose.foundation.lazy.LazyListItemInfo
-import androidx.compose.foundation.lazy.LazyListState
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.State
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableFloatStateOf
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.rememberUpdatedState
-import androidx.compose.runtime.setValue
-import androidx.compose.runtime.withFrameNanos
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.hapticfeedback.HapticFeedback
-import androidx.compose.ui.hapticfeedback.HapticFeedbackType
-import androidx.compose.ui.input.pointer.pointerInput
-import androidx.compose.ui.platform.LocalDensity
-import androidx.compose.ui.platform.LocalHapticFeedback
-import androidx.compose.ui.semantics.contentDescription
-import androidx.compose.ui.semantics.semantics
-import androidx.compose.ui.unit.Density
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.unit.sp
-import kotlin.math.abs
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.launch
-
-/**
- * Dragging a row of a [androidx.compose.foundation.lazy.LazyColumn] into a different place in it.
- *
- * Generic rather than the session list's own, because "hold this and move it" is one gesture
- * wherever it appears and the arithmetic below is the whole of it. The list itself is left alone:
- * this reports a move and the caller decides what a move means -- it is the caller that holds the
- * rows and the caller that tells a server about the new order.
- *
- * The drag is on a [ReorderHandle] rather than on the row, which is what keeps it out of the way of
- * the scroll. A whole row that can be dragged sideways-ish is a row that sometimes eats a fling,
- * and a list is scrolled far more often than it is rearranged.
- */
-class Reorder
-internal constructor(
-    private val listState: LazyListState,
-    private val scope: CoroutineScope,
-    private val haptics: HapticFeedback,
-    /** What the [EDGE] band is in pixels here; a band in raw pixels is one screen's answer. */
-    private val density: Density,
-    /**
-     * The caller's own lists are what move; these are [State] so that the gesture, which outlives a
-     * recomposition, is never holding the first composition's copy of them.
-     */
-    private val onMove: State<(from: Int, to: Int) -> Unit>,
-    private val onSettled: State<() -> Unit>,
-) {
-    /** The key of the row in hand, or null when nothing is being dragged. */
-    var held by mutableStateOf<Any?>(null)
-        private set
-
-    /** Where the list had laid the row out when it was taken hold of, in viewport pixels. */
-    private var grabbedAt = 0
-
-    /** How far the finger has moved since, which is what the row is drawn following. */
-    private var dragged by mutableFloatStateOf(0f)
-
-    /** How far the list has scrolled under it since -- see [follow]. */
-    private var scrolled = 0f
-
-    /** The index the row has been moved to so far, which is what the next move counts from. */
-    private var at = 0
-
-    /** Where it started, so that a handle merely pressed is not reported as a rearrangement. */
-    private var from = 0
-
-    /**
-     * How much of the travel below the moves so far have accounted for.
-     *
-     * The travel is what decides a crossing, rather than where the row is drawn *now*: a lazy list
-     * animates an item into its new place, so for a few frames after a move `offset` still reports
-     * roughly the old one. Deciding from that offset re-decided the same crossing on every frame
-     * until the animation caught up, and a drag of two rows arrived six rows down.
-     */
-    private var settled = 0f
-
-    private fun info(key: Any): LazyListItemInfo? =
-        listState.layoutInfo.visibleItemsInfo.firstOrNull { it.key == key }
-
-    private fun itemAt(index: Int): LazyListItemInfo? =
-        listState.layoutInfo.visibleItemsInfo.firstOrNull { it.index == index }
-
-    /**
-     * How far from where the list laid it out this row should be drawn -- zero for every row but
-     * the one in hand.
-     *
-     * Measured against where the row is laid out *now* rather than accumulated, which is what makes
-     * it self-correcting: a move, or a scroll under the finger, puts the row somewhere new, and the
-     * same subtraction cancels that out so the row stays under the finger instead of jumping by its
-     * own height.
-     */
-    fun offsetOf(key: Any): Float {
-        if (key != held) return 0f
-        val now = info(key) ?: return 0f
-        return grabbedAt + dragged - now.offset
-    }
-
-    internal fun grab(key: Any) {
-        val from = info(key) ?: return
-        held = key
-        grabbedAt = from.offset
-        at = from.index
-        this.from = from.index
-        dragged = 0f
-        scrolled = 0f
-        settled = 0f
-        // The platform's "you have picked this up", the same feedback a long press gives, because
-        // the gesture it confirms is the same kind of commitment.
-        haptics.performHapticFeedback(HapticFeedbackType.LongPress)
-    }
-
-    internal fun drag(by: Float) {
-        if (held == null) return
-        dragged += by
-        cross()
-    }
-
-    /**
-     * Trades places with as many neighbours as the travel so far has earned.
-     *
-     * Half a neighbour's height each way, so the row changes place when it covers most of the one
-     * it is passing -- and a full height of hysteresis before it can come back, since the move has
-     * already paid that half in the other direction. A loop rather than one step: a fast drag, or a
-     * list scrolling under a parked finger, crosses several rows between two events.
-     */
-    private fun cross() {
-        while (true) {
-            val slack = dragged + scrolled - settled
-            val next = itemAt(if (slack > 0) at + 1 else at - 1) ?: return
-            if (abs(slack) < next.size / 2f) return
-            // Where the list is looking, taken before the move and put back after it. A lazy list
-            // keeps its place by the *key* of the item at the top, so moving that item takes the
-            // viewport with it -- drag the top row down two places and the list scrolls two rows
-            // to follow it, which reads as the row never having moved. The correction is by index,
-            // which is the thing that did not change.
-            val anchor = listState.firstVisibleItemIndex
-            val within = listState.firstVisibleItemScrollOffset
-            onMove.value(at, next.index)
-            // Requested rather than scrolled to: this has to take effect in the *same* measurement
-            // as the move, and a scroll launched beside it lands before the list has taken the new
-            // order and is then undone by it.
-            listState.requestScrollToItem(anchor, within)
-            settled += if (slack > 0) next.size.toFloat() else -next.size.toFloat()
-            at = next.index
-            // Loud on purpose: the row is under a finger that is covering it, so the tick is how
-            // the reader knows a place was taken rather than that they are still between two.
-            haptics.performHapticFeedback(HapticFeedbackType.SegmentTick)
-        }
-    }
-
-    internal fun release() {
-        // Only where the row actually went somewhere: a handle pressed and let go has rearranged
-        // nothing, and reporting one would have the server rewrite the order it already has.
-        val moved = held != null && at != from
-        held = null
-        dragged = 0f
-        scrolled = 0f
-        settled = 0f
-        if (moved) onSettled.value()
-    }
-
-    /**
-     * Scrolls the list while the row in hand is held against one end of it, so a row can be moved
-     * further than one screenful. A frame loop rather than a response to the drag, because a finger
-     * parked at the bottom edge sends no more events and is exactly the case this exists for.
-     */
-    internal fun follow() {
-        val key = held ?: return
-        scope.launch {
-            while (held == key) {
-                withFrameNanos {}
-                val moving = info(key) ?: continue
-                val viewport = listState.layoutInfo.viewportEndOffset
-                val edge = with(density) { EDGE.toPx() }
-                val top = grabbedAt + dragged
-                val bottom = top + moving.size
-                val step =
-                    when {
-                        top < edge -> -(edge - top).coerceAtMost(edge)
-                        bottom > viewport - edge -> (bottom - (viewport - edge)).coerceAtMost(edge)
-                        else -> 0f
-                    }
-                if (step == 0f) continue
-                // Counted as travel of its own: the finger has not moved, but the rows have moved
-                // under it, which is the same thing to everything above. Nothing is added to the
-                // drag, because where the row is *drawn* is measured against the list's own
-                // offsets and those have already moved.
-                scrolled += listState.scrollBy(step * SPEED)
-                cross()
-            }
-        }
-    }
-
-    private companion object {
-        /** How close to an end of the list a held row has to be before the list follows it. */
-        val EDGE = 36.dp
-
-        /** A fraction of the overshoot per frame, so the scroll eases in rather than lurching. */
-        const val SPEED = 0.12f
-    }
-}
-
-@Composable
-fun rememberReorder(
-    listState: LazyListState,
-    /** Two indices into the lazy list, which is the caller's own order to rearrange. */
-    onMove: (from: Int, to: Int) -> Unit,
-    /** The drag is over: the order on screen is the one to keep. */
-    onSettled: () -> Unit,
-): Reorder {
-    val move = rememberUpdatedState(onMove)
-    val settled = rememberUpdatedState(onSettled)
-    val haptics = LocalHapticFeedback.current
-    val density = LocalDensity.current
-    val scope = rememberCoroutineScope()
-    return remember(listState) { Reorder(listState, scope, haptics, density, move, settled) }
-}
-
-/**
- * The handle a row is dragged by: the burger, at about the size of a heading.
- *
- * Bigger than an icon beside a line of text -- this is what a row is taken hold of by, and at
- * [GLYPH_SIZE] it read as decoration on the end of the row. Not as big as the row either: a mark
- * scaled to the card's whole inner height came out heavier than anything else on screen, since
- * these rules thicken with the glyph.
- *
- * The touch square around it is [GLYPH_BUTTON_SIZE], the same as every other icon control here, so
- * the mark and the area that answers to a finger are two different sizes -- which is why the caller
- * subtracts [HANDLE_MARGIN] from the gap it wants: what has to line up with the text on the other
- * side is the mark, not the box around it.
- *
- * [key] is the row's own key in the list, which is how a gesture that started here finds the row it
- * belongs to -- an index would be stale the moment the first move landed.
- */
-@Composable
-fun ReorderHandle(state: Reorder, key: Any, modifier: Modifier = Modifier) {
-    Box(
-        contentAlignment = Alignment.Center,
-        modifier =
-            modifier
-                .size(GLYPH_BUTTON_SIZE)
-                // Nothing here draws a word, and a handle is the kind of control somebody using a
-                // screen reader has no other way to find.
-                .semantics { contentDescription = "Drag to reorder" }
-                .pointerInput(key) {
-                    detectDragGestures(
-                        onDragStart = {
-                            state.grab(key)
-                            state.follow()
-                        },
-                        onDrag = { _, amount -> state.drag(amount.y) },
-                        onDragEnd = { state.release() },
-                        onDragCancel = { state.release() },
-                    )
-                },
-    ) {
-        Glyph(DRAG_GLYPH, colour = MaterialTheme.colorScheme.onSurfaceVariant, size = HANDLE_MARK)
-    }
-}
-
-/** How big the mark itself is: a heading's size, which is what the font is asked for in `sp`. */
-private val HANDLE_MARK = 24.sp
-
-/**
- * How much of the touch square lies outside the mark on each side.
- *
- * A caller that wants the *mark* a given distance from something takes this off that distance --
- * see the rule about aligning the mark rather than the box it is centred in.
- */
-val HANDLE_MARGIN = (GLYPH_BUTTON_SIZE - HANDLE_MARK.value.dp) / 2

app/androidApp/src/main/kotlin/com/example/aiapp/ReplyFooter.kt

@@ -1,89 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.text.style.TextAlign
-import java.time.Instant
-import java.time.ZoneId
-import java.time.format.DateTimeFormatter
-import java.time.format.FormatStyle
-import java.util.Locale
-
-/**
- * The line under a finished reply: what it cost to produce, and when it was sent.
- *
- * Small and set back, in the tone the session's own subtitle takes: it is about the message rather
- * than part of it, and at the reply's own size it would read as the last thing the model said.
- *
- * Right-aligned because it closes the message rather than opening one -- a reader scanning down the
- * left edge is reading what was said, and this is where that ends.
- */
-@Composable
-fun ReplyFooter(
-    ts: Double,
-    tokensPerSecond: Double?,
-    prefillMs: Long?,
-    modifier: Modifier = Modifier,
-) {
-    val text = replyFooterText(ts, tokensPerSecond, prefillMs, ZoneId.systemDefault()) ?: return
-    Text(
-        text,
-        style = MaterialTheme.typography.labelSmall,
-        color = MaterialTheme.colorScheme.onSurfaceVariant,
-        textAlign = TextAlign.End,
-        modifier = modifier.fillMaxWidth(),
-    )
-}
-
-/**
- * What the footer says, or null when there is nothing to say: "read 9.5s · 50.3 tok/s · 3:00 PM".
- *
- * Split out so the wording is testable without a screen, and [zone] is a parameter for the same
- * reason [limitSummary] takes one: a test has to say the same thing wherever it runs.
- *
- * **The time is last, and so sits against the right edge whatever else is on the line.** The
- * measurements in front of it are the provider's, so a session on another provider has fewer of
- * them or none -- and a reader who has learned where the clock is should not have to find it again
- * because the model changed. The costs grow leftwards into the space instead.
- *
- * Those measurements are drawn only where the provider made them. Most do not -- a coding CLI
- * reports what a turn cost and never how long the model spent on it -- and the time this app
- * watched a reply arrive over is a different quantity: it counts the network, the pauses between
- * tokens and whatever else the machine was doing. So the line is the clock alone rather than a
- * plausible figure beside it.
- */
-fun replyFooterText(
-    ts: Double,
-    tokensPerSecond: Double?,
-    prefillMs: Long?,
-    zone: ZoneId,
-): String? {
-    val at =
-        if (ts <= 0.0) null
-        else
-            try {
-                DateTimeFormatter.ofLocalizedTime(FormatStyle.SHORT)
-                    .withZone(zone)
-                    .format(Instant.ofEpochMilli((ts * 1000).toLong()))
-            } catch (_: Exception) {
-                null
-            }
-    // A tenth up to three digits, where the difference between 18 and 18.4 tok/s is something a
-    // reader comparing two models can use; past that the tenth is noise on a figure that moves by
-    // more than that between turns.
-    val rate =
-        tokensPerSecond
-            ?.takeIf { it > 0.0 }
-            ?.let {
-                if (it >= 100) String.format(Locale.getDefault(), "%.0f tok/s", it)
-                else String.format(Locale.getDefault(), "%.1f tok/s", it)
-            }
-    // Named "read" rather than given a unit alone, because a second figure in seconds beside a
-    // rate is unreadable otherwise -- and it is the same word the status row uses while it is
-    // happening, so the wait and the figure for it are one vocabulary.
-    val read = prefillMs?.takeIf { it > 0 }?.let { "read ${formatMillis(it)}" }
-    return listOfNotNull(read, rate, at).joinToString(" · ").ifEmpty { null }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/RestartDialog.kt

@@ -1,35 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.material3.AlertDialog
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-
-/**
- * What a setting costs, asked before it is written.
- *
- * Every setting in this app whose consequence is worth saying says it here rather than in a
- * paragraph beside the control: a sentence under a switch is read after the decision if it is read
- * at all, and a form of a dozen settings each carrying its own explanation is mostly explanation. A
- * modal interrupts at the moment the consequence becomes real, and it is also a way out.
- *
- * What they have in common, and why it is one dialog rather than four: each of them ends something
- * that is running — a process, a loaded model, a server — and says what starting it again costs.
- */
-@Composable
-fun RestartDialog(
-    title: String,
-    text: String,
-    onConfirm: () -> Unit,
-    onDismiss: () -> Unit,
-    /** The word on the button, which is the action rather than a bare "OK". */
-    confirm: String = "Save",
-) {
-    AlertDialog(
-        onDismissRequest = onDismiss,
-        title = { Text(title) },
-        text = { Text(text) },
-        confirmButton = { TextButton(onClick = onConfirm) { Text(confirm) } },
-        dismissButton = { TextButton(onClick = onDismiss) { Text("Cancel") } },
-    )
-}

app/androidApp/src/main/kotlin/com/example/aiapp/SessionAlerts.kt

@@ -31,13 +31,13 @@ import androidx.lifecycle.compose.LocalLifecycleOwner
 import androidx.lifecycle.repeatOnLifecycle
 
 /**
- * A session wanting attention, said over the app as well as in Android's drawer.
+ * A session wanting attention, said over the app rather than through Android's drawer.
  *
- * Two places carry the same fact and they are doing different jobs: a row in the shade waits
- * however long it has to, which makes it the record, and a banner is read now or not at all, which
- * makes it the interruption. So somebody with the app open gets both -- this, and a silent row
- * behind it that is still there when they go looking and goes by itself when they open the session.
- * Whether the app is open at all is this collection and nothing else.
+ * Two places can carry the same fact and only one is right at a time. A row in the shade is for
+ * somebody looking at something else: it makes a sound, it waits however long it has to, and acting
+ * on it means leaving whatever they were doing. Somebody with this app open needs none of that. So
+ * while these are on screen the stream is delivered here instead, which is arranged by the
+ * collection below and nothing else.
  *
  * A banner can go three ways, each somebody deciding something different: tapped, which opens the
  * session; pushed off either side; or left alone, in which case it goes when the bar runs out.

app/androidApp/src/main/kotlin/com/example/aiapp/SessionImage.kt

@@ -5,32 +5,24 @@ import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.gestures.detectTransformGestures
-import androidx.compose.foundation.interaction.MutableInteractionSource
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.navigationBarsPadding
-import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
-import androidx.compose.material3.Button
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
-import androidx.compose.runtime.DisposableEffect
 import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.SideEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableFloatStateOf
-import androidx.compose.runtime.mutableIntStateOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
-import androidx.compose.ui.geometry.Offset
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.FilterQuality
 import androidx.compose.ui.graphics.ImageBitmap
@@ -38,20 +30,12 @@ import androidx.compose.ui.graphics.asImageBitmap
 import androidx.compose.ui.graphics.graphicsLayer
 import androidx.compose.ui.input.pointer.pointerInput
 import androidx.compose.ui.layout.ContentScale
-import androidx.compose.ui.layout.onSizeChanged
 import androidx.compose.ui.platform.LocalDensity
-import androidx.compose.ui.platform.LocalView
 import androidx.compose.ui.unit.Dp
-import androidx.compose.ui.unit.IntSize
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.isSpecified
 import androidx.compose.ui.window.Dialog
 import androidx.compose.ui.window.DialogProperties
-import androidx.compose.ui.window.DialogWindowProvider
-import androidx.core.view.ViewCompat
-import androidx.core.view.WindowCompat
-import androidx.core.view.WindowInsetsCompat
-import androidx.core.view.WindowInsetsControllerCompat
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 
@@ -156,23 +140,12 @@ fun SessionImageViewer(
     onClose: () -> Unit,
 ) {
     val (bitmap, failed) = rememberSessionBitmap(settings, sessionId, ref)
-    val view = LocalView.current
-    var hiddenBars by remember(ref) { mutableStateOf(ViewerBars()) }
-    var barInsets by remember(ref) { mutableStateOf(ViewerBarInsets()) }
     Dialog(
         onDismissRequest = onClose,
-        properties =
-            DialogProperties(usePlatformDefaultWidth = false, decorFitsSystemWindows = false),
+        properties = DialogProperties(usePlatformDefaultWidth = false),
     ) {
-        ViewerSystemBars(hiddenBars)
         Box(
-            Modifier.fillMaxSize()
-                .background(Color.Black)
-                .clickable(
-                    interactionSource = remember { MutableInteractionSource() },
-                    indication = null,
-                    onClick = onClose,
-                ),
+            Modifier.fillMaxSize().background(Color.Black).clickable(onClick = onClose),
             contentAlignment = Alignment.Center,
         ) {
             when (val image = bitmap) {
@@ -192,46 +165,7 @@ fun SessionImageViewer(
                         // beside it are.
                         CircularProgressIndicator(color = Color.White)
                     }
-                else -> {
-                    var viewport by remember { mutableStateOf(IntSize.Zero) }
-                    var nativeSizeRequest by remember { mutableIntStateOf(0) }
-                    ZoomableImage(
-                        image,
-                        nativeSizeRequest = nativeSizeRequest,
-                        onViewportChanged = {
-                            viewport = it
-                            ViewCompat.getRootWindowInsets(view)?.let { insets ->
-                                barInsets =
-                                    ViewerBarInsets(
-                                        status =
-                                            insets
-                                                .getInsetsIgnoringVisibility(
-                                                    WindowInsetsCompat.Type.statusBars()
-                                                )
-                                                .top,
-                                        navigation =
-                                            insets
-                                                .getInsetsIgnoringVisibility(
-                                                    WindowInsetsCompat.Type.navigationBars()
-                                                )
-                                                .bottom,
-                                    )
-                            }
-                        },
-                        onBarsChanged = { hiddenBars = it },
-                        barInsets = barInsets,
-                        viewport = viewport,
-                    )
-                    Button(
-                        onClick = { nativeSizeRequest++ },
-                        modifier =
-                            Modifier.align(Alignment.BottomEnd)
-                                .navigationBarsPadding()
-                                .padding(16.dp),
-                    ) {
-                        Text("100%")
-                    }
-                }
+                else -> ZoomableImage(image)
             }
         }
     }
@@ -291,72 +225,34 @@ private fun enlargingFilter(sourceHeight: Int, drawnHeight: Int): FilterQuality
  * The image on its own, as large as it fits, with pinch to zoom.
  *
  * Inside a dialog rather than a screen -- see [SessionImageViewer] -- so the platform's back
- * gesture returns to the transcript instead of leaving the app. It opens fitted, with the whole
- * image visible without enlarging a smaller one; the 100% control changes to one bitmap pixel per
- * screen pixel and recenters it.
+ * gesture returns to the transcript instead of leaving the app. It opens fitted, the whole image
+ * visible.
  */
 @Composable
-private fun ZoomableImage(
-    image: ImageBitmap,
-    nativeSizeRequest: Int,
-    onViewportChanged: (IntSize) -> Unit,
-    onBarsChanged: (ViewerBars) -> Unit,
-    barInsets: ViewerBarInsets,
-    viewport: IntSize,
-) {
+private fun ZoomableImage(image: ImageBitmap) {
     var scale by remember { mutableFloatStateOf(1f) }
     var offsetX by remember { mutableFloatStateOf(0f) }
     var offsetY by remember { mutableFloatStateOf(0f) }
-    val nativeScale = nativeScale(image.width, image.height, viewport.width, viewport.height)
-    LaunchedEffect(nativeSizeRequest, nativeScale) {
-        if (nativeSizeRequest > 0) {
-            scale = nativeScale
-            offsetX = 0f
-            offsetY = 0f
-        }
-    }
-    val bars =
-        viewerBars(
-            image.width,
-            image.height,
-            viewport.width,
-            viewport.height,
-            scale,
-            Offset(offsetX, offsetY),
-            barInsets,
-        )
-    SideEffect { onBarsChanged(bars) }
     Image(
         bitmap = image,
         contentDescription = "Attached image",
-        contentScale = ContentScale.Inside,
+        contentScale = ContentScale.Fit,
         // Zoomed in, the reader is looking at pixels on purpose.
         filterQuality = FilterQuality.None,
         modifier =
             Modifier.fillMaxSize()
-                .onSizeChanged(onViewportChanged)
-                .pointerInput(nativeScale) {
-                    detectTransformGestures { centroid, pan, zoom, _ ->
-                        val oldScale = scale
-                        val maximumScale = maxOf(8f, nativeScale)
-                        val newScale = (oldScale * zoom).coerceIn(1f, maximumScale)
-                        if (newScale > 1f) {
-                            val offset =
-                                zoomOffset(
-                                    Offset(offsetX, offsetY),
-                                    centroid,
-                                    pan,
-                                    oldScale,
-                                    newScale,
-                                    Offset(size.width / 2f, size.height / 2f),
-                                )
-                            offsetX = offset.x
-                            offsetY = offset.y
+                .pointerInput(Unit) {
+                    detectTransformGestures { _, pan, zoom, _ ->
+                        // Floor of 1 so the image cannot be pinched smaller than fitted, which is
+                        // already the whole of it; a ceiling so it cannot be lost off-screen.
+                        scale = (scale * zoom).coerceIn(1f, 8f)
+                        if (scale > 1f) {
+                            offsetX += pan.x
+                            offsetY += pan.y
                         } else {
                             offsetX = 0f
                             offsetY = 0f
                         }
-                        scale = newScale
                     }
                 }
                 .graphicsLayer {
@@ -367,104 +263,3 @@ private fun ZoomableImage(
                 },
     )
 }
-
-/** Lets the picture use the whole display, hiding only the system bars it actually reaches. */
-@Composable
-private fun ViewerSystemBars(hidden: ViewerBars) {
-    val view = LocalView.current
-    val window = (view.parent as? DialogWindowProvider)?.window
-    val controller = window?.let { WindowCompat.getInsetsController(it, view) }
-    SideEffect {
-        controller?.systemBarsBehavior =
-            WindowInsetsControllerCompat.BEHAVIOR_SHOW_TRANSIENT_BARS_BY_SWIPE
-        if (hidden.status) {
-            controller?.hide(WindowInsetsCompat.Type.statusBars())
-        } else {
-            controller?.show(WindowInsetsCompat.Type.statusBars())
-        }
-        if (hidden.navigation) {
-            controller?.hide(WindowInsetsCompat.Type.navigationBars())
-        } else {
-            controller?.show(WindowInsetsCompat.Type.navigationBars())
-        }
-    }
-    DisposableEffect(view) {
-        onDispose {
-            controller?.show(
-                WindowInsetsCompat.Type.statusBars() or WindowInsetsCompat.Type.navigationBars()
-            )
-        }
-    }
-}
-
-internal data class ViewerBars(val status: Boolean = false, val navigation: Boolean = false)
-
-internal data class ViewerBarInsets(val status: Int = 0, val navigation: Int = 0)
-
-/** Which full-screen system-bar regions the fitted, zoomed and panned image intersects. */
-internal fun viewerBars(
-    imageWidth: Int,
-    imageHeight: Int,
-    viewportWidth: Int,
-    viewportHeight: Int,
-    scale: Float,
-    offset: Offset,
-    insets: ViewerBarInsets,
-): ViewerBars {
-    if (imageWidth <= 0 || imageHeight <= 0 || viewportWidth <= 0 || viewportHeight <= 0) {
-        return ViewerBars()
-    }
-    val fittedScale = insideScale(imageWidth, imageHeight, viewportWidth, viewportHeight)
-    val width = imageWidth * fittedScale * scale
-    val height = imageHeight * fittedScale * scale
-    val left = viewportWidth / 2f + offset.x - width / 2f
-    val right = left + width
-    val top = viewportHeight / 2f + offset.y - height / 2f
-    val bottom = top + height
-    val crossesScreen = right > 0f && left < viewportWidth
-    return ViewerBars(
-        status = crossesScreen && insets.status > 0 && bottom > 0f && top < insets.status,
-        navigation =
-            crossesScreen &&
-                insets.navigation > 0 &&
-                bottom > viewportHeight - insets.navigation &&
-                top < viewportHeight,
-    )
-}
-
-/** Scale relative to [ContentScale.Inside] at which bitmap and screen pixels are one-to-one. */
-internal fun nativeScale(
-    imageWidth: Int,
-    imageHeight: Int,
-    viewportWidth: Int,
-    viewportHeight: Int,
-): Float {
-    if (imageWidth <= 0 || imageHeight <= 0 || viewportWidth <= 0 || viewportHeight <= 0) return 1f
-    return 1f / insideScale(imageWidth, imageHeight, viewportWidth, viewportHeight)
-}
-
-/** The downscale-only factor used by [ContentScale.Inside]. */
-private fun insideScale(
-    imageWidth: Int,
-    imageHeight: Int,
-    viewportWidth: Int,
-    viewportHeight: Int,
-): Float =
-    minOf(
-        1f,
-        viewportWidth.toFloat() / imageWidth,
-        viewportHeight.toFloat() / imageHeight,
-    )
-
-/** Keeps the image point beneath [centroid] beneath the fingers as its scale changes. */
-internal fun zoomOffset(
-    offset: Offset,
-    centroid: Offset,
-    pan: Offset,
-    oldScale: Float,
-    newScale: Float,
-    viewportCenter: Offset,
-): Offset {
-    val scaleChange = newScale / oldScale
-    return offset * scaleChange + (centroid - viewportCenter) * (1f - scaleChange) + pan
-}

app/androidApp/src/main/kotlin/com/example/aiapp/SessionListScreen.kt

@@ -1,11 +1,9 @@
 package com.example.aiapp
 
-import androidx.activity.compose.BackHandler
 import androidx.compose.foundation.ExperimentalFoundationApi
 import androidx.compose.foundation.combinedClickable
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.PaddingValues
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxSize
@@ -14,15 +12,11 @@ import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.foundation.lazy.rememberLazyListState
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.Card
-import androidx.compose.material3.CardDefaults
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.FloatingActionButton
-import androidx.compose.material3.LinearProgressIndicator
 import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Surface
 import androidx.compose.material3.Switch
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
@@ -35,30 +29,14 @@ import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.alpha
-import androidx.compose.ui.graphics.graphicsLayer
-import androidx.compose.ui.layout.onSizeChanged
 import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.platform.LocalDensity
 import androidx.compose.ui.unit.dp
-import androidx.compose.ui.zIndex
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 
 /**
- * The sessions tab: every session, in the order the reader has put them in.
- *
- * Nothing here sorts. The order is the server's `sessions` list and the reader's own -- see
- * [reorderSessions] -- which is the one arrangement a row cannot be moved out of by something the
- * session does. It replaced sorting by activity, and then sorting by when each agent was turned on:
- * both meant a list that rearranged itself under whoever was reading it, and the status word and
- * its colour already say which session wants something without the row having to move to say it.
- *
- * Holding a row puts the screen in selection mode, the same gesture and the same bottom bar as the
- * import tab, so the two lists are learned once. Rearranging is deliberately *not* part of a
- * selection -- the handle moves the row it is on, whether or not that row is picked out -- because
- * "which rows am I acting on" and "where does this one go" are two questions.
+ * The sessions tab: sessions awaiting an answer sort to the top, which is the "your turn" inbox.
  *
  * No title and no Back of its own -- [MainScreen] owns the header and the tab that names this one.
  * What stays here is the button that adds a session, because that acts on this list and nothing
@@ -70,23 +48,10 @@ fun SessionListScreen(
     reloadToken: Int,
     onOpen: (SessionSummary) -> Unit,
     onSpawn: () -> Unit,
-    /** A session this list has just deleted, for whoever is showing it elsewhere. */
-    onDeleted: (String) -> Unit = {},
 ) {
     val scope = rememberCoroutineScope()
     var listState by remember { mutableStateOf<LoadState<List<SessionSummary>>>(LoadState.Loading) }
-
-    // Which rows the reader has picked out. Empty means selection mode is off, as on the import
-    // tab: a selection mode with nothing in it has no controls and no way out but Back.
-    var selected by remember { mutableStateOf<Set<String>>(emptySet()) }
-
-    // The sessions a delete has been confirmed for, or none. A list rather than one session,
-    // because a selection is what the bar below acts on.
-    var confirmingDelete by remember { mutableStateOf<List<SessionSummary>>(emptyList()) }
-
-    // Whether an answer is outstanding, which is a different question from whether there is
-    // anything to draw: see [refresh].
-    var reloading by remember { mutableStateOf(false) }
+    var confirmingDelete by remember { mutableStateOf<SessionSummary?>(null) }
 
     // Failures that belong to one session rather than to the list, keyed by its id and shown on its
     // own card. The two scopes are decided by whether the server answered: it answered and refused,
@@ -95,10 +60,6 @@ fun SessionListScreen(
     // Cleared on the next successful load below -- an entry outlives its session otherwise.
     var deleteErrors by remember { mutableStateOf<Map<String, String>>(emptyMap()) }
 
-    // Why the order on screen is not the order that was saved, when saving one failed. The list is
-    // what failed, so it is reported over the list rather than on any row.
-    var orderError by remember { mutableStateOf<String?>(null) }
-
     // Which sessions have a delete in flight. A set of ids rather than a flag on the row, because
     // the rows are rebuilt from whatever the server last said and this belongs to the request.
     var deleting by remember { mutableStateOf<Set<String>>(emptySet()) }
@@ -109,142 +70,31 @@ fun SessionListScreen(
     val transcriptCache = remember(settings) { TranscriptCache(cacheRoot(context, settings)) }
 
     fun refresh() {
-        // The rows stay while the answer is on its way, with the bar below saying one is: this
-        // list is asked again every time the panel over a session is opened, and blanking it each
-        // time hands the reader an empty screen to report on something that was never in doubt.
-        // A first load has nothing to keep, and says so with the spinner instead.
-        if (listState !is LoadState.Loaded) listState = LoadState.Loading
-        reloading = true
+        listState = LoadState.Loading
         scope.launch {
             listState =
                 try {
                     val loaded =
                         withContext(Dispatchers.IO) { LoadState.Loaded(fetchSessions(settings)) }
                     deleteErrors = emptyMap()
-                    val alive = loaded.value.map { it.id }.toSet()
-                    // A selection is of sessions, so one deleted somewhere else leaves it. Only
-                    // that one: the other rows the reader picked out are still there.
-                    selected = selected.intersect(alive)
                     // The path out for a cached transcript whose session was deleted somewhere
                     // else. This list is the only place that ever learns the full set. On the
                     // answer rather than in `finally`: a list that failed to arrive says nothing
                     // about which sessions exist.
-                    withContext(Dispatchers.IO) { transcriptCache.retainOnly(alive) }
+                    withContext(Dispatchers.IO) {
+                        transcriptCache.retainOnly(loaded.value.map { it.id }.toSet())
+                    }
                     loaded
                 } catch (e: ApiException) {
                     LoadState.failed(e)
                 }
-            reloading = false
-        }
-    }
-
-    /**
-     * Deletes every session in [targets], one after another.
-     *
-     * One at a time and in the order they are drawn: the server has no batch delete for sessions,
-     * and each one ends a process. Each row says what is happening to it from the moment the work
-     * is handed over, which is also when the selection goes -- a bar still naming sessions being
-     * deleted is a set nobody can act on.
-     */
-    fun deleteChosen(targets: List<SessionSummary>, alsoDeleteForeign: Boolean) {
-        selected = emptySet()
-        // Marked here rather than after the request returns: a row has to say something is
-        // happening to it from the moment it is asked for.
-        deleting = deleting + targets.map { it.id }
-        deleteErrors = deleteErrors - targets.map { it.id }.toSet()
-        scope.launch {
-            for (session in targets) {
-                try {
-                    withContext(Dispatchers.IO) {
-                        deleteSession(settings, session.id, alsoDeleteForeign)
-                        // After it succeeded, not before: a refused delete leaves the session
-                        // exactly as it was, and its transcript with it.
-                        transcriptCache.session(TranscriptAddress(session.id)).purge()
-                    }
-                    // Only this row, and only what changed. Refetching the list instead put every
-                    // other session back through loading and handed the reader an empty screen, to
-                    // report on something never in doubt.
-                    val loaded = listState
-                    if (loaded is LoadState.Loaded) {
-                        listState = LoadState.Loaded(loaded.value.filterNot { it.id == session.id })
-                    }
-                    onDeleted(session.id)
-                } catch (e: ApiException) {
-                    // Kept, because it is still there: the server refused, so the session it
-                    // refused about is exactly as it was.
-                    deleteErrors = deleteErrors + (session.id to (e.message ?: "Delete failed"))
-                } finally {
-                    deleting = deleting - session.id
-                }
-            }
         }
     }
 
     LaunchedEffect(reloadToken) { refresh() }
 
-    val rows = rememberLazyListState()
-    val reorder =
-        rememberReorder(
-            listState = rows,
-            onMove = { from, to ->
-                // Moved here and now, because the row is under a finger: waiting for the server to
-                // agree would drag the handle away from the card it is on. What the server thinks
-                // is asked for when the finger comes up, and a refusal puts the list back.
-                val loaded = listState
-                if (loaded is LoadState.Loaded) {
-                    val moved = loaded.value.toMutableList()
-                    moved.add(to, moved.removeAt(from))
-                    listState = LoadState.Loaded(moved)
-                }
-            },
-            onSettled = {
-                val loaded = listState
-                if (loaded is LoadState.Loaded) {
-                    val order = loaded.value.map { it.id }
-                    scope.launch {
-                        try {
-                            withContext(Dispatchers.IO) { reorderSessions(settings, order) }
-                            orderError = null
-                        } catch (e: ApiException) {
-                            orderError = e.message ?: "The new order couldn't be saved"
-                            // The screen must not go on showing an arrangement nothing kept, so
-                            // the server's own order comes back -- which is also the only way to
-                            // see what it does think.
-                            refresh()
-                        }
-                    }
-                }
-            },
-        )
-
-    // Back leaves selection mode rather than the tab, which is the level it is one step above.
-    // Nested inside MainScreen's own handler, so it wins while there is a selection.
-    BackHandler(enabled = selected.isNotEmpty()) { selected = emptySet() }
-
-    // Measured rather than assumed: the list reserves exactly what the bar covers, so the last row
-    // can still be scrolled to while it is up.
-    var barHeight by remember { mutableStateOf(0.dp) }
-    val density = LocalDensity.current
-    // What the bar covers *now*: its measurement is kept while it is away, but nothing is
-    // reserved for a bar that is not up.
-    val covered = if (selected.isEmpty()) 0.dp else barHeight
-
-    // The spawn button floats over the list, so the list ends above it -- measured, for the
-    // reason the bar is. Without this the last row sat under the button, which was survivable
-    // while every part of a row did the same thing and is not now that corner is a handle.
-    var buttonHeight by remember { mutableStateOf(0.dp) }
-
     Box(Modifier.fillMaxSize()) {
         Column(Modifier.fillMaxSize().padding(16.dp)) {
-            orderError?.let { message ->
-                // The server's own words, unprefixed, the way every other failure is shown.
-                Text(
-                    message,
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.error,
-                )
-                Spacer(Modifier.height(8.dp))
-            }
             when (val state = listState) {
                 is LoadState.Loading -> CircularProgressIndicator()
                 // The message as Api.kt wrote it, with nothing added: it is already a whole
@@ -263,32 +113,20 @@ fun SessionListScreen(
                             color = MaterialTheme.colorScheme.onSurfaceVariant,
                         )
                     }
-                    LazyColumn(
-                        state = rows,
-                        contentPadding =
-                            PaddingValues(bottom = covered + buttonHeight + BUTTON_RING * 2),
-                    ) {
-                        uniqueItems(state.value, key = { it.id }) { session ->
+                    // Awaiting-answer first (the point of the screen), then most recently active.
+                    val ordered =
+                        state.value.sortedWith(
+                            compareByDescending<SessionSummary> { it.status == "awaitingInput" }
+                                .thenByDescending { it.lastActivity }
+                        )
+                    LazyColumn {
+                        uniqueItems(ordered, key = { it.id }) { session ->
                             SessionCard(
                                 session = session,
                                 error = deleteErrors[session.id],
                                 deleting = session.id in deleting,
-                                picked = session.id in selected,
-                                // The handle is a selection-mode control, so it is absent rather
-                                // than disabled outside one: this is not a capability being
-                                // withheld, it is a mode the list is not in.
-                                reorder = reorder.takeIf { selected.isNotEmpty() },
-                                onClick = {
-                                    // In selection mode a tap is a selection, so the reader is
-                                    // never one mis-tap away from opening a session they were only
-                                    // picking rows for.
-                                    if (selected.isEmpty()) onOpen(session)
-                                    else
-                                        selected =
-                                            if (session.id in selected) selected - session.id
-                                            else selected + session.id
-                                },
-                                onLongPress = { selected = selected + session.id },
+                                onOpen = { onOpen(session) },
+                                onLongPress = { confirmingDelete = session },
                             )
                             Spacer(Modifier.height(12.dp))
                         }
@@ -297,114 +135,70 @@ fun SessionListScreen(
             }
         }
 
-        // Over the list rather than above it: a bar that appears in the flow moves every row down
-        // by its own height at the moment the reader is looking at them.
-        if (reloading) {
-            LinearProgressIndicator(Modifier.align(Alignment.TopCenter).fillMaxWidth())
-        }
-
-        // Beside nothing in particular, because a selection is not one row: the options that act on
-        // it belong to the screen, and the bottom is where a thumb already is.
-        if (selected.isNotEmpty()) {
-            val picked =
-                (listState as? LoadState.Loaded)?.value?.filter { it.id in selected }.orEmpty()
-            SessionSelectionBar(
-                count = picked.size,
-                modifier =
-                    Modifier.align(Alignment.BottomCenter).onSizeChanged {
-                        barHeight = with(density) { it.height.toDp() }
-                    },
-                onDelete = { confirmingDelete = picked },
-            )
-        }
-
-        // Above the bar when there is one, by what that bar measured: the button stays rather than
-        // coming and going, since an absent control cannot say whether there was nothing to do.
         FloatingActionButton(
             onClick = onSpawn,
-            modifier =
-                Modifier.align(Alignment.BottomEnd)
-                    .padding(end = BUTTON_RING, bottom = BUTTON_RING + covered)
-                    .onSizeChanged { buttonHeight = with(density) { it.height.toDp() } },
+            modifier = Modifier.align(Alignment.BottomEnd).padding(24.dp),
         ) {
             Text("+", style = MaterialTheme.typography.headlineMedium)
         }
     }
 
-    val targets = confirmingDelete
-    if (targets.isNotEmpty()) {
-        // Reset per selection, so a toggle turned on for one set of conversations is not still
-        // on for the next. Off to begin with: see [deleteSession].
-        var alsoDeleteForeign by remember(targets) { mutableStateOf(false) }
-        // Whichever of these keep a transcript of their own decide what the sentences below say,
-        // and whether the switch is offered at all. Old servers reported only the capability, when
-        // Claude Code was its sole owner.
-        val owned = targets.filter { it.keepsOwnTranscript }
-        val transcriptOwner = owned.firstOrNull()?.ownTranscriptName ?: "Claude Code"
+    confirmingDelete?.let { session ->
+        // Reset per session, so a toggle turned on for one conversation is not still on for the
+        // next. Off to begin with: see [deleteSession].
+        var alsoDeleteForeign by remember(session.id) { mutableStateOf(false) }
         AlertDialog(
-            onDismissRequest = { confirmingDelete = emptyList() },
-            title = {
-                Text(
-                    if (targets.size == 1) "Delete \"${targets.first().title}\"?"
-                    else "Delete ${targets.size} sessions?"
-                )
-            },
+            onDismissRequest = { confirmingDelete = null },
+            title = { Text("Delete \"${session.title}\"?") },
             text = {
                 // Two different acts behind one button, so it says which one this is. What
-                // separates them is whether the *driver* keeps its own record of the
-                // conversation
-                // -- the coding CLIs do, whether this app spawned the session or imported it;
+                // separates them is whether the *driver* keeps its own record of the conversation
+                // -- the Claude Code CLI does, whether this app spawned the session or imported it;
                 // echo and llama.cpp do not.
                 //
                 // This used to branch on `imported`, above a comment asserting that "a session
-                // started here has no copy anywhere". That was false for every coding-CLI session
+                // started here has no copy anywhere". That was false for every claude-cli session
                 // this app spawned, and getting it wrong in that direction is the expensive one:
-                // "this can't be undone", said of something that can, spends the credibility that
+                // "this can't be undone", said of something that can, spends the credibility the
                 // sentence needs.
                 //
-                // Neither branch promises a restore. The recoverable one says what is known,
-                // that the driver keeps its own record, rather than that the file is still there,
-                // and it names what goes either way, because this app's transcript holds images,
-                // peer messages and commands the CLI's own record never had.
-                //
-                // A selection takes the sentence that covers all of it: "some of these" is what
-                // makes the mixed case true without either half of it being read as a promise
-                // about every row.
+                // Neither branch promises a restore. The recoverable one says what is known -- the
+                // driver keeps its own record -- rather than that the file is still there, and it
+                // names what goes either way, because this app's transcript holds images, peer
+                // messages and commands the CLI's own record never had.
                 Column {
                     Text(
                         when {
-                            owned.isEmpty() ->
+                            !session.keepsOwnTranscript ->
                                 "Kills the process and deletes the conversation. Nothing else " +
                                     "keeps a copy, so this can't be undone."
-                            // The sentence below is the one the toggle makes false, which is
-                            // why it is written twice rather than appended to: "should still be
-                            // there to import again", left on screen beside a switch that removes
-                            // it, is the reassurance being read as it stops being true.
+                            // The sentence below is the one the toggle makes false, which is why it
+                            // is written twice rather than appended to: leaving "should still be
+                            // there to import again" on screen beside a switch that removes it is
+                            // the reassurance being read at the moment it stops being true.
                             alsoDeleteForeign ->
                                 "Kills the process and deletes both copies of the conversation: " +
-                                    "this app's, and $transcriptOwner's own transcript on the " +
+                                    "this app's, and Claude Code's own transcript on the " +
                                     "machine. Nothing keeps another, so this can't be undone."
                             else ->
                                 "Stops the process and deletes this app's copy of the " +
                                     "conversation, including any images, peer messages and " +
-                                    "commands recorded only here. $transcriptOwner keeps its own " +
-                                    "transcript on the machine" +
-                                    (if (owned.size < targets.size) " for some of these" else "") +
-                                    ", so the conversation itself should still be there to " +
-                                    "import again."
+                                    "commands recorded only here. Claude Code keeps its own " +
+                                    "transcript on the machine, so the conversation itself " +
+                                    "should still be there to import again."
                         }
                     )
                     // Only where there is a second copy to decide about. Absent rather than
                     // disabled, because this is not a capability being withheld: for echo and
                     // llama.cpp there is no other transcript, and a switch offering to delete one
                     // would be asking about something that does not exist.
-                    if (owned.isNotEmpty()) {
+                    if (session.keepsOwnTranscript) {
                         Spacer(Modifier.height(16.dp))
-                        // Its own row rather than beside the paragraph: a switch is taller
-                        // than a line of text and re-centres whatever shares a row with it.
+                        // Its own row rather than beside the paragraph: a switch is taller than a
+                        // line of text and re-centres whatever shares a row with it.
                         Row(verticalAlignment = Alignment.CenterVertically) {
                             Text(
-                                "Delete $transcriptOwner's transcript too",
+                                "Delete Claude Code's transcript too",
                                 style = MaterialTheme.typography.bodyMedium,
                                 modifier = Modifier.weight(1f),
                             )
@@ -420,8 +214,38 @@ fun SessionListScreen(
             confirmButton = {
                 TextButton(
                     onClick = {
-                        confirmingDelete = emptyList()
-                        deleteChosen(targets, alsoDeleteForeign)
+                        confirmingDelete = null
+                        // Marked here rather than after the request returns: the row has to say
+                        // something is happening to it from the moment it is asked for.
+                        deleting = deleting + session.id
+                        deleteErrors = deleteErrors - session.id
+                        scope.launch {
+                            try {
+                                withContext(Dispatchers.IO) {
+                                    deleteSession(settings, session.id, alsoDeleteForeign)
+                                    // After it succeeded, not before: a refused delete leaves the
+                                    // session exactly as it was, and its transcript with it.
+                                    transcriptCache.session(session.id).purge()
+                                }
+                                // Only this row, and only what changed. Refetching the list instead
+                                // put every other session back through loading and handed the
+                                // reader an empty screen, to report on something never in doubt.
+                                val loaded = listState
+                                if (loaded is LoadState.Loaded) {
+                                    listState =
+                                        LoadState.Loaded(
+                                            loaded.value.filterNot { it.id == session.id }
+                                        )
+                                }
+                            } catch (e: ApiException) {
+                                // Kept, because it is still there: the server refused, so the
+                                // session it refused about is exactly as it was.
+                                deleteErrors =
+                                    deleteErrors + (session.id to (e.message ?: "Delete failed"))
+                            } finally {
+                                deleting = deleting - session.id
+                            }
+                        }
                     }
                 ) {
                     // Coloured by consequence: this takes something away, and does so wherever it
@@ -430,54 +254,12 @@ fun SessionListScreen(
                 }
             },
             dismissButton = {
-                TextButton(onClick = { confirmingDelete = emptyList() }) { Text("Cancel") }
+                TextButton(onClick = { confirmingDelete = null }) { Text("Cancel") }
             },
         )
     }
 }
 
