Let the reader put the session list in its own order

Nothing sorts the sessions tab any more. The order is the server's `sessions` list, which is the reader's arrangement: holding a row puts the screen in selection mode -- the same gesture and the same bottom bar as the import tab -- and each card grows a burger handle at its right edge that drags the row to a new place, with a tick of haptic feedback for each one it passes. The two attempts this replaces, sorting by activity and then by when each agent was turned on, were both looking for an order a session could not move itself out of; no rule computed from what a session is doing can be one. `POST /sessions/order` rewrites the config's order, so it is the same on every device and survives a backend restart, and `SessionConfig::started` goes with the sort that needed it. Rearranging is independent of the selection: the handle moves the row it is on, picked out or not. The click moved off the card and onto its contents so that a press landing on the handle cannot also select the row it is about to move. Selection's one action is Delete, which now takes the whole set. Two traps in `Reorder.kt`, both measured on the emulator and written down in `this-machine-android`: a crossing is decided from how far the finger has travelled, because a lazy list animates an item into its new place and its `offset` reports the old one for several frames; and the viewport is pinned with `requestScrollToItem` around each move, because a lazy list keeps its place by the key of the top item and would otherwise follow the row being dragged. Verified on the emulator against the sandbox: the order survives an app restart and a backend read-back, a two-row drag moves exactly two rows, a drag to the bottom edge scrolls the list and lands the row last, pressing the handle without moving changes nothing, and deleting two selected sessions leaves the rest in place.
List a session's background tasks above its subagents
2026-09-20 01:06:15 -04:00 · 2026-09-19 23:29:40 -04:00 · 2026-09-19 22:15:14 -04:00 · 2026-09-19 21:20:58 -04:00 · 2026-09-19 19:30:35 -04:00 · 2026-09-19 18:55:51 -04:00
309 changed files with 24319 additions and 58328 deletions
@@ -0,0 +1 @@
 ../../.claude/skills/ai-app-rigs
@@ -1,6 +0,0 @@
 # xtask convention (https://github.com/matklad/cargo-xtask), without folding
 # every crate in this repo into one workspace -- they are deliberately
 # independent (see run-tests.sh, which cds into each). `cargo xtask apk`
 # from the repo root runs xtask/src/main.rs directly.
 [alias]
 xtask = "run --quiet --manifest-path xtask/Cargo.toml --"
@@ -72,13 +72,19 @@ Each exists because something was invisible without it.
  `usage::Fixture`'s, since those are its states. With none set an echo
  session meters nothing, which is the ordinary case and draws no bar.
 - **A fake CLI exercises the process lifecycle without a token.** Point a
-  `claude_cli` provider's `command` at a two-line script — `#!/bin/sh` and
+  `claude_cli` provider's `command` at a script that ordinarily runs
-  `cat > /dev/null` — and it behaves the way the lifecycle code cares about:
+  `cat > /dev/null` and it behaves the way the lifecycle code cares about:
  it holds the fifo open, records a real pid, writes nothing, and dies on a
  signal. So adopt, stop, restart and start are all drivable without a real
  `--resume` and without spending a turn on somebody's account. Reach for
  this when what is under test is *whether a process is running*, and for
-  `debug-transcript.sh` when it is *what the transcript draws*.
+  `debug-transcript.sh` when it is *what the transcript draws*. The sandbox's
  version also handles `auth login`: it prints an inert Anthropic-shaped URL,
  rejects any code except `sandbox-code`, and exits successfully for that one.
 - **`/think [seconds]` in an echo session puts up a thinking card**, long
  enough to watch it spin before it closes with the span it actually took.
  The rest of the turn is the ordinary echo reply, so it is also the rig for
  a block and a reply meeting.
 - **`app/transcript-bench.sh`** is the standard scroll measurement: it opens
  the first session (or `-k` keeps the current screen), scrolls a fixed
  gesture loop, and prints the app's render report — the same one the in-app
@@ -141,28 +147,55 @@ moment you use it — `ANDROID_SERIAL=$(emu serial) ./gradlew …`.
 ### Testing llama.cpp and ssh here
-**Both are set up here as of 2026-09-04** and need nothing typed. The
+**Both are set up here** and need nothing typed. The prebuilt llama.cpp lives
-prebuilt CPU llama.cpp lives outside the repo at `~/.local/opt/llama.cpp`
+outside the repo at `~/.local/opt/llama.cpp-vk` — a **Vulkan** build as of
-(the 15 MB `ubuntu-x64` release asset) and is symlinked as
+2026-09-19, replacing the CPU one that was there before — and is symlinked as
-`/usr/local/bin/llama-server`, which is what makes **discovery find it over
+both `~/.local/bin/llama-server` and `/usr/local/bin/llama-server`. The second
-ssh**: `~/.local/bin` is not on the PATH a non-interactive ssh session gets.
+is what makes **discovery find it over ssh**: `~/.local/bin` is not on the
-It resolves its own libraries through `$ORIGIN`, so no `LD_LIBRARY_PATH` is
+PATH a non-interactive ssh session gets. It resolves its own libraries through
-needed. One model is downloaded — `unsloth/Qwen3-0.6B-GGUF/Qwen3-0.6B-Q8_0.gguf`,
+`$ORIGIN`, so no `LD_LIBRARY_PATH` is needed.
-639 MB under `~/.local/share/ai-app/models` — and answers at usable speed on
+
-this VM's 8 cores. **Do not test with a 2-bit quant**: the
+Two models are downloaded under `~/.local/share/ai-app/models`:
-IQ2_XXS of that model produces fluent nonsense, which reads exactly like a
+
-broken driver — `llama-cli` produces the same from the file directly, which
+- `unsloth/Qwen3-0.6B-GGUF/Qwen3-0.6B-Q8_0.gguf`, 639 MB, loads in ~4s. It
-is how to tell the two apart in a hurry.
+  calls tools correctly and is the right rig for the driver's shape. Do not
  judge *answers* by it — asked for the second line of a file it read from
  line 2 and then named the third.
 - `ISTA-DASLab/Qwen3.8-27B-GSQ-RCO-GGUF/Qwen3.8-27B-GSQ-RCO-IQ3_S-mtp.gguf`,
  12 GB, ~20s to load, and the only one here with a multi-token-prediction
  head. It is the rig for anything about `loading` being a state of its own,
  since 20s is long enough to send into.
 **Do not test with a 2-bit quant**: the IQ2_XXS of the 0.6B produces fluent
 nonsense, which reads exactly like a broken driver — `llama-cli` produces the
 same from the file directly, which is how to tell the two apart in a hurry.
 **The GPU is shared and llama-server dies loudly when it runs out.** A second
 server loading a model while the 27B holds VRAM fails with `radv/amdgpu:
 Failed to allocate a buffer` / `MESA: error: buffer allocation failed` and
 exits mid-request. `-ngl 0` runs it on the 8 cores instead, which is the way
 to test the driver while something else holds the card -- through the app, that
 is the model's "Layers on the GPU" set to 0 in the machines tab's provider
 view, and `--models-max` above 1 is how two models come to be loaded at once
 in the first place.
 **Testing tools and MCP without the app**: `llama-server --tools all` publishes
 its built-in tools at `GET /tools` and runs one at `POST /tools` with
 `{"tool": …, "params": …}` and an `x-tool-cwd` header — so a whole agent loop
 is drivable with `curl` and no model at all. The Exa MCP server at
 `https://mcp.exa.ai/mcp` answers **without an API key** and needs a
 `User-Agent` header (Cloudflare answers 403 without one, which reads as a
 refusal rather than a missing header).
 There is no second machine, so **ssh this VM to itself**. That is set up
 too: the key is `~/.config/ai-app/ssh-self` (its public half is in
 `~/.ssh/authorized_keys`, labelled removable), and the real config carries a
-setup called **"this vm over ssh"** — `bob@127.0.0.1` with that
+machine called **"this vm over ssh"** — `bob@127.0.0.1` with that
 `identityFile` plus
 `options: ["StrictHostKeyChecking=no", "UserKnownHostsFile=/tmp/ai-app-known-hosts"]`
 so it touches nothing real — offering `claude-cli` and `llama-cpp`. It is the
 whole rig for "does a remote llama session work", since the far machine is
-this one and the model file is the same file. For a throwaway setup of your
+this one and the model file is the same file. For a throwaway machine of your
 own, point a provider's `command` at something harmless like `/bin/echo`
 rather than at `claude`: the transport is what is under test, the process
 exiting immediately is the signal, and it costs no tokens. The remote login
@@ -200,7 +233,7 @@ never be able to close the app, whatever produced it.
 **Deleting a session offers to take the machine's own transcript with it** —
 `DELETE /sessions/{id}?deleteForeign=true`, behind a switch in the
 confirmation, and only where the driver keeps a record of its own
-(`keepsOwnTranscript`, which today means Claude Code). Off by default,
+(`keepsOwnTranscript`, currently Claude Code or Codex). Off by default,
 because leaving that copy is what makes an ordinary delete recoverable — and
 the dialog's paragraph is rewritten when it is on rather than appended to,
 since the sentence promising the conversation "should still be there to
@@ -210,6 +243,57 @@ where it was instead of half-deleted.
 ## Measurements worth not re-taking
 - **`-np 1` is what makes the MTP draft head pay.** Taken 2026-09-19 on the
  27B above, decode speed for a 300-token reply, from `llama-server`'s own
  timings rather than the clock:
  | flags | tok/s |
  | --- | --- |
  | plain, any `-np` | 41.5 |
  | `--spec-type draft-mtp -np 1` | 61.4 |
  | `--spec-type draft-mtp -np 2` (n-max 2) | 65.9 |
  | `--spec-type draft-mtp`, default `-np` (4 slots) | 28 |
  Draft acceptance is 0.53–0.73 in every case, so the head is working in all
  of them: what changes is that speculating against a KV cache split four ways
  is slower than not speculating. A model's preset gets `parallel = 1` unless
  its settings say otherwise (the machines tab's provider view, since
  2026-09-19), so this is recorded for whoever next sees MTP look broken or
  next raises the slot count to answer two sessions at once. `--spec-draft-n-max 2` was
  worth another 7% in a single sample and is deliberately *not* passed — one
  sample on a virtualised GPU is not a number to hardcode.
 - **Prompt processing is the expensive part of a llama turn here, and decode
  speed falls only slowly with context.** Taken 2026-09-19 on a free GPU, the
  27B with `--spec-type draft-mtp -np 1`, generating 160 tokens each time:
  | context | decode | prefill of that prompt |
  | --- | --- | --- |
  | 88 | 43.4 tok/s (cold) | 21s |
  | 1,569 | 55.5 tok/s | (model still warming) |
  | 6,068 | 53.2 tok/s | 9.5s |
  | 14,068 | 50.3 tok/s | 22s |
  So a turn on a long conversation spends tens of seconds before the first
  token, and that is what `SessionStatus::Reading` exists to say. The same
  sweep on the 0.6B **on the CPU** falls much harder -- 30.1 tok/s at 44
  tokens of context to 11.5 at 6,024 -- which is the shape somebody means by
  "it gets slower as the conversation goes on". The figure the app draws is
  `timings.predicted_per_second`, decode only, so prefill is never mixed into
  it.
 - **A busy GPU is a model that will not load at all**, not a slow one:
  `radv/amdgpu: Failed to allocate a buffer` and `failed to load model` while
  something else holds VRAM. A 0.6B that had been decoding at 149 tok/s ran at
  16.7 in that window before its server died, so a tok/s figure taken while
  the card is shared says nothing about the model.
 - **Asking for the head when the file has none is fatal**, not ignored:
  `context type MTP requested but model doesn't contain MTP layers` and the
  server exits. Without the flag the same file logs `unused tensor
  blk.N.nextn.* — ignoring` and runs normally, which is the state to look for
  when MTP is silently not happening.
 - **What the transcript screen costs to scroll.** Taken 2026-08-30 on the GPU
  emulator against a real imported transcript with the server at
  `--delay 120`. Settled and flinging fast, both into fresh history and back
@@ -55,21 +55,4 @@ components: [
        // the terminal the QR would be printed on.
        enroll: "server/enroll-link.sh",
    ),
    // E5 (RUST.md): app/shellApp packaged by the xtask instead of Gradle
    // (cargo ndk -> javac -> d8 -> aapt2 -> zipalign -> apksigner), signed
    // with the same release key as "app" above so the two can install
    // over each other -- a separate component, not a mode of "app" above,
    // because it is a different applicationId (com.example.aiapp.shell)
    // built by a different tool from different sources. No `cwd`: it
    // defaults to this checkout's root, which both the `cargo xtask`
    // alias (`.cargo/config.toml`, resolved relative to the working
    // directory cargo is run from) and `cargo xtask apk`'s own publishing
    // step (`xtask/build/outputs/apk/<mode>/*.apk`, matching discover.rs's
    // `*/build/outputs/apk/*/*.apk` pattern -- see apk.rs's module doc)
    // both need.
    Apk(
        name: "shell",
        modes: ["release", "debug"],
        build: "cargo xtask apk",
    ),
 ],
@@ -1,20 +1,12 @@
 .gradle/
 build/
 app/androidApp/build/
 app/shellApp/build/
 local.properties
 .kotlin/
 *.iml
 .idea/
 .DS_Store
 server/target/
 event-model/target/
 client-core/target/
 android-shell/target/
 # E3's native library, built by cargo-ndk straight into the Gradle module
 # (RUST.md) -- an artifact, like server/target/ above, not source.
 app/shellApp/src/main/jniLibs/
 # Server logs from a development run (ai-server.log by convention,
 # wg-test.log from ./test-wg-tunnel.sh).
@@ -29,14 +21,3 @@ certs/
 config.ron
 config.json
 sessions/
 # iris, the in-house UI library, is vendored at iris/ and built by cargo.
 iris/target/
 iris/android-app/target/
 # E5's packaging xtask (RUST.md). `build/` above already covers
 # xtask/build/outputs/apk (the published APK, see apk.rs's module doc).
 # The repo root has no Cargo workspace, so this is xtask's own
 # intermediate working files (target/xtask/apk/...), not a shared one.
 xtask/target/
 /target/
@@ -1,18 +1,23 @@
 # ai-app
-A phone interface to AI coding sessions (Claude Code and llama.cpp),
+A phone interface to AI coding sessions (Codex, Claude Code and llama.cpp),
 replacing the Claude app for daily use. Rust/Axum backend on the desktop,
 Kotlin/Compose Android app, WireGuard + pinned self-signed TLS + bearer token
 between them.
-**`docs/PLAN.md` is the design source of truth** — every decision with its
+**`PLAN.md` is the design source of truth** — every decision with its date,
-date, its rationale, and what was rejected. Read it before changing anything
+its rationale, and what was rejected. Read it before changing anything
 structural, and update it in place when a decision changes rather than
 letting this file and the plan become two versions of the truth. This file is
-the working notes layer: layout, commands, rigs, and things that have bitten.
+the working notes layer: layout, commands, and things that have bitten.
-The design and working documents live under `docs/` — everything except this
+
-file and `CLAUDE.md`, which stay at the root because that is where Claude
+**The rigs are the `ai-app-rigs` skill** — the sandbox and bench scripts, the
-Code and other agent harnesses look for them.
+rule that no UI-driving script may tap a coordinate, how to test llama.cpp and
 ssh here, how importing behaves, and the measurements not worth re-taking.
 They moved there on 2026-09-04 because they are 12 KB that only matter once
 you are actually running one, and this file is sent with every request. Read
 it before writing or running a benchmark, driving the UI from a script, or
 touching the import screen.
 The central design point, worth not undoing by accident: **a session is a
 child process, translated into one common event model.** A new session type
@@ -25,14 +30,124 @@ Mirrors `../dev-updater` deliberately: same stack (axum 0.8 +
 axum-server/rustls, tokio, clap; Kotlin 2.4.x + Compose Multiplatform, single
 `:androidApp` module), same cert scheme, same registry pattern. Read
 dev-updater's `README.md` and `AGENTS.md` before diverging from them.
-Module-by-module intent is in `docs/PLAN.md`'s "Backend layout".
+Module-by-module intent is in PLAN.md's "Backend layout".
 - `server/` — the Rust backend (`ai-server`). `routes.rs`'s module doc
  comment is the HTTP table and the surface's source of truth.
  **A machine's models are served by one shared `llama-server`** (2026-09-19,
  `session/llama/router.rs`): started with no `-m`, which makes it a
  **router** — it reads a preset file naming models and their flags, starts a
  child server per model asked for, and routes by the `model` field in each
  request. So a session has no process of its own, two sessions on one model
  share one copy of it in memory, and a backend restart adopts one process
  rather than one per session. Four things fall out of it and are easy to get
  wrong again — a session records the router's pid in its own directory as
  `process::Detail::Shared`, and `process::stop` refuses to signal a `Shared`
  record, which is what keeps one session ending from unloading everybody's
  model; **nothing stops a router on its own**, and the only thing that does
  is the machine's provider view (`POST /machines/{id}/providers/{p}/stop`);
  how a model is *loaded* is per model on its machine
  (`ProviderConfig::model_settings`, `LLAMA_MODEL_PARAMS`) rather than per
  session, and saving those settings rewrites the preset, which **unloads**
  that model; and the preset is read back before every edit, because a router
  adopted from an earlier run is serving sections this process has never seen
  and rewriting without them unloads those.
  **A llama.cpp session runs on its configured machine** (built
  2026-09-04, the last of phase 5): `Transport::reserve_port` returns the
  port the server binds *there* and the port that reaches it *here*, and
  `Launch::reaching` puts the `-L` tunnel on the connection already carrying
  the command. Three things fell out of it and are easy to get wrong again —
  a forwarded launch gets a pty (`-tt`) and every other one keeps `-T`,
  because `llama-server` never reads the stdin whose closing ends a CLI and
  the same kill left it loaded on the far machine; the model is looked for on
  the machine that will serve it, so the spawn screen offers
  `GET /machines/{id}/providers/{p}/models` rather than any list of this
  backend's own; and the
  readiness poll watches the process as well as the port, since a model that
  will not load exits in a second and was being reported as "gave up after
  300s". See PLAN.md's "Transport" and "llama-server management".
  **A llama session has tools and runs the loop itself** (2026-09-19):
  `--tools all` gives the router `llama-server`'s built-in set, which it also
  *runs* (`GET /tools` for the definitions, `POST /tools` to call one), while
  web search comes from an MCP server this backend connects to directly
  (`session/llama/mcp.rs`, Exa preset in a discovered provider's
  `mcpServers`). Driving the loop is what makes the permission gate ours:
  `manual` asks before every call and remembers a tool you answer
  "Always allow …" to, `bypassPermissions` never asks, and the allowances are
  folded back out of the transcript. Which tools a *session* offers is a
  filter applied to those definitions here, not a flag over there: one shared
  server has one set, and the filter costs no reload (2,181 tokens of prompt
  with all seven, 698 with none). Three more things fall out of it and are
  easy to get wrong again — a model change **asks for another model** and
  stops nothing, since the one being left may be another session's;
  `parallel = 1` unless that model's settings say otherwise, and it is what
  decides whether the MTP draft head is a 50% speed-up or a 33% loss; and
  `spec-type = draft-mtp` is conditional on the file actually having a head,
  because asking for one that is not there makes `llama-server` **exit**.
  **A llama session's thinking is drawn** (2026-09-19): `reasoning_content`
  becomes `Event::Thinking` deltas closed by an `Event::ThinkingDone` carrying
  the span the *driver* measured, and the phone draws a card that spins while
  the block is open and says "Thought for 12.4s" once it is not. The reasoning
  is deliberately not part of the next prompt (`conversation` ignores it), and
  `timings.predicted_per_second` and `timings.prompt_ms` off the same stream
  become `UsageDelta`'s `tokensPerSecond` and `prefillMs`, which is the
  "read 9.5s · 50.3 tok/s · 3:00 PM" under a finished reply — nothing else here
  measures either, so every other driver sends `None`, and the clock is last so
  that it does not move when a provider reports fewer of them.
  **A turn's wait has two halves and says which** (2026-09-19):
  `SessionStatus::Loading` is the model coming off disk and
  `SessionStatus::Reading` is `llama-server` processing the prompt -- emitted
  when the request goes out and cleared by the first thing the model says, of
  any kind. Prefill is the expensive half here (~10s at 6k tokens, ~22s at
  14k), and as `running` it looked exactly like thinking. The phone draws
  both with the working spinner and its own words, "loading model" and
  "reading prompt".
  **Thinking effort is a param, and which levels exist is the model's answer**
  (2026-09-19): the `thinking` param rides on the request as a chat-template
  argument (`reasoning_effort`, or `enable_thinking: false` for `off`), so it
  needs no restart -- and the driver asks the loaded server which levels its
  template actually takes rather than trusting the offered list, because the
  27B raises on `high` and answers to `xhigh`. A level it cannot take is
  dropped and said in the transcript, naming the ones it can.
  **Every one of those is a default rather than a constant** (2026-09-19):
  `DriverKind::params` declares what a provider takes — key, label, shape,
  and whether a change waits for a restart — and the phone renders whatever
  arrives, on the spawn form and in the session settings dialog. Adding a
  setting to a driver is one entry in that table and no app change. `tools`
  is in there too, because the seven built-in definitions are ~1,500 tokens
  of every prompt, which on a small window is the difference between a usable
  session and one that overruns. `DriverKind::model_params` is the same table
  for a provider's **models**, drawn in the machines tab's provider view —
  the settings that decide how a model is loaded, which belong to the machine
  because one loaded copy answers every session using it.
  **A model is downloaded onto the machine that will serve it** (2026-09-19,
  replacing the fetch this backend used to do onto its own disk, and the
  Models tab that went with it). `models.rs` writes a script and a detached
  `curl` runs it *there*; the state of a run is a file beside the partial
  (`x.gguf.download`), so nothing about it is held in this process — it
  survives the phone closing, this backend restarting and a second device
  watching, and `kill -0` at each listing is what stops a machine that was
  rebooted from leaving a download claiming to be running. The progress is
  `wc -c` of the partial against the size HuggingFace published, the sha256
  it publishes is what makes a resume safe, and a finished download is not a
  state: it is a model, in the list beside the one still going.
  Codex is one persistent `codex app-server --stdio` process per session; its
  driver uses native turn steering and interruption, persists the protocol
  state and thread id, and reads subscription limits through the same CLI
  protocol.
 - `app/` — the Compose app, package `com.example.aiapp`, label "AI Sessions".
-  `AppRoot.kt` is the navigation `when`; `MainScreen.kt` the root's four tabs
+  `AppRoot.kt` is the navigation `when`; `SidePanels.kt` the one drag that
-  (sessions, import, models, setups); `Api.kt`/`EventStream.kt` the REST + SSE
+  slides the whole main screen over a session from the left (`MainPanel.kt`)
-  clients; `Events.kt` the event model mirror; `ServerConfig.kt` settings and
+  and what it has running beside the turn -- its background tasks over its
  subagents (`BackgroundTasks.kt`, `SubagentPanel.kt`) -- from the right, both keeping
  the session composed underneath; `MainScreen.kt` the root's three tabs
  (sessions, import, machines); `Reorder.kt` the drag that moves a row of a
  lazy list, used by the session list's handles -- **the order of that list is
  the reader's own and nothing sorts it** (`POST /sessions/order`);
  `MachineModels.kt` the models on one machine
  and the downloads putting them there, drawn inside `ProviderScreen.kt` for a
  provider that serves files off that machine's disk; `Api.kt`/`EventStream.kt`
  the REST + SSE clients; `Events.kt` the event model mirror; `ServerConfig.kt` settings and
  the Keystore-sealed token.
 - `wg-app-link/` — a **git submodule** shared with dev-updater: the pinned CA
  and leaf (`certs`), QR enrollment and the bearer token (`enroll`), wg0
@@ -42,24 +157,17 @@ Module-by-module intent is in `docs/PLAN.md`'s "Backend layout".
  build without it, since it is a path dependency, which is what keeps the two
  projects version-locked to the commit this repo pins. What deliberately did
  **not** move is the API surface and the config *schema*: routes, drivers,
-  sessions and setups are what makes this project itself.
+  sessions and machines are what makes this project itself.
- `docs/` — every design and working document except this file and
+- `SUBAGENTS.md` — a session's subagents as transcripts of their own
-  `CLAUDE.md`:
+  (`server/src/session/subagent.rs`, the subcards in `SessionListScreen.kt`
-  - `docs/EXPLORER.md` — the file explorer's design (`server/src/files.rs`
+  and the read-only form of `SessionScreen.kt`); `DECISIONS.md` holds the
-    and `FilesScreen.kt` / `FileViewer.kt` / `FileEditor.kt`).
+  choices made there that are still awaiting review.
-  - `docs/TRANSCRIPT_CACHE.md` — the phone's copy of what it has been sent.
+- `EXPLORER.md` — the file explorer's design (`server/src/files.rs` and
-    Read it before touching `TranscriptCache.kt`, `TranscriptSource.kt`, or
+  `FilesScreen.kt` / `FileViewer.kt` / `FileEditor.kt`).
-    the opening and stream effects in `SessionScreen.kt`.
+- `TRANSCRIPT_CACHE.md` — the phone's copy of what it has been sent. Read it
-  - `docs/TODO.md` — the working list.
+  before touching `TranscriptCache.kt`, `TranscriptSource.kt`, or the opening
-  - `docs/RUST.md` — the plan for moving the app to Rust (on the `rustify`
+  and stream effects in `SessionScreen.kt`.
-    branch of the `ai-app-2` clone): what has to be reproduced, the
+- `TODO.md` — the working list.
    framework decision, and the ordered experiments with their pass
    conditions. Read it before touching anything under that branch.
  - `docs/IRIS.md`, `docs/IRIS_TODO.md`, `docs/DECISIONS.md`,
    `docs/LAYOUT.md`, `docs/TEXTURES.md`, `docs/CLIENT_CORE.md` — iris's
    own public API log, working list, decisions log, layout/render design,
    and texture-atlas design, and the client-core crate's design,
    respectively.
 - `.dev-updater.ron` — what Dev Updater builds here: the server (run as
  `service: Managed(…)`, supervised by Dev Updater's own implementation
  rather than a script kept here) and the APK, in parallel. It points at
@@ -96,11 +204,7 @@ two icon buttons the same width without either being given one — and why
  :androidApp:compileDebugKotlin :androidApp:lintDebug
  :androidApp:testDebugUnitTest`. The unit tests are JVM-only and cover the
  syntax highlighter, the ANSI parser and the transcript cache — the app's
-  pure logic with no Android in it. Touching anything under `BenchFixture.kt`,
+  pure logic with no Android in it.
  `BenchNetwork.kt`, `BenchRun.kt` or the `bench` build type also needs
  `:androidApp:compileBenchKotlin :androidApp:lintBench` — a second build
  type compiles separately and lint has caught real bugs debug alone never
  would (see "Android Lint" below).
 - **Android Lint is not optional and is not run by a build.** It found a
  crash that had been shipping (`java.time` on a minSdk-24 app with
  desugaring off) and later a permission check that silently dropped every
@@ -156,174 +260,6 @@ two icon buttons the same width without either being given one — and why
  genuine handshake against 10.66.0.1 with pinned TLS, no router or phone
  involved. That is how to verify the wg0-only posture.
 ## The rigs
 Each exists because something was invisible without it.
 - **The `bench` build type and `app/bench-fixture/`** exist for P0 (RUST.md
  and DECISIONS.md's 2026-09-05 entries), the phone benchmark gate Iris
  asked for before porting continues: a deterministic, checked-in synthetic
  transcript (`app/bench-fixture/generate.py`, never a real one) that both
  this app and iris open with no server, so a frame-time comparison
  measures the renderer rather than the data. `./build-apk.sh bench` builds
  it — own application id (`com.example.aiapp.bench`) and label ("AI
  Sessions bench") so it installs beside a real enrollment rather than
  replacing it. Opening it goes straight to a session screen holding the
  fixture (no enrollment, no permission prompts) with a "Run benchmark"
  control beside "Copy" in session settings: it drives the same scroll loop
  and streaming phase `transcript-bench.sh`/`stream-bench.sh` drive over
  `ui-trace`, but in-process, since a real phone has no usable system
  tracing and no agent can drive one (this-machine-android's skill).
  `BenchFixture.kt`/`BenchNetwork.kt` fake the backend by installing a
  `URLStreamHandlerFactory` that answers `TranscriptSource`/`EventStream`'s
  requests from an in-memory copy of the fixture instead of opening a
  socket — so the fold, the paging and `uniqueItems` under test are the
  screen's real ones, never a shortcut built just for this. The report
  gains a `bench:` section (process CPU time, peak RSS, battery current) on
  every build, empty except when `BenchRun.kt` filled it in.
 - **`app/ui-sandbox.sh`** — a second `ai-server` with its own `$HOME`, config
  and data directory, holding eight invented Claude Code transcripts and a
  `claude` that is two lines of shell. **That isolation is the point**: the
  import screen lists whatever is in `~/.claude/projects`, which in this VM is
  real agent transcripts, so exercising *delete* against the ordinary server
  deletes somebody's conversation and exercising *import* starts a real
  `--resume` on the owner's account.
  Its port and root derive from the checkout's name, so two checkouts'
  sandboxes cannot reach each other, and its token is generated once into
  `~/.config/ai-app/sandbox-token` and carried across restarts along with any
  the enrolment flow appended — so the emulator app is enrolled **once** (the
  start banner prints the command) and stays enrolled. It shares the real TLS
  certificates, because the installed APK pins that CA.
  Driving verbs, so none of this is re-derived per session:
  `./ui-sandbox.sh spawn [title]` (an echo session, prints its id),
  `./ui-sandbox.sh send SID text|@file`, and
  `./ui-sandbox.sh api /path [curl args]`.
  `./ui-sandbox.sh keep` restarts the server without wiping the sessions and
  enrolment already there — for when the fixture under test was expensive to
  build; plain `start` wipes them, which is right for the list-screen
  fixtures and wrong for that.
  It passes `--delay` by default, and `AI_SANDBOX_BIG_MB` puts one large
  transcript among the small ones while `AI_SANDBOX_SPAWN_DELAY` makes the
  fake CLI slow to start. Both exist because operations that finish in
  milliseconds have states on the way that nothing can observe, and an
  unobservable state is one where broken and working look identical.
  It also builds a fixture tree at the sandbox home's `~/files` for the
  explorer, holding the states otherwise only reachable by finding a real
  machine in one: an empty directory, a name with a tab and one with an
  apostrophe, a binary file, one over `FILE_LIMIT`, one `chmod 000`, a
  symlink to a directory and a broken one, a source file per language, and
  the three sizes the limits were measured against (`edit-32k.rs`,
  `edit-128k.rs`, `big-source.rs`). Point a session at it with
  `./ui-sandbox.sh api /sessions/<id>/cwd -X POST -H 'content-type: application/json' -d '{"cwd":"~/files"}'`.
  The explorer's 409 is produced by editing the file on the machine
  (`printf … > file`) between pressing the pencil and pressing save.
 - **`app/debug-transcript.sh`** — a real conversation on the emulator. The
  echo driver is the right rig for most things and the wrong one for anything
  whose cost scales with what was actually written: a real reply is longer,
  is real markdown, and carries tool calls whose input and output are
  kilobytes. Two faults were invisible until a real transcript was loaded — a
  page of history landing mid-fling threw the reader back to the newest end,
  and parsing one real reply took 51ms against 4.6ms for a synthetic one.
  `-b` takes the biggest conversation on the machine rather than the newest,
  which is what a scrolling test wants; `--stop` takes it down.
  It copies the transcript into `/tmp` and gives the server a `HOME` of its
  own, so the import can only see the copy — importing spawns `claude
  --resume`, and against the real file that is a second CLI writing to a
  conversation somebody may still be in. **A transcript never goes in this
  repository**: they hold whatever was said, read and written in that
  session, and `~/repos` is shared with the host besides.
 - **A fake CLI exercises the process lifecycle without a token.** Point a
  `claude_cli` provider's `command` at a two-line script — `#!/bin/sh` and
  `cat > /dev/null` — and it behaves the way the lifecycle code cares about:
  it holds the fifo open, records a real pid, writes nothing, and dies on a
  signal. So adopt, stop, restart and start are all drivable without a real
  `--resume` and without spending a turn on somebody's account. Reach for
  this when what is under test is *whether a process is running*, and for
  `debug-transcript.sh` when it is *what the transcript draws*.
 - **`app/transcript-bench.sh`** is the standard scroll measurement: it opens
  the first session (or `-k` keeps the current screen), scrolls a fixed
  gesture loop, and prints the app's render report — the same one the in-app
  copy button produces, whose `on screen:` line names what the viewport was
  holding. Compare two runs with the same gestures; the emulator's absolute
  frame times transfer nothing, the report's accounting does. Run it either
  side of any change under `Markdown*.kt`, `Transcript*.kt` or
  `SessionScreen.kt`'s list, and put the report in the commit. The numbers
  that move first are the worst `record: one block`, the reparse mean while
  streaming, and the draw phase's accounting line.
 - **`app/stream-bench.sh [-k] FILE`** is that measurement for a reply still
  arriving. It taps "Jump to latest" so the list is pinned to the newest end,
  resets the report, sends FILE, waits for the transcript to stop growing,
  and prints. Both of those are corrections to a first version that measured
  nothing: a transcript parked further back never redraws while a reply
  streams into it, and a session is idle at *both* ends of a turn, so polling
  for idle answers before the turn has started.
 - **`app/trace-draw.sh`** names what a scrolling frame spends inside the
  framework, from `atrace` text output with no trace processor needed. It is
  how the cost of a layout node per link was attributed to the framework
  rather than guessed at.
 ### Driving the UI
 **No script that drives this app's UI presses a coordinate.** Every control
 is found by the name it already carries for assistive technology —
 `ui-trace record --do "tap 'Session settings'"` — which resolves the label
 against the screen at the moment of the gesture and fails the whole run when
 it is not there. `app/bench-lib.sh` is what the bench scripts share for it. A
 coordinate is a position measured once by hand, and anything that moves the
 control makes the tap land on whatever now sits there — the bench then
 reports a number that was never measured, which reads exactly like a result.
 Both bench scripts pressed the render report at `tap 723 205` until that
 button moved into the session settings dialog on 2026-09-03. The check that
 none has crept back:
    grep -n "tap [0-9]" app/*.sh
 Swipes are still coordinates, deliberately: a gesture across a scrolling area
 is a distance rather than a control.
 **Two traps in the emulator bench loop**, each of which cost a run.
 `adb shell pm clear` removes the enrolment and the notification permission
 along with the saved anchors, so the next run measures a permission dialog —
 re-enrol with the command `ui-sandbox.sh` prints, and
 `pm grant … POST_NOTIFICATIONS`. And a saved scroll anchor is per session id,
 so the only way two builds start a scroll from the same place is a *fresh
 session for each*.
 **The emulator is `~/repos/emulator-tools`' business, not this repo's.**
 `emu up` creates and boots the AVD named after this checkout — whatever `emu
 name` prints, never a name typed out here, since this file is the same in
 every clone. `run-android.sh` is that plus a build and an install. The `adb`
 on `PATH` after sourcing `android-env.sh` is that repo's wrapper, which fills
 in `-s` from the same rule. Gradle does not go through it, so a Gradle init
 script from `emulator-tools` runs `emu check` before `installDebug`,
 `uninstallDebug` and `connectedAndroidTest` and fails rather than fanning out
 to every attached device; when it refuses, say which device you mean at the
 moment you use it — `ANDROID_SERIAL=$(emu serial) ./gradlew …`.
 ### Testing llama.cpp and ssh here
 The prebuilt CPU llama.cpp lives outside the repo at
 `~/.local/opt/llama.cpp` (the 15 MB `ubuntu-x64` release asset). It needs its
 own directory on `LD_LIBRARY_PATH`, so start the server as
 `LD_LIBRARY_PATH=~/.local/opt/llama.cpp ai-server …` and point a provider's
 `command` at `~/.local/opt/llama.cpp/llama-server`. A 0.6B Q8_0 answers at
 usable speed on this VM's 8 cores. **Do not test with a 2-bit quant**: the
 IQ2_XXS of that model produces fluent nonsense, which reads exactly like a
 broken driver — `llama-cli` produces the same from the file directly, which
 is how to tell the two apart in a hurry.
 There is no second machine, so **ssh this VM to itself**: generate a
 throwaway key, append the public half to `~/.ssh/authorized_keys`, and
 configure a host of `bob@127.0.0.1` with `identityFile` pointing at it plus
 `options: ["StrictHostKeyChecking=no", "UserKnownHostsFile=…"]` so it touches
 nothing real. Point a provider's `command` at something harmless like
 `/bin/echo` rather than at `claude`: the transport is what is under test, the
 process exiting immediately is the signal, and it costs no tokens. **Take the
 key back out afterwards.** The remote login shell here is **fish**; the
 remote script and `ssh.rs`'s POSIX quoting happen to mean the same thing in
 both, but that is luck rather than design, and a shell that is neither is the
 thing to suspect first if a remote spawn ever mangles an argument.
 ## Where things run (host vs this VM)
 The machine itself — the two boxes, the shared `~/repos` mount, and why the
@@ -332,7 +268,7 @@ means here:
 - **`ai-server` belongs on the host in production.** That is where the LAN
  address the phone can reach is, and where WireGuard terminates.
-  `wg-setup-host.sh` sets that up (keys, `wg0.conf`, the phone's QR); run it
+  `wg-machine-host.sh` sets that up (keys, `wg0.conf`, the phone's QR); run it
  there with `sudo WG_ENDPOINT=<ddns name>`.
 - **The tunnel and the real phone can never terminate in the VM**, because
  nothing outside can open a connection into it. Phone bring-up is host work.
@@ -347,7 +283,7 @@ means here:
 ## Sessions outlive the backend
 Since 2026-08-29 a session's process is deliberately left running when
-`ai-server` stops, and adopted again when it starts. docs/PLAN.md has the design;
+`ai-server` stops, and adopted again when it starts. PLAN.md has the design;
 day to day:
 - **Stopping the server no longer stops the sessions.** After `pkill
@@ -365,47 +301,93 @@ day to day:
  keep what a development server spawns. The flag decides only what **new**
  sessions are marked as; what happens on the way out is decided by the
  **mark**.
 - **A llama.cpp router is not cleaned up by any of that**, throwaway sessions
  included: it belongs to the machine rather than to a session, and a
  development server that has loaded a model leaves it loaded — gigabytes of
  VRAM — after `pkill ai-server`. Stop it from the machines tab's provider
  view, or `pkill -f "[l]lama-server"` when testing.
 - Each session directory holds `process.json`, `stdin.fifo`, `stdout.log` and
  `stderr.log`. `stdout.log` is the driver's input, read from the byte offset
  in `process.json`; removing either by hand while the session is live loses
  output or replays it.
-## Importing
+## Auto-resume
-The import list reports each session's **size as well as its line count**,
+**A session switched to it sends itself a message once the account's usage
-because the two disagree in the way that matters: these transcripts embed
+limit lifts** — off by default, per session, in the session settings dialog.
-screenshots as base64, so one line can be a megabyte. On this machine a 69 MB
+PLAN.md's "Auto-resume" is the design; day to day:
 session has 3,427 lines and a 44 MB one has 6,792 — nothing about a line
 count tells you what continuing a session will cost. Shown, not warned about;
 importing a large session is a choice somebody is entitled to make.
-**Never import a Claude Code session that is open in a terminal.** The app
+- **The schedule is a plan to ask.** `resume.rs` wakes at the scheduled time,
-refuses it — see docs/PLAN.md for the incident that made that a refusal rather
+  asks `GET /usage`'s meter for that machine and provider, and only sends when
-than a warning.
+  it answers `ok` with nothing at 100%. Anything else — still spent, logged
  out, unreachable — is a longer wait, and a still-spent window reschedules to
  the reset time the *meter* now gives.
 - **Test it with echo, never with a real account.** `/limit [minutes]` reports
  the same `limitReached` event a real driver does, and `/usage 100 5` sets
  what the meter answers. They are deliberately separate: the two disagreeing
  is the case the design exists for. `/usage 20` is the limit lifting.
 - The wait is on the session in `config.ron` (`resume`), so it survives a
  backend restart. A day after the limit was hit it gives up and says so in
  the transcript.
-**One Claude Code session id can name two files, and the listing offers it
+## A session waiting on its own work
 once.** Resuming from a different working directory makes the CLI write a
 second transcript with the same id under that directory's project folder — an
 ordinary state of a machine, not corruption. Everything downstream addresses
 a session by id, and the phone keyed its list on it, so two rows sharing one
 **closed the app** on a Compose duplicate-key throw. `parse_listing` keeps
 the copy with the most lines, because the other is usually a few-hundred-byte
 stub and is often the *newer* of the two, so recency is the wrong key.
 Deleting removes every copy rather than the first, or the row came back after
 a delete that reported success. The phone's half is `uniqueItems`, which
 every list keyed on a server-chosen id goes through: a repeat there must
 never be able to close the app, whatever produced it.
-**Deleting a session offers to take the machine's own transcript with it** —
+Since 2026-09-06 a session whose turn ended with a **backgrounded subagent or
-`DELETE /sessions/{id}?deleteForeign=true`, behind a switch in the
+command still running** reports `waiting` rather than `idle` — its own status,
-confirmation, and only where the driver keeps a record of its own
+drawn as the word "waiting" in `waitingColor` on both screens. `idle` means
-(`keepsOwnTranscript`, which today means Claude Code). Off by default,
+"waiting for a person" and this means the opposite, so it also suppresses the
-because leaving that copy is what makes an ordinary delete recoverable — and
+"finished" notification, which used to arrive at the one moment it was untrue.
-the dialog's paragraph is rewritten when it is on rather than appended to,
+Two things fall out of it and are easy to get wrong again: the queue and the
-since the sentence promising the conversation "should still be there to
+held-command boundary release on **either** end-of-turn status, so a message
-import again" is exactly the one the switch makes false. The server deletes
+sent while a subagent runs is not held until the subagent finishes; and
-the machine's copy *first*, so a machine it cannot reach leaves the session
+`sessionWorking("waiting")` is deliberately **false** — nothing is being
-where it was instead of half-deleted.
+written, and the fold uses that same predicate to decide a reply is settled.
 - **Nothing subagent-specific goes in the main agent's transcript** unless a
  subagent sends it a real message that wakes it — which is the peer path, and
  already has a row. A row per finished background task was tried and was a
  screenful of dividers about work nobody was asking after, one of them a whole
  shell command. A subagent's report is its own transcript's closing text and
  is read in the subcard.
 - **A backgrounded command has no subagent, so its report lands in the tool
  card that launched it** — a `ToolUpdate` against the call's own id, replacing
  the launch result that says it is still running. `/background [seconds]` in
  an echo session is that shape end to end.
 - **Two replies that meet are separated by a `TurnBreak`** — a hairline, no
  words. The reply that follows a turn boundary is a **new** message: the fold
  refuses to grow a settled reply, and without that the two ran together
  mid-sentence. `./ui-sandbox.sh` plus `/subagent 3` or `/background 5` in an
  echo session is the whole rig; the helpers stagger a second apart so each
  reply is its own.
 - **Claude's background-task level is authority; two edge sources are the
  fallback.** Since Claude Code 2.1.261,
  `background_tasks_changed { tasks: [...] }` replaces the live set and repairs
  a missed ending edge. Its array size is also the measured `backgroundTasks`
  count exposed on the session row and event stream; the phone draws a nonzero
  count beside the status rather than deriving one from `waiting` or from the
  subagent directory. **What those tasks are is `GET /sessions/{id}/background`**,
  listed in the session's right panel above the subagents: runtime state, so it
  is never persisted and `null` -- not an empty list -- is what a session with
  no process answers. An `ambient` task is dropped from both the list and the
  count, on the CLI's own instruction: a live-update watcher is not activity,
  and counting one leaves a session `waiting` for ever. An adopted CLI is sent a repeated `initialize` to ask
  for the current set. Reconcile only between turns or at a result boundary:
  a foreground agent is legitimately absent from a background-only snapshot.
  Older CLIs still need both edge sources: `open_tasks` knows about a
  backgrounded command, while `Subagents::any_open` finds a subagent whose
  `task_started` is behind an adopted stdout offset.
 - **A usage limit a subagent hits reaches the session**, not just the
  subagent's own transcript; auto-resume can only schedule against a session.
  That is the case where the main agent is idle and a background Task is
  still burning quota.
 - **Codex's count is two id sets added together.** Open child thread ids come
  from the subagent registry; live background command process ids come from
  app-server's experimental `thread/backgroundTerminals/list`. The command set
  is runtime state, refreshed at lifecycle edges and once a second while
  nonempty. Never decrement it from an unmatched completion.
 - **The status word and its colour are `sessionStatusWord` /
  `sessionStatusColour`**, shared by the list and the session screen. They
  were two `when`s, and the second one silently missed `waiting`.
 ## Shared appearance
@@ -418,10 +400,77 @@ where it was instead of half-deleted.
  swallowed the drag along with the tap, so a list could not be scrolled
  while anything in it was busy.
 - **A rate-limit bar belongs to a session's provider, not to its machine.**
  One machine offers echo, the Claude CLI and a local model at once and only
  the CLI spends anything, so a session says which meter reports on it
  (`usageProvider`, from `DriverKind::usage_provider`, which
  `usage::providers_for` reads too so the two lists cannot disagree) and the
  phone matches a snapshot on machine *and* provider. Nothing meters a llama
  or echo session, and the phone draws **nothing** for one — not a zero, and
  not "unknown". Nothing while the first fetch is out either: "checking"
  under a session that turns out to meter nothing is a row the screen then
  has to withdraw.
 ## Things that have bitten
-Project-specific only — a lesson that would bite any project on this machine
+- **A server started with no `--tools` answers 403 at `GET /tools`, not an
-belongs in `~/.claude/TOOLCHAIN.md` or `~/.claude/MACHINE.md` instead.
+  empty list.** The route is off rather than empty, so reading that as a
  failure made "no tools" — the one setting whose entire purpose is to have
  none — a session that never started. The router is always given
  `--tools all` now and the choice is a filter here, so this is a trap for
  whoever next changes how the server is started.
 - **`POST /models/load` answers 400 for a model that is already loaded**, and
  that is the *ordinary* case once one server is shared: a second session
  naming a model somebody else loaded. The router driver asks what is loaded
  first and treats "it is there" as the answer whatever the request said.
 - **Starting a process from a blocking thread needs the runtime.** Loading a
  model is minutes of disk, so it runs on a `std::thread` — and tokio's
  `Command::spawn` registers the child with the reactor, so calling it with no
  runtime context panics. The panic kills only that thread: the session said
  `loading` for ever and nothing appeared in the log. `Routers` holds a
  `tokio::runtime::Handle` and enters it around the spawn.
 - **A llama session reports `loading`, and a message sent into it queues.**
  Before 2026-09-19 the session showed `running` from the moment the process
  started, so a minute of reading a model off disk was indistinguishable from
  a minute of thinking -- and anything sent in that window came back as an
  error, because `llama-server` refuses everything until the model is in
  memory. `SessionStatus::Loading` is the state. A driver that reports
  `Loading` owes the holding as well as the word, and **the queue is where it
  holds**: held inside the turn instead (until 2026-09-20) the message was
  recorded as read on arrival, so the phone drew it as sent while nothing was
  reading it, and the turn then folded it out of the transcript *and*
  appended it, sending it to the model twice. `Shared::await_ready` is now
  only for a turn whose model was changed under it.
 - **A llama turn that says nothing said something that was thrown away.** Two
  silent endings were found on 2026-09-20 and both looked, on the phone, like
  a message that was sent and never answered: an `{"error": ...}` chunk
  arriving mid-stream on an otherwise successful response (a GPU that ran out
  of memory mid-decode), and a stream that simply stops without its `[DONE]`
  (the model unloaded under the session). Neither is an ordinary end, and
  `generate` now fails the turn for both -- a reply that stops early is not a
  reply, and the transcript keeps whatever arrived before it.
 - **A transcript outlives the enum.** Removing `Event::TaskNote` hours after
  adding it made every transcript that had recorded one unreadable, so
  `launch` failed for those sessions and `SessionManager::new` skipped them —
  no status, nothing sendable, no new messages, for every live session that
  had run a background task. **The set of kinds a transcript can hold only
  ever grows**: a line may come from a newer server or from an older one that
  wrote a kind since dropped, and one unfamiliar word must never be able to
  end the file. `Indexed::parse_at` degrades a line it cannot read to
  `Event::Unreadable { kind }`, keeping its seq — which is what everything
  downstream is addressed by — and the phone draws it as a placeholder saying
  which kind. Never delete a variant instead of retiring it; `Event::TaskNote`
  is what retiring looks like, and the phone folds it to no row.
 Project-specific only. A lesson that would bite any project on this machine
 belongs in `~/.claude/MACHINE.md` or the `this-machine-*` skill for its
 subject; one that would bite any project anywhere belongs in the
 `code-lessons` skill, under the admission test at its end.
 - **tracing caches callsite interest process-wide.** A test that hits a
  `tracing::warn!` with no subscriber installed can poison the interest cache
@@ -515,6 +564,19 @@ belongs in `~/.claude/TOOLCHAIN.md` or `~/.claude/MACHINE.md` instead.
  the reader hit the end of what was loaded on every swipe and stood there
  for a round trip. It is `HISTORY_SCREENS` viewports now, counted from what
  is actually on screen.
 - **A page landing while the history observer was fetching it must trigger its
  own successor.** The observer once collected only `LazyListState.layoutInfo`;
  while its collector was suspended in `loadOlderPage`, a compact page could
  be composed and laid out without leaving another change to observe afterward.
  Keying the effect on `oldestSeq` still missed the opening prefetch: that key
  changed while `loadingHistory` was true, so the restarted effect declined to
  overlap it and never noticed the flag returning to false. Codex exposes both
  failures because a page full of calls collapses into one tool group: loading
  stopped until expanding that group forced a layout. The observer now collects
  the cursor, loading, restoring and failure state with the layout, so returning
  to not-loading always rechecks the settled height. A failed page turns the
  history boundary into a Try again control rather than retrying in a loop or
  requiring another scroll.
 - **Only `fetchTranscript` was off the main thread; the fold was not.**
  `foldEvent` returns a new list per event, so a page is that many copies of
  a growing list — fine at 80 events and about 300,000 element copies at 800,
@@ -522,38 +584,12 @@ belongs in `~/.claude/TOOLCHAIN.md` or `~/.claude/MACHINE.md` instead.
  shape: the `markdownIn` scan that decides *what* to parse ran before the
  hop to `Dispatchers.Default`. The shape to watch for is a `withContext`
  that wraps the *fetch* and leaves the work done with the result outside it.
-
+- **A transcript snapshot cannot survive a suspension and then be assigned.**
-## Measurements worth not re-taking
+  `loadOlderPage` joined its page to `items`, suspended while `warm` parsed
-
+  markdown, and then assigned the joined snapshot. An SSE event arriving in
- **What the transcript screen costs to scroll.** Taken 2026-08-30 on the GPU
+  that gap appeared and vanished; reopening brought it back because the
-  emulator against a real imported transcript with the server at
+  transcript and cache had it all along. Warm against a candidate if needed,
-  `--delay 120`. Settled and flinging fast, both into fresh history and back
+  then join against the current `items` and assign without another suspension.
-  through rows already drawn: **5.2–5.9% janky frames, 99th percentile
+  Also keep the page's original `oldestSeq`: a stream reset while the fetch or
-  29–32ms, 0–2 slow UI-thread frames.** The stock Settings app on the same
+  warm is suspended makes the page stale, and it must be discarded rather
-  device is 3.3% and 38ms, so this is at the platform floor. The number that
+  than joined into the reset window.
  is *not* at the floor is the first few seconds after opening a session,
  where every row on the way is being composed for the first time; that is
  inherent to a lazy list and it is why a measurement taken before the screen
  settles reads three times worse. **Settle first, then reset `gfxinfo`.**
 - **The reset path is not reachable by reopening a session.** Measured
  2026-09-04 against a session streaming at 20 events a second: reopening one
  with an anchor 1,800 events back connects **87–119 events behind**, well
  under `CATCH_UP_LIMIT`'s 200, because the restore is two requests — the
  opening page, then one span covering the whole distance. To exercise the
  reset at all you have to lower `CATCH_UP_LIMIT` in a throwaway build; at 5
  the app takes the reset on a live connection, clears, refills and carries
  on without reconnecting.
 - **The session screen's stream survives backgrounding here** — 20 seconds at
  the launcher while 415 events were produced brought no reconnect at all,
  which is not what the comment above that loop expects, and is most likely
  this emulator being headless rather than the phone's behaviour.
 - **Reopening a cached session costs one request for one event** (the probe),
  and scrolling the whole conversation back costs nothing more; a cold open
  of the same 500-event session is two pages, 100 events. Measured
  2026-09-04 on the emulator against the sandbox.
 - **Reading is cheap and editing is not.** The viewer handles a 1 MiB,
  28,000-line file because it draws one row per line; the editor is one
  `BasicTextField`, which costs two seconds a frame at 128 kB and stops the
  app at 1 MiB, so `EDIT_LIMIT` caps it at 32 kB with the reason said on
  screen. If you make the editor faster, that number is what to move.
  docs/EXPLORER.md's "What the measurements said" has the rest.
@@ -14,7 +14,7 @@ AGENTS.md. `server/src/files.rs` is the backend and `FilesScreen.kt` /
 ## What it is, in one paragraph
 A machine's filesystem, seen from the phone through the backend. The explorer
-belongs to a **setup** (a machine), not to a session: a session only says
+belongs to a **machine** (a machine), not to a session: a session only says
 where to start. Every operation — list, read, write, create — is one shell
 script run through `Transport`, exactly the way the import listing and the
 usage fetch already work, so the local and the ssh case are one
@@ -25,16 +25,16 @@ message. The phone draws what came back.
 ### 1. Keyed on the machine, opened from the session
-Routes live under `/setups/{id}/…`, beside `importable`, because a filesystem
+Routes live under `/machines/{id}/…`, beside `importable`, because a filesystem
 is a property of a machine. The session screen's folder button opens the
-explorer with the session's setup and its `cwd`; a session with no `cwd`
+explorer with the session's machine and its `cwd`; a session with no `cwd`
 opens at the machine's home, which the **machine** resolves (`cd` with no
 argument and `pwd -P`), never a path the phone guessed. Nothing in the
-explorer knows what a session is, so a later entry point from the setups tab
+explorer knows what a session is, so a later entry point from the machines tab
 is one more caller and no new code.
 Rejected: routes under `/sessions/{id}/`. The session would be a detour to
-find the setup, and "browse this machine" from anywhere else would need a
+find the machine, and "browse this machine" from anywhere else would need a
 session to exist first.
 ### 2. One shell script per operation, over `Transport`, on both transports
@@ -68,7 +68,7 @@ Elsewhere the phone picks an **id** and the server resolves which file it
 names, so an enrolled token cannot become "read me an arbitrary file". The
 explorer's whole purpose is the path, so it takes one. Recorded in PLAN.md's
 Security section in these terms: the token already gates spawning a
-bypass-permissions agent in any directory on any machine a setup names, and
+bypass-permissions agent in any directory on any configured machine, and
 that agent can already read and write every file its user can. The explorer
 is a shorter path to authority the token already holds, not new authority.
 The import rule stands where it is, because there a path was unnecessary and
@@ -82,13 +82,14 @@ writing are fixed scripts; the phone chooses only the path and the bytes.
 Same rule as `POST /sessions/{id}/cwd`, with the same wording, because where
 a relative path would be depends on something the reader cannot see. Every
 listing answers with `pwd -P` of the directory it listed, so the phone
-navigates on a resolved absolute path — the parent is a string operation on
+navigates on a resolved absolute path. The phone also resolves `~` through the
-that, and a `~` the session was spawned with is shown as what it turned out
+same route, then shortens that directory and every path beneath it back to
-to be. The phone never resolves `..` itself.
+tilde notation for display; it never guesses where a local or ssh user's home
 is. The phone never resolves `..` itself.
 ### 5. A read is capped and typed, and every state it can be in has a word
-`GET /setups/{id}/file` answers with one of `text` (content, size, mtime,
+`GET /machines/{id}/file` answers with one of `text` (content, size, mtime,
 sha256), `binary` (not UTF-8; size reported, nothing shown), `tooBig` (over
 `FILE_LIMIT`, 1 MiB; size reported so the reader knows what they are looking
 at), or the machine's own error.
@@ -101,7 +102,7 @@ what it is.
 ### 6. A write is conditional on what the reader saw
-`PUT /setups/{id}/file` carries the sha256 the read reported. The script
+`PUT /machines/{id}/file` carries the sha256 the read reported. The script
 compares it against the file as it is now and exits distinctly if it differs;
 the server answers **409**. Agents edit files while people read them; this is
 the common case, not the exotic one, and silently overwriting an agent's edit
@@ -122,9 +123,9 @@ precondition is fresh without a second read.
 ### 7. Create refuses to overwrite
-`POST /setups/{id}/file` runs under `set -C` (noclobber) and `: > "$1"`, so a
+`POST /machines/{id}/file` runs under `set -C` (noclobber) and `: > "$1"`, so a
 name that exists fails with the shell's own message rather than truncating
-somebody's file; `POST /setups/{id}/dir` is `mkdir --` with the same
+somebody's file; `POST /machines/{id}/dir` is `mkdir --` with the same
 property. The modal names one thing in the current directory and has a switch
 for "directory"; a created file opens straight into edit mode, because an
 empty file is not something to look at.
@@ -208,17 +209,21 @@ absence the signal. Back with unsaved changes asks, and says the edits will
 be lost. The explorer draws over the session, which deliberately has no
 `imePadding`, so the explorer's own box adds it.
-### 10. The explorer draws over the session, and back closes it first
+### 10. The explorer draws over the session, and back follows what is open
 `Screen.Session` in `AppRoot` gains a `files: FilesTarget?`. When set, the
 `FilesScreen` is composed **on top of** the session in the same `Box`, and
 the session stays composed under it: its event stream keeps flowing, its
 scroll position and draft stay where they were, and returning from a file
-costs nothing. Back — the button and the platform gesture — clears `files`
+costs nothing. From an open file, both the header's back button and Android back
-when set and goes to the list otherwise. Inside the explorer the same back
+return to its containing directory. From a directory, the header's back button
-steps one level: editor → viewer (with the unsaved question) → listing →
+clears `files` and returns to the session. Android back instead walks toward the
-parent directory, and only from the starting directory does it close. "Back
+session's project directory: upward to the common ancestor, then down one path
-returns; it does not exit."