-/**
- * The ring of space inside a session's card, which is also what its handle leaves around itself.
- */
-private val CARD_PADDING = 16.dp
-
-/** The gap the spawn button keeps from the edges it floats over, and from the list above it. */
-private val BUTTON_RING = 24.dp
-
-/**
- * What can be done to the sessions that are selected.
- *
- * Delete only, for now, which is the one thing this screen has ever done to a session from the list
- * rather than from inside it. The same bar as the import tab's, down to the wording of the count.
- */
-@Composable
-private fun SessionSelectionBar(
-    count: Int,
-    modifier: Modifier = Modifier,
-    onDelete: () -> Unit,
-) {
-    Surface(
-        modifier = modifier.fillMaxWidth(),
-        color = MaterialTheme.colorScheme.surfaceContainerHigh,
-        tonalElevation = 3.dp,
-    ) {
-        Row(
-            verticalAlignment = Alignment.CenterVertically,
-            modifier = Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 8.dp),
-        ) {
-            Text(
-                "$count selected",
-                style = MaterialTheme.typography.bodyMedium,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                modifier = Modifier.weight(1f),
-            )
-            TextButton(onClick = onDelete) {
-                Text("Delete", color = MaterialTheme.colorScheme.error)
-            }
-        }
-    }
-}
-
 @OptIn(ExperimentalFoundationApi::class)
 @Composable
 private fun SessionCard(
@@ -492,53 +274,22 @@ private fun SessionCard(
      * about a request that has not been answered yet.
      */
     deleting: Boolean,
-    /** Whether this row is one of the selection the bottom bar acts on. */
-    picked: Boolean,
-    /** The drag this row can be moved by, or null where the list is not in selection mode. */
-    reorder: Reorder?,
-    onClick: () -> Unit,
+    onOpen: () -> Unit,
     onLongPress: () -> Unit,
 ) {
-    val held = reorder?.held == session.id
     BusyItem(label = if (deleting) "deleting" else null) {
         Card(
-            colors =
-                if (picked)
-                    CardDefaults.cardColors(
-                        containerColor = MaterialTheme.colorScheme.secondaryContainer,
-                        contentColor = MaterialTheme.colorScheme.onSecondaryContainer,
-                    )
-                else CardDefaults.cardColors(),
-            // Lifted while it is in hand, which is the one cue that says this row is being carried
-            // rather than sitting where it belongs.
-            elevation = CardDefaults.cardElevation(defaultElevation = if (held) 8.dp else 0.dp),
-            modifier =
+            // Off while the delete is in flight: a card that still opens a session it is deleting
+            // is a race the reader can start by tapping. On the card rather than in [BusyItem],
+            // which leaves gestures alone so the list still scrolls.
             Modifier.fillMaxWidth()
-                    // Drawn where the finger has taken it, above the rows it is passing over. Both
-                    // in the layer rather than in the layout, so nothing around it moves and the
-                    // list does not remeasure per frame of a drag.
-                    .zIndex(if (held) 1f else 0f)
-                    .graphicsLayer { translationY = reorder?.offsetOf(session.id) ?: 0f },
-        ) {
-            Row(verticalAlignment = Alignment.CenterVertically) {
-                Column(
-                    // Everything but the handle, which is what makes the two gestures separate
-                    // rather than competing: a press that lands on the handle never reaches this,
-                    // so holding it cannot select the row it is about to move. The card had the
-                    // click while the handle was the only thing inside it that did not want one,
-                    // and a hold on the handle then both selected the row and ate the drag.
-                    //
-                    // Off while the delete is in flight: a card that still opens a session it is
-                    // deleting is a race the reader can start by tapping. Here rather than in
-                    // [BusyItem], which leaves gestures alone so the list still scrolls.
-                    Modifier.weight(1f)
                 .combinedClickable(
                     enabled = !deleting,
-                            onClick = onClick,
+                    onClick = onOpen,
                     onLongClick = onLongPress,
                 )
-                        .padding(CARD_PADDING)
         ) {
+            Column(Modifier.padding(16.dp)) {
                 Row(
                     verticalAlignment = Alignment.CenterVertically,
                     modifier = Modifier.fillMaxWidth(),
@@ -549,23 +300,15 @@ private fun SessionCard(
                         modifier = Modifier.weight(1f),
                     )
                     StatusText(session.status)
-                        if (session.backgroundTasks > 0) {
-                            Text(
-                                backgroundTaskLabel(session.backgroundTasks),
-                                style = MaterialTheme.typography.labelLarge,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                                modifier = Modifier.padding(start = 8.dp),
-                            )
-                        }
                 }
                 Spacer(Modifier.height(4.dp))
                 Row(modifier = Modifier.fillMaxWidth()) {
                     Text(
-                            // Machine, then what runs on it, then what it is set to: the same order
-                            // and separator as the session screen's header and the usage dialog, so
-                            // one pair of facts is not written three ways.
+                        // Machine, then what runs on it, then what it is set to: the same order and
+                        // separator as the session screen's header and the usage dialog, so one
+                        // pair of facts is not written three ways.
                         listOfNotNull(
-                                    session.machineName,
+                                session.setupName,
                                 session.provider,
                                 session.model?.let { modelLabel(it) },
                             )
@@ -590,31 +333,24 @@ private fun SessionCard(
                     )
                 }
             }
-                // Inside the card, so what it moves is the thing it is drawn on. Nothing is held
-                // open for it outside selection mode: the row is then the row it always was.
-                if (reorder != null) {
-                    ReorderHandle(
-                        reorder,
-                        session.id,
-                        // Dimmed with the rest of the row while something is happening to it, since
-                        // a row on its way out is not one to rearrange -- see [BusyItem], whose
-                        // appearance this matches rather than repeating its dimming rule.
-                        // The mark lines up with the text on the other side of the card,
-                        // which means taking the square it is centred in off the gap: see
-                        // [HANDLE_MARGIN].
-                        Modifier.alpha(if (deleting) 0.4f else 1f)
-                            .padding(end = CARD_PADDING - HANDLE_MARGIN),
-                    )
-                }
-            }
         }
     }
 }
 
 @Composable
 fun StatusText(status: String) {
-    val label = sessionStatusWord(status)
-    val color = sessionStatusColour(status)
+    val (label, color) =
+        when (status) {
+            "awaitingInput" -> "your turn" to awaitingColor
+            "running" -> "running" to runningColor
+            "compacting" -> "compacting" to commandColor
+            "exited" -> "exited" to MaterialTheme.colorScheme.onSurfaceVariant
+            // Said in words, because it differs in kind from the others rather than in degree: the
+            // session is not idle and has not exited, nobody has been able to find out which. A
+            // muted colour alone would read as one of the quiet states.
+            "unknown" -> "can't tell" to MaterialTheme.colorScheme.onSurfaceVariant
+            else -> status to MaterialTheme.colorScheme.onSurfaceVariant
+        }
     Row(verticalAlignment = Alignment.CenterVertically) {
         if (sessionWorking(status)) {
             // The same colour as the word beside it: the two are one signal, and a spinner in the

app/androidApp/src/main/kotlin/com/example/aiapp/SessionSettingsDialog.kt

@@ -0,0 +1,331 @@
+package com.example.aiapp
+
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.text.KeyboardActions
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Switch
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.text.input.ImeAction
+import androidx.compose.ui.unit.dp
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+/**
+ * What can be changed about one session, as opposed to about this app.
+ *
+ * Over the session rather than a step down from it: everything here is about the conversation
+ * behind it, and a dialog keeps that conversation on screen while it is being adjusted. It was a
+ * screen of its own until 2026-08-30, which put a page transition and a back stack around two
+ * controls and hid the thing they act on.
+ *
+ * The model and the permission mode are deliberately still on the session's own bar, because those
+ * are changed *while* reading a turn -- "not this model, try that one".
+ *
+ * Captions are for what a control costs rather than for what it is. A paragraph under every control
+ * made the dialog longer than the conversation it covers -- so Notifications has none, while Move
+ * and Reload do, because what those two take away is not visible from here.
+ */
+@Composable
+fun SessionSettingsDialog(
+    settings: ServerSettings,
+    sessionId: String,
+    /**
+     * What the session is called now, as the screen behind this knows it -- see the rename below.
+     */
+    title: String,
+    onRenamed: (String) -> Unit,
+    /**
+     * What this phone is holding of the conversation, or null while that is being measured -- see
+     * the Reload row below, which is what would discard it.
+     */
+    cachedBytes: Long?,
+    onReload: () -> Unit,
+    onDismiss: () -> Unit,
+    /**
+     * Copies what this session costs to draw. Built by the session screen, because everything it
+     * measures is that screen's own state.
+     */
+    onCopyRenderReport: () -> Unit,
+) {
+    val scope = rememberCoroutineScope()
+    var name by remember(sessionId) { mutableStateOf(title) }
+    var saving by remember { mutableStateOf(false) }
+    var error by remember { mutableStateOf<String?>(null) }
+    // Null until the server has been asked. The row this dialog was opened over is a snapshot of
+    // whenever the list was last fetched, so drawing the switch straight from it would show a
+    // position that may have been changed since. Until the answer arrives the switch is disabled
+    // and a spinner sits beside it, which is what not knowing looks like.
+    var notify by remember(sessionId) { mutableStateOf<Boolean?>(null) }
+    var notifyError by remember { mutableStateOf<String?>(null) }
+    // Where the session works. Null until the server has been asked, for the same reason the switch
+    // above is. An empty answer is a session that was never given a directory, which is not the
+    // same as one whose directory is unknown -- the field is only enabled once one of those is
+    // settled.
+    var cwd by remember(sessionId) { mutableStateOf<String?>(null) }
+    var typedCwd by remember(sessionId) { mutableStateOf("") }
+    var cwdError by remember { mutableStateOf<String?>(null) }
+    var movingCwd by remember { mutableStateOf(false) }
+
+    LaunchedEffect(sessionId) {
+        try {
+            val fresh = withContext(Dispatchers.IO) { fetchSession(settings, sessionId) }
+            notify = fresh.notify
+            cwd = fresh.cwd.orEmpty()
+            typedCwd = fresh.cwd.orEmpty()
+        } catch (e: ApiException) {
+            // Left unknown rather than falling back to the stale row: the switch stays disabled,
+            // instead of offering a position nothing confirmed.
+            notifyError = e.message
+            notify = null
+        }
+    }
+
+    /**
+     * Moves the session, which ends the process that is in the old directory.
+     *
+     * Said plainly beside the field rather than confirmed in a second dialog: what it costs is a
+     * process, and a stopped session is a state this app already has a word and a button for.
+     */
+    fun moveCwd() {
+        val chosen = typedCwd.trim()
+        if (movingCwd || chosen.isEmpty() || chosen == cwd) return
+        movingCwd = true
+        cwdError = null
+        scope.launch {
+            try {
+                withContext(Dispatchers.IO) { setSessionCwd(settings, sessionId, chosen) }
+                cwd = chosen
+            } catch (e: ApiException) {
+                // Where it happened: this field is the only thing on screen that knows a move was
+                // asked for, and the reason is usually the path itself.
+                cwdError = e.message
+            } finally {
+                movingCwd = false
+            }
+        }
+    }
+
+    // Moved optimistically so the switch answers the finger that moved it, and put back if the
+    // request is refused -- a switch that waits for a round trip reads as broken on a slow tunnel,
+    // and one that stays moved after a refusal lies.
+    fun setNotify(wanted: Boolean) {
+        val was = notify
+        notify = wanted
+        notifyError = null
+        scope.launch {
+            try {
+                withContext(Dispatchers.IO) { setSessionNotify(settings, sessionId, wanted) }
+            } catch (e: ApiException) {
+                notify = was
+                notifyError = e.message
+            }
+        }
+    }
+
+    // Nothing to do when the name has not changed, so the button says so rather than sending a
+    // request whose success would look exactly like the failure of having typed nothing.
+    val changed = name.trim().isNotEmpty() && name.trim() != title
+
+    fun save() {
+        if (!changed || saving) return
+        val chosen = name.trim()
+        saving = true
+        error = null
+        scope.launch {
+            try {
+                withContext(Dispatchers.IO) { renameSession(settings, sessionId, chosen) }
+                onRenamed(chosen)
+            } catch (e: ApiException) {
+                // Reported here, where it happened, because this dialog is the only place that
+                // knows a rename was attempted.
+                error = e.message
+                saving = false
+            }
+        }
+    }
+
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        title = { Text("Session settings") },
+        text = {
+            Column {
+                OutlinedTextField(
+                    value = name,
+                    onValueChange = { name = it },
+                    label = { Text("Name") },
+                    singleLine = true,
+                    enabled = !saving,
+                    modifier = Modifier.fillMaxWidth(),
+                    // The keyboard's own action does what the button does: a one-field form where
+                    // the return key does nothing is a form people press return at anyway.
+                    keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
+                    keyboardActions = KeyboardActions(onDone = { save() }),
+                )
+                Spacer(Modifier.height(8.dp))
+                Row(
+                    verticalAlignment = Alignment.CenterVertically,
+                    modifier = Modifier.fillMaxWidth(),
+                ) {
+                    Glyph(BELL_GLYPH, colour = MaterialTheme.colorScheme.onSurface)
+                    Spacer(Modifier.width(8.dp))
+                    Text("Notifications", modifier = Modifier.weight(1f))
+                    if (notify == null && notifyError == null) {
+                        CircularProgressIndicator(
+                            modifier = Modifier.width(16.dp).height(16.dp),
+                            strokeWidth = 2.dp,
+                        )
+                        Spacer(Modifier.width(8.dp))
+                    }
+                    Switch(
+                        checked = notify == true,
+                        onCheckedChange = { setNotify(it) },
+                        enabled = notify != null,
+                    )
+                }
+                // Beside the switch that failed, not with the rename's error: they are two requests
+                // and a reader has to be able to tell which one the server refused.
+                notifyError?.let {
+                    Text(
+                        it,
+                        color = MaterialTheme.colorScheme.error,
+                        style = MaterialTheme.typography.bodySmall,
+                    )
+                }
+                Spacer(Modifier.height(8.dp))
+                Row(
+                    verticalAlignment = Alignment.CenterVertically,
+                    modifier = Modifier.fillMaxWidth(),
+                ) {
+                    OutlinedTextField(
+                        value = typedCwd,
+                        onValueChange = { typedCwd = it },
+                        label = { Text("Working directory") },
+                        // What the field cannot say by being empty: a session that was never given
+                        // one starts wherever its launcher does, and this names that rather than
+                        // showing a path nobody chose.
+                        placeholder = { Text("wherever the session was started") },
+                        singleLine = true,
+                        enabled = cwd != null && !movingCwd,
+                        modifier = Modifier.weight(1f),
+                        keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
+                        keyboardActions = KeyboardActions(onDone = { moveCwd() }),
+                    )
+                    TextButton(
+                        onClick = { moveCwd() },
+                        enabled =
+                            cwd != null &&
+                                !movingCwd &&
+                                typedCwd.trim().isNotEmpty() &&
+                                typedCwd.trim() != cwd,
+                    ) {
+                        Text(if (movingCwd) "Moving..." else "Move")
+                    }
+                }
+                // The whole of what pressing Move does, where it is about to be pressed. A
+                // directory is settled when the process is spawned, so it is ended and the next
+                // thing said to the session starts it in the new place.
+                Text(
+                    "Moving stops the session's process. It starts again in the new directory " +
+                        "with the next message, or with Start.",
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+                cwdError?.let {
+                    Text(
+                        it,
+                        color = MaterialTheme.colorScheme.error,
+                        style = MaterialTheme.typography.bodySmall,
+                    )
+                }
+                Spacer(Modifier.height(8.dp))
+                Row(
+                    verticalAlignment = Alignment.CenterVertically,
+                    modifier = Modifier.fillMaxWidth(),
+                ) {
+                    Text("Transcript", modifier = Modifier.weight(1f))
+                    // The size is what the button discards, and the unknown state is drawn rather
+                    // than guessed: a spinner while the directory is being measured, and words when
+                    // there is nothing there, because "nothing cached" and "0 B" read as different
+                    // claims.
+                    when {
+                        cachedBytes == null ->
+                            CircularProgressIndicator(
+                                modifier = Modifier.width(16.dp).height(16.dp),
+                                strokeWidth = 2.dp,
+                            )
+                        else ->
+                            Text(
+                                humanSize(cachedBytes)?.let { "$it cached" } ?: "nothing cached",
+                                style = MaterialTheme.typography.bodySmall,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                            )
+                    }
+                    Spacer(Modifier.width(12.dp))
+                    // Enabled whether or not anything is cached: "what I see disagrees with the
+                    // machine" is a state an empty cache can be in too, and a control that comes
+                    // and goes makes its own presence the signal.
+                    TextButton(onClick = onReload) { Text("Reload") }
+                }
+                // Captioned, unlike the controls above it, for the same reason Move is: what it
+                // costs is not visible, and neither is the case it exists for.
+                Text(
+                    "Reload throws away this phone's copy and fetches the transcript from the " +
+                        "server again. Use it when what is shown here disagrees with the file " +
+                        "on the machine.",
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+                error?.let {
+                    Spacer(Modifier.height(8.dp))
+                    Text(
+                        it,
+                        color = MaterialTheme.colorScheme.error,
+                        style = MaterialTheme.typography.bodySmall,
+                    )
+                }
+                Spacer(Modifier.height(8.dp))
+                // About this session, which is what everything in here is -- and it was on the
+                // header until 2026-09-03, where the folder button now is. It copies rather than
+                // opening anything, so it says so and then says it happened: a row that looks like
+                // a control and gives no sign of having run is one people press twice.
+                Row(
+                    verticalAlignment = Alignment.CenterVertically,
+                    modifier = Modifier.fillMaxWidth(),
+                ) {
+                    Glyph(SPEED_GLYPH, colour = MaterialTheme.colorScheme.onSurface)
+                    Spacer(Modifier.width(8.dp))
+                    Text("Render timings", modifier = Modifier.weight(1f))
+                    TextButton(onClick = onCopyRenderReport) { Text("Copy") }
+                }
+            }
+        },
+        // Disabled rather than absent while there is nothing to save: a button that comes and goes
+        // makes its own presence the signal, and its absence cannot say why.
+        confirmButton = {
+            TextButton(onClick = { save() }, enabled = changed && !saving) {
+                Text(if (saving) "Saving..." else "Save")
+            }
+        },
+        dismissButton = { TextButton(onClick = onDismiss) { Text("Close") } },
+    )
+}

app/androidApp/src/main/kotlin/com/example/aiapp/SessionSettingsScreen.kt

@@ -1,685 +0,0 @@
-package com.example.aiapp
-
-import androidx.activity.compose.BackHandler
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.imePadding
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.width
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.text.KeyboardActions
-import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Surface
-import androidx.compose.material3.Switch
-import androidx.compose.material3.Tab
-import androidx.compose.material3.TabRow
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableIntStateOf
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.text.input.ImeAction
-import androidx.compose.ui.unit.dp
-import java.time.Instant
-import java.time.ZoneId
-import java.time.format.DateTimeFormatter
-import java.time.format.FormatStyle
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-/**
- * What can be changed about one session, and about the provider serving it.
- *
- * A screen rather than a dialog, again, and for the reason the dialog was chosen in the first place
- * turned around: it has outgrown one. A Material dialog constrains its own height and scrolls
- * inside itself, so a form of a dozen settings is read through a letterbox that also covers the
- * conversation it is about -- and there is nowhere in it to put a second tab. Drawn over the
- * session rather than as a `Screen` of its own, so the session under it stays composed and its
- * stream keeps flowing; the back gesture closes it.
- *
- * **Two tabs, and the second is not a copy.** It is [ProviderScreen] -- the same composable the
- * machines tab opens, for this session's machine and provider. A session's settings and its
- * provider's are different things with different owners (one rides on a request, one decides how a
- * model is loaded for everybody), and this is the second way in rather than a second version of
- * them.
- *
- * The model and the permission mode are on the session's own bar as well, because those are changed
- * *while* reading a turn -- "not this model, try that one". They are here too because that bar is
- * one row shared with three actions: a long model name leaves the other picker a few pixels wide,
- * and this is where somebody goes looking for a setting anyway.
- *
- * Captions are for what a control costs rather than for what it is. A paragraph under every control
- * made the dialog longer than the conversation it covers -- so Notifications has none, while Move
- * and Reload do, because what those two take away is not visible from here.
- */
-@Composable
-fun SessionSettingsScreen(
-    settings: ServerSettings,
-    sessionId: String,
-    /** Which machine and provider the second tab is about. */
-    machineId: String,
-    provider: String,
-    /**
-     * What the session is called now, as the screen behind this knows it -- see the rename below.
-     */
-    title: String,
-    onRenamed: (String) -> Unit,
-    /**
-     * How hard the model thinks, or null for the CLI's own default.
-     *
-     * Owned by the screen behind this rather than held here, like [title]: this dialog is what
-     * changes it, and a level kept only for as long as the dialog is open is the old one again the
-     * next time it is opened.
-     *
-     * Not fetched, because unlike the notification switch there is nothing else that changes it:
-     * the level is this app's to set and the server does not resolve it into something else.
-     */
-    effort: String?,
-    onEffortChanged: (String?) -> Unit,
-    /** Whether a level does anything here; the row is left out entirely where it does not. */
-    takesEffort: Boolean,
-    /**
-     * The settings that are one of a list -- the model and the permission mode.
-     *
-     * Owned by the screen behind this, like [title] and [effort]: it is what asked the machine what
-     * the provider offers. Whichever of them this one has no answer for is not in the list, and
-     * draws no row.
-     */
-    choices: List<SessionChoice>,
-    /**
-     * The settings this session's provider takes, and what they are set to.
-     *
-     * Declared by the server rather than listed here -- see [ProviderParamFields]. Empty for a
-     * provider with none, which draws no section at all.
-     */
-    paramSpecs: List<ParamSpec>,
-    params: Map<String, String>,
-    onParamsChanged: (Map<String, String>) -> Unit,
-    /**
-     * What this phone is holding of the conversation, or null while that is being measured -- see
-     * the Reload row below, which is what would discard it.
-     */
-    cachedBytes: Long?,
-    /**
-     * How big the record on the server is, or null where it did not say. The other half of the pair
-     * beside it: what the conversation costs there, against what this phone is holding of it.
-     */
-    transcriptBytes: Long?,
-    onReload: () -> Unit,
-    /**
-     * Opens the transcript file itself in the explorer. Null from a server that does not say where
-     * it is, which draws no button rather than one that cannot work.
-     */
-    onViewRaw: (() -> Unit)?,
-    onDismiss: () -> Unit,
-    /**
-     * Copies what this session costs to draw. Built by the session screen, because everything it
-     * measures is that screen's own state.
-     */
-    onCopyRenderReport: () -> Unit,
-) {
-    val scope = rememberCoroutineScope()
-    var name by remember(sessionId) { mutableStateOf(title) }
-    var effortError by remember { mutableStateOf<String?>(null) }
-    var saving by remember { mutableStateOf(false) }
-    var error by remember { mutableStateOf<String?>(null) }
-    // Null until the server has been asked. The row this dialog was opened over is a snapshot of
-    // whenever the list was last fetched, so drawing the switch straight from it would show a
-    // position that may have been changed since. Until the answer arrives the switch is disabled
-    // and a spinner sits beside it, which is what not knowing looks like.
-    var notify by remember(sessionId) { mutableStateOf<Boolean?>(null) }
-    var notifyError by remember { mutableStateOf<String?>(null) }
-    // The same three-state shape the notification switch has, for the same reason: until the
-    // server has answered, the switch is disabled rather than showing a position nothing confirmed.
-    var autoResume by remember(sessionId) { mutableStateOf<Boolean?>(null) }
-    var resumeMessage by remember(sessionId) { mutableStateOf(DEFAULT_RESUME_MESSAGE) }
-    // When the server next intends to ask whether the limit has lifted, or null when nothing is
-    // waiting. Read once with everything else: it moves on the server's schedule, not this
-    // screen's, and a figure that redrew itself here would be this app re-measuring what it was
-    // told.
-    var resumeAt by remember(sessionId) { mutableStateOf<Double?>(null) }
-    var resumeError by remember { mutableStateOf<String?>(null) }
-    // Where the session works. Null until the server has been asked, for the same reason the switch
-    // above is. An empty answer is a session that was never given a directory, which is not the
-    // same as one whose directory is unknown -- the field is only enabled once one of those is
-    // settled.
-    var cwd by remember(sessionId) { mutableStateOf<String?>(null) }
-    var typedCwd by remember(sessionId) { mutableStateOf("") }
-    var cwdError by remember { mutableStateOf<String?>(null) }
-    var movingCwd by remember { mutableStateOf(false) }
-    // The two settings on this screen that end the session's process, held while the reader is
-    // asked whether that is what they meant. Null is nobody being asked.
-    var askedCwd by remember(sessionId) { mutableStateOf<String?>(null) }
-    var askedEffort by remember(sessionId) { mutableStateOf<String?>(null) }
-
-    LaunchedEffect(sessionId) {
-        try {
-            val fresh = withContext(Dispatchers.IO) { fetchSession(settings, sessionId) }
-            notify = fresh.notify
-            autoResume = fresh.autoResume
-            resumeMessage = fresh.autoResumeMessage
-            resumeAt = fresh.resumeAt
-            cwd = fresh.cwd.orEmpty()
-            typedCwd = fresh.cwd.orEmpty()
-        } catch (e: ApiException) {
-            // Left unknown rather than falling back to the stale row: the switch stays disabled,
-            // instead of offering a position nothing confirmed.
-            notifyError = e.message
-            notify = null
-            resumeError = e.message
-            autoResume = null
-        }
-    }
-
-    /**
-     * Moves the session, which ends the process that is in the old directory.
-     *
-     * Only ever reached through [RestartDialog], which is where what it costs is said -- see
-     * `askToMove`.
-     */
-    fun askToMove() {
-        val chosen = typedCwd.trim()
-        if (movingCwd || chosen.isEmpty() || chosen == cwd) return
-        askedCwd = chosen
-    }
-
-    fun moveCwd() {
-        val chosen = typedCwd.trim()
-        if (movingCwd || chosen.isEmpty() || chosen == cwd) return
-        movingCwd = true
-        cwdError = null
-        scope.launch {
-            try {
-                withContext(Dispatchers.IO) { setSessionCwd(settings, sessionId, chosen) }
-                cwd = chosen
-            } catch (e: ApiException) {
-                // Where it happened: this field is the only thing on screen that knows a move was
-                // asked for, and the reason is usually the path itself.
-                cwdError = e.message
-            } finally {
-                movingCwd = false
-            }
-        }
-    }
-
-    /**
-     * Chooses a thinking level, which ends the process the old level was launched with. Asked for
-     * first, the same way a move is.
-     *
-     * Put back if the request is refused, for the reason the notification switch below gives: a
-     * control that stays where it was put after a refusal is stating something untrue.
-     */
-    fun setEffort(chosen: String?) {
-        val was = effort
-        onEffortChanged(chosen)
-        effortError = null
-        scope.launch {
-            try {
-                withContext(Dispatchers.IO) { setSessionEffort(settings, sessionId, chosen) }
-            } catch (e: ApiException) {
-                onEffortChanged(was)
-                effortError = e.message
-            }
-        }
-    }
-
-    // Moved optimistically so the switch answers the finger that moved it, and put back if the
-    // request is refused -- a switch that waits for a round trip reads as broken on a slow tunnel,
-    // and one that stays moved after a refusal lies.
-    fun setNotify(wanted: Boolean) {
-        val was = notify
-        notify = wanted
-        notifyError = null
-        scope.launch {
-            try {
-                withContext(Dispatchers.IO) { setSessionNotify(settings, sessionId, wanted) }
-            } catch (e: ApiException) {
-                notify = was
-                notifyError = e.message
-            }
-        }
-    }
-
-    /**
-     * Turns auto-resume on or off, or changes what it would say.
-     *
-     * One request for both, because the server takes one: switching it on and typing the message
-     * are two halves of the same decision, and sending them separately would leave a moment where
-     * the session is armed with the old words.
-     *
-     * Put back if refused, like the notification switch. Turning it off also clears what was
-     * scheduled -- said here rather than only on the server, or the row would go on naming a time
-     * that no longer exists.
-     */
-    fun setAutoResume(on: Boolean, message: String) {
-        val wasOn = autoResume
-        val wasMessage = resumeMessage
-        val wasAt = resumeAt
-        autoResume = on
-        resumeMessage = message
-        if (!on) resumeAt = null
-        resumeError = null
-        scope.launch {
-            try {
-                withContext(Dispatchers.IO) {
-                    setSessionAutoResume(settings, sessionId, on, message)
-                }
-            } catch (e: ApiException) {
-                autoResume = wasOn
-                resumeMessage = wasMessage
-                resumeAt = wasAt
-                resumeError = e.message
-            }
-        }
-    }
-
-    // Nothing to do when the name has not changed, so the button says so rather than sending a
-    // request whose success would look exactly like the failure of having typed nothing.
-    val changed = name.trim().isNotEmpty() && name.trim() != title
-
-    fun save() {
-        if (!changed || saving) return
-        val chosen = name.trim()
-        saving = true
-        error = null
-        scope.launch {
-            try {
-                withContext(Dispatchers.IO) { renameSession(settings, sessionId, chosen) }
-                onRenamed(chosen)
-            } catch (e: ApiException) {
-                // Reported here, where it happened, because this dialog is the only place that
-                // knows a rename was attempted.
-                error = e.message
-                saving = false
-            }
-        }
-    }
-
-    // The platform's own way back out of a layer: without it, back falls through to whatever is
-    // under this and closes the session -- which reads as a crash to somebody who meant to return
-    // to what they were reading.
-    BackHandler(onBack = onDismiss)
-    var tab by remember(sessionId) { mutableIntStateOf(0) }
-    Surface(Modifier.fillMaxSize()) {
-        // The keyboard covers the lower half of a form of fields, and this is a screen rather
-        // than a dialog now -- nothing else is going to move it out of the way.
-        Column(Modifier.fillMaxSize().imePadding()) {
-            Row(
-                verticalAlignment = Alignment.CenterVertically,
-                modifier = Modifier.fillMaxWidth().padding(horizontal = 16.dp),
-            ) {
-                GlyphButton(BACK_GLYPH, "Back", onDismiss)
-                Spacer(Modifier.width(GLYPH_BUTTON_MARGIN))
-                Text(
-                    "Settings",
-                    style = MaterialTheme.typography.titleMedium,
-                    modifier = Modifier.weight(1f),
-                )
-                // Disabled rather than absent while there is nothing to save: a button that comes
-                // and goes makes its own presence the signal, and its absence cannot say why.
-                TextButton(onClick = { save() }, enabled = changed && !saving) {
-                    Text(if (saving) "Saving..." else "Save")
-                }
-            }
-            // The same two-tab shape the main screen uses for its three, so a reader who has
-            // learned one has learned the other.
-            TabRow(selectedTabIndex = tab) {
-                Tab(selected = tab == 0, onClick = { tab = 0 }, text = { Text("Session") })
-                Tab(selected = tab == 1, onClick = { tab = 1 }, text = { Text(provider) })
-            }
-            if (tab == 1) {
-                // The machines tab's own screen, with its back control left off: this one has a
-                // header of its own, and two ways out stacked above each other is a reader asking
-                // which of them goes where.
-                ProviderScreen(
-                    settings = settings,
-                    machineId = machineId,
-                    provider = provider,
-                    onBack = null,
-                )
-                return@Column
-            }
-            Column(
-                Modifier.verticalScroll(rememberScrollState())
-                    .padding(horizontal = 16.dp)
-                    .padding(top = 12.dp, bottom = 16.dp)
-            ) {
-                LabelledField(
-                    label = "Name",
-                    value = name,
-                    onValueChange = { name = it },
-                    enabled = !saving,
-                    keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
-                    // The keyboard's own action does what the button does: a one-field form where
-                    // the return key does nothing is a form people press return at anyway.
-                    keyboardActions = KeyboardActions(onDone = { save() }),
-                )
-                Spacer(Modifier.height(8.dp))
-                Row(
-                    verticalAlignment = Alignment.CenterVertically,
-                    modifier = Modifier.fillMaxWidth(),
-                ) {
-                    Glyph(BELL_GLYPH, colour = MaterialTheme.colorScheme.onSurface)
-                    Spacer(Modifier.width(8.dp))
-                    Text("Notifications", modifier = Modifier.weight(1f))
-                    if (notify == null && notifyError == null) {
-                        CircularProgressIndicator(
-                            modifier = Modifier.width(16.dp).height(16.dp),
-                            strokeWidth = 2.dp,
-                        )
-                        Spacer(Modifier.width(8.dp))
-                    }
-                    Switch(
-                        checked = notify == true,
-                        onCheckedChange = { setNotify(it) },
-                        enabled = notify != null,
-                    )
-                }
-                // Beside the switch that failed, not with the rename's error: they are two requests
-                // and a reader has to be able to tell which one the server refused.
-                notifyError?.let {
-                    Text(
-                        it,
-                        color = MaterialTheme.colorScheme.error,
-                        style = MaterialTheme.typography.bodySmall,
-                    )
-                }
-                Spacer(Modifier.height(8.dp))
-                Row(
-                    verticalAlignment = Alignment.CenterVertically,
-                    modifier = Modifier.fillMaxWidth(),
-                ) {
-                    Text("Resume after a usage limit", modifier = Modifier.weight(1f))
-                    if (autoResume == null && resumeError == null) {
-                        CircularProgressIndicator(
-                            modifier = Modifier.width(16.dp).height(16.dp),
-                            strokeWidth = 2.dp,
-                        )
-                        Spacer(Modifier.width(8.dp))
-                    }
-                    Switch(
-                        checked = autoResume == true,
-                        onCheckedChange = { setAutoResume(it, resumeMessage) },
-                        enabled = autoResume != null,
-                    )
-                }
-                // Disabled rather than hidden while the switch is off: a field that comes and goes
-                // makes its own presence the signal, and a visible one teaches what the switch will
-                // do. Committed on the keyboard's Done rather than on every keystroke, so typing a
-                // sentence is one request instead of one per letter.
-                LabelledField(
-                    label = "Message to send",
-                    value = resumeMessage,
-                    onValueChange = { resumeMessage = it },
-                    // What an empty field means: the server's own word rather than a session
-                    // poked with nothing to read.
-                    hint = DEFAULT_RESUME_MESSAGE,
-                    enabled = autoResume == true,
-                    keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
-                    keyboardActions =
-                        KeyboardActions(onDone = { setAutoResume(true, resumeMessage) }),
-                )
-                // Only where something is actually waiting. Absent is not a state worth a row: a
-                // session that has not hit a limit has nothing scheduled, which the reader can see
-                // from the switch.
-                resumeAt?.let { at ->
-                    Text(
-                        "Waiting now -- next check ${formatCheckTime(at)}.",
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-                resumeError?.let {
-                    Text(
-                        it,
-                        color = MaterialTheme.colorScheme.error,
-                        style = MaterialTheme.typography.bodySmall,
-                    )
-                }
-                Spacer(Modifier.height(8.dp))
-                // The button sits at the bottom of the row rather than centred on it: the field
-                // beside it is a label above a box, and a control centred against the pair lands
-                // beside the label rather than beside the thing it acts on.
-                Row(
-                    verticalAlignment = Alignment.Bottom,
-                    modifier = Modifier.fillMaxWidth(),
-                ) {
-                    LabelledField(
-                        label = "Working directory",
-                        value = typedCwd,
-                        onValueChange = { typedCwd = it },
-                        // What the field cannot say by being empty: a session that was never
-                        // given one starts wherever its launcher does.
-                        hint = "wherever the session was started",
-                        enabled = cwd != null && !movingCwd,
-                        keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
-                        keyboardActions = KeyboardActions(onDone = { askToMove() }),
-                        modifier = Modifier.weight(1f),
-                    )
-                    TextButton(
-                        onClick = { askToMove() },
-                        enabled =
-                            cwd != null &&
-                                !movingCwd &&
-                                typedCwd.trim().isNotEmpty() &&
-                                typedCwd.trim() != cwd,
-                    ) {
-                        Text(if (movingCwd) "Moving..." else "Move")
-                    }
-                }
-                cwdError?.let {
-                    Text(
-                        it,
-                        color = MaterialTheme.colorScheme.error,
-                        style = MaterialTheme.typography.bodySmall,
-                    )
-                }
-                choices.forEach { choice ->
-                    Spacer(Modifier.height(8.dp))
-                    PickerRow(choice.label, choice.current, choice.options, choice.onPick)
-                }
-                // Left out rather than disabled, the one place this dialog does that: a disabled
-                // control teaches what the thing can do, and a llama session cannot do this at all
-                // -- the row would be teaching something false about it.
-                if (takesEffort) {
-                    Spacer(Modifier.height(8.dp))
-                    PickerRow(
-                        "Thinking",
-                        effort ?: DEFAULT_EFFORT,
-                        // The level the CLI picks for itself is in the list as well as in the
-                        // button, so leaving a level is not a one-way trip -- the same correction
-                        // the model picker carries.
-                        listOf(DEFAULT_EFFORT) + EFFORT_LEVELS,
-                    ) { chosen ->
-                        askedEffort = chosen
-                    }
-                    effortError?.let {
-                        Text(
-                            it,
-                            color = MaterialTheme.colorScheme.error,
-                            style = MaterialTheme.typography.bodySmall,
-                        )
-                    }
-                }
-                if (paramSpecs.isNotEmpty()) {
-                    Spacer(Modifier.height(16.dp))
-                    Text(
-                        "Model settings",
-                        style = MaterialTheme.typography.titleSmall,
-                    )
-                    Spacer(Modifier.height(8.dp))
-                    // Edited here and saved by the screen behind this, which is what makes
-                    // typing in a text field affordable: the save is debounced, and a dialog
-                    // dismissed mid-edit would take an unsaved value with it.
-                    ProviderParamFields(
-                        specs = paramSpecs,
-                        values = params,
-                        onChange = onParamsChanged,
-                        // The same picker the model and permission rows above use: how hard a
-                        // session thinks is one kind of setting, whichever provider declares it.
-                        choices = ChoiceStyle.Picker,
-                    )
-                }
-                Spacer(Modifier.height(8.dp))
-                Row(
-                    verticalAlignment = Alignment.CenterVertically,
-                    modifier = Modifier.fillMaxWidth(),
-                ) {
-                    Text("Transcript", modifier = Modifier.weight(1f))
-                    // What the conversation costs on the server, and then what Reload would
-                    // discard here -- one line, so the two sizes read as a pair. A server that
-                    // did not measure its file leaves its half out rather than saying zero.
-                    val onServer = transcriptBytes?.let { humanSize(it) ?: "0 B" }
-                    // The unknown state is drawn rather than guessed: a spinner while the cache
-                    // is being measured, and words when there is nothing in it, because "nothing
-                    // cached" and "0 B" read as different claims.
-                    when {
-                        cachedBytes == null -> {
-                            onServer?.let {
-                                Text(
-                                    it,
-                                    style = MaterialTheme.typography.bodySmall,
-                                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                                )
-                                Spacer(Modifier.width(8.dp))
-                            }
-                            CircularProgressIndicator(
-                                modifier = Modifier.width(16.dp).height(16.dp),
-                                strokeWidth = 2.dp,
-                            )
-                        }
-                        else -> {
-                            val cached =
-                                humanSize(cachedBytes)?.let { "$it cached" } ?: "nothing cached"
-                            Text(
-                                onServer?.let { "$it · $cached" } ?: cached,
-                                style = MaterialTheme.typography.bodySmall,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                            )
-                        }
-                    }
-                }
-                // Both on a line of their own under what they act on, rather than crowded against
-                // the size on the line above: two buttons and a measurement do not fit the width
-                // of a phone, and the one that would lose is the number.
-                Row(
-                    horizontalArrangement = Arrangement.End,
-                    verticalAlignment = Alignment.CenterVertically,
-                    modifier = Modifier.fillMaxWidth(),
-                ) {
-                    // The record as it is on disk, for the question the drawn conversation cannot
-                    // answer -- which is most of what anybody opens this dialog to debug.
-                    onViewRaw?.let { TextButton(onClick = it) { Text("View raw") } }
-                    Spacer(Modifier.width(8.dp))
-                    // Enabled whether or not anything is cached: "what I see disagrees with the
-                    // machine" is a state an empty cache can be in too, and a control that comes
-                    // and goes makes its own presence the signal.
-                    TextButton(onClick = onReload) { Text("Reload") }
-                }
-                error?.let {
-                    Spacer(Modifier.height(8.dp))
-                    Text(
-                        it,
-                        color = MaterialTheme.colorScheme.error,
-                        style = MaterialTheme.typography.bodySmall,
-                    )
-                }
-                Spacer(Modifier.height(8.dp))
-                // About this session, which is what everything in here is -- and it was on the
-                // header until 2026-09-03, where the folder button now is. It copies rather than
-                // opening anything, so it says so and then says it happened: a row that looks like
-                // a control and gives no sign of having run is one people press twice.
-                Row(
-                    verticalAlignment = Alignment.CenterVertically,
-                    modifier = Modifier.fillMaxWidth(),
-                ) {
-                    Glyph(SPEED_GLYPH, colour = MaterialTheme.colorScheme.onSurface)
-                    Spacer(Modifier.width(8.dp))
-                    Text("Render timings", modifier = Modifier.weight(1f))
-                    TextButton(onClick = onCopyRenderReport) { Text("Copy") }
-                }
-            }
-        }
-    }
-
-    // A directory is settled when the process is spawned, so moving means ending it. Said here
-    // rather than under the field, which is the rule the whole screen follows -- see
-    // [RestartDialog].
-    askedCwd?.let { chosen ->
-        RestartDialog(
-            title = "Move to $chosen?",
-            text =
-                "This stops the session's process. It starts again in the new directory with " +
-                    "the next message, or with Start.",
-            confirm = "Move",
-            onConfirm = {
-                askedCwd = null
-                moveCwd()
-            },
-            onDismiss = { askedCwd = null },
-        )
-    }
-    // The same cost for the same reason: the CLI reads the level when it launches, and has no
-    // control request for changing one.
-    askedEffort?.let { chosen ->
-        RestartDialog(
-            title = "Think $chosen?",
-            text =
-                "This stops the session's process. It starts again with the next message, or " +
-                    "with Start.",
-            confirm = "Change",
-            onConfirm = {
-                askedEffort = null
-                setEffort(chosen.takeIf { it != DEFAULT_EFFORT })
-            },
-            onDismiss = { askedEffort = null },
-        )
-    }
-}
-
-/**
- * One session setting that is a choice from a list, as this dialog draws it.
- *
- * A shape rather than a pair of parameters each, because a provider may offer either of them, both
- * or neither, and they are otherwise the same control.
- */
-data class SessionChoice(
-    val label: String,
-    val current: String,
-    val options: List<String>,
-    val onPick: (String) -> Unit,
-)
-
-/**
- * When the server will next look, as a local time.
- *
- * A time rather than a countdown, for the reason the transcript's own limit row gives: this screen
- * reads the figure once, and a span drawn from a value nothing refreshes goes stale while somebody
- * is looking at it.
- */
-private fun formatCheckTime(epochSeconds: Double): String =
-    try {
-        DateTimeFormatter.ofLocalizedTime(FormatStyle.SHORT)
-            .withZone(ZoneId.systemDefault())
-            .format(Instant.ofEpochSecond(epochSeconds.toLong()))
-    } catch (_: Exception) {
-        // A time that cannot be read is not a time to show: the sentence above still says a check
-        // is coming, which is the part the reader can act on.
-        "soon"
-    }

app/androidApp/src/main/kotlin/com/example/aiapp/SessionStatusWords.kt

@@ -1,74 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.graphics.Color
-
-/**
- * What a session's status is called on screen, and what colour it is drawn in.
- *
- * One pair of functions rather than a branch on each screen that shows a status. There were two,
- * and the second silently fell short the moment the server grew a state: `waiting` arrived and the
- * session list learned the word and the colour while the session screen's status row printed the
- * wire's own word in the muted grey every quiet state uses. That comment already said the words
- * were "the session list's own"; this is what makes that true rather than a promise.
- *
- * A subagent's own three states are deliberately not here -- see `subagentStatusLabel`, which
- * collapses everything it does not recognise rather than passing it through, because a subagent has
- * fewer states than a session and reporting one it cannot have is worse than reporting none.
- */
-fun sessionStatusWord(status: String, subagent: Boolean = false): String =
-    when (status) {
-        "idle" -> "idle"
-        "running" -> "running"
-        "compacting" -> "compacting"
-        // Not "running": a model coming off disk is not a model answering, and the difference is
-        // minutes. Said in its own word so a first message that waits is explained rather than
-        // looking like a session that has stopped responding. See `SessionStatus::Loading`.
-        //
-        // "model" rather than "loading" alone, because there are two waits before an answer and
-        // the reader is entitled to know which one they are in: this one happens once, and
-        // "reading prompt" below happens on every turn.
-        "loading" -> "loading model"
-        // The model has the prompt and has not started answering. Its own word for the same
-        // reason: a long conversation spends real time here, and reported as "running" it looked
-        // like a model thinking. See `SessionStatus::Reading`.
-        "reading" -> "reading prompt"
-        // Its own word, because the state it is easily mistaken for means the opposite: "idle"
-        // invites the reader to type something, and a waiting session is going to carry on without
-        // them. See `SessionStatus::Waiting`.
-        "waiting" -> "waiting"
-        "awaitingInput" -> "your turn"
-        // A subagent's process was always its parent's, so it had none of its own to merely stop.
-        "exited" -> if (subagent) "finished" else "exited"
-        // Said in words, because it differs in kind from the others rather than in degree: the
-        // session is not idle and has not exited, nobody has been able to find out which. A muted
-        // colour alone would read as one of the quiet states.
-        "unknown" -> "can't tell"
-        // A state this build has never heard of, said as itself. The nearest word we do know would
-        // read as a fact somebody established.
-        else -> status
-    }
-
-fun backgroundTaskLabel(count: Int): String = "$count bg ${if (count == 1) "task" else "tasks"}"
-
-/**
- * The colour that goes with [sessionStatusWord]: the accent is spent on the states that are about
- * to do something or want something, and every quiet one shares the muted colour.
- *
- * Stated beside whatever draws it rather than inherited -- a colour that carries meaning has to
- * carry its own contrast, since the surface under it will not change to rescue it.
- */
-@Composable
-fun sessionStatusColour(status: String): Color =
-    when (status) {
-        "awaitingInput" -> awaitingColor
-        "running" -> runningColor
-        "compacting" -> commandColor
-        // The same accent as the other states that are busy on their own account, because that is
-        // what this is: something is happening and nothing is wanted from the reader.
-        "loading",
-        "reading" -> commandColor
-        "waiting" -> waitingColor
-        else -> MaterialTheme.colorScheme.onSurfaceVariant
-    }

app/androidApp/src/main/kotlin/com/example/aiapp/SessionUsageBar.kt

@@ -15,8 +15,6 @@ import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.drawWithContent
-import androidx.compose.ui.geometry.Offset
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.unit.dp
 import java.time.Duration
@@ -72,21 +70,12 @@ class UsageFeed(
     /** Ask the backend again now. The dialog's refresh button; the poll does it on its own. */
     val refresh: () -> Unit,
 ) {
-    /**
-     * What meters [session], and what that meter came back as. See [usageFor] for the states.
-     *
-     * A session rather than a machine, because a machine is not what is metered: one machine runs
-     * the Claude CLI and an echo session side by side, and only the first of them spends anything.
-     */
-    fun forSession(session: SessionSummary): SessionUsage {
-        // Settled without asking anybody: a session nothing meters has nothing to check, and
-        // "checking" is what the fetch's own states would say about it for as long as one is out.
-        val provider = session.usageProvider ?: return SessionUsage.NotMetered
-        return when (val state = snapshots) {
+    /** What [setup]'s own limits came back as. See [usageFor] for why the states are these. */
+    fun forSetup(setup: String): SessionUsage =
+        when (val state = snapshots) {
             is LoadState.Loading -> SessionUsage.Waiting
             is LoadState.Error -> SessionUsage.Unavailable(state.message)
-            is LoadState.Loaded -> usageFor(state.value, session.machine, provider, session.model)
-        }
+            is LoadState.Loaded -> usageFor(state.value, setup)
         }
 }
 