+segment per press, and at the project it returns to the session. This makes
 Back from `/etc` visibly travel through `/`, `/home`, and onward to a project
 under `~/repos`, rather than leading away from it. The `..` row remains explicit
 parent navigation. An editor with unsaved changes asks before either route
 discards them. "Back returns; it does not exit."
 Rejected: a `Screen.Files` beside `Screen.Session`. Every route back from a
 leaf screen goes to Main today, and a session disposed and re-created on each
@@ -267,6 +272,18 @@ The speedometer went; the report is a "Copy render timings" row in
 already are. **Moving it is where the no-coordinate-taps rule got enforced**
 (Bryan, 2026-09-03) — see AGENTS.md's "Driving the UI".
 ### 14. File links in a session open in the explorer
 A markdown destination that is an absolute path or a local `file:` URI opens that document in the
 session's explorer, on the session's machine. A trailing editor line and optional column are removed;
 the viewer opens the file but does not yet scroll to a line. Web links, relative links and `file:`
 URIs naming another host keep their ordinary external behaviour. The distinction is deliberately
 narrow: a relative link might be a web reference, and the phone must not silently reinterpret it as
 a path on another machine.
 The markdown link handler is provided around the session rather than taught about machines. That
 keeps the renderer reusable and makes the explorer's existing machine target the one navigation path.
 ## HTTP surface
 In `routes.rs`'s module doc with the rest. Bodies use `deny_unknown_fields`
@@ -1,68 +1,159 @@
 # Subagents
-A session's subagents -- the helpers a Claude Code session starts through its
+A session's subagents -- helpers started by Claude Code's Task tool or Codex's
-Task tool -- each get a transcript of their own, listed under the session's
+collaboration tools -- each get a transcript of their own, listed in a panel
-card and readable in the same transcript view the session has. Designed
+over the open session and readable in the same transcript view the session has.
-2026-09-05; the decisions Bryan has not yet reviewed are in `DECISIONS.md`.
+Designed 2026-09-05; extended to Codex's multiplexed app-server threads on
 2026-09-13. The decisions Bryan has not yet reviewed are in `DECISIONS.md`.
 ## What a subagent is here
 **A subagent is a second transcript owned by a session, in the same event
 model, with no process and no controls.** It is not a session: it cannot be
-messaged, stopped or started, and it has no setup, model or usage of its
+messaged, stopped or started, and it has no machine, model or usage of its
 own. Everything it shares with a session -- the transcript file format, the
 paging routes, the SSE stream, the phone's cache and rendering -- is reused
 by addressing, not by copying.
-The CLI reports a subagent's messages on the parent's own stream-json
+Claude reports a subagent's messages on the parent's own stream-json output,
-output, each carrying `parent_tool_use_id` = the id of the Task `tool_use`
+each carrying `parent_tool_use_id` = the id of the Task `tool_use` that started
-that started it. Before this the translator dropped those lines
+it. Before this the translator dropped those lines
 (`subagent_events_are_not_duplicated_into_the_transcript`); now it routes
 them to that subagent's own translator and transcript. The parent's
 transcript still shows only the Task call itself.
 Codex app-server multiplexes every thread in the session tree onto the root
 process's stdout. Its notifications carry `threadId`; `subAgentActivity`
 items name the child thread and its lifecycle, and `collabAgentToolCall`
 items carry the spawn prompt. The Codex translator routes a non-root
 `threadId` exactly as Claude routes a `parent_tool_use_id`. The child thread
 id is the subagent id on disk. An asynchronously delivered `agentMessage` is
 a `PeerMessage`, not assistant text from the recipient. Its delta notification
 does not repeat the completed item's `delivery` field, so the translator
 remembers that field from `item/started` and suppresses those deltas. Letting
 one into the recipient's provisional assistant row makes its next completed
 message replace the combined row, visibly erasing text that Codex still has.
 The parent draws the initial `spawnAgent` as its ordinary `Task` card and
 closes it when the matching `subAgentActivity.started` arrives. The remaining
 collaboration calls remain visible as coordination -- waiting, messaging,
 listing and lifecycle controls -- rather than being mistaken for generic task
 output. Null optional fields and a bare `completed` status carry no information
 and are omitted; their useful result is the child transcript, status or peer
 message beside them.
 ## Storage
 Under the session directory:
 ```
-<session>/subagents/<tool_use_id>/meta.json        {title, created}
+<session>/subagents/<subagent_id>/meta.json         {title, created}
-<session>/subagents/<tool_use_id>/transcript.jsonl same SeqEvent lines as the session's
+<session>/subagents/<subagent_id>/transcript.jsonl  same SeqEvent lines as the session's
 ```
-The id is the Task tool_use id (`toolu_…`), which is unique, stable across a
+The id is Claude's Task tool_use id (`toolu_…`) or Codex's child thread id.
-backend restart, and already the key everything on the parent side uses.
+Both are unique, stable across a backend restart, and already the key their
 parent-side lifecycle uses.
 Only ids matching `[A-Za-z0-9_-]+` are ever created or looked up, since the
 id becomes a path.
 The transcript's sequence numbers are its own, starting at 1. `Transcript`,
 `read_window`, `catch_up` and `read_after` work on it unchanged.
-Its path out: deleting the session deletes its directory, subagents included.
+Its path out: deleting the session deletes its directory, subagents included,
-There is no separate delete.
+and `POST /sessions/{id}/subagents/delete` removes finished ones on their own
 -- all or nothing, and refused while any named one is still running, since its
 transcript is still being written to and its process is the session's to stop.
 ## Lifecycle, as events in the subagent's transcript
-1. Created on the first child line for an unseen parent id (or, when the
+1. Created when the parent Task/Agent call is seen. A current Claude CLI's
-   parent Task call was seen, at that call). First lines written:
+   `task_started` with `task_type: local_agent` is a recovery source when an
   adopted stream begins after that call. A bare `parent_tool_use_id` is not
   enough: other operations can also parent nested lines, and treating one as
   proof created false subagents named after their first subcommand.
   First lines written:
   `Status Running`, then `UserMessage { text: <the Task's prompt> }` when
   the prompt is known -- it genuinely is the subagent's first user turn.
 2. Every child line is translated by that subagent's own `Translator`
   (one per subagent: tool ids are unique but streaming deltas are by
   content-block index, and parallel subagents interleave).
-3. **The parent's `tool_result` never finishes a subagent.** The Task tool
+3. **What ends a subagent is the CLI's own task lifecycle**, on top-level
-   runs in the background by default: the `tool_result` -- "Async agent
+   `system` lines that carry no `parent_tool_use_id`: `task_started`
-   launched..." -- arrives the moment it *starts*, while the subagent goes
+   (`task_id`, `tool_use_id`, `task_type`, `is_backgrounded`, the prompt),
-   on working for however long its own turn takes, sometimes minutes. What
+   `task_progress` repeatedly, then `task_updated` (`patch.status`, naming the
-   ends it is its own turn ending: the raw API's `message_delta` on its
+   *task* only) and `task_notification` (`tool_use_id`, `status`, and `summary`
-   stream carrying `stop_reason: "end_turn"` (a `stop_reason` of `tool_use`
+   -- the agent's own report). `translate_task` keeps the
-   is the model about to call one, not an end), or a `result` line for its
+   `task_id -> tool_use_id` mapping from the first so the update can be
-   own turn if a future CLI version ever sends one. Either maps to
+   attributed, records the summary as the subagent's closing text, and writes
-   `Status Exited`; the subagent's vocabulary has no `Idle`, so the
+   `Status Exited`. A
-   equivalent event `dispatch` produces for an ordinary session is dropped
+   `completed` update is deliberately not the end: its notification carries
-   rather than written. A shipped version of this finished on the
+   the summary and would otherwise land after the ending. Any other terminal
-   `tool_result` instead, which read a running background agent as
+   status ends it from the update, since the failure to avoid is a subagent
-   "finished" with its transcript truncated at the moment it launched.
+   nothing ever finishes.
   Since Claude Code 2.1.261, `background_tasks_changed { tasks: [...] }` is
   the authoritative level beside those edges: its set replaces the previous
   set, so a missed terminal edge cannot leave a subagent running forever. Its
   ids are deliberately not correlated with the edge stream; what is read off
   each entry is its own description and kind, and what is read off the set is
   whether it is empty and how large. The session API and stream expose that
   size as `backgroundTasks`, which the phone draws beside the status, and
   `GET /sessions/{id}/background` serves the entries themselves -- listed in
   the session's panel *above* the subagents and never as subagent cards. An
   `ambient` entry is excluded from both, on the CLI's own instruction: a
   live-update watcher is not activity. A backgrounded subagent is legitimately
   in both lists, since it is both running and a transcript. The edges still
   carry mapping, outcome and closing summary. On adoption the driver sends a repeated `initialize`,
   which makes a current CLI send the full set; an older CLI accepts it and sends no level,
   leaving the edge-based path unchanged. A snapshot is reconciled immediately
   when the persisted parent status proves it is between turns, and otherwise
   at the next `result` boundary -- while a turn is open, a foreground agent is
   legitimately absent from the background set. Reconciliation writes
   `Status Exited`, which is also what makes a formerly stale row deletable;
   a task notification ordered after the level can still add its summary.
   The two rules this replaces were both wrong, in opposite directions. The
   parent's `tool_result` is not it: a backgrounded Task's arrives at launch
   ("Async agent launched..."), so ending there truncated a running agent's
   transcript at the moment it started. Nor is the subagent's own
   `end_turn`: measured against 2.1.237 on 2026-09-06, **a subagent's lines
   carry no `stream_event` at all** -- they are whole `user`/`assistant`
   lines with a null `stop_reason`, no `result` line is sent for one, and the
   sub's final report never appears as a child line -- so that rule could
   never fire and every subagent stayed `running` for ever. `ends_a_turn` is
   kept as a second detector for a dialect that does say either, and must
   never be the only one again.
   `Status Exited` either way; the subagent's vocabulary has no `Idle` or
   `Waiting`, so the end-of-turn status `dispatch` produces for an ordinary
   session is dropped rather than written.
   **The ending reaches the parent's transcript as nothing at all**
   (2026-09-06). It was tried, and a row per finished subagent is a screenful
   of dividers about work the reader was not asking after; the closing report
   is *this* transcript's last line and here is where somebody reads it. What
   the parent gets a row for is a message a subagent genuinely sends it, which
   arrives by the peer path. A backgrounded *command* is the other half of
   this and goes the other way: it has no transcript of its own, so its report
   updates the tool card that launched it, which was still saying the command
   was running. The two lifecycle shapes are still handled once:
   whichever gets there first is the one that finds the task still open, and
   `finish` below closes it. See PLAN.md's "Two turns must never be drawn as
   one".
   **While any task is outstanding the session's turn ends in
   `Status Waiting` rather than `Idle`.** `Idle` means "waiting for a person",
   and a session with a backgrounded subagent is not doing that. The edge
   fallback has two sources: the translator's `open_tasks`, and
   `Subagents::any_open` -- which covers a subagent launched before a backend
   restart adopted the session, whose `task_started` is behind the durable
   stdout offset. On current Claude versions the replace-semantics level above
   reconciles both at a safe turn boundary.
   **A limit the account hits inside a subagent is hoisted to the session**
   as well as recorded here, because `resume.rs` can only schedule against a
   session, and a background subagent outliving its parent's turn is the
   ordinary case -- see PLAN.md's "A limit a subagent hits is the session's".
 4. **A child line for a subagent that already finished reopens it**
   (`Status Running`) rather than being dropped: a background Task can be
   sent another message long after its first turn ended, and that is
@@ -70,7 +161,27 @@ There is no separate delete.
   `Translator`, just picking back up.
 5. When the parent session's process exits (`Status Exited` on the
   session), every subagent still `Running` gets `Status Exited` too: its
-   process was the parent's.
+   process was the parent's. Read from the directory rather than from the
   live map, because one left `Running` by a previous run of the server is
   precisely the one nothing in this process has touched -- and it would
   otherwise read `running` again every time its session was started.
 For Codex the same lifecycle is expressed by app-server rather than Claude's
 task notices: `subAgentActivity.started` creates the child,
 `subAgentActivity.interacted` reopens it, and `completed` or `interrupted`
 finishes it. A child's own `turn/completed` is not its end; it remains running
 until that activity edge. The root's `turn/completed` reports `waiting` while
 the registry contains an open child, and the last activity completion reports
 `idle` if the root is between turns. Because the child thread id is also the
 on-disk id, an adopted driver can route and finish a child whose spawn record
 is already behind the durable stdout offset. The registry's open count is also
 Codex's `backgroundTasks` measurement: lifecycle changes send it through the
 same event and session-summary fields as Claude's provider snapshot. The other
 part of that measurement is app-server's runtime
 `thread/backgroundTerminals/list` set. Its process ids are held only in memory
 and added to the open-child count; the driver refreshes the set at terminal
 boundaries and while it remains nonempty, rather than decrementing for an
 unmatched ending edge.
 A subagent that was mid-flight when the backend restarted keeps working:
 the registry reopens the existing transcript on the next child line, and
@@ -80,27 +191,34 @@ the backend was down nothing recorded that until the next line arrives, so
 its last status stays `Running`, which the list reports as **unknown**
 rather than as running (see the wire shape) until then.
-Title: the Task call's `description` input, then ` (<subagent_type>)` when
+Title: for Claude, the Task call's `description` input, then
-one is given; falling back to the tool's name when the child arrives before
+` (<subagent_type>)` when one is given; falling back to `Task` when the
-(or without) the parent call being seen.
+description is absent. An adopted current CLI can recover the same fields from
 its `local_agent` lifecycle record. For Codex, the first lifecycle record uses
 the spawned thread's name or the last segment of `agentPath`, with underscores
 shown as spaces, then falls back to `subagent`.
 ## Server layout
 - `session/subagent.rs` -- the registry: `Subagents` (per session, in
  `Shared`), `Subagent` (its `Transcript` behind a mutex plus a
  `broadcast::Sender<SeqEvent>`), `record(id, event)`, `start(id, title,
-  prompt)`, `finish(id)`, `reopen(id)`, `finish_all()`, `list()` from disk. Drivers get an
+  prompt)`, `finish(id)`, `reopen(id)`, `finish_all()`, `list()` from disk, and
  `delete(ids)` -- its path out. Drivers get an
  `Arc<Subagents>` beside their `EventSink`; llama ignores it.
 - `session/claude/translate.rs` -- routes child lines by parent id, holds
  one child `Translator` per subagent, remembers pending Task calls'
  description/prompt/subagent_type.
 - `session/codex/translate.rs` -- routes multiplexed app-server notifications
  by thread id, remembers collaboration prompts, and translates activity
  edges into the same registry lifecycle.
 - `session/echo.rs` -- `/subagent [n]`: the test rig. Starts *n* (default 1)
  subagents at once, each named "helper k". Each writes the prompt as its
  user message, streams a few words of text, runs one `Bash` tool call, then
  finishes about three seconds after starting, and the parent's Task calls
  end when their subagent does. Three seconds so the running state can be
  seen on the phone.
- `routes.rs` -- three routes, in the doc table.
+- `routes.rs` -- four routes, in the doc table.
 ## Wire shape
@@ -110,11 +228,23 @@ GET /sessions                            same field on each row
 GET /sessions/{id}/subagents             [{id, title, status, created, lastActivity}], oldest first
 GET /sessions/{id}/subagents/{sub}/transcript   exactly the session transcript's query and answer
 GET /sessions/{id}/subagents/{sub}/events?after=N  exactly the session events stream
 POST /sessions/{id}/subagents/delete     {subagents} -> 204; refused whole if one is running
 ```
 The delete is a batch rather than a `DELETE` per id for the reason the import
 list's is: the phone deletes what a reader selected, and one request per row
 means a batch can half-arrive, leaving the rows that were missed looking
 exactly like rows nobody picked. Unlike an import delete it is local file
 removal, so it is done by the time the reply is sent and there is no per-row
 state to follow afterwards. What decides "running" is
 `Subagents::list`'s own rule, shared through `routes::has_a_process` so the
 list and the delete cannot disagree about it.
 `status` is the transcript's last `Status` event, serialised like a session's
 (`running`, `exited`), except that a subagent whose session is not itself
-running cannot be running: the list answers `unknown` for that one. The
+running cannot be running: the list answers `unknown` for that one. A
 subagent never reports `waiting`: that is a session's word for having
 outstanding work of its own, and a subagent has none. The
 phone words these as *running*, *finished* and *unknown* on the subcard.
 The count on `SessionInfo` is a directory listing, so the list stays cheap.
@@ -122,19 +252,37 @@ The per-subagent status is only read when the list route is asked for.
 ## Phone
- `SessionSummary.subagents: Int`. A card with a non-zero count ends in an
+- The subcards are ordered **still running first, then most recently
-  expander row -- a full-width `Chevron(Pointing.Down)` row that flips to
+  active** -- a display decision made on the phone (`subagentOrder`), over the
-  `Pointing.Up` -- collapsed by default. Expanding fetches
+  server's stable oldest-first answer. Two keys rather than activity alone
-  `/sessions/{id}/subagents` and draws one `OutlinedCard` per subagent,
+  because a subagent that is thinking reports nothing meanwhile and would sink
-  indented inside the session card, the way dev-updater draws a project's
+  below one that just finished.
-  components: title, then the status word and a relative time. The
+- **Holding a subcard selects it, and several at a time**, exactly as the
-  expansion state is per session id and survives a refresh of the list.
+  import list works, with the selection bar drawn inside the panel rather than
- Tapping a subcard opens `Screen.Subagent`, which is `SessionScreen` in
+  at the bottom of the session: this selection belongs to the subagent list,
-  **read-only** form: the same transcript, paging, cache, selection,
+  and a bar under the composer would read as acting on the conversation.
  Delete is
  *disabled*, with the reason in words, while anything selected is still
  running. Deleting confirms first, dims the rows it is acting on
  (`BusyItem`), and on success takes them out of the panel without refetching
  anything else. The phone's cached copy of
  a deleted subagent's transcript is purged with it.
 - The main session list does not expand or count subagents. Swiping left over
  an open session pulls an 88%-wide panel in from the right and fetches
  `/sessions/{id}/subagents`; it draws one `OutlinedCard` per subagent: title,
  then the status word and a relative time. The transcript remains composed
  under the panel, so its event stream, draft and scroll position stay live.
  Horizontal scrollers inside the transcript win the gesture. Collapsing one,
  or starting over any ordinary part of the session, gives the gesture back to
  the panel; Android keeps its own edge Back gesture. Swiping right on the
  panel, tapping outside it, or Back closes it.
 - Tapping a subcard opens a `SessionScreen` layer in **read-only** form: the
  same transcript, paging, cache, selection,
  images and status row, with the composer, the process button, the model
  picker, the files button, the settings cog and the usage bar left out.
-  The header shows the subagent's title with the session's title beneath
+  The header shows the subagent's title with the session's title beneath it.
-  it. Back returns to the list.
+  It is another layer over the still-composed session and its panel; Back
  returns to the panel.
 - Addressing: `fetchTranscript`, `EventStream`, `TranscriptSource` and the
  cache take a transcript address rather than a session id --
  `sessions/{id}` or `sessions/{id}/subagents/{sub}` -- so the cache nests a
@@ -5,6 +5,10 @@ one in place when it turns out to need a decision.
 ## App — transcript
 - [ ] Decide how running background tasks can be inspected. For now the session
      status shows only the provider-reported count; command details stay in
      their existing tool cards and must not become subagent cards.
 - [ ] Messages received from other agents are inconsistent — sometimes they
      appear, sometimes they don't. **Needs a rig.** Read the code rather than
      measured: a live Claude session only learns of a peer message from the
@@ -33,3 +37,21 @@ one in place when it turns out to need a decision.
      that would work today, for Claude sessions, and it is the option that was
      not chosen.
 ## A session the server could not load
 - [ ] **A session whose transcript will not parse is skipped with nothing but a
      log line, and from the phone it looks exactly like an idle unresponsive
      one.** `SessionManager::new` catches a failing `launch` and logs
      "couldn't relaunch session <id>", so the session has no pump and no
      driver: no status, no history, nothing sendable. That is what the
      `taskNote` incident (fd71d87) looked like from Bryan's phone, and why it
      needed a report from him rather than being visible in the app.
      `Event::Unreadable` removes the cause that time, but not the class — an
      unreadable `process.json`, a provider edited away and an unreachable host
      all reach the same place.
      This is the "design the unknown state first" rule: a session the server
      could not load is not a session with nothing to say, and only the phone
      can show the difference. It needs a status the wire can carry for it —
      the failure with its reason, reported on the session itself — rather than
      the reader having to tell it apart from silence.
@@ -1,36 +0,0 @@
 [package]
 name = "android-shell"
 version = "0.1.0"
 edition = "2024"
 # The JNI bridge behind E3's two Java stub classes (`MainActivity`,
 # `NotificationService` -- see RUST.md's "How much Java is unavoidable" for
 # why those two classes cannot be anything but Java/Kotlin, registered from
 # the manifest by name). Everything they would otherwise have done in
 # Kotlin -- the SSE follow loop, deciding where a notification is shown,
 # picking a session for a share -- is here instead, built on `client-core`
 # so the networking and parsing are not duplicated a third time next to the
 # server and the Kotlin app.
 #
 # `cdylib` for `System.loadLibrary`; `lib` too so `cargo test`/`clippy` run
 # on a normal host target without an Android NDK toolchain, the same
 # posture `client-core` and `server` already have.
 [lib]
 name = "android_shell"
 crate-type = ["cdylib", "lib"]
 [dependencies]
 client-core = { path = "../client-core" }
 jni = "0.22"
 log = "0.4"
 # `LogErrorAndDefault` (the `native_method!` error policy this crate uses
 # throughout, see lib.rs) logs through the `log` facade, which is a no-op
 # without a backend installed -- so without this, every recoverable error
 # at a native entry point would be silently dropped rather than reaching
 # logcat. Android-only: nothing else here needs it, and it does not build
 # off-device (see `notify::ensure_logger`'s call site, the only place this
 # is used).
 [target.'cfg(target_os = "android")'.dependencies]
 android_logger = "0.15"
@@ -1,152 +0,0 @@
 //! Thin wrappers around the five `Env` calls this crate makes constantly
 //! (a class name, a method name and a signature, all as plain `&str`).
 //!
 //! `jni` 0.22 wants a class or method *name* as `AsRef<JNIStr>` (its own
 //! modified-UTF-8 type; `JNIString::new` is the runtime conversion, used
 //! here uniformly rather than switching to the compile-time `jni_str!`
 //! literal macro call by call -- these are a handful of short, one-off
 //! lookups, not a hot loop, so the difference is not worth two code paths
 //! for the same thing) and a *signature* as a parsed `MethodSignature`/
 //! `FieldSignature`, which is why those go through
 //! `RuntimeMethodSignature`/`RuntimeFieldSignature::from_str` instead: the
 //! parsed form is what lets these calls skip re-validating the signature
 //! against the arguments on every call, which is the whole reason `jni`
 //! moved to it.
 //!
 //! **The classloader gotcha, found by testing (2026-09-05).** A class
 //! lookup by name (`find_class`, `new_object`, `call_static_method`,
 //! `get_static_field` -- anything that resolves a *class*, as opposed to
 //! `call_method` on an object it already has, which needs no such lookup)
 //! defaults to `FindClass`'s ordinary search when it cannot find the
 //! calling thread a classloader through `Thread.getContextClassLoader()`.
 //! That default is fine on a thread the JVM itself started -- an
 //! `onCreate`/`onStartCommand` callback -- but every one of these calls
 //! from `android-shell`'s own background thread (the notification
 //! follow-loop, the share upload) is running on a thread *Rust* spawned
 //! and attached with `JavaVM::attach_current_thread`, which the platform
 //! never gave an app classloader. Framework classes
 //! (`android.app.Notification$Builder`, ...) still resolve, because they
 //! are reachable from the bootstrap loader `FindClass` falls back to --
 //! `androidx.core.app.NotificationManagerCompat` is not, since it is
 //! packaged inside this app's own APK. The failure was
 //! `Error::NoClassDefFound`, logged by `notify::show`'s `LogErrorAndDefault`
 //! as "failed to resolve Java class ... (class not found or linkage
 //! error)" -- on a real device this reads as "the notification silently
 //! never arrives," since the whole call is inside the follow loop and the
 //! ongoing foreground notification (built on the main thread, in
 //! `try_start`, before the background thread exists) posts fine either
 //! way. `remember_class_loader` caches the app's own `ClassLoader` the
 //! first time any entry point has a `Context` to ask, and every class
 //! lookup below goes through it explicitly via `LoaderContext::Loader`
 //! rather than the thread-dependent default -- so it is correct on the
 //! main thread and on this crate's own background threads alike.
 use jni::Env;
 use jni::errors::Result;
 use jni::objects::{JClass, JClassLoader, JObject, JValue, JValueOwned};
 use jni::refs::{Global, LoaderContext};
 use jni::signature::{RuntimeFieldSignature, RuntimeMethodSignature};
 use jni::strings::JNIString;
 use std::sync::OnceLock;
 static CLASS_LOADER: OnceLock<Global<JClassLoader<'static>>> = OnceLock::new();
 /// Caches `context`'s own `ClassLoader`, the first time this is called.
 /// Cheap to call from every entry point that has a `Context` on hand
 /// (`MainActivity`'s and `NotificationService`'s all do): later calls are
 /// a `OnceLock::get` and nothing else.
 pub fn remember_class_loader(env: &mut Env, context: &JObject) -> Result<()> {
    if CLASS_LOADER.get().is_some() {
        return Ok(());
    }
    // context.getClass().getClassLoader() -- resolved via `call_method` on
    // real objects throughout, so this needs no class-name lookup of its
    // own and has nothing to bootstrap.
    let class_obj = call_method(env, context, "getClass", "()Ljava/lang/Class;", &[])?.l()?;
    let loader_obj = call_method(
        env,
        &class_obj,
        "getClassLoader",
        "()Ljava/lang/ClassLoader;",
        &[],
    )?
    .l()?;
    let loader = env.cast_local::<JClassLoader>(loader_obj)?;
    let global = env.new_global_ref(&loader)?;
    // Lost the race with another entry point calling this concurrently --
    // both loaders name the same app, so either one is fine and there is
    // nothing to reconcile.
    let _ = CLASS_LOADER.set(global);
    Ok(())
 }
 /// Resolves `name` (slash-separated, e.g. `androidx/core/app/NotificationCompat`)
 /// through the cached app classloader when one has been remembered, and
 /// through the ordinary default otherwise -- which is every call made
 /// before any entry point has run, and is also correct for a main-thread
 /// caller, so there is no case this makes worse.
 fn resolve_class<'local>(env: &mut Env<'local>, name: &str) -> Result<JClass<'local>> {
    match CLASS_LOADER.get() {
        Some(loader) => {
            let binary_name = name.replace('/', ".");
            LoaderContext::Loader(loader).load_class(env, JNIString::new(&binary_name), true)
        }
        None => env.find_class(JNIString::new(name)),
    }
 }
 pub fn find_class<'local>(env: &mut Env<'local>, name: &str) -> Result<JClass<'local>> {
    resolve_class(env, name)
 }
 /// A new Java string as a plain `JObject` -- what every call site here
 /// wants it as (`JValue::Object` takes `&JObject`, not `&JString`, and
 /// `JString: Into<JObject>` is the documented way across).
 pub fn jstr_obj<'local>(env: &mut Env<'local>, text: impl AsRef<str>) -> Result<JObject<'local>> {
    Ok(env.new_string(text)?.into())
 }
 pub fn new_object<'local>(
    env: &mut Env<'local>,
    class: &str,
    sig: &str,
    args: &[JValue],
 ) -> Result<JObject<'local>> {
    let sig = RuntimeMethodSignature::from_str(sig)?;
    let class = resolve_class(env, class)?;
    env.new_object(class, sig.method_signature(), args)
 }
 pub fn call_method<'local>(
    env: &mut Env<'local>,
    obj: &JObject,
    method: &str,
    sig: &str,
    args: &[JValue],
 ) -> Result<JValueOwned<'local>> {
    let sig = RuntimeMethodSignature::from_str(sig)?;
    env.call_method(obj, JNIString::new(method), sig.method_signature(), args)
 }
 pub fn call_static_method<'local>(
    env: &mut Env<'local>,
    class: &str,
    method: &str,
    sig: &str,
    args: &[JValue],
 ) -> Result<JValueOwned<'local>> {
    let sig = RuntimeMethodSignature::from_str(sig)?;
    let class = resolve_class(env, class)?;
    env.call_static_method(class, JNIString::new(method), sig.method_signature(), args)
 }
 pub fn get_static_field<'local>(
    env: &mut Env<'local>,
    class: &str,
    field: &str,
    sig: &str,
 ) -> Result<JValueOwned<'local>> {
    let sig = RuntimeFieldSignature::from_str(sig)?;
    let class = resolve_class(env, class)?;
    env.get_static_field(class, JNIString::new(field), sig.field_signature())
 }
@@ -1,131 +0,0 @@
 //! The JNI bridge behind E3's two Java stub classes. See `Cargo.toml`'s
 //! package comment for what this crate is and RUST.md's E3 entry for the
 //! design decisions.
 //!
 //! Each native method is declared with `jni`'s [`native_method!`] macro
 //! rather than a hand-written `#[no_mangle] extern "system" fn Java_...`:
 //! the macro derives the mangled export name and the JNI signature from the
 //! Rust function itself, so the two cannot drift apart the way a
 //! hand-typed name string and a hand-typed `"(Landroid/...;)V"` signature
 //! routinely do. `error_policy = LogErrorAndDefault` matches
 //! `Notifications.kt`'s own posture: a failure here (a lost connection, a
 //! JNI call that threw) is reported to logcat, not thrown back into Java
 //! as an exception that would crash the app over something recoverable.
 //!
 //! Each `const _: NativeMethod = native_method! { ... };` binding is
 //! otherwise unused by name -- `_` is the idiomatic way to keep a
 //! side-effecting const (here, generating the `#[export_name]`d function
 //! the JVM resolves by the JNI naming convention) without a `dead_code`
 //! warning for a binding nothing reads.
 mod jcall;
 mod notify;
 mod settings;
 mod share;
 use jni::errors::LogErrorAndDefault;
 use jni::objects::{JClass, JObject};
 use jni::sys::jint;
 use jni::{Env, NativeMethod, native_method};
 /// Installs the `log` backend that routes to logcat, once per process.
 /// Without it, `LogErrorAndDefault` (every native method below) and any
 /// `log::error!` inside `jni` itself (e.g. `JString`'s `Display` fallback)
 /// call into the `log` facade's default no-op logger, and a real failure
 /// vanishes with nothing on logcat to say so -- silently *more* wrong than
 /// crashing, since nothing on screen or in the log says a notification was
 /// dropped. Called from every entry point below rather than a Java-side
 /// `Application.onCreate`, since this crate deliberately has no such class
 /// to hook (see RUST.md's E3 entry on the two-Java-classes floor).
 fn ensure_logger() {
    static ONCE: std::sync::Once = std::sync::Once::new();
    ONCE.call_once(|| {
        #[cfg(target_os = "android")]
        android_logger::init_once(
            android_logger::Config::default()
                .with_max_level(log::LevelFilter::Debug)
                .with_tag("android-shell"),
        );
    });
 }
 // The parameters are spelled as their Java types, not as `JObject`: the
 // macro encodes each argument into the exported symbol's JNI signature
 // (and JNI resolves `Java_...` names *by* that signature), so a generic
 // `JObject` here would export `(Ljava/lang/Object;...)` against a Java
 // method actually declared `(Landroid/app/Activity;...)` -- two different
 // symbols that never resolve to each other, silently, with no compiler
 // error on either side. `android.app.Activity` etc. have no dedicated
 // Rust wrapper in this crate, so they fall back to plain `JObject` in the
 // implementation functions below (the "Built-in Types" note in
 // `native_method!`'s docs).
 const _: NativeMethod = native_method! {
    java_type = "com.example.aiapp.shell.MainActivity",
    static extern fn native_handle_intent(activity: android.app.Activity, intent: android.content.Intent) -> (),
    error_policy = LogErrorAndDefault,
 };
 /// `MainActivity.nativeHandleIntent` -- called from `onCreate` and
 /// `onNewIntent`. See `share::handle_intent` for what an intent can mean.
 fn native_handle_intent<'local>(
    env: &mut Env<'local>,
    _class: JClass<'local>,
    activity: JObject<'local>,
    intent: JObject<'local>,
 ) -> Result<(), jni::errors::Error> {
    ensure_logger();
    jcall::remember_class_loader(env, &activity)?;
    share::handle_intent(env, &activity, &intent)
 }
 const _: NativeMethod = native_method! {
    java_type = "com.example.aiapp.shell.NotificationService",
    static extern fn native_sync(context: android.content.Context) -> (),
    error_policy = LogErrorAndDefault,
 };
 /// `NotificationService.nativeSync` -- called both from `MainActivity` (an
 /// enrollment may have just landed) and from `NotificationService.sync`
 /// itself. See `notify::sync`.
 fn native_sync<'local>(
    env: &mut Env<'local>,
    _class: JClass<'local>,
    context: JObject<'local>,
 ) -> Result<(), jni::errors::Error> {
    ensure_logger();
    jcall::remember_class_loader(env, &context)?;
    notify::sync(env, &context)
 }
 const _: NativeMethod = native_method! {
    java_type = "com.example.aiapp.shell.NotificationService",
    static extern fn native_on_start_command(service: android.app.Service) -> jint,
    error_policy = LogErrorAndDefault,
 };
 /// `NotificationService.nativeOnStartCommand`. See `notify::on_start_command`.
 fn native_on_start_command<'local>(
    env: &mut Env<'local>,
    _class: JClass<'local>,
    service: JObject<'local>,
 ) -> Result<jint, jni::errors::Error> {
    ensure_logger();
    jcall::remember_class_loader(env, &service)?;
    Ok(notify::on_start_command(env, service))
 }
 const _: NativeMethod = native_method! {
    java_type = "com.example.aiapp.shell.NotificationService",
    static extern fn native_on_destroy() -> (),
    error_policy = LogErrorAndDefault,
 };
 /// `NotificationService.nativeOnDestroy`. See `notify::on_destroy`.
 fn native_on_destroy<'local>(
    _env: &mut Env<'local>,
    _class: JClass<'local>,
 ) -> Result<(), jni::errors::Error> {
    ensure_logger();
    notify::on_destroy();
    Ok(())
 }
@@ -1,556 +0,0 @@
 //! Where a notification is said, and the foreground service that keeps
 //! the connection open while the app is closed. Ported from
 //! `Notifications.kt`'s `NotificationService`, minus the "session on
 //! screen" / "hand to the app as a banner" branches: those read
 //! process-wide state that only exists because a screen is drawn to
 //! register against, and this experiment draws no screen yet (that is
 //! E4's job, on iris). So every notification here takes the third branch
 //! Kotlin's `show` already had -- the platform's own drawer -- which is
 //! also exactly the case E3's pass condition asks for: **a notification
 //! arrives with the app closed.**
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::time::Duration;
 use client_core::api::UreqTransport;
 use client_core::notifications::{SessionNotification, follow_notifications};
 use jni::Env;
 use jni::errors::Result;
 use jni::objects::{JObject, JValue};
 use jni::sys::{JNI_TRUE, jint};
 use crate::settings::{self, ServerSettings};
 const ALERT_CHANNEL: &str = "sessions";
 const ONGOING_CHANNEL: &str = "connection";
 const ONGOING_ID: i32 = 1;
 const ALERT_ID: i32 = 2;
 /// Same backoff as `Notifications.kt`'s `RECONNECT_DELAY_MS`.
 const RECONNECT_DELAY: Duration = Duration::from_millis(5_000);
 /// Whether the follow-loop thread is already running. **A deviation from
 /// `Notifications.kt`, found by testing rather than planned**: the Kotlin
 /// `onStartCommand` spawns a fresh `thread(isDaemon = true) { follow(...) }`
 /// on *every* call, with nothing to notice a previous one is still going --
 /// and `sync()` calling `startForegroundService` when the service is
 /// already running is an ordinary Android start, not a restart, so
 /// `onStartCommand` runs again. Enrolling from `MainActivity` (which calls
 /// `sync` once itself, then again inside `handle_enrollment` after saving
 /// the token) hits exactly this path and was observed opening **two**
 /// concurrent connections to `/notifications` from one process -- caught
 /// on this build via `adb logcat` showing two `jni::vm::java_vm: Attached
 /// thread ai-app-notifications` lines for one enrollment. Guarded here
 /// rather than left to match Kotlin's behaviour exactly, since duplicating
 /// a live connection is a resource leak with no upside; worth carrying the
 /// same guard back to `Notifications.kt` separately.
 static RUNNING: AtomicBool = AtomicBool::new(false);
 /// Set by `nativeOnDestroy`, checked by the follow loop between
 /// reconnects. **Known gap, recorded rather than hidden**: unlike
 /// `HttpURLConnection.disconnect()` in the Kotlin original, nothing here
 /// can interrupt a `ureq` read already blocked inside one connection --
 /// `Transport::stream` hands back a plain `Read` with no cancellation
 /// handle. So a stop lands at the next reconnect, not mid-read. `/notifications`
 /// is idle between events (a keep-alive, per `server/src/routes.rs`), so in
 /// practice this is a bounded wait rather than a hang; closing that gap
 /// for real means adding a cancellation point to `client_core::Transport`,
 /// which is a decision affecting every caller of that trait, not just this
 /// one -- left for whoever next depends on prompt shutdown.
 static STOPPING: AtomicBool = AtomicBool::new(false);
 fn static_int(env: &mut Env, class: &str, field: &str) -> Result<i32> {
    crate::jcall::get_static_field(env, class, field, "I")?.i()
 }
 fn notification_manager<'l>(env: &mut Env<'l>, context: &JObject) -> Result<JObject<'l>> {
    crate::jcall::call_static_method(
        env,
        "androidx/core/app/NotificationManagerCompat",
        "from",
        "(Landroid/content/Context;)Landroidx/core/app/NotificationManagerCompat;",
        &[JValue::Object(context)],
    )?
    .l()
 }
 fn create_channel(
    env: &mut Env,
    manager: &JObject,
    id: &str,
    name: &str,
    importance: i32,
 ) -> Result<()> {
    let id_j = crate::jcall::jstr_obj(env, id)?;
    let builder = crate::jcall::new_object(
        env,
        "androidx/core/app/NotificationChannelCompat$Builder",
        "(Ljava/lang/String;I)V",
        &[JValue::Object(&id_j), JValue::Int(importance)],
    )?;
    let name_j = crate::jcall::jstr_obj(env, name)?;
    crate::jcall::call_method(
        env,
        &builder,
        "setName",
        "(Ljava/lang/CharSequence;)Landroidx/core/app/NotificationChannelCompat$Builder;",
        &[JValue::Object(&name_j)],
    )?;
    let channel = crate::jcall::call_method(
        env,
        &builder,
        "build",
        "()Landroidx/core/app/NotificationChannelCompat;",
        &[],
    )?
    .l()?;
    crate::jcall::call_method(
        env,
        manager,
        "createNotificationChannel",
        "(Landroidx/core/app/NotificationChannelCompat;)V",
        &[JValue::Object(&channel)],
    )?;
    Ok(())
 }
 /// Two channels, because they are two different things to be told -- see
 /// `Notifications.kt`'s `createChannels` for the reasoning; the names and
 /// importances here are copied from it exactly, since a phone that has
 /// seen both apps should not learn two different vocabularies for the
 /// same fact.
 fn create_channels(env: &mut Env, context: &JObject) -> Result<()> {
    let manager = notification_manager(env, context)?;
    let default = static_int(
        env,
        "androidx/core/app/NotificationManagerCompat",
        "IMPORTANCE_DEFAULT",
    )?;
    let min = static_int(
        env,
        "androidx/core/app/NotificationManagerCompat",
        "IMPORTANCE_MIN",
    )?;
    create_channel(
        env,
        &manager,
        ALERT_CHANNEL,
        "Sessions needing attention",
        default,
    )?;
    create_channel(env, &manager, ONGOING_CHANNEL, "Staying connected", min)?;
    Ok(())
 }
 fn new_intent_for<'l>(
    env: &mut Env<'l>,
    context: &JObject,
    class_name: &str,
 ) -> Result<JObject<'l>> {
    let target_class = crate::jcall::find_class(env, class_name)?;
    crate::jcall::new_object(
        env,
        "android/content/Intent",
        "(Landroid/content/Context;Ljava/lang/Class;)V",
        &[JValue::Object(context), JValue::Object(&target_class)],
    )
 }
 /// The intent a tap on an alert opens -- mirrors `Notifications.kt`'s
 /// `sessionIntent`, including building the URI through `Uri.Builder`
 /// rather than string concatenation, for the same reason: an id needing
 /// escaping must survive the round trip.
 fn session_intent<'l>(
    env: &mut Env<'l>,
    context: &JObject,
    session_id: &str,
 ) -> Result<JObject<'l>> {
    let intent = new_intent_for(env, context, "com/example/aiapp/shell/MainActivity")?;
    let action_view = crate::jcall::jstr_obj(env, "android.intent.action.VIEW")?;
    crate::jcall::call_method(
        env,
        &intent,
        "setAction",
        "(Ljava/lang/String;)Landroid/content/Intent;",
        &[JValue::Object(&action_view)],
    )?;
    let builder = crate::jcall::new_object(env, "android/net/Uri$Builder", "()V", &[])?;
    let scheme = crate::jcall::jstr_obj(env, settings::SCHEME)?;
    crate::jcall::call_method(
        env,
        &builder,
        "scheme",
        "(Ljava/lang/String;)Landroid/net/Uri$Builder;",
        &[JValue::Object(&scheme)],
    )?;
    let authority = crate::jcall::jstr_obj(env, "session")?;
    crate::jcall::call_method(
        env,
        &builder,
        "authority",
        "(Ljava/lang/String;)Landroid/net/Uri$Builder;",
        &[JValue::Object(&authority)],
    )?;
    let path = crate::jcall::jstr_obj(env, session_id)?;
    crate::jcall::call_method(
        env,
        &builder,
        "appendPath",
        "(Ljava/lang/String;)Landroid/net/Uri$Builder;",
        &[JValue::Object(&path)],
    )?;
    let uri = crate::jcall::call_method(env, &builder, "build", "()Landroid/net/Uri;", &[])?.l()?;
    crate::jcall::call_method(
        env,
        &intent,
        "setData",
        "(Landroid/net/Uri;)Landroid/content/Intent;",
        &[JValue::Object(&uri)],
    )?;
    Ok(intent)
 }
 fn pending_activity<'l>(
    env: &mut Env<'l>,
    context: &JObject,
    intent: &JObject,
 ) -> Result<JObject<'l>> {
    let update_current = static_int(env, "android/app/PendingIntent", "FLAG_UPDATE_CURRENT")?;
    let immutable = static_int(env, "android/app/PendingIntent", "FLAG_IMMUTABLE")?;
    crate::jcall::call_static_method(
        env,
        "android/app/PendingIntent",
        "getActivity",
        "(Landroid/content/Context;ILandroid/content/Intent;I)Landroid/app/PendingIntent;",
        &[
            JValue::Object(context),
            JValue::Int(0),
            JValue::Object(intent),
            JValue::Int(update_current | immutable),
        ],
    )?
    .l()
 }
 fn builder_call<'l>(
    env: &mut Env<'l>,
    builder: &JObject<'l>,
    method: &str,
    sig: &str,
    args: &[JValue],
 ) -> Result<()> {
    crate::jcall::call_method(env, builder, method, sig, args)?;
    Ok(())
 }
 /// The type Android 14+ requires a foreground service to declare, and
 /// nothing before it -- mirrors `Notifications.kt`'s `foregroundType`.
 fn foreground_type(env: &mut Env) -> Result<i32> {
    let sdk = static_int(env, "android/os/Build$VERSION", "SDK_INT")?;
    let upside_down_cake = static_int(env, "android/os/Build$VERSION_CODES", "UPSIDE_DOWN_CAKE")?;
    if sdk >= upside_down_cake {
        static_int(
            env,
            "android/content/pm/ServiceInfo",
            "FOREGROUND_SERVICE_TYPE_SPECIAL_USE",
        )
    } else {
        Ok(0)
    }
 }
 fn ongoing_notification<'l>(env: &mut Env<'l>, context: &JObject) -> Result<JObject<'l>> {
    let channel = crate::jcall::jstr_obj(env, ONGOING_CHANNEL)?;
    let builder = crate::jcall::new_object(
        env,
        "androidx/core/app/NotificationCompat$Builder",
        "(Landroid/content/Context;Ljava/lang/String;)V",
        &[JValue::Object(context), JValue::Object(&channel)],
    )?;
    let title = crate::jcall::jstr_obj(env, "Watching for sessions that need you")?;
    builder_call(
        env,
        &builder,
        "setContentTitle",
        "(Ljava/lang/CharSequence;)Landroidx/core/app/NotificationCompat$Builder;",
        &[JValue::Object(&title)],
    )?;
    let icon = static_int(env, "android/R$drawable", "stat_notify_sync")?;
    builder_call(
        env,
        &builder,
        "setSmallIcon",
        "(I)Landroidx/core/app/NotificationCompat$Builder;",
        &[JValue::Int(icon)],
    )?;
    builder_call(
        env,
        &builder,
        "setOngoing",
        "(Z)Landroidx/core/app/NotificationCompat$Builder;",
        &[JValue::Bool(JNI_TRUE)],
    )?;
    let priority_min = static_int(env, "androidx/core/app/NotificationCompat", "PRIORITY_MIN")?;
    builder_call(
        env,
        &builder,
        "setPriority",
        "(I)Landroidx/core/app/NotificationCompat$Builder;",
        &[JValue::Int(priority_min)],
    )?;
    crate::jcall::call_method(env, &builder, "build", "()Landroid/app/Notification;", &[])?.l()
 }
 /// Starts the service if there is a server to connect to, and stops it
 /// otherwise -- mirrors `Notifications.kt`'s `NotificationService.sync`.
 pub fn sync(env: &mut Env, context: &JObject) -> Result<()> {
    let service_intent =
        new_intent_for(env, context, "com/example/aiapp/shell/NotificationService")?;
    if settings::load(env, context)?.is_none() {
        crate::jcall::call_method(
            env,
            context,
            "stopService",
            "(Landroid/content/Intent;)Z",
            &[JValue::Object(&service_intent)],
        )?;
        return Ok(());
    }
    create_channels(env, context)?;
    crate::jcall::call_static_method(
        env,
        "androidx/core/content/ContextCompat",
        "startForegroundService",
        "(Landroid/content/Context;Landroid/content/Intent;)V",
        &[JValue::Object(context), JValue::Object(&service_intent)],
    )?;
    Ok(())
 }
 /// The `Service.onStartCommand` body -- loads settings, starts the
 /// foreground notification, and spawns the follow-loop thread. Answers the
 /// platform's `START_STICKY`/`START_NOT_STICKY` constant, read from the
 /// framework rather than hardcoded so a wrong guess at their values cannot
 /// silently pick the other behaviour.
 pub fn on_start_command(env: &mut Env, service: JObject) -> jint {
    match try_start(env, &service) {
        Ok(true) => static_int(env, "android/app/Service", "START_STICKY").unwrap_or(1),
        Ok(false) => {
            let _ = crate::jcall::call_method(env, &service, "stopSelf", "()V", &[]);
            static_int(env, "android/app/Service", "START_NOT_STICKY").unwrap_or(2)
        }
        Err(e) => {
            log_error(env, "onStartCommand", &e);
            static_int(env, "android/app/Service", "START_NOT_STICKY").unwrap_or(2)
        }
    }
 }
 fn try_start(env: &mut Env, service: &JObject) -> Result<bool> {
    let Some(settings) = settings::load(env, service)? else {
        return Ok(false);
    };
    let ca = settings::load_pinned_ca(env)?;
    let notification = ongoing_notification(env, service)?;
    let fg_type = foreground_type(env)?;
    crate::jcall::call_static_method(
        env,
        "androidx/core/app/ServiceCompat",
        "startForeground",
        "(Landroid/app/Service;ILandroid/app/Notification;I)V",
        &[
            JValue::Object(service),
            JValue::Int(ONGOING_ID),
            JValue::Object(&notification),
            JValue::Int(fg_type),
        ],
    )?;
    // See `RUNNING`'s doc: a second `onStartCommand` while the loop from
    // the first is still going -- the ordinary case for this service,
    // since `sync()` is called from more than one place -- must not open
    // a second connection.
    if RUNNING.swap(true, Ordering::SeqCst) {
        return Ok(true);
    }
    let vm = env.get_java_vm()?;
    let context = env.new_global_ref(service)?;
    STOPPING.store(false, Ordering::SeqCst);
    std::thread::Builder::new()
        .name("ai-app-notifications".to_string())
        .spawn(move || {
            // Requests a *permanent* attachment (detached only when this thread
            // exits), matching the Kotlin original's `thread(isDaemon = true)`:
            // this is the long-lived follow loop, not a one-shot callback.
            let _: jni::errors::Result<()> = vm.attach_current_thread(|env| {
                follow_loop(env, &context, settings, &ca);
                Ok(())
            });
        })
        .ok();
    Ok(true)
 }
 /// Follows the backend's notification stream, reconnecting until stopped
 /// -- mirrors `Notifications.kt`'s `follow`. A dropped connection is the
 /// ordinary case, so it retries quietly and forever; nothing is shown when
 /// it cannot connect, for the same reason as the Kotlin original: a
 /// notification saying "I could not tell you whether anything happened" is
 /// noise about a condition nobody can act on.
 fn follow_loop(env: &mut Env, context: &JObject, settings: ServerSettings, ca: &[u8]) {
    while !STOPPING.load(Ordering::SeqCst) {
        if let Ok(transport) = UreqTransport::new(settings.base_url(), settings.token.clone(), ca) {
            let _ = follow_notifications(&transport, |notification| {
                if let Err(e) = show(env, context, &notification) {
                    log_error(env, "show", &e);
                }
                !STOPPING.load(Ordering::SeqCst)
            });
        }
        if STOPPING.load(Ordering::SeqCst) {
            return;
        }
        std::thread::sleep(RECONNECT_DELAY);
    }
 }
 /// One notification per session, replacing that session's previous one --
 /// mirrors `Notifications.kt`'s `show`, minus the on-screen/banner
 /// branches this module's doc comment explains.
 fn show(env: &mut Env, context: &JObject, notification: &SessionNotification) -> Result<()> {
    let manager = notification_manager(env, context)?;
    let sdk = static_int(env, "android/os/Build$VERSION", "SDK_INT")?;
    let tiramisu = static_int(env, "android/os/Build$VERSION_CODES", "TIRAMISU")?;
    let allowed = if sdk < tiramisu {
        true
    } else {
        let permission = crate::jcall::jstr_obj(env, "android.permission.POST_NOTIFICATIONS")?;
        let granted = static_int(
            env,
            "android/content/pm/PackageManager",
            "PERMISSION_GRANTED",
        )?;
        let result = crate::jcall::call_static_method(
            env,
            "androidx/core/content/ContextCompat",
            "checkSelfPermission",
            "(Landroid/content/Context;Ljava/lang/String;)I",
            &[JValue::Object(context), JValue::Object(&permission)],
        )?
        .i()?;
        result == granted
    };
    let enabled =
        crate::jcall::call_method(env, &manager, "areNotificationsEnabled", "()Z", &[])?.z()?;
    if !allowed || !enabled {
        return Ok(());
    }
    let intent = session_intent(env, context, &notification.session_id)?;
    let pending = pending_activity(env, context, &intent)?;
    let channel = crate::jcall::jstr_obj(env, ALERT_CHANNEL)?;
    let builder = crate::jcall::new_object(
        env,
        "androidx/core/app/NotificationCompat$Builder",
        "(Landroid/content/Context;Ljava/lang/String;)V",
        &[JValue::Object(context), JValue::Object(&channel)],
    )?;
    let title = crate::jcall::jstr_obj(env, &notification.title)?;
    builder_call(
        env,
        &builder,
        "setContentTitle",
        "(Ljava/lang/CharSequence;)Landroidx/core/app/NotificationCompat$Builder;",
        &[JValue::Object(&title)],
    )?;
    let text = crate::jcall::jstr_obj(env, notification.kind.attention_line())?;
    builder_call(
        env,
        &builder,
        "setContentText",
        "(Ljava/lang/CharSequence;)Landroidx/core/app/NotificationCompat$Builder;",
        &[JValue::Object(&text)],
    )?;
    let icon = static_int(env, "android/R$drawable", "stat_notify_chat")?;
    builder_call(
        env,
        &builder,
        "setSmallIcon",
        "(I)Landroidx/core/app/NotificationCompat$Builder;",
        &[JValue::Int(icon)],
    )?;
    builder_call(
        env,
        &builder,
        "setContentIntent",
        "(Landroid/app/PendingIntent;)Landroidx/core/app/NotificationCompat$Builder;",
        &[JValue::Object(&pending)],
    )?;
    builder_call(
        env,
        &builder,
        "setAutoCancel",
        "(Z)Landroidx/core/app/NotificationCompat$Builder;",
        &[JValue::Bool(JNI_TRUE)],
    )?;
    let when = (notification.at * 1000.0) as i64;
    builder_call(
        env,
        &builder,
        "setWhen",
        "(J)Landroidx/core/app/NotificationCompat$Builder;",
        &[JValue::Long(when)],
    )?;
    builder_call(
        env,
        &builder,
        "setShowWhen",
        "(Z)Landroidx/core/app/NotificationCompat$Builder;",
        &[JValue::Bool(JNI_TRUE)],
    )?;
    let built =
        crate::jcall::call_method(env, &builder, "build", "()Landroid/app/Notification;", &[])?
            .l()?;
    let tag = crate::jcall::jstr_obj(env, &notification.session_id)?;
    crate::jcall::call_method(
        env,
        &manager,
        "notify",
        "(Ljava/lang/String;ILandroid/app/Notification;)V",
        &[
            JValue::Object(&tag),
            JValue::Int(ALERT_ID),
            JValue::Object(&built),
        ],
    )?;
    Ok(())
 }
 /// Ends the follow loop -- mirrors `Notifications.kt`'s `onDestroy`, with
 /// the gap this module's `STOPPING` doc explains.
 pub fn on_destroy() {
    STOPPING.store(true, Ordering::SeqCst);
    // `RUNNING`'s path out. Same race as `STOPPING` itself (this doc's own
    // comment): the old thread may still be inside a blocked read when a
    // new `onStartCommand` follows immediately, which would spawn a
    // second one before the first has actually stopped. Narrower than not
    // resetting at all -- a service destroyed and never restarted would
    // otherwise wedge `RUNNING` true forever -- and no worse than the
    // known gap already accepted above.
    RUNNING.store(false, Ordering::SeqCst);
 }
 pub fn log_error(env: &mut Env, where_: &str, error: &jni::errors::Error) {
    let message = format!("android-shell: {where_}: {error}");
    let _ = (|| -> Result<()> {
        let tag = crate::jcall::jstr_obj(env, "android-shell")?;
        let msg = crate::jcall::jstr_obj(env, &message)?;
        crate::jcall::call_static_method(
            env,
            "android/util/Log",
            "e",
            "(Ljava/lang/String;Ljava/lang/String;)I",
            &[JValue::Object(&tag), JValue::Object(&msg)],
        )?;
        Ok(())
    })();
 }
@@ -1,141 +0,0 @@
 //! Enrollment: where the backend is, and the Keystore-sealed token to
 //! reach it. This crate does not reimplement the Android Keystore AES-GCM
 //! sealing in Rust -- it calls the same `wg-app-link` `ServerStore` Kotlin
 //! class the production app already uses (see `ServerConfig.kt`), through
 //! JNI, for two reasons: that code is shared with Dev Updater and already
 //! tested, and the sealed value on a real phone is keyed to the exact
 //! Keystore alias that class already uses -- reimplementing the crypto
 //! here would either duplicate it or invalidate an existing enrollment.
 use jni::Env;
 use jni::errors::Result;
 use jni::objects::{JObject, JString, JValue};
 /// Where the backend is and how to authenticate to it -- the Rust twin of
 /// `wg-app-link`'s `ServerSettings` data class, read back field by field
 /// rather than kept as a live JNI reference, so it can cross a thread
 /// boundary (a `JObject` is tied to one `Env`/thread).
 #[derive(Debug, Clone)]
 pub struct ServerSettings {
    pub host: String,
    pub port: i32,
    pub token: String,
 }
 impl ServerSettings {
    pub fn base_url(&self) -> String {
        format!("https://{}:{}", self.host, self.port)
    }
 }
 /// This experiment's own scheme and Keystore alias -- distinct from the
 /// production app's (`aiapp` / `aiapp-token-key`) so the two can be
 /// installed side by side on the same development device without
 /// colliding over which one a scanned QR or a deep link resolves to. See
 /// RUST.md's E3 entry for why they are not the same value.
 pub(crate) const SCHEME: &str = "aiappshell";
 const KEY_ALIAS: &str = "aiapp-shell-token-key";
 const STORE_CLASS: &str = "com/example/wgapplink/ServerStore";
 const SETTINGS_CLASS: &str = "com/example/wgapplink/ServerSettings";
 fn new_store<'l>(env: &mut Env<'l>) -> Result<JObject<'l>> {
    let scheme = crate::jcall::jstr_obj(env, SCHEME)?;
    let alias = crate::jcall::jstr_obj(env, KEY_ALIAS)?;
    crate::jcall::new_object(
        env,
        STORE_CLASS,
        "(Ljava/lang/String;Ljava/lang/String;)V",
        &[JValue::Object(&scheme), JValue::Object(&alias)],
    )
 }
 fn read_settings(env: &mut Env, settings_obj: &JObject) -> Result<ServerSettings> {
    let host = get_string(env, settings_obj, "getHost")?;
    let port = crate::jcall::call_method(env, settings_obj, "getPort", "()I", &[])?.i()?;
    let token = get_string(env, settings_obj, "getToken")?;
    Ok(ServerSettings { host, port, token })
 }
 fn get_string(env: &mut Env, obj: &JObject, getter: &str) -> Result<String> {
    let value = crate::jcall::call_method(env, obj, getter, "()Ljava/lang/String;", &[])?.l()?;
    let jstr: JString = env.cast_local::<JString>(value)?;
    jstr.try_to_string(env)
 }
 /// The stored enrollment, or `None` when there is not one -- mirrors
 /// `ServerConfig.kt`'s `loadServerSettings`.
 pub fn load(env: &mut Env, context: &JObject) -> Result<Option<ServerSettings>> {
    let store = new_store(env)?;
    let settings_obj = crate::jcall::call_method(
        env,
        &store,
        "load",
        "(Landroid/content/Context;)Lcom/example/wgapplink/ServerSettings;",
        &[JValue::Object(context)],
    )?
    .l()?;
    if settings_obj.is_null() {
        return Ok(None);
    }
    Ok(Some(read_settings(env, &settings_obj)?))
 }
 /// Seals and stores `settings` -- mirrors `ServerConfig.kt`'s `saveServerSettings`.
 pub fn save(env: &mut Env, context: &JObject, settings: &ServerSettings) -> Result<()> {
    let store = new_store(env)?;
    let host = crate::jcall::jstr_obj(env, &settings.host)?;
    let token = crate::jcall::jstr_obj(env, &settings.token)?;
    let settings_obj = crate::jcall::new_object(
        env,
        SETTINGS_CLASS,
        "(Ljava/lang/String;ILjava/lang/String;)V",
        &[
            JValue::Object(&host),
            JValue::Int(settings.port),
            JValue::Object(&token),
        ],
    )?;
    crate::jcall::call_method(
        env,
        &store,
        "save",
        "(Landroid/content/Context;Lcom/example/wgapplink/ServerSettings;)V",
        &[JValue::Object(context), JValue::Object(&settings_obj)],
    )?;
    Ok(())
 }
 /// Parses an `aiappshell://enroll?...` URI -- mirrors `ServerConfig.kt`'s
 /// `parseEnrollmentUri`, asking the same Kotlin code that already owns the
 /// query-parameter rules rather than re-deriving them here.
 pub fn parse_enrollment_uri(env: &mut Env, uri: &JObject) -> Result<Option<ServerSettings>> {
    let store = new_store(env)?;
    let settings_obj = crate::jcall::call_method(
        env,
        &store,
        "parseEnrollmentUri",
        "(Landroid/net/Uri;)Lcom/example/wgapplink/ServerSettings;",
        &[JValue::Object(uri)],
    )?
    .l()?;
    if settings_obj.is_null() {
        return Ok(None);
    }
    Ok(Some(read_settings(env, &settings_obj)?))
 }
 /// The CA this build pins, generated at build time the same way
 /// `androidApp`'s `generatePinnedCert` task does (see `build.gradle.kts`)
 /// but into a plain Java constant, since this module has no Kotlin of its
 /// own to generate into.
 pub fn load_pinned_ca(env: &mut Env) -> Result<Vec<u8>> {
    let value = crate::jcall::get_static_field(
        env,
        "com/example/aiapp/shell/PinnedCa",
        "PINNED_CA_PEM",
        "Ljava/lang/String;",
    )?
    .l()?;
    let jstr: JString = env.cast_local::<JString>(value)?;
    Ok(jstr.try_to_string(env)?.into_bytes())
 }
@@ -1,183 +0,0 @@
 //! Deep links and the share sheet -- ported from `MainActivity.kt`'s
 //! `handleIntent`/`onNewIntent` and `Share.kt`'s `sharedContent`.
 //!
 //! **Scope cut, recorded rather than silent**: only shared *text*
 //! (`Intent.EXTRA_TEXT`) is attached to a session. `Attachments.kt`'s
 //! upload path -- `ContentResolver` reads of a shared file/photo URI,
 //! bitmap downscaling, EXIF rotation -- is real work of its own and is not
 //! ported here, because `client-core`'s `ApiClient` does not have the
 //! `/sessions/{id}/attachments` route yet either (see `CLIENT_CORE.md`'s
 //! "not covered" list). So `ACTION_SEND`/`ACTION_SEND_MULTIPLE` with a
 //! `content://` stream and no text falls through to a toast saying so,
 //! rather than silently doing nothing. Closing this gap is the same
 //! `client-core` work whichever caller needs it next.
 //!
 //! **Which session a share lands in** is also a placeholder: with no
 //! screen drawn yet (E4's job), there is no picker to ask, so this attaches
 //! to whichever session has the latest `last_activity` -- the one most
 //! likely to be what somebody meant. Worth revisiting once a real screen
 //! exists to ask instead of guessing.
 use client_core::api::{ApiClient, UreqTransport};
 use jni::Env;
 use jni::errors::Result;
 use jni::objects::{JObject, JString, JValue};
 use crate::notify;
 use crate::settings;
 const ACTION_SEND: &str = "android.intent.action.SEND";
 const ACTION_SEND_MULTIPLE: &str = "android.intent.action.SEND_MULTIPLE";
 const ACTION_VIEW: &str = "android.intent.action.VIEW";
 const EXTRA_TEXT: &str = "android.intent.extra.TEXT";
 fn get_string_method(env: &mut Env, obj: &JObject, method: &str) -> Result<Option<String>> {
    let value = crate::jcall::call_method(env, obj, method, "()Ljava/lang/String;", &[])?.l()?;
    if value.is_null() {
        return Ok(None);
    }
    let jstr: JString = env.cast_local::<JString>(value)?;
    Ok(Some(jstr.try_to_string(env)?))
 }
 fn toast(env: &mut Env, context: &JObject, message: &str) -> Result<()> {
    let message = crate::jcall::jstr_obj(env, message)?;
    crate::jcall::call_static_method(
        env,
        "com/example/aiapp/shell/MainActivity",
        "toast",
        "(Landroid/content/Context;Ljava/lang/String;)V",
        &[JValue::Object(context), JValue::Object(&message)],
    )?;
    Ok(())
 }
 /// The one place an incoming intent is sorted into what it means -- mirrors
 /// `MainActivity.kt`'s `handleIntent`.
 pub fn handle_intent(env: &mut Env, activity: &JObject, intent: &JObject) -> Result<()> {
    let action = get_string_method(env, intent, "getAction")?;
    if matches!(
        action.as_deref(),
        Some(ACTION_SEND) | Some(ACTION_SEND_MULTIPLE)
    ) {
        return handle_share(env, activity, intent);
    }
    if action.as_deref() != Some(ACTION_VIEW) {
        return Ok(());
    }
    let uri = crate::jcall::call_method(env, intent, "getData", "()Landroid/net/Uri;", &[])?.l()?;
    if uri.is_null() {
        return Ok(());
    }
    let scheme = get_string_method(env, &uri, "getScheme")?;
    if scheme.as_deref() != Some(settings::SCHEME) {
        return Ok(());
    }
    match get_string_method(env, &uri, "getHost")?.as_deref() {
        Some("session") => handle_session_open(env, activity, &uri),
        Some("enroll") => handle_enrollment(env, activity, &uri),
        _ => Ok(()),
    }
 }
 fn handle_session_open(env: &mut Env, activity: &JObject, uri: &JObject) -> Result<()> {
    let Some(session_id) = get_string_method(env, uri, "getLastPathSegment")? else {
        return Ok(());
    };
    // There is no session screen yet (E4's job); the toast is this
    // experiment's stand-in proof that the tap was routed to the right
    // session id.
    toast(env, activity, &format!("Opened session {session_id}"))
 }
 fn handle_enrollment(env: &mut Env, activity: &JObject, uri: &JObject) -> Result<()> {
    match settings::parse_enrollment_uri(env, uri)? {
        Some(parsed) => {
            settings::save(env, activity, &parsed)?;
            notify::sync(env, activity)?;
            toast(
                env,
                activity,
                &format!("Enrolled with {}", parsed.base_url()),
            )
        }
        None => toast(env, activity, "Not a valid enrollment code"),
    }
 }
 /// The share sheet -- mirrors `Share.kt`'s `sharedContent` for what counts
 /// as a share, and `AttachmentButton`'s upload-then-message pattern for
 /// what happens to it, minus attachments per this module's doc comment.
 fn handle_share(env: &mut Env, activity: &JObject, intent: &JObject) -> Result<()> {
    let extra_text = crate::jcall::jstr_obj(env, EXTRA_TEXT)?;
    let text = crate::jcall::call_method(
        env,
        intent,
        "getStringExtra",
        "(Ljava/lang/String;)Ljava/lang/String;",
        &[JValue::Object(&extra_text)],
    )?
    .l()?;
    let text = if text.is_null() {
        None
    } else {
        let jstr: JString = env.cast_local::<JString>(text)?;
        Some(jstr.try_to_string(env)?)
    };
    let Some(text) = text.filter(|t| !t.trim().is_empty()) else {
        return toast(
            env,
            activity,
            "Nothing to share -- only shared text is supported so far",
        );
    };
    // Network I/O must not run on the calling thread: `handle_intent` is
    // called from `onCreate`/`onNewIntent`, both on the main thread, and a
    // blocking socket read there is a `NetworkOnMainThreadException`. So
    // the actual send happens on a JNI-attached background thread, the
    // same shape `notify::try_start`'s follow loop uses; `toast` from that
    // thread is safe because `MainActivity.toast` itself hops back to the
    // main looper (see that method).
    let vm = env.get_java_vm()?;
    let activity_ref = env.new_global_ref(activity)?;
    std::thread::spawn(move || {
        let _: jni::errors::Result<()> = vm.attach_current_thread(|env| {
            share_in_background(env, &activity_ref, text);
            Ok(())
        });
    });
    Ok(())
 }
 fn share_in_background(env: &mut Env, activity: &JObject, text: String) {
    let outcome = attach_to_a_session(env, activity, &text);
    let message = match outcome {
        Ok(title) => format!("Shared into \"{title}\""),
        Err(message) => message,
    };
    let _ = toast(env, activity, &message);
 }
 fn attach_to_a_session(
    env: &mut Env,
    activity: &JObject,
    text: &str,
 ) -> std::result::Result<String, String> {
    let settings = settings::load(env, activity)
        .map_err(|e| e.to_string())?
        .ok_or_else(|| "Not enrolled yet".to_string())?;
    let ca = settings::load_pinned_ca(env).map_err(|e| e.to_string())?;
    let transport = UreqTransport::new(settings.base_url(), settings.token.clone(), &ca)
        .map_err(|e| e.to_string())?;
    let client = ApiClient::new(transport);
    let sessions = client.fetch_sessions().map_err(|e| e.to_string())?;
    let target = sessions
        .into_iter()
        .max_by(|a, b| a.last_activity.total_cmp(&b.last_activity))
        .ok_or_else(|| "No session to share into".to_string())?;
    client
        .send_message(&target.id, text, &[])
        .map_err(|e| e.to_string())?;
    Ok(target.title)
 }
@@ -102,16 +102,6 @@ android {
        targetSdk = 37
        versionCode = 1
        versionName = "1.0"
        // Read by MainActivity to decide, at startup, whether this is the P0 benchmark build
        // (docs/RUST.md's P0 box) rather than the app somebody enrolled. False everywhere except
        // the `bench` build type below, which overrides it.
        buildConfigField("boolean", "FIXTURE_MODE", "false")
    }
    buildFeatures {
        // Only for FIXTURE_MODE above; nothing else here reaches for generated BuildConfig fields.
        buildConfig = true
        // Only for the bench build type's resValue("string", "app_name", ...) below.
        resValues = true
    }
    packaging {
        resources { excludes += "/META-INF/{AL2.0,LGPL2.1}" }
@@ -141,35 +131,6 @@ android {
            isMinifyEnabled = false
            if (keystore != null) signingConfig = signingConfigs.getByName("release")
        }
        // P0's benchmark build (docs/RUST.md, docs/DECISIONS.md's 2026-09-05 entry): release
        // optimisations so a frame time measured here means what release means everywhere else in
        // this project, its own application id so it installs beside a real enrollment rather than
        // replacing it, and FIXTURE_MODE so MainActivity opens straight onto the fixture session
        // instead of asking to be enrolled. Signed with the same key as release -- it never talks
        // to a real backend, so there is no CA of its own to mismatch, and a second keystore would
        // be one more secret to keep off this machine's shared mount for no benefit.
        create("bench") {
            initWith(getByName("release"))
            // :link (wg-app-link) has no "bench" build type of its own -- it is a library shared
            // with dev-updater and has no reason to know this project invented one -- so this says
            // which of its build types to link against instead.
            matchingFallbacks += listOf("release")
            applicationIdSuffix = ".bench"
            // "AI Sessions bench" everywhere the OS shows the app's name (launcher, recents,
            // Settings): this resValue overrides res/values/strings.xml's app_name for this
            // build type alone, and AndroidManifest.xml's android:label reads @string/app_name
            // rather than a literal so a build type can override it without touching the
            // manifest.
            resValue("string", "app_name", "AI Sessions bench")
            buildConfigField("boolean", "FIXTURE_MODE", "true")
            if (keystore != null) signingConfig = signingConfigs.getByName("release")
        }
    }
    sourceSets {
        // The fixture both bench builds (this one and iris's) open with; see
        // app/bench-fixture/README.md. Read directly from its own directory rather than copied
        // into androidApp/src -- one file to keep in sync with the generator, not two.
        getByName("bench").assets.directories.add("../bench-fixture/assets")
    }
    compileOptions {
        sourceCompatibility = JavaVersion.VERSION_21
@@ -25,7 +25,7 @@
         the fix is a judgement about how this app should look. Drop this
         suppression when a real icon lands. -->
    <application
-        android:label="@string/app_name"
+        android:label="AI Sessions"
        android:allowBackup="true"
        android:theme="@android:style/Theme.Material.Light.NoActionBar"
        tools:ignore="MissingApplicationIcon">
@@ -11,6 +11,7 @@ import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.CompositionLocalProvider
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.key
@@ -21,6 +22,7 @@ import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.semantics.clearAndSetSemantics
 import androidx.compose.ui.unit.dp
 import com.example.wgapplink.localNetworkAllowed
 import kotlinx.coroutines.Dispatchers
@@ -31,41 +33,39 @@ import kotlinx.coroutines.withContext
 * One `when` rather than a navigation library: a handful of screens, with [Screen.Main] as the root
 * and the back button the only other way between them.
 *
- * Import, models and setups are tabs inside [MainScreen] -- four views of the same backend, none of
+ * Import, models and machines are tabs inside [MainScreen] -- four views of the same backend, none
- * them a step down from another -- and what is left here is only what genuinely is a step down: one
+ * of them a step down from another -- and what is left here is only what genuinely is a step down:
- * session, spawning one, and settings.
+ * one session, spawning one, and settings.
 */
 private sealed class Screen {
-    /**
+    data object Main : Screen()
     * The session list, with a subagent's own transcript over it when [subagent] is set.
     *
     * A layer on this screen rather than a screen of its own, for the same reason [Session.files]
     * is: [SessionListScreen] owns which cards are expanded and what each expansion fetched, kept
     * in `remember`, and a subagent is opened from a card's expander. As a sibling `Screen` it was
     * disposed and recreated on every return, which lost that state -- an expanded card collapsed
     * itself the moment its own subagent's view was closed.
     */
    data class Main(val subagent: SubagentTarget? = null) : Screen()
    /**
-     * One subagent's own transcript, read-only. See [SessionScreen]'s `subagent` parameter and
+     * One session, with the file explorer or a subagent transcript over it when set.
     * SUBAGENTS.md's "Phone". Closing it returns to [Main] under it, not to [Session]: a subagent
     * is opened from the session list's card rather than from inside the session it belongs to.
     */
    data class SubagentTarget(val summary: SessionSummary, val subagent: SubagentSummary)
    /**
     * One session, with the file explorer over it when [files] is set.
     *
-     * The explorer is a layer on this screen rather than a screen of its own, so the session under
+     * Both are layers on this screen rather than screens of their own, so the session under them
-     * it stays composed: its event stream keeps flowing, its scroll position and draft stay put,
+     * stays composed: its event stream keeps flowing, its scroll position and draft stay put, and
-     * and coming back from a file costs nothing. As a sibling `Screen` it would be disposed and re-
+     * coming back costs nothing. As sibling `Screen`s they would dispose and recreate it on every
-     * created on every return, refetching the transcript over the tunnel.
+     * return, refetching the transcript over the tunnel.
     */
-    data class Session(val summary: SessionSummary, val files: FilesTarget? = null) : Screen()
+    data class Session(
        val summary: SessionSummary,
        val files: FilesTarget? = null,
        val subagent: SubagentSummary? = null,
    ) : Screen()
    data object Spawn : Screen()
    /**
     * One provider on one machine: its settings, and what its shared server is holding.
     *
     * A step down from the machines tab rather than a tab of its own, because it is about one
     * machine rather than about the backend. Addressed by ids and names rather than by the
     * [Provider] it was tapped from: what it shows is fetched, and a stale copy of a card would be
     * a second version of the same truth.
     */
    data class ProviderSettings(val machineId: String, val provider: String) : Screen()
    data object Settings : Screen()
 }
@@ -99,7 +99,7 @@ fun AppRoot(
    val context = LocalContext.current
    val scope = rememberCoroutineScope()
    var settings by remember(settingsVersion) { mutableStateOf(loadServerSettings(context)) }
-    var screen by remember { mutableStateOf<Screen>(Screen.Main()) }
+    var screen by remember { mutableStateOf<Screen>(Screen.Main) }
    // A notification tap this could not follow, and why. Null both before one is asked for and
    // after one succeeds, since success is a screen rather than a message.
    var failedOpen by remember { mutableStateOf<FailedOpen?>(null) }
@@ -114,7 +114,7 @@ fun AppRoot(
            share = shareRequest
            // A session already open takes it. Otherwise the list is where the choice is made,
            // whatever screen was showing: Spawn and Settings have nowhere to put a file.
-            if (screen !is Screen.Session) screen = Screen.Main()
+            if (screen !is Screen.Session) screen = Screen.Main
        }
    }
@@ -141,7 +141,7 @@ fun AppRoot(
                existing = null,
                onSaved = { saved ->
                    settings = saved
-                    screen = Screen.Main()
+                    screen = Screen.Main
                },
                onBack = null,
            )
@@ -154,7 +154,7 @@ fun AppRoot(
    // shows, so it always refetches.
    val goToMain = {
        reloadToken++
-        screen = Screen.Main()
+        screen = Screen.Main
    }
    if (screen !is Screen.Main) {
        BackHandler(onBack = goToMain)
@@ -196,44 +196,23 @@ fun AppRoot(
    // deliberately does not: resizing a whole screen on every frame of the keyboard animation is
    // the cost that made it lag, so it moves only its composer and transcript.
    when (val here = screen) {
-        is Screen.Main ->
+        Screen.Main ->
            Box(Modifier.imePadding()) {
                MainScreen(
                    settings = current,
                    reloadToken = reloadToken,
                    share = share,
                    onOpen = { screen = Screen.Session(it) },
                    onOpenSubagent = { summary, subagent ->
                        screen = here.copy(subagent = Screen.SubagentTarget(summary, subagent))
                    },
                    onSpawn = { screen = Screen.Spawn },
                    onImported = { imported ->
                        reloadToken++
                        screen = Screen.Session(imported)
                    },
                    onSettings = { screen = Screen.Settings },
                    onProvider = { machineId, provider ->
                        screen = Screen.ProviderSettings(machineId, provider)
                    },
                )
                // Its own back handler is registered after MainScreen's, so it is the one the
                // platform asks first while a subagent is open -- the same rule the files
                // explorer's handler follows over its session, below.
                here.subagent?.let { target ->
                    BackHandler { screen = here.copy(subagent = null) }
                    // Its own opaque background: this screen was always the sole content under
                    // the theme's own Surface before, so it never had to paint one -- stacked over
                    // the list here, the space between its own cards let the list underneath show
                    // through without this. The same fix FilesScreen needed over its session.
                    Box(Modifier.fillMaxSize().background(MaterialTheme.colorScheme.background)) {
                        key(target.summary.id, target.subagent.id) {
                            SessionScreen(
                                settings = current,
                                summary = target.summary,
                                onBack = { screen = here.copy(subagent = null) },
                                onFiles = {},
                                subagent = target.subagent,
                            )
                        }
                    }
                }
            }
        is Screen.Session ->
            // Keyed on the id, because a different session is a different screen rather than this
@@ -246,14 +225,94 @@ fun AppRoot(
                // A Box so the explorer can be drawn *over* the session rather than instead of it.
                // No imePadding here, for the reason above -- the explorer adds its own.
                Box {
-                    SessionScreen(
+                    val fileLinkHandler = rememberFileLinkHandler { path ->
-                        settings = current,
+                        screen = here.copy(files = here.summary.filesTarget(path))
-                        summary = here.summary,
+                    }
-                        onBack = goToMain,
+                    Box(
-                        onFiles = { screen = here.copy(files = it) },
+                        Modifier.then(
-                        share = share,
+                            if (here.subagent != null || here.files != null)
-                        onShareTaken = { share = null },
+                                Modifier.clearAndSetSemantics {}
-                    )
+                            else Modifier
                        )
                    ) {
                        // How much background work the session has, from the one subscription
                        // to its events the screen below holds. Here because the panel and that
                        // screen both draw it, and must draw the same number.
                        var backgroundTasks by
                            remember(here.summary.id) {
                                mutableIntStateOf(here.summary.backgroundTasks)
                            }
                        // The two panels this session can be pulled aside for: its subagents
                        // from the right, and the whole main screen from the left. Both are here
                        // rather than screens of their own for the same reason the explorer is --
                        // the session under them stays composed. The main panel exists only
                        // inside a session, which is what makes it unswipeable until one has been
                        // opened.
                        SidePanels(
                            left = { active, close ->
                                MainPanel(
                                    settings = current,
                                    sessionId = here.summary.id,
                                    active = active,
                                    onOpen = { screen = Screen.Session(it) },
                                    onSpawn = { screen = Screen.Spawn },
                                    onImported = { imported ->
                                        reloadToken++
                                        screen = Screen.Session(imported)
                                    },
                                    onSettings = { screen = Screen.Settings },
                                    onProvider = { machineId, provider ->
                                        screen = Screen.ProviderSettings(machineId, provider)
                                    },
                                    onClose = close,
                                    onGone = goToMain,
                                )
                            },
                            // The whole width: it stands in for the screen Back would have shown,
                            // rather than sitting over the session the way the subagents do.
                            leftFraction = 1f,
                            right = { active, close ->
                                SubagentPanel(
                                    settings = current,
                                    summary = here.summary,
                                    active = active,
                                    backgroundTasks = backgroundTasks,
                                    onClose = close,
                                    onOpenSubagent = { screen = here.copy(subagent = it) },
                                )
                            },
                        ) {
                            CompositionLocalProvider(
                                LocalFileLinkHandler provides fileLinkHandler
                            ) {
                                SessionScreen(
                                    settings = current,
                                    summary = here.summary,
                                    onBack = goToMain,
                                    onFiles = { screen = here.copy(files = it) },
                                    share = share,
                                    onShareTaken = { share = null },
                                    onBackgroundTasks = { backgroundTasks = it },
                                )
                            }
                        }
                    }
                    here.subagent?.let { subagent ->
                        BackHandler { screen = here.copy(subagent = null) }
                        Box(
                            Modifier.fillMaxSize().background(MaterialTheme.colorScheme.background)
                        ) {
                            key(subagent.id) {
                                SessionScreen(
                                    settings = current,
                                    summary = here.summary,
                                    onBack = { screen = here.copy(subagent = null) },
                                    onFiles = {},
                                    subagent = subagent,
                                )
                            }
                        }
                    }
                    // Its own back handler is registered after this screen's, so it is the one the
                    // platform asks first, and it steps back inside itself before closing.
                    here.files?.let { target ->
@@ -265,6 +324,15 @@ fun AppRoot(
                    }
                }
            }
        is Screen.ProviderSettings ->
            Box(Modifier.imePadding()) {
                ProviderScreen(
                    settings = current,
                    machineId = here.machineId,
                    provider = here.provider,
                    onBack = goToMain,
                )
            }
        is Screen.Spawn ->
            Box(Modifier.imePadding()) {
                SpawnScreen(
@@ -0,0 +1,155 @@
 package com.example.aiapp
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.heightIn
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.lazy.LazyListScope
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.LocalContentColor
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedCard
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.dp
 /**
 * The background work a session has going, above its subagents in the panel [SidePanels] slides
 * over it from the right.
 *
 * Collapsed to its one-line count by default, the way everything else this app adds to a screen
 * arrives: what a reader came to the panel for is the subagents, and a run of cards about work
 * nobody asked after would push them off it. Expanding pushes them down instead of covering them,
 * so the two are read together.
 *
 * Nothing is drawn at all when the count is zero -- including when the provider never said, which
 * is the same absence the status row draws. A permanently visible "0 bg tasks" would be a line
 * about nothing on every session that has never backgrounded anything, which is most of them.
 */
 fun LazyListScope.backgroundTaskSection(
    count: Int,
    tasks: LoadState<List<BackgroundTaskSummary>?>,
    expanded: Boolean,
    onToggle: () -> Unit,
    onRetry: () -> Unit,
 ) {
    if (count == 0) return
    item(key = "background-heading") {
        Row(
            verticalAlignment = Alignment.CenterVertically,
            modifier = Modifier.fillMaxWidth().heightIn(min = 48.dp).clickable(onClick = onToggle),
        ) {
            Text(
                "${backgroundTaskLabel(count)} running",
                style = MaterialTheme.typography.titleMedium,
                modifier = Modifier.weight(1f),
            )
            Chevron(if (expanded) Pointing.Up else Pointing.Down)
        }
    }
    if (!expanded) return
    when (tasks) {
        is LoadState.Loading ->
            item(key = "background-loading") {
                CircularProgressIndicator(modifier = Modifier.width(24.dp).height(24.dp))
            }
        is LoadState.Error ->
            item(key = "background-error") {
                Column {
                    Text(
                        tasks.message,
                        color = MaterialTheme.colorScheme.error,
                        style = MaterialTheme.typography.bodySmall,
                    )
                    TextButton(onClick = onRetry) { Text("Try again") }
                }
            }
        // Null is the provider declining to say, which a session whose process has gone answers.
        // Said in words: the count above came from somewhere, and an empty space under it would
        // read as the tasks having finished rather than as nobody being left to ask.
        is LoadState.Loaded ->
            when (val rows = tasks.value) {
                null ->
                    item(key = "background-unknown") {
                        Text(
                            "This session isn't saying what these are.",
                            color = MaterialTheme.colorScheme.onSurfaceVariant,
                            style = MaterialTheme.typography.bodyMedium,
                        )
                    }
                else ->
                    uniqueItems(rows, key = { "background-${it.id}" }) { BackgroundTaskCard(it) }
            }
    }
 }
 /**
 * One background task: what it is doing, and what kind of thing is doing it.
 *
 * Not something to open, unlike the subagent cards below it -- a task is a provider's runtime state
 * and has no transcript of its own. A backgrounded agent that does is also in the subagent list,
 * under its own name.
 */
@Composable
 private fun BackgroundTaskCard(task: BackgroundTaskSummary) {
    val kind = backgroundTaskKindLabel(task.kind)
    OutlinedCard(Modifier.fillMaxWidth()) {
        Column(Modifier.padding(horizontal = 12.dp, vertical = 8.dp)) {
            // The kind stands in as the title where the provider gave no description, rather than
            // the id it named the task by: Codex reports a process number, which says nothing to
            // the person reading and would look like a name somebody chose.
            Text(
                task.description ?: kind,
                style = MaterialTheme.typography.titleSmall,
                color =
                    if (task.description == null) MaterialTheme.colorScheme.onSurfaceVariant
                    else LocalContentColor.current,
            )
            if (task.description != null) {
                Spacer(Modifier.height(2.dp))
                Text(
                    kind,
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.onSurfaceVariant,
                )
            }
        }
    }
 }
 /**
 * What a [BackgroundTaskSummary.kind] is called on screen.
 *
 * A kind this build has not heard of is named by what every one of them has in common rather than
 * by the nearest word we do know, which would be this screen asserting something the server never
 * said.
 */
 private fun backgroundTaskKindLabel(kind: String) =
    when (kind) {
        "agent" -> "subagent"
        "command" -> "background command"
        "workflow" -> "workflow"
        else -> "background task"
    }
 /**
 * The heading over one group in the panel, so neither list is a run of cards with no name.
 *
 * The same band as the background section's own heading row above, rather than a gap chosen to look
 * right here: what separates a heading from the cards above it is that both headings sit in a row
 * of one height.
 */
@Composable
 fun PanelSectionHeading(text: String) {
    Row(verticalAlignment = Alignment.CenterVertically, modifier = Modifier.heightIn(min = 48.dp)) {
        Text(text, style = MaterialTheme.typography.titleMedium)
    }
 }
@@ -1,108 +0,0 @@
 package com.example.aiapp
 import android.content.Context
 import java.util.concurrent.CopyOnWriteArrayList
 /**
 * P0's benchmark gate (see docs/RUST.md and docs/DECISIONS.md's 2026-09-05 entry): an in-process
 * fake of the backend, so the `bench` build type can drive a real session screen -- the real
 * [TranscriptSource], the real fold, the real paging -- with no server and no network permission.
 *
 * Only ever installed when [BuildConfig.FIXTURE_MODE] is true (see [MainActivity]); everything else
 * in this build compiles it in but never calls it, since Kotlin has no per-build-type source set
 * that both [MainActivity] (which every variant compiles) and this can share without one.
 *
 * The design: [requestFromServer] and [Sse] talk to `https://$FIXTURE_HOST:$FIXTURE_PORT` through
 * ordinary `java.net.URL`, exactly as they would talk to a real server. A
 * [java.net.URLStreamHandlerFactory] registered once for the whole process intercepts every
 * `https://` connection to that host and answers from this object's in-memory event log instead of
 * opening a socket -- see BenchNetwork.kt. Everything above that (TranscriptSource, SessionScreen,
 * the fold, uniqueItems) never learns the difference.
 */
 object BenchFixture {
    const val FIXTURE_HOST = "bench.fixture.invalid"
    const val FIXTURE_PORT = 1
    /** How many of the fixture's events are the opening backlog; see bench-fixture/README.md. */
    private const val BACKLOG_COUNT = 3200
    val settings = ServerSettings(FIXTURE_HOST, FIXTURE_PORT, "bench")
    /** The session id every bench run opens; nothing else in this build ever mints one. */
    const val SESSION_ID = "bench-fixture-session"
    /**
     * The whole transcript, seq order, growing as [pushLive] is called during the streaming phase.
     * Read by both the REST page handler and the SSE handler, so a page requested mid- stream and a
     * live frame agree on what has "already happened" -- the same thing a real server's own
     * transcript file guarantees.
     */
    private val log = CopyOnWriteArrayList<Pair<String, SeqEvent>>()
    /** The events not yet appended to [log] -- the streaming phase's own source. */
    private var streamTail: List<Pair<String, SeqEvent>> = emptyList()
    private val images = mutableMapOf<String, ByteArray>()
    @Volatile private var loaded = false
    /**
     * Parses the bundled fixture once. Safe to call more than once; only the first does anything.
     */
    @Synchronized
    fun ensureLoaded(context: Context) {
        if (loaded) return
        val lines =
            context.assets.open("transcript.jsonl").bufferedReader().readLines().filter {
                it.isNotBlank()
            }
        val parsed = lines.map { it to parseSeqEvent(it) }
        log.addAll(parsed.take(BACKLOG_COUNT))
        streamTail = parsed.drop(BACKLOG_COUNT)
        for (name in listOf("bench1.png", "bench2.png")) {
            images[name] = context.assets.open(name).readBytes()
        }
        loaded = true
    }
    /** The events the streaming phase has left to send. */
    fun remainingStreamEvents(): Int = streamTail.size
    /** Sends the next fixture event onto the live log, as a real SSE frame would arrive. */
    fun pushNextLiveEvent(): Boolean {
        val next = streamTail.firstOrNull() ?: return false
        streamTail = streamTail.drop(1)
        log.add(next)
        return true
    }
    /** Undoes [pushNextLiveEvent] and reloads the opening backlog, for running the bench twice. */
    @Synchronized
    fun resetToBacklog(context: Context) {
        loaded = false
        log.clear()
        ensureLoaded(context)
    }
    fun fileBytes(name: String): ByteArray? = images[name]
    /**
     * Raw JSON lines with seq > [after], in order -- what an `/events?after=` connection replays.
     */
    fun linesAfter(after: Long): List<String> =
        log.filter { it.second.seq > after }.map { it.first }
    /**
     * One REST page: [fetchTranscript]'s `before`/`limit`/`after`, against the growing log. Ignores
     * `coalesce` -- the fixture's own deltas are already split the way a real reply streams, and
     * what the benchmark exercises is the fold and the paging, not the server's row-joining, which
     * client-core's own port tracks separately (CLIENT_CORE.md).
     */
    fun page(before: Long?, limit: Int, after: Long?): List<String> {
        val upper = before ?: (log.lastOrNull()?.second?.seq?.plus(1) ?: 1L)
        val candidates = log.filter {
            it.second.seq < upper && (after == null || it.second.seq > after)
        }
        return candidates.takeLast(limit).map { it.first }
    }
 }
@@ -1,181 +0,0 @@
 package com.example.aiapp
 import java.io.ByteArrayInputStream
 import java.io.IOException
 import java.io.InputStream
 import java.io.PipedInputStream
 import java.io.PipedOutputStream
 import java.net.HttpURLConnection
 import java.net.URL
 import java.net.URLStreamHandler
 import java.net.URLStreamHandlerFactory
 import java.security.Principal
 import java.security.cert.Certificate
 import javax.net.ssl.HttpsURLConnection
 import javax.net.ssl.SSLPeerUnverifiedException
 import org.json.JSONArray
 /**
 * Installs the process-wide interception [BenchFixture] needs. Idempotent and safe to call more
 * than once; the JDK only allows [URL.setURLStreamHandlerFactory] to be called successfully once
 * per process, and a second real call throws -- so this guards it rather than relying on every
 * caller to remember.
 *
 * Scoped to [BenchFixture.FIXTURE_HOST]: any other `https://` URL falls through to the platform's
 * ordinary handler, so this only ever changes behaviour for the one host the bench build invents.
 */
@Synchronized
 fun installFixtureNetworkOnce() {
    if (installed) return
    installed = true
    URL.setURLStreamHandlerFactory(
        URLStreamHandlerFactory { protocol ->
            if (protocol != "https") null
            else
                object : URLStreamHandler() {
                    override fun openConnection(url: URL): HttpURLConnection =
                        if (url.host == BenchFixture.FIXTURE_HOST) FixtureConnection(url)
                        else
                        // The bench build makes no other https call -- this factory is
                        // installed only in FIXTURE_MODE (MainActivity) -- so there is
                        // deliberately no delegate to a platform handler here: once a
                        // URLStreamHandlerFactory is installed there is no supported way to
                        // ask the JDK for its own default handler back, and re-entering this
                        // same factory for the fallback would recurse forever rather than
                        // reach one.
                        throw java.io.IOException(
                                "bench build's fixture network has no route to https host " +
                                    "${url.host} -- only ${BenchFixture.FIXTURE_HOST} is served"
                            )
                }
        }
    )
 }
 private var installed = false
 /**
 * Answers one request against [BenchFixture] instead of opening a socket. Implements just enough of
 * [HttpsURLConnection] for [requestFromServer] and [Sse] to work unmodified: both only call
 * `connect`/`disconnect`, set a handful of request properties they never need answered, and read
 * `responseCode` and `inputStream`.
 */
 private class FixtureConnection(url: URL) : HttpsURLConnection(url) {
    private var input: InputStream? = null
    private var writer: Thread? = null
    override fun connect() {
        if (input != null) return
        input = route(url.path, url.query)
    }
    override fun disconnect() {
        writer?.interrupt()
        try {
            input?.close()
        } catch (_: IOException) {}
    }
    override fun usingProxy() = false
    override fun getResponseCode(): Int {
        connect()
        return 200
    }
    override fun getInputStream(): InputStream {
        connect()
        return input!!
    }
    override fun getErrorStream(): InputStream? = null
    // Nothing here reads any of these; implemented only because HttpsURLConnection declares them
    // abstract. A fixture never negotiates real TLS, so each says exactly that rather than
    // fabricating a plausible-looking certificate.
    override fun getCipherSuite() = "none (bench fixture, no TLS)"
    override fun getLocalCertificates(): Array<Certificate>? = null
    override fun getServerCertificates(): Array<Certificate> =
        throw SSLPeerUnverifiedException("bench fixture connection presents no certificate")
    override fun getPeerPrincipal(): Principal =
        throw SSLPeerUnverifiedException("bench fixture connection presents no certificate")
    override fun getLocalPrincipal(): Principal? = null
    /**
     * [path] is `/sessions/{id}/...`; everything else this build's fixture is asked for is a bug.
     */
    private fun route(path: String, query: String?): InputStream {
        val params =
            (query ?: "")
                .split("&")
                .filter { it.contains('=') }
                .associate {
                    val (k, v) = it.split("=", limit = 2)
                    k to java.net.URLDecoder.decode(v, "UTF-8")
                }
        return when {
            path.endsWith("/transcript") -> {
                val lines =
                    BenchFixture.page(
                        before = params["before"]?.toLongOrNull(),
                        limit = params["limit"]?.toIntOrNull() ?: 80,
                        after = params["after"]?.toLongOrNull(),
                    )
                val body = JSONArray(lines.map { org.json.JSONObject(it) })
                ByteArrayInputStream(body.toString().toByteArray())
            }
            path.endsWith("/events") -> openEventsStream(params["after"]?.toLongOrNull() ?: 0L)
            path.contains("/files/") -> {
                val name = path.substringAfterLast("/files/")
                val bytes =
                    BenchFixture.fileBytes(name)
                        ?: throw IOException("bench fixture has no file named $name")
                ByteArrayInputStream(bytes)
            }
            else -> throw IOException("bench fixture has no route for $path")
        }
    }
    /**
     * A live SSE body: [BenchFixture.linesAfter] replayed immediately, then polled every 50ms for
     * anything [BenchFixture.pushNextLiveEvent] has added since -- the same shape a real backend's
     * backlog-then-follow gives [Sse], just polled instead of woken, which is a fixture's business
     * rather than something worth a condition variable for.
     */
    private fun openEventsStream(after: Long): InputStream {
        val pipeIn = PipedInputStream(1 shl 16)
        val pipeOut = PipedOutputStream(pipeIn)
        var sent = after
        val thread = Thread {
            try {
                while (!Thread.currentThread().isInterrupted) {
                    val fresh = BenchFixture.linesAfter(sent)
                    for (line in fresh) {
                        pipeOut.write("data: $line\n\n".toByteArray())
                        pipeOut.flush()
                        sent = org.json.JSONObject(line).getLong("seq")
                    }
                    Thread.sleep(50)
                }
            } catch (_: InterruptedException) {
                // disconnect() -- the ordinary way this ends.
            } catch (_: IOException) {
                // The reader side (Sse) closed its end.
            } finally {
                try {
                    pipeOut.close()
                } catch (_: IOException) {}
            }
        }
            .also {
                it.isDaemon = true
                it.start()
            }
        writer = thread
        return pipeIn
    }
 }
@@ -1,143 +0,0 @@
 package com.example.aiapp
 import android.content.Context
 import android.os.BatteryManager
 import android.os.Process
 import androidx.compose.animation.core.tween
 import androidx.compose.foundation.gestures.animateScrollBy
 import androidx.compose.foundation.lazy.LazyListState
 import java.io.File
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.delay
 import kotlinx.coroutines.isActive
 import kotlinx.coroutines.launch
 /**
 * P0's scripted benchmark, run in-process instead of by a shell script: the phone has no usable
 * system tracing (this-machine-android's skill) and no agent can drive it, so the same scroll loop
 * and streaming phase `transcript-bench.sh`/`stream-bench.sh` drive over `ui-trace` are reproduced
 * here against [LazyListState] and [BenchFixture] directly. Only reachable from the `bench` build
 * (see [SessionSettingsDialog]'s `onRunBenchmark`), but compiled into every build for the reason
 * [BenchFixture]'s doc comment gives.
 */
 object BenchRun {
    /** transcript-bench.sh's default: 6 cycles of 4 swipes each, 900px over 200ms, 500ms apart. */
    private const val CYCLES = 6
    private const val SWIPE_PX = 900f
    private const val SWIPE_MS = 200
    private const val SWIPE_PAUSE_MS = 500L
    /** stream-bench.sh's shape: a real reply arrives as many small deltas, not one big write. */
    private const val STREAM_EVENTS_PER_SEC = 20
    private const val STREAM_SECONDS = 20
    /**
     * Scrolls, then streams, then returns the extra report lines P0 asked for (CPU time, peak RSS,
     * battery current) -- [FrameStats] and [DebugStats] are reset first, exactly as
     * `copyRenderReport` resets them, so the two accountings cover the same stretch of work.
     */
    suspend fun run(
        context: Context,
        scope: CoroutineScope,
        listState: LazyListState,
    ): List<String> {
        FrameStats.reset()
        DebugStats.reset()
        val cpuStartMs = Process.getElapsedCpuTime()
        val battery = BatterySampler(context)
        // Launched in the caller's scope rather than a fresh coroutineScope{} here, which would
        // suspend this function until the sampler job ended -- and it only ends when told to.
        val samplerJob = scope.launch {
            while (isActive) {
                battery.sample()
                delay(1000)
            }
        }
        // The swipe loop: transcript-bench.sh's four swipes per cycle are two drags toward newer
        // content and two back, so a cycle returns to where it started and the whole loop measures
        // steady-state scrolling rather than travelling somewhere new each time.
        repeat(CYCLES) {
            repeat(2) {
                listState.animateScrollBy(SWIPE_PX, tween(SWIPE_MS))
                delay(SWIPE_PAUSE_MS)
            }
            repeat(2) {
                listState.animateScrollBy(-SWIPE_PX, tween(SWIPE_MS))
                delay(SWIPE_PAUSE_MS)
            }
        }
        // Pinned to the newest end before streaming starts, the way stream-bench.sh's "Jump to
        // latest" tap is -- a reply streamed into a list parked further back arrives off-screen and
        // the report would show nothing happened.
        listState.scrollToItem(0)
        var sent = 0
        val total = STREAM_EVENTS_PER_SEC * STREAM_SECONDS
        while (sent < total && BenchFixture.remainingStreamEvents() > 0) {
            BenchFixture.pushNextLiveEvent()
            sent++
            delay(1000L / STREAM_EVENTS_PER_SEC)
        }
        // Lets the last few deltas land and draw before the report is read.
        delay(300)
        samplerJob.cancel()
        val cpuMs = Process.getElapsedCpuTime() - cpuStartMs
        val rssLine = peakRssLine()
        val batteryLine = battery.finish()
        return listOf(
            "  scroll: $CYCLES cycles (${CYCLES * 4} swipes), streamed $sent/$total fixture events",
            "  process CPU time over this run: ${cpuMs}ms",
            rssLine,
            batteryLine,
        )
    }
    /** VmHWM from /proc/self/status: the process's high-water mark, in kB, since it started. */
    private fun peakRssLine(): String {
        val kb =
            try {
                File("/proc/self/status")
                    .readLines()
                    .firstOrNull { it.startsWith("VmHWM:") }
                    ?.trim()
                    ?.removePrefix("VmHWM:")
                    ?.trim()
                    ?.removeSuffix("kB")
                    ?.trim()
                    ?.toLongOrNull()
            } catch (_: Exception) {
                null
            }
        return "  peak RSS: " +
            (kb?.let { "${it}kB" } ?: "unavailable (/proc/self/status unreadable)")
    }
 }
 /**
 * Samples [BatteryManager.BATTERY_PROPERTY_CURRENT_NOW] (microamps) once a second for the length of
 * a run. The property returns `Int.MIN_VALUE` on hardware that does not support it -- most
 * emulators -- and that is reported as "unavailable" rather than folded into an average with the
 * real samples, which would silently understate every number after it. See UI_RULES: never present
 * an inferred value as a measured one.
 */
 private class BatterySampler(context: Context) {
    private val manager = context.getSystemService(BatteryManager::class.java)
    private val samples = mutableListOf<Int>()
    fun sample() {
        val value = manager?.getIntProperty(BatteryManager.BATTERY_PROPERTY_CURRENT_NOW)
        if (value != null && value != Int.MIN_VALUE) samples.add(value)
    }
    fun finish(): String {
        if (samples.isEmpty()) return "  battery current: unavailable on this device"
        val meanUa = samples.sum() / samples.size
        return "  battery current: mean ${meanUa}µA over ${samples.size} samples" +
            " (min ${samples.min()}, max ${samples.max()})"
    }
 }
@@ -1,10 +1,15 @@
 package com.example.aiapp
 import androidx.compose.foundation.layout.PaddingValues
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material3.Button
 import androidx.compose.material3.ButtonDefaults
 import androidx.compose.material3.OutlinedButton
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.Shape
 import androidx.compose.ui.unit.dp
@@ -49,3 +54,49 @@ val BubbleShape: Shape = RoundedCornerShape(percent = 50)
 * ends that tall would bow its sides.
 */
 val BubbleMenuShape: Shape = RoundedCornerShape(20.dp)
 /**
 * A round button sized to the mark it draws.
 *
 * The composer's three actions -- attach, stop, send -- are single glyphs, and a pill's word-shaped
 * padding around one glyph was width taken from the pickers beside it: with a long model name on
 * the row, the permission mode ended up too small to hit. One diameter for all three, and it is the
 * platform's minimum touch target rather than a button's shorter default height.
 *
 * [fill] null draws the outlined form, for the one of the three that does not act on the session.
 */
@Composable
 fun CircleButton(
    onClick: () -> Unit,
    modifier: Modifier = Modifier,
    fill: Color? = null,
    enabled: Boolean = true,
    content: @Composable () -> Unit,
 ) {
    val sized = modifier.size(CircleButtonSize)
    if (fill == null) {
        OutlinedButton(
            onClick = onClick,
            enabled = enabled,
            shape = CircleShape,
            contentPadding = PaddingValues(0.dp),
            modifier = sized,
        ) {
            content()
        }
    } else {
        Button(
            onClick = onClick,
            enabled = enabled,
            shape = CircleShape,
            colors = actionButtonColors(fill),
            contentPadding = PaddingValues(0.dp),
            modifier = sized,
        ) {
            content()
        }
    }
 }
 /** How wide and tall one of those is; see [CircleButton]. */
 val CircleButtonSize = 48.dp
@@ -160,6 +160,7 @@ private val FENCE_LANGUAGES: Map<String, Language> =
        "shell" to Language.SHELL,
        "zsh" to Language.SHELL,
        "console" to Language.SHELL,
        "diff" to Language.DIFF,
        "python" to Language.PYTHON,
        "py" to Language.PYTHON,
        "javascript" to Language.JAVASCRIPT,
@@ -60,3 +60,23 @@ fun compactingLabel(seconds: Long?): String =
        seconds < 60 -> "compacting ${seconds}s"
        else -> "compacting ${seconds / 60}m ${seconds % 60}s"
    }
 /**
 * How full the session is, as the status row says it.
 *
 * Three states, not two, and the third is the one that needed the words: a session whose occupancy
 * is known and whose ceiling is not. That one keeps the bare figure, and a session with a ceiling
 * gets both — the reader can see which they are looking at. What must not happen is a missing
 * ceiling drawn as a number, or as a proportion of some assumed window, which would be this screen
 * inventing the very fact it does not have.
 *
 * A llama.cpp session always has one, since the window is a flag its own server was started with. A
 * coding CLI's is the vendor's business and neither control protocol states it, so those keep the
 * bare figure they have always had.
 */
 fun contextLabel(held: Long?, limit: Long?): String =
    when {
        held == null -> "context unknown"
        limit == null -> "context ${tokens(held)}"
        else -> "context ${tokens(held)} / ${tokens(limit)}"
    }
@@ -127,13 +127,6 @@ fun debugReport(
    frames: List<String>,
    accounting: List<String>,
    crash: String?,
    /**
     * P0's benchmark-only measurements (process CPU time, peak RSS, battery current) -- empty on
     * every path but [BenchRun.runP0Benchmark], which is the only caller that has them. A section
     * heading only appears when there is something to put under it, so an ordinary copy from the
     * render-report button reads exactly as it did before this existed.
     */
    extra: List<String> = emptyList(),
 ): String = buildString {
    appendLine("ai-app render report")
    appendLine(device)
@@ -159,11 +152,6 @@ fun debugReport(
    appendLine("work since this was last copied:")
    val work = DebugStats.lines()
    if (work.isEmpty()) appendLine("  nothing recorded") else work.forEach { appendLine(it) }
    if (extra.isNotEmpty()) {
        appendLine()
        appendLine("bench:")
        extra.forEach { appendLine(it) }
    }
 }
 /** Puts [text] on the clipboard under [label], which is what the system offers as its name. */
@@ -40,6 +40,28 @@ fun TranscriptDivider(text: String, color: Color, modifier: Modifier = Modifier)
    }
 }
 /**
 * The rule between two replies that met with nothing said in between -- see
 * [TranscriptItem.TurnBreak].
 *
 * No words and no colour. Every other divider here reports something that happened and is worth
 * finding by scanning; this one only says "these are two", and it appears once per turn that
 * started without anybody typing. Saying more was a screenful of announcements about background
 * work the reader was not asking after -- one of them a whole shell command, drawn as centred prose
 * because the words came from somewhere that had no reason to keep them short.
 *
 * The outline colour is the scheme's one for structure rather than for meaning, which is what this
 * is. Inset from both edges so it reads as a separator between two rows rather than as the top edge
 * of the one under it.
 */
@Composable
 fun TurnBreakRow(modifier: Modifier = Modifier) {
    HorizontalDivider(
        modifier.fillMaxWidth().padding(horizontal = 48.dp, vertical = 6.dp),
        color = MaterialTheme.colorScheme.outlineVariant,
    )
 }
 /**
 * The mark a clear leaves.
 *
@@ -61,6 +61,24 @@ sealed class SessionEvent {
    data class AssistantText(val delta: String) : SessionEvent()
    /** The durable value of the open assistant message, replacing its provisional deltas. */
    data class AssistantTextFinal(val text: String) : SessionEvent()
    /**
     * The model's working, streamed the way its reply is: its own card, and deliberately not part
     * of what the session said. Only a provider that actually streams its reasoning sends it.
     */
    data class Thinking(val delta: String) : SessionEvent()
    /**
     * The thinking above this finished, having taken [ms].
     *
     * Measured by the driver, because only it can see when the model stopped: this app knows when
     * an event *arrived*, and the last fragment of a block followed by a slow tool call looks
     * exactly like thinking that went on that long.
     */
    data class ThinkingDone(val ms: Long) : SessionEvent()
    data class ToolStart(val id: String, val tool: String, val input: String) : SessionEvent()
    data class ToolUpdate(val id: String, val output: String) : SessionEvent()
@@ -108,6 +126,26 @@ sealed class SessionEvent {
        val turnStart: Long? = null,
    ) : SessionEvent()
    /**
     * A line in the transcript this build cannot read: a kind a newer server wrote, or one an older
     * server wrote that has since been dropped.
     *
     * [kind] is the word the line called itself, so the row can say what is missing rather than
     * that something is. The server makes these when reading; no driver sends one.
     */
    data class Unreadable(val kind: String) : SessionEvent()
    /**
     * Retired on 2026-09-06, hours after it was added: a background task finishing, which turned
     * out to be a screenful of notices about work nobody was asking after.
     *
     * Kept because a transcript is append-only -- the sessions that ran a background task in that
     * window have these lines for ever. It draws no row, which is the whole reason it is still
     * named here rather than left to fall through to [Unknown]: that would draw a placeholder per
     * background task, which is the same wall the row was removed for.
     */
    object RetiredTaskNote : SessionEvent()
    /**
     * A command the session was asked to run on itself and cannot run yet. Resolved by
     * [CommandSent] with the same id; a command that ran straight away has only that one.
@@ -117,6 +155,9 @@ sealed class SessionEvent {
    /** The same command, handed to the session. */
    data class CommandSent(val id: String, val text: String) : SessionEvent()
    /** Provider-reported number of background tasks alive now. */
    data class BackgroundTasks(val count: Int) : SessionEvent()
    data class Status(val state: String) : SessionEvent()
    /**
@@ -135,7 +176,25 @@ sealed class SessionEvent {
     * so adding turns up would report a figure the session stopped being true of. Null where the
     * dialect did not say, which leaves the context unmeasured rather than unchanged.
     */
-    data class UsageDelta(val tokens: Long, val context: Long?) : SessionEvent()
+    data class UsageDelta(
        val tokens: Long,
        val context: Long?,
        /**
         * How fast the reply came out, where the provider measured it -- null everywhere else,
         * which is most of them. Never worked out here: the time this app watched a reply arrive
         * over includes the network and whatever the server was doing between tokens.
         */
        val tokensPerSecond: Double? = null,
        /**
         * How long the provider spent reading the prompt before it began answering; null where
         * nothing measured it. The same rule as [tokensPerSecond]: the provider's own figure, or
         * nothing at all.
         */
        val prefillMs: Long? = null,
    ) : SessionEvent()
    /** How much context this session's model has, which is what [UsageDelta.context] is out of. */
    data class ContextWindow(val tokens: Long) : SessionEvent()
    /**
     * A compaction that finished, and how much context it recovered.
@@ -169,6 +228,8 @@ sealed class SessionEvent {
     */
    data class LimitReached(val resetsAt: Double?) : SessionEvent()
    data class AuthenticationRequired(val message: String) : SessionEvent()
    data class Error(val message: String) : SessionEvent()
    /**
@@ -205,6 +266,9 @@ fun parseSeqEvent(json: String): SeqEvent {
                )
            "messageDropped" -> SessionEvent.MessageDropped(body.getString("id"))
            "assistantText" -> SessionEvent.AssistantText(body.getString("delta"))
            "assistantTextFinal" -> SessionEvent.AssistantTextFinal(body.getString("text"))
            "thinking" -> SessionEvent.Thinking(body.getString("delta"))
            "thinkingDone" -> SessionEvent.ThinkingDone(body.getLong("ms"))
            "toolStart" ->
                SessionEvent.ToolStart(
                    id = body.getString("id"),
@@ -252,19 +316,25 @@ fun parseSeqEvent(json: String): SeqEvent {
                    body.getString("text"),
                    if (body.has("turnStart")) body.getLong("turnStart") else null,
                )
            "unreadable" -> SessionEvent.Unreadable(body.getString("kind"))
            "taskNote" -> SessionEvent.RetiredTaskNote
            "commandQueued" ->
                SessionEvent.CommandQueued(body.getString("id"), body.getString("text"))
            "commandSent" -> SessionEvent.CommandSent(body.getString("id"), body.getString("text"))
            "backgroundTasks" -> SessionEvent.BackgroundTasks(body.getInt("count"))
            "status" -> SessionEvent.Status(body.getString("state"))
            "settings" ->
                SessionEvent.Settings(
                    model = body.optString("model").ifEmpty { null },
                    permissionMode = body.optString("permissionMode").ifEmpty { null },
                )
            "contextWindow" -> SessionEvent.ContextWindow(body.getLong("tokens"))
            "usageDelta" ->
                SessionEvent.UsageDelta(
                    body.getLong("tokens"),
                    if (body.has("context")) body.getLong("context") else null,
                    if (body.has("tokensPerSecond")) body.getDouble("tokensPerSecond") else null,
                    if (body.has("prefillMs")) body.getLong("prefillMs") else null,
                )
            "compacted" ->
                SessionEvent.Compacted(
@@ -277,6 +347,8 @@ fun parseSeqEvent(json: String): SeqEvent {
                SessionEvent.LimitReached(
                    if (body.has("resetsAt")) body.getDouble("resetsAt") else null
                )
            "authenticationRequired" ->
                SessionEvent.AuthenticationRequired(body.getString("message"))
            "error" -> SessionEvent.Error(body.getString("message"))
            else -> SessionEvent.Unknown(type)
        }
@@ -291,7 +363,21 @@ fun parseSeqEvent(json: String): SeqEvent {
 * first time the server grows a state, and the drift would be a reply that never splits or one
 * split mid-stream.
 */
-fun sessionWorking(state: String): Boolean = state == "running" || state == "compacting"
+fun sessionWorking(state: String): Boolean =
    state == "running" || state == "compacting" || state == "loading" || state == "reading"
 /** Whether the latest events still say this session needs an explicit provider login. */
 internal fun authenticationPromptAfter(open: Boolean, event: SessionEvent): Boolean =
    when (event) {
        is SessionEvent.AuthenticationRequired -> true
        // A later provider response proves an older authentication failure in a replayed page is
        // no longer current. Without this, one old failure reopened sign-in after every later
        // successful turn.
        is SessionEvent.AssistantText,
        is SessionEvent.AssistantTextFinal,
        is SessionEvent.ToolStart -> false
        else -> open
    }
 /**
 * The context after [event], given what it was before.
@@ -315,3 +401,18 @@ fun contextAfter(current: Long?, event: SessionEvent): Long? =
        is SessionEvent.Cleared -> null
        else -> current
    }
 /**
 * The context window after [event], mirroring the server's `context_limit_after` for the same
 * reason [contextAfter] mirrors its neighbour: the screen has to keep up between page loads.
 *
 * A window belongs to the process, so a session whose process has exited has none — left standing,
 * a session restarted on a different model would draw its occupancy against the old model's
 * ceiling.
 */
 fun contextLimitAfter(current: Long?, event: SessionEvent): Long? =
    when (event) {
        is SessionEvent.ContextWindow -> event.tokens
        is SessionEvent.Status -> if (event.state == "exited") null else current
        else -> current
    }
@@ -44,26 +44,46 @@ import kotlinx.coroutines.withContext
 /**
 * Which machine's files to show, and where to start.
 *
- * A **setup**, not a session: a filesystem is a property of a machine, and a session only says
+ * A **machine**, not a session: a filesystem is a property of a machine, and a session only says
- * where it was working. That is what makes a second way in -- from the setups tab -- one more
+ * where it was working. That is what makes a second way in -- from the machines tab -- one more
 * caller rather than any new code here.
 */
-data class FilesTarget(val setup: String, val setupName: String, val start: String)
+data class FilesTarget(
    val machine: String,
    val machineName: String,
    val start: String,
    /** A document to open immediately; [start] remains the fallback directory. */
    val file: String? = null,
 )
 /** The explorer target for this session's machine, optionally opened on [file]. */
 fun SessionSummary.filesTarget(file: String? = null) =
    FilesTarget(
        machine = machine,
        machineName = machineName,
        start = cwd?.takeIf { it.isNotBlank() } ?: "~",
        file = file,
    )
 /** Where the explorer is: in a directory, or in one file. */
 private sealed class Spot(val path: String) {
    class Dir(path: String) : Spot(path)
-    class Doc(path: String) : Spot(path)
+    class Doc(path: String, val directory: Dir) : Spot(path)
 }
 private enum class UnsavedDestination {
    Directory,
    Session,
 }
 /**
 * The files on the machine a session runs on: browse them, read one, change one.