@@ -127,8 +116,8 @@ fun rememberUsageFeed(settings: ServerSettings): UsageFeed {
  *
  * Worst rather than the five-hour one, because the button it colours opens *all* of them, and a
  * blue icon over a weekly quota at 97% would be the interface answering a question nobody asked.
- * Taken over however many windows this session's provider returned rather than the three Claude
- * sends today -- the backend passes windows it does not recognise straight through.
+ * Taken over however many windows came back rather than the three Claude sends today -- the backend
+ * passes windows it does not recognise straight through.
  *
  * Every state that is not a measurement takes the ordinary control colour instead. That is the
  * point where colour stops being able to help: blue is the low end of a scale here, so colouring an
@@ -144,7 +133,7 @@ fun usageGlyphColour(usage: SessionUsage): Color =
     }
 
 /**
- * The shortest usage window for the pool this session uses, under the session's own header.
+ * The five-hour window for the machine this session runs on, under the session's own header.
  *
  * Here rather than only in the usage dialog because it is the number that decides whether to keep
  * going, and it was a screen away from the place that decision gets made. It reports on this
@@ -161,17 +150,17 @@ fun SessionUsageBar(usage: SessionUsage, modifier: Modifier = Modifier) {
     // rather than recomputed at draw time: a percentage that comes back unchanged is an equal
     // value, Compose skips the recomposition, and a "left" that only ticked when the quota moved
     // would sit at a stale figure for hours.
-    val now = rememberUsageNow()
+    var now by remember { mutableStateOf(OffsetDateTime.now()) }
+    LaunchedEffect(Unit) {
+        while (true) {
+            delay(REFRESH_MS)
+            now = OffsetDateTime.now()
+        }
+    }
 
-    // Nothing at all for a session that meters nothing: a row saying "unknown" there would report
-    // a problem about a machine somebody chose, on every screen, forever.
-    //
-    // And nothing while the first fetch is out, which is a different silence. A request in flight
-    // is not a state to report -- and the session that meters nothing is exactly the one this
-    // cannot yet tell apart, so "5-hour usage: checking" appeared under an echo session for half a
-    // second and was then taken away. A row that has to be withdrawn is worse than one that
-    // arrives late.
-    if (usage is SessionUsage.NotMetered || usage is SessionUsage.Waiting) {
+    // Nothing at all for a machine that meters nothing: a row saying "unknown" there would report a
+    // problem about a setup somebody chose, on every screen, forever.
+    if (usage is SessionUsage.NotMetered) {
         return
     }
 
@@ -182,18 +171,24 @@ fun SessionUsageBar(usage: SessionUsage, modifier: Modifier = Modifier) {
         // Words, not a colour and not an empty bar: every one of these is a different kind of
         // answer from "this much is used", and only words carry a difference in kind.
         when (val state = usage) {
-            // Both handled above, before the row exists at all.
-            SessionUsage.NotMetered,
-            SessionUsage.Waiting -> Unit
-            is SessionUsage.Unavailable -> UsageNote("Usage unknown -- ${state.why}")
+            SessionUsage.NotMetered -> Unit
+            is SessionUsage.Unavailable -> UsageNote("5-hour usage unknown -- ${state.why}")
+            SessionUsage.Waiting -> UsageNote("5-hour usage: checking")
             is SessionUsage.Known -> {
-                val window = shortestUsageWindow(state.windows)
+                val window = state.windows.firstOrNull { it.kind == "session" }
                 if (window == null) {
-                    UsageNote("Usage unknown -- no window duration was reported")
+                    UsageNote("5-hour usage unknown -- no five-hour window reported")
                 } else {
-                    UsageProgressIndicator(window, now, Modifier.weight(1f))
+                    LinearProgressIndicator(
+                        progress = { (window.percent / 100.0).toFloat().coerceIn(0f, 1f) },
+                        // The same step at the same percentages as the dialog's bars: this is the
+                        // same measurement, and a reader who learned the colour there has to be
+                        // able to read it here without checking which screen they are on.
+                        color = quotaColor(window.percent),
+                        modifier = Modifier.weight(1f),
+                    )
                     Text(
-                        usageWindowLabel(window, now),
+                        fiveHourLabel(window, now),
                         style = MaterialTheme.typography.labelSmall,
                         color = MaterialTheme.colorScheme.onSurfaceVariant,
                         modifier = Modifier.padding(start = 8.dp),
@@ -204,56 +199,6 @@ fun SessionUsageBar(usage: SessionUsage, modifier: Modifier = Modifier) {
     }
 }
 
-/** A clock shared by each usage surface, advanced independently of changes to the quota. */
-@Composable
-internal fun rememberUsageNow(): OffsetDateTime {
-    var now by remember { mutableStateOf(OffsetDateTime.now()) }
-    LaunchedEffect(Unit) {
-        while (true) {
-            delay(REFRESH_MS)
-            now = OffsetDateTime.now()
-        }
-    }
-    return now
-}
-
-/** The quota fill with a white tick showing how far the current time window has progressed. */
-@Composable
-internal fun UsageProgressIndicator(
-    window: UsageWindow,
-    now: OffsetDateTime,
-    modifier: Modifier = Modifier,
-) {
-    val elapsed = usageWindowElapsedFraction(window, now)
-    LinearProgressIndicator(
-        progress = { (window.percent / 100.0).toFloat().coerceIn(0f, 1f) },
-        // The same step at the same percentages everywhere: this is the same measurement, and a
-        // reader who learned the colour on one surface should not have to relearn it on another.
-        color = quotaColor(window.percent),
-        modifier =
-            modifier.drawWithContent {
-                drawContent()
-                elapsed?.let { fraction ->
-                    drawLine(
-                        color = Color.White,
-                        start = Offset(size.width * fraction, 0f),
-                        end = Offset(size.width * fraction, size.height),
-                        strokeWidth = 2.dp.toPx(),
-                    )
-                }
-            },
-    )
-}
-
-/** Elapsed time divided by the reported window duration, or null when either value is unknown. */
-internal fun usageWindowElapsedFraction(window: UsageWindow, now: OffsetDateTime): Float? {
-    val durationMinutes = window.durationMinutes?.takeIf { it > 0 } ?: return null
-    val end = windowEnd(window.resetsAt, now) as? WindowEnd.Ends ?: return null
-    val remainingMinutes =
-        end.until.seconds.toDouble() / 60.0 + end.until.nano.toDouble() / 60_000_000_000.0
-    return (1.0 - remainingMinutes / durationMinutes).coerceIn(0.0, 1.0).toFloat()
-}
-
 /** Anything this row says instead of drawing a bar, so all of them look the same. */
 @Composable
 private fun UsageNote(text: String) {
@@ -265,103 +210,42 @@ private fun UsageNote(text: String) {
 }
 
 /**
- * "42% -- 2h 15m left / 5h": how much is gone, then how long what is left has to last, then how
- * long the whole window is.
+ * "42% -- 2h 15m left": how much is gone, then how long what is left has to last.
  *
  * The percentage on its own does not answer the question it gets asked, which is whether to start
  * something now; 80% with twenty minutes to go and 80% with four hours to go are opposite answers.
  *
- * The window's *length* is what the provider's own name for it used to carry ("5-hour window"), and
- * it is worth more beside the time left than in front of the percentage: "3h 42m left / 5h" says in
- * one reading both how much of the cycle is to come and which cycle this is. Where the provider
- * reported no duration there is simply nothing after the span -- the name it gave is not a
- * measurement of one, so nothing is inferred from it.
- *
  * The window's end has two missing cases, worded differently on purpose; see [WindowEnd]. A window
  * that is not running gets the percentage and nothing else.
  */
-private fun usageWindowLabel(window: UsageWindow, now: OffsetDateTime): String {
+private fun fiveHourLabel(window: UsageWindow, now: OffsetDateTime): String {
     val percent = "${window.percent.toInt()}%"
-    val outOf =
-        window.durationMinutes?.takeIf { it > 0 }?.let { " / ${formatMillis(it * 60_000)}" } ?: ""
     return when (val end = windowEnd(window.resetsAt, now)) {
-        // Between blocks a window can have no reset time, and saying so is a fact about nothing:
-        // there is no window to run out. The percentage is the whole answer.
+        // Between blocks the five-hour window has no reset time, and saying so is a fact about
+        // nothing: there is no window to run out. The percentage is the whole answer.
         WindowEnd.NotRunning -> percent
         WindowEnd.Unreadable -> "$percent · reset time unreadable"
         is WindowEnd.Ends ->
             // Under a minute, including past the end: the number would round to "0m left", which
             // reads as a measurement rather than as the window having run out.
             if (end.until < Duration.ofMinutes(1)) "$percent · refresh soon"
-            else "$percent · ${formatSpan(end.until)} left$outOf"
+            else "$percent · ${formatSpan(end.until)} left"
     }
 }
 
 /**
- * One meter's snapshot, out of every machine's: [machine]'s row for [provider].
- *
- * Both halves are needed to pick it. A machine can hold more than one meter -- the Claude CLI's
- * account and, while a test has one set, an echo session's invented one -- and a snapshot is one
- * service on one machine.
+ * One machine's snapshot, out of every machine's.
  *
  * Every way of having *failed* to get numbers is [SessionUsage.Unavailable] with the reason in it.
  * None of them may look like zero, and none may look like [SessionUsage.NotMetered], which is the
  * machine having no quota rather than the question going unanswered.
  */
-fun usageFor(
-    snapshots: List<UsageSnapshot>,
-    machine: String,
-    provider: String,
-    model: String?,
-): SessionUsage {
-    // No snapshot at all means the backend never asked, which it only does where there is nothing
-    // to ask about. That is a different answer from having asked and failed.
-    val pools = usageSnapshotsFor(snapshots, machine, provider)
-    if (pools.isEmpty()) return SessionUsage.NotMetered
-    val mine =
-        usagePoolFor(pools, model)
-            ?: return SessionUsage.Unavailable("couldn't tell which usage pool this session uses")
+fun usageFor(snapshots: List<UsageSnapshot>, setup: String): SessionUsage {
+    // No snapshot at all means the backend never asked, which it only does for a machine with
+    // nothing metered on it. That is a different answer from having asked and failed.
+    val mine = snapshots.firstOrNull { it.setup == setup } ?: return SessionUsage.NotMetered
     if (mine.state != "ok") {
-        val why =
-            mine.detail
-                ?: when (mine.state) {
-                    "notLoggedIn" -> "no Claude account is signed in on this machine"
-                    "authenticating" -> "Claude sign-in is in progress"
-                    "loginRequired" -> "Claude sign-in is required"
-                    else -> mine.state
-                }
-        return SessionUsage.Unavailable(why)
+        return SessionUsage.Unavailable(mine.detail ?: mine.state)
     }
     return SessionUsage.Known(mine.windows)
 }
-
-/** Every billing pool reported for one provider on one machine. */
-internal fun usageSnapshotsFor(
-    snapshots: List<UsageSnapshot>,
-    machine: String,
-    provider: String?,
-): List<UsageSnapshot> =
-    if (provider == null) emptyList()
-    else snapshots.filter { it.machine == machine && it.provider == provider }
-
-/** The pool an explicit model names, or the provider's generic pool for every other model. */
-internal fun usagePoolFor(pools: List<UsageSnapshot>, model: String?): UsageSnapshot? {
-    if (pools.size == 1) return pools.first()
-    val normalizedModel = model?.normalizedPoolName()
-    val named = normalizedModel?.let { wanted ->
-        pools.firstOrNull { pool ->
-            val name = pool.limitName?.normalizedPoolName()
-            name == wanted || (wanted.contains("luna") && name == "gptreserve")
-        }
-    }
-    return named ?: pools.firstOrNull { it.limitId == "codex" }
-}
-
-/** The shortest cycle the selected pool actually reported. */
-internal fun shortestUsageWindow(windows: List<UsageWindow>): UsageWindow? =
-    windows
-        .mapNotNull { window -> window.durationMinutes?.let { duration -> duration to window } }
-        .minByOrNull { it.first }
-        ?.second
-
-private fun String.normalizedPoolName(): String = lowercase().filter(Char::isLetterOrDigit)

app/androidApp/src/main/kotlin/com/example/aiapp/SettingsScreen.kt

@@ -15,6 +15,7 @@ import androidx.compose.foundation.layout.width
 import androidx.compose.material3.Button
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedButton
+import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.getValue
@@ -124,14 +125,28 @@ fun SettingsScreen(
         }
         Spacer(Modifier.height(16.dp))
 
-        LabelledField(label = "Host", value = host, onValueChange = { host = it })
+        OutlinedTextField(
+            value = host,
+            onValueChange = { host = it },
+            label = { Text("Host") },
+            singleLine = true,
+            modifier = Modifier.fillMaxWidth(),
+        )
         Spacer(Modifier.height(8.dp))
-        LabelledField(label = "Port", value = port, onValueChange = { port = it })
+        OutlinedTextField(
+            value = port,
+            onValueChange = { port = it },
+            label = { Text("Port") },
+            singleLine = true,
+            modifier = Modifier.fillMaxWidth(),
+        )
         Spacer(Modifier.height(8.dp))
-        LabelledField(
-            label = if (existing != null) "Token (unchanged if left blank)" else "Token",
+        OutlinedTextField(
             value = token,
             onValueChange = { token = it },
+            label = { Text(if (existing != null) "Token (unchanged if left blank)" else "Token") },
+            singleLine = true,
+            modifier = Modifier.fillMaxWidth(),
         )
         Spacer(Modifier.height(24.dp))
 

app/androidApp/src/main/kotlin/com/example/aiapp/SetupsScreen.kt

@@ -1,7 +1,5 @@
 package com.example.aiapp
 
-import androidx.compose.foundation.BorderStroke
-import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
@@ -12,9 +10,9 @@ import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.Card
-import androidx.compose.material3.CardDefaults
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
@@ -26,11 +24,6 @@ import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.semantics.contentDescription
-import androidx.compose.ui.semantics.semantics
-import androidx.compose.ui.text.font.FontFamily
-import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
@@ -44,25 +37,19 @@ import kotlinx.coroutines.withContext
  * which is what keeps the enrolled token from being able to introduce commands.
  */
 @Composable
-fun MachinesScreen(
-    settings: ServerSettings,
-    reloadToken: Int,
-    /** Opens one provider on one machine -- its settings, and what its server is holding. */
-    onProvider: (String, String) -> Unit,
-) {
+fun SetupsScreen(settings: ServerSettings, reloadToken: Int) {
     val scope = rememberCoroutineScope()
-    var state by remember { mutableStateOf<LoadState<List<Machine>>>(LoadState.Loading) }
+    var state by remember { mutableStateOf<LoadState<List<Setup>>>(LoadState.Loading) }
     var adding by remember { mutableStateOf(false) }
-    var renaming by remember { mutableStateOf<Machine?>(null) }
-    var confirmingDelete by remember { mutableStateOf<Machine?>(null) }
-    var signingIn by remember { mutableStateOf<Pair<Machine, Provider>?>(null) }
+    var renaming by remember { mutableStateOf<Setup?>(null) }
+    var confirmingDelete by remember { mutableStateOf<Setup?>(null) }
     var busy by remember { mutableStateOf<String?>(null) }
     var actionError by remember { mutableStateOf<String?>(null) }
 
     suspend fun reload() {
         state =
             try {
-                withContext(Dispatchers.IO) { LoadState.Loaded(fetchMachines(settings)) }
+                withContext(Dispatchers.IO) { LoadState.Loaded(fetchSetups(settings)) }
             } catch (e: ApiException) {
                 LoadState.failed(e)
             }
@@ -95,19 +82,19 @@ fun MachinesScreen(
             is LoadState.Error -> Text(current.message, color = MaterialTheme.colorScheme.error)
             is LoadState.Loaded ->
                 LazyColumn(Modifier.fillMaxSize()) {
-                    uniqueItems(current.value, key = { it.id }) { machine ->
-                        MachineCard(
-                            machine = machine,
-                            onRename = { renaming = machine },
+                    uniqueItems(current.value, key = { it.id }) { setup ->
+                        SetupCard(
+                            setup = setup,
+                            onRename = { renaming = setup },
                             onRediscover = {
                                 scope.launch {
-                                    busy = "Asking ${machine.name} what it has…"
+                                    busy = "Asking ${setup.name} what it has…"
                                     actionError =
                                         runCatching {
                                             withContext(Dispatchers.IO) {
-                                                updateMachine(
+                                                updateSetup(
                                                     settings,
-                                                    machine.id,
+                                                    setup.id,
                                                     rediscover = true,
                                                 )
                                             }
@@ -118,9 +105,7 @@ fun MachinesScreen(
                                     reload()
                                 }
                             },
-                            onDelete = { confirmingDelete = machine },
-                            onSignIn = { provider -> signingIn = machine to provider },
-                            onProvider = { provider -> onProvider(machine.id, provider.name) },
+                            onDelete = { confirmingDelete = setup },
                         )
                     }
                 }
@@ -128,7 +113,7 @@ fun MachinesScreen(
     }
 
     if (adding) {
-        AddMachineDialog(
+        AddSetupDialog(
             onDismiss = { adding = false },
             onAdd = { name, ssh ->
                 adding = false
@@ -136,7 +121,7 @@ fun MachinesScreen(
                     busy = "Asking $name what it has…"
                     actionError =
                         runCatching {
-                            withContext(Dispatchers.IO) { addMachine(settings, name, ssh) }
+                            withContext(Dispatchers.IO) { addSetup(settings, name, ssh) }
                         }
                             .exceptionOrNull()
                             ?.message
@@ -144,13 +129,13 @@ fun MachinesScreen(
                     reload()
                 }
             },
-            onTest = { ssh -> withContext(Dispatchers.IO) { probeMachine(settings, ssh) } },
+            onTest = { ssh -> withContext(Dispatchers.IO) { probeSetup(settings, ssh) } },
         )
     }
 
-    renaming?.let { machine ->
+    renaming?.let { setup ->
         RenameDialog(
-            machine = machine,
+            setup = setup,
             onDismiss = { renaming = null },
             onRename = { name ->
                 renaming = null
@@ -158,7 +143,7 @@ fun MachinesScreen(
                     actionError =
                         runCatching {
                             withContext(Dispatchers.IO) {
-                                updateMachine(settings, machine.id, name = name)
+                                updateSetup(settings, setup.id, name = name)
                             }
                         }
                             .exceptionOrNull()
@@ -169,10 +154,10 @@ fun MachinesScreen(
         )
     }
 
-    confirmingDelete?.let { machine ->
+    confirmingDelete?.let { setup ->
         AlertDialog(
             onDismissRequest = { confirmingDelete = null },
-            title = { Text("Remove \"${machine.name}\"?") },
+            title = { Text("Remove \"${setup.name}\"?") },
             text = {
                 Text(
                     "The machine is left alone -- this only stops this app offering it. " +
@@ -186,9 +171,7 @@ fun MachinesScreen(
                         scope.launch {
                             actionError =
                                 runCatching {
-                                    withContext(Dispatchers.IO) {
-                                        deleteMachine(settings, machine.id)
-                                    }
+                                    withContext(Dispatchers.IO) { deleteSetup(settings, setup.id) }
                                 }
                                     .exceptionOrNull()
                                     ?.message
@@ -204,99 +187,34 @@ fun MachinesScreen(
             },
         )
     }
-
-    signingIn?.let { (machine, provider) ->
-        ProviderLoginDialog(
-            settings = settings,
-            machineId = machine.id,
-            machineName = machine.name,
-            provider = provider.name,
-            onDismiss = { signingIn = null },
-            onSignedIn = {
-                signingIn = null
-                scope.launch { reload() }
-            },
-        )
-    }
 }
 
 @Composable
-private fun MachineCard(
-    machine: Machine,
+private fun SetupCard(
+    setup: Setup,
     onRename: () -> Unit,
     onRediscover: () -> Unit,
     onDelete: () -> Unit,
-    onSignIn: (Provider) -> Unit,
-    onProvider: (Provider) -> Unit,
 ) {
     Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
         Column(Modifier.padding(12.dp)) {
-            Text(machine.name, style = MaterialTheme.typography.titleSmall)
+            Text(setup.name, style = MaterialTheme.typography.titleSmall)
             Text(
-                // Not "this machine": the seeded machine is *called* that, and the card read "this
+                // Not "this machine": the seeded setup is *called* that, and the card read "this
                 // machine / this machine".
-                machine.address ?: "runs where the backend does",
+                setup.address ?: "runs where the backend does",
                 style = MaterialTheme.typography.bodySmall,
                 color = MaterialTheme.colorScheme.onSurfaceVariant,
             )
             Spacer(Modifier.height(4.dp))
-            if (machine.providers.isEmpty()) {
             Text(
-                    "Nothing found on it. Install something and rediscover.",
-                    style = MaterialTheme.typography.bodySmall,
-                )
+                if (setup.providers.isEmpty()) {
+                    "Nothing found on it. Install something and rediscover."
                 } else {
-                machine.providers.forEach { provider ->
-                    // A card of its own rather than a line of text: a provider is where the
-                    // settings that belong to *this machine* live -- how each of its models is
-                    // loaded, the models themselves, and the server holding them -- and those had
-                    // nowhere to be until one llama-server came to serve every session on a
-                    // machine. Sized by its own padding rather than by whatever control happened
-                    // to be on its row, like the tool call cards it is built after.
-                    Card(
-                        Modifier.fillMaxWidth()
-                            .padding(vertical = 4.dp)
-                            .clickable { onProvider(provider) }
-                            .semantics { contentDescription = "Open ${provider.name}" },
-                        // A border, and the machine card's own surface kept underneath it.
-                        // The tint that was here before is one step along the surface ladder
-                        // from the card it sits in, and two adjacent surfaces render as one flat
-                        // block: these read as lines of text in a box rather than as things to
-                        // open. One cue, and a visible one.
-                        colors = CardDefaults.cardColors(containerColor = Color.Transparent),
-                        border = BorderStroke(1.dp, MaterialTheme.colorScheme.outlineVariant),
-                    ) {
-                        Row(
-                            verticalAlignment = Alignment.CenterVertically,
-                            modifier = Modifier.fillMaxWidth().padding(12.dp),
-                        ) {
-                            Column(Modifier.weight(1f)) {
-                                Text(provider.name, style = MaterialTheme.typography.titleSmall)
-                                // What was actually found, which is the honest second line and
-                                // the one thing here nobody can change. No arrow: a card that
-                                // lifts off the one behind it already reads as something to open,
-                                // and the chevron was the only thing making these look like rows
-                                // of a list.
-                                provider.command?.let {
-                                    Text(
-                                        it,
+                    setup.providers.joinToString(" · ") { it.name }
+                },
                 style = MaterialTheme.typography.bodySmall,
-                                        fontFamily = FontFamily.Monospace,
-                                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                                        maxLines = 1,
-                                        // A program is identified by its name, which is the tail
-                                        // of its path.
-                                        overflow = TextOverflow.StartEllipsis,
             )
-                                }
-                            }
-                            if (provider.kind == "claude_cli") {
-                                TextButton(onClick = { onSignIn(provider) }) { Text("Sign in") }
-                            }
-                        }
-                    }
-                }
-            }
             Row(verticalAlignment = Alignment.CenterVertically) {
                 TextButton(onClick = onRename) { Text("Rename") }
                 TextButton(onClick = onRediscover) { Text("Rediscover") }
@@ -308,7 +226,7 @@ private fun MachineCard(
 }
 
 @Composable
-private fun AddMachineDialog(
+private fun AddSetupDialog(
     onDismiss: () -> Unit,
     onAdd: (String, SshDetails?) -> Unit,
     onTest: suspend (SshDetails?) -> List<Provider>,
@@ -318,7 +236,6 @@ private fun AddMachineDialog(
     var address by remember { mutableStateOf("") }
     var identity by remember { mutableStateOf("") }
     var attachmentsDir by remember { mutableStateOf("") }
-    var modelsDir by remember { mutableStateOf("") }
     var tested by remember { mutableStateOf<String?>(null) }
     var testing by remember { mutableStateOf(false) }
 
@@ -333,7 +250,6 @@ private fun AddMachineDialog(
                     port = typedPort,
                     identityFile = identity.trim().ifEmpty { null },
                     attachmentsDir = attachmentsDir.trim().ifEmpty { null },
-                    modelsDir = modelsDir.trim().ifEmpty { null },
                 )
             }
 
@@ -349,36 +265,33 @@ private fun AddMachineDialog(
                     color = MaterialTheme.colorScheme.onSurfaceVariant,
                 )
                 Spacer(Modifier.height(8.dp))
-                LabelledField(label = "Name", value = name, onValueChange = { name = it })
-                Spacer(Modifier.height(8.dp))
-                LabelledField(
-                    // Just the shape. What a blank one means is said once, in the text above this
-                    // form -- repeating it here wrapped the label onto a second line.
-                    label = "user@host[:port]",
+                OutlinedTextField(
+                    value = name,
+                    onValueChange = { name = it },
+                    label = { Text("Name") },
+                    singleLine = true,
+                )
+                OutlinedTextField(
                     value = address,
                     onValueChange = { address = it },
+                    // Just the shape. What a blank one means is said once, in the text above this
+                    // form -- repeating it here wrapped the label onto a second line.
+                    label = { Text("user@host[:port]") },
+                    singleLine = true,
                 )
-                Spacer(Modifier.height(8.dp))
-                LabelledField(
-                    label = "Key path on the backend",
+                OutlinedTextField(
                     value = identity,
                     onValueChange = { identity = it },
+                    label = { Text("Key path on the backend") },
+                    singleLine = true,
                 )
-                Spacer(Modifier.height(8.dp))
-                LabelledField(
-                    // Where a file attached from the phone lands on that machine.
-                    label = "Folder for attached files",
+                // Where a file attached from the phone lands on that machine. Blank means the
+                // session's own directory, which is what most people want.
+                OutlinedTextField(
                     value = attachmentsDir,
                     onValueChange = { attachmentsDir = it },
-                    hint = "the session's own directory",
-                )
-                Spacer(Modifier.height(8.dp))
-                LabelledField(
-                    // Where that machine's GGUFs are, for a llama.cpp session on it.
-                    label = "Folder for models",
-                    value = modelsDir,
-                    onValueChange = { modelsDir = it },
-                    hint = "the same place this backend keeps its own downloads",
+                    label = { Text("Folder for attached files (optional)") },
+                    singleLine = true,
                 )
                 tested?.let {
                     Spacer(Modifier.height(8.dp))
@@ -426,14 +339,19 @@ private fun AddMachineDialog(
 }
 
 @Composable
-private fun RenameDialog(machine: Machine, onDismiss: () -> Unit, onRename: (String) -> Unit) {
-    var name by remember { mutableStateOf(machine.name) }
+private fun RenameDialog(setup: Setup, onDismiss: () -> Unit, onRename: (String) -> Unit) {
+    var name by remember { mutableStateOf(setup.name) }
     AlertDialog(
         onDismissRequest = onDismiss,
         title = { Text("Rename") },
         text = {
             Column {
-                LabelledField(label = "Name", value = name, onValueChange = { name = it })
+                OutlinedTextField(
+                    value = name,
+                    onValueChange = { name = it },
+                    label = { Text("Name") },
+                    singleLine = true,
+                )
                 Spacer(Modifier.height(8.dp))
                 Text(
                     "Sessions already running on it keep working -- they refer to the machine, " +

app/androidApp/src/main/kotlin/com/example/aiapp/SidePanels.kt

@@ -1,250 +0,0 @@
-package com.example.aiapp
-
-import androidx.activity.compose.BackHandler
-import androidx.compose.animation.core.Animatable
-import androidx.compose.foundation.background
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.gestures.Orientation
-import androidx.compose.foundation.gestures.draggable
-import androidx.compose.foundation.gestures.rememberDraggableState
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.BoxScope
-import androidx.compose.foundation.layout.BoxWithConstraints
-import androidx.compose.foundation.layout.fillMaxHeight
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.width
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Surface
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.derivedStateOf
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableFloatStateOf
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.graphics.graphicsLayer
-import androidx.compose.ui.platform.LocalDensity
-import androidx.compose.ui.semantics.clearAndSetSemantics
-import androidx.compose.ui.semantics.contentDescription
-import androidx.compose.ui.semantics.semantics
-import androidx.compose.ui.unit.Dp
-import androidx.compose.ui.unit.dp
-import kotlin.math.absoluteValue
-import kotlinx.coroutines.launch
-
-private const val OPEN_THRESHOLD = 0.35f
-private val FLING_THRESHOLD = 400.dp
-
-/**
- * How much of the screen a panel takes by default, leaving a sliver of what it is over.
- *
- * A panel given the whole width instead is standing in for the screen rather than sitting over it,
- * and then the sliver would be a strip of a screen the reader has just left behind.
- */
-const val PANEL_FRACTION = 0.88f
-
-/** How dark the scrim over [SidePanels]' content goes with a panel fully open. */
-private const val SCRIM_ALPHA = 0.32f
-
-/**
- * Which side of the content a panel comes in from: where it sits, and which way it slides out.
- *
- * [sign] is also the direction of the reveal this side owns, so the drag arithmetic is written once
- * rather than once per side with the minus signs moved around.
- */
-enum class PanelSide(val alignment: Alignment, val sign: Float) {
-    Left(Alignment.CenterStart, -1f),
-    Right(Alignment.CenterEnd, 1f),
-}
-
-/**
- * Keeps [content] composed while a panel belonging to it moves over from the left or the right.
- *
- * One gesture drives both sides rather than one handler each, because two `draggable`s over the
- * same content cannot share a horizontal drag: the inner one claims it whichever way the finger
- * went, and the outer never sees a thing. So the position is a single signed reveal -- negative is
- * the left panel showing, positive the right -- which also makes it impossible to have both open.
- *
- * A side left null has no panel and no gesture toward it -- the reveal cannot travel that way at
- * all -- so one composable serves a screen with one panel and a screen with two.
- *
- * The root drag handler deliberately sits behind descendants. A horizontal scroller consumes its
- * drag first, so code blocks, attachments and tool inputs keep their existing gesture. Collapsing
- * that content, or starting over any ordinary part of the session, gives the gesture back to the
- * panel; Android's own right-edge Back gesture remains untouched.
- */
-@Composable
-fun SidePanels(
-    left: (@Composable (active: Boolean, close: () -> Unit) -> Unit)? = null,
-    leftFraction: Float = PANEL_FRACTION,
-    right: (@Composable (active: Boolean, close: () -> Unit) -> Unit)? = null,
-    rightFraction: Float = PANEL_FRACTION,
-    content: @Composable () -> Unit,
-) {
-    val scope = rememberCoroutineScope()
-    // Which panel the gesture settled on, null for neither. The *settled* side rather than the
-    // current position, so a panel's contents know they are being looked at while the animation
-    // is still running.
-    var opened by remember { mutableStateOf<PanelSide?>(null) }
-    var dragging by remember { mutableStateOf(false) }
-    var draggedReveal by remember { mutableFloatStateOf(0f) }
-    val animatedReveal = remember { Animatable(0f) }
-    // Read from a draw or layout lambda, never from the composable body: where the panel has got
-    // to changes every frame of a drag, and a body that reads it recomposes this whole subtree --
-    // the session included -- once per frame. The booleans below are what composition is allowed
-    // to know, and each of them changes twice per gesture. (Same rule as the keyboard inset in
-    // SessionScreen, and found the same way.)
-    fun revealNow() = if (dragging) draggedReveal else animatedReveal.value
-    val leftShown by remember { derivedStateOf { revealNow() < 0f } }
-    val rightShown by remember { derivedStateOf { revealNow() > 0f } }
-    val engaged = leftShown || rightShown
-    val flingThreshold = with(LocalDensity.current) { FLING_THRESHOLD.toPx() }
-
-    suspend fun startDrag() {
-        animatedReveal.stop()
-        draggedReveal = animatedReveal.value
-        dragging = true
-    }
-
-    // Which panel the reveal belongs to, [bias] breaking the tie at rest -- a drag away from
-    // nothing is toward whichever panel that direction opens.
-    fun sideOf(bias: Float): PanelSide? =
-        when {
-            draggedReveal < 0f -> PanelSide.Left
-            draggedReveal > 0f -> PanelSide.Right
-            bias > 0f -> PanelSide.Left
-            bias < 0f -> PanelSide.Right
-            else -> null
-        }
-
-    suspend fun finishDrag(velocity: Float) {
-        val side = sideOf(0f)
-        // How fast the finger is moving toward that side's open position: the left panel opens
-        // rightwards and the right panel leftwards, so the sign of a velocity only means something
-        // once it is read against the side. A fling decides on its own; anything slower is decided
-        // by how far in the panel already is.
-        val toward = side?.let { -it.sign * velocity } ?: 0f
-        val opens =
-            if (toward.absoluteValue > flingThreshold) toward > 0f
-            else draggedReveal.absoluteValue >= OPEN_THRESHOLD
-        val target = side.takeIf { opens }
-        opened = target
-        animatedReveal.snapTo(draggedReveal)
-        dragging = false
-        animatedReveal.animateTo(target?.sign ?: 0f)
-    }
-
-    fun close() {
-        opened = null
-        scope.launch { animatedReveal.animateTo(0f) }
-    }
-
-    BackHandler(enabled = opened != null) { close() }
-
-    BoxWithConstraints(Modifier.fillMaxSize()) {
-        val dragState = rememberDraggableState { delta ->
-            // Against the width of the panel this drag is moving, since the reveal is a fraction
-            // of it and the two sides need not be the same width.
-            val width =
-                sideOf(delta)?.let {
-                    constraints.maxWidth * if (it == PanelSide.Left) leftFraction else rightFraction
-                } ?: return@rememberDraggableState
-            draggedReveal =
-                (draggedReveal - delta / width.coerceAtLeast(1f)).coerceIn(
-                    if (left == null) 0f else -1f,
-                    if (right == null) 0f else 1f,
-                )
-        }
-        val drag =
-            Modifier.draggable(
-                state = dragState,
-                orientation = Orientation.Horizontal,
-                onDragStarted = { startDrag() },
-                onDragStopped = { velocity -> finishDrag(velocity) },
-            )
-
-        Box(
-            Modifier.fillMaxSize()
-                .then(drag)
-                .then(if (engaged) Modifier.clearAndSetSemantics {} else Modifier)
-        ) {
-            content()
-        }
-
-        if (engaged) {
-            Box(
-                Modifier.fillMaxSize()
-                    .graphicsLayer { alpha = revealNow().absoluteValue * SCRIM_ALPHA }
-                    .background(MaterialTheme.colorScheme.scrim)
-                    .semantics { contentDescription = "Dismiss panel" }
-                    .clickable { close() }
-            )
-        }
-
-        // Both panels stay composed while they are off screen, so opening one costs no
-        // composition -- but an off-screen panel is cleared from the semantics tree, since nothing
-        // a reader cannot see should be reachable by swiping through the screen.
-        left?.let { panel ->
-            SlidingPanel(
-                side = PanelSide.Left,
-                width = maxWidth * leftFraction,
-                raised = leftFraction < 1f,
-                shown = { (-revealNow()).coerceAtLeast(0f) },
-                visible = leftShown,
-                drag = drag,
-            ) {
-                panel(opened == PanelSide.Left, ::close)
-            }
-        }
-        right?.let { panel ->
-            SlidingPanel(
-                side = PanelSide.Right,
-                width = maxWidth * rightFraction,
-                raised = rightFraction < 1f,
-                shown = { revealNow().coerceAtLeast(0f) },
-                visible = rightShown,
-                drag = drag,
-            ) {
-                panel(opened == PanelSide.Right, ::close)
-            }
-        }
-    }
-}
-
-/**
- * One panel at [shown] of the way in, sliding out to its own [side].
- *
- * [raised] is for a panel with some of the screen still beside it, which takes a tonal step to say
- * it is above what it has not covered. A panel covering the whole width has nothing to be above,
- * and a step there is a screen that is simply the wrong colour.
- *
- * [visible] says the same thing as `shown() > 0f` and is the form composition may read; see
- * [SidePanels].
- */
-@Composable
-private fun BoxScope.SlidingPanel(
-    side: PanelSide,
-    width: Dp,
-    raised: Boolean,
-    shown: () -> Float,
-    visible: Boolean,
-    drag: Modifier,
-    contents: @Composable () -> Unit,
-) {
-    Surface(
-        tonalElevation = if (raised) 3.dp else 0.dp,
-        shadowElevation = 8.dp,
-        modifier =
-            Modifier.align(side.alignment)
-                .width(width)
-                .fillMaxHeight()
-                .graphicsLayer { translationX = side.sign * size.width * (1f - shown()) }
-                .then(if (visible) Modifier else Modifier.clearAndSetSemantics {})
-                .then(drag),
-    ) {
-        contents()
-    }
-}

app/androidApp/src/main/kotlin/com/example/aiapp/SpawnScreen.kt

@@ -16,6 +16,7 @@ import androidx.compose.material3.Button
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.FilterChip
 import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
@@ -47,52 +48,44 @@ fun SpawnScreen(
     val scope = rememberCoroutineScope()
     // What the form is made of, and whether we have it yet. A failure here is not the same as a
     // server with nothing to offer, so it must not reach the pickers as empty lists.
-    var options by remember { mutableStateOf<LoadState<List<Machine>>>(LoadState.Loading) }
+    var options by remember { mutableStateOf<LoadState<List<Setup>>>(LoadState.Loading) }
 
-    // Machine first, then one of its providers. Choosing a machine can invalidate the provider, so
-    // the
-    // provider is stored by name and resolved against the current machine rather than held as an
+    // Setup first, then one of its providers. Choosing a setup can invalidate the provider, so the
+    // provider is stored by name and resolved against the current setup rather than held as an
     // object that could outlive the list it came from.
-    var machineName by remember { mutableStateOf<String?>(null) }
+    var setupName by remember { mutableStateOf<String?>(null) }
     var providerName by remember { mutableStateOf<String?>(null) }
     var title by remember { mutableStateOf("") }
     var model by remember { mutableStateOf("") }
-    var providerModels by remember { mutableStateOf<List<OfferedModel>>(emptyList()) }
-    var providerModelsLoading by remember { mutableStateOf(false) }
-    var providerModelsError by remember { mutableStateOf<String?>(null) }
     var cwd by remember { mutableStateOf("") }
-    // Set only after the selected provider reports its own default. An empty value is not sent.
-    var permissionMode by remember { mutableStateOf("") }
-    // Null until the server has been asked, and null again if it answers "no level chosen" -- the
-    // two are told apart by [defaultsAsked], because a picker that shows a level before the answer
-    // arrives is one you can spawn at without having chosen it.
-    var effort by remember { mutableStateOf<String?>(null) }
-    var defaultsAsked by remember { mutableStateOf(false) }
+    // "auto" rather than "manual": on a phone every ask is a round trip to a question card, and
+    // answering "allow Bash?" dozens of times per task is what this app exists to avoid.
+    var permissionMode by remember { mutableStateOf("auto") }
     var busy by remember { mutableStateOf(false) }
     // Only the spawn's own failure. The fetch's lives in `options`: this one leaves a filled-in
     // form worth keeping, and that one leaves nothing to fill in.
     var spawnError by remember { mutableStateOf<String?>(null) }
-    // Whatever the chosen provider says it takes, by key. Empty until something is typed: an
-    // absent key means the server's own default, which is what every field's placeholder says.
-    var params by remember { mutableStateOf<Map<String, String>>(emptyMap()) }
+    // Downloaded models, for a llama provider to choose between. Kept separate from the setups: a
+    // Claude session needs none, so failing to list them must not stop the screen rendering.
+    var models by remember { mutableStateOf<List<LocalModel>>(emptyList()) }
+    var modelKey by remember { mutableStateOf<String?>(null) }
+    var contextSize by remember { mutableStateOf("") }
+    var temperature by remember { mutableStateOf("") }
 
     LaunchedEffect(Unit) {
-        // Separate from the machines fetch below and deliberately not fatal: failing to learn the
-        // default must leave a screen you can still spawn from, so the picker stays on "default"
-        // and says so rather than the whole form refusing to draw.
-        runCatching { withContext(Dispatchers.IO) { fetchDefaultEffort(settings) } }
-            .onSuccess { effort = it }
-        defaultsAsked = true
         options =
             try {
-                val fetched = withContext(Dispatchers.IO) { fetchMachines(settings) }
+                val fetched = withContext(Dispatchers.IO) { fetchSetups(settings) }
                 val first = fetched.firstOrNull()
-                machineName = first?.name
+                setupName = first?.name
                 providerName = first?.providers?.firstOrNull()?.name
                 LoadState.Loaded(fetched)
             } catch (e: ApiException) {
                 LoadState.failed(e)
             }
+        models =
+            runCatching { withContext(Dispatchers.IO) { fetchModels(settings).local } }
+                .getOrDefault(emptyList())
     }
 