 *
 * Drawn **over** the session rather than instead of it (see [AppRoot]), so its event stream keeps
- * flowing and coming back from a file costs nothing. Back steps one level inside here -- editor to
+ * flowing and coming back from a file costs nothing. Both back controls return from a file to its
- * viewer, viewer to the directory it came from, directory to the one above -- and only closes from
+ * directory. In a directory, Android back walks toward the session's project directory and closes
- * where it opened.
+ * the explorer once it gets there; the header's back button closes it immediately.
 *
 * Every directory that has been visited is kept for as long as this is open; the refresh glyph is
 * how one gets asked again on purpose, and creating something refetches the directory it was
@@ -72,51 +92,82 @@ private sealed class Spot(val path: String) {
@Composable
 fun FilesScreen(settings: ServerSettings, target: FilesTarget, onClose: () -> Unit) {
    val scope = rememberCoroutineScope()
-    var stack by remember { mutableStateOf(listOf<Spot>(Spot.Dir(target.start))) }
+    val initialDirectory =
        target.file?.let(::parentOf)?.let { Spot.Dir(it) } ?: Spot.Dir(target.start)
    var here by
        remember(target) {
            mutableStateOf<Spot>(
                target.file?.let { Spot.Doc(it, initialDirectory) } ?: initialDirectory
            )
        }
    val listings = remember { mutableStateMapOf<String, LoadState<Listing>>() }
    var creating by remember { mutableStateOf(false) }
    // Edit mode and whether anything has been typed live here rather than in the pane below,
-    // because they are what back has to know about -- and back arrives from two places, the arrow
+    // because both ways out have to ask before discarding it.
    // and the platform's own gesture, which must mean the same thing.
    var editing by remember { mutableStateOf(false) }
    var dirty by remember { mutableStateOf(false) }
-    var askUnsaved by remember { mutableStateOf(false) }
+    var unsavedDestination by remember { mutableStateOf<UnsavedDestination?>(null) }
    val here = stack.last()
    fun go(spot: Spot) {
        editing = false
        dirty = false
-        stack = stack + spot
+        here = spot
    }
-    fun back() {
+    fun leave(destination: UnsavedDestination) {
-        when {
+        if (editing && dirty) {
-            editing && dirty -> askUnsaved = true
+            unsavedDestination = destination
-            editing -> editing = false
+        } else if (destination == UnsavedDestination.Directory) {
-            stack.size > 1 -> {
+            go((here as Spot.Doc).directory)
-                stack = stack.dropLast(1)
+        } else {
-                editing = false
+            onClose()
                dirty = false
            }
            else -> onClose()
        }
    }
    suspend fun load(path: String, again: Boolean) {
-        if (!again && listings[path] is LoadState.Loaded) return
+        val existing = listings[path]
        if (!again && (existing is LoadState.Loaded || existing is LoadState.Loading)) return
        listings[path] = LoadState.Loading
        listings[path] =
            try {
                withContext(Dispatchers.IO) {
-                    LoadState.Loaded(fetchDir(settings, target.setup, path))
+                    LoadState.Loaded(fetchDir(settings, target.machine, path))
                }
            } catch (e: ApiException) {
                LoadState.failed(e)
            }
    }
-    BackHandler(onBack = ::back)
+    val projectDirectory = (listings[target.start] as? LoadState.Loaded)?.value?.path
    val homeDirectory =
        if (target.start == "~") projectDirectory
        else (listings["~"] as? LoadState.Loaded)?.value?.path
    fun systemBack() {
        when (val spot = here) {
            is Spot.Doc -> leave(UnsavedDestination.Directory)
            is Spot.Dir -> {
                val path = (listings[spot.path] as? LoadState.Loaded)?.value?.path ?: spot.path
                when {
                    path == projectDirectory || path == target.start -> onClose()
                    projectDirectory != null ->
                        nextDirectoryToward(path, projectDirectory)?.let { go(Spot.Dir(it)) }
                            ?: onClose()
                    else -> parentOf(path)?.let { go(Spot.Dir(it)) } ?: onClose()
                }
            }
        }
    }
    // A file link can open without visiting the project first, but Back still needs to know where
    // the project is. Home is likewise resolved by the machine rather than guessed on the phone;
    // it is what lets every path beneath it be displayed with `~`, including over ssh.
    LaunchedEffect(target.machine, target.start) {
        if (target.file != null) load(target.start, again = false)
        if (target.start != "~") load("~", again = false)
    }
    BackHandler(onBack = ::systemBack)
    Box(
        Modifier.fillMaxSize()
@@ -129,14 +180,15 @@ fun FilesScreen(settings: ServerSettings, target: FilesTarget, onClose: () -> Un
            when (val spot = here) {
                is Spot.Dir -> {
                    val state = listings[spot.path] ?: LoadState.Loading
-                    // The resolved path once there is one: a directory opened as `~` is called what
+                    // Navigate with the resolved path, but name anything under the machine's home
-                    // it turned out to be, not what it was asked for.
+                    // the way somebody working there would write it.
                    val at = (state as? LoadState.Loaded)?.value?.path ?: spot.path
                    val shownAt = tildePath(at, homeDirectory)
                    FilesHeader(
-                        title = baseName(at),
+                        title = baseName(shownAt),
-                        path = at,
+                        path = shownAt,
-                        machine = target.setupName,
+                        machine = target.machineName,
-                        onBack = ::back,
+                        onBack = { leave(UnsavedDestination.Session) },
                    ) {
                        GlyphButton(
                            REFRESH_GLYPH,
@@ -152,7 +204,7 @@ fun FilesScreen(settings: ServerSettings, target: FilesTarget, onClose: () -> Un
                        )
                    }
                    LaunchedEffect(spot.path) { load(spot.path, again = false) }
-                    DirectoryBody(state, onOpen = ::go)
+                    DirectoryBody(state, directory = spot, onOpen = ::go)
                }
                is Spot.Doc ->
                    DocPane(
@@ -161,22 +213,26 @@ fun FilesScreen(settings: ServerSettings, target: FilesTarget, onClose: () -> Un
                        path = spot.path,
                        name = baseName(spot.path),
                        editing = editing,
                        homeDirectory = homeDirectory,
                        onEditing = { editing = it },
                        onDirty = { dirty = it },
-                        onBack = ::back,
+                        onBack = { leave(UnsavedDestination.Directory) },
                    )
            }
        }
    }
-    if (askUnsaved) {
+    unsavedDestination?.let { destination ->
        UnsavedDialog(
            onDiscard = {
-                askUnsaved = false
+                unsavedDestination = null
-                editing = false
+                if (destination == UnsavedDestination.Directory) {
-                dirty = false
+                    go((here as Spot.Doc).directory)
                } else {
                    onClose()
                }
            },
-            onCancel = { askUnsaved = false },
+            onCancel = { unsavedDestination = null },
        )
    }
@@ -185,7 +241,7 @@ fun FilesScreen(settings: ServerSettings, target: FilesTarget, onClose: () -> Un
    if (creating && dir != null && listing != null) {
        CreateDialog(
            settings = settings,
-            setup = target.setup,
+            machine = target.machine,
            directory = listing.path,
            onDismiss = { creating = false },
            onCreated = { path, isDirectory ->
@@ -196,7 +252,7 @@ fun FilesScreen(settings: ServerSettings, target: FilesTarget, onClose: () -> Un
                    load(dir.path, again = true)
                    // A new file has nothing to look at, so it opens where it can be filled in.
                    if (!isDirectory) {
-                        go(Spot.Doc(path))
+                        go(Spot.Doc(path, dir))
                        editing = true
                    }
                }
@@ -248,7 +304,11 @@ private fun FilesHeader(
 * looks like a right one.
 */
@Composable
-private fun ColumnScope.DirectoryBody(state: LoadState<Listing>, onOpen: (Spot) -> Unit) {
+private fun ColumnScope.DirectoryBody(
    state: LoadState<Listing>,
    directory: Spot.Dir,
    onOpen: (Spot) -> Unit,
 ) {
    when (state) {
        is LoadState.Loading -> CircularProgressIndicator(Modifier.padding(16.dp))
        is LoadState.Error ->
@@ -289,7 +349,9 @@ private fun ColumnScope.DirectoryBody(state: LoadState<Listing>, onOpen: (Spot)
                        name = entry.name,
                        trailing = trailingOf(entry),
                        onClick = {
-                            onOpen(if (entry.isDirectory) Spot.Dir(path) else Spot.Doc(path))
+                            onOpen(
                                if (entry.isDirectory) Spot.Dir(path) else Spot.Doc(path, directory)
                            )
                        },
                    )
                }
@@ -357,6 +419,7 @@ private fun ColumnScope.DocPane(
    path: String,
    name: String,
    editing: Boolean,
    homeDirectory: String?,
    onEditing: (Boolean) -> Unit,
    onDirty: (Boolean) -> Unit,
    onBack: () -> Unit,
@@ -381,7 +444,7 @@ private fun ColumnScope.DocPane(
        state = LoadState.Loading
        state =
            try {
-                val got = withContext(Dispatchers.IO) { fetchFile(settings, target.setup, path) }
+                val got = withContext(Dispatchers.IO) { fetchFile(settings, target.machine, path) }
                if (got is FileContent.Text) draft = TextFieldValue(got.content)
                LoadState.Loaded(got)
            } catch (e: ApiException) {
@@ -404,7 +467,7 @@ private fun ColumnScope.DocPane(
            try {
                val written =
                    withContext(Dispatchers.IO) {
-                        writeFile(settings, target.setup, path, draft.text, against)
+                        writeFile(settings, target.machine, path, draft.text, against)
                    }
                state =
                    LoadState.Loaded(
@@ -430,7 +493,12 @@ private fun ColumnScope.DocPane(
        }
    }
-    FilesHeader(title = name, path = path, machine = target.setupName, onBack = onBack) {
+    FilesHeader(
        title = name,
        path = tildePath(path, homeDirectory),
        machine = target.machineName,
        onBack = onBack,
    ) {
        if (editing) {
            if (saving) {
                GlyphSpinner("Saving")
@@ -527,7 +595,9 @@ private fun ColumnScope.DocPane(
                scope.launch {
                    val fresh =
                        try {
-                            withContext(Dispatchers.IO) { fetchFile(settings, target.setup, path) }
+                            withContext(Dispatchers.IO) {
                                fetchFile(settings, target.machine, path)
                            }
                        } catch (e: ApiException) {
                            saveError = e.message
                            conflict = null
@@ -571,7 +641,7 @@ private fun Note(text: String) {
@Composable
 private fun CreateDialog(
    settings: ServerSettings,
-    setup: String,
+    machine: String,
    directory: String,
    onDismiss: () -> Unit,
    onCreated: (String, Boolean) -> Unit,
@@ -591,8 +661,8 @@ private fun CreateDialog(
        scope.launch {
            try {
                withContext(Dispatchers.IO) {
-                    if (isDirectory) createDir(settings, setup, path)
+                    if (isDirectory) createDir(settings, machine, path)
-                    else createFile(settings, setup, path)
+                    else createFile(settings, machine, path)
                }
                onCreated(path, isDirectory)
            } catch (e: ApiException) {
@@ -678,6 +748,35 @@ internal fun parentOf(path: String): String? {
    }
 }
 /**
 * The next directory on the filesystem path from [current] to [destination], or null when there.
 *
 * Moving between two branches first walks upward to their common ancestor. Once [current] is that
 * ancestor, the next press walks one segment down toward [destination]. Both paths are answers from
 * the machine, so they are absolute and have no symlinks or `..` left to resolve here.
 */
 internal fun nextDirectoryToward(current: String, destination: String): String? {
    val here = current.trimEnd('/').ifEmpty { "/" }
    val there = destination.trimEnd('/').ifEmpty { "/" }
    if (here == there) return null
    val beneathHere = if (here == "/") there.startsWith('/') else there.startsWith("$here/")
    if (!beneathHere) return parentOf(here)
    val next = there.removePrefix(here).trimStart('/').substringBefore('/')
    return join(here, next)
 }
 /** A path as somebody on [home] writes it, leaving paths outside that home unchanged. */
 internal fun tildePath(path: String, home: String?): String {
    val at = path.trimEnd('/').ifEmpty { "/" }
    val resolvedHome = home?.trimEnd('/')?.ifEmpty { "/" } ?: return at
    return when {
        at == resolvedHome -> "~"
        resolvedHome != "/" && at.startsWith("$resolvedHome/") ->
            "~${at.removePrefix(resolvedHome)}"
        else -> at
    }
 }
 /** What a path names: its last segment, with `/` naming itself. */
 internal fun baseName(path: String): String {
    val trimmed = path.trimEnd('/')
@@ -7,6 +7,8 @@ import androidx.compose.ui.text.buildAnnotatedString
 /** What a span of code is, in the terms the palette has a colour for. */
 enum class Kind {
    ADDITION,
    DELETION,
    KEYWORD,
    STRING,
    LITERAL,
@@ -24,6 +26,8 @@ data class Span(val start: Int, val end: Int, val kind: Kind)
 * one instance and lives with the rest of the palette.
 */
 data class SyntaxPalette(
    val addition: Color,
    val deletion: Color,
    val keyword: Color,
    val string: Color,
    val literal: Color,
@@ -34,6 +38,8 @@ data class SyntaxPalette(
 ) {
    fun of(kind: Kind): Color =
        when (kind) {
            Kind.ADDITION -> addition
            Kind.DELETION -> deletion
            Kind.KEYWORD -> keyword
            Kind.STRING -> string
            Kind.LITERAL -> literal
@@ -44,6 +50,26 @@ data class SyntaxPalette(
        }
 }
 /** A unified diff is line-oriented: colour the changed lines and leave context untouched. */
 fun scanDiff(code: String): List<Span> {
    val spans = ArrayList<Span>()
    var start = 0
    while (start < code.length) {
        val end = code.indexOf('\n', start).let { if (it == -1) code.length else it }
        val kind =
            when {
                code.startsWith("+++", start) || code.startsWith("---", start) -> Kind.METADATA
                code.startsWith("+", start) -> Kind.ADDITION
                code.startsWith("-", start) -> Kind.DELETION
                code.startsWith("@@", start) -> Kind.METADATA
                else -> null
            }
        if (kind != null) spans.add(Span(start, end, kind))
        start = if (end == code.length) end else end + 1
    }
    return spans
 }
 /**
 * [code] with its keywords, strings and comments coloured, or plain if there is no language for it.
 *
@@ -82,8 +82,8 @@ private const val SETTLE_MS = 500L
@Composable
 fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (SessionSummary) -> Unit) {
    val scope = rememberCoroutineScope()
-    var setups by remember { mutableStateOf<LoadState<List<Setup>>>(LoadState.Loading) }
+    var machines by remember { mutableStateOf<LoadState<List<Machine>>>(LoadState.Loading) }
-    var chosen by remember { mutableStateOf<Setup?>(null) }
+    var chosen by remember { mutableStateOf<Machine?>(null) }
    var sessions by remember { mutableStateOf<LoadState<List<Importable>>>(LoadState.Loading) }
    // What is happening to each row right now, as the word the row shows. A map keyed by id rather
@@ -100,9 +100,8 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
    // Deleting a transcript cannot be undone, so it is asked rather than done. Held as the rows
    // themselves, not a flag, so the dialog can say what it is about.
    var confirming by remember { mutableStateOf<List<Importable>?>(null) }
-    // Same default as the spawn screen: a phone is the wrong place to answer "allow Bash?" forty
+    // Set from the selected Claude provider rather than repeated in the app.
-    // times.
+    var permissionMode by remember { mutableStateOf("") }
    var permissionMode by remember { mutableStateOf("auto") }
    // When each row last slid upwards, as a plain map rather than state: nothing is drawn from it,
    // so a tap reading it needs no recomposition.
    val movedAt = remember { mutableMapOf<String, Long>() }
@@ -114,9 +113,9 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
     * Taken from the answer rather than kept across the load: the server is what knows what is
     * running, and this screen may be opening on work another phone started.
     */
-    suspend fun fetchInto(setup: Setup): LoadState<List<Importable>> =
+    suspend fun fetchInto(machine: Machine): LoadState<List<Importable>> =
        try {
-            val rows = withContext(Dispatchers.IO) { fetchImportable(settings, setup.id) }
+            val rows = withContext(Dispatchers.IO) { fetchImportable(settings, machine.id) }
            running = rows.mapNotNull { row -> row.pending?.let { row.id to it } }.toMap()
            rowErrors = rows.mapNotNull { row -> row.error?.let { row.id to it } }.toMap()
            LoadState.Loaded(rows)
@@ -124,10 +123,10 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
            LoadState.Error(err.message ?: "Couldn't list sessions")
        }
-    fun loadSessions(setup: Setup) {
+    fun loadSessions(machine: Machine) {
        sessions = LoadState.Loading
        selected = emptySet()
-        scope.launch { sessions = fetchInto(setup) }
+        scope.launch { sessions = fetchInto(machine) }
    }
    /** Takes a row out of the list, once the machine no longer has it to offer. */
@@ -141,9 +140,9 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
    }
    LaunchedEffect(reloadToken) {
-        setups =
+        machines =
            try {
-                val found = withContext(Dispatchers.IO) { fetchSetups(settings) }
+                val found = withContext(Dispatchers.IO) { fetchMachines(settings) }
                found.firstOrNull()?.let {
                    chosen = it
                    loadSessions(it)
@@ -171,7 +170,7 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
        selected = emptySet()
        running = running + targets.associate { it.id to WAITING }
        rowErrors = rowErrors - targets.map { it.id }.toSet()
-        val setup = chosen
+        val machine = chosen
        val ids = targets.map { it.id }
        scope.launch {
            // One request for the whole batch, not one per row. Sent row by row, a handover was
@@ -198,25 +197,28 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
            // The listing is the repair, because it carries the same state the events do. Only when
            // something still looks outstanding, so the ordinary case does not pay for a second
            // listing, which is the most expensive call this screen makes.
-            if (setup != null && targets.any { running.containsKey(it.id) }) {
+            if (machine != null && targets.any { running.containsKey(it.id) }) {
                // Quietly: no Loading, because blanking the list to report on rows that are already
                // saying what is happening to them is the flicker this screen avoids everywhere
                // else.
-                sessions = fetchInto(setup)
+                sessions = fetchInto(machine)
            }
        }
    }
    val provider = chosen?.providers?.firstOrNull { it.kind == "claude_cli" }
    LaunchedEffect(chosen?.id, provider?.name) {
        permissionMode = provider?.defaultPermissionMode.orEmpty()
    }
    /** Continues [targets] in the background, leaving the screen where it is. */
    fun importAll(targets: List<Importable>) {
-        val setup = chosen ?: return
+        val machine = chosen ?: return
        val useProvider = provider ?: return
        handOver(targets) { ids ->
            startImport(
                settings,
-                setup = setup.id,
+                machine = machine.id,
                sessionIds = ids,
                provider = useProvider.name,
                permissionMode = permissionMode,
@@ -232,7 +234,7 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
     * it, which is the case where waiting is the right thing anyway.
     */
    fun importAndOpen(target: Importable) {
-        val setup = chosen ?: return
+        val machine = chosen ?: return
        val useProvider = provider ?: return
        running = running + (target.id to IMPORTING)
        rowErrors = rowErrors - target.id
@@ -242,7 +244,7 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
                    withContext(Dispatchers.IO) {
                        spawnSession(
                            settings,
-                            setup = setup.id,
+                            machine = machine.id,
                            provider = useProvider.name,
                            // Nothing to say: the server titles it from the session it continues.
                            title = "",
@@ -270,10 +272,10 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
        java.util.concurrent.atomic.AtomicReference<ImportableStream?>(null)
    }
    LaunchedEffect(chosen?.id) {
-        val setup = chosen?.id ?: return@LaunchedEffect
+        val machine = chosen?.id ?: return@LaunchedEffect
        try {
            while (true) {
-                val stream = ImportableStream(settings, setup)
+                val stream = ImportableStream(settings, machine)
                liveChanges.set(stream)
                try {
                    withContext(Dispatchers.IO) {
@@ -341,24 +343,24 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
            )
            Spacer(Modifier.height(12.dp))
-            when (val loaded = setups) {
+            when (val loaded = machines) {
                is LoadState.Loading -> CircularProgressIndicator()
                is LoadState.Error -> Text(loaded.message, color = MaterialTheme.colorScheme.error)
                is LoadState.Loaded -> {
                    // Only worth choosing when there is a choice.
                    if (loaded.value.size > 1) {
                        Row(Modifier.fillMaxWidth()) {
-                            loaded.value.forEach { setup ->
+                            loaded.value.forEach { machine ->
                                TextButton(
                                    onClick = {
-                                        chosen = setup
+                                        chosen = machine
-                                        loadSessions(setup)
+                                        loadSessions(machine)
                                    }
                                ) {
                                    Text(
-                                        setup.name,
+                                        machine.name,
                                        color =
-                                            if (setup.id == chosen?.id)
+                                            if (machine.id == chosen?.id)
                                                MaterialTheme.colorScheme.primary
                                            else MaterialTheme.colorScheme.onSurfaceVariant,
                                    )
@@ -375,7 +377,7 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
                    } else {
                        ChipGroup(
                            label = "Permissions",
-                            options = PERMISSION_MODES,
+                            options = provider?.permissionModes.orEmpty(),
                            selected = permissionMode,
                            onSelect = { permissionMode = it },
                        )
@@ -439,9 +441,9 @@ fun ImportScreen(settings: ServerSettings, reloadToken: Int, onImported: (Sessio
            confirmButton = {
                TextButton(
                    onClick = {
-                        val setup = chosen ?: return@TextButton
+                        val machine = chosen ?: return@TextButton
                        confirming = null
-                        handOver(targets) { ids -> deleteImportable(settings, setup.id, ids) }
+                        handOver(targets) { ids -> deleteImportable(settings, machine.id, ids) }
                    }
                ) {
                    // Coloured by consequence: this takes something away, wherever it appears.
@@ -12,13 +12,13 @@ package com.example.aiapp
 * the caller owns reconnecting -- there is no cursor to resume from, because anything missed is in
 * the next listing.
 */
-class ImportableStream(settings: ServerSettings, private val setup: String) {
+class ImportableStream(settings: ServerSettings, private val machine: String) {
    private val stream = Sse(settings)
    fun close() = stream.close()
    fun run(onOpen: () -> Unit, onChange: (ImportableChange) -> Unit) {
-        stream.run("/setups/$setup/importable/events", onOpen) { _, data ->
+        stream.run("/machines/$machine/importable/events", onOpen) { _, data ->
            if (data.isNotEmpty()) parseImportableChange(data)?.let(onChange)
        }
    }
@@ -16,6 +16,7 @@ enum class Language {
    CPP,
    CSHARP,
    DART,
    DIFF,
    FISH,
    GO,
    JAVA,
@@ -100,7 +101,7 @@ fun spansOf(code: String, language: Language): List<Span> = SCANNERS.getValue(la
 // Lazy for the same reason [RULES] is, since it reads it.
 private val SCANNERS: Map<Language, (String) -> List<Span>> by lazy {
    RULES.mapValues { (_, rules) -> { code: String -> scan(code, rules) } } +
-        mapOf(Language.MARKDOWN to ::scanMarkdown)
+        mapOf(Language.DIFF to ::scanDiff, Language.MARKDOWN to ::scanMarkdown)
 }
 private val C_STYLE = BlockComment("/*", "*/", nests = false)
@@ -0,0 +1,404 @@
 package com.example.aiapp
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.lazy.LazyListScope
 import androidx.compose.foundation.text.KeyboardActions
 import androidx.compose.foundation.text.KeyboardOptions
 import androidx.compose.material3.Card
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.LinearProgressIndicator
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.Stable
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.LocalSoftwareKeyboardController
 import androidx.compose.ui.text.input.ImeAction
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.delay
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 /**
 * The models on one machine, the downloads putting more there, and HuggingFace to find them in.
 *
 * This was a tab of its own, about the backend's own disk. It moved under the machine's llama.cpp
 * provider on 2026-09-19, when a download came to run on the machine that will serve the file:
 * there is no such thing as "the models", only this machine's, and the screen that decides how a
 * model is loaded is the screen that should be able to fetch one.
 *
 * Everything here is the machine's state rather than this screen's. A download is a process on that
 * machine with its progress written beside the partial file, so closing the app, locking the phone
 * or restarting the backend does not touch it, and a second device watching sees the same numbers.
 */
@Stable
 class MachineModelsState(
    private val settings: ServerSettings,
    private val machineId: String,
    private val scope: CoroutineScope,
 ) {
    var state by mutableStateOf<LoadState<Models>>(LoadState.Loading)
        private set
    var query by mutableStateOf("")
    var results by mutableStateOf<LoadState<List<RemoteRepo>>?>(null)
        private set
    var openRepo by mutableStateOf<String?>(null)
        private set
    var repoFiles by mutableStateOf<LoadState<List<RemoteFile>>?>(null)
        private set
    /** What the last action said went wrong, shown above the list that action was taken in. */
    var actionError by mutableStateOf<String?>(null)
        private set
    val models: Models?
        get() = (state as? LoadState.Loaded)?.value
    val downloads: List<Download>
        get() = models?.downloads.orEmpty()
    /** How big each downloaded model is, by key, for the cards the provider screen draws. */
    val sizes: Map<String, Long>
        get() = models?.local.orEmpty().associate { it.key to it.bytes }
    suspend fun reload() {
        state =
            try {
                withContext(Dispatchers.IO) {
                    LoadState.Loaded(fetchMachineModels(settings, machineId))
                }
            } catch (e: ApiException) {
                LoadState.failed(e)
            }
    }
    /** Runs [action], says what it said if it failed, and asks the machine again either way. */
    private fun act(action: suspend () -> Unit) {
        scope.launch {
            actionError =
                runCatching { withContext(Dispatchers.IO) { action() } }.exceptionOrNull()?.message
            reload()
        }
    }
    fun search() {
        openRepo = null
        results = LoadState.Loading
        scope.launch {
            results =
                try {
                    withContext(Dispatchers.IO) { LoadState.Loaded(searchModels(settings, query)) }
                } catch (e: ApiException) {
                    LoadState.failed(e)
                }
        }
    }
    fun toggleRepo(repo: String) {
        if (openRepo == repo) {
            openRepo = null
            return
        }
        openRepo = repo
        repoFiles = LoadState.Loading
        scope.launch {
            repoFiles =
                try {
                    withContext(Dispatchers.IO) {
                        LoadState.Loaded(fetchRepoFiles(settings, machineId, repo))
                    }
                } catch (e: ApiException) {
                    LoadState.failed(e)
                }
        }
    }
    fun download(repo: String, file: String) = act {
        startDownload(settings, machineId, repo, file)
    }
    fun cancel(key: String) = act { cancelDownload(settings, machineId, key) }
    fun remove(key: String) = act { deleteModel(settings, machineId, key) }
 }
 /**
 * One machine's models, asked for again while this screen is open.
 *
 * Polled rather than pushed: a download belongs to a machine, not to any session, so it has no
 * event stream of its own. Faster while something is downloading, because that is the only thing
 * here that changes by itself -- each ask is a round trip to that machine, and once a minute would
 * be a progress bar that moved in jumps.
 *
 * [onLocalChange] fires when the set of models on the machine changes, which is how the screen
 * around this learns that a download has become a model it must now draw settings for.
 *
 * [enabled] is false for a provider that holds no files of its own -- the Claude CLI names its
 * models rather than storing them -- and then nothing is asked of the machine at all. Taken as a
 * parameter rather than decided by the caller's `if`, so that this is composed unconditionally and
 * keeps its search results across the moment the provider's kind arrives.
 */
@Composable
 fun rememberMachineModels(
    settings: ServerSettings,
    machineId: String,
    enabled: Boolean,
    onLocalChange: () -> Unit,
 ): MachineModelsState {
    val scope = rememberCoroutineScope()
    val state = remember(settings, machineId) { MachineModelsState(settings, machineId, scope) }
    LaunchedEffect(state, enabled) {
        if (!enabled) return@LaunchedEffect
        var known: List<String>? = null
        while (true) {
            state.reload()
            val local = state.models?.local?.map { it.key }
            if (local != null) {
                if (known != null && known != local) onLocalChange()
                known = local
            }
            delay(if (state.downloads.any { it.state == "running" }) 1500 else 5000)
        }
    }
    return state
 }
 /** What is being fetched onto this machine, above the models it already has. */
 fun LazyListScope.downloadCards(state: MachineModelsState) {
    uniqueItems(state.downloads, key = { "download:" + it.key }) { download ->
        DownloadCard(
            download = download,
            onCancel = { state.cancel(download.key) },
            onResume = { state.download(download.repo, download.file) },
            onRemove = { state.remove(download.key) },
        )
    }
 }
 /**
 * Finding a model to fetch: a search, and what it found.
 *
 * Below the models this machine has rather than above them, because what is here is what the reader
 * came for and getting another is the rarer errand.
 */
 fun LazyListScope.modelSearch(state: MachineModelsState) {
    item("search") {
        Spacer(Modifier.height(16.dp))
        Text("Get another model", style = MaterialTheme.typography.titleSmall)
        Text(
            "Downloaded onto this machine, which is where llama.cpp reads it from.",
            style = MaterialTheme.typography.bodySmall,
            color = MaterialTheme.colorScheme.onSurfaceVariant,
        )
        Spacer(Modifier.height(8.dp))
        val keyboard = LocalSoftwareKeyboardController.current
        OutlinedTextField(
            value = state.query,
            onValueChange = { state.query = it },
            label = { Text("Search HuggingFace") },
            singleLine = true,
            // The keyboard's own key searches, and puts itself away to show what it found. The
            // button below this is under the keyboard while it is up, so without this the only
            // way to press it is to dismiss the keyboard first -- which nothing on screen says.
            keyboardOptions = KeyboardOptions(imeAction = ImeAction.Search),
            keyboardActions =
                KeyboardActions(
                    onSearch = {
                        keyboard?.hide()
                        state.search()
                    }
                ),
            modifier = Modifier.fillMaxWidth(),
        )
        TextButton(
            enabled = state.query.isNotBlank(),
            onClick = {
                keyboard?.hide()
                state.search()
            },
        ) {
            Text("Search")
        }
    }
    when (val found = state.results) {
        null -> {}
        is LoadState.Loading -> item("searching") { CircularProgressIndicator() }
        is LoadState.Error ->
            item("search-failed") { Text(found.message, color = MaterialTheme.colorScheme.error) }
        is LoadState.Loaded ->
            uniqueItems(found.value, key = { "repo:" + it.id }) { repo ->
                val open = state.openRepo == repo.id
                RepoRow(repo, expanded = open) { state.toggleRepo(repo.id) }
                // Inside the expanded repository's own item rather than as a section after the
                // list: drawn after every card, a repository's files read as belonging to
                // whichever card happened to be last.
                if (open) {
                    when (val files = state.repoFiles) {
                        null -> {}
                        is LoadState.Loading -> CircularProgressIndicator()
                        is LoadState.Error ->
                            Text(files.message, color = MaterialTheme.colorScheme.error)
                        is LoadState.Loaded ->
                            Column {
                                val busy = state.downloads.map { it.key }.toSet()
                                files.value.forEach { file ->
                                    RepoFileRow(
                                        file,
                                        downloading = "${repo.id}/${file.path}" in busy,
                                    ) {
                                        state.download(repo.id, file.path)
                                    }
                                }
                            }
                    }
                }
            }
    }
 }
@Composable
 private fun DownloadCard(
    download: Download,
    onCancel: () -> Unit,
    onResume: () -> Unit,
    onRemove: () -> Unit,
 ) {
    val running = download.state == "running" || download.state == "verifying"
    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
        Column(Modifier.padding(12.dp)) {
            Text(download.file, style = MaterialTheme.typography.titleSmall)
            Text(
                download.repo,
                style = MaterialTheme.typography.bodySmall,
                color = MaterialTheme.colorScheme.onSurfaceVariant,
            )
            Spacer(Modifier.height(8.dp))
            // A determinate bar only when the size is known. HuggingFace sends no size when it
            // was never told one, and a bar drawn from a guess is worse than one that admits it
            // is counting.
            if (download.total != null && download.total > 0) {
                LinearProgressIndicator(
                    progress = { download.done.toFloat() / download.total.toFloat() },
                    // Blue at every value, unlike a quota bar: a download nearing its end is
                    // nearing success, and colouring it like a limit being approached would say
                    // the opposite.
                    color = progressColor,
                    modifier = Modifier.fillMaxWidth(),
                )
                Text(
                    "${gigabytes(download.done)} of ${gigabytes(download.total)}",
                    style = MaterialTheme.typography.bodySmall,
                )
            } else if (running) {
                LinearProgressIndicator(color = progressColor, modifier = Modifier.fillMaxWidth())
                Text(
                    "${gigabytes(download.done)} so far, total size unknown",
                    style = MaterialTheme.typography.bodySmall,
                )
            }
            download.error?.let {
                Text(
                    it,
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.error,
                )
            }
            Row(verticalAlignment = Alignment.CenterVertically) {
                Text(
                    download.state,
                    style = MaterialTheme.typography.bodySmall,
                    modifier = Modifier.weight(1f),
                )
                if (running) {
                    TextButton(onClick = onCancel) { Text("Cancel") }
                } else {
                    // A stopped download kept its partial file, so carrying on is the cheap
                    // answer and starting again is not the only one offered.
                    TextButton(onClick = onResume) { Text("Resume") }
                    TextButton(onClick = onRemove) { Text("Remove") }
                }
            }
        }
    }
 }
@Composable
 private fun RepoRow(repo: RemoteRepo, expanded: Boolean, onToggle: () -> Unit) {
    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
        Row(Modifier.padding(12.dp), verticalAlignment = Alignment.CenterVertically) {
            Column(Modifier.weight(1f)) {
                Text(
                    repo.id,
                    style = MaterialTheme.typography.titleSmall,
                    maxLines = 1,
                    // The owner is the part that repeats; the model name at the end is what tells
                    // two entries apart.
                    overflow = TextOverflow.StartEllipsis,
                )
                Text(
                    "${repo.downloads} downloads · ${repo.likes} likes",
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.onSurfaceVariant,
                )
            }
            TextButton(onClick = onToggle) { Text(if (expanded) "Hide" else "Files") }
        }
    }
 }
@Composable
 private fun RepoFileRow(file: RemoteFile, downloading: Boolean, onDownload: () -> Unit) {
    Row(
        Modifier.fillMaxWidth().padding(start = 16.dp, top = 4.dp, bottom = 4.dp),
        verticalAlignment = Alignment.CenterVertically,
    ) {
        Column(Modifier.weight(1f)) {
            Text(file.path, style = MaterialTheme.typography.bodyMedium)
            Text(
                gigabytes(file.bytes),
                style = MaterialTheme.typography.bodySmall,
                color = MaterialTheme.colorScheme.onSurfaceVariant,
            )
        }
        // Disabled rather than absent, so the row reads the same whether this one is absent,
        // already here, or on its way. Offering "Download" for a file that is downloading would be
        // a button that does nothing anyone can see.
        TextButton(enabled = !file.have && !downloading, onClick = onDownload) {
            Text(
                when {
                    file.have -> "Downloaded"
                    downloading -> "Downloading"
                    else -> "Download"
                }
            )
        }
    }
 }
 fun gigabytes(bytes: Long): String =
    if (bytes >= 1_000_000_000) {
        "%.2f GB".format(bytes / 1_000_000_000.0)
    } else {
        "%.0f MB".format(bytes / 1_000_000.0)
    }
@@ -1,5 +1,7 @@
 package com.example.aiapp
 import androidx.compose.foundation.BorderStroke
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
@@ -10,6 +12,7 @@ import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.Card
 import androidx.compose.material3.CardDefaults
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedTextField
@@ -24,6 +27,11 @@ import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.semantics.contentDescription
 import androidx.compose.ui.semantics.semantics
 import androidx.compose.ui.text.font.FontFamily
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
@@ -37,19 +45,25 @@ import kotlinx.coroutines.withContext
 * which is what keeps the enrolled token from being able to introduce commands.
 */
@Composable
-fun SetupsScreen(settings: ServerSettings, reloadToken: Int) {
+fun MachinesScreen(
    settings: ServerSettings,
    reloadToken: Int,
    /** Opens one provider on one machine -- its settings, and what its server is holding. */
    onProvider: (String, String) -> Unit,
 ) {
    val scope = rememberCoroutineScope()
-    var state by remember { mutableStateOf<LoadState<List<Setup>>>(LoadState.Loading) }
+    var state by remember { mutableStateOf<LoadState<List<Machine>>>(LoadState.Loading) }
    var adding by remember { mutableStateOf(false) }
-    var renaming by remember { mutableStateOf<Setup?>(null) }
+    var renaming by remember { mutableStateOf<Machine?>(null) }
-    var confirmingDelete by remember { mutableStateOf<Setup?>(null) }
+    var confirmingDelete by remember { mutableStateOf<Machine?>(null) }
    var signingIn by remember { mutableStateOf<Pair<Machine, Provider>?>(null) }
    var busy by remember { mutableStateOf<String?>(null) }
    var actionError by remember { mutableStateOf<String?>(null) }
    suspend fun reload() {
        state =
            try {
-                withContext(Dispatchers.IO) { LoadState.Loaded(fetchSetups(settings)) }
+                withContext(Dispatchers.IO) { LoadState.Loaded(fetchMachines(settings)) }
            } catch (e: ApiException) {
                LoadState.failed(e)
            }
@@ -82,19 +96,19 @@ fun SetupsScreen(settings: ServerSettings, reloadToken: Int) {
            is LoadState.Error -> Text(current.message, color = MaterialTheme.colorScheme.error)
            is LoadState.Loaded ->
                LazyColumn(Modifier.fillMaxSize()) {
-                    uniqueItems(current.value, key = { it.id }) { setup ->
+                    uniqueItems(current.value, key = { it.id }) { machine ->
-                        SetupCard(
+                        MachineCard(
-                            setup = setup,
+                            machine = machine,
-                            onRename = { renaming = setup },
+                            onRename = { renaming = machine },
                            onRediscover = {
                                scope.launch {
-                                    busy = "Asking ${setup.name} what it has…"
+                                    busy = "Asking ${machine.name} what it has…"
                                    actionError =
                                        runCatching {
                                            withContext(Dispatchers.IO) {
-                                                updateSetup(
+                                                updateMachine(
                                                    settings,
-                                                    setup.id,
+                                                    machine.id,
                                                    rediscover = true,
                                                )
                                            }
@@ -105,7 +119,9 @@ fun SetupsScreen(settings: ServerSettings, reloadToken: Int) {
                                    reload()
                                }
                            },
-                            onDelete = { confirmingDelete = setup },
+                            onDelete = { confirmingDelete = machine },
                            onSignIn = { provider -> signingIn = machine to provider },
                            onProvider = { provider -> onProvider(machine.id, provider.name) },
                        )
                    }
                }
@@ -113,7 +129,7 @@ fun SetupsScreen(settings: ServerSettings, reloadToken: Int) {
    }
    if (adding) {
-        AddSetupDialog(
+        AddMachineDialog(
            onDismiss = { adding = false },
            onAdd = { name, ssh ->
                adding = false
@@ -121,7 +137,7 @@ fun SetupsScreen(settings: ServerSettings, reloadToken: Int) {
                    busy = "Asking $name what it has…"
                    actionError =
                        runCatching {
-                            withContext(Dispatchers.IO) { addSetup(settings, name, ssh) }
+                            withContext(Dispatchers.IO) { addMachine(settings, name, ssh) }
                        }
                            .exceptionOrNull()
                            ?.message
@@ -129,13 +145,13 @@ fun SetupsScreen(settings: ServerSettings, reloadToken: Int) {
                    reload()
                }
            },
-            onTest = { ssh -> withContext(Dispatchers.IO) { probeSetup(settings, ssh) } },
+            onTest = { ssh -> withContext(Dispatchers.IO) { probeMachine(settings, ssh) } },
        )
    }
-    renaming?.let { setup ->
+    renaming?.let { machine ->
        RenameDialog(
-            setup = setup,
+            machine = machine,
            onDismiss = { renaming = null },
            onRename = { name ->
                renaming = null
@@ -143,7 +159,7 @@ fun SetupsScreen(settings: ServerSettings, reloadToken: Int) {
                    actionError =
                        runCatching {
                            withContext(Dispatchers.IO) {
-                                updateSetup(settings, setup.id, name = name)
+                                updateMachine(settings, machine.id, name = name)
                            }
                        }
                            .exceptionOrNull()
@@ -154,10 +170,10 @@ fun SetupsScreen(settings: ServerSettings, reloadToken: Int) {
        )
    }
-    confirmingDelete?.let { setup ->
+    confirmingDelete?.let { machine ->
        AlertDialog(
            onDismissRequest = { confirmingDelete = null },
-            title = { Text("Remove \"${setup.name}\"?") },
+            title = { Text("Remove \"${machine.name}\"?") },
            text = {
                Text(
                    "The machine is left alone -- this only stops this app offering it. " +
@@ -171,7 +187,9 @@ fun SetupsScreen(settings: ServerSettings, reloadToken: Int) {
                        scope.launch {
                            actionError =
                                runCatching {
-                                    withContext(Dispatchers.IO) { deleteSetup(settings, setup.id) }
+                                    withContext(Dispatchers.IO) {
                                        deleteMachine(settings, machine.id)
                                    }
                                }
                                    .exceptionOrNull()
                                    ?.message
@@ -187,34 +205,99 @@ fun SetupsScreen(settings: ServerSettings, reloadToken: Int) {
            },
        )
    }
    signingIn?.let { (machine, provider) ->
        ProviderLoginDialog(
            settings = settings,
            machineId = machine.id,
            machineName = machine.name,
            provider = provider.name,
            onDismiss = { signingIn = null },
            onSignedIn = {
                signingIn = null
                scope.launch { reload() }
            },
        )
    }
 }
@Composable
-private fun SetupCard(
+private fun MachineCard(
-    setup: Setup,
+    machine: Machine,
    onRename: () -> Unit,
    onRediscover: () -> Unit,
    onDelete: () -> Unit,
    onSignIn: (Provider) -> Unit,
    onProvider: (Provider) -> Unit,
 ) {
    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
        Column(Modifier.padding(12.dp)) {
-            Text(setup.name, style = MaterialTheme.typography.titleSmall)
+            Text(machine.name, style = MaterialTheme.typography.titleSmall)
            Text(
-                // Not "this machine": the seeded setup is *called* that, and the card read "this
+                // Not "this machine": the seeded machine is *called* that, and the card read "this
                // machine / this machine".
-                setup.address ?: "runs where the backend does",
+                machine.address ?: "runs where the backend does",
                style = MaterialTheme.typography.bodySmall,
                color = MaterialTheme.colorScheme.onSurfaceVariant,
            )
            Spacer(Modifier.height(4.dp))
-            Text(
+            if (machine.providers.isEmpty()) {
-                if (setup.providers.isEmpty()) {
+                Text(
-                    "Nothing found on it. Install something and rediscover."
+                    "Nothing found on it. Install something and rediscover.",
-                } else {
+                    style = MaterialTheme.typography.bodySmall,
-                    setup.providers.joinToString(" · ") { it.name }
+                )
-                },
+            } else {
-                style = MaterialTheme.typography.bodySmall,
+                machine.providers.forEach { provider ->
-            )
+                    // A card of its own rather than a line of text: a provider is where the
                    // settings that belong to *this machine* live -- how each of its models is
                    // loaded, the models themselves, and the server holding them -- and those had
                    // nowhere to be until one llama-server came to serve every session on a
                    // machine. Sized by its own padding rather than by whatever control happened
                    // to be on its row, like the tool call cards it is built after.
                    Card(
                        Modifier.fillMaxWidth()
                            .padding(vertical = 4.dp)
                            .clickable { onProvider(provider) }
                            .semantics { contentDescription = "Open ${provider.name}" },
                        // A border, and the machine card's own surface kept underneath it.
                        // The tint that was here before is one step along the surface ladder
                        // from the card it sits in, and two adjacent surfaces render as one flat
                        // block: these read as lines of text in a box rather than as things to
                        // open. One cue, and a visible one.
                        colors = CardDefaults.cardColors(containerColor = Color.Transparent),
                        border = BorderStroke(1.dp, MaterialTheme.colorScheme.outlineVariant),
                    ) {
                        Row(
                            verticalAlignment = Alignment.CenterVertically,
                            modifier = Modifier.fillMaxWidth().padding(12.dp),
                        ) {
                            Column(Modifier.weight(1f)) {
                                Text(provider.name, style = MaterialTheme.typography.titleSmall)
                                // What was actually found, which is the honest second line and
                                // the one thing here nobody can change. No arrow: a card that
                                // lifts off the one behind it already reads as something to open,
                                // and the chevron was the only thing making these look like rows
                                // of a list.
                                provider.command?.let {
                                    Text(
                                        it,
                                        style = MaterialTheme.typography.bodySmall,
                                        fontFamily = FontFamily.Monospace,
                                        color = MaterialTheme.colorScheme.onSurfaceVariant,
                                        maxLines = 1,
                                        // A program is identified by its name, which is the tail
                                        // of its path.
                                        overflow = TextOverflow.StartEllipsis,
                                    )
                                }
                            }
                            if (provider.kind == "claude_cli") {
                                TextButton(onClick = { onSignIn(provider) }) { Text("Sign in") }
                            }
                        }
                    }
                }
            }
            Row(verticalAlignment = Alignment.CenterVertically) {
                TextButton(onClick = onRename) { Text("Rename") }
                TextButton(onClick = onRediscover) { Text("Rediscover") }
@@ -226,7 +309,7 @@ private fun SetupCard(
 }
@Composable
-private fun AddSetupDialog(
+private fun AddMachineDialog(
    onDismiss: () -> Unit,
    onAdd: (String, SshDetails?) -> Unit,
    onTest: suspend (SshDetails?) -> List<Provider>,
@@ -349,8 +432,8 @@ private fun AddSetupDialog(
 }
@Composable
-private fun RenameDialog(setup: Setup, onDismiss: () -> Unit, onRename: (String) -> Unit) {
+private fun RenameDialog(machine: Machine, onDismiss: () -> Unit, onRename: (String) -> Unit) {
-    var name by remember { mutableStateOf(setup.name) }
+    var name by remember { mutableStateOf(machine.name) }
    AlertDialog(
        onDismissRequest = onDismiss,
        title = { Text("Rename") },
@@ -66,35 +66,6 @@ class MainActivity : ComponentActivity() {
        // Transparent status bar on every version; the Surface below paints through underneath it
        // and content insets itself. Same reasoning as dev-updater's MainActivity.
        enableEdgeToEdge()
        // The `bench` build's entire purpose (P0, docs/RUST.md): open straight onto the session
        // screen against BenchFixture's in-process fake backend, with no enrollment, no network
        // permission, and no notification prompt -- none of them mean anything with no server and
        // no real device to notify. See BenchFixture.kt and BenchNetwork.kt for how a screen built
        // to talk to a real backend is made to talk to this instead. Still needs the same
        // status/navigation-bar padding the ordinary flow below applies: edge-to-edge is the
        // platform's own default from Android 15 on this app's targetSdk, with or without the call
        // above, so skipping the padding here put the header's own buttons under the status bar --
        // there to look at, but not there for `ui-trace`'s tap-by-label to land on.
        if (BuildConfig.FIXTURE_MODE) {
            installFixtureNetworkOnce()
            BenchFixture.ensureLoaded(this)
            setContent {
                MaterialTheme(colorScheme = AiAppColors) {
                    Surface(modifier = Modifier.fillMaxSize()) {
                        Box(Modifier.fillMaxSize().statusBarsPadding().navigationBarsPadding()) {
                            SessionScreen(
                                settings = BenchFixture.settings,
                                summary = benchSessionSummary(),
                                onBack = { finish() },
                                onFiles = {},
                            )
                        }
                    }
                }
            }
            return
        }
        // Dark status-bar icons only over a light background, decided from the scheme rather than
        // fixed. It was hardcoded to `true`, which was right against the default light surface and
        // became unreadable the moment the app wore Catppuccin Mocha.
@@ -176,26 +147,6 @@ class MainActivity : ComponentActivity() {
        }
    }
    /** The one session the `bench` build ever shows -- BenchFixture's session id, nothing else. */
    private fun benchSessionSummary() =
        SessionSummary(
            id = BenchFixture.SESSION_ID,
            setup = "bench",
            setupName = "bench",
            provider = "bench",
            title = "P0 benchmark",
            model = null,
            keepsOwnTranscript = false,
            permissionMode = null,
            imported = false,
            notify = false,
            cwd = null,
            contextTokens = null,
            maxImageEdge = null,
            status = "idle",
            lastActivity = 0.0,
        )
    // launchMode="singleTop": an enrollment scan, or a notification tapped while the app is open,
    // lands here rather than in a second activity instance.
    override fun onNewIntent(intent: Intent) {
@@ -0,0 +1,53 @@
 package com.example.aiapp
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableIntStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
 /**
 * The app's root screen, in the full-width panel [SidePanels] slides over a session from the left.
 *
 * Not a list of its own but [MainScreen] itself, and the whole width of the screen: what a right
 * swipe gets is the screen Back would have got, moved over the session instead of replacing it. The
 * session stays composed underneath, with its stream open and its draft and scroll position where
 * they were, so swiping the panel back off returns to it for nothing -- where Back and a tap costs
 * the whole transcript over the tunnel again.
 *
 * Tapping the session already open is that same swipe back rather than a fresh screen: reopening it
 * would hand [SessionScreen] a new summary for the conversation it is already showing.
 *
 * [onGone] is the one thing the list can do that this panel cannot survive -- deleting the very
 * session it is drawn over. There is nothing left to swipe back into, so that closes the screen.
 */
@Composable
 fun MainPanel(
    settings: ServerSettings,
    sessionId: String,
    active: Boolean,
    onOpen: (SessionSummary) -> Unit,
    onSpawn: () -> Unit,
    onImported: (SessionSummary) -> Unit,
    onSettings: () -> Unit,
    onProvider: (String, String) -> Unit,
    onClose: () -> Unit,
    onGone: () -> Unit,
 ) {
    // Asked again each time the panel opens: who is working and who is waiting on an answer is
    // exactly what changed while the session underneath was being read.
    var reloadToken by remember(sessionId) { mutableIntStateOf(0) }
    LaunchedEffect(active) { if (active) reloadToken++ }
    MainScreen(
        settings = settings,
        reloadToken = reloadToken,
        onOpen = { if (it.id == sessionId) onClose() else onOpen(it) },
        onSpawn = onSpawn,
        onImported = onImported,
        onSettings = onSettings,
        onProvider = onProvider,
        onDeleted = { if (it == sessionId) onGone() },
    )
 }
@@ -26,19 +26,23 @@ import androidx.lifecycle.compose.LocalLifecycleOwner
 import androidx.lifecycle.repeatOnLifecycle
 /**
- * The app's root: one title, and four views of the backend behind it.
+ * The app's root: one title, and three views of the backend behind it.
 *
- * These were four screens reached by four words in a row under the title, and the row was already
+ * These were screens reached by words in a row under the title, and the row was already full. Tabs
- * full. Tabs say the same thing in less space and say one more thing besides: that these are places
+ * say the same thing in less space and say one more thing besides: that these are places to be
- * to be rather than errands to run. Sessions, the machine's importable history, the models on it
+ * rather than errands to run. Sessions, the machine's importable history and the machines
- * and the machines themselves are all *the same backend*, looked at four ways, and none is a step
+ * themselves are all *the same backend*, looked at three ways, and none is a step down from
- * down from another. Settings still is, which is why it stays a pushed screen with its own Back.
+ * another. Settings still is, which is why it stays a pushed screen with its own Back.
 *
 * Models were a fourth tab until 2026-09-19. They are a machine's models now -- downloaded onto the
 * machine that has to serve them -- so they live under that machine's llama.cpp provider, beside
 * the settings deciding how each one is loaded. A tab about "the models" was a claim that there is
 * one such set, and there is one per machine.
 */
 private enum class MainTab(val label: String) {
    Sessions("Sessions"),
    Import("Import"),
-    Models("Models"),
+    Machines("Machines"),
    Setups("Setups"),
 }
@Composable
@@ -48,11 +52,13 @@ fun MainScreen(
    /** What another app shared in and no session has taken yet; see [ShareRequest]. */
    share: ShareRequest? = null,
    onOpen: (SessionSummary) -> Unit,
    /** Opens one session's subagent, from the expander under its card. */
    onOpenSubagent: (SessionSummary, SubagentSummary) -> Unit,
    onSpawn: () -> Unit,
    onImported: (SessionSummary) -> Unit,
    onSettings: () -> Unit,
    /** One machine's provider, opened from the machines tab. */
    onProvider: (String, String) -> Unit,
    /** A session the list has just deleted; see [SessionListScreen]. */
    onDeleted: (String) -> Unit = {},
 ) {
    var tab by remember { mutableStateOf(MainTab.Sessions) }
    var refreshToken by remember { mutableIntStateOf(0) }
@@ -141,13 +147,13 @@ fun MainScreen(
                    settings = settings,
                    reloadToken = token,
                    onOpen = onOpen,
                    onOpenSubagent = onOpenSubagent,
                    onSpawn = onSpawn,
                    onDeleted = onDeleted,
                )
            MainTab.Import ->
                ImportScreen(settings = settings, reloadToken = token, onImported = onImported)
-            MainTab.Models -> ModelsScreen(settings = settings, reloadToken = token)
+            MainTab.Machines ->
-            MainTab.Setups -> SetupsScreen(settings = settings, reloadToken = token)
+                MachinesScreen(settings = settings, reloadToken = token, onProvider = onProvider)
        }
    }
 }
@@ -32,6 +32,7 @@ import com.mikepenz.markdown.model.markdownAnnotator
 import com.mikepenz.markdown.utils.getUnescapedTextInNode
 import com.mikepenz.markdown.utils.resolveImageAlt
 import com.mikepenz.markdown.utils.resolveImageLink
 import java.net.URI
 import org.intellij.markdown.MarkdownElementTypes
 import org.intellij.markdown.MarkdownTokenTypes
 import org.intellij.markdown.ast.ASTNode
@@ -89,6 +90,7 @@ fun LinkedText(content: String, node: ASTNode, style: TextStyle, modifier: Modif
            content.buildMarkdownAnnotatedString(node, style, settings)
        }
    val uriHandler = LocalUriHandler.current
    val fileLinkHandler = LocalFileLinkHandler.current
    val onPlainTap = LocalMarkdownTap.current
    val layout = remember { Ref<TextLayoutResult>() }
    // The renderer's own rule for a style that names no colour: the theme's text colour.
@@ -127,7 +129,7 @@ fun LinkedText(content: String, node: ASTNode, style: TextStyle, modifier: Modif
                    when {
                        url != null -> {
                            up.consume()
-                            uriHandler.openUri(url)
+                            if (fileLinkHandler?.invoke(url) != true) uriHandler.openUri(url)
                        }
                        onPlainTap != null -> {
                            up.consume()
@@ -164,6 +166,55 @@ fun LinkedText(content: String, node: ASTNode, style: TextStyle, modifier: Modif
 */
 val LocalMarkdownTap = compositionLocalOf<(() -> Unit)?> { null }
 /**
 * Opens a markdown destination inside the current session when it names a file on that session's
 * machine. Null outside a session, where every link keeps its ordinary URI behaviour.
 */
 val LocalFileLinkHandler = compositionLocalOf<((String) -> Boolean)?> { null }
 /**
 * A stable markdown link handler whose behaviour follows the latest [onFile]. Keeping its identity
 * stable matters: every visible markdown paragraph reads it, and a session recomposes on every
 * streamed event.
 */
@Composable
 fun rememberFileLinkHandler(onFile: (String) -> Unit): (String) -> Boolean {
    val latest = rememberUpdatedState(onFile)
    return remember {
        { destination ->
            val path = filePathOf(destination)
            if (path == null) false
            else {
                latest.value(path)
                true
            }
        }
    }
 }
 /**
 * The path named by a local-file markdown destination.
 *
 * Only absolute paths and local `file:` URIs are claimed. A relative destination might be a web
 * link, and sending one to a machine's filesystem would silently give an ordinary link a different
 * meaning. Editors commonly append a line and optional column; the current viewer opens the file
 * itself, so those coordinates are removed here.
 */
 internal fun filePathOf(destination: String): String? {
    val uri = runCatching { URI(destination) }.getOrNull()
    val path =
        when {
            destination.startsWith("/") && !destination.startsWith("//") ->
                uri?.path ?: destination.substringBefore('#').substringBefore('?')
            uri != null &&
                uri.scheme.equals("file", ignoreCase = true) &&
                (uri.host.isNullOrEmpty() || uri.host == "localhost") -> uri.path
            else -> null
        }
    if (path.isNullOrEmpty() || !path.startsWith('/')) return null
    return path.replace(Regex(":\\d+(?::\\d+)?$"), "")
 }
 /**
 * [onTap] as a stable value to provide for [LocalMarkdownTap]. The identity stays put while the
 * behaviour follows the latest [onTap], which is what keeps providing it from invalidating the text
@@ -21,12 +21,25 @@ const val DEFAULT_MODEL = "default"
 * one model rather than one model from another. Anything that does not look like that is returned
 * untouched.
 *
 * A llama.cpp session's model is not an identifier at all -- it is `owner/repo/file.gguf`, where
 * the file was downloaded from -- so what is kept is the file, which is the part that tells two
 * models apart, and the extension goes with the directories. The model's *own* name is better still
 * and is not derivable here: it is inside the file, and only the server has ever opened it. Where a
 * screen has the server's answer it should prefer it; this is the floor under every screen that
 * does not.
 *
 * A display decision, not a correction: the full name is what the session reports.
 */
 fun modelLabel(model: String?): String {
    val name = model?.takeIf { it.isNotBlank() } ?: return DEFAULT_MODEL
    if (name.endsWith(GGUF)) {
        return name.substringAfterLast('/').removeSuffix(GGUF)
    }
    return name.removePrefix("claude-").replace(DATED_SUFFIX, "")
 }
 /** A trailing `-YYYYMMDD`, which is how these identifiers carry their release date. */
 private val DATED_SUFFIX = Regex("""-\d{8}$""")
 /** What every model a llama.cpp session can run is stored as. */
 private const val GGUF = ".gguf"
@@ -1,374 +0,0 @@
 package com.example.aiapp
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.material3.Card
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.LinearProgressIndicator
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.delay
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 /**
 * Models on the backend, and HuggingFace to get more from.
 *
 * Everything here is the server's state rather than this screen's: what is downloaded, and what is
 * downloading, are the same answers on every enrolled device, and a download started here keeps
 * going when this screen closes.
 */
@Composable
 fun ModelsScreen(settings: ServerSettings, reloadToken: Int) {
    val scope = rememberCoroutineScope()
    var state by remember { mutableStateOf<LoadState<Models>>(LoadState.Loading) }
    var query by remember { mutableStateOf("") }
    var results by remember { mutableStateOf<LoadState<List<RemoteRepo>>?>(null) }
    var openRepo by remember { mutableStateOf<String?>(null) }
    var repoFiles by remember { mutableStateOf<LoadState<List<RemoteFile>>?>(null) }
    var actionError by remember { mutableStateOf<String?>(null) }
    suspend fun reload() {
        state =
            try {
                withContext(Dispatchers.IO) { LoadState.Loaded(fetchModels(settings)) }
            } catch (e: ApiException) {
                LoadState.failed(e)
            }
    }
    // Polled rather than pushed: a download belongs to the machine, not to any session, so it has
    // no event stream of its own. Keyed on the token as well, so the header's Refresh restarts the
    // loop with a read now rather than leaving the reader watching for a second and a half.
    LaunchedEffect(reloadToken) {
        while (true) {
            reload()
            delay(1500)
        }
    }
    Column(Modifier.fillMaxSize().padding(16.dp)) {
        actionError?.let {
            Text(it, color = MaterialTheme.colorScheme.error)
            Spacer(Modifier.height(8.dp))
        }
        OutlinedTextField(
            value = query,
            onValueChange = { query = it },
            label = { Text("Search HuggingFace") },
            singleLine = true,
            modifier = Modifier.fillMaxWidth(),
        )
        Spacer(Modifier.height(8.dp))
        TextButton(
            enabled = query.isNotBlank(),
            onClick = {
                openRepo = null
                results = LoadState.Loading
                scope.launch {
                    results =
                        try {
                            withContext(Dispatchers.IO) {
                                LoadState.Loaded(searchModels(settings, query))
                            }
                        } catch (e: ApiException) {
                            LoadState.failed(e)
                        }
                }
            },
        ) {
            Text("Search")
        }
        Spacer(Modifier.height(8.dp))
        LazyColumn(Modifier.fillMaxSize()) {
            when (val current = state) {
                is LoadState.Loading -> item { CircularProgressIndicator() }
                is LoadState.Error ->
                    item { Text(current.message, color = MaterialTheme.colorScheme.error) }
                is LoadState.Loaded -> {
                    if (current.value.downloads.isNotEmpty()) {
                        item { SectionLabel("Downloading") }
                        uniqueItems(current.value.downloads, key = { it.key + it.run }) { download
                            ->
                            DownloadCard(download) {
                                scope.launch {
                                    actionError =
                                        runCatching {
                                            withContext(Dispatchers.IO) {
                                                cancelDownload(settings, download.key)
                                            }
                                        }
                                            .exceptionOrNull()
                                            ?.message
                                }
                            }
                        }
                    }
                    item { SectionLabel("On the backend") }
                    if (current.value.local.isEmpty()) {
                        item {
                            Text(
                                "None yet. Search above to find one.",
                                style = MaterialTheme.typography.bodyMedium,
                                color = MaterialTheme.colorScheme.onSurfaceVariant,
                            )
                        }
                    }
                    uniqueItems(current.value.local, key = { it.key }) { model ->
                        LocalModelCard(model) {
                            scope.launch {
                                actionError =
                                    runCatching {
                                        withContext(Dispatchers.IO) {
                                            deleteModel(settings, model.key)
                                        }
                                    }
                                        .exceptionOrNull()
                                        ?.message
                                reload()
                            }
                        }
                    }
                }
            }
            results?.let { found ->
                item { SectionLabel("HuggingFace") }
                when (found) {
                    is LoadState.Loading -> item { CircularProgressIndicator() }
                    is LoadState.Error ->
                        item { Text(found.message, color = MaterialTheme.colorScheme.error) }
                    is LoadState.Loaded ->
                        uniqueItems(found.value, key = { it.id }) { repo ->
                            val open = openRepo == repo.id
                            RepoRow(repo, expanded = open) {
                                if (open) {
                                    openRepo = null
                                } else {
                                    openRepo = repo.id
                                    repoFiles = LoadState.Loading
                                    scope.launch {
                                        repoFiles =
                                            try {
                                                withContext(Dispatchers.IO) {
                                                    LoadState.Loaded(
                                                        fetchRepoFiles(settings, repo.id)
                                                    )
                                                }
                                            } catch (e: ApiException) {
                                                LoadState.failed(e)
                                            }
                                    }
                                }
                            }
                            // Inside the expanded repository's own item rather than as a section
                            // after the list: drawn after every card, a repository's files read as
                            // belonging to whichever card happened to be last.
                            if (open) {
                                when (val files = repoFiles) {
                                    null -> {}
                                    is LoadState.Loading -> CircularProgressIndicator()
                                    is LoadState.Error ->
                                        Text(files.message, color = MaterialTheme.colorScheme.error)
                                    is LoadState.Loaded ->
                                        Column {
                                            val busy =
                                                (state as? LoadState.Loaded)
                                                    ?.value
                                                    ?.downloads
                                                    .orEmpty()
                                                    .filter { it.state == "running" }
                                                    .map { it.key }
                                                    .toSet()
                                            files.value.forEach { file ->
                                                RepoFileRow(
                                                    file,
                                                    downloading = "${repo.id}/${file.path}" in busy,
                                                ) {
                                                    scope.launch {
                                                        actionError =
                                                            runCatching {
                                                                withContext(Dispatchers.IO) {
                                                                    startDownload(
                                                                        settings,
                                                                        repo.id,
                                                                        file.path,
                                                                    )
                                                                }
                                                            }
                                                                .exceptionOrNull()
                                                                ?.message
                                                        reload()
                                                    }
                                                }
                                            }
                                        }
                                }
                            }
                        }
                }
            }
        }
    }
 }
@Composable
 private fun SectionLabel(text: String) {
    Spacer(Modifier.height(12.dp))
    Text(text, style = MaterialTheme.typography.titleSmall)
    Spacer(Modifier.height(4.dp))
 }
@Composable
 private fun DownloadCard(download: Download, onCancel: () -> Unit) {
    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
        Column(Modifier.padding(12.dp)) {
            Text(download.file, style = MaterialTheme.typography.titleSmall)
            Text(
                download.repo,
                style = MaterialTheme.typography.bodySmall,
                color = MaterialTheme.colorScheme.onSurfaceVariant,
            )
            Spacer(Modifier.height(8.dp))
            // A determinate bar only when the size is known. The server sends no total when it was
            // never told one, and a bar drawn from a guess is worse than one that admits it is
            // counting.
            if (download.total != null && download.total > 0) {
                LinearProgressIndicator(
                    progress = { download.done.toFloat() / download.total.toFloat() },
                    // Blue at every value, unlike a quota bar: a download nearing its end is
                    // nearing success, and colouring it like a limit being approached would say the
                    // opposite.
                    color = progressColor,
                    modifier = Modifier.fillMaxWidth(),
                )
                Text(
                    "${gigabytes(download.done)} of ${gigabytes(download.total)}",
                    style = MaterialTheme.typography.bodySmall,
                )
            } else {
                LinearProgressIndicator(color = progressColor, modifier = Modifier.fillMaxWidth())
                Text(
                    "${gigabytes(download.done)} so far, total size unknown",
                    style = MaterialTheme.typography.bodySmall,
                )
            }
            download.error?.let {
                Text(
                    it,
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.error,
                )
            }
            Row {
                Text(
                    download.state,
                    style = MaterialTheme.typography.bodySmall,
                    modifier = Modifier.weight(1f),
                )
                if (download.state == "running") {
                    TextButton(onClick = onCancel) { Text("Cancel") }
                }
            }
        }
    }
 }
@Composable
 private fun LocalModelCard(model: LocalModel, onDelete: () -> Unit) {
    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
        Row(Modifier.padding(12.dp), verticalAlignment = Alignment.CenterVertically) {
            Column(Modifier.weight(1f)) {
                Text(model.file, style = MaterialTheme.typography.titleSmall)
                Text(
                    "${model.repo} · ${gigabytes(model.bytes)}",
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.onSurfaceVariant,
                )
            }
            TextButton(onClick = onDelete) { Text("Delete") }
        }
    }
 }
@Composable
 private fun RepoRow(repo: RemoteRepo, expanded: Boolean, onToggle: () -> Unit) {
    Card(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
        Row(Modifier.padding(12.dp), verticalAlignment = Alignment.CenterVertically) {
            Column(Modifier.weight(1f)) {
                Text(
                    repo.id,
                    style = MaterialTheme.typography.titleSmall,
                    maxLines = 1,
                    // The owner is the part that repeats; the model name at the end is what tells
                    // two entries apart.
                    overflow = TextOverflow.StartEllipsis,
                )
                Text(
                    "${repo.downloads} downloads · ${repo.likes} likes",
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.onSurfaceVariant,
                )
            }
            TextButton(onClick = onToggle) { Text(if (expanded) "Hide" else "Files") }
        }
    }
 }
@Composable
 private fun RepoFileRow(file: RemoteFile, downloading: Boolean, onDownload: () -> Unit) {
    Row(
        Modifier.fillMaxWidth().padding(start = 16.dp, top = 4.dp, bottom = 4.dp),
        verticalAlignment = Alignment.CenterVertically,
    ) {
        Column(Modifier.weight(1f)) {
            Text(file.path, style = MaterialTheme.typography.bodyMedium)
            Text(
                gigabytes(file.bytes),
                style = MaterialTheme.typography.bodySmall,
                color = MaterialTheme.colorScheme.onSurfaceVariant,
            )
        }
        // Disabled rather than absent, so the row reads the same whether this one is absent,
        // already here, or on its way. Offering "Download" for a file that is downloading would be
        // a button that does nothing anyone can see.
        TextButton(enabled = !file.have && !downloading, onClick = onDownload) {
            Text(
                when {
                    file.have -> "Downloaded"
                    downloading -> "Downloading"
                    else -> "Download"
                }
            )
        }
    }
 }
 private fun gigabytes(bytes: Long): String =
    if (bytes >= 1_000_000_000) {
        "%.2f GB".format(bytes / 1_000_000_000.0)
    } else {
        "%.0f MB".format(bytes / 1_000_000.0)
    }
@@ -28,7 +28,7 @@ import androidx.compose.ui.unit.sp
 * This replaced a hand-drawn canvas gear, whose doc comment argued against icon fonts on the
 * grounds that a system font may not have the glyph. That objection is about *relying* on a system
 * font, and it is exactly right: the answer is not to avoid glyphs but to ship them. The font here
- * is `app/build-icon-font.sh`'s output -- seventeen glyphs, 2.8 KB, subset out of the 3 MB symbols
+ * is `app/build-icon-font.sh`'s output -- eighteen glyphs, 2.9 KB, subset out of the 3 MB symbols
 * font and committed. Adding one means adding its codepoint in *both* places; a codepoint here that
 * the script did not subset is a glyph that silently isn't there.
 *
@@ -136,6 +136,16 @@ val EDIT_GLYPH = glyph(0xF03EB)
 */
 val SAVE_GLYPH = glyph(0xF0193)
 /**
 * `md-menu` -- the burger: three stacked rules, drawn as the handle a row is dragged by.
 *
 * The mark for "take hold of this and move it" rather than for a menu, which is what it means on a
 * row that has one: three rules look like the rows of a list, and the only thing here that draws
 * them is a list being rearranged. Nothing else in this app opens a menu from a burger, so the two
 * senses cannot be confused.
 */
 val DRAG_GLYPH = glyph(0xF035C)
 /**
 * The size an icon draws at beside a line of text.
 *
@@ -165,7 +175,7 @@ private val GLYPH_EXTENT = GLYPH_SIZE.value.dp
 * own corners and beside a title it arrived at the first letter. And it is taller than any header's
 * text, which is what lets the button fill a header row rather than sit in the middle of one.
 */
-private val GLYPH_BUTTON_SIZE = 48.dp
+val GLYPH_BUTTON_SIZE = 48.dp
 /**
 * The ring itself, for putting something that is *not* a glyph button next to one -- a title beside
@@ -34,6 +34,8 @@ import org.json.JSONObject
 * gets a push from Google's servers, which would mean this backend talking to Google about
 * somebody's coding sessions, and the whole point of the tunnel is that it does not.
 *
 * Every moment it hears about goes to the drawer; [show] decides what else is done with it.
 *
 * The cost Android charges is a notification of its own that cannot be dismissed. That is made as
 * quiet as the platform allows: [ONGOING_CHANNEL] is `IMPORTANCE_MIN`, so it makes no sound, shows
 * no status-bar icon, and sits at the bottom of the shade. It is not hidden outright, because it
@@ -138,10 +140,11 @@ class NotificationService : Service() {
        // Nothing to tell somebody about the session they are reading. The transcript in front of
        // them is already saying it.
        if (isOnScreen(notification.sessionId)) return
-        // The app is up: it says this itself, as a banner over whatever screen they are on. Never
+        // The app is up, so it says this itself as a banner over whatever screen they are on --
-        // both -- one thing happened, and a drawer filling up behind an app that already showed you
+        // which interrupts, where the drawer's row records: a banner lasts seconds and reaches only
-        // each one is a drawer nobody reads.
+        // somebody already looking. Both go up, and the banner having done the interrupting is what
-        if (handOver(notification)) return
+        // makes the row a silent one.
        val banner = handOver(notification)
        val manager = NotificationManagerCompat.from(this)
        // Two different noes, and both are answers rather than faults: the runtime permission
        // refused, and notifications switched off for the app in Android's own settings.
@@ -172,6 +175,7 @@ class NotificationService : Service() {
                .setAutoCancel(true)
                .setWhen((notification.at * 1000).toLong())
                .setShowWhen(true)
                .setSilent(banner)
                .build()
        manager.notify(notification.sessionId, ALERT_ID, built)
    }
@@ -262,7 +266,8 @@ class NotificationService : Service() {
         * Whether there is an app to reach is the subscriber count rather than a flag of its own:
         * [SessionAlerts] collects this exactly while it is on screen. `tryEmit` neither suspends
         * nor blocks the thread reading the stream, and the buffer is there so a handful of
-         * sessions finishing together all land rather than the last one winning.
+         * sessions finishing together all land rather than the last one winning. Reaching the app
         * does not stop the drawer's row; it makes it a silent one.
         */
        private val toApp = MutableSharedFlow<SessionNotification>(extraBufferCapacity = 8)
@@ -272,7 +277,11 @@ class NotificationService : Service() {
        private fun handOver(notification: SessionNotification) =
            toApp.subscriptionCount.value > 0 && toApp.tryEmit(notification)
-        /** Somebody is looking at [sessionId]; nothing is posted about it until they stop. */
+        /**
         * Somebody is looking at [sessionId]; nothing is posted about it until they stop, and
         * whatever the drawer is already holding about it goes now rather than waiting to be swiped
         * away. Opening the session *is* reading the notification, whichever way they got here.
         */
        fun showing(context: Context, sessionId: String) {
            onScreen = sessionId
            // Whatever was posted about it before is about to be read, so it has nothing left to
@@ -0,0 +1,121 @@
 package com.example.aiapp
 import android.content.Context
 import androidx.core.content.edit
 import java.util.UUID
 import org.json.JSONArray
 import org.json.JSONObject
 private const val PENDING_MESSAGES = "pending-messages"
 /** A quiet user bubble below the durable transcript. */
 internal data class QueuedMessage(
    val id: String,
    val text: String,
    val attachments: List<String>,
    val refusal: String? = null,
    /** This phone is still waiting for any durable event that says the server accepted it. */
    val local: Boolean = false,
    /** The HTTP request returned successfully; the provider event is still outstanding. */
    val serverAccepted: Boolean = false,
 )
 internal fun localPendingMessage(text: String, attachments: List<String>) =
    QueuedMessage("local-${UUID.randomUUID()}", text, attachments, local = true)
 private fun QueuedMessage.matches(text: String, attachments: List<String>) =
    this.text == text && this.attachments == attachments
 /** Replaces the local bridge with the server's durable waiting message, without drawing both. */
 internal fun reconcileQueuedMessage(
    queued: List<QueuedMessage>,
    event: SessionEvent.MessageQueued,
 ): List<QueuedMessage> {
    if (queued.any { !it.local && it.id == event.id }) return queued
    val at = queued.indexOfFirst { it.local && it.matches(event.text, event.attachments) }
    if (at < 0) return queued + QueuedMessage(event.id, event.text, event.attachments)
    return queued.mapIndexed { index, message ->
        if (index == at) QueuedMessage(event.id, event.text, event.attachments) else message
    }
 }
 /** Removes exactly the pending bubble that became a provider-received user message. */
 internal fun reconcileUserMessage(
    queued: List<QueuedMessage>,
    event: SessionEvent.UserMessage,
 ): List<QueuedMessage> {
    val at =
        event.id?.let { id -> queued.indexOfFirst { !it.local && it.id == id }.takeIf { it >= 0 } }
            ?: queued.indexOfFirst { it.local && it.matches(event.text, event.attachments) }
    return if (at < 0) queued else queued.filterIndexed { index, _ -> index != at }
 }
 /** Keeps a failed send in place and puts its actionable failure in that message's bubble. */
 internal fun markPendingFailure(
    queued: List<QueuedMessage>,
    id: String,
    failure: String,
 ): List<QueuedMessage> = queued.map { message ->
    if (message.local && message.id == id) message.copy(refusal = failure) else message
 }
 /** Stops persisting a send once the server owns it, while its bubble awaits the provider event. */
 internal fun markPendingAccepted(queued: List<QueuedMessage>, id: String): List<QueuedMessage> =
    queued.map { message ->
        if (message.local && message.id == id) message.copy(serverAccepted = true) else message
    }
 internal fun discardPendingMessage(
    queued: List<QueuedMessage>,
    id: String,
 ): List<QueuedMessage> = queued.filterNot { it.local && it.id == id }
 /** Restores sends for which this phone has not yet seen a durable server event. */
 internal fun loadPendingMessages(context: Context, key: String): List<QueuedMessage> {
    val encoded =
        context.getSharedPreferences(PENDING_MESSAGES, Context.MODE_PRIVATE).getString(key, null)
            ?: return emptyList()
    return try {
        val messages = JSONArray(encoded)
        List(messages.length()) { index ->
            val message = messages.getJSONObject(index)
            val attachments = message.optJSONArray("attachments") ?: JSONArray()
            QueuedMessage(
                id = message.getString("id"),
                text = message.getString("text"),
                attachments = List(attachments.length()) { attachments.getString(it) },
                refusal = message.optString("refusal").takeIf { it.isNotEmpty() },
                local = true,
            )
        }
    } catch (_: org.json.JSONException) {
        // A corrupt local outbox is not useful on the next open either. Remove it rather than
        // repeatedly pretending it decoded to an intentionally empty one.
        context.getSharedPreferences(PENDING_MESSAGES, Context.MODE_PRIVATE).edit { remove(key) }
        emptyList()
    }
 }
 /** Stores only sends the server has not confirmed; everything accepted is the server's to keep. */
 internal fun savePendingMessages(context: Context, key: String, queued: List<QueuedMessage>) {
    val local = queued.filter { it.local && !it.serverAccepted }
    context.getSharedPreferences(PENDING_MESSAGES, Context.MODE_PRIVATE).edit {
        if (local.isEmpty()) {
            remove(key)
        } else {
            putString(
                key,
                JSONArray(
                        local.map { message ->
                            JSONObject()
                                .put("id", message.id)
                                .put("text", message.text)
                                .put("attachments", JSONArray(message.attachments))
                                .put("refusal", message.refusal ?: "")
                        }
                    )
                    .toString(),
            )
        }
    }
 }
@@ -0,0 +1,215 @@
 package com.example.aiapp
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableIntStateOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.LocalUriHandler
 import androidx.compose.ui.unit.dp
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.delay
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 /**
 * Relays a provider CLI's headless browser login without ever owning its credentials.
 *
 * The URL and code live only in this composition. The CLI process on [machineId] remains the one
 * OAuth client and the only writer of its credential file.
 */
@Composable
 fun ProviderLoginDialog(
    settings: ServerSettings,
    machineId: String,
    machineName: String,
    provider: String,
    onDismiss: () -> Unit,
    onSignedIn: () -> Unit,
 ) {
    val scope = rememberCoroutineScope()
    val uriHandler = LocalUriHandler.current
    var login by remember(machineId, provider) { mutableStateOf<ProviderLogin?>(null) }
    var code by remember(machineId, provider) { mutableStateOf("") }
    var error by remember(machineId, provider) { mutableStateOf<String?>(null) }
    var retry by remember(machineId, provider) { mutableIntStateOf(0) }
    suspend fun follow(initial: ProviderLogin): ProviderLogin {
        var current = initial
        val wasSubmitting = initial.state == "submitting"
        while (current.state == "starting" || current.state == "submitting") {
            delay(400)
            current =
                withContext(Dispatchers.IO) {
                    fetchProviderLogin(
                        settings,
                        machineId,
                        provider,
                        current.attempt,
                    )
                }
            login = current
        }
        if (wasSubmitting && current.state == "waitingForCode" && current.detail == null) {
            current =
                current.copy(
                    detail = "That code was not accepted. Copy the complete code and try again."
                )
            login = current
        }
        return current
    }
    LaunchedEffect(machineId, provider, retry) {
        error = null
        code = ""
        login = null
        try {
            val started =
                withContext(Dispatchers.IO) { startProviderLogin(settings, machineId, provider) }
            login = started
            if (follow(started).state == "succeeded") {
                onSignedIn()
            }
        } catch (e: ApiException) {
            error = e.message
        }
    }
    fun dismiss() {
        login
            ?.takeUnless { it.state in setOf("succeeded", "failed", "cancelled") }
            ?.let {
                scope.launch(Dispatchers.IO) {
                    runCatching { cancelProviderLogin(settings, machineId, provider, it.attempt) }
                }
            }
        onDismiss()
    }
    AlertDialog(
        onDismissRequest = ::dismiss,
        title = { Text("Sign in to Claude") },
        text = {
            Column {
                Text(
                    "Claude will sign in on $machineName. Open the authorization page, then " +
                        "paste the code it gives you here."
                )
                Spacer(Modifier.height(12.dp))
                when (val current = login) {
                    null ->
                        if (error == null) {
                            Row(verticalAlignment = Alignment.CenterVertically) {
                                CircularProgressIndicator()
                                Text("Starting sign-in…")
                            }
                        }
                    else ->
                        when (current.state) {
                            "starting",
                            "submitting" ->
                                Row(verticalAlignment = Alignment.CenterVertically) {
                                    CircularProgressIndicator()
                                    Text(
                                        if (current.state == "submitting") "Checking code…"
                                        else "Starting sign-in…"
                                    )
                                }
                            "waitingForCode" -> {
                                TextButton(
                                    onClick = {
                                        runCatching {
                                            current.authorizationUrl?.let(uriHandler::openUri)
                                        }
                                            .onFailure {
                                                error = "Couldn't open the authorization page."
                                            }
                                    },
                                    enabled = current.authorizationUrl != null,
                                ) {
                                    Text("Open authorization page")
                                }
                                OutlinedTextField(
                                    value = code,
                                    onValueChange = { code = it },
                                    label = { Text("Authorization code") },
                                    singleLine = true,
                                    modifier = Modifier.fillMaxWidth(),
                                )
                                current.detail?.let {
                                    Text(it, color = MaterialTheme.colorScheme.error)
                                }
                            }
                            "succeeded" -> Text("Signed in on $machineName.")
                            "cancelled" -> Text("Sign-in was cancelled.")
                            else ->
                                Text(
                                    current.detail ?: "Sign-in failed.",
                                    color = MaterialTheme.colorScheme.error,
                                )
                        }
                }
                error?.let { Text(it, color = MaterialTheme.colorScheme.error) }
            }
        },
        confirmButton = {
            val current = login
            when {
                current?.state == "waitingForCode" ->
                    TextButton(
                        onClick = {
                            scope.launch {
                                error = null
                                try {
                                    val submitted =
                                        withContext(Dispatchers.IO) {
                                            submitProviderLoginCode(
                                                settings,
                                                machineId,
                                                provider,
                                                current.attempt,
                                                code,
                                            )
                                        }
                                    login = submitted
                                    if (follow(submitted).state == "succeeded") {
                                        onSignedIn()
                                    }
                                } catch (e: ApiException) {
                                    error = e.message
                                }
                            }
                        },
                        enabled = code.isNotBlank(),
                    ) {
                        Text("Continue")
                    }
                error != null || current?.state == "failed" || current?.state == "cancelled" ->
                    TextButton(onClick = { retry++ }) { Text("Try again") }
                current?.state == "succeeded" -> TextButton(onClick = onDismiss) { Text("Done") }
            }
        },
        dismissButton = {
            if (login?.state != "succeeded") {
                TextButton(onClick = ::dismiss) { Text("Cancel") }
            }
        },
    )
 }
@@ -0,0 +1,117 @@
 package com.example.aiapp
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.text.KeyboardOptions
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.text.input.KeyboardType
 import androidx.compose.ui.unit.dp
 /**
 * The controls for whatever settings a provider says it takes.
 *
 * One composable for both screens that offer them — the spawn form and the session settings dialog
 * — and for every provider, because the server declares the list (see `DriverKind::params`) rather
 * than this file knowing it. A driver that grows a setting gets a control here with no change to
 * the app, which is the whole point: the values that suit one machine ship as defaults, and every
 * one of them stays reachable from a phone.
 *
 * [values] is the whole map and [onChange] hands back the whole map. A key absent from it means the
 * setting is unset, which is what every [ParamSpec.unset] describes — so clearing a field and never
 * touching it are deliberately the same state.
 */
@Composable
 fun ProviderParamFields(
    specs: List<ParamSpec>,
    values: Map<String, String>,
    onChange: (Map<String, String>) -> Unit,
    /**
     * Whether to say which settings wait for a restart. False on a spawn form, where nothing is
     * running yet and every setting is about to be read — saying it there would be a warning about
     * a state the reader cannot be in.
     */
    warnAboutRestart: Boolean,
    modifier: Modifier = Modifier,
 ) {
    if (specs.isEmpty()) return
    Column(modifier.fillMaxWidth()) {
        specs.forEach { spec ->
            val set = { value: String ->
                onChange(
                    // Blank clears rather than storing an empty string: the server reads an absent
                    // key as "use the default", and an empty one would be a value it then failed
                    // to parse.
                    if (value.isBlank()) values - spec.key else values + (spec.key to value)
                )
            }
            when (spec.kind) {
                "choice" -> {
                    // The first option is what unset means, so selecting it clears the key — see
                    // `ParamKind::Choice`. Without that the picker could show a default it could
                    // not return to.
                    val default = spec.options.firstOrNull().orEmpty()
                    ChipGroup(
                        label = spec.label + restartSuffix(spec, warnAboutRestart),
                        options = spec.options,
                        selected = values[spec.key] ?: default,
                        onSelect = { chosen -> set(if (chosen == default) "" else chosen) },
                    )
                }
                else ->
                    OutlinedTextField(
                        value = values[spec.key].orEmpty(),
                        onValueChange = set,
                        label = { Text(spec.label + restartSuffix(spec, warnAboutRestart)) },
                        placeholder = { Text(spec.unset) },
                        singleLine = true,
                        keyboardOptions = KeyboardOptions(keyboardType = keyboardFor(spec.kind)),
                        modifier = Modifier.fillMaxWidth(),
                    )
            }
            Spacer(Modifier.height(16.dp))
        }
        if (warnAboutRestart && specs.any { it.restart }) {
            Text(
                "A setting marked “on restart” is saved now and read when this session's process " +
                    "next starts.",
                style = MaterialTheme.typography.bodySmall,
                color = MaterialTheme.colorScheme.onSurfaceVariant,
            )
        }
    }
 }
 /**
 * Marks a control whose value will not take effect yet.
 *
 * On the label rather than beside it, because the reader decides whether to change the thing before
 * they touch it — a note underneath is read after the decision.
 */
 private fun restartSuffix(spec: ParamSpec, warn: Boolean): String =
    if (warn && spec.restart) " (on restart)" else ""
 /**
 * The keyboard for a value's shape. A number field that opens the letter keyboard is one every
 * entry is made harder by, and these are nearly all numbers.
 */
 private fun keyboardFor(kind: String): KeyboardType =
    when (kind) {
        "integer" -> KeyboardType.Number
        "decimal" -> KeyboardType.Decimal
        else -> KeyboardType.Text
    }
 /**
 * How long typing has to stop before edited settings are sent.
 *
 * Long enough that a number is one request rather than one per digit, short enough that closing the
 * dialog straight after typing still saves — the save runs on the screen behind it, which outlives
 * the dialog, so this delay is not a window the value can be lost in.
 */
 const val PARAM_SAVE_DELAY_MS = 700L
@@ -0,0 +1,484 @@
 package com.example.aiapp
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.imePadding
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.foundation.rememberScrollState
 import androidx.compose.foundation.text.KeyboardOptions
 import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.Card
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableIntStateOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.text.font.FontFamily
 import androidx.compose.ui.text.input.KeyboardType
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.window.DialogProperties
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 /**
 * One provider on one machine: what it is, what its shared server is holding, and how each of its
 * models is loaded.
 *
 * This is where a setting that belongs to a *machine* lives, as opposed to one that belongs to a
 * session. The two were one list until llama.cpp sessions came to share one server per machine: how
 * a model is loaded stopped being anything a single session could decide, because one copy of it in
 * memory is what several sessions are talking to.
 *
 * It is also the only place a loaded model is taken out of memory. Nothing does that on its own —
 * closing a session leaves the model loaded on purpose, since the next one to want it would
 * otherwise pay the load again — so the memory is freed here, where what it costs everybody is
 * visible.
 */
@Composable
 fun ProviderScreen(
    settings: ServerSettings,
    machineId: String,
    provider: String,
    onBack: () -> Unit,
 ) {
    val scope = rememberCoroutineScope()
    var state by remember { mutableStateOf<LoadState<ProviderView>>(LoadState.Loading) }
    var reload by remember { mutableIntStateOf(0) }
    var editing by remember { mutableStateOf<ProviderModel?>(null) }
    var confirmingStop by remember { mutableStateOf(false) }
    // What is being done to the server or to one of its models, in a word, and what went wrong
    // when it did. Both here rather than per row: these act on the whole machine.
    var busy by remember { mutableStateOf<String?>(null) }
    var actionError by remember { mutableStateOf<String?>(null) }
    var confirmingDelete by remember { mutableStateOf<ProviderModel?>(null) }
    // The machine's own models and what is being fetched onto it. Only for a provider that serves
    // files off that machine's disk -- everything else names its models rather than holding them,
    // and a search for a GGUF under the Claude CLI would be an offer that leads nowhere.
    val kind = (state as? LoadState.Loaded)?.value?.kind
    val machineModels =
        rememberMachineModels(
            settings = settings,
            machineId = machineId,
            enabled = kind == "llama_cpp",
            // A download that became a model is a model this screen has no settings for yet, so
            // the view it is drawing is now one model short of the truth.
            onLocalChange = { reload++ },
        )
    LaunchedEffect(reload) {
        state =
            try {
                withContext(Dispatchers.IO) {
                    LoadState.Loaded(fetchProvider(settings, machineId, provider))
                }
            } catch (e: ApiException) {
                LoadState.failed(e)
            }
    }
    // Say what is happening, do it, say what went wrong, refetch: every action on this screen
    // changes what it is showing.
    val act = { what: String, action: suspend () -> Unit ->
        scope.launch {
            busy = what
            actionError =
                runCatching { withContext(Dispatchers.IO) { action() } }.exceptionOrNull()?.message
            busy = null
            reload++
        }
        Unit
    }
    // The models search at the bottom takes the keyboard, and everything below the field it is
    // typed in -- the Search button, the results -- is behind it without this.
    Column(Modifier.fillMaxSize().imePadding().padding(16.dp)) {
        Row(verticalAlignment = Alignment.CenterVertically, modifier = Modifier.fillMaxWidth()) {
            TextButton(onClick = onBack) { Text("Back") }
        }
        when (val current = state) {
            is LoadState.Loading -> CircularProgressIndicator()
            is LoadState.Error -> Text(current.message, color = MaterialTheme.colorScheme.error)
            is LoadState.Loaded -> {
                val view = current.value
                Text(view.name, style = MaterialTheme.typography.titleMedium)
                Text(
                    "on ${view.machine}",
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.onSurfaceVariant,
                )
                view.command?.let {
                    Text(
                        it,
                        style = MaterialTheme.typography.bodySmall,
                        fontFamily = FontFamily.Monospace,
                        color = MaterialTheme.colorScheme.onSurfaceVariant,
                    )
                }
                Spacer(Modifier.height(12.dp))
                actionError?.let {
                    Text(it, color = MaterialTheme.colorScheme.error)
                    Spacer(Modifier.height(8.dp))
                }
                busy?.let {
                    Row(verticalAlignment = Alignment.CenterVertically) {
                        CircularProgressIndicator(Modifier.height(16.dp).padding(end = 8.dp))
                        Text(it, style = MaterialTheme.typography.bodySmall)
                    }
                    Spacer(Modifier.height(8.dp))
                }
                LazyColumn(Modifier.fillMaxSize()) {
                    view.server?.let { server ->
                        item("server") {
                            ServerCard(
                                server = server,
                                maxLoaded = view.maxLoaded,
                                enabled = busy == null,
                                onStop = { confirmingStop = true },
                                onMaxLoaded = { chosen ->
                                    act("Saving…") {
                                        setProviderSettings(
                                            settings,
                                            machineId,
                                            provider,
                                            chosen,
                                        )
                                    }
                                },
                            )
                            Spacer(Modifier.height(12.dp))
                        }
                    }
                    if (view.models.isNotEmpty() && view.modelParams.isNotEmpty()) {
                        item("models-heading") {
                            Text("Models", style = MaterialTheme.typography.titleSmall)
                            Text(
                                "How a model is loaded belongs to the machine, not to a session: " +
                                    "one copy of it in memory answers every session using it.",
                                style = MaterialTheme.typography.bodySmall,
                                color = MaterialTheme.colorScheme.onSurfaceVariant,
                            )
                            Spacer(Modifier.height(8.dp))
                        }
                    }
                    machineModels.actionError?.let { failure ->
                        item("models-error") {
                            Text(failure, color = MaterialTheme.colorScheme.error)
                        }
                    }
                    // Above the models: this is what is about to be one of them.
                    downloadCards(machineModels)
                    val sizes = machineModels.sizes
                    uniqueItems(view.models, key = { it.id }) { model ->
                        ModelCard(
                            model = model,
                            specs = view.modelParams,
                            bytes = sizes[model.id],
                            onDelete =
                                if (model.id in sizes) ({ confirmingDelete = model }) else null,
                            // Tapping opens the settings; a provider whose models take none has
                            // nothing to open, so the row is not a control.
                            onEdit =
                                if (view.modelParams.isEmpty()) null else ({ editing = model }),
                            onUnload =
                                if (model.status == "loaded" || model.status == "sleeping") {
                                    {
                                        act("Unloading ${model.label}…") {
                                            unloadProviderModel(
                                                settings,
                                                machineId,
                                                provider,
                                                model.id,
                                            )
                                        }
                                    }
                                } else null,
                            enabled = busy == null,
                        )
                    }
                    if (kind == "llama_cpp") modelSearch(machineModels)
                    if (view.mcpServers.isNotEmpty()) {
                        item("mcp") {
                            Spacer(Modifier.height(12.dp))
                            Text("Tool servers", style = MaterialTheme.typography.titleSmall)
                            Text(
                                view.mcpServers.joinToString(", ") +
                                    " — configured on the backend, in its config file.",
                                style = MaterialTheme.typography.bodySmall,
                                color = MaterialTheme.colorScheme.onSurfaceVariant,
                            )
                        }
                    }
                }
            }
        }
    }
    editing?.let { model ->
        val view = (state as? LoadState.Loaded)?.value
        ModelSettingsDialog(
            model = model,
            specs = view?.modelParams.orEmpty(),
            onDismiss = { editing = null },
            onSave = { params ->
                editing = null
                act("Saving ${model.label}…") {
                    setModelSettings(settings, machineId, provider, model.id, params)
                }
            },
        )
    }
    confirmingDelete?.let { model ->
        AlertDialog(
            onDismissRequest = { confirmingDelete = null },
            title = { Text("Delete ${model.label}?") },
            text = {
                Text(
                    "The file is removed from ${(state as? LoadState.Loaded)?.value?.machine ?: "this machine"}. " +
                        "Nothing here can get it back -- downloading it again is the whole file again. " +
                        "Sessions using it keep their conversations and cannot start it."
                )
            },
            confirmButton = {
                TextButton(
                    onClick = {
                        confirmingDelete = null
                        machineModels.remove(model.id)
                    }
                ) {
                    Text("Delete")
                }
            },
            dismissButton = {
                TextButton(onClick = { confirmingDelete = null }) { Text("Cancel") }
            },
        )
    }
    if (confirmingStop) {
        AlertDialog(
            onDismissRequest = { confirmingStop = false },
            title = { Text("Stop this server?") },
            text = {
                // Said plainly rather than hidden: this is the only thing that frees the memory,
                // and what it costs is that every session on this machine reloads its model.
                Text(
                    "Every model it is holding is unloaded. Sessions using it will show as " +
                        "exited, and the next message to one loads its model again — which is " +
                        "the slow part, not the sending."
                )
            },
            confirmButton = {
                TextButton(
                    onClick = {
                        confirmingStop = false
                        act("Stopping…") { stopProviderServer(settings, machineId, provider) }
                    }
                ) {
                    Text("Stop")
                }
            },
            dismissButton = { TextButton(onClick = { confirmingStop = false }) { Text("Cancel") } },
        )
    }
 }
@Composable
 private fun ServerCard(
    server: ServerState,
    maxLoaded: Int?,
    enabled: Boolean,
    onStop: () -> Unit,
    onMaxLoaded: (Int?) -> Unit,
 ) {
    // The saved value is what this starts at and what Save is compared against, so a field left
    // half-typed is visibly not saved rather than quietly either way.
    val saved = maxLoaded?.toString().orEmpty()
    var typed by remember(saved) { mutableStateOf(saved) }
    Card(Modifier.fillMaxWidth()) {
        Column(Modifier.padding(12.dp)) {
            Text("Model server", style = MaterialTheme.typography.titleSmall)
            Text(
                if (server.running) {
                    "Running" + (server.port?.let { ", reached on port $it" } ?: "")
                } else {
                    // Not a fault: nothing is loaded because nothing has asked. Saying it in
                    // words rather than colouring the row, since "stopped" and "we could not
                    // ask" would otherwise look the same.
                    "Not running. A session starts it when it needs a model."
                },
                style = MaterialTheme.typography.bodySmall,
                color = MaterialTheme.colorScheme.onSurfaceVariant,
            )
            Spacer(Modifier.height(8.dp))
            OutlinedTextField(
                value = typed,
                onValueChange = { typed = it.filter(Char::isDigit) },
                label = { Text("Models loaded at once") },
                placeholder = { Text("one -- a second model replaces the first") },
                singleLine = true,
                keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Number),
                modifier = Modifier.fillMaxWidth(),
            )
            Row(verticalAlignment = Alignment.CenterVertically) {
                // Shown whether or not it is running, and disabled when there is nothing to stop:
                // a button that comes and goes makes its own absence the message.
                TextButton(enabled = enabled && server.running, onClick = onStop) { Text("Stop") }
                Spacer(Modifier.weight(1f))
                TextButton(
                    enabled = enabled && typed != saved,
                    onClick = { onMaxLoaded(typed.toIntOrNull()) },
                ) {
                    Text("Save")
                }
            }
            if (typed != saved) {
                Text(
                    "Read when this server next starts.",
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.onSurfaceVariant,
                )
            }
        }
    }
 }
@Composable
 private fun ModelCard(
    model: ProviderModel,
    specs: List<ParamSpec>,
    /** How big the file is on the machine, for a provider whose models are files. */
    bytes: Long?,
    onEdit: (() -> Unit)?,
    onUnload: (() -> Unit)?,
    onDelete: (() -> Unit)?,
    enabled: Boolean,
 ) {
    Card(
        Modifier.fillMaxWidth()
            .padding(vertical = 4.dp)
            .then(if (onEdit != null && enabled) Modifier.clickable(onClick = onEdit) else Modifier)
    ) {
        Column(Modifier.padding(12.dp)) {
            Row(verticalAlignment = Alignment.CenterVertically) {
                Text(
                    model.label,
                    style = MaterialTheme.typography.bodyMedium,
                    modifier = Modifier.weight(1f),
                )
                bytes?.let {
                    Text(
                        gigabytes(it),
                        style = MaterialTheme.typography.bodySmall,
                        color = MaterialTheme.colorScheme.onSurfaceVariant,
                    )
                }
            }
            // What the server is doing with it, in its own word. Absent means nobody could ask --
            // the server is not running -- and the line is left out rather than guessed at.
            model.status?.let {
                Text(
                    it,
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.onSurfaceVariant,
                )
            }
            if (model.settings.isNotEmpty()) {
                Text(
                    // In the words the dialog uses, and in the order it draws them: a summary
                    // naming `contextSize` is a summary of a different screen than the one it
                    // sits under.
                    specs
                        .mapNotNull { spec ->
                            model.settings[spec.key]?.let { "${spec.label} $it" }
                        }
                        .joinToString(", "),
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.onSurfaceVariant,
                )
            }
            if (onUnload != null || onDelete != null) {
                Row(verticalAlignment = Alignment.CenterVertically) {
                    // Both shown whenever this kind of model has them, disabled rather than
                    // absent: unloading frees memory and deleting frees disk, and a button that
                    // comes and goes makes its own absence the message.
                    onUnload?.let { TextButton(enabled = enabled, onClick = it) { Text("Unload") } }
                    Spacer(Modifier.weight(1f))
                    onDelete?.let { TextButton(enabled = enabled, onClick = it) { Text("Delete") } }
                }
            }
        }
    }
 }
 /**
 * How one model is loaded.
 *
 * Saved on Save rather than as it is typed, unlike the session settings dialog: writing this
 * unloads the model for everybody using it, which is not something to do once per keystroke.
 */
@Composable
 private fun ModelSettingsDialog(
    model: ProviderModel,
    specs: List<ParamSpec>,
    onDismiss: () -> Unit,
    onSave: (Map<String, String>) -> Unit,
 ) {
    var params by remember(model.id) { mutableStateOf(model.settings) }
    AlertDialog(
        onDismissRequest = onDismiss,
        // Every control here is a number, so the keyboard is up for most of this dialog's life --
        // and a dialog that keeps its own size under the keyboard puts Save off the bottom of the
        // screen, where nothing on screen says it is there. Taking the insets ourselves is what
        // lets `imePadding` shrink it instead.
        properties = DialogProperties(decorFitsSystemWindows = false),
        modifier = Modifier.imePadding(),
        title = { Text(model.label) },
        text = {
            Column(Modifier.verticalScroll(rememberScrollState())) {
                Text(
                    if (model.status == "loaded" || model.status == "sleeping") {
                        "This model is loaded. Saving takes it out of memory, and the sessions " +
                            "using it load it again with these settings on their next message."
                    } else {
                        "Read when this model is next loaded."
                    },
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.onSurfaceVariant,
                )
                Spacer(Modifier.height(12.dp))
                ProviderParamFields(
                    specs = specs,
                    values = params,
                    onChange = { params = it },
                    // Every one of these is read at load time, and the sentence above already
                    // says when that is -- marking each control "on restart" would repeat it six
                    // times.
                    warnAboutRestart = false,
                )
            }
        },
        confirmButton = { TextButton(onClick = { onSave(params) }) { Text("Save") } },
        dismissButton = { TextButton(onClick = onDismiss) { Text("Cancel") } },
    )
 }
@@ -1,10 +1,12 @@
 package com.example.aiapp
 import androidx.compose.foundation.background
 import androidx.compose.foundation.horizontalScroll
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.ColumnScope
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.rememberScrollState
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Modifier
@@ -18,6 +20,14 @@ import androidx.compose.ui.unit.dp
 * monospace text drawn hard against the edge of a tinted block reads as a clipping fault, and three
 * copies of "clip, fill, pad" drift apart the first time one is adjusted.
 *
 * **Nothing in here wraps; it scrolls sideways instead.** This is column-aligned far more often
 * than it is prose -- a diff, a table, a test run, a command and its arguments -- and wrapping
 * destroys exactly the alignment that was carrying the meaning, while turning one line into four
 * and a run of them into a wall. The scroll belongs to the block rather than to each line so that
 * the lines stay aligned with each other as it moves: one offset for the whole column is what makes
 * a shifted diff still read as a diff. Every [Text] inside is therefore drawn with `softWrap =
 * false`, which is the half of this a caller has to remember.
 *
 * The colour is [rawSurface], which is also what a code block inside a reply is given.
 */
@Composable
@@ -29,6 +39,10 @@ fun RawBlock(modifier: Modifier = Modifier, content: @Composable ColumnScope.()
            // rectangle drawn at the same radius as the one behind it reads as a misprint.
            .clip(MaterialTheme.shapes.extraSmall)
            .background(rawSurface)
            // Clipped and filled before this, so the tint is the viewport and does not scroll away
            // from under the text; padded after it, so the inset travels with the content and the
            // last column does not end flush against the edge.
            .horizontalScroll(rememberScrollState())
            .padding(horizontal = 8.dp, vertical = 6.dp),
        content = content,
    )
@@ -0,0 +1,284 @@
 package com.example.aiapp
 import androidx.compose.foundation.gestures.detectDragGestures
 import androidx.compose.foundation.gestures.scrollBy
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.lazy.LazyListItemInfo
 import androidx.compose.foundation.lazy.LazyListState
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.State
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableFloatStateOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.rememberUpdatedState
 import androidx.compose.runtime.setValue
 import androidx.compose.runtime.withFrameNanos
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.hapticfeedback.HapticFeedback
 import androidx.compose.ui.hapticfeedback.HapticFeedbackType
 import androidx.compose.ui.input.pointer.pointerInput
 import androidx.compose.ui.platform.LocalDensity
 import androidx.compose.ui.platform.LocalHapticFeedback
 import androidx.compose.ui.semantics.contentDescription
 import androidx.compose.ui.semantics.semantics
 import androidx.compose.ui.unit.Density
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
 import kotlin.math.abs
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.launch
 /**
 * Dragging a row of a [androidx.compose.foundation.lazy.LazyColumn] into a different place in it.
 *
 * Generic rather than the session list's own, because "hold this and move it" is one gesture
 * wherever it appears and the arithmetic below is the whole of it. The list itself is left alone:
 * this reports a move and the caller decides what a move means -- it is the caller that holds the
 * rows and the caller that tells a server about the new order.
 *
 * The drag is on a [ReorderHandle] rather than on the row, which is what keeps it out of the way of
 * the scroll. A whole row that can be dragged sideways-ish is a row that sometimes eats a fling,
 * and a list is scrolled far more often than it is rearranged.
 */
 class Reorder
 internal constructor(
    private val listState: LazyListState,
    private val scope: CoroutineScope,
    private val haptics: HapticFeedback,
    /** What the [EDGE] band is in pixels here; a band in raw pixels is one screen's answer. */
    private val density: Density,
    /**
     * The caller's own lists are what move; these are [State] so that the gesture, which outlives a
     * recomposition, is never holding the first composition's copy of them.
     */
    private val onMove: State<(from: Int, to: Int) -> Unit>,
    private val onSettled: State<() -> Unit>,
 ) {
    /** The key of the row in hand, or null when nothing is being dragged. */
    var held by mutableStateOf<Any?>(null)
        private set
    /** Where the list had laid the row out when it was taken hold of, in viewport pixels. */
    private var grabbedAt = 0
    /** How far the finger has moved since, which is what the row is drawn following. */
    private var dragged by mutableFloatStateOf(0f)
    /** How far the list has scrolled under it since -- see [follow]. */
    private var scrolled = 0f
    /** The index the row has been moved to so far, which is what the next move counts from. */
    private var at = 0
    /** Where it started, so that a handle merely pressed is not reported as a rearrangement. */
    private var from = 0
    /**
     * How much of the travel below the moves so far have accounted for.
     *
     * The travel is what decides a crossing, rather than where the row is drawn *now*: a lazy list
     * animates an item into its new place, so for a few frames after a move `offset` still reports
     * roughly the old one. Deciding from that offset re-decided the same crossing on every frame
     * until the animation caught up, and a drag of two rows arrived six rows down.
     */
    private var settled = 0f
    private fun info(key: Any): LazyListItemInfo? =
        listState.layoutInfo.visibleItemsInfo.firstOrNull { it.key == key }
    private fun itemAt(index: Int): LazyListItemInfo? =
        listState.layoutInfo.visibleItemsInfo.firstOrNull { it.index == index }
    /**
     * How far from where the list laid it out this row should be drawn -- zero for every row but
     * the one in hand.
     *
     * Measured against where the row is laid out *now* rather than accumulated, which is what makes
     * it self-correcting: a move, or a scroll under the finger, puts the row somewhere new, and the
     * same subtraction cancels that out so the row stays under the finger instead of jumping by its
     * own height.
     */
    fun offsetOf(key: Any): Float {
        if (key != held) return 0f
        val now = info(key) ?: return 0f
        return grabbedAt + dragged - now.offset
    }
    internal fun grab(key: Any) {
        val from = info(key) ?: return
        held = key
        grabbedAt = from.offset
        at = from.index
        this.from = from.index
        dragged = 0f
        scrolled = 0f
        settled = 0f
        // The platform's "you have picked this up", the same feedback a long press gives, because
        // the gesture it confirms is the same kind of commitment.
        haptics.performHapticFeedback(HapticFeedbackType.LongPress)
    }
    internal fun drag(by: Float) {
        if (held == null) return
        dragged += by
        cross()
    }
    /**
     * Trades places with as many neighbours as the travel so far has earned.
     *
     * Half a neighbour's height each way, so the row changes place when it covers most of the one
     * it is passing -- and a full height of hysteresis before it can come back, since the move has
     * already paid that half in the other direction. A loop rather than one step: a fast drag, or a
     * list scrolling under a parked finger, crosses several rows between two events.
     */
    private fun cross() {
        while (true) {
            val slack = dragged + scrolled - settled
            val next = itemAt(if (slack > 0) at + 1 else at - 1) ?: return
            if (abs(slack) < next.size / 2f) return
            // Where the list is looking, taken before the move and put back after it. A lazy list
            // keeps its place by the *key* of the item at the top, so moving that item takes the
            // viewport with it -- drag the top row down two places and the list scrolls two rows
            // to follow it, which reads as the row never having moved. The correction is by index,
            // which is the thing that did not change.
            val anchor = listState.firstVisibleItemIndex
            val within = listState.firstVisibleItemScrollOffset
            onMove.value(at, next.index)
            // Requested rather than scrolled to: this has to take effect in the *same* measurement
            // as the move, and a scroll launched beside it lands before the list has taken the new
            // order and is then undone by it.
            listState.requestScrollToItem(anchor, within)
            settled += if (slack > 0) next.size.toFloat() else -next.size.toFloat()
            at = next.index
            // Loud on purpose: the row is under a finger that is covering it, so the tick is how
            // the reader knows a place was taken rather than that they are still between two.
            haptics.performHapticFeedback(HapticFeedbackType.SegmentTick)
        }
    }
    internal fun release() {
        // Only where the row actually went somewhere: a handle pressed and let go has rearranged
        // nothing, and reporting one would have the server rewrite the order it already has.
        val moved = held != null && at != from
        held = null
        dragged = 0f
        scrolled = 0f
        settled = 0f
        if (moved) onSettled.value()
    }
    /**
     * Scrolls the list while the row in hand is held against one end of it, so a row can be moved
     * further than one screenful. A frame loop rather than a response to the drag, because a finger
     * parked at the bottom edge sends no more events and is exactly the case this exists for.
     */
    internal fun follow() {
        val key = held ?: return
        scope.launch {
            while (held == key) {
                withFrameNanos {}
                val moving = info(key) ?: continue
                val viewport = listState.layoutInfo.viewportEndOffset
                val edge = with(density) { EDGE.toPx() }
                val top = grabbedAt + dragged
                val bottom = top + moving.size
                val step =
                    when {
                        top < edge -> -(edge - top).coerceAtMost(edge)
                        bottom > viewport - edge -> (bottom - (viewport - edge)).coerceAtMost(edge)
                        else -> 0f
                    }
                if (step == 0f) continue
                // Counted as travel of its own: the finger has not moved, but the rows have moved
                // under it, which is the same thing to everything above. Nothing is added to the
                // drag, because where the row is *drawn* is measured against the list's own
                // offsets and those have already moved.
                scrolled += listState.scrollBy(step * SPEED)
                cross()
            }
        }
    }
    private companion object {
        /** How close to an end of the list a held row has to be before the list follows it. */
        val EDGE = 36.dp
        /** A fraction of the overshoot per frame, so the scroll eases in rather than lurching. */
        const val SPEED = 0.12f
    }
 }
@Composable
 fun rememberReorder(
    listState: LazyListState,
    /** Two indices into the lazy list, which is the caller's own order to rearrange. */
    onMove: (from: Int, to: Int) -> Unit,
    /** The drag is over: the order on screen is the one to keep. */
    onSettled: () -> Unit,
 ): Reorder {
    val move = rememberUpdatedState(onMove)
    val settled = rememberUpdatedState(onSettled)
    val haptics = LocalHapticFeedback.current
    val density = LocalDensity.current
    val scope = rememberCoroutineScope()
    return remember(listState) { Reorder(listState, scope, haptics, density, move, settled) }
 }
 /**
 * The handle a row is dragged by: the burger, at about the size of a heading.
 *
 * Bigger than an icon beside a line of text -- this is what a row is taken hold of by, and at
 * [GLYPH_SIZE] it read as decoration on the end of the row. Not as big as the row either: a mark
 * scaled to the card's whole inner height came out heavier than anything else on screen, since
 * these rules thicken with the glyph.
 *
 * The touch square around it is [GLYPH_BUTTON_SIZE], the same as every other icon control here, so
 * the mark and the area that answers to a finger are two different sizes -- which is why the caller
 * subtracts [HANDLE_MARGIN] from the gap it wants: what has to line up with the text on the other
 * side is the mark, not the box around it.
 *
 * [key] is the row's own key in the list, which is how a gesture that started here finds the row it
 * belongs to -- an index would be stale the moment the first move landed.
 */
@Composable
 fun ReorderHandle(state: Reorder, key: Any, modifier: Modifier = Modifier) {
    Box(
        contentAlignment = Alignment.Center,
        modifier =
            modifier
                .size(GLYPH_BUTTON_SIZE)
                // Nothing here draws a word, and a handle is the kind of control somebody using a
                // screen reader has no other way to find.
                .semantics { contentDescription = "Drag to reorder" }
                .pointerInput(key) {
                    detectDragGestures(
                        onDragStart = {
                            state.grab(key)
                            state.follow()
                        },
                        onDrag = { _, amount -> state.drag(amount.y) },
                        onDragEnd = { state.release() },
                        onDragCancel = { state.release() },
                    )
                },
    ) {
        Glyph(DRAG_GLYPH, colour = MaterialTheme.colorScheme.onSurfaceVariant, size = HANDLE_MARK)
    }
 }
 /** How big the mark itself is: a heading's size, which is what the font is asked for in `sp`. */
 private val HANDLE_MARK = 24.sp
 /**
 * How much of the touch square lies outside the mark on each side.
 *
 * A caller that wants the *mark* a given distance from something takes this off that distance --
 * see the rule about aligning the mark rather than the box it is centred in.
 */
 val HANDLE_MARGIN = (GLYPH_BUTTON_SIZE - HANDLE_MARK.value.dp) / 2
@@ -0,0 +1,89 @@
 package com.example.aiapp
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.text.style.TextAlign
 import java.time.Instant
 import java.time.ZoneId
 import java.time.format.DateTimeFormatter
 import java.time.format.FormatStyle
 import java.util.Locale
 /**
 * The line under a finished reply: what it cost to produce, and when it was sent.
 *
 * Small and set back, in the tone the session's own subtitle takes: it is about the message rather
 * than part of it, and at the reply's own size it would read as the last thing the model said.
 *
 * Right-aligned because it closes the message rather than opening one -- a reader scanning down the
 * left edge is reading what was said, and this is where that ends.
 */
@Composable
 fun ReplyFooter(
    ts: Double,
    tokensPerSecond: Double?,
    prefillMs: Long?,
    modifier: Modifier = Modifier,
 ) {
    val text = replyFooterText(ts, tokensPerSecond, prefillMs, ZoneId.systemDefault()) ?: return
    Text(
        text,
        style = MaterialTheme.typography.labelSmall,
        color = MaterialTheme.colorScheme.onSurfaceVariant,
        textAlign = TextAlign.End,
        modifier = modifier.fillMaxWidth(),
    )
 }
 /**
 * What the footer says, or null when there is nothing to say: "read 9.5s · 50.3 tok/s · 3:00 PM".
 *
 * Split out so the wording is testable without a screen, and [zone] is a parameter for the same
 * reason [limitSummary] takes one: a test has to say the same thing wherever it runs.
 *
 * **The time is last, and so sits against the right edge whatever else is on the line.** The
 * measurements in front of it are the provider's, so a session on another provider has fewer of
 * them or none -- and a reader who has learned where the clock is should not have to find it again
 * because the model changed. The costs grow leftwards into the space instead.
 *
 * Those measurements are drawn only where the provider made them. Most do not -- a coding CLI
 * reports what a turn cost and never how long the model spent on it -- and the time this app
 * watched a reply arrive over is a different quantity: it counts the network, the pauses between
 * tokens and whatever else the machine was doing. So the line is the clock alone rather than a
 * plausible figure beside it.
 */
 fun replyFooterText(
    ts: Double,
    tokensPerSecond: Double?,
    prefillMs: Long?,
    zone: ZoneId,
 ): String? {
    val at =
        if (ts <= 0.0) null
        else
            try {
                DateTimeFormatter.ofLocalizedTime(FormatStyle.SHORT)
                    .withZone(zone)
                    .format(Instant.ofEpochMilli((ts * 1000).toLong()))
            } catch (_: Exception) {
                null
            }
    // A tenth up to three digits, where the difference between 18 and 18.4 tok/s is something a
    // reader comparing two models can use; past that the tenth is noise on a figure that moves by
    // more than that between turns.
    val rate =
        tokensPerSecond
            ?.takeIf { it > 0.0 }
            ?.let {
                if (it >= 100) String.format(Locale.getDefault(), "%.0f tok/s", it)
                else String.format(Locale.getDefault(), "%.1f tok/s", it)
            }
    // Named "read" rather than given a unit alone, because a second figure in seconds beside a
    // rate is unreadable otherwise -- and it is the same word the status row uses while it is
    // happening, so the wait and the figure for it are one vocabulary.
    val read = prefillMs?.takeIf { it > 0 }?.let { "read ${formatMillis(it)}" }
    return listOfNotNull(read, rate, at).joinToString(" · ").ifEmpty { null }
 }
@@ -31,13 +31,13 @@ import androidx.lifecycle.compose.LocalLifecycleOwner
 import androidx.lifecycle.repeatOnLifecycle
 /**
- * A session wanting attention, said over the app rather than through Android's drawer.