     Column(Modifier.fillMaxSize().verticalScroll(rememberScrollState()).padding(16.dp)) {
@@ -109,7 +102,7 @@ fun SpawnScreen(
         // Nothing below is fillable until the options are here, and a failure to fetch them leaves
         // no form worth showing -- so this reports and stops, rather than offering empty pickers
         // under an error message.
-        val machines =
+        val setups =
             when (val state = options) {
                 is LoadState.Loading -> {
                     CircularProgressIndicator()
@@ -121,88 +114,51 @@ fun SpawnScreen(
                 }
                 is LoadState.Loaded -> state.value
             }
-        val machine = machines.firstOrNull { it.name == machineName }
-        val current = machine?.providers?.firstOrNull { it.name == providerName }
-        // Coding CLIs take a working directory, model, permission mode and thinking level. Keying
-        // the extra fields on the kind rather than the provider name keeps a second installation
+        val setup = setups.firstOrNull { it.name == setupName }
+        val current = setup?.providers?.firstOrNull { it.name == providerName }
+        // Only the Claude CLI has models, a working directory and permission modes; keying the
+        // extra fields on the kind rather than the provider name keeps a second Claude provider
         // from needing anything here.
         val isClaude = current?.kind == "claude_cli"
-        val isCodex = current?.kind == "codex_cli"
-        val isCodingCli = isClaude || isCodex
         val isLlama = current?.kind == "llama_cpp"
-        // Echo is the only kind with nothing to choose between.
-        val offersModels = isCodingCli || isLlama
-        // Where a session's tools act, which is the only thing a working directory decides.
-        val takesCwd = isCodingCli || isLlama
-
-        // Whichever machine and provider are chosen now, asked again when either changes. The
-        // previous answer is dropped first rather than left on screen: a model name from another
-        // machine looks exactly like one from this one.
-        LaunchedEffect(machine?.id, current?.name) {
-            model = ""
-            // A key from the previous provider would be a setting this one does not have, drawn
-            // by no control and sent at the spawn anyway.
-            params = emptyMap()
-            providerModels = emptyList()
-            providerModelsError = null
-            permissionMode = current?.defaultPermissionMode.orEmpty()
-            // Every kind that offers models at all, not only the coding CLIs: a llama provider
-            // answers with the GGUFs on the machine it runs on, through the same call. One
-            // question with one answer is what keeps the picker free of a branch on the kind.
-            if (machine == null || current == null || !offersModels) {
-                providerModelsLoading = false
-                return@LaunchedEffect
-            }
-            providerModelsLoading = true
-            try {
-                providerModels =
-                    withContext(Dispatchers.IO) {
-                        fetchProviderModels(settings, machine.id, current.name)
-                    }
-            } catch (e: ApiException) {
-                providerModelsError = e.message
-            } finally {
-                providerModelsLoading = false
-            }
-        }
 
         // The machine first, because it decides what can be run at all.
         ChipGroup(
-            label = "Machine",
-            options = machines.map { it.name },
-            selected = machineName,
+            label = "Setup",
+            options = setups.map { it.name },
+            selected = setupName,
             onSelect = { name ->
-                machineName = name
+                setupName = name
                 // The provider list changes with the machine, so a name carried over from the
                 // previous one would be a selection that isn't in the picker. Take that machine's
                 // first.
                 providerName =
-                    machines.firstOrNull { it.name == name }?.providers?.firstOrNull()?.name
+                    setups.firstOrNull { it.name == name }?.providers?.firstOrNull()?.name
             },
         )
-        machine?.address?.let {
+        setup?.address?.let {
             Text(
                 it,
                 style = MaterialTheme.typography.bodySmall,
                 color = MaterialTheme.colorScheme.onSurfaceVariant,
             )
-            // The address belongs to the machine above it, not to the provider label below; without
+            // The address belongs to the setup above it, not to the provider label below; without
             // this they read as one block.
             Spacer(Modifier.height(8.dp))
         }
 
-        // Only what this machine actually has. A machine with none says so rather than showing an
+        // Only what this machine actually has. A setup with none says so rather than showing an
         // empty row that reads as a failure.
-        if (machine != null && machine.providers.isEmpty()) {
+        if (setup != null && setup.providers.isEmpty()) {
             Text(
-                "\"${machine.name}\" has no providers configured.",
+                "\"${setup.name}\" has no providers configured.",
                 style = MaterialTheme.typography.bodyMedium,
                 color = MaterialTheme.colorScheme.onSurfaceVariant,
             )
         } else {
             ChipGroup(
                 label = "Provider",
-                options = machine?.providers?.map { it.name }.orEmpty(),
+                options = setup?.providers?.map { it.name }.orEmpty(),
                 selected = providerName,
                 onSelect = { providerName = it },
             )
@@ -210,116 +166,91 @@ fun SpawnScreen(
 
         Spacer(Modifier.height(16.dp))
 
-        LabelledField(label = "Title", value = title, onValueChange = { title = it })
+        OutlinedTextField(
+            value = title,
+            onValueChange = { title = it },
+            label = { Text("Title") },
+            singleLine = true,
+            modifier = Modifier.fillMaxWidth(),
+        )
 
-        if (offersModels) {
-            when {
-                providerModelsLoading ->
+        if (isLlama) {
+            // A llama session names one of the models this backend has downloaded, so the choice is
+            // that list rather than free text -- a name that is not on disk is a session that
+            // cannot start.
+            if (models.isEmpty()) {
                 Text(
-                        "Loading model choices…",
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                providerModelsError != null ->
-                    Text(
-                        "Model choices unavailable: $providerModelsError",
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.error,
-                    )
-                // A llama session cannot start without one, so this says what to do about it
-                // rather than only that there is nothing -- the models it needs are on the
-                // machine that will serve them, which is not always this backend.
-                providerModels.isEmpty() && isLlama ->
-                    Text(
-                        "No models on ${machine.name}. The Models screen downloads " +
-                            "to the backend; another machine needs the file put there itself.",
+                    "No models downloaded yet. Get one from the Models screen first.",
                     style = MaterialTheme.typography.bodyMedium,
                     color = MaterialTheme.colorScheme.onSurfaceVariant,
                 )
-                providerModels.isEmpty() ->
-                    Text(
-                        "This machine reported no selectable models.",
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                else -> {
-                    Spacer(Modifier.height(16.dp))
+            } else {
                 ChipGroup(
                     label = "Model",
-                        // The label, and the id is what is sent: for a llama model those differ,
-                        // since it is chosen by path and named by what is inside the file.
-                        options = providerModels.map { it.label },
-                        selected = providerModels.firstOrNull { it.id == model }?.label,
-                        onSelect = { chosen ->
-                            val id = providerModels.first { it.label == chosen }.id
-                            // A llama session has to have one, so choosing the same chip twice
-                            // must not clear it -- there is nothing to fall back to.
-                            model = if (model == id && !isLlama) "" else id
-                        },
+                    // The file, not the whole key: the repository is the same for every
+                    // quantisation of a model, so the file name is what tells two of them apart.
+                    options = models.map { it.file },
+                    selected = models.firstOrNull { it.key == modelKey }?.file,
+                    onSelect = { file -> modelKey = models.first { it.file == file }.key },
                 )
             }
-            }
+            Spacer(Modifier.height(16.dp))
+
+            OutlinedTextField(
+                value = contextSize,
+                onValueChange = { contextSize = it },
+                label = { Text("Context size (blank = the model's default)") },
+                singleLine = true,
+                modifier = Modifier.fillMaxWidth(),
+            )
+            Spacer(Modifier.height(16.dp))
+
+            OutlinedTextField(
+                value = temperature,
+                onValueChange = { temperature = it },
+                label = { Text("Temperature (blank = llama.cpp's default)") },
+                singleLine = true,
+                modifier = Modifier.fillMaxWidth(),
+            )
             Spacer(Modifier.height(16.dp))
         }
 
-        if (isCodingCli) {
-            // Free text as well as the chips above: the catalog is a shortcut, and a CLI will
-            // take a name it did not list.
-            LabelledField(
+        if (isClaude) {
+            if (current.models.isNotEmpty()) {
+                Spacer(Modifier.height(16.dp))
+                ChipGroup(
                     label = "Model",
+                    options = current.models,
+                    selected = model.ifEmpty { null },
+                    onSelect = { chosen -> model = if (model == chosen) "" else chosen },
+                )
+            }
+            Spacer(Modifier.height(8.dp))
+            OutlinedTextField(
                 value = model,
                 onValueChange = { model = it },
-                hint = "the CLI's default",
+                label = { Text("Model (blank = the CLI's default)") },
+                singleLine = true,
+                modifier = Modifier.fillMaxWidth(),
             )
             Spacer(Modifier.height(16.dp))
-        }
 
-        // Nothing is running yet, so nothing here waits for a restart -- every one of these is
-        // read by the process this form is about to start.
-        ProviderParamFields(
-            specs = current?.params.orEmpty(),
-            values = params,
-            onChange = { params = it },
-            // Chips, like every other choice on this form.
-            choices = ChoiceStyle.Chips,
-        )
-
-        // Every session whose tools act on files needs one, which is both kinds that have
-        // tools -- a llama session's built-in tools run in it exactly as a CLI's do.
-        if (takesCwd) {
-            LabelledField(
-                label = "Working directory",
+            OutlinedTextField(
                 value = cwd,
                 onValueChange = { cwd = it },
-                hint = "wherever the session's process starts",
+                label = { Text("Working directory") },
+                placeholder = { Text("/home/…") },
+                singleLine = true,
+                modifier = Modifier.fillMaxWidth(),
             )
             Spacer(Modifier.height(16.dp))
-        }
 
-        // Offered wherever the provider has modes, rather than where this screen believes it
-        // does: the server is what knows, and llama.cpp grew them without this line changing.
-        if (current != null && current.permissionModes.isNotEmpty()) {
             ChipGroup(
                 label = "Permissions",
-                options = current.permissionModes,
+                options = PERMISSION_MODES,
                 selected = permissionMode,
                 onSelect = { permissionMode = it },
             )
-            Spacer(Modifier.height(16.dp))
-        }
-
-        if (isCodingCli) {
-            // Says what it does to *later* spawns as well, because it does: the level chosen here
-            // is stored as the default, which is the whole way that default is set. A picker that
-            // quietly changed a global would be the same control with the fact left out.
-            ChipGroup(
-                label = "Thinking (kept as the default for new sessions)",
-                options = listOf(DEFAULT_EFFORT) + EFFORT_LEVELS,
-                // The CLI's own default is a level in the list, so this cannot be a one-way trip.
-                // Disabled-looking until the server has answered, for the reason above.
-                selected = if (defaultsAsked) effort ?: DEFAULT_EFFORT else null,
-                onSelect = { chosen -> effort = chosen.takeIf { it != DEFAULT_EFFORT } },
-            )
         }
         Spacer(Modifier.height(24.dp))
 
@@ -337,29 +268,33 @@ fun SpawnScreen(
                     try {
                         val spawned =
                             withContext(Dispatchers.IO) {
-                                // Stored before the spawn and not after it: choosing a level is
-                                // an intent about new sessions in general, so a spawn that then
-                                // fails must not also lose the choice. Non-fatal for the same
-                                // reason the fetch above is -- the session is what was asked for.
-                                if (isCodingCli) {
-                                    runCatching { setDefaultEffort(settings, effort) }
-                                }
                                 spawnSession(
                                     settings,
                                     // The id, not the label: labels are editable and the server
                                     // resolves by id. Non-null here, since `chosen` came from
-                                    // `machine`'s own provider list.
-                                    machine = machine.id,
+                                    // `setup`'s own provider list.
+                                    setup = setup.id,
                                     provider = chosen.name,
                                     title = title.trim(),
-                                    model = model.trim().takeIf { offersModels },
-                                    cwd = cwd.trim().takeIf { takesCwd },
-                                    permissionMode = permissionMode.takeIf { it.isNotEmpty() },
-                                    effort = effort.takeIf { isCodingCli },
-                                    // Already only the keys somebody set: a field left blank
-                                    // removes its key rather than sending an empty value, so
-                                    // "blank" reaches the server as "your default".
-                                    params = params,
+                                    model =
+                                        if (isLlama) modelKey else model.trim().takeIf { isClaude },
+                                    cwd = cwd.trim().takeIf { isClaude },
+                                    permissionMode = permissionMode.takeIf { isClaude },
+                                    // Sent only when set, so blank means "whatever llama.cpp does
+                                    // by default" rather than a zero.
+                                    params =
+                                        buildMap {
+                                            if (isLlama) {
+                                                contextSize
+                                                    .trim()
+                                                    .takeIf { it.isNotEmpty() }
+                                                    ?.let { put("contextSize", it) }
+                                                temperature
+                                                    .trim()
+                                                    .takeIf { it.isNotEmpty() }
+                                                    ?.let { put("temperature", it) }
+                                            }
+                                        },
                                 )
                             }
                         onSpawned(spawned)
@@ -369,8 +304,7 @@ fun SpawnScreen(
                     }
                 }
             },
-            // A llama session names the file to load, so there is nothing to spawn without one.
-            enabled = !busy && current != null && !(isLlama && model.isEmpty()),
+            enabled = !busy && current != null && !(isLlama && modelKey == null),
         ) {
             Text(if (busy) "Spawning..." else "Spawn")
         }

app/androidApp/src/main/kotlin/com/example/aiapp/SubagentPanel.kt

@@ -1,335 +0,0 @@
-package com.example.aiapp
-
-import androidx.activity.compose.BackHandler
-import androidx.compose.foundation.ExperimentalFoundationApi
-import androidx.compose.foundation.combinedClickable
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.heightIn
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.width
-import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.material3.AlertDialog
-import androidx.compose.material3.CardDefaults
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.LocalContentColor
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedCard
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableIntStateOf
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.unit.dp
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-/**
- * What a session has running beside the turn you are reading: its background tasks, then its
- * subagents, in the panel [SidePanels] slides over it from the right.
- *
- * [active] is whether the panel is being looked at: the lists are fetched then rather than on
- * composition, since the panel is composed for every session whether or not anybody opens it.
- *
- * [onOpenCall] takes the reader to where a background task was started, in the transcript under
- * this panel -- so the panel is closed with it, which is the caller's to do.
- *
- * [backgroundTasks] is the live count from the session's own event stream, and is what the
- * background list is refetched against: a card for work that has since finished is a stale
- * measurement drawn as a current one, which is the one thing a list of what is running now must not
- * do.
- *
- * Both lists are items of one lazy column rather than two stacked scrollers, so expanding the
- * background section pushes the subagents down without either being able to run off the panel.
- */
-@Composable
-fun SubagentPanel(
-    settings: ServerSettings,
-    summary: SessionSummary,
-    active: Boolean,
-    backgroundTasks: Int,
-    onOpenSubagent: (SubagentSummary) -> Unit,
-    onOpenCall: (CallSite) -> Unit,
-) {
-    val scope = rememberCoroutineScope()
-    val context = LocalContext.current
-    val transcriptCache = remember(settings) { TranscriptCache(cacheRoot(context, settings)) }
-    var rows by
-        remember(summary.id) { mutableStateOf<LoadState<List<SubagentSummary>>>(LoadState.Loading) }
-    var selected by remember(summary.id) { mutableStateOf(setOf<String>()) }
-    var deleting by remember(summary.id) { mutableStateOf(setOf<String>()) }
-    var deleteError by remember(summary.id) { mutableStateOf<String?>(null) }
-    var confirming by remember(summary.id) { mutableStateOf<List<SubagentSummary>?>(null) }
-    var refreshToken by remember(summary.id) { mutableIntStateOf(0) }
-    var background by
-        remember(summary.id) {
-            mutableStateOf<LoadState<List<BackgroundTaskSummary>?>>(LoadState.Loading)
-        }
-    var backgroundExpanded by remember(summary.id) { mutableStateOf(false) }
-
-    LaunchedEffect(active, refreshToken) {
-        if (!active) return@LaunchedEffect
-        rows = LoadState.Loading
-        rows =
-            try {
-                val fetched = withContext(Dispatchers.IO) { fetchSubagents(settings, summary.id) }
-                selected = selected intersect fetched.mapTo(mutableSetOf()) { it.id }
-                LoadState.Loaded(fetched)
-            } catch (e: ApiException) {
-                LoadState.failed(e)
-            }
-    }
-
-    // No reset to Loading on a refetch: the spinner belongs to the first fetch, and one flashed
-    // over the list at every start and end would blink precisely when something happened.
-    LaunchedEffect(active, backgroundTasks, refreshToken) {
-        if (!active || backgroundTasks == 0) return@LaunchedEffect
-        background =
-            try {
-                LoadState.Loaded(
-                    withContext(Dispatchers.IO) { fetchBackgroundTasks(settings, summary.id) }
-                )
-            } catch (e: ApiException) {
-                LoadState.failed(e)
-            }
-    }
-
-    BackHandler(enabled = selected.isNotEmpty()) { selected = emptySet() }
-
-    val ordered = (rows as? LoadState.Loaded)?.value?.let(::subagentOrder)
-
-    Column(Modifier.fillMaxSize()) {
-        LazyColumn(
-            verticalArrangement = Arrangement.spacedBy(8.dp),
-            modifier = Modifier.weight(1f).padding(horizontal = 16.dp),
-        ) {
-            backgroundTaskSection(
-                count = backgroundTasks,
-                tasks = background,
-                expanded = backgroundExpanded,
-                onToggle = { backgroundExpanded = !backgroundExpanded },
-                onRetry = { refreshToken++ },
-                onOpenCall = onOpenCall,
-            )
-            item(key = "subagents-heading") { PanelSectionHeading("Subagents") }
-            when (val state = rows) {
-                is LoadState.Loading ->
-                    item(key = "subagents-loading") {
-                        CircularProgressIndicator(modifier = Modifier.width(24.dp).height(24.dp))
-                    }
-                is LoadState.Error ->
-                    item(key = "subagents-error") {
-                        Column {
-                            Text(
-                                state.message,
-                                color = MaterialTheme.colorScheme.error,
-                                style = MaterialTheme.typography.bodySmall,
-                            )
-                            TextButton(onClick = { refreshToken++ }) { Text("Try again") }
-                        }
-                    }
-                is LoadState.Loaded ->
-                    if (ordered.isNullOrEmpty()) {
-                        item(key = "subagents-empty") {
-                            Text(
-                                "No subagents in this session.",
-                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                                style = MaterialTheme.typography.bodyMedium,
-                            )
-                        }
-                    } else {
-                        uniqueItems(ordered, key = { it.id }) { subagent ->
-                            SubagentCard(
-                                subagent = subagent,
-                                selected = subagent.id in selected,
-                                selecting = selected.isNotEmpty(),
-                                deleting = subagent.id in deleting,
-                                onClick = { onOpenSubagent(subagent) },
-                                onSelect = {
-                                    selected =
-                                        if (subagent.id in selected) selected - subagent.id
-                                        else selected + subagent.id
-                                },
-                            )
-                        }
-                    }
-            }
-        }
-
-        if (selected.isNotEmpty()) {
-            val picked = ordered.orEmpty().filter { it.id in selected }
-            SubagentSelectionBar(
-                picked = picked,
-                onDelete = { confirming = picked },
-                modifier = Modifier.padding(horizontal = 16.dp),
-            )
-        }
-        deleteError?.let {
-            Text(
-                it,
-                color = MaterialTheme.colorScheme.error,
-                style = MaterialTheme.typography.bodySmall,
-                modifier = Modifier.padding(horizontal = 16.dp, vertical = 8.dp),
-            )
-        }
-    }
-
-    confirming?.let { picked ->
-        AlertDialog(
-            onDismissRequest = { confirming = null },
-            title = {
-                Text(
-                    if (picked.size == 1) "Delete this subagent?"
-                    else "Delete ${picked.size} subagents?"
-                )
-            },
-            text = {
-                Text(
-                    (if (picked.size == 1) "\"${picked.first().title}\"\n\n" else "") +
-                        "A subagent's transcript is the only record of what it did: the session " +
-                        "that started it kept just the Task call. Nothing else has a copy, so " +
-                        "this can't be undone. The session itself is untouched."
-                )
-            },
-            confirmButton = {
-                TextButton(
-                    onClick = {
-                        confirming = null
-                        selected = emptySet()
-                        val ids = picked.map { it.id }
-                        val gone = ids.toSet()
-                        deleting += gone
-                        deleteError = null
-                        scope.launch {
-                            try {
-                                withContext(Dispatchers.IO) {
-                                    deleteSubagents(settings, summary.id, ids)
-                                    gone.forEach {
-                                        transcriptCache
-                                            .session(TranscriptAddress(summary.id, it))
-                                            .purge()
-                                    }
-                                }
-                                val loaded = rows
-                                if (loaded is LoadState.Loaded) {
-                                    rows =
-                                        LoadState.Loaded(loaded.value.filterNot { it.id in gone })
-                                }
-                            } catch (e: ApiException) {
-                                deleteError = e.message ?: "Delete failed"
-                            } finally {
-                                deleting -= gone
-                            }
-                        }
-                    }
-                ) {
-                    Text("Delete", color = MaterialTheme.colorScheme.error)
-                }
-            },
-            dismissButton = { TextButton(onClick = { confirming = null }) { Text("Cancel") } },
-        )
-    }
-}
-
-private fun subagentOrder(rows: List<SubagentSummary>): List<SubagentSummary> =
-    rows.sortedWith(
-        compareByDescending<SubagentSummary> { it.status == "running" }
-            .thenByDescending { it.lastActivity }
-    )
-
-@OptIn(ExperimentalFoundationApi::class)
-@Composable
-private fun SubagentCard(
-    subagent: SubagentSummary,
-    selected: Boolean,
-    selecting: Boolean,
-    deleting: Boolean,
-    onClick: () -> Unit,
-    onSelect: () -> Unit,
-) {
-    BusyItem(label = if (deleting) "deleting" else null) {
-        OutlinedCard(
-            colors =
-                if (selected)
-                    CardDefaults.outlinedCardColors(
-                        containerColor = MaterialTheme.colorScheme.secondaryContainer,
-                        contentColor = MaterialTheme.colorScheme.onSecondaryContainer,
-                    )
-                else CardDefaults.outlinedCardColors(),
-            modifier =
-                Modifier.fillMaxWidth()
-                    .combinedClickable(
-                        enabled = !deleting,
-                        onClick = { if (selecting) onSelect() else onClick() },
-                        onLongClick = onSelect,
-                    ),
-        ) {
-            Column(Modifier.padding(horizontal = 12.dp, vertical = 8.dp)) {
-                Text(subagent.title, style = MaterialTheme.typography.titleSmall)
-                Spacer(Modifier.height(2.dp))
-                Row(Modifier.fillMaxWidth()) {
-                    Text(
-                        subagentStatusLabel(subagent.status),
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        modifier = Modifier.weight(1f),
-                    )
-                    Text(
-                        relativeTime(subagent.lastActivity),
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-            }
-        }
-    }
-}
-
-@Composable
-private fun SubagentSelectionBar(
-    picked: List<SubagentSummary>,
-    onDelete: () -> Unit,
-    modifier: Modifier = Modifier,
-) {
-    val running = picked.count { it.status == "running" }
-    Row(
-        verticalAlignment = Alignment.CenterVertically,
-        modifier = modifier.fillMaxWidth().heightIn(min = 48.dp),
-    ) {
-        Text(
-            if (running == 0) "${picked.size} selected" else "$running still running",
-            style = MaterialTheme.typography.bodySmall,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
-            modifier = Modifier.weight(1f),
-        )
-        TextButton(onClick = onDelete, enabled = running == 0) {
-            Text(
-                "Delete",
-                color =
-                    if (running == 0) MaterialTheme.colorScheme.error
-                    else LocalContentColor.current,
-            )
-        }
-    }
-}
-
-private fun subagentStatusLabel(status: String) =
-    when (status) {
-        "running" -> "running"
-        "exited" -> "finished"
-        else -> "unknown"
-    }

app/androidApp/src/main/kotlin/com/example/aiapp/Theme.kt

@@ -134,20 +134,6 @@ val clearedColor: Color
 val awaitingColor: Color
     @Composable get() = Mocha.Peach
 
-/**
- * Waiting on itself: the session's turn is over, but a subagent or a backgrounded command it
- * started is still going, and it will speak again with nobody having typed anything.
- *
- * Its own colour rather than [awaitingColor], which is the opposite state -- that one means the
- * reader has something to do, and this one means they specifically do not. Not [runningColor]
- * either: nothing is being written, and a green "running" on a session that will say nothing for
- * ten minutes is the wrong promise. Blue for the same reason [commandColor] is blue -- not stuck,
- * but not replying to you either -- and a different blue because that one is the session acting on
- * itself rather than getting on with what was asked.
- */
-val waitingColor: Color
-    @Composable get() = Mocha.Sky
-
 /** Approaching a limit -- still fine, worth seeing. */
 val warningColor: Color
     @Composable get() = Mocha.Yellow
@@ -213,8 +199,6 @@ val rawSurface: Color
  */
 fun catppuccinSyntax(): SyntaxPalette =
     SyntaxPalette(
-        addition = Mocha.Green,
-        deletion = Mocha.Red,
         keyword = Mocha.Mauve,
         string = Mocha.Green,
         literal = Mocha.Peach,

app/androidApp/src/main/kotlin/com/example/aiapp/ThinkingCard.kt

@@ -1,87 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.width
-import androidx.compose.material3.Card
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.CompositionLocalProvider
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.unit.dp
-
-/**
- * A model's working, shut until somebody asks for it.
- *
- * Shut by default, like a tool call and a memory note and for the same reason: it is not what the
- * session said, and left open it puts the reasoning between the question and the answer -- which on
- * a small model is most of the conversation.
- *
- * The heading is the whole of what the reader gets for free, so it carries the one thing worth
- * knowing without opening anything: whether this is still going, and if not how long it took. A
- * spinner while it runs, because that is the same fact a running command reports and it is drawn
- * the same way here.
- */
-@Composable
-fun ThinkingCard(
-    item: TranscriptItem.ThinkingRow,
-    replies: ParsedReplies,
-    expanded: Boolean,
-    onToggle: () -> Unit,
-    modifier: Modifier = Modifier,
-) {
-    Card(modifier.fillMaxWidth().clickable(onClick = onToggle)) {
-        Column(Modifier.padding(12.dp)) {
-            Row(verticalAlignment = Alignment.CenterVertically) {
-                Text(thinkingHeadline(item), style = MaterialTheme.typography.titleSmall)
-                Spacer(Modifier.width(8.dp))
-                if (item.open) {
-                    CircularProgressIndicator(
-                        modifier = Modifier.width(16.dp).height(16.dp),
-                        strokeWidth = 2.dp,
-                    )
-                }
-            }
-            // Markdown, like every other thing the model wrote: a model reasons in the same
-            // lists, headings and fenced code it answers in, and drawn plainly those arrive as
-            // rows of hashes and asterisks around the working the reader opened the card to read.
-            // Still arriving means the incremental parse -- see [MarkdownText] -- since an open
-            // block gains a delta at a time.
-            //
-            // The words shut the card too, and have to do it themselves -- see [LocalMarkdownTap].
-            if (expanded) {
-                CompositionLocalProvider(LocalMarkdownTap provides rememberMarkdownTap(onToggle)) {
-                    MarkdownText(
-                        item.text,
-                        replies,
-                        Modifier.padding(top = 6.dp),
-                        live = item.open,
-                    )
-                }
-            }
-        }
-    }
-}
-
-/**
- * "Thinking", "Thought for 12.4s", or "Thought".
- *
- * The third is the one worth keeping: a block whose turn ended before the model said anything --
- * interrupted, stopped, a process that exited -- was thought about for a length of time nobody
- * measured. Naming a span there would be this screen inventing one, and the reader has no way to
- * tell an invented one from the rest.
- */
-fun thinkingHeadline(item: TranscriptItem.ThinkingRow): String =
-    when {
-        item.open -> "Thinking"
-        item.ms != null -> "Thought for ${formatMillis(item.ms)}"
-        else -> "Thought"
-    }

app/androidApp/src/main/kotlin/com/example/aiapp/ToolInput.kt

@@ -1,6 +1,9 @@
 package com.example.aiapp
 
+import androidx.compose.foundation.horizontalScroll
+import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
@@ -48,31 +51,24 @@ data class ToolInput(
 private val SUBJECTS: Map<String, Pair<String, Language?>> =
     mapOf(
         "Bash" to ("command" to Language.SHELL),
-        "Shell" to ("command" to Language.SHELL),
-        "Patch" to ("diff" to Language.DIFF),
         "Read" to ("file_path" to null),
         "Write" to ("file_path" to null),
         "Edit" to ("file_path" to null),
         "Glob" to ("pattern" to null),
         "Grep" to ("pattern" to null),
         "WebFetch" to ("url" to null),
-        "WebSearch" to ("query" to null),
-        // Persisted transcripts keep the provider vocabulary they were written with.
-        "web_search" to ("query" to null),
     )
 
 /** Fields that are the tool's own prose about itself rather than input to it. */
 private val DESCRIPTIONS = listOf("description", "prompt")
 
 fun parseToolInput(tool: String, input: String): ToolInput {
-    if (input.trim() == "null") return ToolInput(null, null, null, null, emptyList())
     val json =
         try {
             JSONObject(input)
         } catch (_: org.json.JSONException) {
             // Not an object: older transcripts and some tools send a bare string. It is still the
-            // input, so it is still shown. JSON null is the one exception: it means the call had
-            // no input, and drawing the word makes an absent value look like an instruction.
+            // input, so it is still shown.
             return ToolInput(
                 null,
                 null,
@@ -82,20 +78,15 @@ fun parseToolInput(tool: String, input: String): ToolInput {
             )
         }
     val (subjectKey, language) = SUBJECTS[tool] ?: (null to null)
-    val subject =
-        subjectKey
-            ?.let { json.text(it) }
-            ?.takeIf { it.isNotBlank() }
-            ?.let { if (tool == "Bash") renderedBashScript(it) ?: it else it }
+    val subject = subjectKey?.let { json.optString(it) }?.takeIf { it.isNotBlank() }
     val description = DESCRIPTIONS.firstNotNullOfOrNull {
-        json.text(it)?.takeIf { value -> value.isNotBlank() }
+        json.optString(it).takeIf { v -> v.isNotBlank() }
     }
-    val timeout = json.text("timeout")?.takeIf { it.isNotBlank() }?.let { formatMillisText(it) }
+    val timeout = json.optString("timeout").takeIf { it.isNotBlank() }?.let { formatMillisText(it) }
     val rest =
         json
             .keys()
             .asSequence()
-            .filterNot(json::isNull)
             .filter { it != subjectKey || subject == null }
             .filter { it !in DESCRIPTIONS || description == null }
             .filter { it != "timeout" || timeout == null }
@@ -105,31 +96,6 @@ fun parseToolInput(tool: String, input: String): ToolInput {
     return ToolInput(subject, language, description, timeout, rest)
 }
 
-private fun JSONObject.text(key: String): String? =
-    if (isNull(key)) null else optString(key).takeIf { it.isNotEmpty() }
-
-/**
- * Removes Codex's rendered Bash argv from old transcript rows.
- *
- * New events arrive normalized by the server, but persisted transcripts keep the input originally
- * written to them. Only the outer pair are presentation quoting: quotes inside the command belong
- * to the command and must not be parsed as an early end delimiter.
- */
-internal fun renderedBashScript(command: String): String? {
-    val prefix =
-        listOf("/usr/bin/bash -lc ", "/bin/bash -lc ", "bash -lc ").firstOrNull {
-            command.startsWith(it)
-        } ?: return null
-    val quoted = command.removePrefix(prefix)
-    return quoted
-        .takeIf {
-            it.length >= 2 &&
-                ((it.startsWith('\'') && it.endsWith('\'')) ||
-                    (it.startsWith('"') && it.endsWith('"')))
-        }
-        ?.substring(1, quoted.lastIndex)
-}
-
 /**
  * A tool call's input: its subject highlighted, then whatever else it carried.
  *
@@ -147,8 +113,7 @@ fun ToolInputView(tool: String, input: String, modifier: Modifier = Modifier) {
     RawBlock(modifier) {
         parsed.subject?.let { subject ->
             // Not wrapped: a wrapped command hides where its arguments end, and the long one is the
-            // one being read closely. The sideways scroll that makes that readable is the block's,
-            // shared with the lines below -- see [RawBlock].
+            // one being read closely.
             Text(
                 // Not cached: a tool's subject is one command line, which lexes in microseconds --
                 // the cache exists for a fence with two hundred lines in it.
@@ -156,6 +121,7 @@ fun ToolInputView(tool: String, input: String, modifier: Modifier = Modifier) {
                 style = MaterialTheme.typography.bodySmall,
                 fontFamily = FontFamily.Monospace,
                 softWrap = false,
+                modifier = Modifier.fillMaxWidth().horizontalScroll(rememberScrollState()),
             )
         }
         parsed.rest.forEach {
@@ -164,7 +130,6 @@ fun ToolInputView(tool: String, input: String, modifier: Modifier = Modifier) {
                 style = MaterialTheme.typography.bodySmall,
                 fontFamily = FontFamily.Monospace,
                 color = MaterialTheme.colorScheme.onSurfaceVariant,
-                softWrap = false,
                 modifier = Modifier.padding(top = 2.dp),
             )
         }

app/androidApp/src/main/kotlin/com/example/aiapp/ToolRows.kt

@@ -27,9 +27,6 @@ import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
 import androidx.compose.ui.graphics.Shape
-import androidx.compose.ui.layout.onPlaced
-import androidx.compose.ui.layout.onSizeChanged
-import androidx.compose.ui.layout.positionInRoot
 import androidx.compose.ui.platform.LocalDensity
 import androidx.compose.ui.semantics.contentDescription
 import androidx.compose.ui.semantics.semantics
@@ -64,9 +61,7 @@ sealed class TranscriptRow {
      *
      * A tool row therefore keys on [TranscriptItem.ToolRun.runId] rather than on a sequence number,
      * and it is the *same* value whether the run is drawn as one card or as a group. Which value
-     * that is belongs to the item ([TranscriptItem.key]) everywhere a row is one thing; where
-     * [groupRuns] cuts a run into several rows it is the one deciding, and it says so by handing
-     * each piece its key.
+     * that is belongs to the item ([TranscriptItem.key]), not to a `when` here.
      */
     abstract val key: Any
 
@@ -80,15 +75,23 @@ sealed class TranscriptRow {
      */
     abstract val startSeq: Long
 
-    data class Single(val item: TranscriptItem, override val key: Any = item.key) :
-        TranscriptRow() {
+    data class Single(val item: TranscriptItem) : TranscriptRow() {
+        override val key: Any
+            get() = item.key
+
         override val startSeq: Long
             get() = item.seq
     }
 
     /** Two or more calls with nothing between them; drawn as one collapsed card. */
-    data class Tools(val calls: List<TranscriptItem.ToolRun>, override val key: String) :
-        TranscriptRow() {
+    data class Tools(val calls: List<TranscriptItem.ToolRun>) : TranscriptRow() {
+        /** The run's own name, which every call in it already carries. */
+        val id: String
+            get() = calls.first().runId
+
+        override val key: Any
+            get() = id
+
         override val startSeq: Long
             get() = calls.first().seq
     }
@@ -99,75 +102,33 @@ sealed class TranscriptRow {
  *
  * A single call is left alone: "Called 1 tool" hides a card to say the same thing in more words,
  * and the run this exists for is the burst of five greps nobody wants to scroll past.
- *
- * The last call is left alone too, and so is one still running wherever in its run it sits. What
- * the session is doing, or did last, is the one thing worth seeing without opening anything, and a
- * heading counting it hides it. What folds a call back into its run is therefore not finishing but
- * being overtaken: anything arriving behind it, a reply included, makes it history.
- *
- * [heldOut] is the one thing being read can change, and only in that direction: a call standing on
- * its own that somebody is reading is not overtaken while they read it. Opening a call *already*
- * inside a group does not pull it out (2026-09-16, after it briefly did) -- it is visible where it
- * is, and grouping is what gives a row its identity, so a rule that reads the open set both ways
- * makes the reader's own tap rebuild the rows around it: three rows became one the moment a call
- * was closed, and no anchor survives a row that no longer exists -- the list jumped by 450px and
- * took the closed card with it. Which calls are held out is [SessionScreen]'s to say, since being
- * inside a group once is what settles it.
  */
-fun groupToolRuns(
-    items: List<TranscriptItem>,
-    heldOut: Set<String> = emptySet(),
-): List<TranscriptRow> = DebugStats.timed("grouped tool runs") { groupRuns(items, heldOut) }
+fun groupToolRuns(items: List<TranscriptItem>): List<TranscriptRow> =
+    DebugStats.timed("grouped tool runs") { groupRuns(items) }
 
-private fun groupRuns(items: List<TranscriptItem>, heldOut: Set<String>): List<TranscriptRow> {
+private fun groupRuns(items: List<TranscriptItem>): List<TranscriptRow> {
     val rows = mutableListOf<TranscriptRow>()
     var run = mutableListOf<TranscriptItem.ToolRun>()
-    // A run can occupy more than one non-adjacent piece, so claimed keys span the whole transcript
-    // rather than resetting at each piece.
-    var runId: String? = null
-    val claimedKeys = mutableSetOf<String>()
 
     fun flush() {
-        val first = run.firstOrNull() ?: return
-        // The first piece keeps the run's name, which survives a page landing in front of it
-        // ([adoptRun]). Later pieces qualify that name with their first call; the suffix is the
-        // final guard because a duplicate LazyColumn key takes down the whole screen.
-        var key = first.runId
-        if (!claimedKeys.add(key)) {
-            key = "${first.runId}/${first.id}"
-            var suffix = 2
-            while (!claimedKeys.add(key)) {
-                key = "${first.runId}/${first.id}/${suffix++}"
+        when (run.size) {
+            0 -> {}
+            1 -> rows += TranscriptRow.Single(run.first())
+            else -> rows += TranscriptRow.Tools(run.toList())
         }
-        }
-        rows +=
-            if (run.size == 1) TranscriptRow.Single(first, key)
-            else TranscriptRow.Tools(run.toList(), key)
         run = mutableListOf()
     }
 
-    items.forEachIndexed { index, item ->
+    items.forEach { item ->
         // Grouped by the run each call says it belongs to, not by adjacency worked out here.
         // Adjacency is the same answer most of the time and a worse one at the edges: a call
         // arriving next to an existing run, or a page of history arriving in front of one, both
         // change which call is *first*.
-        val call = item as? TranscriptItem.ToolRun
-        if (call == null || call.runId != runId) {
+        if (item is TranscriptItem.ToolRun && (run.isEmpty() || run.first().runId == item.runId)) {
+            run += item
+        } else {
             flush()
-            runId = call?.runId
-        }
-        when {
-            call == null -> rows += TranscriptRow.Single(item)
-            // Standing outside the run is the call's place in the list as it is now, not something
-            // recorded on the call: the same finished call is a row of its own while it is the last
-            // thing that happened, or open and never yet grouped, and part of its group once a
-            // reply lands behind it.
-            call.done && call.id !in heldOut && index != items.lastIndex -> run += call
-            else -> {
-                flush()
-                run += call
-                flush()
-            }
+            if (item is TranscriptItem.ToolRun) run += item else rows += TranscriptRow.Single(item)
         }
     }
     flush()
@@ -199,15 +160,7 @@ fun ToolGroup(
      */
     onToggle: () -> Unit,
     isToolExpanded: (String) -> Boolean,
-    /**
-     * Toggles one call, and says where in the group it was drawn: how far down the group's own top
-     * edge its card begins, and how tall that card is now.
-     *
-     * The screen anchors on *rows*, and a call is not one -- but what the reader is opening or
-     * shutting is the call, and keeping it under their finger needs its place inside the row. Only
-     * the group knows that, so only the group can say it. See `SessionScreen`'s `toggleAnchored`.
-     */
-    onToolToggle: (id: String, top: Int, height: Int) -> Unit,
+    onToolToggle: (String) -> Unit,
     onAnswer: (List<QuestionAnswer>, onSettled: () -> Unit) -> Unit,
     image: @Composable (String) -> Unit,
 ) {
@@ -222,10 +175,8 @@ fun ToolGroup(
         }
         return
     }
-    val placed = remember { Placed() }
     Column(
         Modifier.fillMaxWidth()
-            .onPlaced { placed.top = it.positionInRoot().y }
             .clip(MaterialTheme.shapes.medium)
             .background(MaterialTheme.colorScheme.surfaceContainerLow)
     ) {
@@ -245,19 +196,13 @@ fun ToolGroup(
             verticalArrangement = Arrangement.spacedBy(GROUP_GAP),
         ) {
             group.calls.forEachIndexed { index, call ->
-                val card = remember(call.id) { Placed() }
                 ToolCard(
                     tool = call,
                     expanded = isToolExpanded(call.id),
-                    onToggle = {
-                        onToolToggle(call.id, (card.top - placed.top).toInt(), card.height)
-                    },
+                    onToggle = { onToolToggle(call.id) },
                     onAnswer = onAnswer,
                     image = image,
                     shape = connectedShape(index, group.calls.size),
-                    modifier =
-                        Modifier.onPlaced { card.top = it.positionInRoot().y }
-                            .onSizeChanged { card.height = it.height },
                 )
             }
         }
@@ -267,18 +212,6 @@ fun ToolGroup(
     }
 }
 
-/**
- * Where something was last placed, in the window's coordinates, and how tall it was.
- *
- * Deliberately not snapshot state: it is written from the layout phase, and a write there that
- * composition reads would schedule another recomposition of every group on screen, every frame.
- * Nothing reads it except the gesture that follows.
- */
-private class Placed {
-    var top = 0f
-    var height = 0
-}
-
 /**
  * The height of a group's heading, and so of the bar at its foot.
  *
@@ -360,17 +293,14 @@ fun ToolCard(
     image: @Composable (String) -> Unit = {},
     /** Square where this card faces another in a group; see [connectedShape]. */
     shape: Shape = CardDefaults.shape,
-    modifier: Modifier = Modifier,
 ) {
     val parsed = remember(tool.tool, tool.input) { parseToolInput(tool.tool, tool.input) }
-    val name = toolDisplayName(tool.tool)
-    val output = toolDisplayOutput(tool.tool, tool.output)
     val deciding = tool.asks.any { it.answers.isEmpty() }
     val open = expanded || deciding
-    Card(modifier.fillMaxWidth().clickable(onClick = onToggle), shape = shape) {
+    Card(Modifier.fillMaxWidth().clickable(onClick = onToggle), shape = shape) {
         Column(Modifier.padding(GROUP_INSET_LARGE)) {
             Row(verticalAlignment = Alignment.CenterVertically) {
-                Text(name, style = MaterialTheme.typography.titleSmall)
+                Text(tool.tool, style = MaterialTheme.typography.titleSmall)
                 if (open) {
                     Spacer(Modifier.weight(1f))
                     parsed.timeout?.let {
@@ -425,26 +355,24 @@ fun ToolCard(
                 if (tool.tool != ASK_USER_QUESTION) {
                     ToolInputView(tool.tool, tool.input, Modifier.padding(top = 4.dp))
                 }
-                if (output.isNotEmpty()) {
+                if (tool.output.isNotEmpty()) {
                     Spacer(Modifier.height(8.dp))
                     Text("Output", style = MaterialTheme.typography.labelSmall)
                     // What the tool printed, on the surface everything verbatim gets and in the
                     // face it was written for: this is column-aligned far more often than it is
                     // prose, and a proportional font silently destroys the alignment that carried
-                    // the meaning. Unwrapped for the same reason, and scrolled sideways by the
-                    // block around it -- see [RawBlock].
+                    // the meaning.
                     //
                     // Its terminal styling applied and the rest of the escapes taken out: colour is
                     // often the whole of what a diff or a test run is saying. Remembered against
                     // the text, so a card that is open through a scroll parses once.
                     val palette = remember { ansiPalette() }
-                    val styled = remember(output, palette) { ansiStyled(output, palette) }
+                    val styled = remember(tool.output, palette) { ansiStyled(tool.output, palette) }
                     RawBlock(Modifier.padding(top = 2.dp)) {
                         Text(
                             styled,
                             style = MaterialTheme.typography.bodySmall,
                             fontFamily = FontFamily.Monospace,
-                            softWrap = false,
                         )
                     }
                 }
@@ -463,22 +391,6 @@ fun ToolCard(
     }
 }
 
-private val collaborationToolNames =
-    mapOf(
-        "Task" to "Spawn agent",
-        "TaskOutput" to "Wait for agents",
-        "SendMessage" to "Message agent",
-        "CloseAgent" to "Close agent",
-        "InterruptAgent" to "Interrupt agent",
-        "ListAgents" to "List agents",
-        "ResumeAgent" to "Resume agent",
-    )
-
-internal fun toolDisplayName(tool: String): String = collaborationToolNames[tool] ?: tool
-
-internal fun toolDisplayOutput(tool: String, output: String): String =
-    if (tool in collaborationToolNames && output == "completed") "" else output
-
 /**
  * The permission ask on the call it is about.
  *

app/androidApp/src/main/kotlin/com/example/aiapp/TranscriptAddress.kt

@@ -1,27 +0,0 @@
-package com.example.aiapp
-
-/**
- * Where one transcript lives: a session's own, or one of its subagents'.
- *
- * The single mechanism [fetchTranscript], [EventStream], [TranscriptSource] and
- * [TranscriptCache.session] all take, rather than each growing its own branch between a session and
- * a subagent -- see SUBAGENTS.md's "Phone" and "Wire shape". A caller that has only a session id
- * builds one with the one-argument constructor; a subagent's screen supplies both ids.
- */
-data class TranscriptAddress(val sessionId: String, val subagentId: String? = null) {
-    /** The URL segment naming this transcript, before `/transcript` or `/events`. */
-    val urlPath: String
-        get() =
-            if (subagentId == null) "sessions/$sessionId"
-            else "sessions/$sessionId/subagents/$subagentId"
-
-    /**
-     * Where this transcript's cache lives on the phone, relative to the cache root.
-     *
-     * A subagent's nests under its session's directory rather than sitting beside it, so deleting a
-     * session's cache directory takes its subagents' with it -- the same one-way door the server's
-     * own storage describes.
-     */
-    val cachePath: String
-        get() = if (subagentId == null) sessionId else "$sessionId/subagents/$subagentId"
-}

app/androidApp/src/main/kotlin/com/example/aiapp/TranscriptCache.kt

@@ -35,15 +35,8 @@ class TranscriptCache(
     private val root: File,
     private val warn: (String) -> Unit = { Log.w("ai-app", it) },
 ) {
-    /**
-     * The cache for one transcript, whether or not anything has been stored for it yet.
-     *
-     * A subagent's [TranscriptAddress.cachePath] nests it under its session's directory, so
-     * deleting the session (below) takes its subagents' caches with it -- there is no separate
-     * purge for one.
-     */
-    fun session(address: TranscriptAddress): SessionCache =
-        SessionCache(File(root, address.cachePath), warn)
+    /** The cache for one session, whether or not anything has been stored for it yet. */
+    fun session(id: String): SessionCache = SessionCache(File(root, id), warn)
 