+ * A session wanting attention, said over the app as well as in Android's drawer.
 *
- * Two places can carry the same fact and only one is right at a time. A row in the shade is for
+ * Two places carry the same fact and they are doing different jobs: a row in the shade waits
- * somebody looking at something else: it makes a sound, it waits however long it has to, and acting
+ * however long it has to, which makes it the record, and a banner is read now or not at all, which
- * on it means leaving whatever they were doing. Somebody with this app open needs none of that. So
+ * makes it the interruption. So somebody with the app open gets both -- this, and a silent row
- * while these are on screen the stream is delivered here instead, which is arranged by the
+ * behind it that is still there when they go looking and goes by itself when they open the session.
- * collection below and nothing else.
+ * Whether the app is open at all is this collection and nothing else.
 *
 * A banner can go three ways, each somebody deciding something different: tapped, which opens the
 * session; pushed off either side; or left alone, in which case it goes when the bar runs out.
@@ -5,24 +5,32 @@ import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.gestures.detectTransformGestures
 import androidx.compose.foundation.interaction.MutableInteractionSource
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.navigationBarsPadding
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
 import androidx.compose.material3.Button
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.DisposableEffect
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.SideEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableFloatStateOf
 import androidx.compose.runtime.mutableIntStateOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
 import androidx.compose.ui.geometry.Offset
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.FilterQuality
 import androidx.compose.ui.graphics.ImageBitmap
@@ -30,12 +38,20 @@ import androidx.compose.ui.graphics.asImageBitmap
 import androidx.compose.ui.graphics.graphicsLayer
 import androidx.compose.ui.input.pointer.pointerInput
 import androidx.compose.ui.layout.ContentScale
 import androidx.compose.ui.layout.onSizeChanged
 import androidx.compose.ui.platform.LocalDensity
 import androidx.compose.ui.platform.LocalView
 import androidx.compose.ui.unit.Dp
 import androidx.compose.ui.unit.IntSize
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.isSpecified
 import androidx.compose.ui.window.Dialog
 import androidx.compose.ui.window.DialogProperties
 import androidx.compose.ui.window.DialogWindowProvider
 import androidx.core.view.ViewCompat
 import androidx.core.view.WindowCompat
 import androidx.core.view.WindowInsetsCompat
 import androidx.core.view.WindowInsetsControllerCompat
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
@@ -140,12 +156,23 @@ fun SessionImageViewer(
    onClose: () -> Unit,
 ) {
    val (bitmap, failed) = rememberSessionBitmap(settings, sessionId, ref)
    val view = LocalView.current
    var hiddenBars by remember(ref) { mutableStateOf(ViewerBars()) }
    var barInsets by remember(ref) { mutableStateOf(ViewerBarInsets()) }
    Dialog(
        onDismissRequest = onClose,
-        properties = DialogProperties(usePlatformDefaultWidth = false),
+        properties =
            DialogProperties(usePlatformDefaultWidth = false, decorFitsSystemWindows = false),
    ) {
        ViewerSystemBars(hiddenBars)
        Box(
-            Modifier.fillMaxSize().background(Color.Black).clickable(onClick = onClose),
+            Modifier.fillMaxSize()
                .background(Color.Black)
                .clickable(
                    interactionSource = remember { MutableInteractionSource() },
                    indication = null,
                    onClick = onClose,
                ),
            contentAlignment = Alignment.Center,
        ) {
            when (val image = bitmap) {
@@ -165,7 +192,46 @@ fun SessionImageViewer(
                        // beside it are.
                        CircularProgressIndicator(color = Color.White)
                    }
-                else -> ZoomableImage(image)
+                else -> {
                    var viewport by remember { mutableStateOf(IntSize.Zero) }
                    var nativeSizeRequest by remember { mutableIntStateOf(0) }
                    ZoomableImage(
                        image,
                        nativeSizeRequest = nativeSizeRequest,
                        onViewportChanged = {
                            viewport = it
                            ViewCompat.getRootWindowInsets(view)?.let { insets ->
                                barInsets =
                                    ViewerBarInsets(
                                        status =
                                            insets
                                                .getInsetsIgnoringVisibility(
                                                    WindowInsetsCompat.Type.statusBars()
                                                )
                                                .top,
                                        navigation =
                                            insets
                                                .getInsetsIgnoringVisibility(
                                                    WindowInsetsCompat.Type.navigationBars()
                                                )
                                                .bottom,
                                    )
                            }
                        },
                        onBarsChanged = { hiddenBars = it },
                        barInsets = barInsets,
                        viewport = viewport,
                    )
                    Button(
                        onClick = { nativeSizeRequest++ },
                        modifier =
                            Modifier.align(Alignment.BottomEnd)
                                .navigationBarsPadding()
                                .padding(16.dp),
                    ) {
                        Text("100%")
                    }
                }
            }
        }
    }
@@ -225,34 +291,72 @@ private fun enlargingFilter(sourceHeight: Int, drawnHeight: Int): FilterQuality
 * The image on its own, as large as it fits, with pinch to zoom.
 *
 * Inside a dialog rather than a screen -- see [SessionImageViewer] -- so the platform's back
- * gesture returns to the transcript instead of leaving the app. It opens fitted, the whole image
+ * gesture returns to the transcript instead of leaving the app. It opens fitted, with the whole
- * visible.
+ * image visible without enlarging a smaller one; the 100% control changes to one bitmap pixel per
 * screen pixel and recenters it.
 */
@Composable
-private fun ZoomableImage(image: ImageBitmap) {
+private fun ZoomableImage(
    image: ImageBitmap,
    nativeSizeRequest: Int,
    onViewportChanged: (IntSize) -> Unit,
    onBarsChanged: (ViewerBars) -> Unit,
    barInsets: ViewerBarInsets,
    viewport: IntSize,
 ) {
    var scale by remember { mutableFloatStateOf(1f) }
    var offsetX by remember { mutableFloatStateOf(0f) }
    var offsetY by remember { mutableFloatStateOf(0f) }
    val nativeScale = nativeScale(image.width, image.height, viewport.width, viewport.height)
    LaunchedEffect(nativeSizeRequest, nativeScale) {
        if (nativeSizeRequest > 0) {
            scale = nativeScale
            offsetX = 0f
            offsetY = 0f
        }
    }
    val bars =
        viewerBars(
            image.width,
            image.height,
            viewport.width,
            viewport.height,
            scale,
            Offset(offsetX, offsetY),
            barInsets,
        )
    SideEffect { onBarsChanged(bars) }
    Image(
        bitmap = image,
        contentDescription = "Attached image",
-        contentScale = ContentScale.Fit,
+        contentScale = ContentScale.Inside,
        // Zoomed in, the reader is looking at pixels on purpose.
        filterQuality = FilterQuality.None,
        modifier =
            Modifier.fillMaxSize()
-                .pointerInput(Unit) {
+                .onSizeChanged(onViewportChanged)
-                    detectTransformGestures { _, pan, zoom, _ ->
+                .pointerInput(nativeScale) {
-                        // Floor of 1 so the image cannot be pinched smaller than fitted, which is
+                    detectTransformGestures { centroid, pan, zoom, _ ->
-                        // already the whole of it; a ceiling so it cannot be lost off-screen.
+                        val oldScale = scale
-                        scale = (scale * zoom).coerceIn(1f, 8f)
+                        val maximumScale = maxOf(8f, nativeScale)
-                        if (scale > 1f) {
+                        val newScale = (oldScale * zoom).coerceIn(1f, maximumScale)
-                            offsetX += pan.x
+                        if (newScale > 1f) {
-                            offsetY += pan.y
+                            val offset =
                                zoomOffset(
                                    Offset(offsetX, offsetY),
                                    centroid,
                                    pan,
                                    oldScale,
                                    newScale,
                                    Offset(size.width / 2f, size.height / 2f),
                                )
                            offsetX = offset.x
                            offsetY = offset.y
                        } else {
                            offsetX = 0f
                            offsetY = 0f
                        }
                        scale = newScale
                    }
                }
                .graphicsLayer {
@@ -263,3 +367,104 @@ private fun ZoomableImage(image: ImageBitmap) {
                },
    )
 }
 /** Lets the picture use the whole display, hiding only the system bars it actually reaches. */
@Composable
 private fun ViewerSystemBars(hidden: ViewerBars) {
    val view = LocalView.current
    val window = (view.parent as? DialogWindowProvider)?.window
    val controller = window?.let { WindowCompat.getInsetsController(it, view) }
    SideEffect {
        controller?.systemBarsBehavior =
            WindowInsetsControllerCompat.BEHAVIOR_SHOW_TRANSIENT_BARS_BY_SWIPE
        if (hidden.status) {
            controller?.hide(WindowInsetsCompat.Type.statusBars())
        } else {
            controller?.show(WindowInsetsCompat.Type.statusBars())
        }
        if (hidden.navigation) {
            controller?.hide(WindowInsetsCompat.Type.navigationBars())
        } else {
            controller?.show(WindowInsetsCompat.Type.navigationBars())
        }
    }
    DisposableEffect(view) {
        onDispose {
            controller?.show(
                WindowInsetsCompat.Type.statusBars() or WindowInsetsCompat.Type.navigationBars()
            )
        }
    }
 }
 internal data class ViewerBars(val status: Boolean = false, val navigation: Boolean = false)
 internal data class ViewerBarInsets(val status: Int = 0, val navigation: Int = 0)
 /** Which full-screen system-bar regions the fitted, zoomed and panned image intersects. */
 internal fun viewerBars(
    imageWidth: Int,
    imageHeight: Int,
    viewportWidth: Int,
    viewportHeight: Int,
    scale: Float,
    offset: Offset,
    insets: ViewerBarInsets,
 ): ViewerBars {
    if (imageWidth <= 0 || imageHeight <= 0 || viewportWidth <= 0 || viewportHeight <= 0) {
        return ViewerBars()
    }
    val fittedScale = insideScale(imageWidth, imageHeight, viewportWidth, viewportHeight)
    val width = imageWidth * fittedScale * scale
    val height = imageHeight * fittedScale * scale
    val left = viewportWidth / 2f + offset.x - width / 2f
    val right = left + width
    val top = viewportHeight / 2f + offset.y - height / 2f
    val bottom = top + height
    val crossesScreen = right > 0f && left < viewportWidth
    return ViewerBars(
        status = crossesScreen && insets.status > 0 && bottom > 0f && top < insets.status,
        navigation =
            crossesScreen &&
                insets.navigation > 0 &&
                bottom > viewportHeight - insets.navigation &&
                top < viewportHeight,
    )
 }
 /** Scale relative to [ContentScale.Inside] at which bitmap and screen pixels are one-to-one. */
 internal fun nativeScale(
    imageWidth: Int,
    imageHeight: Int,
    viewportWidth: Int,
    viewportHeight: Int,
 ): Float {
    if (imageWidth <= 0 || imageHeight <= 0 || viewportWidth <= 0 || viewportHeight <= 0) return 1f
    return 1f / insideScale(imageWidth, imageHeight, viewportWidth, viewportHeight)
 }
 /** The downscale-only factor used by [ContentScale.Inside]. */
 private fun insideScale(
    imageWidth: Int,
    imageHeight: Int,
    viewportWidth: Int,
    viewportHeight: Int,
 ): Float =
    minOf(
        1f,
        viewportWidth.toFloat() / imageWidth,
        viewportHeight.toFloat() / imageHeight,
    )
 /** Keeps the image point beneath [centroid] beneath the fingers as its scale changes. */
 internal fun zoomOffset(
    offset: Offset,
    centroid: Offset,
    pan: Offset,
    oldScale: Float,
    newScale: Float,
    viewportCenter: Offset,
 ): Offset {
    val scaleChange = newScale / oldScale
    return offset * scaleChange + (centroid - viewportCenter) * (1f - scaleChange) + pan
 }
@@ -1,26 +1,28 @@
 package com.example.aiapp
 import androidx.activity.compose.BackHandler
 import androidx.compose.foundation.ExperimentalFoundationApi
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.combinedClickable
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.PaddingValues
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.heightIn
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.foundation.lazy.rememberLazyListState
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.Card
 import androidx.compose.material3.CardDefaults
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.FloatingActionButton
 import androidx.compose.material3.LinearProgressIndicator
 import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedCard
+import androidx.compose.material3.Surface
 import androidx.compose.material3.Switch
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
@@ -33,16 +35,30 @@ import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.alpha
 import androidx.compose.ui.graphics.graphicsLayer
 import androidx.compose.ui.layout.onSizeChanged
 import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.semantics.contentDescription
+import androidx.compose.ui.platform.LocalDensity
 import androidx.compose.ui.semantics.semantics
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.zIndex
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 /**
- * The sessions tab: sessions awaiting an answer sort to the top, which is the "your turn" inbox.
+ * The sessions tab: every session, in the order the reader has put them in.
 *
 * Nothing here sorts. The order is the server's `sessions` list and the reader's own -- see
 * [reorderSessions] -- which is the one arrangement a row cannot be moved out of by something the
 * session does. It replaced sorting by activity, and then sorting by when each agent was turned on:
 * both meant a list that rearranged itself under whoever was reading it, and the status word and
 * its colour already say which session wants something without the row having to move to say it.
 *
 * Holding a row puts the screen in selection mode, the same gesture and the same bottom bar as the
 * import tab, so the two lists are learned once. Rearranging is deliberately *not* part of a
 * selection -- the handle moves the row it is on, whether or not that row is picked out -- because
 * "which rows am I acting on" and "where does this one go" are two questions.
 *
 * No title and no Back of its own -- [MainScreen] owns the header and the tab that names this one.
 * What stays here is the button that adds a session, because that acts on this list and nothing
@@ -53,39 +69,24 @@ fun SessionListScreen(
    settings: ServerSettings,
    reloadToken: Int,
    onOpen: (SessionSummary) -> Unit,
    /** Opens one session's subagent, from the expander under its card. */
    onOpenSubagent: (SessionSummary, SubagentSummary) -> Unit,
    onSpawn: () -> Unit,
    /** A session this list has just deleted, for whoever is showing it elsewhere. */
    onDeleted: (String) -> Unit = {},
 ) {
    val scope = rememberCoroutineScope()
    var listState by remember { mutableStateOf<LoadState<List<SessionSummary>>>(LoadState.Loading) }
    var confirmingDelete by remember { mutableStateOf<SessionSummary?>(null) }
-    // Which session cards are expanded to show their subagents, and what each expansion fetched.
+    // Which rows the reader has picked out. Empty means selection mode is off, as on the import
-    // Ids rather than a flag on the row for the same reason `deleting` is: the rows are rebuilt
+    // tab: a selection mode with nothing in it has no controls and no way out but Back.
-    // from
+    var selected by remember { mutableStateOf<Set<String>>(emptySet()) }
    // whatever the server last said, and this belongs to the reader's own choice, which survives a
    // refresh.
    var expandedSessions by remember { mutableStateOf(setOf<String>()) }
    var subagentLoads by remember {
        mutableStateOf(mapOf<String, LoadState<List<SubagentSummary>>>())
    }
-    fun loadSubagents(sessionId: String) {
+    // The sessions a delete has been confirmed for, or none. A list rather than one session,
-        subagentLoads = subagentLoads + (sessionId to LoadState.Loading)
+    // because a selection is what the bar below acts on.
-        scope.launch {
+    var confirmingDelete by remember { mutableStateOf<List<SessionSummary>>(emptyList()) }
-            subagentLoads =
+
-                subagentLoads +
+    // Whether an answer is outstanding, which is a different question from whether there is
-                    (sessionId to
+    // anything to draw: see [refresh].
-                        try {
+    var reloading by remember { mutableStateOf(false) }
                            LoadState.Loaded(
                                withContext(Dispatchers.IO) { fetchSubagents(settings, sessionId) }
                            )
                        } catch (e: ApiException) {
                            LoadState.failed(e)
                        })
        }
    }
    // Failures that belong to one session rather than to the list, keyed by its id and shown on its
    // own card. The two scopes are decided by whether the server answered: it answered and refused,
@@ -94,6 +95,10 @@ fun SessionListScreen(
    // Cleared on the next successful load below -- an entry outlives its session otherwise.
    var deleteErrors by remember { mutableStateOf<Map<String, String>>(emptyMap()) }
    // Why the order on screen is not the order that was saved, when saving one failed. The list is
    // what failed, so it is reported over the list rather than on any row.
    var orderError by remember { mutableStateOf<String?>(null) }
    // Which sessions have a delete in flight. A set of ids rather than a flag on the row, because
    // the rows are rebuilt from whatever the server last said and this belongs to the request.
    var deleting by remember { mutableStateOf<Set<String>>(emptySet()) }
@@ -104,39 +109,142 @@ fun SessionListScreen(
    val transcriptCache = remember(settings) { TranscriptCache(cacheRoot(context, settings)) }
    fun refresh() {
-        listState = LoadState.Loading
+        // The rows stay while the answer is on its way, with the bar below saying one is: this
        // list is asked again every time the panel over a session is opened, and blanking it each
        // time hands the reader an empty screen to report on something that was never in doubt.
        // A first load has nothing to keep, and says so with the spinner instead.
        if (listState !is LoadState.Loaded) listState = LoadState.Loading
        reloading = true
        scope.launch {
            listState =
                try {
                    val loaded =
                        withContext(Dispatchers.IO) { LoadState.Loaded(fetchSessions(settings)) }
                    deleteErrors = emptyMap()
                    val alive = loaded.value.map { it.id }.toSet()
                    // A selection is of sessions, so one deleted somewhere else leaves it. Only
                    // that one: the other rows the reader picked out are still there.
                    selected = selected.intersect(alive)
                    // The path out for a cached transcript whose session was deleted somewhere
                    // else. This list is the only place that ever learns the full set. On the
                    // answer rather than in `finally`: a list that failed to arrive says nothing
                    // about which sessions exist.
-                    withContext(Dispatchers.IO) {
+                    withContext(Dispatchers.IO) { transcriptCache.retainOnly(alive) }
                        transcriptCache.retainOnly(loaded.value.map { it.id }.toSet())
                    }
                    // A session gone from this answer cannot still be expanded, and an expanded one
                    // that is still here asks again -- its subagents may have changed since the
                    // last
                    // fetch.
                    val ids = loaded.value.map { it.id }.toSet()
                    expandedSessions = expandedSessions intersect ids
                    subagentLoads = subagentLoads.filterKeys { it in ids }
                    expandedSessions.forEach(::loadSubagents)
                    loaded
                } catch (e: ApiException) {
                    LoadState.failed(e)
                }
            reloading = false
        }
    }
    /**
     * Deletes every session in [targets], one after another.
     *
     * One at a time and in the order they are drawn: the server has no batch delete for sessions,
     * and each one ends a process. Each row says what is happening to it from the moment the work
     * is handed over, which is also when the selection goes -- a bar still naming sessions being
     * deleted is a set nobody can act on.
     */
    fun deleteChosen(targets: List<SessionSummary>, alsoDeleteForeign: Boolean) {
        selected = emptySet()
        // Marked here rather than after the request returns: a row has to say something is
        // happening to it from the moment it is asked for.
        deleting = deleting + targets.map { it.id }
        deleteErrors = deleteErrors - targets.map { it.id }.toSet()
        scope.launch {
            for (session in targets) {
                try {
                    withContext(Dispatchers.IO) {
                        deleteSession(settings, session.id, alsoDeleteForeign)
                        // After it succeeded, not before: a refused delete leaves the session
                        // exactly as it was, and its transcript with it.
                        transcriptCache.session(TranscriptAddress(session.id)).purge()
                    }
                    // Only this row, and only what changed. Refetching the list instead put every
                    // other session back through loading and handed the reader an empty screen, to
                    // report on something never in doubt.
                    val loaded = listState
                    if (loaded is LoadState.Loaded) {
                        listState = LoadState.Loaded(loaded.value.filterNot { it.id == session.id })
                    }
                    onDeleted(session.id)
                } catch (e: ApiException) {
                    // Kept, because it is still there: the server refused, so the session it
                    // refused about is exactly as it was.
                    deleteErrors = deleteErrors + (session.id to (e.message ?: "Delete failed"))
                } finally {
                    deleting = deleting - session.id
                }
            }
        }
    }
    LaunchedEffect(reloadToken) { refresh() }
    val rows = rememberLazyListState()
    val reorder =
        rememberReorder(
            listState = rows,
            onMove = { from, to ->
                // Moved here and now, because the row is under a finger: waiting for the server to
                // agree would drag the handle away from the card it is on. What the server thinks
                // is asked for when the finger comes up, and a refusal puts the list back.
                val loaded = listState
                if (loaded is LoadState.Loaded) {
                    val moved = loaded.value.toMutableList()
                    moved.add(to, moved.removeAt(from))
                    listState = LoadState.Loaded(moved)
                }
            },
            onSettled = {
                val loaded = listState
                if (loaded is LoadState.Loaded) {
                    val order = loaded.value.map { it.id }
                    scope.launch {
                        try {
                            withContext(Dispatchers.IO) { reorderSessions(settings, order) }
                            orderError = null
                        } catch (e: ApiException) {
                            orderError = e.message ?: "The new order couldn't be saved"
                            // The screen must not go on showing an arrangement nothing kept, so
                            // the server's own order comes back -- which is also the only way to
                            // see what it does think.
                            refresh()
                        }
                    }
                }
            },
        )
    // Back leaves selection mode rather than the tab, which is the level it is one step above.
    // Nested inside MainScreen's own handler, so it wins while there is a selection.
    BackHandler(enabled = selected.isNotEmpty()) { selected = emptySet() }
    // Measured rather than assumed: the list reserves exactly what the bar covers, so the last row
    // can still be scrolled to while it is up.
    var barHeight by remember { mutableStateOf(0.dp) }
    val density = LocalDensity.current
    // What the bar covers *now*: its measurement is kept while it is away, but nothing is
    // reserved for a bar that is not up.
    val covered = if (selected.isEmpty()) 0.dp else barHeight
    // The spawn button floats over the list, so the list ends above it -- measured, for the
    // reason the bar is. Without this the last row sat under the button, which was survivable
    // while every part of a row did the same thing and is not now that corner is a handle.
    var buttonHeight by remember { mutableStateOf(0.dp) }
    Box(Modifier.fillMaxSize()) {
        Column(Modifier.fillMaxSize().padding(16.dp)) {
            orderError?.let { message ->
                // The server's own words, unprefixed, the way every other failure is shown.
                Text(
                    message,
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.error,
                )
                Spacer(Modifier.height(8.dp))
            }
            when (val state = listState) {
                is LoadState.Loading -> CircularProgressIndicator()
                // The message as Api.kt wrote it, with nothing added: it is already a whole
@@ -155,31 +263,32 @@ fun SessionListScreen(
                            color = MaterialTheme.colorScheme.onSurfaceVariant,
                        )
                    }
-                    // Awaiting-answer first (the point of the screen), then most recently active.
+                    LazyColumn(
-                    val ordered =
+                        state = rows,
-                        state.value.sortedWith(
+                        contentPadding =
-                            compareByDescending<SessionSummary> { it.status == "awaitingInput" }
+                            PaddingValues(bottom = covered + buttonHeight + BUTTON_RING * 2),
-                                .thenByDescending { it.lastActivity }
+                    ) {
-                        )
+                        uniqueItems(state.value, key = { it.id }) { session ->
                    LazyColumn {
                        uniqueItems(ordered, key = { it.id }) { session ->
                            SessionCard(
                                session = session,
                                error = deleteErrors[session.id],
                                deleting = session.id in deleting,
-                                onOpen = { onOpen(session) },
+                                picked = session.id in selected,
-                                onLongPress = { confirmingDelete = session },
+                                // The handle is a selection-mode control, so it is absent rather
-                                expanded = session.id in expandedSessions,
+                                // than disabled outside one: this is not a capability being
-                                subagents = subagentLoads[session.id],
+                                // withheld, it is a mode the list is not in.
-                                onToggleSubagents = {
+                                reorder = reorder.takeIf { selected.isNotEmpty() },
-                                    if (session.id in expandedSessions) {
+                                onClick = {
-                                        expandedSessions = expandedSessions - session.id
+                                    // In selection mode a tap is a selection, so the reader is
-                                    } else {
+                                    // never one mis-tap away from opening a session they were only
-                                        expandedSessions = expandedSessions + session.id
+                                    // picking rows for.
-                                        loadSubagents(session.id)
+                                    if (selected.isEmpty()) onOpen(session)
-                                    }
+                                    else
                                        selected =
                                            if (session.id in selected) selected - session.id
                                            else selected + session.id
                                },
-                                onOpenSubagent = { subagent -> onOpenSubagent(session, subagent) },
+                                onLongPress = { selected = selected + session.id },
                            )
                            Spacer(Modifier.height(12.dp))
                        }
@@ -188,70 +297,114 @@ fun SessionListScreen(
            }
        }
        // Over the list rather than above it: a bar that appears in the flow moves every row down
        // by its own height at the moment the reader is looking at them.
        if (reloading) {
            LinearProgressIndicator(Modifier.align(Alignment.TopCenter).fillMaxWidth())
        }
        // Beside nothing in particular, because a selection is not one row: the options that act on
        // it belong to the screen, and the bottom is where a thumb already is.
        if (selected.isNotEmpty()) {
            val picked =
                (listState as? LoadState.Loaded)?.value?.filter { it.id in selected }.orEmpty()
            SessionSelectionBar(
                count = picked.size,
                modifier =
                    Modifier.align(Alignment.BottomCenter).onSizeChanged {
                        barHeight = with(density) { it.height.toDp() }
                    },
                onDelete = { confirmingDelete = picked },
            )
        }
        // Above the bar when there is one, by what that bar measured: the button stays rather than
        // coming and going, since an absent control cannot say whether there was nothing to do.
        FloatingActionButton(
            onClick = onSpawn,
-            modifier = Modifier.align(Alignment.BottomEnd).padding(24.dp),
+            modifier =
                Modifier.align(Alignment.BottomEnd)
                    .padding(end = BUTTON_RING, bottom = BUTTON_RING + covered)
                    .onSizeChanged { buttonHeight = with(density) { it.height.toDp() } },
        ) {
            Text("+", style = MaterialTheme.typography.headlineMedium)
        }
    }
-    confirmingDelete?.let { session ->
+    val targets = confirmingDelete
-        // Reset per session, so a toggle turned on for one conversation is not still on for the
+    if (targets.isNotEmpty()) {
-        // next. Off to begin with: see [deleteSession].
+        // Reset per selection, so a toggle turned on for one set of conversations is not still
-        var alsoDeleteForeign by remember(session.id) { mutableStateOf(false) }
+        // on for the next. Off to begin with: see [deleteSession].
        var alsoDeleteForeign by remember(targets) { mutableStateOf(false) }
        // Whichever of these keep a transcript of their own decide what the sentences below say,
        // and whether the switch is offered at all. Old servers reported only the capability, when
        // Claude Code was its sole owner.
        val owned = targets.filter { it.keepsOwnTranscript }
        val transcriptOwner = owned.firstOrNull()?.ownTranscriptName ?: "Claude Code"
        AlertDialog(
-            onDismissRequest = { confirmingDelete = null },
+            onDismissRequest = { confirmingDelete = emptyList() },
-            title = { Text("Delete \"${session.title}\"?") },
+            title = {
                Text(
                    if (targets.size == 1) "Delete \"${targets.first().title}\"?"
                    else "Delete ${targets.size} sessions?"
                )
            },
            text = {
                // Two different acts behind one button, so it says which one this is. What
-                // separates them is whether the *driver* keeps its own record of the conversation
+                // separates them is whether the *driver* keeps its own record of the
-                // -- the Claude Code CLI does, whether this app spawned the session or imported it;
+                // conversation
                // -- the coding CLIs do, whether this app spawned the session or imported it;
                // echo and llama.cpp do not.
                //
                // This used to branch on `imported`, above a comment asserting that "a session
-                // started here has no copy anywhere". That was false for every claude-cli session
+                // started here has no copy anywhere". That was false for every coding-CLI session
                // this app spawned, and getting it wrong in that direction is the expensive one:
-                // "this can't be undone", said of something that can, spends the credibility the
+                // "this can't be undone", said of something that can, spends the credibility that
                // sentence needs.
                //
-                // Neither branch promises a restore. The recoverable one says what is known -- the
+                // Neither branch promises a restore. The recoverable one says what is known,
-                // driver keeps its own record -- rather than that the file is still there, and it
+                // that the driver keeps its own record, rather than that the file is still there,
-                // names what goes either way, because this app's transcript holds images, peer
+                // and it names what goes either way, because this app's transcript holds images,
-                // messages and commands the CLI's own record never had.
+                // peer messages and commands the CLI's own record never had.
                //
                // A selection takes the sentence that covers all of it: "some of these" is what
                // makes the mixed case true without either half of it being read as a promise
                // about every row.
                Column {
                    Text(
                        when {
-                            !session.keepsOwnTranscript ->
+                            owned.isEmpty() ->
                                "Kills the process and deletes the conversation. Nothing else " +
                                    "keeps a copy, so this can't be undone."
-                            // The sentence below is the one the toggle makes false, which is why it
+                            // The sentence below is the one the toggle makes false, which is
-                            // is written twice rather than appended to: leaving "should still be
+                            // why it is written twice rather than appended to: "should still be
-                            // there to import again" on screen beside a switch that removes it is
+                            // there to import again", left on screen beside a switch that removes
-                            // the reassurance being read at the moment it stops being true.
+                            // it, is the reassurance being read as it stops being true.
                            alsoDeleteForeign ->
                                "Kills the process and deletes both copies of the conversation: " +
-                                    "this app's, and Claude Code's own transcript on the " +
+                                    "this app's, and $transcriptOwner's own transcript on the " +
                                    "machine. Nothing keeps another, so this can't be undone."
                            else ->
                                "Stops the process and deletes this app's copy of the " +
                                    "conversation, including any images, peer messages and " +
-                                    "commands recorded only here. Claude Code keeps its own " +
+                                    "commands recorded only here. $transcriptOwner keeps its own " +
-                                    "transcript on the machine, so the conversation itself " +
+                                    "transcript on the machine" +
-                                    "should still be there to import again."
+                                    (if (owned.size < targets.size) " for some of these" else "") +
                                    ", so the conversation itself should still be there to " +
                                    "import again."
                        }
                    )
                    // Only where there is a second copy to decide about. Absent rather than
                    // disabled, because this is not a capability being withheld: for echo and
                    // llama.cpp there is no other transcript, and a switch offering to delete one
                    // would be asking about something that does not exist.
-                    if (session.keepsOwnTranscript) {
+                    if (owned.isNotEmpty()) {
                        Spacer(Modifier.height(16.dp))
-                        // Its own row rather than beside the paragraph: a switch is taller than a
+                        // Its own row rather than beside the paragraph: a switch is taller
-                        // line of text and re-centres whatever shares a row with it.
+                        // than a line of text and re-centres whatever shares a row with it.
                        Row(verticalAlignment = Alignment.CenterVertically) {
                            Text(
-                                "Delete Claude Code's transcript too",
+                                "Delete $transcriptOwner's transcript too",
                                style = MaterialTheme.typography.bodyMedium,
                                modifier = Modifier.weight(1f),
                            )
@@ -267,38 +420,8 @@ fun SessionListScreen(
            confirmButton = {
                TextButton(
                    onClick = {
-                        confirmingDelete = null
+                        confirmingDelete = emptyList()
-                        // Marked here rather than after the request returns: the row has to say
+                        deleteChosen(targets, alsoDeleteForeign)
                        // something is happening to it from the moment it is asked for.
                        deleting = deleting + session.id
                        deleteErrors = deleteErrors - session.id
                        scope.launch {
                            try {
                                withContext(Dispatchers.IO) {
                                    deleteSession(settings, session.id, alsoDeleteForeign)
                                    // After it succeeded, not before: a refused delete leaves the
                                    // session exactly as it was, and its transcript with it.
                                    transcriptCache.session(TranscriptAddress(session.id)).purge()
                                }
                                // Only this row, and only what changed. Refetching the list instead
                                // put every other session back through loading and handed the
                                // reader an empty screen, to report on something never in doubt.
                                val loaded = listState
                                if (loaded is LoadState.Loaded) {
                                    listState =
                                        LoadState.Loaded(
                                            loaded.value.filterNot { it.id == session.id }
                                        )
                                }
                            } catch (e: ApiException) {
                                // Kept, because it is still there: the server refused, so the
                                // session it refused about is exactly as it was.
                                deleteErrors =
                                    deleteErrors + (session.id to (e.message ?: "Delete failed"))
                            } finally {
                                deleting = deleting - session.id
                            }
                        }
                    }
                ) {
                    // Coloured by consequence: this takes something away, and does so wherever it
@@ -307,12 +430,54 @@ fun SessionListScreen(
                }
            },
            dismissButton = {
-                TextButton(onClick = { confirmingDelete = null }) { Text("Cancel") }
+                TextButton(onClick = { confirmingDelete = emptyList() }) { Text("Cancel") }
            },
        )
    }
 }
 /**
 * The ring of space inside a session's card, which is also what its handle leaves around itself.
 */
 private val CARD_PADDING = 16.dp
 /** The gap the spawn button keeps from the edges it floats over, and from the list above it. */
 private val BUTTON_RING = 24.dp
 /**
 * What can be done to the sessions that are selected.
 *
 * Delete only, for now, which is the one thing this screen has ever done to a session from the list
 * rather than from inside it. The same bar as the import tab's, down to the wording of the count.
 */
@Composable
 private fun SessionSelectionBar(
    count: Int,
    modifier: Modifier = Modifier,
    onDelete: () -> Unit,
 ) {
    Surface(
        modifier = modifier.fillMaxWidth(),
        color = MaterialTheme.colorScheme.surfaceContainerHigh,
        tonalElevation = 3.dp,
    ) {
        Row(
            verticalAlignment = Alignment.CenterVertically,
            modifier = Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 8.dp),
        ) {
            Text(
                "$count selected",
                style = MaterialTheme.typography.bodyMedium,
                color = MaterialTheme.colorScheme.onSurfaceVariant,
                modifier = Modifier.weight(1f),
            )
            TextButton(onClick = onDelete) {
                Text("Delete", color = MaterialTheme.colorScheme.error)
            }
        }
    }
 }
@OptIn(ExperimentalFoundationApi::class)
@Composable
 private fun SessionCard(
@@ -327,183 +492,129 @@ private fun SessionCard(
     * about a request that has not been answered yet.
     */
    deleting: Boolean,
-    onOpen: () -> Unit,
+    /** Whether this row is one of the selection the bottom bar acts on. */
    picked: Boolean,
    /** The drag this row can be moved by, or null where the list is not in selection mode. */
    reorder: Reorder?,
    onClick: () -> Unit,
    onLongPress: () -> Unit,
    /** Whether the expander below is open. Collapsed by default; see [SessionListScreen]. */
    expanded: Boolean,
    /** What the expander's own fetch answered, or null before it has been asked. */
    subagents: LoadState<List<SubagentSummary>>?,
    onToggleSubagents: () -> Unit,
    onOpenSubagent: (SubagentSummary) -> Unit,
 ) {
    val held = reorder?.held == session.id
    BusyItem(label = if (deleting) "deleting" else null) {
        Card(
-            // Off while the delete is in flight: a card that still opens a session it is deleting
+            colors =
-            // is a race the reader can start by tapping. On the card rather than in [BusyItem],
+                if (picked)
-            // which leaves gestures alone so the list still scrolls.
+                    CardDefaults.cardColors(
-            Modifier.fillMaxWidth()
+                        containerColor = MaterialTheme.colorScheme.secondaryContainer,
-                .combinedClickable(
+                        contentColor = MaterialTheme.colorScheme.onSecondaryContainer,
-                    enabled = !deleting,
+                    )
-                    onClick = onOpen,
+                else CardDefaults.cardColors(),
-                    onLongClick = onLongPress,
+            // Lifted while it is in hand, which is the one cue that says this row is being carried
-                )
+            // rather than sitting where it belongs.
            elevation = CardDefaults.cardElevation(defaultElevation = if (held) 8.dp else 0.dp),
            modifier =
                Modifier.fillMaxWidth()
                    // Drawn where the finger has taken it, above the rows it is passing over. Both
                    // in the layer rather than in the layout, so nothing around it moves and the
                    // list does not remeasure per frame of a drag.
                    .zIndex(if (held) 1f else 0f)
                    .graphicsLayer { translationY = reorder?.offsetOf(session.id) ?: 0f },
        ) {
-            Column(Modifier.padding(16.dp)) {
+            Row(verticalAlignment = Alignment.CenterVertically) {
-                Row(
+                Column(
-                    verticalAlignment = Alignment.CenterVertically,
+                    // Everything but the handle, which is what makes the two gestures separate
-                    modifier = Modifier.fillMaxWidth(),
+                    // rather than competing: a press that lands on the handle never reaches this,
                    // so holding it cannot select the row it is about to move. The card had the
                    // click while the handle was the only thing inside it that did not want one,
                    // and a hold on the handle then both selected the row and ate the drag.
                    //
                    // Off while the delete is in flight: a card that still opens a session it is
                    // deleting is a race the reader can start by tapping. Here rather than in
                    // [BusyItem], which leaves gestures alone so the list still scrolls.
                    Modifier.weight(1f)
                        .combinedClickable(
                            enabled = !deleting,
                            onClick = onClick,
                            onLongClick = onLongPress,
                        )
                        .padding(CARD_PADDING)
                ) {
                    Text(
                        session.title,
                        style = MaterialTheme.typography.titleMedium,
                        modifier = Modifier.weight(1f),
                    )
                    StatusText(session.status)
                }
                Spacer(Modifier.height(4.dp))
                Row(modifier = Modifier.fillMaxWidth()) {
                    Text(
                        // Machine, then what runs on it, then what it is set to: the same order and
                        // separator as the session screen's header and the usage dialog, so one
                        // pair of facts is not written three ways.
                        listOfNotNull(
                                session.setupName,
                                session.provider,
                                session.model?.let { modelLabel(it) },
                            )
                            .joinToString(" · "),
                        style = MaterialTheme.typography.bodySmall,
                        color = MaterialTheme.colorScheme.onSurfaceVariant,
                        modifier = Modifier.weight(1f),
                    )
                    Text(
                        relativeTime(session.lastActivity),
                        style = MaterialTheme.typography.bodySmall,
                        color = MaterialTheme.colorScheme.onSurfaceVariant,
                    )
                }
                error?.let {
                    Spacer(Modifier.height(8.dp))
                    // The server's own words, unprefixed, the way every other failure is shown.
                    Text(
                        it,
                        style = MaterialTheme.typography.bodySmall,
                        color = MaterialTheme.colorScheme.error,
                    )
                }
                // Nothing at all for a card with no subagents: a disabled expander here would be
                // noise on every ordinary session's card. Its own row at the bottom rather than
                // beside the title or the machine line, so opening it never displaces text that was
                // already on screen -- see UI_RULES on a control not displacing the text beside it.
                if (session.subagents > 0) {
                    Spacer(Modifier.height(8.dp))
                    // The platform's minimum touch height, not the chevron's own ten or so dp:
                    // at the chevron's height a tap meant for it landed on the first subcard
                    // beneath and opened a subagent instead.
                    Row(
                        horizontalArrangement = Arrangement.Center,
                        verticalAlignment = Alignment.CenterVertically,
-                        modifier =
+                        modifier = Modifier.fillMaxWidth(),
                            Modifier.fillMaxWidth()
                                .heightIn(min = 48.dp)
                                .clickable(enabled = !deleting, onClick = onToggleSubagents)
                                .semantics {
                                    contentDescription =
                                        if (expanded) "Collapse subagents" else "Expand subagents"
                                },
                    ) {
-                        Chevron(if (expanded) Pointing.Up else Pointing.Down)
+                        Text(
-                    }
+                            session.title,
-                    if (expanded) {
+                            style = MaterialTheme.typography.titleMedium,
-                        Spacer(Modifier.height(4.dp))
+                            modifier = Modifier.weight(1f),
-                        Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                        )
-                            when (subagents) {
+                        StatusText(session.status)
-                                null,
+                        if (session.backgroundTasks > 0) {
-                                is LoadState.Loading ->
+                            Text(
-                                    CircularProgressIndicator(
+                                backgroundTaskLabel(session.backgroundTasks),
-                                        modifier = Modifier.width(20.dp).height(20.dp),
+                                style = MaterialTheme.typography.labelLarge,
-                                        strokeWidth = 2.dp,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                                    )
+                                modifier = Modifier.padding(start = 8.dp),
-                                is LoadState.Error ->
+                            )
                                    // Said here rather than left silent: a fetch that failed and an
                                    // expander that simply found nothing must not look the same --
                                    // see UI_RULES on designing the unknown state first.
                                    Text(
                                        subagents.message,
                                        style = MaterialTheme.typography.bodySmall,
                                        color = MaterialTheme.colorScheme.error,
                                    )
                                is LoadState.Loaded ->
                                    subagents.value.forEach { subagent ->
                                        SubagentCard(
                                            subagent,
                                            onClick = { onOpenSubagent(subagent) },
                                        )
                                    }
                            }
                        }
                    }
                    Spacer(Modifier.height(4.dp))
                    Row(modifier = Modifier.fillMaxWidth()) {
                        Text(
                            // Machine, then what runs on it, then what it is set to: the same order
                            // and separator as the session screen's header and the usage dialog, so
                            // one pair of facts is not written three ways.
                            listOfNotNull(
                                    session.machineName,
                                    session.provider,
                                    session.model?.let { modelLabel(it) },
                                )
                                .joinToString(" · "),
                            style = MaterialTheme.typography.bodySmall,
                            color = MaterialTheme.colorScheme.onSurfaceVariant,
                            modifier = Modifier.weight(1f),
                        )
                        Text(
                            relativeTime(session.lastActivity),
                            style = MaterialTheme.typography.bodySmall,
                            color = MaterialTheme.colorScheme.onSurfaceVariant,
                        )
                    }
                    error?.let {
                        Spacer(Modifier.height(8.dp))
                        // The server's own words, unprefixed, the way every other failure is shown.
                        Text(
                            it,
                            style = MaterialTheme.typography.bodySmall,
                            color = MaterialTheme.colorScheme.error,
                        )
                    }
                }
                // Inside the card, so what it moves is the thing it is drawn on. Nothing is held
                // open for it outside selection mode: the row is then the row it always was.
                if (reorder != null) {
                    ReorderHandle(
                        reorder,
                        session.id,
                        // Dimmed with the rest of the row while something is happening to it, since
                        // a row on its way out is not one to rearrange -- see [BusyItem], whose
                        // appearance this matches rather than repeating its dimming rule.
                        // The mark lines up with the text on the other side of the card,
                        // which means taking the square it is centred in off the gap: see
                        // [HANDLE_MARGIN].
                        Modifier.alpha(if (deleting) 0.4f else 1f)
                            .padding(end = CARD_PADDING - HANDLE_MARGIN),
                    )
                }
            }
        }
    }
 }
 /**
 * One subagent, indented inside its session's card -- the way dev-updater draws a project's
 * components (`ComponentCard`, `UpdaterScreen.kt`): an outlined card, not the session card's own
 * filled one, so the nesting reads as one step rather than as another session.
 */
@Composable
 private fun SubagentCard(subagent: SubagentSummary, onClick: () -> Unit) {
    OutlinedCard(Modifier.fillMaxWidth().clickable(onClick = onClick)) {
        Column(Modifier.padding(horizontal = 12.dp, vertical = 8.dp)) {
            Text(subagent.title, style = MaterialTheme.typography.titleSmall)
            Spacer(Modifier.height(2.dp))
            Row(modifier = Modifier.fillMaxWidth()) {
                Text(
                    subagentStatusLabel(subagent.status),
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.onSurfaceVariant,
                    modifier = Modifier.weight(1f),
                )
                Text(
                    relativeTime(subagent.lastActivity),
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.onSurfaceVariant,
                )
            }
        }
    }
 }
 /**
 * The subcard's word for a subagent's status -- see SUBAGENTS.md's "Wire shape". Its own function
 * rather than a branch inside [StatusText], because a subagent's three states are not that
 * composable's five: "exited" reads as "finished" here, since its process was always its parent's
 * and never something of its own to have merely stopped.
 */
 private fun subagentStatusLabel(status: String) =
    when (status) {
        "running" -> "running"
        "exited" -> "finished"
        else -> "unknown"
    }
@Composable
 fun StatusText(status: String) {
-    val (label, color) =
+    val label = sessionStatusWord(status)
-        when (status) {
+    val color = sessionStatusColour(status)
            "awaitingInput" -> "your turn" to awaitingColor
            "running" -> "running" to runningColor
            "compacting" -> "compacting" to commandColor
            "exited" -> "exited" to MaterialTheme.colorScheme.onSurfaceVariant
            // Said in words, because it differs in kind from the others rather than in degree: the
            // session is not idle and has not exited, nobody has been able to find out which. A
            // muted colour alone would read as one of the quiet states.
            "unknown" -> "can't tell" to MaterialTheme.colorScheme.onSurfaceVariant
            else -> status to MaterialTheme.colorScheme.onSurfaceVariant
        }
    Row(verticalAlignment = Alignment.CenterVertically) {
        if (sessionWorking(status)) {
            // The same colour as the word beside it: the two are one signal, and a spinner in the
@@ -44,8 +44,10 @@ import kotlinx.coroutines.withContext
 * screen of its own until 2026-08-30, which put a page transition and a back stack around two
 * controls and hid the thing they act on.
 *
- * The model and the permission mode are deliberately still on the session's own bar, because those
+ * The model and the permission mode are on the session's own bar as well, because those are changed
- * are changed *while* reading a turn -- "not this model, try that one".
+ * *while* reading a turn -- "not this model, try that one". They are here too because that bar is
 * one row shared with three actions: a long model name leaves the other picker a few pixels wide,
 * and this is where somebody goes looking for a setting anyway.
 *
 * Captions are for what a control costs rather than for what it is. A paragraph under every control
 * made the dialog longer than the conversation it covers -- so Notifications has none, while Move
@@ -61,15 +63,36 @@ fun SessionSettingsDialog(
    title: String,
    onRenamed: (String) -> Unit,
    /**
-     * How hard the model thinks, as the session reports it, or null for the CLI's own default.
+     * How hard the model thinks, or null for the CLI's own default.
     *
-     * Taken from the row this dialog was opened over rather than fetched, because unlike the
+     * Owned by the screen behind this rather than held here, like [title]: this dialog is what
-     * notification switch there is nothing else that changes it: the level is this app's to set and
+     * changes it, and a level kept only for as long as the dialog is open is the old one again the
-     * the server does not resolve it into something else.
+     * next time it is opened.
     *
     * Not fetched, because unlike the notification switch there is nothing else that changes it:
     * the level is this app's to set and the server does not resolve it into something else.
     */
    effort: String?,
    onEffortChanged: (String?) -> Unit,
    /** Whether a level does anything here; the row is left out entirely where it does not. */
    takesEffort: Boolean,
    /**
     * The settings that are one of a list -- the model and the permission mode.
     *
     * Owned by the screen behind this, like [title] and [effort]: it is what asked the machine what
     * the provider offers. Whichever of them this one has no answer for is not in the list, and
     * draws no row.
     */
    choices: List<SessionChoice>,
    /**
     * The settings this session's provider takes, and what they are set to.
     *
     * Declared by the server rather than listed here -- see [ProviderParamFields]. Empty for a
     * provider with none, which draws no section at all.
     */
    paramSpecs: List<ParamSpec>,
    params: Map<String, String>,
    onParamsChanged: (Map<String, String>) -> Unit,
    /**
     * What this phone is holding of the conversation, or null while that is being measured -- see
     * the Reload row below, which is what would discard it.
@@ -82,17 +105,9 @@ fun SessionSettingsDialog(
     * measures is that screen's own state.
     */
    onCopyRenderReport: () -> Unit,
    /**
     * Runs P0's scripted scroll-and-stream benchmark and copies the extended report, or null on
     * every build but `bench` -- see [BuildConfig.FIXTURE_MODE] and BenchRun.kt. Null rather than
     * always-present-but-disabled: this has no meaning at all outside the bench build, and a
     * control with nothing behind it on every other build is not a state worth drawing.
     */
    onRunBenchmark: (() -> Unit)? = null,
 ) {
    val scope = rememberCoroutineScope()
    var name by remember(sessionId) { mutableStateOf(title) }
    var level by remember(sessionId) { mutableStateOf(effort) }
    var effortError by remember { mutableStateOf<String?>(null) }
    var saving by remember { mutableStateOf(false) }
    var error by remember { mutableStateOf<String?>(null) }
@@ -172,14 +187,14 @@ fun SessionSettingsDialog(
     * control that stays where it was put after a refusal is stating something untrue.
     */
    fun setEffort(chosen: String?) {
-        val was = level
+        val was = effort
-        level = chosen
+        onEffortChanged(chosen)
        effortError = null
        scope.launch {
            try {
                withContext(Dispatchers.IO) { setSessionEffort(settings, sessionId, chosen) }
            } catch (e: ApiException) {
-                level = was
+                onEffortChanged(was)
                effortError = e.message
            }
        }
@@ -417,6 +432,20 @@ fun SessionSettingsDialog(
                        style = MaterialTheme.typography.bodySmall,
                    )
                }
                choices.forEach { choice ->
                    Spacer(Modifier.height(8.dp))
                    Row(
                        verticalAlignment = Alignment.CenterVertically,
                        modifier = Modifier.fillMaxWidth(),
                    ) {
                        Text(choice.label, modifier = Modifier.weight(1f))
                        PickerButton(
                            current = choice.current,
                            options = choice.options,
                            onPick = choice.onPick,
                        )
                    }
                }
                // Left out rather than disabled, the one place this dialog does that: a disabled
                // control teaches what the thing can do, and a llama session cannot do this at all
                // -- the row would be teaching something false about it.
@@ -428,7 +457,7 @@ fun SessionSettingsDialog(
                    ) {
                        Text("Thinking", modifier = Modifier.weight(1f))
                        PickerButton(
-                            current = level ?: DEFAULT_EFFORT,
+                            current = effort ?: DEFAULT_EFFORT,
                            // The level the CLI picks for itself is in the list as well as in the
                            // button, so leaving a level is not a one-way trip -- the same
                            // correction the model picker carries.
@@ -455,6 +484,23 @@ fun SessionSettingsDialog(
                        )
                    }
                }
                if (paramSpecs.isNotEmpty()) {
                    Spacer(Modifier.height(16.dp))
                    Text(
                        "Model settings",
                        style = MaterialTheme.typography.titleSmall,
                    )
                    Spacer(Modifier.height(8.dp))
                    // Edited here and saved by the screen behind this, which is what makes
                    // typing in a text field affordable: the save is debounced, and a dialog
                    // dismissed mid-edit would take an unsaved value with it.
                    ProviderParamFields(
                        specs = paramSpecs,
                        values = params,
                        onChange = onParamsChanged,
                        warnAboutRestart = true,
                    )
                }
                Spacer(Modifier.height(8.dp))
                Row(
                    verticalAlignment = Alignment.CenterVertically,
@@ -515,21 +561,6 @@ fun SessionSettingsDialog(
                    Text("Render timings", modifier = Modifier.weight(1f))
                    TextButton(onClick = onCopyRenderReport) { Text("Copy") }
                }
                // Bench-build only: see [onRunBenchmark]. Named exactly "Run benchmark" because
                // ui-trace and the emulator smoke run find it by that label, the same way every
                // other control here is found -- see AGENTS.md's "Driving the UI".
                onRunBenchmark?.let { run ->
                    Spacer(Modifier.height(8.dp))
                    Row(
                        verticalAlignment = Alignment.CenterVertically,
                        modifier = Modifier.fillMaxWidth(),
                    ) {
                        Glyph(SPEED_GLYPH, colour = MaterialTheme.colorScheme.onSurface)
                        Spacer(Modifier.width(8.dp))
                        Text("P0 benchmark", modifier = Modifier.weight(1f))
                        TextButton(onClick = run) { Text("Run benchmark") }
                    }
                }
            }
        },
        // Disabled rather than absent while there is nothing to save: a button that comes and goes
@@ -543,6 +574,19 @@ fun SessionSettingsDialog(
    )
 }
 /**
 * One session setting that is a choice from a list, as this dialog draws it.
 *
 * A shape rather than a pair of parameters each, because a provider may offer either of them, both
 * or neither, and they are otherwise the same control.
 */
 data class SessionChoice(
    val label: String,
    val current: String,
    val options: List<String>,
    val onPick: (String) -> Unit,
 )
 /**
 * When the server will next look, as a local time.
 *
@@ -0,0 +1,74 @@
 package com.example.aiapp
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.graphics.Color
 /**
 * What a session's status is called on screen, and what colour it is drawn in.
 *
 * One pair of functions rather than a branch on each screen that shows a status. There were two,
 * and the second silently fell short the moment the server grew a state: `waiting` arrived and the
 * session list learned the word and the colour while the session screen's status row printed the
 * wire's own word in the muted grey every quiet state uses. That comment already said the words
 * were "the session list's own"; this is what makes that true rather than a promise.
 *
 * A subagent's own three states are deliberately not here -- see `subagentStatusLabel`, which
 * collapses everything it does not recognise rather than passing it through, because a subagent has
 * fewer states than a session and reporting one it cannot have is worse than reporting none.
 */
 fun sessionStatusWord(status: String, subagent: Boolean = false): String =
    when (status) {
        "idle" -> "idle"
        "running" -> "running"
        "compacting" -> "compacting"
        // Not "running": a model coming off disk is not a model answering, and the difference is
        // minutes. Said in its own word so a first message that waits is explained rather than
        // looking like a session that has stopped responding. See `SessionStatus::Loading`.
        //
        // "model" rather than "loading" alone, because there are two waits before an answer and
        // the reader is entitled to know which one they are in: this one happens once, and
        // "reading prompt" below happens on every turn.
        "loading" -> "loading model"
        // The model has the prompt and has not started answering. Its own word for the same
        // reason: a long conversation spends real time here, and reported as "running" it looked
        // like a model thinking. See `SessionStatus::Reading`.
        "reading" -> "reading prompt"
        // Its own word, because the state it is easily mistaken for means the opposite: "idle"
        // invites the reader to type something, and a waiting session is going to carry on without
        // them. See `SessionStatus::Waiting`.
        "waiting" -> "waiting"
        "awaitingInput" -> "your turn"
        // A subagent's process was always its parent's, so it had none of its own to merely stop.
        "exited" -> if (subagent) "finished" else "exited"
        // Said in words, because it differs in kind from the others rather than in degree: the
        // session is not idle and has not exited, nobody has been able to find out which. A muted
        // colour alone would read as one of the quiet states.
        "unknown" -> "can't tell"
        // A state this build has never heard of, said as itself. The nearest word we do know would
        // read as a fact somebody established.
        else -> status
    }
 fun backgroundTaskLabel(count: Int): String = "$count bg ${if (count == 1) "task" else "tasks"}"
 /**
 * The colour that goes with [sessionStatusWord]: the accent is spent on the states that are about
 * to do something or want something, and every quiet one shares the muted colour.
 *
 * Stated beside whatever draws it rather than inherited -- a colour that carries meaning has to
 * carry its own contrast, since the surface under it will not change to rescue it.
 */
@Composable
 fun sessionStatusColour(status: String): Color =
    when (status) {
        "awaitingInput" -> awaitingColor
        "running" -> runningColor
        "compacting" -> commandColor
        // The same accent as the other states that are busy on their own account, because that is
        // what this is: something is happening and nothing is wanted from the reader.
        "loading",
        "reading" -> commandColor
        "waiting" -> waitingColor
        else -> MaterialTheme.colorScheme.onSurfaceVariant
    }
@@ -15,6 +15,8 @@ import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.drawWithContent
 import androidx.compose.ui.geometry.Offset
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.unit.dp
 import java.time.Duration
@@ -83,7 +85,7 @@ class UsageFeed(
        return when (val state = snapshots) {
            is LoadState.Loading -> SessionUsage.Waiting
            is LoadState.Error -> SessionUsage.Unavailable(state.message)
-            is LoadState.Loaded -> usageFor(state.value, session.setup, provider)
+            is LoadState.Loaded -> usageFor(state.value, session.machine, provider, session.model)
        }
    }
 }
@@ -125,8 +127,8 @@ fun rememberUsageFeed(settings: ServerSettings): UsageFeed {
 *
 * Worst rather than the five-hour one, because the button it colours opens *all* of them, and a
 * blue icon over a weekly quota at 97% would be the interface answering a question nobody asked.
- * Taken over however many windows came back rather than the three Claude sends today -- the backend
+ * Taken over however many windows this session's provider returned rather than the three Claude
- * passes windows it does not recognise straight through.
+ * sends today -- the backend passes windows it does not recognise straight through.
 *
 * Every state that is not a measurement takes the ordinary control colour instead. That is the
 * point where colour stops being able to help: blue is the low end of a scale here, so colouring an
@@ -142,7 +144,7 @@ fun usageGlyphColour(usage: SessionUsage): Color =
    }
 /**
- * The five-hour window for the machine this session runs on, under the session's own header.
+ * The shortest usage window for the pool this session uses, under the session's own header.
 *
 * Here rather than only in the usage dialog because it is the number that decides whether to keep
 * going, and it was a screen away from the place that decision gets made. It reports on this
@@ -159,16 +161,10 @@ fun SessionUsageBar(usage: SessionUsage, modifier: Modifier = Modifier) {
    // rather than recomputed at draw time: a percentage that comes back unchanged is an equal
    // value, Compose skips the recomposition, and a "left" that only ticked when the quota moved
    // would sit at a stale figure for hours.
-    var now by remember { mutableStateOf(OffsetDateTime.now()) }
+    val now = rememberUsageNow()
    LaunchedEffect(Unit) {
        while (true) {
            delay(REFRESH_MS)
            now = OffsetDateTime.now()
        }
    }
    // Nothing at all for a session that meters nothing: a row saying "unknown" there would report
-    // a problem about a setup somebody chose, on every screen, forever.
+    // a problem about a machine somebody chose, on every screen, forever.
    //
    // And nothing while the first fetch is out, which is a different silence. A request in flight
    // is not a state to report -- and the session that meters nothing is exactly the one this
@@ -189,22 +185,15 @@ fun SessionUsageBar(usage: SessionUsage, modifier: Modifier = Modifier) {
            // Both handled above, before the row exists at all.