     /**
      * Deletes every session directory not in [ids], called after a successful list fetch. The path

app/androidApp/src/main/kotlin/com/example/aiapp/TranscriptItems.kt

@@ -63,45 +63,6 @@ sealed class TranscriptItem {
          * inside that reply would step the list under them.
          */
         val settled: Boolean = false,
-        /** A final value that supersedes provisional deltas behind a page boundary. */
-        val replacesPrefix: Boolean = false,
-        /**
-         * When the reply was sent, in epoch seconds: the time on its newest delta, which is the
-         * moment it finished rather than the moment it started.
-         *
-         * The transcript's own timestamp rather than a clock read here, so every device draws the
-         * same time under the same reply and a replayed page agrees with the live stream.
-         */
-        val ts: Double = 0.0,
-        /**
-         * How fast it was generated, where the provider measured it; null everywhere else.
-         *
-         * Folded on from the turn's usage event rather than carried by the text, because it is not
-         * known until the reply is over.
-         */
-        val tokensPerSecond: Double? = null,
-        /** How long the provider spent reading the prompt, where it measured that. */
-        val prefillMs: Long? = null,
-    ) : TranscriptItem()
-
-    /**
-     * The model's working before -- or between -- the things it said.
-     *
-     * Its own row rather than part of the reply, and deliberately not a [ToolRun]: a run of tool
-     * calls collapses into one card, and folding a model's reasoning into "Called 6 tools" would
-     * file it as one of them. Shut by default, like every other card that is not what was said.
-     *
-     * Three states, because two of them are not the same absence. [open] is a block still being
-     * thought, which is what the spinner is for. A closed one with an [ms] says how long it took; a
-     * closed one without is a block whose turn ended before anything said -- an interrupted reply,
-     * a session stopped mid-thought -- and it says so by not naming a duration rather than by
-     * naming a wrong one.
-     */
-    data class ThinkingRow(
-        override val seq: Long,
-        val text: String,
-        val ms: Long? = null,
-        val open: Boolean = true,
     ) : TranscriptItem()
 
     data class ToolRun(
@@ -182,29 +143,6 @@ sealed class TranscriptItem {
             get() = arrived
     }
 
-    /**
-     * Where one turn ended and the next began with nothing said in between.
-     *
-     * A rule and no words. Two replies meet like this whenever a turn starts without anybody typing
-     * -- a subagent reporting back, a session the CLI picked up by itself -- and drawn with only
-     * the ordinary gap between them they read as one answer with a paragraph break through the
-     * middle of it. What the reader needs is to see that these are two; what started the turn is
-     * somebody else's transcript's business, and a row per background task is a screenful of
-     * dividers about work nobody was asking after.
-     *
-     * Made by the fold rather than sent by the server, because it is not something that happened:
-     * it is the boundary between two things that did. See [foldEvent].
-     */
-    data class TurnBreak(override val seq: Long) : TranscriptItem() {
-        /**
-         * Its own key, because it shares a [seq] with the reply it sits above -- that reply's first
-         * delta is the event this was made at, and a keyed list refuses two items with one key by
-         * taking the app down.
-         */
-        override val key: Any
-            get() = "break$seq"
-    }
-
     /**
      * A command the session ran on itself -- `/compact`, `/rename`. Kept in the transcript rather
      * than only shown while it waits, because it explains what follows: a conversation that
@@ -237,18 +175,6 @@ sealed class TranscriptItem {
         val preTokens: Long?,
         val postTokens: Long?,
     ) : TranscriptItem()
-
-    /**
-     * The account ran out of quota, so the turn stopped here.
-     *
-     * A divider rather than an error: nothing failed, and what a reader scrolling back needs from
-     * it is the same thing a clear or a compaction gives them -- why the conversation stops at this
-     * line.
-     *
-     * [resetsAt] is epoch seconds and null where the session was told nothing, which is a state the
-     * row has words for rather than a time it invents.
-     */
-    data class LimitNote(override val seq: Long, val resetsAt: Double?) : TranscriptItem()
 }
 
 /**
@@ -293,7 +219,7 @@ private fun runIdFor(items: List<TranscriptItem>, id: String, tool: String): Str
  * with the seam wherever the reader happened to have paged.
  */
 fun joinPages(earlier: List<TranscriptItem>, later: List<TranscriptItem>): List<TranscriptItem> {
-    val (older, newer) = healSplitThinking(healSplitMessage(earlier, later))
+    val (older, newer) = healSplitMessage(earlier, later)
     val startedEarlier =
         older.filterIsInstance<TranscriptItem.ToolRun>().mapTo(mutableSetOf()) { it.id }
     val endedLater =
@@ -323,10 +249,9 @@ fun joinPages(earlier: List<TranscriptItem>, later: List<TranscriptItem>): List<
 /**
  * Rejoins a message the page boundary cut, and hands back the two pages to concatenate.
  *
- * [foldEvent] never leaves an *unfinished* assistant message with another behind it inside one
- * page, so an unsettled one at a join is always the far half of the reply the boundary cut, and
- * leaving the two apart drew a single answer as two with a paragraph break through the middle of a
- * sentence. Two settled replies meeting there are two turns and stay two.
+ * [foldEvent] never leaves two assistant messages next to each other inside one page, so two
+ * meeting at a join are always the two halves of one reply, and leaving them apart drew a single
+ * answer as two with a paragraph break through the middle of a sentence.
  *
  * The newer half keeps its identity, for the reason [adoptRun] gives. It grows by what the older
  * half brings, which is safe here and nowhere else -- the join is at the oldest end of what is
@@ -341,36 +266,6 @@ private fun healSplitMessage(
     if (head !is TranscriptItem.AssistantMsg || tail !is TranscriptItem.AssistantMsg) {
         return earlier to later
     }
-    // A settled reply is a whole turn, so the two are two answers that happen to meet at the
-    // boundary rather than one cut in half -- the same distinction the fold makes, and joining them
-    // here would put back exactly the run-together paragraph it stops.
-    // The rule between them is put in here too, since the fold that would have made it never saw
-    // these two side by side.
-    if (head.settled) return earlier to (listOf(TranscriptItem.TurnBreak(tail.seq)) + later)
-    if (tail.replacesPrefix) return earlier.dropLast(1) to later
-    return earlier.dropLast(1) to (listOf(tail.copy(text = head.text + tail.text)) + later.drop(1))
-}
-
-/**
- * Rejoins a thinking block the page boundary cut, the same way [healSplitMessage] rejoins a reply.
- *
- * A block streams a fragment at a time exactly as a reply does, so a boundary lands inside one as
- * readily. The older half then holds an open block whose [SessionEvent.ThinkingDone] is on the
- * newer page -- so it spun for the rest of the conversation, saying the machine was working on a
- * thought it finished minutes ago, and the same working was drawn as two blocks.
- *
- * Only where the older half is still open: a closed one has its own ending and the two are two
- * blocks that happen to meet here. The newer half keeps its identity, for the reason [adoptRun]
- * gives -- it is the part already on screen.
- */
-private fun healSplitThinking(
-    pages: Pair<List<TranscriptItem>, List<TranscriptItem>>
-): Pair<List<TranscriptItem>, List<TranscriptItem>> {
-    val (earlier, later) = pages
-    val head = earlier.lastOrNull()
-    val tail = later.firstOrNull()
-    if (head !is TranscriptItem.ThinkingRow || tail !is TranscriptItem.ThinkingRow) return pages
-    if (!head.open) return pages
     return earlier.dropLast(1) to (listOf(tail.copy(text = head.text + tail.text)) + later.drop(1))
 }
 
@@ -457,64 +352,14 @@ fun foldEvent(items: List<TranscriptItem>, entry: SeqEvent): List<TranscriptItem
             // first of them: a row whose identity changed with every delta would be a new row on
             // every frame, and the list would jump for the whole of a streamed answer.
             val last = items.lastOrNull()
-            // Only into a reply that is still arriving. A settled one is a turn that ended, and
-            // text after it belongs to the next turn -- a separate message, drawn as its own row.
-            // Growing it instead ran two answers together with not even a space between them,
-            // which is what happens whenever a turn starts with nothing recorded in front of it:
-            // a subagent reporting back, or a peer message the CLI only owns up to at the end.
-            if (last is TranscriptItem.AssistantMsg && !last.settled) {
-                items.dropLast(1) + last.copy(text = last.text + event.delta, ts = entry.ts)
+            if (last is TranscriptItem.AssistantMsg) {
+                // A message growing again is not finished, whatever a status said in between.
+                items.dropLast(1) + last.copy(text = last.text + event.delta, settled = false)
             } else {
-                // A rule between the two, and only where they actually meet: anything that draws a
-                // row of its own -- a message, a command, a peer note -- is already the boundary.
-                val between =
-                    if (last is TranscriptItem.AssistantMsg)
-                        listOf(TranscriptItem.TurnBreak(entry.seq))
-                    else emptyList()
-                items + between + TranscriptItem.AssistantMsg(entry.seq, event.delta, ts = entry.ts)
+                items + TranscriptItem.AssistantMsg(entry.seq, event.delta)
             }
         }
-        is SessionEvent.AssistantTextFinal -> {
-            val last = items.lastOrNull()
-            if (last is TranscriptItem.AssistantMsg && !last.settled) {
-                items.dropLast(1) +
-                    last.copy(text = event.text, replacesPrefix = true, ts = entry.ts)
-            } else {
-                val between =
-                    if (last is TranscriptItem.AssistantMsg)
-                        listOf(TranscriptItem.TurnBreak(entry.seq))
-                    else emptyList()
-                items +
-                    between +
-                    TranscriptItem.AssistantMsg(
-                        entry.seq,
-                        event.text,
-                        replacesPrefix = true,
-                        ts = entry.ts,
-                    )
-            }
-        }
-        is SessionEvent.Thinking -> {
-            // Deltas grow the open block, keeping the seq of the first of them, for the same
-            // reason a reply's do: a row whose identity changed per delta is a new row per frame.
-            val last = items.lastOrNull()
-            if (last is TranscriptItem.ThinkingRow && last.open) {
-                items.dropLast(1) + last.copy(text = last.text + event.delta)
-            } else {
-                items + TranscriptItem.ThinkingRow(entry.seq, event.delta)
-            }
-        }
-        // The newest block still open, rather than whatever row happens to be last.
-        is SessionEvent.ThinkingDone ->
-            closeThinking(items) { it.copy(ms = event.ms, open = false) }
         is SessionEvent.ToolStart ->
-            // A call id names one call for its whole lifetime. Codex can repeat the start while
-            // recovering an in-flight item; appending that replay made two rows with one key, and
-            // Compose aborts the entire LazyColumn when it encounters them. Ignoring the replay
-            // also repairs transcripts which already contain it when they are folded on reopen.
-            if (items.any { it is TranscriptItem.ToolRun && it.id == event.id }) {
-                items
-            } else {
             items +
                 TranscriptItem.ToolRun(
                     entry.seq,
@@ -525,7 +370,6 @@ fun foldEvent(items: List<TranscriptItem>, entry: SeqEvent): List<TranscriptItem
                     "",
                     done = false,
                 )
-            }
         is SessionEvent.ToolUpdate -> updateTool(items, event.id) { it.copy(output = event.output) }
         is SessionEvent.ToolEnd ->
             // Created when its start is not here, rather than dropped. A fold that only ever
@@ -600,13 +444,7 @@ fun foldEvent(items: List<TranscriptItem>, entry: SeqEvent): List<TranscriptItem
         // nothing it belongs above.
         is SessionEvent.MessageDropped -> items
         is SessionEvent.Settings -> items
-        // Neither carries a row: both are about what the session can do rather than about anything
-        // said in it, and the composer is where they are drawn.
-        is SessionEvent.Images -> items
-        is SessionEvent.BackgroundTasks -> items
         is SessionEvent.Status -> settleReply(items, event.state)
-        is SessionEvent.AuthenticationRequired ->
-            items + TranscriptItem.ErrorMsg(entry.seq, event.message)
         is SessionEvent.Error -> items + TranscriptItem.ErrorMsg(entry.seq, event.message)
         is SessionEvent.Image ->
             // Under the call that produced it when there is one, and a row of its own when there is
@@ -620,32 +458,12 @@ fun foldEvent(items: List<TranscriptItem>, entry: SeqEvent): List<TranscriptItem
             } else {
                 items + TranscriptItem.ImageItem(entry.seq, event.ref)
             }
-        is SessionEvent.LimitReached -> items + TranscriptItem.LimitNote(entry.seq, event.resetsAt)
         is SessionEvent.Cleared -> items + TranscriptItem.ClearedNote(entry.seq)
         is SessionEvent.Compacted ->
             items + TranscriptItem.CompactedNote(entry.seq, event.preTokens, event.postTokens)
         is SessionEvent.Unknown -> items + TranscriptItem.Note(entry.seq, "[${event.type}]")
-        // Said rather than skipped: a line the server could not read is a hole in the conversation,
-        // and one that draws nothing is a hole nothing on screen ever mentions.
-        is SessionEvent.Unreadable ->
-            items + TranscriptItem.Note(entry.seq, "[unreadable: ${event.kind}]")
-        // No row: see [SessionEvent.RetiredTaskNote].
-        is SessionEvent.RetiredTaskNote -> items
-        // No row of its own -- the counts are screen-level state, see SessionScreen -- but the
-        // generation speed belongs under the reply it measured, and this is where that reply ends.
-        // Only onto the newest row, and only when that row is a reply: a turn whose usage arrives
-        // after a tool call has nothing here to put it on, which draws as a footer without it.
-        is SessionEvent.UsageDelta ->
-            when (val last = items.lastOrNull()) {
-                is TranscriptItem.AssistantMsg ->
-                    items.dropLast(1) +
-                        last.copy(
-                            tokensPerSecond = event.tokensPerSecond,
-                            prefillMs = event.prefillMs,
-                        )
-                else -> items
-            }
-        is SessionEvent.ContextWindow -> items
+        // Screen-level state, not transcript rows -- see SessionScreen.
+        is SessionEvent.UsageDelta -> items
     }
 
 /**
@@ -656,22 +474,9 @@ fun foldEvent(items: List<TranscriptItem>, entry: SeqEvent): List<TranscriptItem
  */
 private fun settleReply(items: List<TranscriptItem>, state: String): List<TranscriptItem> {
     if (sessionWorking(state)) return items
-    // A block the turn ended in the middle of is over, however it ended. Left open it spins for
-    // the rest of the conversation, which says the machine is working when nothing is.
-    val ended = closeThinking(items) { it.copy(open = false) }
-    val last = ended.lastOrNull() as? TranscriptItem.AssistantMsg ?: return ended
-    if (last.settled) return ended
-    return ended.dropLast(1) + last.copy(settled = true)
-}
-
-/** [change] applied to the newest thinking block still open, if there is one. */
-private fun closeThinking(
-    items: List<TranscriptItem>,
-    change: (TranscriptItem.ThinkingRow) -> TranscriptItem.ThinkingRow,
-): List<TranscriptItem> {
-    val at = items.indexOfLast { it is TranscriptItem.ThinkingRow && it.open }
-    if (at < 0) return items
-    return items.toMutableList().apply { this[at] = change(this[at] as TranscriptItem.ThinkingRow) }
+    val last = items.lastOrNull() as? TranscriptItem.AssistantMsg ?: return items
+    if (last.settled) return items
+    return items.dropLast(1) + last.copy(settled = true)
 }
 
 private fun updateTool(
@@ -718,10 +523,6 @@ suspend fun warm(replies: ParsedReplies, rows: List<TranscriptItem>) {
                 // transcript often enough that leaving it out was the whole of why one cost a fifth
                 // of a second to open.
                 is TranscriptItem.PeerNote -> listOf(row.text)
-                // A model's working is markdown too, and only once it is settled: an open block
-                // gains a delta at a time and is drawn by the incremental parse, so warming one
-                // would hold a parse of every prefix of it.
-                is TranscriptItem.ThinkingRow -> if (row.open) emptyList() else listOf(row.text)
                 else -> emptyList()
             }
         }

app/androidApp/src/main/kotlin/com/example/aiapp/TranscriptList.kt

@@ -1,7 +1,6 @@
 package com.example.aiapp
 
 import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.PaddingValues
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
@@ -11,9 +10,6 @@ import androidx.compose.foundation.lazy.LazyListState
 import androidx.compose.foundation.text.selection.SelectionContainer
 import androidx.compose.foundation.text.selection.SelectionState
 import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
@@ -53,8 +49,6 @@ fun TranscriptList(
     units: List<TranscriptUnit>,
     state: LazyListState,
     moreHistory: Boolean,
-    historyError: String?,
-    onRetryHistory: () -> Unit,
     selection: SelectionState,
     modifier: Modifier = Modifier,
     below: @Composable () -> Unit,
@@ -100,29 +94,15 @@ fun TranscriptList(
                 DebugStats.count("unit composed")
                 Box(Modifier.fillMaxWidth().padding(top = u.gap)) { unit(u) }
             }
-            // Standing in for everything not fetched yet. A failed fetch stays actionable here:
-            // when the loaded transcript is too short to scroll, this boundary is the only place
-            // the reader can be given another way to ask.
+            // Standing in for everything not fetched yet. Only here while there is more -- its
+            // appearance at the top edge is also roughly when the next page is asked for, so what
+            // it reports is a fetch in flight rather than an end reached.
             if (moreHistory) {
                 item(key = "history", contentType = "history") {
                     Box(Modifier.fillMaxWidth().padding(vertical = 24.dp)) {
-                        if (historyError == null) {
                         CircularProgressIndicator(
                             Modifier.align(Alignment.Center).size(HISTORY_SPINNER)
                         )
-                        } else {
-                            Column(
-                                Modifier.align(Alignment.Center),
-                                horizontalAlignment = Alignment.CenterHorizontally,
-                            ) {
-                                Text(
-                                    "Couldn't load earlier messages. $historyError",
-                                    color = MaterialTheme.colorScheme.error,
-                                    style = MaterialTheme.typography.bodySmall,
-                                )
-                                TextButton(onClick = onRetryHistory) { Text("Try again") }
-                            }
-                        }
                     }
                 }
             }

app/androidApp/src/main/kotlin/com/example/aiapp/TranscriptSource.kt

@@ -18,7 +18,7 @@ import java.util.concurrent.atomic.AtomicReference
  */
 class TranscriptSource(
     private val settings: ServerSettings,
-    private val address: TranscriptAddress,
+    private val sessionId: String,
     val cache: SessionCache,
 ) {
     private val stream = AtomicReference<EventStream?>(null)
@@ -65,7 +65,7 @@ class TranscriptSource(
         val tail = cache.tail() ?: return false
         // `before = seq + 1` is the newest event with seq <= the cursor, which is the event *at*
         // the cursor when the server still has one there.
-        val answer = fetchTranscript(settings, address, before = tail.seq + 1, limit = 1)
+        val answer = fetchTranscript(settings, sessionId, before = tail.seq + 1, limit = 1)
         val matches =
             answer.size == 1 &&
                 try {
@@ -83,7 +83,7 @@ class TranscriptSource(
      */
     suspend fun fetchOpening(): List<SeqEvent> {
         DebugStats.count("transcript page from server")
-        val page = fetchTranscript(settings, address, limit = OPENING_WINDOW)
+        val page = fetchTranscript(settings, sessionId, limit = OPENING_WINDOW)
         page.forEach { (line, entry) -> cache.append(line, entry.seq) }
         cache.flush()
         return page.map { it.second }
@@ -108,7 +108,7 @@ class TranscriptSource(
         val page =
             fetchTranscript(
                 settings,
-                address,
+                sessionId,
                 before = before,
                 limit = limit,
                 coalesce = coalesce,
@@ -131,7 +131,7 @@ class TranscriptSource(
      * well lose.
      */
     fun follow(after: Long, onOpen: () -> Unit, onReset: () -> Unit, onEvent: (SeqEvent) -> Unit) {
-        val opened = EventStream(settings, address)
+        val opened = EventStream(settings, sessionId)
         stream.getAndSet(opened)?.close()
         try {
             opened.run(after, onOpen, onReset) { raw, entry ->

app/androidApp/src/main/kotlin/com/example/aiapp/TranscriptUnits.kt

@@ -130,25 +130,6 @@ sealed class TranscriptUnit {
             get() = "u$seq:$ordinal"
     }
 
-    /**
-     * The line under a finished reply: when it was sent, and how fast it was generated.
-     *
-     * A unit of its own rather than something drawn inside the last block, because a settled reply
-     * *is* its blocks -- there is no row left to hang it on, and the last block is a piece of
-     * markdown that knows nothing about the message it came from.
-     */
-    data class ReplyFoot(
-        override val seq: Long,
-        override val ordinal: Int,
-        val ts: Double,
-        val tokensPerSecond: Double?,
-        val prefillMs: Long?,
-        override val gap: Dp,
-    ) : TranscriptUnit() {
-        override val key: Any
-            get() = "f$seq"
-    }
-
     /** One memory note of a settled reply; see [MemoryNote]. */
     data class Memory(
         override val seq: Long,
@@ -256,19 +237,6 @@ fun transcriptUnits(
                     }
                 }
             }
-            // Unconditional, because being in this branch is what says the reply is over:
-            // [splitWanted] is settled-or-overtaken. The case to keep out is a message still
-            // arriving, whose "sent at" is not yet the one it ends up with, and that is drawn
-            // whole.
-            units +=
-                TranscriptUnit.ReplyFoot(
-                    row.startSeq,
-                    ordinal,
-                    item.ts,
-                    item.tokensPerSecond,
-                    item.prefillMs,
-                    gap(FOOT_SPACING),
-                )
         } else {
             units += TranscriptUnit.Whole(row, rowGap)
         }
@@ -312,14 +280,6 @@ fun unwarmedReplies(rows: List<TranscriptRow>, replies: ParsedReplies): List<Tra
  * length has lines that wrap, so its bubble is at the full width already and the slices match it
  * exactly. Below it, one item of at most a few screens is nothing the list minds composing.
  */
-/**
- * The room between a reply's last block and the line under it.
- *
- * Tighter than the gap between blocks: the footer belongs to the message above it, and at a block's
- * spacing it reads as a row of its own floating between two replies.
- */
-private val FOOT_SPACING: Dp = 2.dp
-
 const val USER_SPLIT_CHARS = 4000
 
 /**
@@ -415,7 +375,6 @@ private val TranscriptUnit?.kind: String
             is TranscriptUnit.PeerBlock -> "peer block"
             is TranscriptUnit.UserChunk -> "user slice"
             is TranscriptUnit.Memory -> "memory note"
-            is TranscriptUnit.ReplyFoot -> "reply footer"
             is TranscriptUnit.Whole ->
                 when (val row = row) {
                     is TranscriptRow.Tools -> "tool group"

app/androidApp/src/main/kotlin/com/example/aiapp/UsageDialog.kt

@@ -9,15 +9,12 @@ import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.rememberScrollState
 import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.LinearProgressIndicator
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Surface
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.dp
@@ -33,14 +30,7 @@ import java.time.OffsetDateTime
  * own, so the only thing its Back could ever have meant was "put this away".
  */
 @Composable
-fun UsageDialog(
-    settings: ServerSettings,
-    feed: UsageFeed,
-    session: SessionSummary,
-    onDismiss: () -> Unit,
-) {
-    var signingIn by remember { mutableStateOf(false) }
-    val now = rememberUsageNow()
+fun UsageDialog(feed: UsageFeed, onDismiss: () -> Unit) {
     // A plain Dialog rather than an AlertDialog, for the spacing alone. AlertDialog fixes the gaps
     // between its title, content and buttons at sizes meant for a sentence of prose and a decision;
     // this is a dense read-out, and those gaps left a band of empty dialog above Close that was
@@ -55,6 +45,10 @@ fun UsageDialog(
                     verticalAlignment = Alignment.CenterVertically,
                     modifier = Modifier.fillMaxWidth(),
                 ) {
+                    // Deliberately not subtitled with the provider this was opened from. These
+                    // numbers belong to an account on a particular machine -- naming the session's
+                    // provider here made an echo session's screen read "echo" above a line reading
+                    // "claude". Each machine names itself and the service it came from.
                     Text(
                         "Usage",
                         style = MaterialTheme.typography.headlineSmall,
@@ -71,24 +65,10 @@ fun UsageDialog(
                 }
                 Spacer(Modifier.height(8.dp))
                 // Scrolls rather than being trimmed: a machine can report any number of windows and
-                // a provider can report several billing pools, and a dialog is the one place where
-                // running out of room is silent. `fill = false` so a short read-out keeps a short
-                // dialog.
+                // there can be any number of machines, and a dialog is the one place where running
+                // out of room is silent. `fill = false` so a short read-out keeps a short dialog.
                 Column(Modifier.weight(1f, fill = false).verticalScroll(rememberScrollState())) {
-                    val state =
-                        when (val snapshots = feed.snapshots) {
-                            is LoadState.Loading -> LoadState.Loading
-                            is LoadState.Error -> snapshots
-                            is LoadState.Loaded ->
-                                LoadState.Loaded(
-                                    usageSnapshotsFor(
-                                        snapshots.value,
-                                        session.machine,
-                                        session.usageProvider,
-                                    )
-                                )
-                        }
-                    UsageBody(state, now, onSignIn = { signingIn = true })
+                    UsageBody(feed.snapshots)
                 }
                 TextButton(onClick = onDismiss, modifier = Modifier.align(Alignment.End)) {
                     Text("Close")
@@ -96,46 +76,29 @@ fun UsageDialog(
             }
         }
     }
-    if (signingIn) {
-        ProviderLoginDialog(
-            settings = settings,
-            machineId = session.machine,
-            machineName = session.machineName,
-            provider = session.provider,
-            onDismiss = { signingIn = false },
-            onSignedIn = {
-                signingIn = false
-                feed.refresh()
-            },
-        )
-    }
 }
 
 /** What came back, or why nothing did. Split out so the dialog above reads as its own shape. */
 @Composable
-private fun UsageBody(
-    state: LoadState<List<UsageSnapshot>>,
-    now: OffsetDateTime,
-    onSignIn: () -> Unit,
-) {
+private fun UsageBody(state: LoadState<List<UsageSnapshot>>) {
     Column {
         when (val current = state) {
             is LoadState.Loading -> CircularProgressIndicator()
             is LoadState.Error -> Text(current.message, color = MaterialTheme.colorScheme.error)
             is LoadState.Loaded ->
                 if (current.value.isEmpty()) {
-                    // Not an error and not a blank screen: this provider has no paid quota, so
+                    // Not an error and not a blank screen: no machine offers a paid service, so
                     // there is genuinely nothing to report and saying so is the answer.
                     Text(
-                        "This session's provider has no usage limits.",
+                        "No machine here runs anything with usage limits.",
                         style = MaterialTheme.typography.bodyMedium,
                         color = MaterialTheme.colorScheme.onSurfaceVariant,
                     )
                 } else {
-                    // No card around each pool. A card is a step up the surface ladder, and inside
-                    // a dialog -- itself a raised surface -- the step barely renders while costing
-                    // 16dp on every side. What separates one pool from the next is the line naming
-                    // it.
+                    // No card around each machine. A card is a step up the surface ladder, and
+                    // inside a dialog -- itself a raised surface -- the step barely renders while
+                    // costing 16dp on every side. What separates one machine from the next is the
+                    // line naming it.
                     current.value.forEachIndexed { index, snapshot ->
                         if (index > 0) {
                             Spacer(Modifier.height(20.dp))
@@ -145,18 +108,18 @@ private fun UsageBody(
                         // read as a section of their own. Small and quiet, because the numbers
                         // below are what somebody opened this to see.
                         Text(
-                            usageSectionTitle(snapshot),
+                            "${snapshot.setupName.ifEmpty { snapshot.setup }} · ${snapshot.provider}",
                             style = MaterialTheme.typography.bodySmall,
                             color = MaterialTheme.colorScheme.onSurfaceVariant,
                         )
-                        SnapshotState(snapshot, onSignIn)
+                        SnapshotState(snapshot)
                         snapshot.windows.forEachIndexed { windowIndex, window ->
                             // Between the bars, not after the last one: a trailing gap here is what
                             // put a band of empty dialog above the Close button.
                             if (windowIndex > 0) {
                                 Spacer(Modifier.height(12.dp))
                             }
-                            WindowBar(window, now)
+                            WindowBar(window)
                         }
                     }
                 }
@@ -164,44 +127,20 @@ private fun UsageBody(
     }
 }
 
-private fun usageSectionTitle(snapshot: UsageSnapshot): String {
-    val machine = snapshot.machineName.ifEmpty { snapshot.machine }
-    val provider = snapshot.provider
-    val pool =
-        if (provider == "codex" && snapshot.limitId != "codex") {
-            when (snapshot.limitName) {
-                "gpt-reserve" -> "Luna Reserve"
-                null -> snapshot.limitId
-                else -> snapshot.limitName
-            }
-        } else null
-    return listOfNotNull(machine, provider, pool).joinToString(" · ")
-}
-
 /**
  * Anything other than numbers: why this machine has none.
  *
  * The distinction the old single message could not draw. A machine nobody has logged in on is
  * working exactly as somebody set it up, so it reads as a plain statement -- marking it would be
- * the interface nagging about a decision already made. It still offers the direct sign-in action;
- * unreachable and provider failures are the states coloured as faults.
+ * the interface nagging about a decision already made. Only the two faults are coloured as faults.
  */
 @Composable
-private fun SnapshotState(snapshot: UsageSnapshot, onSignIn: () -> Unit) {
+private fun SnapshotState(snapshot: UsageSnapshot) {
     when (snapshot.state) {
         "ok" -> {}
-        "notLoggedIn",
-        "loginRequired" -> {
+        "notLoggedIn" ->
             Text(
-                snapshot.detail ?: "No Claude account on this machine.",
-                style = MaterialTheme.typography.bodyMedium,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-            TextButton(onClick = onSignIn) { Text("Sign in") }
-        }
-        "authenticating" ->
-            Text(
-                "Claude sign-in is in progress.",
+                "No Claude account on this machine.",
                 style = MaterialTheme.typography.bodyMedium,
                 color = MaterialTheme.colorScheme.onSurfaceVariant,
             )
@@ -223,7 +162,7 @@ private fun SnapshotState(snapshot: UsageSnapshot, onSignIn: () -> Unit) {
 }
 
 @Composable
-private fun WindowBar(window: UsageWindow, now: OffsetDateTime) {
+private fun WindowBar(window: UsageWindow) {
     Column {
         Row(modifier = Modifier.fillMaxWidth()) {
             Text(
@@ -234,8 +173,12 @@ private fun WindowBar(window: UsageWindow, now: OffsetDateTime) {
             Text("${window.percent.toInt()}%", style = MaterialTheme.typography.bodyMedium)
         }
         Spacer(Modifier.height(4.dp))
-        UsageProgressIndicator(window, now, Modifier.fillMaxWidth())
-        resetLine(window, now)?.let {
+        LinearProgressIndicator(
+            progress = { (window.percent / 100.0).toFloat().coerceIn(0f, 1f) },
+            color = quotaColor(window.percent),
+            modifier = Modifier.fillMaxWidth(),
+        )
+        resetLine(window)?.let {
             Spacer(Modifier.height(2.dp))
             Text(
                 it,
@@ -254,8 +197,8 @@ private fun WindowBar(window: UsageWindow, now: OffsetDateTime) {
  * failure appeared as an ISO string in a sentence written for a person. Both are named in
  * [WindowEnd], and the session bar words them the same way.
  */
-private fun resetLine(window: UsageWindow, now: OffsetDateTime): String? =
-    when (val end = windowEnd(window.resetsAt, now)) {
+private fun resetLine(window: UsageWindow): String? =
+    when (val end = windowEnd(window.resetsAt, OffsetDateTime.now())) {
         WindowEnd.NotRunning -> null
         WindowEnd.Unreadable -> "reset time unreadable"
         is WindowEnd.Ends ->

app/androidApp/src/test/kotlin/com/example/aiapp/AuthenticationPromptTest.kt

@@ -1,28 +0,0 @@
-package com.example.aiapp
-
-import kotlin.test.Test
-import kotlin.test.assertFalse
-import kotlin.test.assertTrue
-
-class AuthenticationPromptTest {
-    @Test
-    fun an_authentication_failure_stays_actionable_through_its_terminal_status() {
-        val required =
-            authenticationPromptAfter(
-                false,
-                SessionEvent.AuthenticationRequired("sign in again"),
-            )
-
-        assertTrue(authenticationPromptAfter(required, SessionEvent.Status("idle")))
-    }
-
-    @Test
-    fun a_later_provider_response_makes_an_old_failure_stale() {
-        assertFalse(
-            authenticationPromptAfter(
-                true,
-                SessionEvent.AssistantText("Working again."),
-            )
-        )
-    }
-}

app/androidApp/src/test/kotlin/com/example/aiapp/FilesNavigationTest.kt

@@ -1,33 +0,0 @@
-package com.example.aiapp
-
-import kotlin.test.Test
-import kotlin.test.assertEquals
-
-class FilesNavigationTest {
-    @Test
-    fun `back walks through the common ancestor toward the project`() {
-        val project = "/home/bob/repos/project"
-        assertEquals("/", nextDirectoryToward("/etc", project))
-        assertEquals("/home", nextDirectoryToward("/", project))
-        assertEquals("/home/bob", nextDirectoryToward("/home", project))
-        assertEquals("/home/bob/repos", nextDirectoryToward("/home/bob", project))
-        assertEquals(project, nextDirectoryToward("/home/bob/repos", project))
-        assertEquals(null, nextDirectoryToward(project, project))
-    }
-
-    @Test
-    fun `back leaves a project descendant one directory at a time`() {
-        assertEquals(
-            "/home/bob/repos/project/src",
-            nextDirectoryToward("/home/bob/repos/project/src/main", "/home/bob/repos/project"),
-        )
-    }
-
-    @Test
-    fun `paths inside the machine home use tilde notation`() {
-        assertEquals("~", tildePath("/home/bob", "/home/bob"))
-        assertEquals("~/repos/project", tildePath("/home/bob/repos/project", "/home/bob/"))
-        assertEquals("/home/bobby/project", tildePath("/home/bobby/project", "/home/bob"))
-        assertEquals("/etc", tildePath("/etc", "/home/bob"))
-    }
-}

app/androidApp/src/test/kotlin/com/example/aiapp/HighlighterTest.kt

@@ -338,21 +338,6 @@ class HighlighterTest {
         assertEquals("+[-]", highlight("+[-]", fenceLanguage("brainfuck")).text)
     }
 
-    @Test
-    fun `a diff colours changes and identifies its framing separately`() {
-        val code = "--- a/file\n+++ b/file\n@@ -1 +1 @@\n-old\n context\n+new"
-        assertSpans(code, Language.DIFF, Kind.DELETION, "-old")
-        assertSpans(code, Language.DIFF, Kind.ADDITION, "+new")
-        assertSpans(
-            code,
-            Language.DIFF,
-            Kind.METADATA,
-            "--- a/file",
-            "+++ b/file",
-            "@@ -1 +1 @@",
-        )
-    }
-
     @Test
     fun `every language the fence table knows has a scanner`() {
         Language.entries.forEach { spansOf("x", it) }

app/androidApp/src/test/kotlin/com/example/aiapp/LimitRowTest.kt

@@ -1,32 +0,0 @@
-package com.example.aiapp
-
-import java.time.ZoneId
-import kotlin.test.Test
-import kotlin.test.assertEquals
-import kotlin.test.assertTrue
-
-/**
- * What the transcript says where a session ran out of quota.
- *
- * The pair worth a test is the one that reads the same when it goes wrong: a reset time that
- * arrived and one that never did. The second must not turn into a plausible-looking time, because a
- * reader has no way of telling an invented one from a reported one.
- */
-class LimitRowTest {
-    private val utc = ZoneId.of("UTC")
-
-    @Test
-    fun `a reported reset time is shown as a time`() {
-        // 2026-09-05T12:00:00Z. Asserted as a prefix and the clock reading rather than as the
-        // whole string: the platform's own short-time format is what this asks for, and it
-        // differs by JDK and locale down to which space character separates the meridiem.
-        val summary = limitSummary(1_788_609_600.0, utc)
-        assertTrue(summary.startsWith("Usage limit reached • resets "), summary)
-        assertTrue(summary.contains("12:00"), summary)
-    }
-
-    @Test
-    fun `a limit with no reset time says only what is known`() {
-        assertEquals("Usage limit reached", limitSummary(null, utc))
-    }
-}

app/androidApp/src/test/kotlin/com/example/aiapp/MarkdownLinksTest.kt

@@ -1,31 +0,0 @@
-package com.example.aiapp
-
-import kotlin.test.Test
-import kotlin.test.assertEquals
-import kotlin.test.assertNull
-
-class MarkdownLinksTest {
-    @Test
-    fun `absolute file paths are opened on the session machine`() {
-        assertEquals(
-            "/home/bob/repos/ai app/Main.kt",
-            filePathOf("/home/bob/repos/ai%20app/Main.kt"),
-        )
-        assertEquals("/home/bob/Main.kt", filePathOf("file:///home/bob/Main.kt"))
-        assertEquals("/home/bob/Main.kt", filePathOf("file://localhost/home/bob/Main.kt"))
-    }
-
-    @Test
-    fun `editor coordinates select the file itself`() {
-        assertEquals("/home/bob/Main.kt", filePathOf("/home/bob/Main.kt:42"))
-        assertEquals("/home/bob/Main.kt", filePathOf("file:///home/bob/Main.kt:42:7#L42"))
-    }
-
-    @Test
-    fun `ordinary links keep their external meaning`() {
-        assertNull(filePathOf("https://example.com/source.kt"))
-        assertNull(filePathOf("docs/source.kt"))
-        assertNull(filePathOf("//example.com/source.kt"))
-        assertNull(filePathOf("file://example.com/source.kt"))
-    }
-}

app/androidApp/src/test/kotlin/com/example/aiapp/PendingMessagesTest.kt

@@ -1,72 +0,0 @@
-package com.example.aiapp
-
-import kotlin.test.Test
-import kotlin.test.assertEquals
-import kotlin.test.assertTrue
-
-class PendingMessagesTest {
-    private fun local(text: String = "keep this") =
-        QueuedMessage("local-1", text, emptyList(), local = true)
-
-    @Test
-    fun a_server_queue_replaces_the_local_bridge_instead_of_duplicating_it() {
-        val queued =
-            reconcileQueuedMessage(
-                listOf(local()),
-                SessionEvent.MessageQueued("server-1", "keep this", emptyList()),
-            )
-
-        assertEquals(1, queued.size)
-        assertEquals("server-1", queued.single().id)
-        assertTrue(!queued.single().local)
-    }
-
-    @Test
-    fun an_immediately_received_message_removes_its_local_bridge() {
-        val queued =
-            reconcileUserMessage(
-                listOf(local()),
-                SessionEvent.UserMessage("keep this", id = null, attachments = emptyList()),
-            )
-
-        assertTrue(queued.isEmpty())
-    }
-
-    @Test
-    fun a_transport_failure_stays_on_its_message() {
-        val queued = markPendingFailure(listOf(local()), "local-1", "Can't reach the server")
-
-        assertEquals("Can't reach the server", queued.single().refusal)
-        assertTrue(queued.single().local)
-    }
-
-    @Test
-    fun server_acceptance_keeps_the_bubble_until_the_provider_event() {
-        val queued = markPendingAccepted(listOf(local()), "local-1")
-
-        assertEquals(1, queued.size)
-        assertTrue(queued.single().serverAccepted)
-    }
-
-    @Test
-    fun discarding_a_failed_send_removes_only_that_local_copy() {
-        val server = QueuedMessage("server-1", "already accepted", emptyList())
-        val queued = listOf(local(), local("keep this one").copy(id = "local-2"), server)
-
-        val discarded = discardPendingMessage(queued, "local-1")
-
-        assertEquals(listOf("local-2", "server-1"), discarded.map { it.id })
-    }
-
-    @Test
-    fun identical_messages_are_reconciled_one_at_a_time() {
-        val queued = listOf(local(), local().copy(id = "local-2"))
-        val afterFirst =
-            reconcileUserMessage(
-                queued,
-                SessionEvent.UserMessage("keep this", id = null, attachments = emptyList()),
-            )
-
-        assertEquals(listOf("local-2"), afterFirst.map { it.id })
-    }
-}

app/androidApp/src/test/kotlin/com/example/aiapp/SessionImageTest.kt

@@ -1,111 +0,0 @@
-package com.example.aiapp
-
-import androidx.compose.ui.geometry.Offset
-import kotlin.test.Test
-import kotlin.test.assertEquals
-
-class SessionImageTest {
-    @Test
-    fun `a full-height image hides both bars`() {
-        assertEquals(
-            ViewerBars(status = true, navigation = true),
-            viewerBars(
-                imageWidth = 1000,
-                imageHeight = 2000,
-                viewportWidth = 1000,
-                viewportHeight = 2000,
-                scale = 1f,
-                offset = Offset.Zero,
-                insets = ViewerBarInsets(status = 100, navigation = 100),
-            ),
-        )
-    }
-
-    @Test
-    fun `a letterboxed image leaves both bars visible`() {
-        assertEquals(
-            ViewerBars(),
-            viewerBars(
-                imageWidth = 1000,
-                imageHeight = 500,
-                viewportWidth = 1000,
-                viewportHeight = 2000,
-                scale = 1f,
-                offset = Offset.Zero,
-                insets = ViewerBarInsets(status = 100, navigation = 100),
-            ),
-        )
-    }
-
-    @Test
-    fun `panning into the status bar hides only that bar`() {
-        assertEquals(
-            ViewerBars(status = true),
-            viewerBars(
-                imageWidth = 1000,
-                imageHeight = 500,
-                viewportWidth = 1000,
-                viewportHeight = 2000,
-                scale = 2f,
-                offset = Offset(0f, -500f),
-                insets = ViewerBarInsets(status = 100, navigation = 100),
-            ),
-        )
-    }
-
-    @Test
-    fun `native scale reverses fitting a tall image`() {
-        assertEquals(
-            1.25f,
-            nativeScale(
-                imageWidth = 1000,
-                imageHeight = 2000,
-                viewportWidth = 1000,
-                viewportHeight = 1600,
-            ),
-        )
-    }
-
-    @Test
-    fun `native scale leaves a small image alone`() {
-        assertEquals(
-            1f,
-            nativeScale(
-                imageWidth = 500,
-                imageHeight = 500,
-                viewportWidth = 1000,
-                viewportHeight = 1000,
-            ),
-        )
-    }
-
-    @Test
-    fun `zoom keeps the region panned to in the center`() {
-        assertEquals(
-            Offset(240f, -160f),
-            zoomOffset(
-                offset = Offset(120f, -80f),
-                centroid = Offset(500f, 1000f),
-                pan = Offset.Zero,
-                oldScale = 2f,
-                newScale = 4f,
-                viewportCenter = Offset(500f, 1000f),
-            ),
-        )
-    }
-
-    @Test
-    fun `zoom keeps an off-center pinch beneath moving fingers`() {
-        assertEquals(
-            Offset(460f, 420f),
-            zoomOffset(
-                offset = Offset(100f, -100f),
-                centroid = Offset(250f, 400f),
-                pan = Offset(10f, 20f),
-                oldScale = 2f,
-                newScale = 4f,
-                viewportCenter = Offset(500f, 1000f),
-            ),
-        )
-    }
-}

app/androidApp/src/test/kotlin/com/example/aiapp/SessionUsageTest.kt

@@ -1,137 +0,0 @@
-package com.example.aiapp
-
-import java.time.OffsetDateTime
-import kotlin.test.Test
-import kotlin.test.assertEquals
-
-class SessionUsageTest {
-    @Test
-    fun `usage snapshots stay with the session's machine and provider`() {
-        val claude = snapshot("machine", "claude", null)
-        val codex = snapshot("machine", "codex", "codex")
-        val reserve = snapshot("machine", "codex", "gpt-reserve")
-        val elsewhere = snapshot("other", "codex", "codex")
-
-        assertEquals(
-            listOf(codex, reserve),
-            usageSnapshotsFor(
-                listOf(claude, codex, reserve, elsewhere),
-                machine = "machine",
-                provider = "codex",
-            ),
-        )
-    }
-
-    @Test
-    fun `a session without a meter has no usage snapshots`() {
-        assertEquals(
-            emptyList(),
-            usageSnapshotsFor(
-                listOf(snapshot("machine", "claude", null)),
-                machine = "machine",
-                provider = null,
-            ),
-        )
-    }
-
-    @Test
-    fun `the model selects its named pool and other models use the generic pool`() {
-        val generic = snapshot("machine", "codex", "codex")
-        val spark =
-            snapshot(
-                "machine",
-                "codex",
-                "codex_bengalfox",
-                limitName = "GPT-5.3-Codex-Spark",
-            )
-        val reserve =
-            snapshot("machine", "codex", "base_model_inference", limitName = "gpt-reserve")
-        val pools = listOf(generic, spark, reserve)
-
-        assertEquals(spark, usagePoolFor(pools, "gpt-5.3-codex-spark"))
-        assertEquals(reserve, usagePoolFor(pools, "gpt-5.6-luna"))
-        assertEquals(generic, usagePoolFor(pools, "gpt-6-astra"))
-    }
-
-    @Test
-    fun `the bar uses the shortest reported cycle`() {
-        val weekly = window("Weekly", 10_080)
-        val hourly = window("5-hour window", 300)
-
-        assertEquals(hourly, shortestUsageWindow(listOf(weekly, hourly)))
-        assertEquals(null, shortestUsageWindow(listOf(window("unknown", null))))
-    }
-
-    @Test
-    fun `the time cursor follows elapsed time through the window`() {
-        val now = OffsetDateTime.parse("2026-09-17T12:00:00Z")
-
-        assertEquals(
-            0.4f,
-            usageWindowElapsedFraction(
-                window("5-hour window", 300, "2026-09-17T15:00:00Z"),
-                now,
-            ),
-        )
-    }
-
-    @Test
-    fun `the time cursor clamps at the window ends`() {
-        val now = OffsetDateTime.parse("2026-09-17T12:00:00Z")
-
-        assertEquals(
-            0f,
-            usageWindowElapsedFraction(
-                window("5-hour window", 300, "2026-09-17T18:00:00Z"),
-                now,
-            ),
-        )
-        assertEquals(
-            1f,
-            usageWindowElapsedFraction(
-                window("5-hour window", 300, "2026-09-17T11:00:00Z"),
-                now,
-            ),
-        )
-    }
-
-    @Test
-    fun `the time cursor is absent without a usable duration and reset time`() {
-        val now = OffsetDateTime.parse("2026-09-17T12:00:00Z")
-
-        assertEquals(null, usageWindowElapsedFraction(window("unknown", null), now))
-        assertEquals(null, usageWindowElapsedFraction(window("not running", 300), now))
-        assertEquals(
-            null,
-            usageWindowElapsedFraction(window("unreadable", 300, "not a timestamp"), now),
-        )
-        assertEquals(null, usageWindowElapsedFraction(window("zero", 0), now))
-    }
-
-    private fun snapshot(
-        machine: String,
-        provider: String,
-        limitId: String?,
-        limitName: String? = null,
-    ) =
-        UsageSnapshot(
-            provider = provider,
-            machine = machine,
-            machineName = machine,
-            limitId = limitId,
-            limitName = limitName,
-            state = "ok",
-            detail = null,
-            windows = emptyList(),
-        )
-
-    private fun window(label: String, durationMinutes: Long?, resetsAt: String? = null) =
-        UsageWindow(
-            kind = "test",
-            label = label,
-            percent = 12.0,
-            durationMinutes = durationMinutes,
-            resetsAt = resetsAt,
-            active = false,
-        )
-}

app/androidApp/src/test/kotlin/com/example/aiapp/ThinkingTest.kt

@@ -1,150 +0,0 @@
-package com.example.aiapp
-
-import java.time.ZoneId
-import kotlin.test.Test
-import kotlin.test.assertEquals
-import kotlin.test.assertNull
-import kotlin.test.assertTrue
-
-/**
- * The model's working as its own row, and the line under a finished reply.
- *
- * Both have the same shape of hazard: a state nothing measured must not come out looking like one
- * that was. A block interrupted mid-thought has no duration, and a provider that reports no
- * generation speed has no figure -- neither may borrow one.
- */
-class ThinkingTest {
-    private val utc = ZoneId.of("UTC")
-    private var seq = 0L
-
-    private fun fold(items: List<TranscriptItem>, event: SessionEvent, ts: Double = 1.0) =
-        foldEvent(items, SeqEvent(seq = ++seq, ts = ts, event = event))
-
-    private fun fold(vararg events: SessionEvent) =
-        events.fold(emptyList<TranscriptItem>()) { items, event -> fold(items, event) }
-
-    private fun thinking(items: List<TranscriptItem>) =
-        items.filterIsInstance<TranscriptItem.ThinkingRow>()
-
-    @Test
-    fun `deltas accumulate into one block that ends with its duration`() {
-        val items =
-            fold(
-                SessionEvent.Thinking("the user "),
-                SessionEvent.Thinking("wants a card"),
-                SessionEvent.ThinkingDone(12_400),
-                SessionEvent.AssistantText("Here it is."),
-            )
-        val block = thinking(items).single()
-        assertEquals("the user wants a card", block.text)
-        assertEquals(12_400, block.ms)
-        assertEquals("Thought for 12.4s", thinkingHeadline(block))
-        // Its own row, above the reply rather than inside it.
-        assertEquals(1, items.filterIsInstance<TranscriptItem.AssistantMsg>().size)
-    }
-
-    @Test
-    fun `a block the turn ended in the middle of stops without naming a span`() {
-        val items = fold(SessionEvent.Thinking("half a thought"), SessionEvent.Status("idle"))
-        val block = thinking(items).single()
-        assertNull(block.ms)
-        assertTrue(!block.open)
-        assertEquals("Thought", thinkingHeadline(block))
-    }
-
-    @Test
-    fun `a block still being thought says so`() {
-        val block = thinking(fold(SessionEvent.Thinking("hmm"))).single()
-        assertTrue(block.open)
-        assertEquals("Thinking", thinkingHeadline(block))
-    }
-
-    @Test
-    fun `thinking between two replies is two replies and two blocks`() {
-        val items =
-            fold(
-                SessionEvent.Thinking("first"),
-                SessionEvent.ThinkingDone(1_000),
-                SessionEvent.AssistantText("One."),
-                SessionEvent.Thinking("second"),
-                SessionEvent.ThinkingDone(2_000),
-                SessionEvent.AssistantText("Two."),
-            )
-        assertEquals(listOf("first", "second"), thinking(items).map { it.text })
-        assertEquals(
-            listOf("One.", "Two."),
-            items.filterIsInstance<TranscriptItem.AssistantMsg>().map { it.text },
-        )
-    }
-
-    @Test
-    fun `a reply carries when it was sent and what it cost to produce`() {
-        val items =
-            fold(emptyList(), SessionEvent.AssistantText("Done."), ts = 1_788_609_600.0).let {
-                fold(it, SessionEvent.UsageDelta(42, 100, 18.37, 9_489))
-            }
-        val reply = items.filterIsInstance<TranscriptItem.AssistantMsg>().single()
-        assertEquals(1_788_609_600.0, reply.ts)
-        assertEquals(18.37, reply.tokensPerSecond)
-        assertEquals(9_489, reply.prefillMs)
-
-        val footer = replyFooterText(reply.ts, reply.tokensPerSecond, reply.prefillMs, utc)
-        // The clock reading rather than the whole string: the platform's own short-time format
-        // differs by JDK and locale, which is the point of asking it for one.
-        assertTrue(footer!!.startsWith("read 9.5s · 18.4 tok/s · "), footer)
-        assertTrue(footer.contains("12:00"), footer)
-    }
-
-    @Test
-    fun `the clock stays at the end however much the provider measured`() {
-        // What a provider that measures nothing leaves: the time, and nothing in front of it.
-        val bare = replyFooterText(1_788_609_600.0, null, null, utc)
-        assertTrue(bare!!.contains("12:00"), bare)
-        assertTrue(!bare.contains("tok/s") && !bare.contains("read"), bare)
-        // Every shape ends with the same thing, which is the whole point of the order: the clock
-        // does not move because the session is on a provider that measures more or less.
-        val shapes =
-            listOf(
-                bare,
-                replyFooterText(1_788_609_600.0, 18.37, null, utc)!!,
-                replyFooterText(1_788_609_600.0, null, 9_489, utc)!!,
-                replyFooterText(1_788_609_600.0, 18.37, 9_489, utc)!!,
-            )
-        assertEquals(1, shapes.map { it.substringAfterLast("· ") }.distinct().size, "$shapes")
-        // A reply with nothing to say has no line at all rather than an empty one.
-        assertNull(replyFooterText(0.0, null, null, utc))
-    }
-
-    @Test
-    fun `a block cut by a page boundary is one block, and it is not still going`() {
-        // Each page folded on its own, as the app does: the older one holds the fragments before
-        // the cut and no ending, the newer one the rest and the ending.
-        val older = fold(SessionEvent.Thinking("half a "))
-        val newer = fold(SessionEvent.Thinking("thought"), SessionEvent.ThinkingDone(2_000))
-
-        val joined = joinPages(older, newer)
-        val block = thinking(joined).single()
-        assertEquals("half a thought", block.text)
-        assertEquals(2_000, block.ms)
-        assertTrue(!block.open)
-    }
-
-    @Test
-    fun `two blocks meeting at a page boundary stay two`() {
-        val older = fold(SessionEvent.Thinking("first"), SessionEvent.ThinkingDone(1_000))
-        val newer = fold(SessionEvent.Thinking("second"), SessionEvent.ThinkingDone(2_000))
-        assertEquals(listOf("first", "second"), thinking(joinPages(older, newer)).map { it.text })
-    }
-
-    @Test
-    fun `usage that lands after a tool call is not folded onto an older reply`() {
-        val items =
-            fold(
-                SessionEvent.AssistantText("Reading it."),
-                SessionEvent.ToolStart("t1", "Read", "{}"),
-                SessionEvent.ToolEnd("t1", "done"),
-                SessionEvent.UsageDelta(42, 100, 18.0, 500),
-            )
-        assertNull(items.filterIsInstance<TranscriptItem.AssistantMsg>().single().tokensPerSecond)
-    }
-}

app/androidApp/src/test/kotlin/com/example/aiapp/ToolInputTest.kt

@@ -1,43 +0,0 @@
-package com.example.aiapp
-
-import kotlin.test.Test
-import kotlin.test.assertEquals
-import kotlin.test.assertNull
-import kotlin.test.assertTrue
-
-class ToolInputTest {
-    @Test
-    fun `bash wrapper ignores double quotes inside its outer pair`() {
-        assertEquals(
-            "rg -n \"needle\" server app",
-            renderedBashScript("/usr/bin/bash -lc \"rg -n \"needle\" server app\""),
-        )
-    }
-
-    @Test
-    fun `bash wrapper ignores single quotes inside its outer pair`() {
-        assertEquals(
-            "printf 'hello'",
-            renderedBashScript("/bin/bash -lc 'printf 'hello''"),
-        )
-    }
-
-    @Test
-    fun `unquoted or unfamiliar commands stay intact`() {
-        assertNull(renderedBashScript("/usr/bin/bash -lc echo hello"))
-        assertNull(renderedBashScript("/usr/bin/fish -lc 'echo hello'"))
-    }
-
-    @Test
-    fun `missing optional input is not displayed as null`() {
-        assertTrue(parseToolInput("TaskOutput", "null").rest.isEmpty())
-    }
-
-    @Test
-    fun `collaboration calls say what they do and omit empty completion`() {
-        assertEquals("Spawn agent", toolDisplayName("Task"))
-        assertEquals("Wait for agents", toolDisplayName("TaskOutput"))
-        assertEquals("", toolDisplayOutput("TaskOutput", "completed"))
-        assertEquals("failed", toolDisplayOutput("TaskOutput", "failed"))
-    }
-}

app/androidApp/src/test/kotlin/com/example/aiapp/ToolRowsTest.kt

@@ -1,167 +0,0 @@
-package com.example.aiapp
-
-import kotlin.test.Test
-import kotlin.test.assertEquals
-import kotlin.test.assertTrue
-
-/**
- * How a run of tool calls is cut into rows: the call still running, the last call in the
- * transcript, and one held out because the reader has it open are drawn on their own, and every
- * piece the cut leaves behind still has a key of its own -- two rows sharing one key take the app
- * down, and a key that moves takes the reader's place with it.
- */
-class ToolRowsTest {
-    private var seq = 0L
-
-    private fun call(id: String, runId: String = id, done: Boolean = true) =
-        TranscriptItem.ToolRun(
-            seq = ++seq,
-            id = id,
-            runId = runId,
-            tool = "Bash",
-            input = "{}",
-            output = if (done) "ok" else "",
-            done = done,
-        )
-
-    /** Something that is not a tool call, to put behind the run so its last call folds in. */
-    private fun reply() = TranscriptItem.AssistantMsg(seq = ++seq, text = "done")
-
-    private fun shape(rows: List<TranscriptRow>) = rows.map { row ->
-        when (row) {
-            is TranscriptRow.Tools -> row.calls.map { it.id }
-            is TranscriptRow.Single -> listOf((row.item as? TranscriptItem.ToolRun)?.id ?: "reply")
-        }
-    }
-
-    private fun assertKeysDistinct(rows: List<TranscriptRow>) =
-        assertEquals(rows.size, rows.map { it.key }.toSet().size, "$rows")
-
-    @Test
-    fun the_call_still_running_is_a_row_of_its_own() {
-        val rows =
-            groupToolRuns(
-                listOf(
-                    call("a"),
-                    call("b", runId = "a"),
-                    call("c", runId = "a", done = false),
-                    call("d", runId = "a"),
-                    reply(),
-                )
-            )
-        assertEquals(
-            listOf(listOf("a", "b"), listOf("c"), listOf("d"), listOf("reply")),
-            shape(rows),
-        )
-        assertKeysDistinct(rows)
-    }
-
-    @Test
-    fun a_call_running_in_the_middle_of_its_run_splits_the_group_in_two() {
-        val rows =
-            groupToolRuns(
-                listOf(
-                    call("a"),
-                    call("b", runId = "a", done = false),
-                    call("c", runId = "a"),
-                    call("d", runId = "a"),
-                    reply(),
-                )
-            )
-        assertEquals(
-            listOf(listOf("a"), listOf("b"), listOf("c", "d"), listOf("reply")),
-            shape(rows),
-        )
-        assertKeysDistinct(rows)
-    }
-
-    /**
-     * A call held out is one the reader opened while it stood on its own; being overtaken while
-     * they read it does not fold it away, and closing it hands it back to its run.
-     */
-    @Test
-    fun a_held_out_call_stays_out_of_its_group() {
-        val calls =
-            listOf(
-                call("a"),
-                call("b", runId = "a"),
-                call("c", runId = "a"),
-                call("d", runId = "a"),
-                reply(),
-            )
-
-        val whileHeld = groupToolRuns(calls, heldOut = setOf("d"))
-        val afterItCloses = groupToolRuns(calls)
-
-        assertEquals(listOf(listOf("a", "b", "c"), listOf("d"), listOf("reply")), shape(whileHeld))
-        assertTrue(whileHeld[1] is TranscriptRow.Single, "$whileHeld")
-        assertKeysDistinct(whileHeld)
-        assertEquals(listOf(listOf("a", "b", "c", "d"), listOf("reply")), shape(afterItCloses))
-        assertTrue(afterItCloses.first() is TranscriptRow.Tools, "$afterItCloses")
-    }
-
-    /**
-     * The one case where the run's name is a call that is not in the run's first row: a page of
-     * history joined onto a run whose own first call is still going ([joinPages] renames the older
-     * calls to the newer run's name). Both rows would key on that name.
-     */
-    @Test
-    fun the_run_keeps_its_name_even_when_the_call_it_is_named_after_is_the_one_running() {
-        val rows = groupToolRuns(listOf(call("a", runId = "b"), call("b", done = false)))
-        assertEquals(listOf(listOf("a"), listOf("b")), shape(rows))
-        assertKeysDistinct(rows)
-        assertEquals("b", rows.first().key)
-    }
-
-    @Test
-    fun a_run_that_reappears_after_another_row_keeps_distinct_keys() {
-        val rows =
-            groupToolRuns(
-                listOf(
-                    call("older", runId = "exec-1"),
-                    call("older-2", runId = "exec-1"),
-                    reply(),
-                    call("exec-1", runId = "exec-1"),
-                    call("newer", runId = "exec-1"),
-                    reply(),
-                )
-            )
-
-        assertTrue(rows[0] is TranscriptRow.Tools, "$rows")
-        assertTrue(rows[2] is TranscriptRow.Tools, "$rows")
-        assertKeysDistinct(rows)
-        assertEquals("exec-1", rows[0].key)
-        assertEquals("exec-1/exec-1", rows[2].key)
-    }
-
-    /**
-     * Finishing is not what folds a call back in -- being overtaken is. A session that has run its
-     * last command and is writing its reply leaves that command standing until the reply starts.
-     */
-    @Test
-    fun the_last_call_stays_out_when_it_finishes_and_folds_in_when_something_follows() {
-        val a = call("a")
-        val running = call("b", runId = "a", done = false)
-        val finished = running.copy(done = true)
-        val whileRunning = groupToolRuns(listOf(a, running))
-        val afterItEnds = groupToolRuns(listOf(a, finished))
-        val afterTheReply = groupToolRuns(listOf(a, finished, reply()))
-        assertEquals(listOf(listOf("a"), listOf("b")), shape(whileRunning))
-        assertEquals(listOf(listOf("a"), listOf("b")), shape(afterItEnds))
-        assertEquals(listOf(listOf("a", "b"), listOf("reply")), shape(afterTheReply))
-        // The run keeps the key it was drawn under throughout, so the list rebuilds a row rather
-        // than losing its anchor.
-        assertEquals(whileRunning.first().key, afterItEnds.first().key)
-        assertEquals(whileRunning.first().key, afterTheReply.first().key)
-    }
-
-    @Test
-    fun a_run_of_finished_calls_is_one_group_once_something_follows_it() {
-        val rows =
-            groupToolRuns(
-                listOf(call("a"), call("b", runId = "a"), call("c", runId = "a"), reply())
-            )
-        assertEquals(listOf(listOf("a", "b", "c"), listOf("reply")), shape(rows))
-        assertTrue(rows.first() is TranscriptRow.Tools, "$rows")
-    }
-}

app/androidApp/src/test/kotlin/com/example/aiapp/TranscriptCacheTest.kt

@@ -23,7 +23,7 @@ class TranscriptCacheTest {
 
     private fun cache() = TranscriptCache(File(temp, "v1/host_8443")) { said += it }
 
-    private fun session(id: String = "s") = cache().session(TranscriptAddress(id))
+    private fun session(id: String = "s") = cache().session(id)
 
     private fun line(seq: Long, type: String = "toolStart") =
         """{"seq":$seq,"ts":1.5,"type":"$type","id":"x"}"""

app/androidApp/src/test/kotlin/com/example/aiapp/TranscriptItemsTest.kt

@@ -1,185 +0,0 @@
-package com.example.aiapp
-
-import kotlin.test.Test
-import kotlin.test.assertEquals
-import kotlin.test.assertTrue
-
-/**
- * Where one turn ends and the next begins, which is the part of the fold that had no way of saying
- * anything was wrong: two replies run together read as one long answer, and the seam is somewhere
- * in the middle of a sentence.
- */
-class TranscriptItemsTest {
-    private var seq = 0L
-
-    private fun fold(items: List<TranscriptItem>, event: SessionEvent) =
-        foldEvent(items, SeqEvent(seq = ++seq, ts = 1.0, event = event))
-
-    private fun fold(vararg events: SessionEvent) =
-        events.fold(emptyList<TranscriptItem>()) { items, event -> fold(items, event) }
-
-    private fun texts(items: List<TranscriptItem>) =
-        items.filterIsInstance<TranscriptItem.AssistantMsg>().map { it.text }
-
-    @Test
-    fun an_authentication_failure_stays_visible_as_an_error_row() {
-        val entry =
-            SeqEvent(
-                seq = 7,
-                ts = 1.0,
-                event = SessionEvent.AuthenticationRequired("sign in again"),
-            )
-
-        assertEquals(
-            TranscriptItem.ErrorMsg(7, "sign in again"),
-            foldEvent(emptyList(), entry).single(),
-        )
-    }
-
-    @Test
-    fun text_after_the_turn_ended_is_a_new_reply_rather_than_more_of_the_last_one() {
-        val items =
-            fold(
-                SessionEvent.AssistantText("You'll get the one-line notice when it lands."),
-                SessionEvent.Status("idle"),
-                SessionEvent.AssistantText("Dev Updater fix is pushed."),
-            )
-        assertEquals(
-            listOf("You'll get the one-line notice when it lands.", "Dev Updater fix is pushed."),
-            texts(items),
-        )
-    }
-
-    @Test
-    fun deltas_of_one_reply_still_accumulate_into_it() {
-        val items =
-            fold(
-                SessionEvent.AssistantText("Still "),
-                SessionEvent.AssistantText("running "),
-                SessionEvent.Status("running"),
-                SessionEvent.AssistantText("its tests."),
-            )
-        assertEquals(listOf("Still running its tests."), texts(items))
-    }
-
-    @Test
-    fun completed_text_replaces_provisional_deltas_live() {
-        val items =
-            fold(
-                SessionEvent.AssistantText("I'll inspect the color-c concrete implementation"),
-                SessionEvent.AssistantTextFinal(
-                    "I’ll inspect the color-correction TODO and the relevant design."
-                ),
-            )
-        assertEquals(
-            listOf("I’ll inspect the color-correction TODO and the relevant design."),
-            texts(items),
-        )
-    }
-
-    @Test
-    fun completed_text_discards_provisional_deltas_across_a_page_boundary() {
-        val earlier = fold(SessionEvent.AssistantText("1. provisional section\n\n"))
-        val later =
-            fold(
-                SessionEvent.AssistantTextFinal("1. final first section\n\n2. final second section")
-            )
-
-        assertEquals(
-            listOf("1. final first section\n\n2. final second section"),
-            texts(joinPages(earlier, later)),
-        )
-    }
-
-    @Test
-    fun a_final_value_after_a_settled_reply_is_a_new_message_across_a_page_boundary() {
-        val earlier =
-            fold(
-                SessionEvent.AssistantText("Previous answer."),
-                SessionEvent.Status("idle"),
-            )
-        val later = fold(SessionEvent.AssistantTextFinal("Next answer."))
-
-        assertEquals(
-            listOf("Previous answer.", "Next answer."),
-            texts(joinPages(earlier, later)),
-        )
-    }
-
-    /**
-     * The rule that replaced the wall of reports. A turn that starts with nothing recorded in front
-     * of it -- a subagent finishing, the CLI picking a conversation back up -- leaves two replies
-     * abutting, and only the break says they are two.
-     */
-    @Test
-    fun two_replies_that_meet_are_separated_by_a_rule_and_nothing_else() {
-        val items =
-            fold(
-                SessionEvent.AssistantText("Launched it."),
-                SessionEvent.Status("waiting"),
-                SessionEvent.AssistantText("Noted."),
-            )
-        assertEquals(3, items.size, "$items")
-        assertTrue(items[1] is TranscriptItem.TurnBreak, "$items")
-        assertEquals(listOf("Launched it.", "Noted."), texts(items))
-        // Distinct keys: the break shares the reply's seq, and two items with one key take the
-        // app down.
-        assertEquals(3, items.map { it.key }.toSet().size, "$items")
-    }
-
-    /**
-     * A reply after anything that draws a row of its own needs no rule: that row is the boundary.
-     */
-    @Test
-    fun a_reply_after_a_row_of_its_own_gets_no_rule() {
-        val items =
-            fold(
-                SessionEvent.AssistantText("Launched it."),
-                SessionEvent.Status("idle"),
-                SessionEvent.UserMessage("carry on", null, emptyList()),
-                SessionEvent.AssistantText("Noted."),
-            )
-        assertTrue(items.none { it is TranscriptItem.TurnBreak }, "$items")
-    }
-
-    @Test
-    fun a_repeated_tool_start_is_still_one_row() {
-        val start = SessionEvent.ToolStart("exec-1", "Bash", "{\"command\":\"cargo test\"}")
-        val items =
-            fold(
-                start,
-                SessionEvent.AssistantText("The test run is still going."),
-                start,
-                SessionEvent.ToolEnd("exec-1", "finished"),
-            )
-
-        val tools = items.filterIsInstance<TranscriptItem.ToolRun>()
-        assertEquals(1, tools.size, "$items")
-        assertEquals("finished", tools.single().output)
-        assertTrue(tools.single().done)
-    }
-
-    /**
-     * The page-join half of the same rule. A boundary that cuts one reply leaves an unfinished half
-     * to be rejoined; a boundary that lands between two turns must not join anything, or paging
-     * back puts the run-together paragraph straight back.
-     */
-    @Test
-    fun paging_back_rejoins_a_cut_reply_and_leaves_two_finished_ones_apart() {
-        val cut =
-            joinPages(
-                listOf(TranscriptItem.AssistantMsg(1, "half a ")),
-                listOf(TranscriptItem.AssistantMsg(2, "sentence", settled = true)),
-            )
-        assertEquals(listOf("half a sentence"), texts(cut))
-
-        val whole =
-            joinPages(
-                listOf(TranscriptItem.AssistantMsg(1, "One turn.", settled = true)),
-                listOf(TranscriptItem.AssistantMsg(2, "The next.", settled = true)),
-            )
-        assertEquals(listOf("One turn.", "The next."), texts(whole))
-        // And the rule between them, which the fold that would have made it never got to see.
-        assertTrue(whole.any { it is TranscriptItem.TurnBreak }, "$whole")
-    }
-}

app/build-icon-font.sh

@@ -45,11 +45,6 @@ GLYPHS=(
     U+F0193  # md-content_save
     U+F0224  # md-file_outline
     U+F201   # fa-line_chart -- Font Awesome's, asked for by name
-    U+F035C  # md-menu -- the burger, as a row's drag handle
-    U+F07B7  # md-console_line -- a backgrounded command
-    U+F06A9  # md-robot -- a subagent
-    U+F04AA  # md-sitemap -- a workflow
-    U+F0625  # md-help_circle_outline -- a background task of a kind this build does not know
 )
 
 url=https://github.com/ryanoasis/nerd-fonts/releases/latest/download/NerdFontsSymbolsOnly.zip

app/debug-transcript.sh

@@ -120,10 +120,10 @@ TOKEN=$(grep -o 'token=[A-Za-z0-9_-]*' "$WORK/server.log" | head -1 | cut -d= -f
 api() { curl -s --cacert "$CERTS/ca.pem" -H "Authorization: Bearer $TOKEN" "$@"; }
 
 echo "==> Importing"
-MACHINE=$(api "https://127.0.0.1:$PORT/machines" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p' | head -1)
+SETUP=$(api "https://127.0.0.1:$PORT/setups" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p' | head -1)
 SESSION=$(api -H 'Content-Type: application/json' -X POST \
     "https://127.0.0.1:$PORT/sessions" \
-    -d "{\"machine\":\"$MACHINE\",\"provider\":\"claude-cli\",\"title\":\"$PROJECT\",\"import\":\"$ID\"}" \
+    -d "{\"setup\":\"$SETUP\",\"provider\":\"claude-cli\",\"title\":\"$PROJECT\",\"import\":\"$ID\"}" \
     | sed -n 's/.*"id":"\([^"]*\)".*/\1/p' | head -1)
 echo "    session $SESSION, $(wc -l < "$WORK/sessions/$SESSION/transcript.jsonl") events"
 

app/run-android.sh

@@ -9,7 +9,7 @@
 # emulator" is three places for the memory check that was missing from all of
 # them.
 #
-# Environment machine (SDK location, PATH, ...) lives in ./android-env.sh,
+# Environment setup (SDK location, PATH, ...) lives in ./android-env.sh,
 # which can also be sourced directly for one-off commands.
 set -eu
 

app/ui-sandbox.sh

@@ -110,7 +110,7 @@ api) # ./ui-sandbox.sh api /path [curl args...]
     ;;
 spawn) # ./ui-sandbox.sh spawn [title]  -- an echo session; prints its id
     api /sessions -X POST -H 'content-type: application/json' \
-        -d "{\"machine\":\"local\",\"provider\":\"echo\",\"title\":\"${2:-test}\"}" |
+        -d "{\"setup\":\"local\",\"provider\":\"echo\",\"title\":\"${2:-test}\"}" |
         python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])'
     exit 0
     ;;
@@ -150,7 +150,7 @@ if [ -f "$ROOT/config.ron" ]; then
         /^tokens: \[/ { in_tokens = 1; next }
         # The server writes the list back compactly, with the last entry
         # and the close on one line: "    ),],". Reading the close only
-        # at a line start ran past it into `machines`, and the salvage then
+        # at a line start ran past it into `setups`, and the salvage then
         # carried a second copy of that block into the new config.
         in_tokens && /\],/ {
             sub(/\],.*/, "")
@@ -213,24 +213,13 @@ while [ "$i" -le 8 ]; do
     i=$((i + 1))
 done
 
-# A CLI that does nothing during a session and offers one deterministic login
-# during `auth login`, so both paths are free and safe. Everything the spawn
-# path cares about is here: it holds the fifo open, records a real pid, writes
-# nothing, and dies on a signal. A real
+# A CLI that does nothing, so importing one of these is free and safe.
+# Everything the spawn path cares about is here: it holds the fifo open,
+# records a real pid, writes nothing, and dies on a signal. A real
 # `claude --resume` against an invented session id would either fail in a
 # way that tests nothing or start a turn on somebody's account.
 cat >"$ROOT/fake-claude" <<FAKE
 #!/bin/sh
-if [ "\${1:-}" = auth ] && [ "\${2:-}" = login ]; then
-    echo 'https://claude.com/cai/oauth/authorize?state=ai-app-sandbox'
-    while IFS= read -r code; do
-        if [ "\$code" = sandbox-code ]; then
-            exit 0
-        fi
-        echo 'Invalid code' >&2
-    done
-    exit 1
-fi
 # Slow to start, on purpose. An import against this finishes in
 # milliseconds otherwise, so every state on the way -- the row marked
 # "importing", the queue behind it, the event that clears them -- is over
@@ -357,7 +346,7 @@ tokens: [
         sha256: "$hash",
     ),
 $salvaged],
-machines: [
+setups: [
     (
         id: "local",
         name: "sandbox",

client-core/Cargo.lock

@@ -0,0 +1,940 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "cc"
+version = "1.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "005ec2760ca554fae18df7a11195552ec576cd665632a881bc011d5bb2fd4d80"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "client-core"
+version = "0.1.0"
+dependencies = [
+ "event-model",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "ureq",
+]
+
+[[package]]
+name = "cookie"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a373e3602691c3cdea496d2f0ee5935151e6168fe87739483c463db1b2f2f87"
+dependencies = [
+ "percent-encoding",
+ "time",
+ "version_check",
+]
+
+[[package]]
+name = "cookie_store"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b2c103cf610ec6cae3da84a766285b42fd16aad564758459e6ecf128c75206"
+dependencies = [
+ "cookie",
+ "document-features",
+ "idna",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "time",
+ "url",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "document-features"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
+dependencies = [
+ "litrs",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "event-model"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e0f1c7c3a72c66fd80abe965175f7523475c0489a87d3ff9d6e8c87d87a9d2d"
+
+[[package]]
+name = "flate2"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+ "zlib-rs",
+]
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "icu_collections"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
+
+[[package]]
+name = "icu_properties"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
+
+[[package]]
+name = "icu_provider"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
+[[package]]
+name = "litrs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
+dependencies = [
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "smallvec"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9be42f50aa861c555654aa3a37f52f4b1074bacf4e48fe0ef7fa584e80f1f0f"
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12df2e0110f65b775f769bb17ef989067a1d931b2eb822bd4346631eeada89f9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.3",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "ureq"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "972d7902c8735f2695410b8aed7df6ed12a47394aa1c8d7af49f0497b731a94d"
+dependencies = [
+ "base64",
+ "cookie_store",
+ "flate2",
+ "log",
+ "percent-encoding",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "ureq-proto",
+ "utf8-zero",
+ "webpki-roots",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da5f78b09e6941e1a0f2e30e695e4b120377b54d5e0aec11b594bb57b3971613"
+dependencies = [
+ "base64",
+ "http",
+ "httparse",
+ "log",
+]
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8-zero"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "zlib-rs"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34b31d188d9d685a4f9c7b46d6e36631b07058d2cfe190267adce54dc230bf12"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"

client-core/Cargo.toml

@@ -0,0 +1,32 @@
+[package]
+name = "client-core"
+version = "0.1.0"
+edition = "2024"
+
+# The app's pure logic, held once instead of twice: the event model (shared
+# with `server/` via `event-model`), the REST + SSE clients for its HTTP
+# surface (see `server/src/routes.rs`'s module doc for the table), the
+# transcript fold and cache, the markdown block model, the syntax
+# highlighter and the ANSI parser. See CLIENT_CORE.md at the repo root for
+# what this holds today, what it does not yet, and how it corresponds to
+# the Kotlin it replaces.
+#
+# No UI framework dependency of any kind -- this crate is meant to outlive
+# whichever one the app ends up drawing with (see RUST.md).
+
+[dependencies]
+event-model = { path = "../event-model" }
+serde = { version = "1", features = ["derive"] }
+serde_json = { version = "1", features = ["float_roundtrip"] }
+# The blocking HTTP client for the REST calls and the long-lived SSE GETs.
+# `server/` already depends on ureq for its own outbound HTTPS (the usage
+# poll in usage.rs) and it is rustls-backed like the rest of this project's
+# TLS, so this reuses that choice rather than pulling in reqwest's async
+# stack -- a client that runs one blocking request at a time, the way
+# Api.kt's `HttpURLConnection` calls and Sse.kt's blocking read loop do, has
+# no need of an async runtime, and RUST.md's brief for this port is
+# "lightweight" throughout.
+ureq = { version = "3", features = ["json"] }
+
+[dev-dependencies]
+tempfile = "3"

client-core/src/ansi.rs

@@ -0,0 +1,534 @@
+//! What a tool printed, with its terminal styling applied and everything
+//! else taken out. Ported from `app/.../Ansi.kt`, module for module: the
+//! Kotlin version builds a Compose `AnnotatedString`, which does not exist
+//! here, so a [`StyledText`] of plain text plus non-overlapping
+//! `(Range, Style)` spans stands in for it -- a future UI layer maps
+//! [`Style`] onto whatever it draws with.
+//!
+//! Bash output arrives exactly as the program wrote it, escape sequences
+//! included, and drawn verbatim those are line noise in the middle of the
+//! thing being read. Stripping them all would be the other half-answer --
+//! colour is often the whole of what a diff or a test run is saying.
+//!
+//! So the sequences that decide how text *looks* become spans, and every
+//! other one is dropped rather than shown: the rest move a cursor around a
+//! grid this is not, and "go to column 40" has no meaning in a scrolling
+//! document.
+//!
+//! A carriage return is honoured the way a terminal honours it: what was
+//! written since the last line break is thrown away and the line starts
+//! again. That is what makes a progress bar show its final state rather
+//! than every state it passed through.
+
+use std::ops::Range;
+
+/// An RGB colour, the same shape wherever this crate names one -- no alpha,
+/// because the one place that needs partial transparency (dimming) says so
+/// with a separate flag rather than baking it into the colour.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Rgb {
+    pub r: u8,
+    pub g: u8,
+    pub b: u8,
+}
+
+impl Rgb {
+    pub const fn new(r: u8, g: u8, b: u8) -> Self {
+        Self { r, g, b }
+    }
+}
+
+/// The sixteen colours a terminal program names, and the two it assumes.
+///
+/// Its own palette rather than the syntax one: a program that prints in red
+/// has chosen red, where a highlighter's colours are this app's reading of
+/// somebody else's code.
+#[derive(Debug, Clone)]
+pub struct AnsiPalette {
+    /// Indexes 0-7, then 8-15 bright, in the terminal's own order.
+    pub colours: [Rgb; 16],
+    /// What uncoloured text is, needed only where a style has to state a colour.
+    pub foreground: Rgb,
+    /// What the text sits on, needed for reverse video.
+    pub background: Rgb,
+}
+
+/// One span's worth of styling. `None` fields mean "unspecified", the same
+/// meaning `Color.Unspecified` and a null `FontWeight` carried in the Kotlin.
+#[derive(Debug, Clone, Copy, PartialEq, Default)]
+pub struct Style {
+    pub color: Option<Rgb>,
+    /// How much of `color`'s alpha survives, 0.0-1.0; `None` is opaque.
+    pub alpha: Option<f32>,
+    pub background: Option<Rgb>,
+    pub bold: bool,
+    pub italic: bool,
+    pub underline: bool,
+    pub strikethrough: bool,
+}
+
+/// Plain text plus the non-overlapping, ordered spans that style parts of it
+/// -- this crate's stand-in for Compose's `AnnotatedString`.
+#[derive(Debug, Clone, PartialEq, Default)]
+pub struct StyledText {
+    pub text: String,
+    pub spans: Vec<(Range<usize>, Style)>,
+}
+
+impl StyledText {
+    fn plain(text: String) -> Self {
+        Self {
+            text,
+            spans: Vec::new(),
+        }
+    }
+}
+
+const ESC: char = '\u{1B}';
+const BELL: char = '\u{7}';
+
+/// [text] with its terminal styling applied and everything else taken out;
+/// see the module doc.
+pub fn ansi_styled(text: &str, palette: &AnsiPalette) -> StyledText {
+    // The common case by a long way -- nothing to do, and nothing allocated
+    // to find that out.
+    if !text.contains(ESC) && !text.contains('\r') {
+        return StyledText::plain(text.to_string());
+    }
+
+    let chars: Vec<char> = text.chars().collect();
+    let mut runs: Vec<(String, Option<Style>)> = Vec::new();
+    let mut sgr = Sgr::PLAIN;
+    let mut at = 0usize;
+    let mut plain = String::new();
+
+    let flush = |plain: &mut String, sgr: Sgr, runs: &mut Vec<(String, Option<Style>)>| {
+        if !plain.is_empty() {
+            runs.push((std::mem::take(plain), sgr.span(palette)));
+        }
+    };
+
+    while at < chars.len() {
+        let c = chars[at];
+        if c == ESC {
+            flush(&mut plain, sgr, &mut runs);
+            at = skip_escape(&chars, at, |params, final_byte| {
+                if final_byte == 'm' {
+                    sgr = sgr.apply(params, palette);
+                }
+            });
+        } else if c == '\r' && chars.get(at + 1) != Some(&'\n') {
+            // A bare carriage return rewrites the line. One before a newline
+            // is the other half of a Windows line ending: it rewrites
+            // nothing, and it is dropped rather than kept, since that pair
+            // is one line break.
+            flush(&mut plain, sgr, &mut runs);
+            drop_line(&mut runs);
+            at += 1;
+        } else if c == '\r' {
+            at += 1;
+        } else if c >= ' ' || c == '\n' || c == '\t' {
+            // Everything printable, plus the two control characters that are
+            // layout rather than terminal commands. A stray bell or
+            // backspace goes for the same reason a cursor move does.
+            plain.push(c);
+            at += 1;
+        } else {
+            at += 1;
+        }
+    }
+    flush(&mut plain, sgr, &mut runs);
+
+    let mut out = String::new();
+    let mut spans = Vec::new();
+    for (run_text, style) in runs {
+        let start = out.len();
+        out.push_str(&run_text);
+        if let Some(style) = style {
+            spans.push((start..out.len(), style));
+        }
+    }
+    StyledText { text: out, spans }
+}
+
+/// Throws away everything written since the last line break, as a carriage
+/// return does.
+fn drop_line(runs: &mut Vec<(String, Option<Style>)>) {
+    while let Some((text, style)) = runs.pop() {
+        if let Some(break_at) = text.rfind('\n') {
+            runs.push((text[..=break_at].to_string(), style));
+            return;
+        }
+    }
+}
+
+/// The bytes that end a CSI sequence.
+fn is_csi_final(c: char) -> bool {
+    ('@'..='~').contains(&c)
+}
+
+/// Steps over the escape sequence starting at `at`, reporting a CSI's
+/// parameters and final byte. One reader for every kind, because the point
+/// is to *leave* them all behind: a sequence this did not recognise would
+/// otherwise have its body printed as ordinary text. Three shapes -- the CSI
+/// (`ESC [ ... letter`), the string escapes which run to a terminator, and
+/// the two-character ones.
+fn skip_escape(chars: &[char], at: usize, mut on_csi: impl FnMut(&str, char)) -> usize {
+    let Some(&next) = chars.get(at + 1) else {
+        return at + 1;
+    };
+    match next {
+        '[' => {
+            let mut end = at + 2;
+            while end < chars.len() && !is_csi_final(chars[end]) {
+                end += 1;
+            }
+            if end >= chars.len() {
+                // Cut off mid-sequence, which is what a stream that has not
+                // finished arriving looks like: drop the fragment rather
+                // than printing it, and the whole sequence arrives with the
+                // next delta.
+                chars.len()
+            } else {
+                let params: String = chars[at + 2..end].iter().collect();
+                on_csi(&params, chars[end]);
+                end + 1
+            }
+        }
+        ']' | 'P' | 'X' | '^' | '_' => {
+            // Runs to a string terminator: `ESC \`, or the bell that xterm
+            // allows after an OSC.
+            let mut end = at + 2;
+            while end < chars.len() {
+                if chars[end] == BELL {
+                    return end + 1;
+                }
+                if chars[end] == ESC && chars.get(end + 1) == Some(&'\\') {
+                    return end + 2;
+                }
+                end += 1;
+            }
+            chars.len()
+        }
+        _ => at + 2,
+    }
+}
+
+/// Everything an SGR sequence can turn on, as the terminal tracks it.
+#[derive(Debug, Clone, Copy, PartialEq)]
+struct Sgr {
+    fg: Option<Rgb>,
+    bg: Option<Rgb>,
+    bold: bool,
+    dim: bool,
+    italic: bool,
+    underline: bool,
+    strike: bool,
+    reverse: bool,
+}
+
+/// How much of its colour dim text keeps: enough to read, little enough to recede.
+const DIM_ALPHA: f32 = 0.65;
+
+impl Sgr {
+    const PLAIN: Sgr = Sgr {
+        fg: None,
+        bg: None,
+        bold: false,
+        dim: false,
+        italic: false,
+        underline: false,
+        strike: false,
+        reverse: false,
+    };
+
+    /// `None` while nothing is set, so unstyled output costs no spans at all.
+    fn span(&self, palette: &AnsiPalette) -> Option<Style> {
+        if *self == Sgr::PLAIN {
+            return None;
+        }
+        let front = if self.reverse {
+            Some(self.bg.unwrap_or(palette.background))
+        } else {
+            self.fg
+        };
+        let back = if self.reverse {
+            Some(self.fg.unwrap_or(palette.foreground))
+        } else {
+            self.bg
+        };
+        // Dim has to have a colour to dim, so where none was named it dims
+        // the ordinary one.
+        let stated = front.or(if self.dim {
+            Some(palette.foreground)
+        } else {
+            None
+        });
+        Some(Style {
+            color: stated,
+            alpha: if self.dim { Some(DIM_ALPHA) } else { None },
+            background: back,
+            bold: self.bold,
+            italic: self.italic,
+            underline: self.underline,
+            strikethrough: self.strike,
+        })
+    }
+
+    /// This state with `params` applied -- one `ESC[...m`, which carries any
+    /// number of them.
+    ///
+    /// A code this does not model is ignored rather than reset from: the
+    /// program meant something by it, and starting again would also drop
+    /// the codes beside it that are understood.
+    fn apply(&self, params: &str, palette: &AnsiPalette) -> Sgr {
+        // `ESC[m` means `ESC[0m`, and an empty parameter inside a list is a
+        // zero too.
+        let codes: Vec<i64> = params
+            .split(';')
+            .map(|p| p.trim().parse::<i64>().unwrap_or(0))
+            .collect();
+        let mut state = *self;
+        let mut at = 0usize;
+        while at < codes.len() {
+            let code = codes[at];
+            state = match code {
+                0 => Sgr::PLAIN,
+                1 => Sgr {
+                    bold: true,
+                    ..state
+                },
+                2 => Sgr { dim: true, ..state },
+                3 => Sgr {
+                    italic: true,
+                    ..state
+                },
+                4 => Sgr {
+                    underline: true,
+                    ..state
+                },
+                7 => Sgr {
+                    reverse: true,
+                    ..state
+                },
+                9 => Sgr {
+                    strike: true,
+                    ..state
+                },
+                21 | 22 => Sgr {
+                    bold: false,
+                    dim: false,
+                    ..state
+                },
+                23 => Sgr {
+                    italic: false,
+                    ..state
+                },
+                24 => Sgr {
+                    underline: false,
+                    ..state
+                },
+                27 => Sgr {
+                    reverse: false,
+                    ..state
+                },
+                29 => Sgr {
+                    strike: false,
+                    ..state
+                },
+                30..=37 => Sgr {
+                    fg: Some(palette.colours[(code - 30) as usize]),
+                    ..state
+                },
+                90..=97 => Sgr {
+                    fg: Some(palette.colours[(code - 90 + 8) as usize]),
+                    ..state
+                },
+                40..=47 => Sgr {
+                    bg: Some(palette.colours[(code - 40) as usize]),
+                    ..state
+                },
+                100..=107 => Sgr {
+                    bg: Some(palette.colours[(code - 100 + 8) as usize]),
+                    ..state
+                },
+                39 => Sgr { fg: None, ..state },
+                49 => Sgr { bg: None, ..state },
+                38 | 48 => {
+                    let (colour, last) = extended_colour(&codes, at, palette);
+                    at = last;
+                    if code == 38 {
+                        Sgr {
+                            fg: colour,
+                            ..state
+                        }
+                    } else {
+                        Sgr {
+                            bg: colour,
+                            ..state
+                        }
+                    }
+                }
+                _ => state,
+            };
+            at += 1;
+        }
+        state
+    }
+}
+
+/// The colour named by a `38`/`48` at `at`, and the index of that colour's
+/// last parameter.
+///
+/// Two forms: `5;n` for the 256-colour table and `2;r;g;b` for a literal
+/// one. The first sixteen of that table are the palette's own, so a program
+/// asking for "colour 1" through either spelling gets the same red.
+fn extended_colour(codes: &[i64], at: usize, palette: &AnsiPalette) -> (Option<Rgb>, usize) {
+    match codes.get(at + 1) {
+        Some(&5) => match codes.get(at + 2) {
+            None => (None, at + 1),
+            Some(&n) => (Some(indexed_colour(n, palette)), at + 2),
+        },
+        Some(&2) => {
+            let r = codes.get(at + 2);
+            let g = codes.get(at + 3);
+            let b = codes.get(at + 4);
+            match (r, g, b) {
+                (Some(&r), Some(&g), Some(&b)) => (
+                    Some(Rgb::new(
+                        r.clamp(0, 255) as u8,
+                        g.clamp(0, 255) as u8,
+                        b.clamp(0, 255) as u8,
+                    )),
+                    at + 4,
+                ),
+                _ => (None, at + 1),
+            }
+        }
+        _ => (None, at + 1),
+    }
+}
+
+/// The six levels of each channel in the 256-colour cube, as xterm defines them.
+const CUBE: [u8; 6] = [0, 95, 135, 175, 215, 255];
+
+/// One of the 256 colours: the palette's sixteen, then a 6x6x6 cube, then a
+/// grey ramp.
+fn indexed_colour(n: i64, palette: &AnsiPalette) -> Rgb {
+    if n < 0 {
+        palette.foreground
+    } else if n < 16 {
+        palette.colours[n as usize]
+    } else if n < 232 {
+        let i = (n - 16) as usize;
+        Rgb::new(CUBE[i / 36], CUBE[i / 6 % 6], CUBE[i % 6])
+    } else if n < 256 {
+        let grey = (8 + (n - 232) * 10) as u8;
+        Rgb::new(grey, grey, grey)
+    } else {
+        palette.foreground
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A palette matching the Kotlin test's: `colours[i] = Rgb(i, 0, 0)`,
+    /// white foreground, black background.
+    fn palette() -> AnsiPalette {
+        let mut colours = [Rgb::new(0, 0, 0); 16];
+        for (i, c) in colours.iter_mut().enumerate() {
+            *c = Rgb::new(i as u8, 0, 0);
+        }
+        AnsiPalette {
+            colours,
+            foreground: Rgb::new(255, 255, 255),
+            background: Rgb::new(0, 0, 0),
+        }
+    }
+
+    fn styled(text: &str) -> StyledText {
+        ansi_styled(text, &palette())
+    }
+
+    /// The style covering the first character of `word`, or `None` where
+    /// nothing styles it.
+    fn style_over(text: &str, word: &str) -> Option<Style> {
+        let out = styled(text);
+        let at = out
+            .text
+            .find(word)
+            .unwrap_or_else(|| panic!("no {word:?} in {}", out.text));
+        out.spans
+            .iter()
+            .find(|(range, _)| range.contains(&at))
+            .map(|(_, style)| *style)
+    }
+
+    #[test]
+    fn a_colour_becomes_a_span_and_the_sequence_itself_disappears() {
+        let text = format!("plain {ESC}[31mred{ESC}[0m plain");
+        assert_eq!(styled(&text).text, "plain red plain");
+        assert_eq!(
+            style_over(&text, "red").unwrap().color,
+            Some(Rgb::new(1, 0, 0))
+        );
+        assert!(style_over(&text, "plain").is_none());
+    }
+
+    #[test]
+    fn bright_background_and_256_colour_forms_all_reach_the_same_table() {
+        assert_eq!(
+            style_over(&format!("{ESC}[91mx"), "x").unwrap().color,
+            Some(Rgb::new(9, 0, 0))
+        );
+        assert_eq!(
+            style_over(&format!("{ESC}[44mx"), "x").unwrap().background,
+            Some(Rgb::new(4, 0, 0))
+        );
+        assert_eq!(
+            style_over(&format!("{ESC}[38;5;1mx"), "x").unwrap().color,
+            Some(Rgb::new(1, 0, 0))
+        );
+        assert_eq!(
+            style_over(&format!("{ESC}[38;5;16mx"), "x").unwrap().color,
+            Some(Rgb::new(0, 0, 0))
+        );
+        assert_eq!(
+            style_over(&format!("{ESC}[38;5;231mx"), "x").unwrap().color,
+            Some(Rgb::new(255, 255, 255))
+        );
+        assert_eq!(
+            style_over(&format!("{ESC}[38;2;10;20;30mx"), "x")
+                .unwrap()
+                .color,
+            Some(Rgb::new(10, 20, 30))
+        );
+    }
+
+    #[test]
+    fn everything_that_is_not_styling_is_dropped_rather_than_printed() {
+        // A cursor move, an erase, an OSC window title with its bell, and a
+        // bare two-character escape.
+        let text = format!("a{ESC}[2Jb{ESC}[Kc{ESC}]0;a title{BELL}d{ESC}=e");
+        assert_eq!(styled(&text).text, "abcde");
+    }
+
+    #[test]
+    fn a_carriage_return_rewrites_its_line_as_it_does_on_a_terminal() {
+        assert_eq!(styled("10%\r50%\rdone\n").text, "done\n");
+        assert_eq!(styled("kept\r\nfirst\rlast").text, "kept\nlast");
+    }
+
+    #[test]
+    fn a_sequence_cut_off_mid_stream_takes_no_text_with_it() {
+        assert_eq!(styled(&format!("text {ESC}[3")).text, "text ");
+    }
+
+    #[test]
+    fn unstyled_text_costs_no_spans_at_all() {
+        assert_eq!(styled("nothing to do here").spans.len(), 0);
+        assert_eq!(styled(&format!("a{ESC}[2Jb")).spans.len(), 0);
+    }
+}