            SessionUsage.NotMetered,
            SessionUsage.Waiting -> Unit
-            is SessionUsage.Unavailable -> UsageNote("5-hour usage unknown -- ${state.why}")
+            is SessionUsage.Unavailable -> UsageNote("Usage unknown -- ${state.why}")
            is SessionUsage.Known -> {
-                val window = state.windows.firstOrNull { it.kind == "session" }
+                val window = shortestUsageWindow(state.windows)
                if (window == null) {
-                    UsageNote("5-hour usage unknown -- no five-hour window reported")
+                    UsageNote("Usage unknown -- no window duration was reported")
                } else {
-                    LinearProgressIndicator(
+                    UsageProgressIndicator(window, now, Modifier.weight(1f))
                        progress = { (window.percent / 100.0).toFloat().coerceIn(0f, 1f) },
                        // The same step at the same percentages as the dialog's bars: this is the
                        // same measurement, and a reader who learned the colour there has to be
                        // able to read it here without checking which screen they are on.
                        color = quotaColor(window.percent),
                        modifier = Modifier.weight(1f),
                    )
                    Text(
-                        fiveHourLabel(window, now),
+                        usageWindowLabel(window, now),
                        style = MaterialTheme.typography.labelSmall,
                        color = MaterialTheme.colorScheme.onSurfaceVariant,
                        modifier = Modifier.padding(start = 8.dp),
@@ -215,6 +204,56 @@ fun SessionUsageBar(usage: SessionUsage, modifier: Modifier = Modifier) {
    }
 }
 /** A clock shared by each usage surface, advanced independently of changes to the quota. */
@Composable
 internal fun rememberUsageNow(): OffsetDateTime {
    var now by remember { mutableStateOf(OffsetDateTime.now()) }
    LaunchedEffect(Unit) {
        while (true) {
            delay(REFRESH_MS)
            now = OffsetDateTime.now()
        }
    }
    return now
 }
 /** The quota fill with a white tick showing how far the current time window has progressed. */
@Composable
 internal fun UsageProgressIndicator(
    window: UsageWindow,
    now: OffsetDateTime,
    modifier: Modifier = Modifier,
 ) {
    val elapsed = usageWindowElapsedFraction(window, now)
    LinearProgressIndicator(
        progress = { (window.percent / 100.0).toFloat().coerceIn(0f, 1f) },
        // The same step at the same percentages everywhere: this is the same measurement, and a
        // reader who learned the colour on one surface should not have to relearn it on another.
        color = quotaColor(window.percent),
        modifier =
            modifier.drawWithContent {
                drawContent()
                elapsed?.let { fraction ->
                    drawLine(
                        color = Color.White,
                        start = Offset(size.width * fraction, 0f),
                        end = Offset(size.width * fraction, size.height),
                        strokeWidth = 2.dp.toPx(),
                    )
                }
            },
    )
 }
 /** Elapsed time divided by the reported window duration, or null when either value is unknown. */
 internal fun usageWindowElapsedFraction(window: UsageWindow, now: OffsetDateTime): Float? {
    val durationMinutes = window.durationMinutes?.takeIf { it > 0 } ?: return null
    val end = windowEnd(window.resetsAt, now) as? WindowEnd.Ends ?: return null
    val remainingMinutes =
        end.until.seconds.toDouble() / 60.0 + end.until.nano.toDouble() / 60_000_000_000.0
    return (1.0 - remainingMinutes / durationMinutes).coerceIn(0.0, 1.0).toFloat()
 }
 /** Anything this row says instead of drawing a bar, so all of them look the same. */
@Composable
 private fun UsageNote(text: String) {
@@ -226,31 +265,40 @@ private fun UsageNote(text: String) {
 }
 /**
- * "42% -- 2h 15m left": how much is gone, then how long what is left has to last.
+ * "42% -- 2h 15m left / 5h": how much is gone, then how long what is left has to last, then how
 * long the whole window is.
 *
 * The percentage on its own does not answer the question it gets asked, which is whether to start
 * something now; 80% with twenty minutes to go and 80% with four hours to go are opposite answers.
 *
 * The window's *length* is what the provider's own name for it used to carry ("5-hour window"), and
 * it is worth more beside the time left than in front of the percentage: "3h 42m left / 5h" says in
 * one reading both how much of the cycle is to come and which cycle this is. Where the provider
 * reported no duration there is simply nothing after the span -- the name it gave is not a
 * measurement of one, so nothing is inferred from it.
 *
 * The window's end has two missing cases, worded differently on purpose; see [WindowEnd]. A window
 * that is not running gets the percentage and nothing else.
 */
-private fun fiveHourLabel(window: UsageWindow, now: OffsetDateTime): String {
+private fun usageWindowLabel(window: UsageWindow, now: OffsetDateTime): String {
    val percent = "${window.percent.toInt()}%"
    val outOf =
        window.durationMinutes?.takeIf { it > 0 }?.let { " / ${formatMillis(it * 60_000)}" } ?: ""
    return when (val end = windowEnd(window.resetsAt, now)) {
-        // Between blocks the five-hour window has no reset time, and saying so is a fact about
+        // Between blocks a window can have no reset time, and saying so is a fact about nothing:
-        // nothing: there is no window to run out. The percentage is the whole answer.
+        // there is no window to run out. The percentage is the whole answer.
        WindowEnd.NotRunning -> percent
        WindowEnd.Unreadable -> "$percent · reset time unreadable"
        is WindowEnd.Ends ->
            // Under a minute, including past the end: the number would round to "0m left", which
            // reads as a measurement rather than as the window having run out.
            if (end.until < Duration.ofMinutes(1)) "$percent · refresh soon"
-            else "$percent · ${formatSpan(end.until)} left"
+            else "$percent · ${formatSpan(end.until)} left$outOf"
    }
 }
 /**
- * One meter's snapshot, out of every machine's: [setup]'s row for [provider].
+ * One meter's snapshot, out of every machine's: [machine]'s row for [provider].
 *
 * Both halves are needed to pick it. A machine can hold more than one meter -- the Claude CLI's
 * account and, while a test has one set, an echo session's invented one -- and a snapshot is one
@@ -260,14 +308,60 @@ private fun fiveHourLabel(window: UsageWindow, now: OffsetDateTime): String {
 * None of them may look like zero, and none may look like [SessionUsage.NotMetered], which is the
 * machine having no quota rather than the question going unanswered.
 */
-fun usageFor(snapshots: List<UsageSnapshot>, setup: String, provider: String): SessionUsage {
+fun usageFor(
    snapshots: List<UsageSnapshot>,
    machine: String,
    provider: String,
    model: String?,
 ): SessionUsage {
    // No snapshot at all means the backend never asked, which it only does where there is nothing
    // to ask about. That is a different answer from having asked and failed.
    val pools = usageSnapshotsFor(snapshots, machine, provider)
    if (pools.isEmpty()) return SessionUsage.NotMetered
    val mine =
-        snapshots.firstOrNull { it.setup == setup && it.provider == provider }
+        usagePoolFor(pools, model)
-            ?: return SessionUsage.NotMetered
+            ?: return SessionUsage.Unavailable("couldn't tell which usage pool this session uses")
    if (mine.state != "ok") {
-        return SessionUsage.Unavailable(mine.detail ?: mine.state)
+        val why =
            mine.detail
                ?: when (mine.state) {
                    "notLoggedIn" -> "no Claude account is signed in on this machine"
                    "authenticating" -> "Claude sign-in is in progress"
                    "loginRequired" -> "Claude sign-in is required"
                    else -> mine.state
                }
        return SessionUsage.Unavailable(why)
    }
    return SessionUsage.Known(mine.windows)
 }
 /** Every billing pool reported for one provider on one machine. */
 internal fun usageSnapshotsFor(
    snapshots: List<UsageSnapshot>,
    machine: String,
    provider: String?,
 ): List<UsageSnapshot> =
    if (provider == null) emptyList()
    else snapshots.filter { it.machine == machine && it.provider == provider }
 /** The pool an explicit model names, or the provider's generic pool for every other model. */
 internal fun usagePoolFor(pools: List<UsageSnapshot>, model: String?): UsageSnapshot? {
    if (pools.size == 1) return pools.first()
    val normalizedModel = model?.normalizedPoolName()
    val named = normalizedModel?.let { wanted ->
        pools.firstOrNull { pool ->
            val name = pool.limitName?.normalizedPoolName()
            name == wanted || (wanted.contains("luna") && name == "gptreserve")
        }
    }
    return named ?: pools.firstOrNull { it.limitId == "codex" }
 }
 /** The shortest cycle the selected pool actually reported. */
 internal fun shortestUsageWindow(windows: List<UsageWindow>): UsageWindow? =
    windows
        .mapNotNull { window -> window.durationMinutes?.let { duration -> duration to window } }
        .minByOrNull { it.first }
        ?.second
 private fun String.normalizedPoolName(): String = lowercase().filter(Char::isLetterOrDigit)
@@ -0,0 +1,250 @@
 package com.example.aiapp
 import androidx.activity.compose.BackHandler
 import androidx.compose.animation.core.Animatable
 import androidx.compose.foundation.background
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.gestures.Orientation
 import androidx.compose.foundation.gestures.draggable
 import androidx.compose.foundation.gestures.rememberDraggableState
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.BoxScope
 import androidx.compose.foundation.layout.BoxWithConstraints
 import androidx.compose.foundation.layout.fillMaxHeight
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.width
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Surface
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.derivedStateOf
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableFloatStateOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.graphicsLayer
 import androidx.compose.ui.platform.LocalDensity
 import androidx.compose.ui.semantics.clearAndSetSemantics
 import androidx.compose.ui.semantics.contentDescription
 import androidx.compose.ui.semantics.semantics
 import androidx.compose.ui.unit.Dp
 import androidx.compose.ui.unit.dp
 import kotlin.math.absoluteValue
 import kotlinx.coroutines.launch
 private const val OPEN_THRESHOLD = 0.35f
 private val FLING_THRESHOLD = 400.dp
 /**
 * How much of the screen a panel takes by default, leaving a sliver of what it is over.
 *
 * A panel given the whole width instead is standing in for the screen rather than sitting over it,
 * and then the sliver would be a strip of a screen the reader has just left behind.
 */
 const val PANEL_FRACTION = 0.88f
 /** How dark the scrim over [SidePanels]' content goes with a panel fully open. */
 private const val SCRIM_ALPHA = 0.32f
 /**
 * Which side of the content a panel comes in from: where it sits, and which way it slides out.
 *
 * [sign] is also the direction of the reveal this side owns, so the drag arithmetic is written once
 * rather than once per side with the minus signs moved around.
 */
 enum class PanelSide(val alignment: Alignment, val sign: Float) {
    Left(Alignment.CenterStart, -1f),
    Right(Alignment.CenterEnd, 1f),
 }
 /**
 * Keeps [content] composed while a panel belonging to it moves over from the left or the right.
 *
 * One gesture drives both sides rather than one handler each, because two `draggable`s over the
 * same content cannot share a horizontal drag: the inner one claims it whichever way the finger
 * went, and the outer never sees a thing. So the position is a single signed reveal -- negative is
 * the left panel showing, positive the right -- which also makes it impossible to have both open.
 *
 * A side left null has no panel and no gesture toward it -- the reveal cannot travel that way at
 * all -- so one composable serves a screen with one panel and a screen with two.
 *
 * The root drag handler deliberately sits behind descendants. A horizontal scroller consumes its
 * drag first, so code blocks, attachments and tool inputs keep their existing gesture. Collapsing
 * that content, or starting over any ordinary part of the session, gives the gesture back to the
 * panel; Android's own right-edge Back gesture remains untouched.
 */
@Composable
 fun SidePanels(
    left: (@Composable (active: Boolean, close: () -> Unit) -> Unit)? = null,
    leftFraction: Float = PANEL_FRACTION,
    right: (@Composable (active: Boolean, close: () -> Unit) -> Unit)? = null,
    rightFraction: Float = PANEL_FRACTION,
    content: @Composable () -> Unit,
 ) {
    val scope = rememberCoroutineScope()
    // Which panel the gesture settled on, null for neither. The *settled* side rather than the
    // current position, so a panel's contents know they are being looked at while the animation
    // is still running.
    var opened by remember { mutableStateOf<PanelSide?>(null) }
    var dragging by remember { mutableStateOf(false) }
    var draggedReveal by remember { mutableFloatStateOf(0f) }
    val animatedReveal = remember { Animatable(0f) }
    // Read from a draw or layout lambda, never from the composable body: where the panel has got
    // to changes every frame of a drag, and a body that reads it recomposes this whole subtree --
    // the session included -- once per frame. The booleans below are what composition is allowed
    // to know, and each of them changes twice per gesture. (Same rule as the keyboard inset in
    // SessionScreen, and found the same way.)
    fun revealNow() = if (dragging) draggedReveal else animatedReveal.value
    val leftShown by remember { derivedStateOf { revealNow() < 0f } }
    val rightShown by remember { derivedStateOf { revealNow() > 0f } }
    val engaged = leftShown || rightShown
    val flingThreshold = with(LocalDensity.current) { FLING_THRESHOLD.toPx() }
    suspend fun startDrag() {
        animatedReveal.stop()
        draggedReveal = animatedReveal.value
        dragging = true
    }
    // Which panel the reveal belongs to, [bias] breaking the tie at rest -- a drag away from
    // nothing is toward whichever panel that direction opens.
    fun sideOf(bias: Float): PanelSide? =
        when {
            draggedReveal < 0f -> PanelSide.Left
            draggedReveal > 0f -> PanelSide.Right
            bias > 0f -> PanelSide.Left
            bias < 0f -> PanelSide.Right
            else -> null
        }
    suspend fun finishDrag(velocity: Float) {
        val side = sideOf(0f)
        // How fast the finger is moving toward that side's open position: the left panel opens
        // rightwards and the right panel leftwards, so the sign of a velocity only means something
        // once it is read against the side. A fling decides on its own; anything slower is decided
        // by how far in the panel already is.
        val toward = side?.let { -it.sign * velocity } ?: 0f
        val opens =
            if (toward.absoluteValue > flingThreshold) toward > 0f
            else draggedReveal.absoluteValue >= OPEN_THRESHOLD
        val target = side.takeIf { opens }
        opened = target
        animatedReveal.snapTo(draggedReveal)
        dragging = false
        animatedReveal.animateTo(target?.sign ?: 0f)
    }
    fun close() {
        opened = null
        scope.launch { animatedReveal.animateTo(0f) }
    }
    BackHandler(enabled = opened != null) { close() }
    BoxWithConstraints(Modifier.fillMaxSize()) {
        val dragState = rememberDraggableState { delta ->
            // Against the width of the panel this drag is moving, since the reveal is a fraction
            // of it and the two sides need not be the same width.
            val width =
                sideOf(delta)?.let {
                    constraints.maxWidth * if (it == PanelSide.Left) leftFraction else rightFraction
                } ?: return@rememberDraggableState
            draggedReveal =
                (draggedReveal - delta / width.coerceAtLeast(1f)).coerceIn(
                    if (left == null) 0f else -1f,
                    if (right == null) 0f else 1f,
                )
        }
        val drag =
            Modifier.draggable(
                state = dragState,
                orientation = Orientation.Horizontal,
                onDragStarted = { startDrag() },
                onDragStopped = { velocity -> finishDrag(velocity) },
            )
        Box(
            Modifier.fillMaxSize()
                .then(drag)
                .then(if (engaged) Modifier.clearAndSetSemantics {} else Modifier)
        ) {
            content()
        }
        if (engaged) {
            Box(
                Modifier.fillMaxSize()
                    .graphicsLayer { alpha = revealNow().absoluteValue * SCRIM_ALPHA }
                    .background(MaterialTheme.colorScheme.scrim)
                    .semantics { contentDescription = "Dismiss panel" }
                    .clickable { close() }
            )
        }
        // Both panels stay composed while they are off screen, so opening one costs no
        // composition -- but an off-screen panel is cleared from the semantics tree, since nothing
        // a reader cannot see should be reachable by swiping through the screen.
        left?.let { panel ->
            SlidingPanel(
                side = PanelSide.Left,
                width = maxWidth * leftFraction,
                raised = leftFraction < 1f,
                shown = { (-revealNow()).coerceAtLeast(0f) },
                visible = leftShown,
                drag = drag,
            ) {
                panel(opened == PanelSide.Left, ::close)
            }
        }
        right?.let { panel ->
            SlidingPanel(
                side = PanelSide.Right,
                width = maxWidth * rightFraction,
                raised = rightFraction < 1f,
                shown = { revealNow().coerceAtLeast(0f) },
                visible = rightShown,
                drag = drag,
            ) {
                panel(opened == PanelSide.Right, ::close)
            }
        }
    }
 }
 /**
 * One panel at [shown] of the way in, sliding out to its own [side].
 *
 * [raised] is for a panel with some of the screen still beside it, which takes a tonal step to say
 * it is above what it has not covered. A panel covering the whole width has nothing to be above,
 * and a step there is a screen that is simply the wrong colour.
 *
 * [visible] says the same thing as `shown() > 0f` and is the form composition may read; see
 * [SidePanels].
 */
@Composable
 private fun BoxScope.SlidingPanel(
    side: PanelSide,
    width: Dp,
    raised: Boolean,
    shown: () -> Float,
    visible: Boolean,
    drag: Modifier,
    contents: @Composable () -> Unit,
 ) {
    Surface(
        tonalElevation = if (raised) 3.dp else 0.dp,
        shadowElevation = 8.dp,
        modifier =
            Modifier.align(side.alignment)
                .width(width)
                .fillMaxHeight()
                .graphicsLayer { translationX = side.sign * size.width * (1f - shown()) }
                .then(if (visible) Modifier else Modifier.clearAndSetSemantics {})
                .then(drag),
    ) {
        contents()
    }
 }
@@ -48,19 +48,22 @@ fun SpawnScreen(
    val scope = rememberCoroutineScope()
    // What the form is made of, and whether we have it yet. A failure here is not the same as a
    // server with nothing to offer, so it must not reach the pickers as empty lists.
-    var options by remember { mutableStateOf<LoadState<List<Setup>>>(LoadState.Loading) }
+    var options by remember { mutableStateOf<LoadState<List<Machine>>>(LoadState.Loading) }
-    // Setup first, then one of its providers. Choosing a setup can invalidate the provider, so the
+    // Machine first, then one of its providers. Choosing a machine can invalidate the provider, so
-    // provider is stored by name and resolved against the current setup rather than held as an
+    // the
    // provider is stored by name and resolved against the current machine rather than held as an
    // object that could outlive the list it came from.
-    var setupName by remember { mutableStateOf<String?>(null) }
+    var machineName by remember { mutableStateOf<String?>(null) }
    var providerName by remember { mutableStateOf<String?>(null) }
    var title by remember { mutableStateOf("") }
    var model by remember { mutableStateOf("") }
    var providerModels by remember { mutableStateOf<List<OfferedModel>>(emptyList()) }
    var providerModelsLoading by remember { mutableStateOf(false) }
    var providerModelsError by remember { mutableStateOf<String?>(null) }
    var cwd by remember { mutableStateOf("") }
-    // "auto" rather than "manual": on a phone every ask is a round trip to a question card, and
+    // Set only after the selected provider reports its own default. An empty value is not sent.
-    // answering "allow Bash?" dozens of times per task is what this app exists to avoid.
+    var permissionMode by remember { mutableStateOf("") }
    var permissionMode by remember { mutableStateOf("auto") }
    // Null until the server has been asked, and null again if it answers "no level chosen" -- the
    // two are told apart by [defaultsAsked], because a picker that shows a level before the answer
    // arrives is one you can spawn at without having chosen it.
@@ -70,17 +73,12 @@ fun SpawnScreen(
    // Only the spawn's own failure. The fetch's lives in `options`: this one leaves a filled-in
    // form worth keeping, and that one leaves nothing to fill in.
    var spawnError by remember { mutableStateOf<String?>(null) }
-    // The models on the *chosen machine*, for a llama provider to choose between. Kept separate
+    // Whatever the chosen provider says it takes, by key. Empty until something is typed: an
-    // from the setups: a Claude session needs none, so failing to list them must not stop the
+    // absent key means the server's own default, which is what every field's placeholder says.
-    // screen rendering. Refetched when the machine changes, because a model is a file on one
+    var params by remember { mutableStateOf<Map<String, String>>(emptyMap()) }
    // machine -- see [fetchSetupModels].
    var models by remember { mutableStateOf<List<LocalModel>>(emptyList()) }
    var modelKey by remember { mutableStateOf<String?>(null) }
    var contextSize by remember { mutableStateOf("") }
    var temperature by remember { mutableStateOf("") }
    LaunchedEffect(Unit) {
-        // Separate from the setups fetch below and deliberately not fatal: failing to learn the
+        // Separate from the machines fetch below and deliberately not fatal: failing to learn the
        // default must leave a screen you can still spawn from, so the picker stays on "default"
        // and says so rather than the whole form refusing to draw.
        runCatching { withContext(Dispatchers.IO) { fetchDefaultEffort(settings) } }
@@ -88,9 +86,9 @@ fun SpawnScreen(
        defaultsAsked = true
        options =
            try {
-                val fetched = withContext(Dispatchers.IO) { fetchSetups(settings) }
+                val fetched = withContext(Dispatchers.IO) { fetchMachines(settings) }
                val first = fetched.firstOrNull()
-                setupName = first?.name
+                machineName = first?.name
                providerName = first?.providers?.firstOrNull()?.name
                LoadState.Loaded(fetched)
            } catch (e: ApiException) {
@@ -112,7 +110,7 @@ fun SpawnScreen(
        // Nothing below is fillable until the options are here, and a failure to fetch them leaves
        // no form worth showing -- so this reports and stops, rather than offering empty pickers
        // under an error message.
-        val setups =
+        val machines =
            when (val state = options) {
                is LoadState.Loading -> {
                    CircularProgressIndicator()
@@ -124,62 +122,88 @@ fun SpawnScreen(
                }
                is LoadState.Loaded -> state.value
            }
-        val setup = setups.firstOrNull { it.name == setupName }
+        val machine = machines.firstOrNull { it.name == machineName }
-        // Whichever machine is chosen now, asked again when that changes. The old machine's list
+        val current = machine?.providers?.firstOrNull { it.name == providerName }
-        // is dropped first rather than left on screen: a file name from another machine looks
+        // Coding CLIs take a working directory, model, permission mode and thinking level. Keying
-        // exactly like one from this one.
+        // the extra fields on the kind rather than the provider name keeps a second installation
        LaunchedEffect(setup?.id) {
            models = emptyList()
            modelKey = null
            val id = setup?.id ?: return@LaunchedEffect
            models =
                runCatching { withContext(Dispatchers.IO) { fetchSetupModels(settings, id) } }
                    .getOrDefault(emptyList())
        }
        val current = setup?.providers?.firstOrNull { it.name == providerName }
        // Only the Claude CLI has models, a working directory and permission modes; keying the
        // extra fields on the kind rather than the provider name keeps a second Claude provider
        // from needing anything here.
        val isClaude = current?.kind == "claude_cli"
        val isCodex = current?.kind == "codex_cli"
        val isCodingCli = isClaude || isCodex
        val isLlama = current?.kind == "llama_cpp"
        // Echo is the only kind with nothing to choose between.
        val offersModels = isCodingCli || isLlama
        // Where a session's tools act, which is the only thing a working directory decides.
        val takesCwd = isCodingCli || isLlama
        // Whichever machine and provider are chosen now, asked again when either changes. The
        // previous answer is dropped first rather than left on screen: a model name from another
        // machine looks exactly like one from this one.
        LaunchedEffect(machine?.id, current?.name) {
            model = ""
            // A key from the previous provider would be a setting this one does not have, drawn
            // by no control and sent at the spawn anyway.
            params = emptyMap()
            providerModels = emptyList()
            providerModelsError = null
            permissionMode = current?.defaultPermissionMode.orEmpty()
            // Every kind that offers models at all, not only the coding CLIs: a llama provider
            // answers with the GGUFs on the machine it runs on, through the same call. One
            // question with one answer is what keeps the picker free of a branch on the kind.
            if (machine == null || current == null || !offersModels) {
                providerModelsLoading = false
                return@LaunchedEffect
            }
            providerModelsLoading = true
            try {
                providerModels =
                    withContext(Dispatchers.IO) {
                        fetchProviderModels(settings, machine.id, current.name)
                    }
            } catch (e: ApiException) {
                providerModelsError = e.message
            } finally {
                providerModelsLoading = false
            }
        }
        // The machine first, because it decides what can be run at all.
        ChipGroup(
-            label = "Setup",
+            label = "Machine",
-            options = setups.map { it.name },
+            options = machines.map { it.name },
-            selected = setupName,
+            selected = machineName,
            onSelect = { name ->
-                setupName = name
+                machineName = name
                // The provider list changes with the machine, so a name carried over from the
                // previous one would be a selection that isn't in the picker. Take that machine's
                // first.
                providerName =
-                    setups.firstOrNull { it.name == name }?.providers?.firstOrNull()?.name
+                    machines.firstOrNull { it.name == name }?.providers?.firstOrNull()?.name
            },
        )
-        setup?.address?.let {
+        machine?.address?.let {
            Text(
                it,
                style = MaterialTheme.typography.bodySmall,
                color = MaterialTheme.colorScheme.onSurfaceVariant,
            )
-            // The address belongs to the setup above it, not to the provider label below; without
+            // The address belongs to the machine above it, not to the provider label below; without
            // this they read as one block.
            Spacer(Modifier.height(8.dp))
        }
-        // Only what this machine actually has. A setup with none says so rather than showing an
+        // Only what this machine actually has. A machine with none says so rather than showing an
        // empty row that reads as a failure.
-        if (setup != null && setup.providers.isEmpty()) {
+        if (machine != null && machine.providers.isEmpty()) {
            Text(
-                "\"${setup.name}\" has no providers configured.",
+                "\"${machine.name}\" has no providers configured.",
                style = MaterialTheme.typography.bodyMedium,
                color = MaterialTheme.colorScheme.onSurfaceVariant,
            )
        } else {
            ChipGroup(
                label = "Provider",
-                options = setup?.providers?.map { it.name }.orEmpty(),
+                options = machine?.providers?.map { it.name }.orEmpty(),
                selected = providerName,
                onSelect = { providerName = it },
            )
@@ -195,59 +219,59 @@ fun SpawnScreen(
            modifier = Modifier.fillMaxWidth(),
        )
-        if (isLlama) {
+        if (offersModels) {
-            // A llama session names one of the models on the machine it will run on, so the
+            when {
-            // choice is that list rather than free text -- a name that is not on that machine's
+                providerModelsLoading ->
-            // disk is a session that cannot start.
+                    Text(
-            if (models.isEmpty()) {
+                        "Loading model choices…",
-                Text(
+                        style = MaterialTheme.typography.bodySmall,
-                    "No models on ${setup?.name ?: "this machine"}. The Models screen downloads " +
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        "to the backend; another machine needs the file put there itself.",
+                    )
-                    style = MaterialTheme.typography.bodyMedium,
+                providerModelsError != null ->
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    Text(
-                )
+                        "Model choices unavailable: $providerModelsError",
-            } else {
+                        style = MaterialTheme.typography.bodySmall,
-                ChipGroup(
+                        color = MaterialTheme.colorScheme.error,
-                    label = "Model",
+                    )
-                    // The file, not the whole key: the repository is the same for every
+                // A llama session cannot start without one, so this says what to do about it
-                    // quantisation of a model, so the file name is what tells two of them apart.
+                // rather than only that there is nothing -- the models it needs are on the
-                    options = models.map { it.file },
+                // machine that will serve them, which is not always this backend.
-                    selected = models.firstOrNull { it.key == modelKey }?.file,
+                providerModels.isEmpty() && isLlama ->
-                    onSelect = { file -> modelKey = models.first { it.file == file }.key },
+                    Text(
-                )
+                        "No models on ${machine.name}. The Models screen downloads " +
                            "to the backend; another machine needs the file put there itself.",
                        style = MaterialTheme.typography.bodyMedium,
                        color = MaterialTheme.colorScheme.onSurfaceVariant,
                    )
                providerModels.isEmpty() ->
                    Text(
                        "This machine reported no selectable models.",
                        style = MaterialTheme.typography.bodySmall,
                        color = MaterialTheme.colorScheme.onSurfaceVariant,
                    )
                else -> {
                    Spacer(Modifier.height(16.dp))
                    ChipGroup(
                        label = "Model",
                        // The label, and the id is what is sent: for a llama model those differ,
                        // since it is chosen by path and named by what is inside the file.
                        options = providerModels.map { it.label },
                        selected = providerModels.firstOrNull { it.id == model }?.label,
                        onSelect = { chosen ->
                            val id = providerModels.first { it.label == chosen }.id
                            // A llama session has to have one, so choosing the same chip twice
                            // must not clear it -- there is nothing to fall back to.
                            model = if (model == id && !isLlama) "" else id
                        },
                    )
                }
            }
            Spacer(Modifier.height(16.dp))
            OutlinedTextField(
                value = contextSize,
                onValueChange = { contextSize = it },
                label = { Text("Context size (blank = the model's default)") },
                singleLine = true,
                modifier = Modifier.fillMaxWidth(),
            )
            Spacer(Modifier.height(16.dp))
            OutlinedTextField(
                value = temperature,
                onValueChange = { temperature = it },
                label = { Text("Temperature (blank = llama.cpp's default)") },
                singleLine = true,
                modifier = Modifier.fillMaxWidth(),
            )
            Spacer(Modifier.height(16.dp))
        }
-        if (isClaude) {
+        if (isCodingCli) {
-            if (current.models.isNotEmpty()) {
+            // Free text as well as the chips above: the catalog is a shortcut, and a CLI will
-                Spacer(Modifier.height(16.dp))
+            // take a name it did not list.
                ChipGroup(
                    label = "Model",
                    options = current.models,
                    selected = model.ifEmpty { null },
                    onSelect = { chosen -> model = if (model == chosen) "" else chosen },
                )
            }
            Spacer(Modifier.height(8.dp))
            OutlinedTextField(
                value = model,
                onValueChange = { model = it },
@@ -256,7 +280,20 @@ fun SpawnScreen(
                modifier = Modifier.fillMaxWidth(),
            )
            Spacer(Modifier.height(16.dp))
        }
        // Nothing is running yet, so nothing here waits for a restart -- every one of these is
        // read by the process this form is about to start.
        ProviderParamFields(
            specs = current?.params.orEmpty(),
            values = params,
            onChange = { params = it },
            warnAboutRestart = false,
        )
        // Every session whose tools act on files needs one, which is both kinds that have
        // tools -- a llama session's built-in tools run in it exactly as a CLI's do.
        if (takesCwd) {
            OutlinedTextField(
                value = cwd,
                onValueChange = { cwd = it },
@@ -266,15 +303,21 @@ fun SpawnScreen(
                modifier = Modifier.fillMaxWidth(),
            )
            Spacer(Modifier.height(16.dp))
        }
        // Offered wherever the provider has modes, rather than where this screen believes it
        // does: the server is what knows, and llama.cpp grew them without this line changing.
        if (current != null && current.permissionModes.isNotEmpty()) {
            ChipGroup(
                label = "Permissions",
-                options = PERMISSION_MODES,
+                options = current.permissionModes,
                selected = permissionMode,
                onSelect = { permissionMode = it },
            )
            Spacer(Modifier.height(16.dp))
        }
        if (isCodingCli) {
            // Says what it does to *later* spawns as well, because it does: the level chosen here
            // is stored as the default, which is the whole way that default is set. A picker that
            // quietly changed a global would be the same control with the fact left out.
@@ -307,37 +350,25 @@ fun SpawnScreen(
                                // an intent about new sessions in general, so a spawn that then
                                // fails must not also lose the choice. Non-fatal for the same
                                // reason the fetch above is -- the session is what was asked for.
-                                if (isClaude) {
+                                if (isCodingCli) {
                                    runCatching { setDefaultEffort(settings, effort) }
                                }
                                spawnSession(
                                    settings,
                                    // The id, not the label: labels are editable and the server
                                    // resolves by id. Non-null here, since `chosen` came from
-                                    // `setup`'s own provider list.
+                                    // `machine`'s own provider list.
-                                    setup = setup.id,
+                                    machine = machine.id,
                                    provider = chosen.name,
                                    title = title.trim(),
-                                    model =
+                                    model = model.trim().takeIf { offersModels },
-                                        if (isLlama) modelKey else model.trim().takeIf { isClaude },
+                                    cwd = cwd.trim().takeIf { takesCwd },
-                                    cwd = cwd.trim().takeIf { isClaude },
+                                    permissionMode = permissionMode.takeIf { it.isNotEmpty() },
-                                    permissionMode = permissionMode.takeIf { isClaude },
+                                    effort = effort.takeIf { isCodingCli },
-                                    effort = effort.takeIf { isClaude },
+                                    // Already only the keys somebody set: a field left blank
-                                    // Sent only when set, so blank means "whatever llama.cpp does
+                                    // removes its key rather than sending an empty value, so
-                                    // by default" rather than a zero.
+                                    // "blank" reaches the server as "your default".
-                                    params =
+                                    params = params,
                                        buildMap {
                                            if (isLlama) {
                                                contextSize
                                                    .trim()
                                                    .takeIf { it.isNotEmpty() }
                                                    ?.let { put("contextSize", it) }
                                                temperature
                                                    .trim()
                                                    .takeIf { it.isNotEmpty() }
                                                    ?.let { put("temperature", it) }
                                            }
                                        },
                                )
                            }
                        onSpawned(spawned)
@@ -347,7 +378,8 @@ fun SpawnScreen(
                    }
                }
            },
-            enabled = !busy && current != null && !(isLlama && modelKey == null),
+            // A llama session names the file to load, so there is nothing to spawn without one.
            enabled = !busy && current != null && !(isLlama && model.isEmpty()),
        ) {
            Text(if (busy) "Spawning..." else "Spawn")
        }
@@ -0,0 +1,339 @@
 package com.example.aiapp
 import androidx.activity.compose.BackHandler
 import androidx.compose.foundation.ExperimentalFoundationApi
 import androidx.compose.foundation.combinedClickable
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.heightIn
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.CardDefaults
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.LocalContentColor
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedCard
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableIntStateOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.unit.dp
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 /**
 * What a session has running beside the turn you are reading: its background tasks, then its
 * subagents, in the panel [SidePanels] slides over it from the right.
 *
 * [active] is whether the panel is being looked at: the lists are fetched then rather than on
 * composition, since the panel is composed for every session whether or not anybody opens it.
 *
 * [backgroundTasks] is the live count from the session's own event stream, and is what the
 * background list is refetched against: a card for work that has since finished is a stale
 * measurement drawn as a current one, which is the one thing a list of what is running now must not
 * do.
 *
 * Both lists are items of one lazy column rather than two stacked scrollers, so expanding the
 * background section pushes the subagents down without either being able to run off the panel.
 */
@Composable
 fun SubagentPanel(
    settings: ServerSettings,
    summary: SessionSummary,
    active: Boolean,
    backgroundTasks: Int,
    onClose: () -> Unit,
    onOpenSubagent: (SubagentSummary) -> Unit,
 ) {
    val scope = rememberCoroutineScope()
    val context = LocalContext.current
    val transcriptCache = remember(settings) { TranscriptCache(cacheRoot(context, settings)) }
    var rows by
        remember(summary.id) { mutableStateOf<LoadState<List<SubagentSummary>>>(LoadState.Loading) }
    var selected by remember(summary.id) { mutableStateOf(setOf<String>()) }
    var deleting by remember(summary.id) { mutableStateOf(setOf<String>()) }
    var deleteError by remember(summary.id) { mutableStateOf<String?>(null) }
    var confirming by remember(summary.id) { mutableStateOf<List<SubagentSummary>?>(null) }
    var refreshToken by remember(summary.id) { mutableIntStateOf(0) }
    var background by
        remember(summary.id) {
            mutableStateOf<LoadState<List<BackgroundTaskSummary>?>>(LoadState.Loading)
        }
    var backgroundExpanded by remember(summary.id) { mutableStateOf(false) }
    LaunchedEffect(active, refreshToken) {
        if (!active) return@LaunchedEffect
        rows = LoadState.Loading
        rows =
            try {
                val fetched = withContext(Dispatchers.IO) { fetchSubagents(settings, summary.id) }
                selected = selected intersect fetched.mapTo(mutableSetOf()) { it.id }
                LoadState.Loaded(fetched)
            } catch (e: ApiException) {
                LoadState.failed(e)
            }
    }
    // No reset to Loading on a refetch: the spinner belongs to the first fetch, and one flashed
    // over the list at every start and end would blink precisely when something happened.
    LaunchedEffect(active, backgroundTasks, refreshToken) {
        if (!active || backgroundTasks == 0) return@LaunchedEffect
        background =
            try {
                LoadState.Loaded(
                    withContext(Dispatchers.IO) { fetchBackgroundTasks(settings, summary.id) }
                )
            } catch (e: ApiException) {
                LoadState.failed(e)
            }
    }
    BackHandler(enabled = selected.isNotEmpty()) { selected = emptySet() }
    val ordered = (rows as? LoadState.Loaded)?.value?.let(::subagentOrder)
    Column(Modifier.fillMaxSize()) {
        Row(
            horizontalArrangement = Arrangement.End,
            verticalAlignment = Alignment.CenterVertically,
            modifier = Modifier.fillMaxWidth().padding(horizontal = 16.dp),
        ) {
            MarkButton("Close panel", onClose) { Chevron(Pointing.Right) }
        }
        LazyColumn(
            verticalArrangement = Arrangement.spacedBy(8.dp),
            modifier = Modifier.weight(1f).padding(horizontal = 16.dp),
        ) {
            backgroundTaskSection(
                count = backgroundTasks,
                tasks = background,
                expanded = backgroundExpanded,
                onToggle = { backgroundExpanded = !backgroundExpanded },
                onRetry = { refreshToken++ },
            )
            item(key = "subagents-heading") { PanelSectionHeading("Subagents") }
            when (val state = rows) {
                is LoadState.Loading ->
                    item(key = "subagents-loading") {
                        CircularProgressIndicator(modifier = Modifier.width(24.dp).height(24.dp))
                    }
                is LoadState.Error ->
                    item(key = "subagents-error") {
                        Column {
                            Text(
                                state.message,
                                color = MaterialTheme.colorScheme.error,
                                style = MaterialTheme.typography.bodySmall,
                            )
                            TextButton(onClick = { refreshToken++ }) { Text("Try again") }
                        }
                    }
                is LoadState.Loaded ->
                    if (ordered.isNullOrEmpty()) {
                        item(key = "subagents-empty") {
                            Text(
                                "No subagents in this session.",
                                color = MaterialTheme.colorScheme.onSurfaceVariant,
                                style = MaterialTheme.typography.bodyMedium,
                            )
                        }
                    } else {
                        uniqueItems(ordered, key = { it.id }) { subagent ->
                            SubagentCard(
                                subagent = subagent,
                                selected = subagent.id in selected,
                                selecting = selected.isNotEmpty(),
                                deleting = subagent.id in deleting,
                                onClick = { onOpenSubagent(subagent) },
                                onSelect = {
                                    selected =
                                        if (subagent.id in selected) selected - subagent.id
                                        else selected + subagent.id
                                },
                            )
                        }
                    }
            }
        }
        if (selected.isNotEmpty()) {
            val picked = ordered.orEmpty().filter { it.id in selected }
            SubagentSelectionBar(
                picked = picked,
                onDelete = { confirming = picked },
                modifier = Modifier.padding(horizontal = 16.dp),
            )
        }
        deleteError?.let {
            Text(
                it,
                color = MaterialTheme.colorScheme.error,
                style = MaterialTheme.typography.bodySmall,
                modifier = Modifier.padding(horizontal = 16.dp, vertical = 8.dp),
            )
        }
    }
    confirming?.let { picked ->
        AlertDialog(
            onDismissRequest = { confirming = null },
            title = {
                Text(
                    if (picked.size == 1) "Delete this subagent?"
                    else "Delete ${picked.size} subagents?"
                )
            },
            text = {
                Text(
                    (if (picked.size == 1) "\"${picked.first().title}\"\n\n" else "") +
                        "A subagent's transcript is the only record of what it did: the session " +
                        "that started it kept just the Task call. Nothing else has a copy, so " +
                        "this can't be undone. The session itself is untouched."
                )
            },
            confirmButton = {
                TextButton(
                    onClick = {
                        confirming = null
                        selected = emptySet()
                        val ids = picked.map { it.id }
                        val gone = ids.toSet()
                        deleting += gone
                        deleteError = null
                        scope.launch {
                            try {
                                withContext(Dispatchers.IO) {
                                    deleteSubagents(settings, summary.id, ids)
                                    gone.forEach {
                                        transcriptCache
                                            .session(TranscriptAddress(summary.id, it))
                                            .purge()
                                    }
                                }
                                val loaded = rows
                                if (loaded is LoadState.Loaded) {
                                    rows =
                                        LoadState.Loaded(loaded.value.filterNot { it.id in gone })
                                }
                            } catch (e: ApiException) {
                                deleteError = e.message ?: "Delete failed"
                            } finally {
                                deleting -= gone
                            }
                        }
                    }
                ) {
                    Text("Delete", color = MaterialTheme.colorScheme.error)
                }
            },
            dismissButton = { TextButton(onClick = { confirming = null }) { Text("Cancel") } },
        )
    }
 }
 private fun subagentOrder(rows: List<SubagentSummary>): List<SubagentSummary> =
    rows.sortedWith(
        compareByDescending<SubagentSummary> { it.status == "running" }
            .thenByDescending { it.lastActivity }
    )
@OptIn(ExperimentalFoundationApi::class)
@Composable
 private fun SubagentCard(
    subagent: SubagentSummary,
    selected: Boolean,
    selecting: Boolean,
    deleting: Boolean,
    onClick: () -> Unit,
    onSelect: () -> Unit,
 ) {
    BusyItem(label = if (deleting) "deleting" else null) {
        OutlinedCard(
            colors =
                if (selected)
                    CardDefaults.outlinedCardColors(
                        containerColor = MaterialTheme.colorScheme.secondaryContainer,
                        contentColor = MaterialTheme.colorScheme.onSecondaryContainer,
                    )
                else CardDefaults.outlinedCardColors(),
            modifier =
                Modifier.fillMaxWidth()
                    .combinedClickable(
                        enabled = !deleting,
                        onClick = { if (selecting) onSelect() else onClick() },
                        onLongClick = onSelect,
                    ),
        ) {
            Column(Modifier.padding(horizontal = 12.dp, vertical = 8.dp)) {
                Text(subagent.title, style = MaterialTheme.typography.titleSmall)
                Spacer(Modifier.height(2.dp))
                Row(Modifier.fillMaxWidth()) {
                    Text(
                        subagentStatusLabel(subagent.status),
                        style = MaterialTheme.typography.bodySmall,
                        color = MaterialTheme.colorScheme.onSurfaceVariant,
                        modifier = Modifier.weight(1f),
                    )
                    Text(
                        relativeTime(subagent.lastActivity),
                        style = MaterialTheme.typography.bodySmall,
                        color = MaterialTheme.colorScheme.onSurfaceVariant,
                    )
                }
            }
        }
    }
 }
@Composable
 private fun SubagentSelectionBar(
    picked: List<SubagentSummary>,
    onDelete: () -> Unit,
    modifier: Modifier = Modifier,
 ) {
    val running = picked.count { it.status == "running" }
    Row(
        verticalAlignment = Alignment.CenterVertically,
        modifier = modifier.fillMaxWidth().heightIn(min = 48.dp),
    ) {
        Text(
            if (running == 0) "${picked.size} selected" else "$running still running",
            style = MaterialTheme.typography.bodySmall,
            color = MaterialTheme.colorScheme.onSurfaceVariant,
            modifier = Modifier.weight(1f),
        )
        TextButton(onClick = onDelete, enabled = running == 0) {
            Text(
                "Delete",
                color =
                    if (running == 0) MaterialTheme.colorScheme.error
                    else LocalContentColor.current,
            )
        }
    }
 }
 private fun subagentStatusLabel(status: String) =
    when (status) {
        "running" -> "running"
        "exited" -> "finished"
        else -> "unknown"
    }
@@ -134,6 +134,20 @@ val clearedColor: Color
 val awaitingColor: Color
    @Composable get() = Mocha.Peach
 /**
 * Waiting on itself: the session's turn is over, but a subagent or a backgrounded command it
 * started is still going, and it will speak again with nobody having typed anything.
 *
 * Its own colour rather than [awaitingColor], which is the opposite state -- that one means the
 * reader has something to do, and this one means they specifically do not. Not [runningColor]
 * either: nothing is being written, and a green "running" on a session that will say nothing for
 * ten minutes is the wrong promise. Blue for the same reason [commandColor] is blue -- not stuck,
 * but not replying to you either -- and a different blue because that one is the session acting on
 * itself rather than getting on with what was asked.
 */
 val waitingColor: Color
    @Composable get() = Mocha.Sky
 /** Approaching a limit -- still fine, worth seeing. */
 val warningColor: Color
    @Composable get() = Mocha.Yellow
@@ -199,6 +213,8 @@ val rawSurface: Color
 */
 fun catppuccinSyntax(): SyntaxPalette =
    SyntaxPalette(
        addition = Mocha.Green,
        deletion = Mocha.Red,
        keyword = Mocha.Mauve,
        string = Mocha.Green,
        literal = Mocha.Peach,
@@ -0,0 +1,79 @@
 package com.example.aiapp
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.width
 import androidx.compose.material3.Card
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.dp
 /**
 * A model's working, shut until somebody asks for it.
 *
 * Shut by default, like a tool call and a memory note and for the same reason: it is not what the
 * session said, and left open it puts the reasoning between the question and the answer -- which on
 * a small model is most of the conversation.
 *
 * The heading is the whole of what the reader gets for free, so it carries the one thing worth
 * knowing without opening anything: whether this is still going, and if not how long it took. A
 * spinner while it runs, because that is the same fact a running command reports and it is drawn
 * the same way here.
 */
@Composable
 fun ThinkingCard(
    item: TranscriptItem.ThinkingRow,
    expanded: Boolean,
    onToggle: () -> Unit,
    modifier: Modifier = Modifier,
 ) {
    Card(modifier.fillMaxWidth().clickable(onClick = onToggle)) {
        Column(Modifier.padding(12.dp)) {
            Row(verticalAlignment = Alignment.CenterVertically) {
                Text(thinkingHeadline(item), style = MaterialTheme.typography.titleSmall)
                Spacer(Modifier.width(8.dp))
                if (item.open) {
                    CircularProgressIndicator(
                        modifier = Modifier.width(16.dp).height(16.dp),
                        strokeWidth = 2.dp,
                    )
                }
            }
            if (expanded) {
                // Plain text rather than markdown: this is a model talking to itself, so its
                // half-finished lists and stray backticks are not markup it meant to write, and
                // rendering them as such makes the working look like an answer.
                Text(
                    item.text,
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.onSurfaceVariant,
                    modifier = Modifier.padding(top = 6.dp),
                )
            }
        }
    }
 }
 /**
 * "Thinking", "Thought for 12.4s", or "Thought".
 *
 * The third is the one worth keeping: a block whose turn ended before the model said anything --
 * interrupted, stopped, a process that exited -- was thought about for a length of time nobody
 * measured. Naming a span there would be this screen inventing one, and the reader has no way to
 * tell an invented one from the rest.
 */
 fun thinkingHeadline(item: TranscriptItem.ThinkingRow): String =
    when {
        item.open -> "Thinking"
        item.ms != null -> "Thought for ${formatMillis(item.ms)}"
        else -> "Thought"
    }
@@ -1,9 +1,6 @@
 package com.example.aiapp
 import androidx.compose.foundation.horizontalScroll
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.rememberScrollState
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
@@ -51,24 +48,31 @@ data class ToolInput(
 private val SUBJECTS: Map<String, Pair<String, Language?>> =
    mapOf(
        "Bash" to ("command" to Language.SHELL),
        "Shell" to ("command" to Language.SHELL),
        "Patch" to ("diff" to Language.DIFF),
        "Read" to ("file_path" to null),
        "Write" to ("file_path" to null),
        "Edit" to ("file_path" to null),
        "Glob" to ("pattern" to null),
        "Grep" to ("pattern" to null),
        "WebFetch" to ("url" to null),
        "WebSearch" to ("query" to null),
        // Persisted transcripts keep the provider vocabulary they were written with.
        "web_search" to ("query" to null),
    )
 /** Fields that are the tool's own prose about itself rather than input to it. */
 private val DESCRIPTIONS = listOf("description", "prompt")
 fun parseToolInput(tool: String, input: String): ToolInput {
    if (input.trim() == "null") return ToolInput(null, null, null, null, emptyList())
    val json =
        try {
            JSONObject(input)
        } catch (_: org.json.JSONException) {
            // Not an object: older transcripts and some tools send a bare string. It is still the
-            // input, so it is still shown.
+            // input, so it is still shown. JSON null is the one exception: it means the call had
            // no input, and drawing the word makes an absent value look like an instruction.
            return ToolInput(
                null,
                null,
@@ -78,15 +82,20 @@ fun parseToolInput(tool: String, input: String): ToolInput {
            )
        }
    val (subjectKey, language) = SUBJECTS[tool] ?: (null to null)
-    val subject = subjectKey?.let { json.optString(it) }?.takeIf { it.isNotBlank() }
+    val subject =
        subjectKey
            ?.let { json.text(it) }
            ?.takeIf { it.isNotBlank() }
            ?.let { if (tool == "Bash") renderedBashScript(it) ?: it else it }
    val description = DESCRIPTIONS.firstNotNullOfOrNull {
-        json.optString(it).takeIf { v -> v.isNotBlank() }
+        json.text(it)?.takeIf { value -> value.isNotBlank() }
    }
-    val timeout = json.optString("timeout").takeIf { it.isNotBlank() }?.let { formatMillisText(it) }
+    val timeout = json.text("timeout")?.takeIf { it.isNotBlank() }?.let { formatMillisText(it) }
    val rest =
        json
            .keys()
            .asSequence()
            .filterNot(json::isNull)
            .filter { it != subjectKey || subject == null }
            .filter { it !in DESCRIPTIONS || description == null }
            .filter { it != "timeout" || timeout == null }
@@ -96,6 +105,31 @@ fun parseToolInput(tool: String, input: String): ToolInput {
    return ToolInput(subject, language, description, timeout, rest)
 }
 private fun JSONObject.text(key: String): String? =
    if (isNull(key)) null else optString(key).takeIf { it.isNotEmpty() }
 /**
 * Removes Codex's rendered Bash argv from old transcript rows.
 *
 * New events arrive normalized by the server, but persisted transcripts keep the input originally
 * written to them. Only the outer pair are presentation quoting: quotes inside the command belong
 * to the command and must not be parsed as an early end delimiter.
 */
 internal fun renderedBashScript(command: String): String? {
    val prefix =
        listOf("/usr/bin/bash -lc ", "/bin/bash -lc ", "bash -lc ").firstOrNull {
            command.startsWith(it)
        } ?: return null
    val quoted = command.removePrefix(prefix)
    return quoted
        .takeIf {
            it.length >= 2 &&
                ((it.startsWith('\'') && it.endsWith('\'')) ||
                    (it.startsWith('"') && it.endsWith('"')))
        }
        ?.substring(1, quoted.lastIndex)
 }
 /**
 * A tool call's input: its subject highlighted, then whatever else it carried.
 *
@@ -113,7 +147,8 @@ fun ToolInputView(tool: String, input: String, modifier: Modifier = Modifier) {
    RawBlock(modifier) {
        parsed.subject?.let { subject ->
            // Not wrapped: a wrapped command hides where its arguments end, and the long one is the
-            // one being read closely.
+            // one being read closely. The sideways scroll that makes that readable is the block's,
            // shared with the lines below -- see [RawBlock].
            Text(
                // Not cached: a tool's subject is one command line, which lexes in microseconds --
                // the cache exists for a fence with two hundred lines in it.
@@ -121,7 +156,6 @@ fun ToolInputView(tool: String, input: String, modifier: Modifier = Modifier) {
                style = MaterialTheme.typography.bodySmall,
                fontFamily = FontFamily.Monospace,
                softWrap = false,
                modifier = Modifier.fillMaxWidth().horizontalScroll(rememberScrollState()),
            )
        }
        parsed.rest.forEach {
@@ -130,6 +164,7 @@ fun ToolInputView(tool: String, input: String, modifier: Modifier = Modifier) {
                style = MaterialTheme.typography.bodySmall,
                fontFamily = FontFamily.Monospace,
                color = MaterialTheme.colorScheme.onSurfaceVariant,
                softWrap = false,
                modifier = Modifier.padding(top = 2.dp),
            )
        }
@@ -27,6 +27,9 @@ import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
 import androidx.compose.ui.graphics.Shape
 import androidx.compose.ui.layout.onPlaced
 import androidx.compose.ui.layout.onSizeChanged
 import androidx.compose.ui.layout.positionInRoot
 import androidx.compose.ui.platform.LocalDensity
 import androidx.compose.ui.semantics.contentDescription
 import androidx.compose.ui.semantics.semantics
@@ -61,7 +64,9 @@ sealed class TranscriptRow {
     *
     * A tool row therefore keys on [TranscriptItem.ToolRun.runId] rather than on a sequence number,
     * and it is the *same* value whether the run is drawn as one card or as a group. Which value
-     * that is belongs to the item ([TranscriptItem.key]), not to a `when` here.
+     * that is belongs to the item ([TranscriptItem.key]) everywhere a row is one thing; where
     * [groupRuns] cuts a run into several rows it is the one deciding, and it says so by handing
     * each piece its key.
     */
    abstract val key: Any
@@ -75,23 +80,15 @@ sealed class TranscriptRow {
     */
    abstract val startSeq: Long
-    data class Single(val item: TranscriptItem) : TranscriptRow() {
+    data class Single(val item: TranscriptItem, override val key: Any = item.key) :
-        override val key: Any
+        TranscriptRow() {
            get() = item.key
        override val startSeq: Long
            get() = item.seq
    }
    /** Two or more calls with nothing between them; drawn as one collapsed card. */
-    data class Tools(val calls: List<TranscriptItem.ToolRun>) : TranscriptRow() {
+    data class Tools(val calls: List<TranscriptItem.ToolRun>, override val key: String) :
-        /** The run's own name, which every call in it already carries. */
+        TranscriptRow() {
        val id: String
            get() = calls.first().runId
        override val key: Any
            get() = id
        override val startSeq: Long
            get() = calls.first().seq
    }
@@ -102,33 +99,75 @@ sealed class TranscriptRow {
 *
 * A single call is left alone: "Called 1 tool" hides a card to say the same thing in more words,
 * and the run this exists for is the burst of five greps nobody wants to scroll past.
 *
 * The last call is left alone too, and so is one still running wherever in its run it sits. What
 * the session is doing, or did last, is the one thing worth seeing without opening anything, and a
 * heading counting it hides it. What folds a call back into its run is therefore not finishing but
 * being overtaken: anything arriving behind it, a reply included, makes it history.
 *
 * [heldOut] is the one thing being read can change, and only in that direction: a call standing on
 * its own that somebody is reading is not overtaken while they read it. Opening a call *already*
 * inside a group does not pull it out (2026-09-16, after it briefly did) -- it is visible where it
 * is, and grouping is what gives a row its identity, so a rule that reads the open set both ways
 * makes the reader's own tap rebuild the rows around it: three rows became one the moment a call
 * was closed, and no anchor survives a row that no longer exists -- the list jumped by 450px and
 * took the closed card with it. Which calls are held out is [SessionScreen]'s to say, since being
 * inside a group once is what settles it.
 */
-fun groupToolRuns(items: List<TranscriptItem>): List<TranscriptRow> =
+fun groupToolRuns(
-    DebugStats.timed("grouped tool runs") { groupRuns(items) }
+    items: List<TranscriptItem>,
    heldOut: Set<String> = emptySet(),
 ): List<TranscriptRow> = DebugStats.timed("grouped tool runs") { groupRuns(items, heldOut) }
-private fun groupRuns(items: List<TranscriptItem>): List<TranscriptRow> {
+private fun groupRuns(items: List<TranscriptItem>, heldOut: Set<String>): List<TranscriptRow> {
    val rows = mutableListOf<TranscriptRow>()
    var run = mutableListOf<TranscriptItem.ToolRun>()
    // A run can occupy more than one non-adjacent piece, so claimed keys span the whole transcript
    // rather than resetting at each piece.
    var runId: String? = null
    val claimedKeys = mutableSetOf<String>()
    fun flush() {
-        when (run.size) {
+        val first = run.firstOrNull() ?: return
-            0 -> {}
+        // The first piece keeps the run's name, which survives a page landing in front of it
-            1 -> rows += TranscriptRow.Single(run.first())
+        // ([adoptRun]). Later pieces qualify that name with their first call; the suffix is the
-            else -> rows += TranscriptRow.Tools(run.toList())
+        // final guard because a duplicate LazyColumn key takes down the whole screen.
        var key = first.runId
        if (!claimedKeys.add(key)) {
            key = "${first.runId}/${first.id}"
            var suffix = 2
            while (!claimedKeys.add(key)) {
                key = "${first.runId}/${first.id}/${suffix++}"
            }
        }
        rows +=
            if (run.size == 1) TranscriptRow.Single(first, key)
            else TranscriptRow.Tools(run.toList(), key)
        run = mutableListOf()
    }
-    items.forEach { item ->
+    items.forEachIndexed { index, item ->
        // Grouped by the run each call says it belongs to, not by adjacency worked out here.
        // Adjacency is the same answer most of the time and a worse one at the edges: a call
        // arriving next to an existing run, or a page of history arriving in front of one, both
        // change which call is *first*.
-        if (item is TranscriptItem.ToolRun && (run.isEmpty() || run.first().runId == item.runId)) {
+        val call = item as? TranscriptItem.ToolRun
-            run += item
+        if (call == null || call.runId != runId) {
        } else {
            flush()
-            if (item is TranscriptItem.ToolRun) run += item else rows += TranscriptRow.Single(item)
+            runId = call?.runId
        }
        when {
            call == null -> rows += TranscriptRow.Single(item)
            // Standing outside the run is the call's place in the list as it is now, not something
            // recorded on the call: the same finished call is a row of its own while it is the last
            // thing that happened, or open and never yet grouped, and part of its group once a
            // reply lands behind it.
            call.done && call.id !in heldOut && index != items.lastIndex -> run += call
            else -> {
                flush()
                run += call
                flush()
            }
        }
    }
    flush()
@@ -160,7 +199,15 @@ fun ToolGroup(
     */
    onToggle: () -> Unit,
    isToolExpanded: (String) -> Boolean,
-    onToolToggle: (String) -> Unit,
+    /**
     * Toggles one call, and says where in the group it was drawn: how far down the group's own top
     * edge its card begins, and how tall that card is now.