client-core/src/api.rs

@@ -0,0 +1,543 @@
+//! The REST half of the backend's surface (see `server/src/routes.rs`'s
+//! module doc for the table); the SSE half is [`crate::event_stream`].
+//! Ported from `app/.../Api.kt`, but **not at full parity yet** -- see
+//! `CLIENT_CORE.md` for exactly which routes have a typed method here and
+//! which do not.
+//!
+//! Network I/O sits behind the [`Transport`] trait so the rest of this
+//! crate, and anything built on it, can be tested against a fake one with
+//! no server involved. [`UreqTransport`] is the only real implementation.
+
+use std::io::Read;
+
+use serde::Deserialize;
+use serde_json::Value;
+
+/// A request that did not produce what it asked for, carrying the server's
+/// own wording where it sent some.
+///
+/// `status` is the HTTP status where there was a response at all, and
+/// `None` where the server was never reached -- mirroring `ApiException` in
+/// `Api.kt`.
+#[derive(Debug, Clone)]
+pub struct ApiError {
+    pub message: String,
+    pub status: Option<u16>,
+}
+
+impl std::fmt::Display for ApiError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.message)
+    }
+}
+impl std::error::Error for ApiError {}
+
+/// A request body to send, in whichever of the two shapes the surface
+/// takes: `Api.kt`'s `jsonBody` and `streamBody`.
+pub enum Body {
+    Json(Value),
+    Bytes {
+        content_type: String,
+        bytes: Vec<u8>,
+    },
+}
+
+/// What a transport hands back for a REST call: the status and the body
+/// read whole. A streamed body ([`Transport::stream`]) is a different
+/// method because its whole point is not reading it whole.
+pub struct RawResponse {
+    pub status: u16,
+    pub body: Vec<u8>,
+}
+
+/// The network boundary this crate's pure logic is kept out from behind.
+/// `server/src/routes.rs`'s module doc is the surface this drives.
+pub trait Transport: Send + Sync {
+    /// One request/response call -- everything but the long-lived SSE GETs.
+    fn request(
+        &self,
+        method: &str,
+        path: &str,
+        body: Option<Body>,
+    ) -> Result<RawResponse, ApiError>;
+
+    /// Opens `path` and answers a reader over the response body, for a
+    /// caller that reads it as a stream rather than all at once (the SSE
+    /// connections in [`crate::event_stream`]). Fails the same way
+    /// [`Transport::request`] does for a non-2xx response.
+    fn stream(&self, path: &str) -> Result<Box<dyn Read + Send>, ApiError>;
+}
+
+/// One session as `GET /sessions` and `GET /sessions/{id}` report it.
+/// Mirrors `Api.kt`'s `SessionSummary`; see that type's doc for what each
+/// field means and why `setup` is never shown.
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionSummary {
+    pub id: String,
+    pub setup: String,
+    #[serde(default)]
+    pub keeps_own_transcript: bool,
+    pub setup_name: String,
+    pub provider: String,
+    pub title: String,
+    #[serde(default)]
+    pub model: Option<String>,
+    #[serde(default)]
+    pub permission_mode: Option<String>,
+    #[serde(default)]
+    pub imported: bool,
+    #[serde(default = "default_true")]
+    pub notify: bool,
+    #[serde(default)]
+    pub cwd: Option<String>,
+    #[serde(default)]
+    pub context_tokens: Option<u64>,
+    #[serde(default)]
+    pub max_image_edge: Option<u32>,
+    pub status: String,
+    pub last_activity: f64,
+}
+
+fn default_true() -> bool {
+    true
+}
+
+/// A client-core equivalent of `requestFromServer` plus the typed calls
+/// built on it. Holds no state of its own beyond the transport -- the
+/// session id or setup id a call is about is a parameter, per this
+/// project's "ask for the least you need".
+pub struct ApiClient<T: Transport> {
+    transport: T,
+}
+
+impl<T: Transport> ApiClient<T> {
+    pub fn new(transport: T) -> Self {
+        Self { transport }
+    }
+
+    fn json_request<R: for<'de> Deserialize<'de>>(
+        &self,
+        method: &str,
+        path: &str,
+        body: Option<Value>,
+    ) -> Result<R, ApiError> {
+        let raw = self.transport.request(method, path, body.map(Body::Json))?;
+        serde_json::from_slice(&raw.body).map_err(|e| ApiError {
+            message: format!("Reached the server but couldn't read its response ({e})"),
+            status: Some(raw.status),
+        })
+    }
+
+    fn empty_request(&self, method: &str, path: &str, body: Option<Value>) -> Result<(), ApiError> {
+        self.transport.request(method, path, body.map(Body::Json))?;
+        Ok(())
+    }
+
+    pub fn fetch_sessions(&self) -> Result<Vec<SessionSummary>, ApiError> {
+        self.json_request("GET", "/sessions", None)
+    }
+
+    pub fn fetch_session(&self, session_id: &str) -> Result<SessionSummary, ApiError> {
+        self.json_request("GET", &format!("/sessions/{session_id}"), None)
+    }
+
+    pub fn send_message(
+        &self,
+        session_id: &str,
+        text: &str,
+        attachment_ids: &[String],
+    ) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/message"),
+            Some(serde_json::json!({ "text": text, "attachmentIds": attachment_ids })),
+        )
+    }
+
+    pub fn unqueue_message(&self, session_id: &str, message_id: &str) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/unqueue"),
+            Some(serde_json::json!({ "messageId": message_id })),
+        )
+    }
+
+    pub fn answer_question(
+        &self,
+        session_id: &str,
+        question_id: &str,
+        answers: &[String],
+    ) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/answer"),
+            Some(serde_json::json!({ "questionId": question_id, "answers": answers })),
+        )
+    }
+
+    pub fn interrupt_session(&self, session_id: &str) -> Result<(), ApiError> {
+        self.empty_request("POST", &format!("/sessions/{session_id}/interrupt"), None)
+    }
+
+    pub fn stop_session(&self, session_id: &str) -> Result<(), ApiError> {
+        self.empty_request("POST", &format!("/sessions/{session_id}/stop"), None)
+    }
+
+    pub fn start_session(&self, session_id: &str) -> Result<(), ApiError> {
+        self.empty_request("POST", &format!("/sessions/{session_id}/start"), None)
+    }
+
+    pub fn rename_session(&self, session_id: &str, title: &str) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/title"),
+            Some(serde_json::json!({ "title": title })),
+        )
+    }
+
+    pub fn set_session_cwd(&self, session_id: &str, cwd: &str) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/cwd"),
+            Some(serde_json::json!({ "cwd": cwd })),
+        )
+    }
+
+    pub fn set_session_model(&self, session_id: &str, model: &str) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/model"),
+            Some(serde_json::json!({ "model": model })),
+        )
+    }
+
+    pub fn set_session_permission_mode(
+        &self,
+        session_id: &str,
+        mode: &str,
+    ) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/permission-mode"),
+            Some(serde_json::json!({ "permissionMode": mode })),
+        )
+    }
+
+    pub fn set_session_notify(&self, session_id: &str, notify: bool) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/notify"),
+            Some(serde_json::json!({ "notify": notify })),
+        )
+    }
+
+    pub fn run_command(&self, session_id: &str, text: &str) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/command"),
+            Some(serde_json::json!({ "text": text })),
+        )
+    }
+
+    pub fn compact_session(&self, session_id: &str) -> Result<(), ApiError> {
+        self.empty_request("POST", &format!("/sessions/{session_id}/compact"), None)
+    }
+
+    pub fn delete_session(&self, session_id: &str, delete_foreign: bool) -> Result<(), ApiError> {
+        let path = if delete_foreign {
+            format!("/sessions/{session_id}?deleteForeign=true")
+        } else {
+            format!("/sessions/{session_id}")
+        };
+        self.empty_request("DELETE", &path, None)
+    }
+
+    /// A page of transcript history. `before` is the newest-first cursor
+    /// (server default is "the newest page" when absent, which a caller
+    /// gets by passing `None`); the events themselves are handed back as
+    /// [`event_model::SeqEvent`] via `crate::event_stream`'s parsing, kept
+    /// out of this method's signature so a caller that only wants the raw
+    /// lines (for the transcript cache) is not forced to parse them.
+    pub fn fetch_transcript_page(
+        &self,
+        session_id: &str,
+        before: Option<u64>,
+        limit: u32,
+        coalesce: bool,
+    ) -> Result<Vec<Value>, ApiError> {
+        let mut path = format!("/sessions/{session_id}/transcript?limit={limit}");
+        if let Some(before) = before {
+            path.push_str(&format!("&before={before}"));
+        }
+        if coalesce {
+            path.push_str("&coalesce=true");
+        }
+        self.json_request("GET", &path, None)
+    }
+}
+
+/// The blocking [`Transport`] backed by `ureq`, the same crate `server/`
+/// already depends on for its own outbound HTTPS (`usage.rs`'s Anthropic
+/// poll). Verifies the server's leaf against a single pinned CA, the way
+/// `ServerConfig.kt`'s `applyPinnedTls` does, rather than the system trust
+/// store -- the server's certificate is self-signed on purpose (see
+/// `wg-app-link`).
+pub struct UreqTransport {
+    agent: ureq::Agent,
+    base_url: String,
+    token: String,
+}
+
+impl UreqTransport {
+    /// `ca_pem` is the CA certificate `wg-app-link`'s `enroll` minted,
+    /// exactly as read from `certs/ca.pem`.
+    pub fn new(
+        base_url: impl Into<String>,
+        token: impl Into<String>,
+        ca_pem: &[u8],
+    ) -> Result<Self, ApiError> {
+        let cert = ureq::tls::Certificate::from_pem(ca_pem).map_err(|e| ApiError {
+            message: format!("The pinned CA certificate could not be read: {e}"),
+            status: None,
+        })?;
+        let tls_config = ureq::tls::TlsConfig::builder()
+            .root_certs(ureq::tls::RootCerts::new_with_certs(&[cert]))
+            .build();
+        let agent: ureq::Agent = ureq::Agent::config_builder()
+            .tls_config(tls_config)
+            // Read the body ourselves on every status, the way
+            // `requestFromServer` does: the server's own error wording is
+            // in the body of a 4xx/5xx, and the default behaviour throws
+            // it away before this code can read it.
+            .http_status_as_error(false)
+            .timeout_connect(Some(std::time::Duration::from_secs(5)))
+            .build()
+            .into();
+        Ok(Self {
+            agent,
+            base_url: base_url.into(),
+            token: token.into(),
+        })
+    }
+
+    fn url(&self, path: &str) -> String {
+        format!("{}{}", self.base_url, path)
+    }
+}
+
+impl Transport for UreqTransport {
+    fn request(
+        &self,
+        method: &str,
+        path: &str,
+        body: Option<Body>,
+    ) -> Result<RawResponse, ApiError> {
+        let url = self.url(path);
+        let auth = format!("Bearer {}", self.token);
+        let mut builder = ureq::http::Request::builder()
+            .method(method)
+            .uri(&url)
+            .header("Authorization", &auth);
+        let response = match body {
+            None => builder
+                .body(())
+                .map_err(ureq::Error::from)
+                .and_then(|req| self.agent.run(req)),
+            Some(Body::Json(value)) => {
+                builder = builder.header("Content-Type", "application/json");
+                builder
+                    .body(serde_json::to_vec(&value).unwrap_or_default())
+                    .map_err(ureq::Error::from)
+                    .and_then(|req| self.agent.run(req))
+            }
+            Some(Body::Bytes {
+                content_type,
+                bytes,
+            }) => {
+                builder = builder.header("Content-Type", content_type);
+                builder
+                    .body(bytes)
+                    .map_err(ureq::Error::from)
+                    .and_then(|req| self.agent.run(req))
+            }
+        };
+        let mut response = response.map_err(|e| transport_error(&self.base_url, path, e))?;
+        let status = response.status().as_u16();
+        let mut body = Vec::new();
+        response
+            .body_mut()
+            .as_reader()
+            .read_to_end(&mut body)
+            .map_err(|e| ApiError {
+                message: format!("Reached {url} but couldn't read its response ({e})"),
+                status: Some(status),
+            })?;
+        if !(200..300).contains(&status) {
+            return Err(response_error(status, &body, path));
+        }
+        Ok(RawResponse { status, body })
+    }
+
+    fn stream(&self, path: &str) -> Result<Box<dyn Read + Send>, ApiError> {
+        let url = self.url(path);
+        let auth = format!("Bearer {}", self.token);
+        let response = self
+            .agent
+            .get(&url)
+            .header("Authorization", &auth)
+            .header("Accept", "text/event-stream")
+            // No read timeout: between events there is nothing to read for
+            // as long as the thing being followed is idle, mirroring
+            // `EventStream.kt`'s `readTimeout = 0`.
+            .config()
+            .timeout_recv_response(None)
+            .build()
+            .call();
+        let mut response = response.map_err(|e| transport_error(&self.base_url, path, e))?;
+        let status = response.status().as_u16();
+        if status != 200 {
+            let mut body = Vec::new();
+            let _ = response.body_mut().as_reader().read_to_end(&mut body);
+            return Err(response_error(status, &body, path));
+        }
+        Ok(Box::new(response.into_body().into_reader()))
+    }
+}
+
+fn transport_error(base_url: &str, path: &str, e: ureq::Error) -> ApiError {
+    ApiError {
+        message: format!(
+            "Couldn't reach the server at {base_url} ({e}) -- is ai-server running, and is this \
+             device able to reach that address (WireGuard up)? [{path}]"
+        ),
+        status: None,
+    }
+}
+
+/// The 401 wording matches `Api.kt`'s, since that message is instructions
+/// for the reader rather than a diagnostic -- see this project's UI rule
+/// about shortening a failure in one place rather than at each display site.
+fn response_error(status: u16, body: &[u8], path: &str) -> ApiError {
+    let detail = String::from_utf8_lossy(body).trim().to_string();
+    let message = if status == 401 {
+        "The server rejected this device's token. Re-enroll by scanning the server's QR (or \
+         rotate with --rotate-token and scan the new one)."
+            .to_string()
+    } else if detail.is_empty() {
+        format!("Server returned HTTP {status} for {path}")
+    } else {
+        detail
+    };
+    ApiError {
+        message,
+        status: Some(status),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Cursor;
+    use std::sync::Mutex;
+
+    /// A transport with no network at all, for the pure-logic tests this
+    /// module can run without a server.
+    #[derive(Default)]
+    struct FakeTransport {
+        responses: Mutex<Vec<(String, String, RawResponse)>>,
+    }
+
+    impl FakeTransport {
+        fn respond(&self, method: &str, path: &str, status: u16, body: &str) {
+            self.responses.lock().unwrap().push((
+                method.to_string(),
+                path.to_string(),
+                RawResponse {
+                    status,
+                    body: body.as_bytes().to_vec(),
+                },
+            ));
+        }
+    }
+
+    impl Transport for FakeTransport {
+        fn request(
+            &self,
+            method: &str,
+            path: &str,
+            _body: Option<Body>,
+        ) -> Result<RawResponse, ApiError> {
+            let mut responses = self.responses.lock().unwrap();
+            let index = responses
+                .iter()
+                .position(|(m, p, _)| m == method && p == path)
+                .ok_or_else(|| ApiError {
+                    message: format!("no fake response for {method} {path}"),
+                    status: None,
+                })?;
+            let (_, _, response) = responses.remove(index);
+            if !(200..300).contains(&response.status) {
+                return Err(response_error(response.status, &response.body, path));
+            }
+            Ok(response)
+        }
+
+        fn stream(&self, _path: &str) -> Result<Box<dyn Read + Send>, ApiError> {
+            Ok(Box::new(Cursor::new(Vec::new())))
+        }
+    }
+
+    #[test]
+    fn fetch_sessions_parses_the_list() {
+        let transport = FakeTransport::default();
+        transport.respond(
+            "GET",
+            "/sessions",
+            200,
+            r#"[{"id":"s1","setup":"m1","setupName":"desktop","provider":"claude_cli",
+               "title":"hi","status":"idle","lastActivity":1.0}]"#,
+        );
+        let client = ApiClient::new(transport);
+        let sessions = client.fetch_sessions().unwrap();
+        assert_eq!(sessions.len(), 1);
+        assert_eq!(sessions[0].id, "s1");
+        assert_eq!(sessions[0].setup_name, "desktop");
+        // Defaults for fields the server omits.
+        assert!(sessions[0].notify);
+        assert_eq!(sessions[0].model, None);
+    }
+
+    #[test]
+    fn a_401_gets_the_enrollment_message_regardless_of_the_bare_body() {
+        let transport = FakeTransport::default();
+        transport.respond("POST", "/sessions/s1/interrupt", 401, "unauthorized");
+        let client = ApiClient::new(transport);
+        let err = client.interrupt_session("s1").unwrap_err();
+        assert!(err.message.contains("Re-enroll"));
+        assert_eq!(err.status, Some(401));
+    }
+
+    #[test]
+    fn a_bare_error_status_with_no_body_falls_back_to_a_generic_message() {
+        let transport = FakeTransport::default();
+        transport.respond("POST", "/sessions/s1/stop", 500, "");
+        let client = ApiClient::new(transport);
+        let err = client.stop_session("s1").unwrap_err();
+        assert!(err.message.contains("500"));
+    }
+
+    #[test]
+    fn a_server_explanation_in_the_body_is_surfaced_verbatim() {
+        let transport = FakeTransport::default();
+        transport.respond(
+            "POST",
+            "/sessions/s1/cwd",
+            409,
+            "that path does not exist on this machine",
+        );
+        let client = ApiClient::new(transport);
+        let err = client.set_session_cwd("s1", "/nope").unwrap_err();
+        assert_eq!(err.message, "that path does not exist on this machine");
+    }
+}

client-core/src/event_stream.rs

@@ -0,0 +1,142 @@
+//! The SSE half of the API: one long-lived GET per open session screen,
+//! replaying the transcript after a cursor and then following it live.
+//! Ported from `app/.../EventStream.kt`; the framing itself is
+//! [`crate::sse`].
+
+use std::io::{BufRead, BufReader};
+
+use event_model::SeqEvent;
+
+use crate::api::{ApiError, Transport};
+use crate::sse::SseReader;
+
+/// The frame name the server uses to say a cursor was too far behind to
+/// continue from. Must match `send_backlog` in `server/src/routes.rs`.
+const RESET_EVENT: &str = "reset";
+
+/// One frame of a session's event stream, folded from the wire shape the
+/// caller needs to act on -- mirroring what `EventStream.kt`'s three
+/// callbacks were for, as a single enum instead, since Rust has no
+/// equivalent of handing three closures to one blocking call.
+pub enum StreamItem {
+    /// The connection was accepted; the measured moment the stream is live
+    /// (see `EventStream.kt`'s doc on `onOpen` for why this, not the first
+    /// event, is what clears a previous failure on screen).
+    Open,
+    /// The cursor was too far behind to continue from: everything already
+    /// displayed is stale, and the events that follow are a fresh window.
+    /// Arrives before those events, so a caller that clears on it stays in
+    /// order.
+    Reset,
+    /// One event, as both the raw line the transcript cache stores and the
+    /// parsed [`SeqEvent`] the fold works from -- they have to be the same
+    /// line, so both travel together rather than being parsed twice from
+    /// two call sites.
+    Event { raw: String, event: SeqEvent },
+}
+
+/// Follows `/sessions/{id}/events?after={after}`, calling `on_item` for
+/// each [`StreamItem`] until the connection drops or `on_item` asks to
+/// stop (by returning `false`). Reconnecting -- with the last seq seen as
+/// the new cursor -- is the caller's job, same as in the Kotlin version.
+pub fn follow_session_events(
+    transport: &dyn Transport,
+    session_id: &str,
+    after: u64,
+    mut on_item: impl FnMut(StreamItem) -> bool,
+) -> Result<(), ApiError> {
+    let path = format!("/sessions/{session_id}/events?after={after}");
+    let body = transport.stream(&path)?;
+    if !on_item(StreamItem::Open) {
+        return Ok(());
+    }
+    let mut lines = BufReader::new(body).lines();
+    let mut reader = SseReader::new();
+    while let Some(line) = lines.next().transpose().map_err(|e| ApiError {
+        message: format!("Can't reach the server -- retrying. ({e})"),
+        status: None,
+    })? {
+        let Some(frame) = reader.feed_line(&line) else {
+            continue;
+        };
+        // A named frame carries no payload and a data frame has no name.
+        if frame.name.as_deref() == Some(RESET_EVENT) {
+            if !on_item(StreamItem::Reset) {
+                return Ok(());
+            }
+        } else if !frame.data.is_empty() {
+            let event: SeqEvent = serde_json::from_str(&frame.data).map_err(|e| ApiError {
+                message: format!("The server sent an event this build couldn't parse: {e}"),
+                status: None,
+            })?;
+            if !on_item(StreamItem::Event {
+                raw: frame.data,
+                event,
+            }) {
+                return Ok(());
+            }
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::api::{Body, RawResponse};
+    use std::io::Cursor;
+
+    struct FixtureTransport {
+        body: &'static str,
+    }
+
+    impl Transport for FixtureTransport {
+        fn request(
+            &self,
+            _method: &str,
+            _path: &str,
+            _body: Option<Body>,
+        ) -> Result<RawResponse, ApiError> {
+            unimplemented!("this fixture only serves a stream")
+        }
+
+        fn stream(&self, _path: &str) -> Result<Box<dyn std::io::Read + Send>, ApiError> {
+            Ok(Box::new(Cursor::new(self.body.as_bytes().to_vec())))
+        }
+    }
+
+    #[test]
+    fn events_and_a_reset_frame_are_told_apart() {
+        let transport = FixtureTransport {
+            body: "event:reset\n\ndata:{\"seq\":1,\"ts\":1.0,\"type\":\"status\",\"state\":\"idle\"}\n\n",
+        };
+        let mut items = Vec::new();
+        follow_session_events(&transport, "s1", 0, |item| {
+            items.push(match item {
+                StreamItem::Open => "open".to_string(),
+                StreamItem::Reset => "reset".to_string(),
+                StreamItem::Event { event, .. } => format!("event:{}", event.seq),
+            });
+            true
+        })
+        .unwrap();
+        assert_eq!(items, vec!["open", "reset", "event:1"]);
+    }
+
+    #[test]
+    fn the_caller_can_stop_early() {
+        let transport = FixtureTransport {
+            body: "data:{\"seq\":1,\"ts\":1.0,\"type\":\"status\",\"state\":\"idle\"}\n\n\
+                   data:{\"seq\":2,\"ts\":1.0,\"type\":\"status\",\"state\":\"idle\"}\n\n",
+        };
+        let mut count = 0;
+        follow_session_events(&transport, "s1", 0, |item| {
+            if matches!(item, StreamItem::Event { .. }) {
+                count += 1;
+            }
+            count < 1
+        })
+        .unwrap();
+        assert_eq!(count, 1);
+    }
+}

client-core/src/highlight/languages.rs

@@ -0,0 +1,581 @@
+//! A language the highlighter can colour, and the data-driven [`Rules`] each
+//! one scans by. Ported from `app/.../Languages.kt`; see that file's doc for
+//! why nearly every language is a row of data read by one shared scanner,
+//! with Markdown the one exception (`super::markdown`).
+
+use std::collections::HashSet;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum Language {
+    C,
+    Coffeescript,
+    Cpp,
+    Csharp,
+    Dart,
+    Fish,
+    Go,
+    Java,
+    Javascript,
+    Json,
+    Kotlin,
+    Markdown,
+    Perl,
+    Php,
+    Python,
+    Ron,
+    Ruby,
+    Rust,
+    Shell,
+    Swift,
+    Toml,
+    Typescript,
+}
+
+impl Language {
+    /// Every value, for the same exhaustiveness check the Kotlin test runs
+    /// (`Language.entries`).
+    pub const ALL: [Language; 22] = [
+        Language::C,
+        Language::Coffeescript,
+        Language::Cpp,
+        Language::Csharp,
+        Language::Dart,
+        Language::Fish,
+        Language::Go,
+        Language::Java,
+        Language::Javascript,
+        Language::Json,
+        Language::Kotlin,
+        Language::Markdown,
+        Language::Perl,
+        Language::Php,
+        Language::Python,
+        Language::Ron,
+        Language::Ruby,
+        Language::Rust,
+        Language::Shell,
+        Language::Swift,
+        Language::Toml,
+        Language::Typescript,
+    ];
+}
+
+/// What [`super::scan`] needs to know about one language -- data, not code,
+/// so that adding a language is a row here rather than a branch anywhere.
+#[derive(Debug, Clone, Default)]
+pub struct Rules {
+    /// Words drawn as keywords. Only plain words; the scanner cannot reach
+    /// anything else.
+    pub keywords: HashSet<&'static str>,
+    /// Tokens that open a comment running to the end of the line.
+    pub line_comments: Vec<&'static str>,
+    /// Whether `line_comments` count only at the start of a word. The shells
+    /// need it: `$#`, `${#x}` and `a#b` are not comments.
+    pub line_comments_at_word_start: bool,
+    pub block_comment: Option<BlockComment>,
+    /// The string forms. The longest opener that matches wins, so `"""` is
+    /// tried before `"`.
+    pub quotes: Vec<Quote>,
+    pub attributes: Attributes,
+    /// Rust and RON: an optional `b`, `r`, n hashes, `"`, closing at `"` and n hashes.
+    pub raw_strings: bool,
+    /// Rust: `'` opens a character literal only when a backslash or one
+    /// character and a `'` follow. Otherwise it is a lifetime or a label.
+    pub lifetimes: bool,
+}
+
+#[derive(Debug, Clone, Copy)]
+pub struct BlockComment {
+    pub open: &'static str,
+    pub close: &'static str,
+    pub nests: bool,
+}
+
+/// One string form. `escapes` is whether a backslash escapes the closer
+/// (and itself).
+#[derive(Debug, Clone, Copy)]
+pub struct Quote {
+    pub open: &'static str,
+    pub close: &'static str,
+    pub escapes: bool,
+}
+
+/// What opens a metadata span, of the shapes that exist across these languages.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum Attributes {
+    #[default]
+    None,
+    /// `@` and a word: Kotlin and Java annotations, Python decorators.
+    AtWord,
+    /// `#[` or `#![` through the matching `]`: Rust and RON attributes.
+    HashBracket,
+    /// `#` at the start of a line, to the end of it: the C preprocessor.
+    HashLine,
+    /// `[` at the start of a line through the matching `]`: a TOML table header.
+    LineBracket,
+}
+
+const C_STYLE: BlockComment = BlockComment {
+    open: "/*",
+    close: "*/",
+    nests: false,
+};
+const NESTING: BlockComment = BlockComment {
+    open: "/*",
+    close: "*/",
+    nests: true,
+};
+
+const DOUBLE: Quote = Quote {
+    open: "\"",
+    close: "\"",
+    escapes: true,
+};
+const SINGLE: Quote = Quote {
+    open: "'",
+    close: "'",
+    escapes: true,
+};
+const TRIPLE_DOUBLE: Quote = Quote {
+    open: "\"\"\"",
+    close: "\"\"\"",
+    escapes: true,
+};
+const TRIPLE_SINGLE: Quote = Quote {
+    open: "'''",
+    close: "'''",
+    escapes: true,
+};
+
+fn words(list: &'static str) -> HashSet<&'static str> {
+    list.split_whitespace().collect()
+}
+
+/// The rules for one language. A `match` rather than a lazily-built map --
+/// there is no once-per-process cost worth paying for in a language table
+/// this small, and it sidesteps the Kotlin version's own workaround for
+/// property initialization order.
+pub fn rules_for(language: Language) -> Rules {
+    match language {
+        Language::C => Rules {
+            keywords: words(KEYWORDS_C),
+            line_comments: vec!["//"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![DOUBLE, SINGLE],
+            attributes: Attributes::HashLine,
+            ..Default::default()
+        },
+        Language::Cpp => Rules {
+            keywords: words(KEYWORDS_CPP),
+            line_comments: vec!["//"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![DOUBLE, SINGLE],
+            attributes: Attributes::HashLine,
+            ..Default::default()
+        },
+        Language::Csharp => Rules {
+            keywords: words(KEYWORDS_CSHARP),
+            line_comments: vec!["//"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![DOUBLE, SINGLE],
+            ..Default::default()
+        },
+        // `###` opens and closes a block comment and `#` opens a line one,
+        // which is why the scanner tries the block opener first.
+        Language::Coffeescript => Rules {
+            keywords: words(KEYWORDS_COFFEESCRIPT),
+            line_comments: vec!["#"],
+            block_comment: Some(BlockComment {
+                open: "###",
+                close: "###",
+                nests: false,
+            }),
+            quotes: vec![TRIPLE_DOUBLE, TRIPLE_SINGLE, DOUBLE, SINGLE],
+            ..Default::default()
+        },
+        Language::Dart => Rules {
+            keywords: words(KEYWORDS_DART),
+            line_comments: vec!["//"],
+            block_comment: Some(NESTING),
+            quotes: vec![TRIPLE_DOUBLE, TRIPLE_SINGLE, DOUBLE, SINGLE],
+            attributes: Attributes::AtWord,
+            ..Default::default()
+        },
+        Language::Fish => Rules {
+            keywords: words(KEYWORDS_FISH),
+            line_comments: vec!["#"],
+            line_comments_at_word_start: true,
+            quotes: vec![DOUBLE, SINGLE],
+            ..Default::default()
+        },
+        Language::Go => Rules {
+            keywords: words(KEYWORDS_GO),
+            line_comments: vec!["//"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![
+                DOUBLE,
+                SINGLE,
+                Quote {
+                    open: "`",
+                    close: "`",
+                    escapes: false,
+                },
+            ],
+            ..Default::default()
+        },
+        Language::Java => Rules {
+            keywords: words(KEYWORDS_JAVA),
+            line_comments: vec!["//"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![DOUBLE, SINGLE],
+            attributes: Attributes::AtWord,
+            ..Default::default()
+        },
+        Language::Javascript => Rules {
+            keywords: words(KEYWORDS_JAVASCRIPT),
+            line_comments: vec!["//"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![
+                DOUBLE,
+                SINGLE,
+                Quote {
+                    open: "`",
+                    close: "`",
+                    escapes: true,
+                },
+            ],
+            ..Default::default()
+        },
+        Language::Json => Rules {
+            keywords: words(KEYWORDS_JSON),
+            quotes: vec![DOUBLE],
+            ..Default::default()
+        },
+        Language::Kotlin => Rules {
+            keywords: words(KEYWORDS_KOTLIN),
+            line_comments: vec!["//"],
+            block_comment: Some(NESTING),
+            quotes: vec![
+                Quote {
+                    open: "\"\"\"",
+                    close: "\"\"\"",
+                    escapes: false,
+                },
+                DOUBLE,
+                SINGLE,
+            ],
+            attributes: Attributes::AtWord,
+            ..Default::default()
+        },
+        Language::Perl => Rules {
+            keywords: words(KEYWORDS_PERL),
+            line_comments: vec!["#"],
+            quotes: vec![DOUBLE, SINGLE],
+            ..Default::default()
+        },
+        Language::Php => Rules {
+            keywords: words(KEYWORDS_PHP),
+            line_comments: vec!["//", "#"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![DOUBLE, SINGLE],
+            attributes: Attributes::AtWord,
+            ..Default::default()
+        },
+        Language::Python => Rules {
+            keywords: words(KEYWORDS_PYTHON),
+            line_comments: vec!["#"],
+            quotes: vec![TRIPLE_DOUBLE, TRIPLE_SINGLE, DOUBLE, SINGLE],
+            attributes: Attributes::AtWord,
+            ..Default::default()
+        },
+        Language::Ron => Rules {
+            keywords: words(KEYWORDS_RON),
+            line_comments: vec!["//"],
+            block_comment: Some(NESTING),
+            quotes: vec![DOUBLE, SINGLE],
+            attributes: Attributes::HashBracket,
+            raw_strings: true,
+            ..Default::default()
+        },
+        Language::Ruby => Rules {
+            keywords: words(KEYWORDS_RUBY),
+            line_comments: vec!["#"],
+            quotes: vec![DOUBLE, SINGLE],
+            ..Default::default()
+        },
+        Language::Rust => Rules {
+            keywords: words(KEYWORDS_RUST),
+            line_comments: vec!["//"],
+            block_comment: Some(NESTING),
+            // No `'` here: `lifetimes` decides when one opens a character literal.
+            quotes: vec![DOUBLE],
+            attributes: Attributes::HashBracket,
+            raw_strings: true,
+            lifetimes: true,
+            ..Default::default()
+        },
+        Language::Shell => Rules {
+            keywords: words(KEYWORDS_SHELL),
+            line_comments: vec!["#"],
+            line_comments_at_word_start: true,
+            // A shell's single quotes are literal: `'a\'` is not one string.
+            quotes: vec![
+                DOUBLE,
+                Quote {
+                    open: "'",
+                    close: "'",
+                    escapes: false,
+                },
+            ],
+            ..Default::default()
+        },
+        Language::Swift => Rules {
+            keywords: words(KEYWORDS_SWIFT),
+            line_comments: vec!["//"],
+            block_comment: Some(NESTING),
+            quotes: vec![TRIPLE_DOUBLE, DOUBLE],
+            attributes: Attributes::AtWord,
+            ..Default::default()
+        },
+        Language::Toml => Rules {
+            keywords: words(KEYWORDS_TOML),
+            line_comments: vec!["#"],
+            quotes: vec![
+                TRIPLE_DOUBLE,
+                Quote {
+                    open: "'''",
+                    close: "'''",
+                    escapes: false,
+                },
+                DOUBLE,
+                Quote {
+                    open: "'",
+                    close: "'",
+                    escapes: false,
+                },
+            ],
+            attributes: Attributes::LineBracket,
+            ..Default::default()
+        },
+        Language::Typescript => Rules {
+            keywords: words(KEYWORDS_TYPESCRIPT),
+            line_comments: vec!["//"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![
+                DOUBLE,
+                SINGLE,
+                Quote {
+                    open: "`",
+                    close: "`",
+                    escapes: true,
+                },
+            ],
+            attributes: Attributes::AtWord,
+            ..Default::default()
+        },
+        // Markdown has no token rules; see `super::markdown::scan_markdown`.
+        Language::Markdown => Rules::default(),
+    }
+}
+
+// The keyword sets. Every list below other than RON, TOML, fish and JSON
+// came from dev.snipme:highlights 1.1.0 (Apache-2.0), the library the
+// Kotlin scanner replaced, so that no fence which was coloured there turns
+// plain here either.
+
+const KEYWORDS_C: &str =
+    "auto break case char const continue default do double else enum extern float for goto if
+    int long register return short signed sizeof static struct switch typedef union unsigned
+    void volatile while";
+
+const KEYWORDS_CPP: &str =
+    "asm auto bool break case catch char class const const_cast continue default delete do
+    double dynamic_cast else enum explicit export extern false float for friend goto if inline
+    int long mutable namespace new operator private protected public register reinterpret_cast
+    return short signed sizeof static static_cast struct switch template this throw true try
+    typedef typeid typename union unsigned using virtual void volatile wchar_t while";
+
+const KEYWORDS_CSHARP: &str =
+    "abstract as base bool break byte case catch char checked class const continue decimal
+    default delegate do double else enum event explicit extern false finally fixed float for
+    foreach goto if implicit in int interface internal is lock long namespace new null object
+    operator out override params private protected public readonly ref return sbyte sealed short
+    sizeof stackalloc static string struct switch this throw true try typeof uint ulong unchecked
+    unsafe ushort using virtual void volatile while";
+
+const KEYWORDS_COFFEESCRIPT: &str =
+    "Infinity NaN and arguments await break by case catch class continue debugger delete defer
+    default do else export extends false finally for function if import in instanceof is isnt
+    let loop new no not null of on or package return super switch this throw true try typeof
+    unless undefined var wait when with yield";
+
+const KEYWORDS_DART: &str =
+    "abstract as assert async await base break case catch class const continue covariant
+    default deferred do dynamic else enum export extends external factory false final finally
+    for get if implements import in interface is late library mixin new null on operator part
+    required rethrow return sealed set show static super switch this throw true try var void
+    when with while yield";
+
+/// fish is not in the library at all, so its fences are drawn plain today.
+/// The list is the shell's own words, which is what a fish fence is mostly
+/// made of.
+const KEYWORDS_FISH: &str =
+    "and begin break builtin case command continue else end exec for function if in not or
+    return switch while set echo test string math read source";
+
+const KEYWORDS_GO: &str =
+    "break case chan const continue default defer else fallthrough false for func go goto if
+    import interface map package range return select struct switch true type var";
+
+const KEYWORDS_JAVA: &str =
+    "abstract assert boolean break byte case catch char class const continue default do double
+    else enum extends final finally float for goto if implements import instanceof int interface
+    long native new null package private protected public return short static strictfp super
+    switch synchronized this throw throws transient try void volatile while";
+
+const KEYWORDS_JAVASCRIPT: &str =
+    "async await boolean break case catch class const continue debugger default delete do else
+    enum export extends false finally for function if implements import in instanceof interface
+    let new null package private protected public return super switch this throw true try typeof
+    var void while with yield";
+
+const KEYWORDS_JSON: &str = "true false null";
+
+const KEYWORDS_KOTLIN: &str =
+    "actual abstract annotation as break by catch class companion const constructor continue
+    coroutine crossinline data delegate dynamic do else enum expect external false final finally
+    for fun get if import in infix inline interface internal is lazy lateinit native null object
+    open operator out override package private protected public reified return sealed set super
+    suspend tailrec this throw true try typealias typeof val var vararg when while yield";
+
+const KEYWORDS_PERL: &str =
+    "__DATA__ __END__ __FILE__ __LINE__ __PACKAGE__ and cmp continue do else elsif eq eval for
+    foreach goto gt if last le lt my ne next no not or package redo ref return sub unless until
+    use while xor";
+
+const KEYWORDS_PHP: &str =
+    "__halt_compiler abstract and array as break callable case catch class clone const continue
+    declare default die do echo else elseif empty enddeclare endfor endforeach endif endswitch
+    endwhile eval exit extends final finally fn for foreach function global goto if implements
+    include include_once instanceof insteadof interface isset list match new or print private
+    protected public require require_once return static switch throw trait try unset use var
+    while xor yield";
+
+const KEYWORDS_PYTHON: &str =
+    "False True and as assert async await break class continue def del elif else except finally
+    for from global if import in is lambda nonlocal not or pass raise return try while with
+    yield";
+
+/// RON is not in the library either; these are the words a RON file can hold.
+const KEYWORDS_RON: &str = "true false Some None inf NaN";
+
+const KEYWORDS_RUBY: &str =
+    "__ENCODING__ __END__ __FILE__ __LINE__ BEGIN END alias and begin break case class def do
+    else elsif end ensure false for if in module next nil not or redo rescue retry return self
+    super then true undef unless until when while yield";
+
+const KEYWORDS_RUST: &str =
+    "as async await break const continue crate dyn else enum extern false fn for if impl in
+    let loop match mod move mut pub ref return Self self static struct super trait true type
+    union unsafe use where while abstract become box do final macro override priv try typeof
+    unsized virtual yield";
+
+const KEYWORDS_SHELL: &str =
+    "alias bg bind break builtin caller cd command compgen complete compopt continue declare
+    dirs disown echo enable eval exec exit export fc fg getopts hash help history jobs kill let
+    local logout popd printf pushd pwd read readonly return set shift shopt source suspend
+    test";
+
+const KEYWORDS_SWIFT: &str =
+    "_ associatedtype class deinit enum extension fileprivate func import init inout internal
+    let open operator private precedencegroup protocol public rethrows static struct subscript
+    typealias var break case catch continue default defer do else fallthrough for guard if in
+    repeat return throw switch where while Any as await false is nil self Self super throws true
+    try associativity convenience didSet dynamic final get indirect infix lazy left mutating none
+    nonmutating optional override postfix precedence prefix Protocol required right set some Type
+    unowned weak willSet";
+
+/// TOML is not in the library; `inf` and `nan` are values rather than
+/// names, like the booleans.
+const KEYWORDS_TOML: &str = "true false inf nan";
+
+const KEYWORDS_TYPESCRIPT: &str =
+    "abstract as asserts await break case catch class const constructor continue debugger
+    default delete do else enum export extends false finally for from function get if implements
+    import in infer instanceof interface is keyof let module namespace new null number object
+    package private protected public readonly require global return set static string super
+    switch this throw true try type typeof undefined unique unknown var void while with yield";
+
+/// The highlighter's language for a fence's info word, or `None` for one it
+/// has no rules for. Also what `super::file_language` reads for a file's
+/// extension -- one table, so a language added for fences is a language
+/// added for files.
+pub fn fence_language(name: Option<&str>) -> Option<Language> {
+    let name = name?.trim().to_lowercase();
+    FENCE_LANGUAGES
+        .iter()
+        .find(|(alias, _)| *alias == name)
+        .map(|(_, language)| *language)
+}
+
+/// The highlighter's language for a *file*, from its name.
+///
+/// The extension is the part after the *last* dot, which is what makes
+/// `build.gradle.kts` Kotlin. A leading dot is not one: `.bashrc` has no
+/// extension, it has a name that starts with a dot. A name with no dot at
+/// all -- `Makefile` -- is likewise `None`.
+pub fn file_language(name: &str) -> Option<Language> {
+    let dot = name.rfind('.')?;
+    if dot < 1 {
+        return None;
+    }
+    fence_language(Some(&name[dot + 1..]))
+}
+
+const FENCE_LANGUAGES: &[(&str, Language)] = &[
+    ("kotlin", Language::Kotlin),
+    ("kt", Language::Kotlin),
+    ("kts", Language::Kotlin),
+    ("rust", Language::Rust),
+    ("rs", Language::Rust),
+    ("sh", Language::Shell),
+    ("bash", Language::Shell),
+    ("shell", Language::Shell),
+    ("zsh", Language::Shell),
+    ("console", Language::Shell),
+    ("python", Language::Python),
+    ("py", Language::Python),
+    ("javascript", Language::Javascript),
+    ("js", Language::Javascript),
+    ("jsx", Language::Javascript),
+    ("typescript", Language::Typescript),
+    ("ts", Language::Typescript),
+    ("tsx", Language::Typescript),
+    ("java", Language::Java),
+    ("c", Language::C),
+    ("h", Language::C),
+    ("cpp", Language::Cpp),
+    ("c++", Language::Cpp),
+    ("cc", Language::Cpp),
+    ("hpp", Language::Cpp),
+    ("csharp", Language::Csharp),
+    ("cs", Language::Csharp),
+    ("c#", Language::Csharp),
+    ("go", Language::Go),
+    ("golang", Language::Go),
+    ("swift", Language::Swift),
+    ("dart", Language::Dart),
+    ("ruby", Language::Ruby),
+    ("rb", Language::Ruby),
+    ("php", Language::Php),
+    ("perl", Language::Perl),
+    ("pl", Language::Perl),
+    ("coffeescript", Language::Coffeescript),
+    ("coffee", Language::Coffeescript),
+    ("ron", Language::Ron),
+    ("toml", Language::Toml),
+    ("fish", Language::Fish),
+    ("json", Language::Json),
+    ("markdown", Language::Markdown),
+    ("md", Language::Markdown),
+];

client-core/src/highlight/markdown.rs

@@ -0,0 +1,681 @@
+//! Markdown read into the spans that carry a colour -- a ```markdown fence
+//! in a reply, and a `.md` file in the viewer. Ported from
+//! `app/.../MarkdownSyntax.kt`; see that file's doc for why this is its own
+//! scanner rather than a row of [`super::Rules`] (what a character means
+//! depends on where it sits, not on what it is) and why an indented code
+//! block is deliberately not recognised.
+//!
+//! Structure is read a line at a time and each line's prose left to right,
+//! except the two decisions that are not: a fenced block is state carried
+//! forward, and a table is found by its delimiter row, which comes after
+//! the header it belongs to (the one place here that looks ahead).
+
+use super::{Kind, Span};
+
+/// The characters an unordered list may be bulleted with.
+const BULLETS: &str = "-*+";
+/// The characters a thematic break, or a setext heading's underline, can be
+/// drawn with.
+const RULE_MARKERS: &str = "-*_=";
+/// The characters that can open emphasis, strong emphasis or a strikethrough.
+const EMPHASIS: &str = "*_~";
+/// Characters that end a bare URL wherever they appear, and ones only
+/// trimmed off the end.
+const URL_STOPS: &str = "<>\"'`|";
+const URL_TRAILING: &str = ".,:;!?";
+
+pub fn scan_markdown(code: &str) -> Vec<Span> {
+    MarkdownScanner::new(code).run()
+}
+
+struct MarkdownScanner {
+    code: Vec<char>,
+    spans: Vec<Span>,
+}
+
+impl MarkdownScanner {
+    fn new(code: &str) -> Self {
+        Self {
+            code: code.chars().collect(),
+            spans: Vec::new(),
+        }
+    }
+
+    fn run(mut self) -> Vec<Span> {
+        let mut at = 0usize;
+        // The delimiter run that opened the fenced block we are inside, or
+        // None between them.
+        let mut fence: Option<Vec<char>> = None;
+        // Whether the row above was part of a table, which is what makes
+        // this one a body row.
+        let mut table = false;
+        loop {
+            let end = self.line_end(at);
+            if let Some(open) = fence.clone() {
+                // The content and the closing line alike: a fence is one
+                // block of code, and its own delimiters belong to it the
+                // way a string's quotes belong to the string.
+                self.emit(at, end, Kind::String);
+                if self.closes_fence(at, end, &open) {
+                    fence = None;
+                }
+            } else {
+                let opened = self.opens_fence(at, end);
+                if opened.is_some() {
+                    table = false;
+                    fence = opened;
+                } else {
+                    table = self.row(at, end, table);
+                }
+            }
+            if end == self.code.len() {
+                break;
+            }
+            at = end + 1;
+        }
+        self.spans
+    }
+
+    /// The end of the line beginning at `at`: the newline, or the end of the text.
+    fn line_end(&self, at: usize) -> usize {
+        self.code[at..]
+            .iter()
+            .position(|&c| c == '\n')
+            .map(|p| at + p)
+            .unwrap_or(self.code.len())
+    }
+
+    /// One line that is not inside a fence, and whether the table it may be
+    /// part of is still open.
+    fn row(&mut self, start: usize, end: usize, table: bool) -> bool {
+        if self.table_delimiter(start, end) {
+            let indented = self.indented(start, end);
+            self.emit(indented, end, Kind::Mark);
+            return true;
+        }
+        let header = end < self.code.len() && self.table_delimiter(end + 1, self.line_end(end + 1));
+        if (table || header) && self.has_pipe(start, end) {
+            self.table_row(start, end);
+            return true;
+        }
+        self.structure(start, end);
+        false
+    }
+
+    /// A line of nothing but pipes, dashes, alignment colons and space, with
+    /// one of each needed.
+    fn table_delimiter(&self, start: usize, end: usize) -> bool {
+        let mut dashes = false;
+        let mut pipes = false;
+        for at in self.indented(start, end)..end {
+            match self.code[at] {
+                '-' => dashes = true,
+                '|' => pipes = true,
+                ':' | ' ' | '\t' => {}
+                _ => return false,
+            }
+        }
+        dashes && pipes
+    }
+
+    fn has_pipe(&self, start: usize, end: usize) -> bool {
+        let mut at = start;
+        while at < end {
+            if self.code[at] == '\\' {
+                at += 2;
+            } else if self.code[at] == '|' {
+                return true;
+            } else {
+                at += 1;
+            }
+        }
+        false
+    }
+
+    /// A table row: the pipes are the structure, and what is between them is prose.
+    fn table_row(&mut self, start: usize, end: usize) {
+        let mut at = self.indented(start, end);
+        let mut cell = at;
+        while at < end {
+            match self.code[at] {
+                '\\' => at += 2,
+                '|' => {
+                    self.inline(cell, at);
+                    self.emit(at, at + 1, Kind::Mark);
+                    at += 1;
+                    cell = at;
+                }
+                _ => at += 1,
+            }
+        }
+        self.inline(cell, end);
+    }
+
+    /// Spans, coalesced with the one before when they touch and agree.
+    fn emit(&mut self, start: usize, end: usize, kind: Kind) {
+        if end <= start {
+            return;
+        }
+        if let Some(last) = self.spans.last_mut()
+            && last.kind == kind
+            && last.end == start
+        {
+            last.end = end;
+            return;
+        }
+        self.spans.push(Span { start, end, kind });
+    }
+
+    /// The first character of the line at or after `start` that is not indentation.
+    fn indented(&self, start: usize, end: usize) -> usize {
+        let mut at = start;
+        while at < end && (self.code[at] == ' ' || self.code[at] == '\t') {
+            at += 1;
+        }
+        at
+    }
+
+    /// The run of backticks or tildes that could open or close a fence on
+    /// this line, or `None`.
+    fn fence_run(&self, start: usize, end: usize) -> Option<(usize, usize)> {
+        let at = self.indented(start, end);
+        if at == end {
+            return None;
+        }
+        let marker = self.code[at];
+        if marker != '`' && marker != '~' {
+            return None;
+        }
+        let mut run = at;
+        while run < end && self.code[run] == marker {
+            run += 1;
+        }
+        if run - at >= 3 { Some((at, run)) } else { None }
+    }
+
+    /// Draws an opening fence line and answers its delimiter, or `None` if
+    /// this is not one.
+    fn opens_fence(&mut self, start: usize, end: usize) -> Option<Vec<char>> {
+        let (run_start, run_end) = self.fence_run(start, end)?;
+        self.emit(run_start, run_end, Kind::String);
+        // The info word is what the fence is a fence *of*, which is
+        // metadata about the block rather than part of it.
+        let indented = self.indented(run_end, end);
+        self.emit(indented, end, Kind::Metadata);
+        Some(self.code[run_start..run_end].to_vec())
+    }
+
+    /// Whether this line closes a fence opened by `open`: the same
+    /// character, at least as many of them, and nothing else on the line.
+    fn closes_fence(&self, start: usize, end: usize, open: &[char]) -> bool {
+        let Some((run_start, run_end)) = self.fence_run(start, end) else {
+            return false;
+        };
+        if self.code[run_start] != open[0] || run_end - run_start < open.len() {
+            return false;
+        }
+        self.indented(run_end, end) == end
+    }
+
+    /// One ordinary line: what its opening characters make it, and then its prose.
+    fn structure(&mut self, start: usize, end: usize) {
+        let mut at = start;
+        // Quote markers come before everything else and can be several
+        // deep, and what follows one is an ordinary line again -- a heading
+        // inside a quote is still a heading.
+        while at < end && self.code[at] == '>' {
+            at += 1;
+            self.emit(at - 1, at, Kind::Mark);
+            at = self.indented(at, end);
+        }
+        if at == end {
+            return;
+        }
+        if self.heading(at, end) || self.thematic_break(at, end) {
+            return;
+        }
+        let text_start = self.bullet(at, end);
+        self.inline(text_start, end);
+    }
+
+    /// `#` to `######` and a space. Without the space it is a word
+    /// beginning with a hash.
+    fn heading(&mut self, start: usize, end: usize) -> bool {
+        let mut at = start;
+        while at < end && self.code[at] == '#' {
+            at += 1;
+        }
+        let depth = at - start;
+        if !(1..=6).contains(&depth) {
+            return false;
+        }
+        if at < end && self.code[at] != ' ' && self.code[at] != '\t' {
+            return false;
+        }
+        self.emit(start, end, Kind::Keyword);
+        true
+    }
+
+    /// A line made of one repeated rule character and nothing else.
+    fn thematic_break(&mut self, start: usize, end: usize) -> bool {
+        let marker = self.code[start];
+        if !RULE_MARKERS.contains(marker) {
+            return false;
+        }
+        let mut seen = 0usize;
+        for at in start..end {
+            let c = self.code[at];
+            if c == marker {
+                seen += 1;
+            } else if !c.is_whitespace() {
+                return false;
+            }
+        }
+        if seen < if marker == '=' { 1 } else { 3 } {
+            return false;
+        }
+        self.emit(start, end, Kind::Mark);
+        true
+    }
+
+    /// Draws a list marker if the line opens with one, and answers where
+    /// the item's text starts.
+    fn bullet(&mut self, start: usize, end: usize) -> usize {
+        let marker = self.code[start];
+        if BULLETS.contains(marker) && self.space_or_end(start + 1, end) {
+            self.emit(start, start + 1, Kind::Mark);
+            return self.indented(start + 1, end);
+        }
+        let mut digits = start;
+        while digits < end && self.code[digits].is_ascii_digit() {
+            digits += 1;
+        }
+        let delimiter = self.code.get(digits).copied();
+        if digits > start
+            && (delimiter == Some('.') || delimiter == Some(')'))
+            && self.space_or_end(digits + 1, end)
+        {
+            self.emit(start, digits + 1, Kind::Mark);
+            return self.indented(digits + 1, end);
+        }
+        start
+    }
+
+    fn space_or_end(&self, at: usize, end: usize) -> bool {
+        at >= end || self.code[at] == ' ' || self.code[at] == '\t'
+    }
+
+    /// The inline forms, left to right. Every branch answers a position
+    /// strictly after `start` of its call, so this terminates.
+    fn inline(&mut self, start: usize, end: usize) {
+        let mut at = start;
+        while at < end {
+            let c = self.code[at];
+            at = if c == '\\' {
+                // A backslash takes the character after it out of the
+                // running entirely, which is how `\*` stays an asterisk
+                // rather than opening emphasis.
+                at + 2
+            } else if c == '`' {
+                self.code_span(at, end)
+            } else if c == '[' {
+                self.link(at, at, end)
+            } else if c == '!' && self.code.get(at + 1) == Some(&'[') {
+                self.link(at, at + 1, end)
+            } else if c == '<' {
+                self.autolink(at, end)
+            } else if EMPHASIS.contains(c) {
+                self.emphasis(at, end)
+            } else {
+                self.url(at, end).unwrap_or(at + 1)
+            };
+        }
+    }
+
+    /// `` `code` ``, closed by a run of exactly as many backticks as opened it.
+    fn code_span(&mut self, start: usize, end: usize) -> usize {
+        let mut open = start;
+        while open < end && self.code[open] == '`' {
+            open += 1;
+        }
+        let ticks = open - start;
+        let mut at = open;
+        while at < end {
+            if self.code[at] != '`' {
+                at += 1;
+                continue;
+            }
+            let mut close = at;
+            while close < end && self.code[close] == '`' {
+                close += 1;
+            }
+            if close - at == ticks {
+                self.emit(start, close, Kind::String);
+                return close;
+            }
+            at = close;
+        }
+        // Nothing closes it on this line, so those were ordinary backticks.
+        open
+    }
+
+    /// `[text](destination)`, and the same with a leading `!` for an image.
+    fn link(&mut self, start: usize, bracket: usize, end: usize) -> usize {
+        let mut depth = 0i32;
+        let mut close = bracket;
+        while close < end {
+            match self.code[close] {
+                '\\' => close += 1,
+                '[' => depth += 1,
+                ']' => {
+                    depth -= 1;
+                    if depth == 0 {
+                        break;
+                    }
+                }
+                _ => {}
+            }
+            close += 1;
+        }
+        if close >= end {
+            return start + 1;
+        }
+        let destination = close + 1;
+        if self.code.get(destination) != Some(&'(') {
+            return start + 1;
+        }
+        let Some(paren_rel) = self.code[destination..].iter().position(|&c| c == ')') else {
+            return start + 1;
+        };
+        let paren = destination + paren_rel;
+        if paren >= end {
+            return start + 1;
+        }
+        self.emit(start, bracket + 1, Kind::Mark);
+        self.inline(bracket + 1, close);
+        self.emit(close, destination, Kind::Mark);
+        self.emit(destination, paren + 1, Kind::Metadata);
+        paren + 1
+    }
+
+    /// `<https://example.com>` and `<name@example.com>`, drawn as the
+    /// destination they are.
+    fn autolink(&mut self, start: usize, end: usize) -> usize {
+        let mut at = start + 1;
+        let mut addressed = false;
+        while at < end {
+            let c = self.code[at];
+            if c.is_whitespace() || c == '<' {
+                return start + 1;
+            }
+            if c == '>' {
+                if !addressed {
+                    return start + 1;
+                }
+                self.emit(start, at + 1, Kind::Metadata);
+                return at + 1;
+            }
+            if c == ':' || c == '@' {
+                addressed = true;
+            }
+            at += 1;
+        }
+        start + 1
+    }
+
+    /// A bare `scheme://...` written in prose, or `None` if one does not
+    /// start here.
+    fn url(&mut self, start: usize, end: usize) -> Option<usize> {
+        if start > 0 && is_word(self.code[start - 1]) {
+            return None;
+        }
+        let mut scheme = start;
+        while scheme < end && self.code[scheme].is_alphabetic() {
+            scheme += 1;
+        }
+        if scheme == start || !starts_with(&self.code, scheme, "://") {
+            return None;
+        }
+        let body = scheme + 3;
+        let mut at = body;
+        let mut openers = 0i32;
+        let mut closers = 0i32;
+        while at < end && !self.code[at].is_whitespace() && !URL_STOPS.contains(self.code[at]) {
+            if self.code[at] == '(' {
+                openers += 1;
+            } else if self.code[at] == ')' {
+                closers += 1;
+            }
+            at += 1;
+        }
+        while at > body {
+            let last = self.code[at - 1];
+            if URL_TRAILING.contains(last) {
+                at -= 1;
+            } else if last == ')' && closers > openers {
+                closers -= 1;
+                at -= 1;
+            } else {
+                break;
+            }
+        }
+        if at == body {
+            return None;
+        }
+        self.emit(start, at, Kind::Metadata);
+        Some(at)
+    }
+
+    /// `*emph*`, `**strong**`, `_emph_` and `~~struck~~`, drawn markers and
+    /// all.
+    fn emphasis(&mut self, start: usize, end: usize) -> usize {
+        let marker = self.code[start];
+        let mut open = start;
+        while open < end && self.code[open] == marker {
+            open += 1;
+        }
+        let length = open - start;
+        if marker == '~' && length != 2 {
+            return open;
+        }
+        if length > 3 {
+            return open;
+        }
+        if open == end || self.code[open].is_whitespace() {
+            return open;
+        }
+        if marker == '_' && start > 0 && is_word(self.code[start - 1]) {
+            return open;
+        }
+        let mut at = open;
+        while at < end {
+            if self.code[at] == '\\' {
+                at += 2;
+                continue;
+            }
+            if self.code[at] != marker {
+                at += 1;
+                continue;
+            }
+            let mut close = at;
+            while close < end && self.code[close] == marker {
+                close += 1;
+            }
+            let finish = at + length;
+            if close - at >= length
+                && !self.code[at - 1].is_whitespace()
+                && !(marker == '_' && finish < end && is_word(self.code[finish]))
+            {
+                self.emit(start, finish, Kind::Literal);
+                return finish;
+            }
+            at = close;
+        }
+        open
+    }
+}
+
+fn is_word(c: char) -> bool {
+    c.is_alphanumeric() || c == '_'
+}
+
+fn starts_with(code: &[char], at: usize, token: &str) -> bool {
+    let token: Vec<char> = token.chars().collect();
+    if at + token.len() > code.len() {
+        return false;
+    }
+    code[at..at + token.len()] == token[..]
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::{Kind, Language, span_text, spans_of};
+
+    fn spans(code: &str, kind: Kind) -> Vec<String> {
+        let chars: Vec<char> = code.chars().collect();
+        spans_of(code, Language::Markdown)
+            .into_iter()
+            .filter(|s| s.kind == kind)
+            .map(|s| span_text(&chars, &s))
+            .collect()
+    }
+
+    fn assert_spans(code: &str, kind: Kind, expected: &[&str]) {
+        assert_eq!(spans(code, kind), expected.to_vec(), "{kind:?} in: {code}");
+    }
+
+    #[test]
+    fn a_heading_is_coloured_whole_and_a_hash_inside_a_word_is_not_one() {
+        let code = "## Layout\nissue #12 is fixed\n#hashtag";
+        assert_spans(code, Kind::Keyword, &["## Layout"]);
+    }
+
+    #[test]
+    fn seven_hashes_are_not_a_heading() {
+        assert_spans("####### deep", Kind::Keyword, &[]);
+    }
+
+    #[test]
+    fn a_fence_carries_its_language_as_metadata_and_its_body_as_one_string() {
+        let code = "text\n```kotlin\nval x = 1\n```\nmore";
+        assert_spans(code, Kind::Metadata, &["kotlin"]);
+        assert_spans(code, Kind::String, &["```", "val x = 1", "```"]);
+    }
+
+    #[test]
+    fn a_longer_fence_is_not_closed_by_a_shorter_one_and_a_heading_inside_it_is_not_a_heading() {
+        let code = "````\n```\n# not a heading\n````\nafter";
+        assert_spans(code, Kind::Keyword, &[]);
+        assert_spans(
+            code,
+            Kind::String,
+            &["````", "```", "# not a heading", "````"],
+        );
+    }
+
+    #[test]
+    fn an_unclosed_fence_runs_to_the_end_rather_than_panicking() {
+        assert_spans("```\nstill going", Kind::String, &["```", "still going"]);
+    }
+
+    #[test]
+    fn list_markers_and_quote_markers_colour_without_their_text() {
+        let code = "- one\n2. two\n> quoted";
+        assert_spans(code, Kind::Mark, &["-", "2.", ">"]);
+    }
+
+    #[test]
+    fn a_rule_and_a_setext_underline_are_the_same_mark() {
+        assert_spans("Title\n=====\n\n---", Kind::Mark, &["=====", "---"]);
+    }
+
+    #[test]
+    fn emphasis_needs_something_on_both_sides_of_it() {
+        assert_spans(
+            "**bold** and *thin*",
+            Kind::Literal,
+            &["**bold**", "*thin*"],
+        );
+        assert_spans("a * b * c and *p = *q", Kind::Literal, &[]);
+    }
+
+    #[test]
+    fn an_underscore_inside_a_word_emphasises_nothing() {
+        assert_spans("snake_case_name and _real_", Kind::Literal, &["_real_"]);
+    }
+
+    #[test]
+    fn a_code_span_holds_a_backtick_when_opened_with_two() {
+        assert_spans("``a ` b`` and `c`", Kind::String, &["``a ` b``", "`c`"]);
+    }
+
+    #[test]
+    fn an_unclosed_code_span_is_ordinary_text() {
+        assert_spans("a ` b", Kind::String, &[]);
+    }
+
+    #[test]
+    fn a_link_marks_its_brackets_and_colours_its_destination() {
+        let code = "see [the plan](PLAN.md) now";
+        assert_spans(code, Kind::Mark, &["[", "]"]);
+        assert_spans(code, Kind::Metadata, &["(PLAN.md)"]);
+    }
+
+    #[test]
+    fn a_table_is_found_by_its_delimiter_row_and_pipes_elsewhere_are_plain() {
+        let code = "| a | b |\n|---|---|\n| 1 | 2 |\n\nrun a | b in a paragraph";
+        assert_spans(
+            code,
+            Kind::Mark,
+            &["|", "|", "|", "|---|---|", "|", "|", "|"],
+        );
+    }
+
+    #[test]
+    fn a_table_without_outer_pipes_still_colours_and_the_table_ends_with_the_rows() {
+        let code = "a | b\n--- | ---\nnot a row";
+        assert_spans(code, Kind::Mark, &["|", "--- | ---"]);
+    }
+
+    #[test]
+    fn an_autolink_colours_and_an_html_tag_does_not() {
+        let code = "<https://example.com> and <a@b.com> and <div> and <img src=\"http://x\">";
+        assert_spans(
+            code,
+            Kind::Metadata,
+            &["<https://example.com>", "<a@b.com>", "http://x"],
+        );
+    }
+
+    #[test]
+    fn a_bare_url_gives_back_the_sentences_punctuation() {
+        assert_spans(
+            "see https://example.com/a., and ssh://host/x)",
+            Kind::Metadata,
+            &["https://example.com/a", "ssh://host/x"],
+        );
+    }
+
+    #[test]
+    fn a_bracket_a_url_opened_itself_stays_in_it() {
+        assert_spans(
+            "https://en.wikipedia.org/wiki/A_(b) here",
+            Kind::Metadata,
+            &["https://en.wikipedia.org/wiki/A_(b)"],
+        );
+    }
+
+    #[test]
+    fn a_url_inside_a_link_destination_is_not_coloured_twice() {
+        assert_spans(
+            "[x](https://example.com)",
+            Kind::Metadata,
+            &["(https://example.com)"],
+        );
+    }
+
+    #[test]
+    fn a_bracket_with_no_destination_after_it_is_left_plain() {
+        assert_spans("an [aside] here", Kind::Mark, &[]);
+    }
+}

client-core/src/highlight/mod.rs

@@ -0,0 +1,702 @@
+//! `code` read once, left to right, into the spans that carry a colour.
+//! Ported from `app/.../Highlighter.kt`.
+//!
+//! One pass with a small state -- in a comment, in a string, or in ordinary
+//! code -- rather than a locator per token kind over the whole text, which
+//! is what the library this replaced did and is why it found comments
+//! before it knew the language: a `#` inside a shell string, a `//` inside
+//! a URL and a block-comment opener inside a shell glob each commented out
+//! the rest of a line that was nothing of the sort.
+//!
+//! Every span is produced by advancing an index forward, so the result is
+//! ordered, non-overlapping and inside the code by construction. Nothing
+//! here panics: an unterminated string or comment runs to the end of the
+//! code, which is also what it looks like while a fence is still being
+//! written.
+//!
+//! **Indices are char offsets, not byte offsets** -- the scanner works over
+//! `Vec<char>`, mirroring the Kotlin original's `Char`-indexed strings, so
+//! [`span_text`] is how a caller (and every test here) turns a [`Span`]
+//! back into the text it covers.
+
+pub mod languages;
+pub mod markdown;
+
+pub use languages::{
+    Attributes, BlockComment, Language, Quote, Rules, fence_language, file_language, rules_for,
+};
+
+/// What a span of code is, in the terms a palette has a colour for.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum Kind {
+    Keyword,
+    String,
+    Literal,
+    Comment,
+    Metadata,
+    Punctuation,
+    Mark,
+}
+
+/// A run of [`Kind`] in the code, as a half-open range of **char** indices.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Span {
+    pub start: usize,
+    pub end: usize,
+    pub kind: Kind,
+}
+
+/// The text a [`Span`] covers, for a caller working in char indices (every
+/// test in this module, and any UI that also holds `code` as `Vec<char>`).
+pub fn span_text(code: &[char], span: &Span) -> String {
+    code[span.start..span.end].iter().collect()
+}
+
+/// The spans `language` colours in `code` -- the one way to ask, whatever
+/// the language turns out to be made of. `None` draws plain.
+pub fn spans_of(code: &str, language: Language) -> Vec<Span> {
+    if language == Language::Markdown {
+        markdown::scan_markdown(code)
+    } else {
+        scan(code, &rules_for(language))
+    }
+}
+
+/// `code` read into the spans [`Rules`] describes. Also reachable directly
+/// for a caller that already has a [`Rules`] (there is currently only one:
+/// [`spans_of`]), kept public because the Kotlin original exposed it the
+/// same way.
+pub fn scan(code: &str, rules: &Rules) -> Vec<Span> {
+    Scanner::new(code, rules).run()
+}
+
+/// Characters coloured as punctuation, and as marks. Both sets are the ones
+/// the library this replaced used.
+const PUNCTUATION: &str = ",.:;";
+const MARKS: &str = "()={}<>-+[]|&";
+
+struct Scanner<'a> {
+    code: Vec<char>,
+    rules: &'a Rules,
+    spans: Vec<Span>,
+    at: usize,
+}
+
+impl<'a> Scanner<'a> {
+    fn new(code: &str, rules: &'a Rules) -> Self {
+        Self {
+            code: code.chars().collect(),
+            rules,
+            spans: Vec::new(),
+            at: 0,
+        }
+    }
+
+    fn run(mut self) -> Vec<Span> {
+        while self.at < self.code.len() {
+            // Every branch that answers true has advanced `self.at`, so
+            // this terminates.
+            let consumed = self.block_comment()
+                || self.line_comment()
+                || self.raw_string()
+                || self.character_or_lifetime()
+                || self.string()
+                || self.attribute()
+                || self.number()
+                || self.word()
+                || self.single_character();
+            if !consumed {
+                self.at += 1;
+            }
+        }
+        self.spans
+    }
+
+    fn emit(&mut self, start: usize, kind: Kind) {
+        if self.at > start {
+            self.spans.push(Span {
+                start,
+                end: self.at,
+                kind,
+            });
+        }
+    }
+
+    fn starts(&self, token: &str) -> bool {
+        starts_with_at(&self.code, self.at, token)
+    }
+
+    /// Whether a line comment token here opens one; see
+    /// [`Rules::line_comments_at_word_start`].
+    fn at_word_start(&self) -> bool {
+        self.at == 0
+            || self.code[self.at - 1].is_whitespace()
+            || ";|&(".contains(self.code[self.at - 1])
+    }
+
+    /// Whether only whitespace stands between the start of this line and here.
+    fn at_line_start(&self) -> bool {
+        let mut back = self.at as isize - 1;
+        while back >= 0 && self.code[back as usize] != '\n' {
+            if !self.code[back as usize].is_whitespace() {
+                return false;
+            }
+            back -= 1;
+        }
+        true
+    }
+
+    fn advance_to_end_of_line(&mut self) {
+        while self.at < self.code.len() && self.code[self.at] != '\n' {
+            self.at += 1;
+        }
+    }
+
+    /// From an open bracket through the one that matches it, or to the end
+    /// if none does.
+    fn advance_to_matching_bracket(&mut self) {
+        let mut depth = 0i32;
+        while self.at < self.code.len() {
+            match self.code[self.at] {
+                '[' => depth += 1,
+                ']' => depth -= 1,
+                _ => {}
+            }
+            self.at += 1;
+            if depth == 0 {
+                return;
+            }
+        }
+    }
+
+    fn block_comment(&mut self) -> bool {
+        let Some(comment) = self.rules.block_comment else {
+            return false;
+        };
+        if !self.starts(comment.open) {
+            return false;
+        }
+        let start = self.at;
+        self.at += comment.open.chars().count();
+        let mut depth = 1i32;
+        while self.at < self.code.len() && depth > 0 {
+            // The closer is tried first so that a language whose two
+            // delimiters are the same string -- CoffeeScript's `###` --
+            // closes rather than nesting forever.
+            if self.starts(comment.close) {
+                depth -= 1;
+                self.at += comment.close.chars().count();
+            } else if comment.nests && self.starts(comment.open) {
+                depth += 1;
+                self.at += comment.open.chars().count();
+            } else {
+                self.at += 1;
+            }
+        }
+        self.emit(start, Kind::Comment);
+        true
+    }
+
+    fn line_comment(&mut self) -> bool {
+        if !self.rules.line_comments.iter().any(|c| self.starts(c)) {
+            return false;
+        }
+        if self.rules.line_comments_at_word_start && !self.at_word_start() {
+            return false;
+        }
+        let start = self.at;
+        self.advance_to_end_of_line();
+        self.emit(start, Kind::Comment);
+        true
+    }
+
+    /// Rust and RON: `b`? `r` `#`* `"` ... `"` `#`*, with no escapes inside.
+    fn raw_string(&mut self) -> bool {
+        if !self.rules.raw_strings {
+            return false;
+        }
+        let mut ahead = self.at;
+        if self.code.get(ahead) == Some(&'b') {
+            ahead += 1;
+        }
+        if self.code.get(ahead) != Some(&'r') {
+            return false;
+        }
+        ahead += 1;
+        let mut hashes = 0usize;
+        while self.code.get(ahead) == Some(&'#') {
+            ahead += 1;
+            hashes += 1;
+        }
+        if self.code.get(ahead) != Some(&'"') {
+            return false;
+        }
+        let start = self.at;
+        let closer: String = std::iter::once('"')
+            .chain(std::iter::repeat_n('#', hashes))
+            .collect();
+        let closer_chars: Vec<char> = closer.chars().collect();
+        let closed = find_from(&self.code, ahead + 1, &closer_chars);
+        self.at = match closed {
+            Some(index) => index + closer_chars.len(),
+            None => self.code.len(),
+        };
+        self.emit(start, Kind::String);
+        true
+    }
+
+    /// See [`Rules::lifetimes`]: an apostrophe that is not a character
+    /// literal opens nothing.
+    fn character_or_lifetime(&mut self) -> bool {
+        if !self.rules.lifetimes || self.code[self.at] != '\'' {
+            return false;
+        }
+        let Some(&next) = self.code.get(self.at + 1) else {
+            return false;
+        };
+        if next == '\\' || self.code.get(self.at + 2) == Some(&'\'') {
+            self.quoted(Quote {
+                open: "'",
+                close: "'",
+                escapes: true,
+            });
+        } else {
+            self.at += 1;
+        }
+        true
+    }
+
+    fn string(&mut self) -> bool {
+        // Longest opener wins, so Kotlin's `"""` is one delimiter rather
+        // than an empty string followed by a quote.
+        let mut quote: Option<Quote> = None;
+        for candidate in &self.rules.quotes {
+            let current_len = quote.map(|q| q.open.chars().count()).unwrap_or(0);
+            if self.starts(candidate.open) && candidate.open.chars().count() > current_len {
+                quote = Some(*candidate);
+            }
+        }
+        let Some(quote) = quote else {
+            return false;
+        };
+        self.quoted(quote);
+        true
+    }
+
+    fn quoted(&mut self, quote: Quote) {
+        let start = self.at;
+        self.at += quote.open.chars().count();
+        while self.at < self.code.len() {
+            if quote.escapes && self.code[self.at] == '\\' && self.at + 1 < self.code.len() {
+                self.at += 2;
+                continue;
+            }
+            if self.starts(quote.close) {
+                self.at += quote.close.chars().count();
+                break;
+            }
+            self.at += 1;
+        }
+        self.at = self.at.min(self.code.len());
+        self.emit(start, Kind::String);
+    }
+
+    fn attribute(&mut self) -> bool {
+        let start = self.at;
+        match self.rules.attributes {
+            Attributes::None => return false,
+            Attributes::AtWord => {
+                if self.code[self.at] != '@' || !is_word_start(self.code.get(self.at + 1).copied())
+                {
+                    return false;
+                }
+                self.at += 1;
+                while self.at < self.code.len() && is_word_part(self.code[self.at]) {
+                    self.at += 1;
+                }
+            }
+            Attributes::HashBracket => {
+                if self.code[self.at] != '#' {
+                    return false;
+                }
+                let mut ahead = self.at + 1;
+                if self.code.get(ahead) == Some(&'!') {
+                    ahead += 1;
+                }
+                if self.code.get(ahead) != Some(&'[') {
+                    return false;
+                }
+                self.at = ahead;
+                self.advance_to_matching_bracket();
+            }
+            Attributes::HashLine => {
+                if self.code[self.at] != '#' || !self.at_line_start() {
+                    return false;
+                }
+                self.advance_to_end_of_line();
+            }
+            Attributes::LineBracket => {
+                if self.code[self.at] != '[' || !self.at_line_start() {
+                    return false;
+                }
+                self.advance_to_matching_bracket();
+            }
+        }
+        self.emit(start, Kind::Metadata);
+        true
+    }
+
+    /// A number is a run starting with a digit and carrying on through
+    /// letters, digits, `_` and `.` -- which covers `0xFF`, `1_000`, `1u32`
+    /// and `3.14` without a grammar for any of them.
+    fn number(&mut self) -> bool {
+        if !self.code[self.at].is_ascii_digit() {
+            return false;
+        }
+        let start = self.at;
+        while self.at < self.code.len() {
+            let c = self.code[self.at];
+            if c.is_alphanumeric() || c == '_' || c == '.' {
+                self.at += 1;
+            } else {
+                break;
+            }
+        }
+        self.emit(start, Kind::Literal);
+        true
+    }
+
+    fn word(&mut self) -> bool {
+        if !is_word_start(Some(self.code[self.at])) {
+            return false;
+        }
+        let start = self.at;
+        while self.at < self.code.len() && is_word_part(self.code[self.at]) {
+            self.at += 1;
+        }
+        let word: String = self.code[start..self.at].iter().collect();
+        if self.rules.keywords.contains(word.as_str()) {
+            self.emit(start, Kind::Keyword);
+        }
+        true
+    }
+
+    fn single_character(&mut self) -> bool {
+        let kind = if PUNCTUATION.contains(self.code[self.at]) {
+            Kind::Punctuation
+        } else if MARKS.contains(self.code[self.at]) {
+            Kind::Mark
+        } else {
+            return false;
+        };
+        self.at += 1;
+        self.emit(self.at - 1, kind);
+        true
+    }
+}
+
+fn is_word_start(c: Option<char>) -> bool {
+    matches!(c, Some(c) if c.is_alphabetic() || c == '_')
+}
+
+fn is_word_part(c: char) -> bool {
+    c.is_alphanumeric() || c == '_'
+}
+
+/// Whether `code[at..]` starts with `token`, both read as chars.
+fn starts_with_at(code: &[char], at: usize, token: &str) -> bool {
+    let token: Vec<char> = token.chars().collect();
+    if at + token.len() > code.len() {
+        return false;
+    }
+    code[at..at + token.len()] == token[..]
+}
+
+/// The first index at or after `from` where `code` contains `needle`, or
+/// `None`.
+fn find_from(code: &[char], from: usize, needle: &[char]) -> Option<usize> {
+    if needle.is_empty() || from > code.len() {
+        return None;
+    }
+    (from..=code.len().saturating_sub(needle.len())).find(|&i| code[i..i + needle.len()] == *needle)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn spans(code: &str, language: Language, kind: Kind) -> Vec<String> {
+        let chars: Vec<char> = code.chars().collect();
+        spans_of(code, language)
+            .into_iter()
+            .filter(|s| s.kind == kind)
+            .map(|s| span_text(&chars, &s))
+            .collect()
+    }
+
+    fn assert_spans(code: &str, language: Language, kind: Kind, expected: &[&str]) {
+        assert_eq!(
+            spans(code, language, kind),
+            expected.to_vec(),
+            "{kind:?} in: {code}"
+        );
+    }
+
+    #[test]
+    fn a_quoted_glob_is_one_string_not_a_comment() {
+        assert_spans("x '*/a/*'", Language::Shell, Kind::String, &["'*/a/*'"]);
+        assert_spans("x '*/a/*'", Language::Shell, Kind::Comment, &[]);
+    }
+
+    #[test]
+    fn a_find_with_globs_has_no_comment_in_it() {
+        let code = "find . -path '*/.git/*' -prune -o -name '*.kt' -print";
+        assert_spans(
+            code,
+            Language::Shell,
+            Kind::String,
+            &["'*/.git/*'", "'*.kt'"],
+        );
+        assert_spans(code, Language::Shell, Kind::Comment, &[]);
+    }
+
+    #[test]
+    fn a_url_does_not_comment_out_the_rest_of_a_shell_line() {
+        let code = "curl https://example.com/x && echo done";
+        assert_spans(code, Language::Shell, Kind::Comment, &[]);
+        assert_spans(code, Language::Shell, Kind::Keyword, &["echo"]);
+    }
+
+    #[test]
+    fn a_url_inside_a_kotlin_string_stays_a_string() {
+        let code = "val url = \"https://example.com\"\nfun f() = 1";
+        assert_spans(code, Language::Kotlin, Kind::Comment, &[]);
+        assert_spans(
+            code,
+            Language::Kotlin,
+            Kind::String,
+            &["\"https://example.com\""],
+        );
+        assert_spans(code, Language::Kotlin, Kind::Keyword, &["val", "fun"]);
+    }
+
+    #[test]
+    fn a_rust_attribute_is_metadata_and_the_struct_after_it_still_colours() {
+        let code = "#[derive(Debug)]\nstruct A { b: u8 }";
+        assert_spans(code, Language::Rust, Kind::Metadata, &["#[derive(Debug)]"]);
+        assert_spans(code, Language::Rust, Kind::Comment, &[]);
+        assert_spans(code, Language::Rust, Kind::Keyword, &["struct"]);
+    }
+
+    #[test]
+    fn an_inner_rust_attribute_closes_at_its_own_bracket() {
+        let code = "#![allow(dead_code)]\nfn f() {}";
+        assert_spans(
+            code,
+            Language::Rust,
+            Kind::Metadata,
+            &["#![allow(dead_code)]"],
+        );
+        assert_spans(code, Language::Rust, Kind::Keyword, &["fn"]);
+    }
+
+    #[test]
+    fn a_c_preprocessor_line_is_metadata_rather_than_a_comment() {
+        let code = "#include <stdio.h>\nint main() { return 0; }";
+        assert_spans(code, Language::C, Kind::Metadata, &["#include <stdio.h>"]);
+        assert_spans(code, Language::C, Kind::Comment, &[]);
+        assert_spans(code, Language::C, Kind::Keyword, &["int", "return"]);
+    }
+
+    #[test]
+    fn a_kotlin_annotation_is_metadata() {
+        assert_spans(
+            "@Composable fun f() {}",
+            Language::Kotlin,
+            Kind::Metadata,
+            &["@Composable"],
+        );
+    }
+
+    #[test]
+    fn a_hash_inside_a_kotlin_string_is_not_a_comment() {
+        let code = "val c = \"#FF0000\"\nval d = 1";
+        assert_spans(code, Language::Kotlin, Kind::Comment, &[]);
+        assert_spans(code, Language::Kotlin, Kind::String, &["\"#FF0000\""]);
+    }
+
+    #[test]
+    fn an_apostrophe_inside_a_kotlin_string_does_not_open_one() {
+        let code = "val a = \"don't\"\nval b = \"x\"";
+        assert_spans(
+            code,
+            Language::Kotlin,
+            Kind::String,
+            &["\"don't\"", "\"x\""],
+        );
+    }
+
+    #[test]
+    fn a_rust_lifetime_does_not_open_a_string_but_a_character_literal_does() {
+        let code = "fn f<'a>(x: &'a str) { let c = 'x'; }";
+        assert_spans(code, Language::Rust, Kind::String, &["'x'"]);
+    }
+
+    #[test]
+    fn an_escaped_quote_is_inside_the_rust_character_literal() {
+        assert_spans("let c = '\\'';", Language::Rust, Kind::String, &["'\\''"]);
+    }
+
+    #[test]
+    fn a_rust_raw_string_keeps_its_inner_quotes() {
+        let code = "let s = r#\"a \"quoted\" b\"#;";
+        assert_spans(
+            code,
+            Language::Rust,
+            Kind::String,
+            &["r#\"a \"quoted\" b\"#"],
+        );
+    }
+
+    #[test]
+    fn a_kotlin_triple_quoted_string_is_one_string() {
+        assert_spans(
+            "val s = \"\"\"a \"b\" c\"\"\"",
+            Language::Kotlin,
+            Kind::String,
+            &["\"\"\"a \"b\" c\"\"\""],
+        );
+    }
+
+    #[test]
+    fn a_shell_single_quoted_string_takes_no_escapes() {
+        assert_spans("echo 'a\\' b", Language::Shell, Kind::String, &["'a\\'"]);
+    }
+
+    #[test]
+    fn rust_and_kotlin_nest_block_comments() {
+        let code = "/* a /* b */ c */ x";
+        assert_spans(code, Language::Rust, Kind::Comment, &["/* a /* b */ c */"]);
+        assert_spans(
+            code,
+            Language::Kotlin,
+            Kind::Comment,
+            &["/* a /* b */ c */"],
+        );
+    }
+
+    #[test]
+    fn c_ends_a_block_comment_at_the_first_close() {
+        assert_spans(
+            "/* a /* b */ c */ x",
+            Language::C,
+            Kind::Comment,
+            &["/* a /* b */"],
+        );
+    }
+
+    #[test]
+    fn a_shell_comment_starts_only_at_a_word_boundary() {
+        let code = "${#x} $# a#b # real";
+        assert_spans(code, Language::Shell, Kind::Comment, &["# real"]);
+    }
+
+    #[test]
+    fn a_hash_anywhere_is_a_python_comment() {
+        assert_spans("x = 1 # note", Language::Python, Kind::Comment, &["# note"]);
+    }
+
+    #[test]
+    fn a_toml_table_header_is_metadata_and_a_hash_in_a_value_is_not_a_comment() {
+        let code = "[server]\ncolour = \"#FF0000\"\nport = 8080 # the real one";
+        assert_spans(code, Language::Toml, Kind::Metadata, &["[server]"]);
+        assert_spans(code, Language::Toml, Kind::String, &["\"#FF0000\""]);
+        assert_spans(code, Language::Toml, Kind::Comment, &["# the real one"]);
+        assert_spans(code, Language::Toml, Kind::Literal, &["8080"]);
+    }
+
+    #[test]
+    fn a_ron_attribute_and_its_values_colour() {
+        let code = "#![enable(implicit_some)]\n(count: 3, on: true)";
+        assert_spans(
+            code,
+            Language::Ron,
+            Kind::Metadata,
+            &["#![enable(implicit_some)]"],
+        );
+        assert_spans(code, Language::Ron, Kind::Keyword, &["true"]);
+        assert_spans(code, Language::Ron, Kind::Literal, &["3"]);
+    }
+
+    #[test]
+    fn an_unknown_fence_language_is_none() {
+        assert_eq!(fence_language(Some("brainfuck")), None);
+    }
+
+    #[test]
+    fn every_language_the_fence_table_knows_has_a_scanner() {
+        for language in Language::ALL {
+            spans_of("x", language);
+        }
+    }
+
+    /// The scanner must never panic and must never answer a span the code
+    /// does not contain: the library this replaced answered a reversed
+    /// range here, which crashed a card, and a fence still being written is
+    /// an unterminated string or comment on every keystroke.
+    #[test]
+    fn spans_stay_inside_the_code_for_every_language_and_every_nasty_input() {
+        let nasty = [
+            "",
+            "'",
+            "\"",
+            "\"unterminated",
+            "/* unterminated",
+            "###",
+            "#",
+            "#![",
+            "[",
+            "r#\"",
+            "\\",
+            "'''",
+            "\"\"\"",
+            "0x",
+            "1.2.3",
+            "a#b//c/*d*/'e\"f",
+            "```",
+            "*",
+            "**",
+            "~~",
+            "> ",
+            "- ",
+            "1.",
+            "[x](",
+            "#######",
+            "|",
+            "|---|",
+            "<",
+            "<>",
+            "http://",
+            "a://",
+            "\n\n   \n",
+        ];
+        for language in Language::ALL {
+            for code in nasty {
+                let chars: Vec<char> = code.chars().collect();
+                let spans = spans_of(code, language);
+                for s in &spans {
+                    assert!(
+                        s.start <= s.end && s.end <= chars.len(),
+                        "{language:?} answered {s:?} for {code:?}"
+                    );
+                }
+                let mut sorted = spans.clone();
+                sorted.sort_by_key(|s| s.start);
+                assert_eq!(
+                    spans, sorted,
+                    "{language:?} answered spans out of order for {code:?}"
+                );
+            }
+        }
+    }
+}

client-core/src/lib.rs

@@ -0,0 +1,13 @@
+//! The app's pure logic, shared between the server and any Rust client --
+//! see `CLIENT_CORE.md` at the repo root for what lives here and what does
+//! not yet.
+
+pub mod ansi;
+pub mod api;
+pub mod event_stream;
+pub mod highlight;
+pub mod sse;
+pub mod transcript_cache;
+pub mod transcript_fold;
+
+pub use event_model::*;