     *
     * The screen anchors on *rows*, and a call is not one -- but what the reader is opening or
     * shutting is the call, and keeping it under their finger needs its place inside the row. Only
     * the group knows that, so only the group can say it. See `SessionScreen`'s `toggleAnchored`.
     */
    onToolToggle: (id: String, top: Int, height: Int) -> Unit,
    onAnswer: (List<QuestionAnswer>, onSettled: () -> Unit) -> Unit,
    image: @Composable (String) -> Unit,
 ) {
@@ -175,8 +222,10 @@ fun ToolGroup(
        }
        return
    }
    val placed = remember { Placed() }
    Column(
        Modifier.fillMaxWidth()
            .onPlaced { placed.top = it.positionInRoot().y }
            .clip(MaterialTheme.shapes.medium)
            .background(MaterialTheme.colorScheme.surfaceContainerLow)
    ) {
@@ -196,13 +245,19 @@ fun ToolGroup(
            verticalArrangement = Arrangement.spacedBy(GROUP_GAP),
        ) {
            group.calls.forEachIndexed { index, call ->
                val card = remember(call.id) { Placed() }
                ToolCard(
                    tool = call,
                    expanded = isToolExpanded(call.id),
-                    onToggle = { onToolToggle(call.id) },
+                    onToggle = {
                        onToolToggle(call.id, (card.top - placed.top).toInt(), card.height)
                    },
                    onAnswer = onAnswer,
                    image = image,
                    shape = connectedShape(index, group.calls.size),
                    modifier =
                        Modifier.onPlaced { card.top = it.positionInRoot().y }
                            .onSizeChanged { card.height = it.height },
                )
            }
        }
@@ -212,6 +267,18 @@ fun ToolGroup(
    }
 }
 /**
 * Where something was last placed, in the window's coordinates, and how tall it was.
 *
 * Deliberately not snapshot state: it is written from the layout phase, and a write there that
 * composition reads would schedule another recomposition of every group on screen, every frame.
 * Nothing reads it except the gesture that follows.
 */
 private class Placed {
    var top = 0f
    var height = 0
 }
 /**
 * The height of a group's heading, and so of the bar at its foot.
 *
@@ -293,14 +360,17 @@ fun ToolCard(
    image: @Composable (String) -> Unit = {},
    /** Square where this card faces another in a group; see [connectedShape]. */
    shape: Shape = CardDefaults.shape,
    modifier: Modifier = Modifier,
 ) {
    val parsed = remember(tool.tool, tool.input) { parseToolInput(tool.tool, tool.input) }
    val name = toolDisplayName(tool.tool)
    val output = toolDisplayOutput(tool.tool, tool.output)
    val deciding = tool.asks.any { it.answers.isEmpty() }
    val open = expanded || deciding
-    Card(Modifier.fillMaxWidth().clickable(onClick = onToggle), shape = shape) {
+    Card(modifier.fillMaxWidth().clickable(onClick = onToggle), shape = shape) {
        Column(Modifier.padding(GROUP_INSET_LARGE)) {
            Row(verticalAlignment = Alignment.CenterVertically) {
-                Text(tool.tool, style = MaterialTheme.typography.titleSmall)
+                Text(name, style = MaterialTheme.typography.titleSmall)
                if (open) {
                    Spacer(Modifier.weight(1f))
                    parsed.timeout?.let {
@@ -355,24 +425,26 @@ fun ToolCard(
                if (tool.tool != ASK_USER_QUESTION) {
                    ToolInputView(tool.tool, tool.input, Modifier.padding(top = 4.dp))
                }
-                if (tool.output.isNotEmpty()) {
+                if (output.isNotEmpty()) {
                    Spacer(Modifier.height(8.dp))
                    Text("Output", style = MaterialTheme.typography.labelSmall)
                    // What the tool printed, on the surface everything verbatim gets and in the
                    // face it was written for: this is column-aligned far more often than it is
                    // prose, and a proportional font silently destroys the alignment that carried
-                    // the meaning.
+                    // the meaning. Unwrapped for the same reason, and scrolled sideways by the
                    // block around it -- see [RawBlock].
                    //
                    // Its terminal styling applied and the rest of the escapes taken out: colour is
                    // often the whole of what a diff or a test run is saying. Remembered against
                    // the text, so a card that is open through a scroll parses once.
                    val palette = remember { ansiPalette() }
-                    val styled = remember(tool.output, palette) { ansiStyled(tool.output, palette) }
+                    val styled = remember(output, palette) { ansiStyled(output, palette) }
                    RawBlock(Modifier.padding(top = 2.dp)) {
                        Text(
                            styled,
                            style = MaterialTheme.typography.bodySmall,
                            fontFamily = FontFamily.Monospace,
                            softWrap = false,
                        )
                    }
                }
@@ -391,6 +463,22 @@ fun ToolCard(
    }
 }
 private val collaborationToolNames =
    mapOf(
        "Task" to "Spawn agent",
        "TaskOutput" to "Wait for agents",
        "SendMessage" to "Message agent",
        "CloseAgent" to "Close agent",
        "InterruptAgent" to "Interrupt agent",
        "ListAgents" to "List agents",
        "ResumeAgent" to "Resume agent",
    )
 internal fun toolDisplayName(tool: String): String = collaborationToolNames[tool] ?: tool
 internal fun toolDisplayOutput(tool: String, output: String): String =
    if (tool in collaborationToolNames && output == "completed") "" else output
 /**
 * The permission ask on the call it is about.
 *
@@ -63,6 +63,45 @@ sealed class TranscriptItem {
         * inside that reply would step the list under them.
         */
        val settled: Boolean = false,
        /** A final value that supersedes provisional deltas behind a page boundary. */
        val replacesPrefix: Boolean = false,
        /**
         * When the reply was sent, in epoch seconds: the time on its newest delta, which is the
         * moment it finished rather than the moment it started.
         *
         * The transcript's own timestamp rather than a clock read here, so every device draws the
         * same time under the same reply and a replayed page agrees with the live stream.
         */
        val ts: Double = 0.0,
        /**
         * How fast it was generated, where the provider measured it; null everywhere else.
         *
         * Folded on from the turn's usage event rather than carried by the text, because it is not
         * known until the reply is over.
         */
        val tokensPerSecond: Double? = null,
        /** How long the provider spent reading the prompt, where it measured that. */
        val prefillMs: Long? = null,
    ) : TranscriptItem()
    /**
     * The model's working before -- or between -- the things it said.
     *
     * Its own row rather than part of the reply, and deliberately not a [ToolRun]: a run of tool
     * calls collapses into one card, and folding a model's reasoning into "Called 6 tools" would
     * file it as one of them. Shut by default, like every other card that is not what was said.
     *
     * Three states, because two of them are not the same absence. [open] is a block still being
     * thought, which is what the spinner is for. A closed one with an [ms] says how long it took; a
     * closed one without is a block whose turn ended before anything said -- an interrupted reply,
     * a session stopped mid-thought -- and it says so by not naming a duration rather than by
     * naming a wrong one.
     */
    data class ThinkingRow(
        override val seq: Long,
        val text: String,
        val ms: Long? = null,
        val open: Boolean = true,
    ) : TranscriptItem()
    data class ToolRun(
@@ -143,6 +182,29 @@ sealed class TranscriptItem {
            get() = arrived
    }
    /**
     * Where one turn ended and the next began with nothing said in between.
     *
     * A rule and no words. Two replies meet like this whenever a turn starts without anybody typing
     * -- a subagent reporting back, a session the CLI picked up by itself -- and drawn with only
     * the ordinary gap between them they read as one answer with a paragraph break through the
     * middle of it. What the reader needs is to see that these are two; what started the turn is
     * somebody else's transcript's business, and a row per background task is a screenful of
     * dividers about work nobody was asking after.
     *
     * Made by the fold rather than sent by the server, because it is not something that happened:
     * it is the boundary between two things that did. See [foldEvent].
     */
    data class TurnBreak(override val seq: Long) : TranscriptItem() {
        /**
         * Its own key, because it shares a [seq] with the reply it sits above -- that reply's first
         * delta is the event this was made at, and a keyed list refuses two items with one key by
         * taking the app down.
         */
        override val key: Any
            get() = "break$seq"
    }
    /**
     * A command the session ran on itself -- `/compact`, `/rename`. Kept in the transcript rather
     * than only shown while it waits, because it explains what follows: a conversation that
@@ -231,7 +293,7 @@ private fun runIdFor(items: List<TranscriptItem>, id: String, tool: String): Str
 * with the seam wherever the reader happened to have paged.
 */
 fun joinPages(earlier: List<TranscriptItem>, later: List<TranscriptItem>): List<TranscriptItem> {
-    val (older, newer) = healSplitMessage(earlier, later)
+    val (older, newer) = healSplitThinking(healSplitMessage(earlier, later))
    val startedEarlier =
        older.filterIsInstance<TranscriptItem.ToolRun>().mapTo(mutableSetOf()) { it.id }
    val endedLater =
@@ -261,9 +323,10 @@ fun joinPages(earlier: List<TranscriptItem>, later: List<TranscriptItem>): List<
 /**
 * Rejoins a message the page boundary cut, and hands back the two pages to concatenate.
 *
- * [foldEvent] never leaves two assistant messages next to each other inside one page, so two
+ * [foldEvent] never leaves an *unfinished* assistant message with another behind it inside one
- * meeting at a join are always the two halves of one reply, and leaving them apart drew a single
+ * page, so an unsettled one at a join is always the far half of the reply the boundary cut, and
- * answer as two with a paragraph break through the middle of a sentence.
+ * leaving the two apart drew a single answer as two with a paragraph break through the middle of a
 * sentence. Two settled replies meeting there are two turns and stay two.
 *
 * The newer half keeps its identity, for the reason [adoptRun] gives. It grows by what the older
 * half brings, which is safe here and nowhere else -- the join is at the oldest end of what is
@@ -278,6 +341,36 @@ private fun healSplitMessage(
    if (head !is TranscriptItem.AssistantMsg || tail !is TranscriptItem.AssistantMsg) {
        return earlier to later
    }
    // A settled reply is a whole turn, so the two are two answers that happen to meet at the
    // boundary rather than one cut in half -- the same distinction the fold makes, and joining them
    // here would put back exactly the run-together paragraph it stops.
    // The rule between them is put in here too, since the fold that would have made it never saw
    // these two side by side.
    if (head.settled) return earlier to (listOf(TranscriptItem.TurnBreak(tail.seq)) + later)
    if (tail.replacesPrefix) return earlier.dropLast(1) to later
    return earlier.dropLast(1) to (listOf(tail.copy(text = head.text + tail.text)) + later.drop(1))
 }
 /**
 * Rejoins a thinking block the page boundary cut, the same way [healSplitMessage] rejoins a reply.
 *
 * A block streams a fragment at a time exactly as a reply does, so a boundary lands inside one as
 * readily. The older half then holds an open block whose [SessionEvent.ThinkingDone] is on the
 * newer page -- so it spun for the rest of the conversation, saying the machine was working on a
 * thought it finished minutes ago, and the same working was drawn as two blocks.
 *
 * Only where the older half is still open: a closed one has its own ending and the two are two
 * blocks that happen to meet here. The newer half keeps its identity, for the reason [adoptRun]
 * gives -- it is the part already on screen.
 */
 private fun healSplitThinking(
    pages: Pair<List<TranscriptItem>, List<TranscriptItem>>
 ): Pair<List<TranscriptItem>, List<TranscriptItem>> {
    val (earlier, later) = pages
    val head = earlier.lastOrNull()
    val tail = later.firstOrNull()
    if (head !is TranscriptItem.ThinkingRow || tail !is TranscriptItem.ThinkingRow) return pages
    if (!head.open) return pages
    return earlier.dropLast(1) to (listOf(tail.copy(text = head.text + tail.text)) + later.drop(1))
 }
@@ -364,24 +457,75 @@ fun foldEvent(items: List<TranscriptItem>, entry: SeqEvent): List<TranscriptItem
            // first of them: a row whose identity changed with every delta would be a new row on
            // every frame, and the list would jump for the whole of a streamed answer.
            val last = items.lastOrNull()
-            if (last is TranscriptItem.AssistantMsg) {
+            // Only into a reply that is still arriving. A settled one is a turn that ended, and
-                // A message growing again is not finished, whatever a status said in between.
+            // text after it belongs to the next turn -- a separate message, drawn as its own row.
-                items.dropLast(1) + last.copy(text = last.text + event.delta, settled = false)
+            // Growing it instead ran two answers together with not even a space between them,
            // which is what happens whenever a turn starts with nothing recorded in front of it:
            // a subagent reporting back, or a peer message the CLI only owns up to at the end.
            if (last is TranscriptItem.AssistantMsg && !last.settled) {
                items.dropLast(1) + last.copy(text = last.text + event.delta, ts = entry.ts)
            } else {
-                items + TranscriptItem.AssistantMsg(entry.seq, event.delta)
+                // A rule between the two, and only where they actually meet: anything that draws a
                // row of its own -- a message, a command, a peer note -- is already the boundary.
                val between =
                    if (last is TranscriptItem.AssistantMsg)
                        listOf(TranscriptItem.TurnBreak(entry.seq))
                    else emptyList()
                items + between + TranscriptItem.AssistantMsg(entry.seq, event.delta, ts = entry.ts)
            }
        }
        is SessionEvent.AssistantTextFinal -> {
            val last = items.lastOrNull()
            if (last is TranscriptItem.AssistantMsg && !last.settled) {
                items.dropLast(1) +
                    last.copy(text = event.text, replacesPrefix = true, ts = entry.ts)
            } else {
                val between =
                    if (last is TranscriptItem.AssistantMsg)
                        listOf(TranscriptItem.TurnBreak(entry.seq))
                    else emptyList()
                items +
                    between +
                    TranscriptItem.AssistantMsg(
                        entry.seq,
                        event.text,
                        replacesPrefix = true,
                        ts = entry.ts,
                    )
            }
        }
        is SessionEvent.Thinking -> {
            // Deltas grow the open block, keeping the seq of the first of them, for the same
            // reason a reply's do: a row whose identity changed per delta is a new row per frame.
            val last = items.lastOrNull()
            if (last is TranscriptItem.ThinkingRow && last.open) {
                items.dropLast(1) + last.copy(text = last.text + event.delta)
            } else {
                items + TranscriptItem.ThinkingRow(entry.seq, event.delta)
            }
        }
        // The newest block still open, rather than whatever row happens to be last.
        is SessionEvent.ThinkingDone ->
            closeThinking(items) { it.copy(ms = event.ms, open = false) }
        is SessionEvent.ToolStart ->
-            items +
+            // A call id names one call for its whole lifetime. Codex can repeat the start while
-                TranscriptItem.ToolRun(
+            // recovering an in-flight item; appending that replay made two rows with one key, and
-                    entry.seq,
+            // Compose aborts the entire LazyColumn when it encounters them. Ignoring the replay
-                    event.id,
+            // also repairs transcripts which already contain it when they are folded on reopen.
-                    runIdFor(items, event.id, event.tool),
+            if (items.any { it is TranscriptItem.ToolRun && it.id == event.id }) {
-                    event.tool,
+                items
-                    event.input,
+            } else {
-                    "",
+                items +
-                    done = false,
+                    TranscriptItem.ToolRun(
-                )
+                        entry.seq,
                        event.id,
                        runIdFor(items, event.id, event.tool),
                        event.tool,
                        event.input,
                        "",
                        done = false,
                    )
            }
        is SessionEvent.ToolUpdate -> updateTool(items, event.id) { it.copy(output = event.output) }
        is SessionEvent.ToolEnd ->
            // Created when its start is not here, rather than dropped. A fold that only ever
@@ -456,7 +600,10 @@ fun foldEvent(items: List<TranscriptItem>, entry: SeqEvent): List<TranscriptItem
        // nothing it belongs above.
        is SessionEvent.MessageDropped -> items
        is SessionEvent.Settings -> items
        is SessionEvent.BackgroundTasks -> items
        is SessionEvent.Status -> settleReply(items, event.state)
        is SessionEvent.AuthenticationRequired ->
            items + TranscriptItem.ErrorMsg(entry.seq, event.message)
        is SessionEvent.Error -> items + TranscriptItem.ErrorMsg(entry.seq, event.message)
        is SessionEvent.Image ->
            // Under the call that produced it when there is one, and a row of its own when there is
@@ -475,8 +622,27 @@ fun foldEvent(items: List<TranscriptItem>, entry: SeqEvent): List<TranscriptItem
        is SessionEvent.Compacted ->
            items + TranscriptItem.CompactedNote(entry.seq, event.preTokens, event.postTokens)
        is SessionEvent.Unknown -> items + TranscriptItem.Note(entry.seq, "[${event.type}]")
-        // Screen-level state, not transcript rows -- see SessionScreen.
+        // Said rather than skipped: a line the server could not read is a hole in the conversation,
-        is SessionEvent.UsageDelta -> items
+        // and one that draws nothing is a hole nothing on screen ever mentions.
        is SessionEvent.Unreadable ->
            items + TranscriptItem.Note(entry.seq, "[unreadable: ${event.kind}]")
        // No row: see [SessionEvent.RetiredTaskNote].
        is SessionEvent.RetiredTaskNote -> items
        // No row of its own -- the counts are screen-level state, see SessionScreen -- but the
        // generation speed belongs under the reply it measured, and this is where that reply ends.
        // Only onto the newest row, and only when that row is a reply: a turn whose usage arrives
        // after a tool call has nothing here to put it on, which draws as a footer without it.
        is SessionEvent.UsageDelta ->
            when (val last = items.lastOrNull()) {
                is TranscriptItem.AssistantMsg ->
                    items.dropLast(1) +
                        last.copy(
                            tokensPerSecond = event.tokensPerSecond,
                            prefillMs = event.prefillMs,
                        )
                else -> items
            }
        is SessionEvent.ContextWindow -> items
    }
 /**
@@ -487,9 +653,22 @@ fun foldEvent(items: List<TranscriptItem>, entry: SeqEvent): List<TranscriptItem
 */
 private fun settleReply(items: List<TranscriptItem>, state: String): List<TranscriptItem> {
    if (sessionWorking(state)) return items
-    val last = items.lastOrNull() as? TranscriptItem.AssistantMsg ?: return items
+    // A block the turn ended in the middle of is over, however it ended. Left open it spins for
-    if (last.settled) return items
+    // the rest of the conversation, which says the machine is working when nothing is.
-    return items.dropLast(1) + last.copy(settled = true)
+    val ended = closeThinking(items) { it.copy(open = false) }
    val last = ended.lastOrNull() as? TranscriptItem.AssistantMsg ?: return ended
    if (last.settled) return ended
    return ended.dropLast(1) + last.copy(settled = true)
 }
 /** [change] applied to the newest thinking block still open, if there is one. */
 private fun closeThinking(
    items: List<TranscriptItem>,
    change: (TranscriptItem.ThinkingRow) -> TranscriptItem.ThinkingRow,
 ): List<TranscriptItem> {
    val at = items.indexOfLast { it is TranscriptItem.ThinkingRow && it.open }
    if (at < 0) return items
    return items.toMutableList().apply { this[at] = change(this[at] as TranscriptItem.ThinkingRow) }
 }
 private fun updateTool(
@@ -1,6 +1,7 @@
 package com.example.aiapp
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.PaddingValues
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
@@ -10,6 +11,9 @@ import androidx.compose.foundation.lazy.LazyListState
 import androidx.compose.foundation.text.selection.SelectionContainer
 import androidx.compose.foundation.text.selection.SelectionState
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
@@ -49,6 +53,8 @@ fun TranscriptList(
    units: List<TranscriptUnit>,
    state: LazyListState,
    moreHistory: Boolean,
    historyError: String?,
    onRetryHistory: () -> Unit,
    selection: SelectionState,
    modifier: Modifier = Modifier,
    below: @Composable () -> Unit,
@@ -94,15 +100,29 @@ fun TranscriptList(
                DebugStats.count("unit composed")
                Box(Modifier.fillMaxWidth().padding(top = u.gap)) { unit(u) }
            }
-            // Standing in for everything not fetched yet. Only here while there is more -- its
+            // Standing in for everything not fetched yet. A failed fetch stays actionable here:
-            // appearance at the top edge is also roughly when the next page is asked for, so what
+            // when the loaded transcript is too short to scroll, this boundary is the only place
-            // it reports is a fetch in flight rather than an end reached.
+            // the reader can be given another way to ask.
            if (moreHistory) {
                item(key = "history", contentType = "history") {
                    Box(Modifier.fillMaxWidth().padding(vertical = 24.dp)) {
-                        CircularProgressIndicator(
+                        if (historyError == null) {
-                            Modifier.align(Alignment.Center).size(HISTORY_SPINNER)
+                            CircularProgressIndicator(
-                        )
+                                Modifier.align(Alignment.Center).size(HISTORY_SPINNER)
                            )
                        } else {
                            Column(
                                Modifier.align(Alignment.Center),
                                horizontalAlignment = Alignment.CenterHorizontally,
                            ) {
                                Text(
                                    "Couldn't load earlier messages. $historyError",
                                    color = MaterialTheme.colorScheme.error,
                                    style = MaterialTheme.typography.bodySmall,
                                )
                                TextButton(onClick = onRetryHistory) { Text("Try again") }
                            }
                        }
                    }
                }
            }
@@ -130,6 +130,25 @@ sealed class TranscriptUnit {
            get() = "u$seq:$ordinal"
    }
    /**
     * The line under a finished reply: when it was sent, and how fast it was generated.
     *
     * A unit of its own rather than something drawn inside the last block, because a settled reply
     * *is* its blocks -- there is no row left to hang it on, and the last block is a piece of
     * markdown that knows nothing about the message it came from.
     */
    data class ReplyFoot(
        override val seq: Long,
        override val ordinal: Int,
        val ts: Double,
        val tokensPerSecond: Double?,
        val prefillMs: Long?,
        override val gap: Dp,
    ) : TranscriptUnit() {
        override val key: Any
            get() = "f$seq"
    }
    /** One memory note of a settled reply; see [MemoryNote]. */
    data class Memory(
        override val seq: Long,
@@ -237,6 +256,19 @@ fun transcriptUnits(
                    }
                }
            }
            // Unconditional, because being in this branch is what says the reply is over:
            // [splitWanted] is settled-or-overtaken. The case to keep out is a message still
            // arriving, whose "sent at" is not yet the one it ends up with, and that is drawn
            // whole.
            units +=
                TranscriptUnit.ReplyFoot(
                    row.startSeq,
                    ordinal,
                    item.ts,
                    item.tokensPerSecond,
                    item.prefillMs,
                    gap(FOOT_SPACING),
                )
        } else {
            units += TranscriptUnit.Whole(row, rowGap)
        }
@@ -280,6 +312,14 @@ fun unwarmedReplies(rows: List<TranscriptRow>, replies: ParsedReplies): List<Tra
 * length has lines that wrap, so its bubble is at the full width already and the slices match it
 * exactly. Below it, one item of at most a few screens is nothing the list minds composing.
 */
 /**
 * The room between a reply's last block and the line under it.
 *
 * Tighter than the gap between blocks: the footer belongs to the message above it, and at a block's
 * spacing it reads as a row of its own floating between two replies.
 */
 private val FOOT_SPACING: Dp = 2.dp
 const val USER_SPLIT_CHARS = 4000
 /**
@@ -375,6 +415,7 @@ private val TranscriptUnit?.kind: String
            is TranscriptUnit.PeerBlock -> "peer block"
            is TranscriptUnit.UserChunk -> "user slice"
            is TranscriptUnit.Memory -> "memory note"
            is TranscriptUnit.ReplyFoot -> "reply footer"
            is TranscriptUnit.Whole ->
                when (val row = row) {
                    is TranscriptRow.Tools -> "tool group"
@@ -9,12 +9,15 @@ import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.rememberScrollState
 import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.LinearProgressIndicator
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Surface
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.dp
@@ -30,7 +33,14 @@ import java.time.OffsetDateTime
 * own, so the only thing its Back could ever have meant was "put this away".
 */
@Composable
-fun UsageDialog(feed: UsageFeed, onDismiss: () -> Unit) {
+fun UsageDialog(
    settings: ServerSettings,
    feed: UsageFeed,
    session: SessionSummary,
    onDismiss: () -> Unit,
 ) {
    var signingIn by remember { mutableStateOf(false) }
    val now = rememberUsageNow()
    // A plain Dialog rather than an AlertDialog, for the spacing alone. AlertDialog fixes the gaps
    // between its title, content and buttons at sizes meant for a sentence of prose and a decision;
    // this is a dense read-out, and those gaps left a band of empty dialog above Close that was
@@ -45,10 +55,6 @@ fun UsageDialog(feed: UsageFeed, onDismiss: () -> Unit) {
                    verticalAlignment = Alignment.CenterVertically,
                    modifier = Modifier.fillMaxWidth(),
                ) {
                    // Deliberately not subtitled with the provider this was opened from. These
                    // numbers belong to an account on a particular machine -- naming the session's
                    // provider here made an echo session's screen read "echo" above a line reading
                    // "claude". Each machine names itself and the service it came from.
                    Text(
                        "Usage",
                        style = MaterialTheme.typography.headlineSmall,
@@ -65,10 +71,24 @@ fun UsageDialog(feed: UsageFeed, onDismiss: () -> Unit) {
                }
                Spacer(Modifier.height(8.dp))
                // Scrolls rather than being trimmed: a machine can report any number of windows and
-                // there can be any number of machines, and a dialog is the one place where running
+                // a provider can report several billing pools, and a dialog is the one place where
-                // out of room is silent. `fill = false` so a short read-out keeps a short dialog.
+                // running out of room is silent. `fill = false` so a short read-out keeps a short
                // dialog.
                Column(Modifier.weight(1f, fill = false).verticalScroll(rememberScrollState())) {
-                    UsageBody(feed.snapshots)
+                    val state =
                        when (val snapshots = feed.snapshots) {
                            is LoadState.Loading -> LoadState.Loading
                            is LoadState.Error -> snapshots
                            is LoadState.Loaded ->
                                LoadState.Loaded(
                                    usageSnapshotsFor(
                                        snapshots.value,
                                        session.machine,
                                        session.usageProvider,
                                    )
                                )
                        }
                    UsageBody(state, now, onSignIn = { signingIn = true })
                }
                TextButton(onClick = onDismiss, modifier = Modifier.align(Alignment.End)) {
                    Text("Close")
@@ -76,29 +96,46 @@ fun UsageDialog(feed: UsageFeed, onDismiss: () -> Unit) {
            }
        }
    }
    if (signingIn) {
        ProviderLoginDialog(
            settings = settings,
            machineId = session.machine,
            machineName = session.machineName,
            provider = session.provider,
            onDismiss = { signingIn = false },
            onSignedIn = {
                signingIn = false
                feed.refresh()
            },
        )
    }
 }
 /** What came back, or why nothing did. Split out so the dialog above reads as its own shape. */
@Composable
-private fun UsageBody(state: LoadState<List<UsageSnapshot>>) {
+private fun UsageBody(
    state: LoadState<List<UsageSnapshot>>,
    now: OffsetDateTime,
    onSignIn: () -> Unit,
 ) {
    Column {
        when (val current = state) {
            is LoadState.Loading -> CircularProgressIndicator()
            is LoadState.Error -> Text(current.message, color = MaterialTheme.colorScheme.error)
            is LoadState.Loaded ->
                if (current.value.isEmpty()) {
-                    // Not an error and not a blank screen: no machine offers a paid service, so
+                    // Not an error and not a blank screen: this provider has no paid quota, so
                    // there is genuinely nothing to report and saying so is the answer.
                    Text(
-                        "No machine here runs anything with usage limits.",
+                        "This session's provider has no usage limits.",
                        style = MaterialTheme.typography.bodyMedium,
                        color = MaterialTheme.colorScheme.onSurfaceVariant,
                    )
                } else {
-                    // No card around each machine. A card is a step up the surface ladder, and
+                    // No card around each pool. A card is a step up the surface ladder, and inside
-                    // inside a dialog -- itself a raised surface -- the step barely renders while
+                    // a dialog -- itself a raised surface -- the step barely renders while costing
-                    // costing 16dp on every side. What separates one machine from the next is the
+                    // 16dp on every side. What separates one pool from the next is the line naming
-                    // line naming it.
+                    // it.
                    current.value.forEachIndexed { index, snapshot ->
                        if (index > 0) {
                            Spacer(Modifier.height(20.dp))
@@ -108,18 +145,18 @@ private fun UsageBody(state: LoadState<List<UsageSnapshot>>) {
                        // read as a section of their own. Small and quiet, because the numbers
                        // below are what somebody opened this to see.
                        Text(
-                            "${snapshot.setupName.ifEmpty { snapshot.setup }} · ${snapshot.provider}",
+                            usageSectionTitle(snapshot),
                            style = MaterialTheme.typography.bodySmall,
                            color = MaterialTheme.colorScheme.onSurfaceVariant,
                        )
-                        SnapshotState(snapshot)
+                        SnapshotState(snapshot, onSignIn)
                        snapshot.windows.forEachIndexed { windowIndex, window ->
                            // Between the bars, not after the last one: a trailing gap here is what
                            // put a band of empty dialog above the Close button.
                            if (windowIndex > 0) {
                                Spacer(Modifier.height(12.dp))
                            }
-                            WindowBar(window)
+                            WindowBar(window, now)
                        }
                    }
                }
@@ -127,20 +164,44 @@ private fun UsageBody(state: LoadState<List<UsageSnapshot>>) {
    }
 }
 private fun usageSectionTitle(snapshot: UsageSnapshot): String {
    val machine = snapshot.machineName.ifEmpty { snapshot.machine }
    val provider = snapshot.provider
    val pool =
        if (provider == "codex" && snapshot.limitId != "codex") {
            when (snapshot.limitName) {
                "gpt-reserve" -> "Luna Reserve"
                null -> snapshot.limitId
                else -> snapshot.limitName
            }
        } else null
    return listOfNotNull(machine, provider, pool).joinToString(" · ")
 }
 /**
 * Anything other than numbers: why this machine has none.
 *
 * The distinction the old single message could not draw. A machine nobody has logged in on is
 * working exactly as somebody set it up, so it reads as a plain statement -- marking it would be
- * the interface nagging about a decision already made. Only the two faults are coloured as faults.
+ * the interface nagging about a decision already made. It still offers the direct sign-in action;
 * unreachable and provider failures are the states coloured as faults.
 */
@Composable
-private fun SnapshotState(snapshot: UsageSnapshot) {
+private fun SnapshotState(snapshot: UsageSnapshot, onSignIn: () -> Unit) {
    when (snapshot.state) {
        "ok" -> {}
-        "notLoggedIn" ->
+        "notLoggedIn",
        "loginRequired" -> {
            Text(
-                "No Claude account on this machine.",
+                snapshot.detail ?: "No Claude account on this machine.",
                style = MaterialTheme.typography.bodyMedium,
                color = MaterialTheme.colorScheme.onSurfaceVariant,
            )
            TextButton(onClick = onSignIn) { Text("Sign in") }
        }
        "authenticating" ->
            Text(
                "Claude sign-in is in progress.",
                style = MaterialTheme.typography.bodyMedium,
                color = MaterialTheme.colorScheme.onSurfaceVariant,
            )
@@ -162,7 +223,7 @@ private fun SnapshotState(snapshot: UsageSnapshot) {
 }
@Composable
-private fun WindowBar(window: UsageWindow) {
+private fun WindowBar(window: UsageWindow, now: OffsetDateTime) {
    Column {
        Row(modifier = Modifier.fillMaxWidth()) {
            Text(
@@ -173,12 +234,8 @@ private fun WindowBar(window: UsageWindow) {
            Text("${window.percent.toInt()}%", style = MaterialTheme.typography.bodyMedium)
        }
        Spacer(Modifier.height(4.dp))
-        LinearProgressIndicator(
+        UsageProgressIndicator(window, now, Modifier.fillMaxWidth())
-            progress = { (window.percent / 100.0).toFloat().coerceIn(0f, 1f) },
+        resetLine(window, now)?.let {
            color = quotaColor(window.percent),
            modifier = Modifier.fillMaxWidth(),
        )
        resetLine(window)?.let {
            Spacer(Modifier.height(2.dp))
            Text(
                it,
@@ -197,8 +254,8 @@ private fun WindowBar(window: UsageWindow) {
 * failure appeared as an ISO string in a sentence written for a person. Both are named in
 * [WindowEnd], and the session bar words them the same way.
 */
-private fun resetLine(window: UsageWindow): String? =
+private fun resetLine(window: UsageWindow, now: OffsetDateTime): String? =
-    when (val end = windowEnd(window.resetsAt, OffsetDateTime.now())) {
+    when (val end = windowEnd(window.resetsAt, now)) {
        WindowEnd.NotRunning -> null
        WindowEnd.Unreadable -> "reset time unreadable"
        is WindowEnd.Ends ->
@@ -1,6 +0,0 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
    <!-- Overridden by the `bench` build type's resValue (build.gradle.kts) to "AI Sessions bench",
         so the two are never mistaken for each other in the launcher or in Settings. -->
    <string name="app_name">AI Sessions</string>
 </resources>
@@ -0,0 +1,28 @@
 package com.example.aiapp
 import kotlin.test.Test
 import kotlin.test.assertFalse
 import kotlin.test.assertTrue
 class AuthenticationPromptTest {
    @Test
    fun an_authentication_failure_stays_actionable_through_its_terminal_status() {
        val required =
            authenticationPromptAfter(
                false,
                SessionEvent.AuthenticationRequired("sign in again"),
            )
        assertTrue(authenticationPromptAfter(required, SessionEvent.Status("idle")))
    }
    @Test
    fun a_later_provider_response_makes_an_old_failure_stale() {
        assertFalse(
            authenticationPromptAfter(
                true,
                SessionEvent.AssistantText("Working again."),
            )
        )
    }
 }
@@ -0,0 +1,33 @@
 package com.example.aiapp
 import kotlin.test.Test
 import kotlin.test.assertEquals
 class FilesNavigationTest {
    @Test
    fun `back walks through the common ancestor toward the project`() {
        val project = "/home/bob/repos/project"
        assertEquals("/", nextDirectoryToward("/etc", project))
        assertEquals("/home", nextDirectoryToward("/", project))
        assertEquals("/home/bob", nextDirectoryToward("/home", project))
        assertEquals("/home/bob/repos", nextDirectoryToward("/home/bob", project))
        assertEquals(project, nextDirectoryToward("/home/bob/repos", project))
        assertEquals(null, nextDirectoryToward(project, project))
    }
    @Test
    fun `back leaves a project descendant one directory at a time`() {
        assertEquals(
            "/home/bob/repos/project/src",
            nextDirectoryToward("/home/bob/repos/project/src/main", "/home/bob/repos/project"),
        )
    }
    @Test
    fun `paths inside the machine home use tilde notation`() {
        assertEquals("~", tildePath("/home/bob", "/home/bob"))
        assertEquals("~/repos/project", tildePath("/home/bob/repos/project", "/home/bob/"))
        assertEquals("/home/bobby/project", tildePath("/home/bobby/project", "/home/bob"))
        assertEquals("/etc", tildePath("/etc", "/home/bob"))
    }
 }
@@ -338,6 +338,21 @@ class HighlighterTest {
        assertEquals("+[-]", highlight("+[-]", fenceLanguage("brainfuck")).text)
    }
    @Test
    fun `a diff colours changes and identifies its framing separately`() {
        val code = "--- a/file\n+++ b/file\n@@ -1 +1 @@\n-old\n context\n+new"
        assertSpans(code, Language.DIFF, Kind.DELETION, "-old")
        assertSpans(code, Language.DIFF, Kind.ADDITION, "+new")
        assertSpans(
            code,
            Language.DIFF,
            Kind.METADATA,
            "--- a/file",
            "+++ b/file",
            "@@ -1 +1 @@",
        )
    }
    @Test
    fun `every language the fence table knows has a scanner`() {
        Language.entries.forEach { spansOf("x", it) }
@@ -0,0 +1,31 @@
 package com.example.aiapp
 import kotlin.test.Test
 import kotlin.test.assertEquals
 import kotlin.test.assertNull
 class MarkdownLinksTest {
    @Test
    fun `absolute file paths are opened on the session machine`() {
        assertEquals(
            "/home/bob/repos/ai app/Main.kt",
            filePathOf("/home/bob/repos/ai%20app/Main.kt"),
        )
        assertEquals("/home/bob/Main.kt", filePathOf("file:///home/bob/Main.kt"))
        assertEquals("/home/bob/Main.kt", filePathOf("file://localhost/home/bob/Main.kt"))
    }
    @Test
    fun `editor coordinates select the file itself`() {
        assertEquals("/home/bob/Main.kt", filePathOf("/home/bob/Main.kt:42"))
        assertEquals("/home/bob/Main.kt", filePathOf("file:///home/bob/Main.kt:42:7#L42"))
    }
    @Test
    fun `ordinary links keep their external meaning`() {
        assertNull(filePathOf("https://example.com/source.kt"))
        assertNull(filePathOf("docs/source.kt"))
        assertNull(filePathOf("//example.com/source.kt"))
        assertNull(filePathOf("file://example.com/source.kt"))
    }
 }
@@ -0,0 +1,72 @@
 package com.example.aiapp
 import kotlin.test.Test
 import kotlin.test.assertEquals
 import kotlin.test.assertTrue
 class PendingMessagesTest {
    private fun local(text: String = "keep this") =
        QueuedMessage("local-1", text, emptyList(), local = true)
    @Test
    fun a_server_queue_replaces_the_local_bridge_instead_of_duplicating_it() {
        val queued =
            reconcileQueuedMessage(
                listOf(local()),
                SessionEvent.MessageQueued("server-1", "keep this", emptyList()),
            )
        assertEquals(1, queued.size)
        assertEquals("server-1", queued.single().id)
        assertTrue(!queued.single().local)
    }
    @Test
    fun an_immediately_received_message_removes_its_local_bridge() {
        val queued =
            reconcileUserMessage(
                listOf(local()),
                SessionEvent.UserMessage("keep this", id = null, attachments = emptyList()),
            )
        assertTrue(queued.isEmpty())
    }
    @Test
    fun a_transport_failure_stays_on_its_message() {
        val queued = markPendingFailure(listOf(local()), "local-1", "Can't reach the server")
        assertEquals("Can't reach the server", queued.single().refusal)
        assertTrue(queued.single().local)
    }
    @Test
    fun server_acceptance_keeps_the_bubble_until_the_provider_event() {
        val queued = markPendingAccepted(listOf(local()), "local-1")
        assertEquals(1, queued.size)
        assertTrue(queued.single().serverAccepted)
    }
    @Test
    fun discarding_a_failed_send_removes_only_that_local_copy() {
        val server = QueuedMessage("server-1", "already accepted", emptyList())
        val queued = listOf(local(), local("keep this one").copy(id = "local-2"), server)
        val discarded = discardPendingMessage(queued, "local-1")
        assertEquals(listOf("local-2", "server-1"), discarded.map { it.id })
    }
    @Test
    fun identical_messages_are_reconciled_one_at_a_time() {
        val queued = listOf(local(), local().copy(id = "local-2"))
        val afterFirst =
            reconcileUserMessage(
                queued,
                SessionEvent.UserMessage("keep this", id = null, attachments = emptyList()),
            )
        assertEquals(listOf("local-2"), afterFirst.map { it.id })
    }
 }
@@ -0,0 +1,111 @@
 package com.example.aiapp
 import androidx.compose.ui.geometry.Offset
 import kotlin.test.Test
 import kotlin.test.assertEquals
 class SessionImageTest {
    @Test
    fun `a full-height image hides both bars`() {
        assertEquals(
            ViewerBars(status = true, navigation = true),
            viewerBars(
                imageWidth = 1000,
                imageHeight = 2000,
                viewportWidth = 1000,
                viewportHeight = 2000,
                scale = 1f,
                offset = Offset.Zero,
                insets = ViewerBarInsets(status = 100, navigation = 100),
            ),
        )
    }
    @Test
    fun `a letterboxed image leaves both bars visible`() {
        assertEquals(
            ViewerBars(),
            viewerBars(
                imageWidth = 1000,
                imageHeight = 500,
                viewportWidth = 1000,
                viewportHeight = 2000,
                scale = 1f,
                offset = Offset.Zero,
                insets = ViewerBarInsets(status = 100, navigation = 100),
            ),
        )
    }
    @Test
    fun `panning into the status bar hides only that bar`() {
        assertEquals(
            ViewerBars(status = true),
            viewerBars(
                imageWidth = 1000,
                imageHeight = 500,
                viewportWidth = 1000,
                viewportHeight = 2000,
                scale = 2f,
                offset = Offset(0f, -500f),
                insets = ViewerBarInsets(status = 100, navigation = 100),
            ),
        )
    }
    @Test
    fun `native scale reverses fitting a tall image`() {
        assertEquals(
            1.25f,
            nativeScale(
                imageWidth = 1000,
                imageHeight = 2000,
                viewportWidth = 1000,
                viewportHeight = 1600,
            ),
        )
    }
    @Test
    fun `native scale leaves a small image alone`() {
        assertEquals(
            1f,
            nativeScale(
                imageWidth = 500,
                imageHeight = 500,
                viewportWidth = 1000,
                viewportHeight = 1000,
            ),
        )
    }
    @Test
    fun `zoom keeps the region panned to in the center`() {
        assertEquals(
            Offset(240f, -160f),
            zoomOffset(
                offset = Offset(120f, -80f),
                centroid = Offset(500f, 1000f),
                pan = Offset.Zero,
                oldScale = 2f,
                newScale = 4f,
                viewportCenter = Offset(500f, 1000f),
            ),
        )
    }
    @Test
    fun `zoom keeps an off-center pinch beneath moving fingers`() {
        assertEquals(
            Offset(460f, 420f),
            zoomOffset(
                offset = Offset(100f, -100f),
                centroid = Offset(250f, 400f),
                pan = Offset(10f, 20f),
                oldScale = 2f,
                newScale = 4f,
                viewportCenter = Offset(500f, 1000f),
            ),
        )
    }
 }
@@ -0,0 +1,137 @@
 package com.example.aiapp
 import java.time.OffsetDateTime
 import kotlin.test.Test
 import kotlin.test.assertEquals
 class SessionUsageTest {
    @Test
    fun `usage snapshots stay with the session's machine and provider`() {
        val claude = snapshot("machine", "claude", null)
        val codex = snapshot("machine", "codex", "codex")
        val reserve = snapshot("machine", "codex", "gpt-reserve")
        val elsewhere = snapshot("other", "codex", "codex")
        assertEquals(
            listOf(codex, reserve),
            usageSnapshotsFor(
                listOf(claude, codex, reserve, elsewhere),
                machine = "machine",
                provider = "codex",
            ),
        )
    }
    @Test
    fun `a session without a meter has no usage snapshots`() {
        assertEquals(
            emptyList(),
            usageSnapshotsFor(
                listOf(snapshot("machine", "claude", null)),
                machine = "machine",
                provider = null,
            ),
        )
    }
    @Test
    fun `the model selects its named pool and other models use the generic pool`() {
        val generic = snapshot("machine", "codex", "codex")
        val spark =
            snapshot(
                "machine",
                "codex",
                "codex_bengalfox",
                limitName = "GPT-5.3-Codex-Spark",
            )
        val reserve =
            snapshot("machine", "codex", "base_model_inference", limitName = "gpt-reserve")
        val pools = listOf(generic, spark, reserve)
        assertEquals(spark, usagePoolFor(pools, "gpt-5.3-codex-spark"))
        assertEquals(reserve, usagePoolFor(pools, "gpt-5.6-luna"))
        assertEquals(generic, usagePoolFor(pools, "gpt-6-astra"))
    }
    @Test
    fun `the bar uses the shortest reported cycle`() {
        val weekly = window("Weekly", 10_080)
        val hourly = window("5-hour window", 300)
        assertEquals(hourly, shortestUsageWindow(listOf(weekly, hourly)))
        assertEquals(null, shortestUsageWindow(listOf(window("unknown", null))))
    }
    @Test
    fun `the time cursor follows elapsed time through the window`() {
        val now = OffsetDateTime.parse("2026-09-17T12:00:00Z")
        assertEquals(
            0.4f,
            usageWindowElapsedFraction(
                window("5-hour window", 300, "2026-09-17T15:00:00Z"),
                now,
            ),
        )
    }
    @Test
    fun `the time cursor clamps at the window ends`() {
        val now = OffsetDateTime.parse("2026-09-17T12:00:00Z")
        assertEquals(
            0f,
            usageWindowElapsedFraction(
                window("5-hour window", 300, "2026-09-17T18:00:00Z"),
                now,
            ),
        )
        assertEquals(
            1f,
            usageWindowElapsedFraction(
                window("5-hour window", 300, "2026-09-17T11:00:00Z"),
                now,
            ),
        )
    }
    @Test
    fun `the time cursor is absent without a usable duration and reset time`() {
        val now = OffsetDateTime.parse("2026-09-17T12:00:00Z")
        assertEquals(null, usageWindowElapsedFraction(window("unknown", null), now))
        assertEquals(null, usageWindowElapsedFraction(window("not running", 300), now))
        assertEquals(
            null,
            usageWindowElapsedFraction(window("unreadable", 300, "not a timestamp"), now),
        )
        assertEquals(null, usageWindowElapsedFraction(window("zero", 0), now))
    }
    private fun snapshot(
        machine: String,
        provider: String,
        limitId: String?,
        limitName: String? = null,
    ) =
        UsageSnapshot(
            provider = provider,
            machine = machine,
            machineName = machine,
            limitId = limitId,
            limitName = limitName,
            state = "ok",
            detail = null,
            windows = emptyList(),
        )
    private fun window(label: String, durationMinutes: Long?, resetsAt: String? = null) =
        UsageWindow(
            kind = "test",
            label = label,
            percent = 12.0,
            durationMinutes = durationMinutes,
            resetsAt = resetsAt,
            active = false,
        )
 }
@@ -0,0 +1,150 @@
 package com.example.aiapp
 import java.time.ZoneId
 import kotlin.test.Test
 import kotlin.test.assertEquals
 import kotlin.test.assertNull
 import kotlin.test.assertTrue
 /**
 * The model's working as its own row, and the line under a finished reply.
 *
 * Both have the same shape of hazard: a state nothing measured must not come out looking like one
 * that was. A block interrupted mid-thought has no duration, and a provider that reports no
 * generation speed has no figure -- neither may borrow one.
 */
 class ThinkingTest {
    private val utc = ZoneId.of("UTC")
    private var seq = 0L
    private fun fold(items: List<TranscriptItem>, event: SessionEvent, ts: Double = 1.0) =
        foldEvent(items, SeqEvent(seq = ++seq, ts = ts, event = event))
    private fun fold(vararg events: SessionEvent) =
        events.fold(emptyList<TranscriptItem>()) { items, event -> fold(items, event) }
    private fun thinking(items: List<TranscriptItem>) =
        items.filterIsInstance<TranscriptItem.ThinkingRow>()
    @Test
    fun `deltas accumulate into one block that ends with its duration`() {
        val items =
            fold(
                SessionEvent.Thinking("the user "),
                SessionEvent.Thinking("wants a card"),
                SessionEvent.ThinkingDone(12_400),
                SessionEvent.AssistantText("Here it is."),
            )
        val block = thinking(items).single()
        assertEquals("the user wants a card", block.text)
        assertEquals(12_400, block.ms)
        assertEquals("Thought for 12.4s", thinkingHeadline(block))
        // Its own row, above the reply rather than inside it.
        assertEquals(1, items.filterIsInstance<TranscriptItem.AssistantMsg>().size)
    }
    @Test
    fun `a block the turn ended in the middle of stops without naming a span`() {
        val items = fold(SessionEvent.Thinking("half a thought"), SessionEvent.Status("idle"))
        val block = thinking(items).single()
        assertNull(block.ms)
        assertTrue(!block.open)
        assertEquals("Thought", thinkingHeadline(block))
    }
    @Test
    fun `a block still being thought says so`() {
        val block = thinking(fold(SessionEvent.Thinking("hmm"))).single()
        assertTrue(block.open)
        assertEquals("Thinking", thinkingHeadline(block))
    }
    @Test
    fun `thinking between two replies is two replies and two blocks`() {
        val items =
            fold(
                SessionEvent.Thinking("first"),
                SessionEvent.ThinkingDone(1_000),
                SessionEvent.AssistantText("One."),
                SessionEvent.Thinking("second"),
                SessionEvent.ThinkingDone(2_000),
                SessionEvent.AssistantText("Two."),
            )
        assertEquals(listOf("first", "second"), thinking(items).map { it.text })
        assertEquals(
            listOf("One.", "Two."),
            items.filterIsInstance<TranscriptItem.AssistantMsg>().map { it.text },
        )
    }
    @Test
    fun `a reply carries when it was sent and what it cost to produce`() {
        val items =
            fold(emptyList(), SessionEvent.AssistantText("Done."), ts = 1_788_609_600.0).let {
                fold(it, SessionEvent.UsageDelta(42, 100, 18.37, 9_489))
            }
        val reply = items.filterIsInstance<TranscriptItem.AssistantMsg>().single()
        assertEquals(1_788_609_600.0, reply.ts)
        assertEquals(18.37, reply.tokensPerSecond)
        assertEquals(9_489, reply.prefillMs)
        val footer = replyFooterText(reply.ts, reply.tokensPerSecond, reply.prefillMs, utc)
        // The clock reading rather than the whole string: the platform's own short-time format
        // differs by JDK and locale, which is the point of asking it for one.
        assertTrue(footer!!.startsWith("read 9.5s · 18.4 tok/s · "), footer)
        assertTrue(footer.contains("12:00"), footer)
    }
    @Test
    fun `the clock stays at the end however much the provider measured`() {
        // What a provider that measures nothing leaves: the time, and nothing in front of it.
        val bare = replyFooterText(1_788_609_600.0, null, null, utc)
        assertTrue(bare!!.contains("12:00"), bare)
        assertTrue(!bare.contains("tok/s") && !bare.contains("read"), bare)
        // Every shape ends with the same thing, which is the whole point of the order: the clock
        // does not move because the session is on a provider that measures more or less.
        val shapes =
            listOf(
                bare,
                replyFooterText(1_788_609_600.0, 18.37, null, utc)!!,
                replyFooterText(1_788_609_600.0, null, 9_489, utc)!!,
                replyFooterText(1_788_609_600.0, 18.37, 9_489, utc)!!,
            )
        assertEquals(1, shapes.map { it.substringAfterLast("· ") }.distinct().size, "$shapes")
        // A reply with nothing to say has no line at all rather than an empty one.
        assertNull(replyFooterText(0.0, null, null, utc))
    }
    @Test
    fun `a block cut by a page boundary is one block, and it is not still going`() {
        // Each page folded on its own, as the app does: the older one holds the fragments before
        // the cut and no ending, the newer one the rest and the ending.
        val older = fold(SessionEvent.Thinking("half a "))
        val newer = fold(SessionEvent.Thinking("thought"), SessionEvent.ThinkingDone(2_000))
        val joined = joinPages(older, newer)
        val block = thinking(joined).single()
        assertEquals("half a thought", block.text)
        assertEquals(2_000, block.ms)
        assertTrue(!block.open)
    }
    @Test
    fun `two blocks meeting at a page boundary stay two`() {
        val older = fold(SessionEvent.Thinking("first"), SessionEvent.ThinkingDone(1_000))
        val newer = fold(SessionEvent.Thinking("second"), SessionEvent.ThinkingDone(2_000))
        assertEquals(listOf("first", "second"), thinking(joinPages(older, newer)).map { it.text })
    }
    @Test
    fun `usage that lands after a tool call is not folded onto an older reply`() {
        val items =
            fold(
                SessionEvent.AssistantText("Reading it."),
                SessionEvent.ToolStart("t1", "Read", "{}"),
                SessionEvent.ToolEnd("t1", "done"),
                SessionEvent.UsageDelta(42, 100, 18.0, 500),
            )
        assertNull(items.filterIsInstance<TranscriptItem.AssistantMsg>().single().tokensPerSecond)
    }
 }
@@ -0,0 +1,43 @@
 package com.example.aiapp
 import kotlin.test.Test
 import kotlin.test.assertEquals
 import kotlin.test.assertNull
 import kotlin.test.assertTrue
 class ToolInputTest {
    @Test
    fun `bash wrapper ignores double quotes inside its outer pair`() {
        assertEquals(
            "rg -n \"needle\" server app",
            renderedBashScript("/usr/bin/bash -lc \"rg -n \"needle\" server app\""),
        )
    }
    @Test
    fun `bash wrapper ignores single quotes inside its outer pair`() {
        assertEquals(
            "printf 'hello'",
            renderedBashScript("/bin/bash -lc 'printf 'hello''"),
        )
    }
    @Test
    fun `unquoted or unfamiliar commands stay intact`() {
        assertNull(renderedBashScript("/usr/bin/bash -lc echo hello"))
        assertNull(renderedBashScript("/usr/bin/fish -lc 'echo hello'"))
    }
    @Test
    fun `missing optional input is not displayed as null`() {
        assertTrue(parseToolInput("TaskOutput", "null").rest.isEmpty())
    }
    @Test
    fun `collaboration calls say what they do and omit empty completion`() {
        assertEquals("Spawn agent", toolDisplayName("Task"))
        assertEquals("Wait for agents", toolDisplayName("TaskOutput"))
        assertEquals("", toolDisplayOutput("TaskOutput", "completed"))
        assertEquals("failed", toolDisplayOutput("TaskOutput", "failed"))
    }
 }
@@ -0,0 +1,167 @@
 package com.example.aiapp
 import kotlin.test.Test
 import kotlin.test.assertEquals
 import kotlin.test.assertTrue
 /**
 * How a run of tool calls is cut into rows: the call still running, the last call in the
 * transcript, and one held out because the reader has it open are drawn on their own, and every
 * piece the cut leaves behind still has a key of its own -- two rows sharing one key take the app
 * down, and a key that moves takes the reader's place with it.
 */
 class ToolRowsTest {
    private var seq = 0L
    private fun call(id: String, runId: String = id, done: Boolean = true) =
        TranscriptItem.ToolRun(
            seq = ++seq,
            id = id,
            runId = runId,
            tool = "Bash",
            input = "{}",
            output = if (done) "ok" else "",
            done = done,
        )
    /** Something that is not a tool call, to put behind the run so its last call folds in. */
    private fun reply() = TranscriptItem.AssistantMsg(seq = ++seq, text = "done")
    private fun shape(rows: List<TranscriptRow>) = rows.map { row ->
        when (row) {
            is TranscriptRow.Tools -> row.calls.map { it.id }
            is TranscriptRow.Single -> listOf((row.item as? TranscriptItem.ToolRun)?.id ?: "reply")
        }
    }
    private fun assertKeysDistinct(rows: List<TranscriptRow>) =
        assertEquals(rows.size, rows.map { it.key }.toSet().size, "$rows")
    @Test
    fun the_call_still_running_is_a_row_of_its_own() {
        val rows =
            groupToolRuns(
                listOf(
                    call("a"),
                    call("b", runId = "a"),
                    call("c", runId = "a", done = false),
                    call("d", runId = "a"),
                    reply(),
                )
            )
        assertEquals(
            listOf(listOf("a", "b"), listOf("c"), listOf("d"), listOf("reply")),
            shape(rows),
        )
        assertKeysDistinct(rows)
    }
    @Test
    fun a_call_running_in_the_middle_of_its_run_splits_the_group_in_two() {
        val rows =
            groupToolRuns(
                listOf(
                    call("a"),
                    call("b", runId = "a", done = false),
                    call("c", runId = "a"),
                    call("d", runId = "a"),
                    reply(),
                )
            )
        assertEquals(
            listOf(listOf("a"), listOf("b"), listOf("c", "d"), listOf("reply")),
            shape(rows),
        )
        assertKeysDistinct(rows)
    }
    /**
     * A call held out is one the reader opened while it stood on its own; being overtaken while
     * they read it does not fold it away, and closing it hands it back to its run.
     */
    @Test
    fun a_held_out_call_stays_out_of_its_group() {
        val calls =
            listOf(
                call("a"),
                call("b", runId = "a"),
                call("c", runId = "a"),
                call("d", runId = "a"),
                reply(),
            )
        val whileHeld = groupToolRuns(calls, heldOut = setOf("d"))
        val afterItCloses = groupToolRuns(calls)
        assertEquals(listOf(listOf("a", "b", "c"), listOf("d"), listOf("reply")), shape(whileHeld))
        assertTrue(whileHeld[1] is TranscriptRow.Single, "$whileHeld")
        assertKeysDistinct(whileHeld)
        assertEquals(listOf(listOf("a", "b", "c", "d"), listOf("reply")), shape(afterItCloses))
        assertTrue(afterItCloses.first() is TranscriptRow.Tools, "$afterItCloses")
    }
    /**
     * The one case where the run's name is a call that is not in the run's first row: a page of
     * history joined onto a run whose own first call is still going ([joinPages] renames the older
     * calls to the newer run's name). Both rows would key on that name.
     */
    @Test
    fun the_run_keeps_its_name_even_when_the_call_it_is_named_after_is_the_one_running() {
        val rows = groupToolRuns(listOf(call("a", runId = "b"), call("b", done = false)))
        assertEquals(listOf(listOf("a"), listOf("b")), shape(rows))
        assertKeysDistinct(rows)
        assertEquals("b", rows.first().key)
    }
    @Test
    fun a_run_that_reappears_after_another_row_keeps_distinct_keys() {
        val rows =
            groupToolRuns(
                listOf(
                    call("older", runId = "exec-1"),
                    call("older-2", runId = "exec-1"),
                    reply(),
                    call("exec-1", runId = "exec-1"),
                    call("newer", runId = "exec-1"),
                    reply(),
                )
            )
        assertTrue(rows[0] is TranscriptRow.Tools, "$rows")
        assertTrue(rows[2] is TranscriptRow.Tools, "$rows")
        assertKeysDistinct(rows)
        assertEquals("exec-1", rows[0].key)
        assertEquals("exec-1/exec-1", rows[2].key)
    }
    /**
     * Finishing is not what folds a call back in -- being overtaken is. A session that has run its
     * last command and is writing its reply leaves that command standing until the reply starts.
     */
    @Test
    fun the_last_call_stays_out_when_it_finishes_and_folds_in_when_something_follows() {
        val a = call("a")
        val running = call("b", runId = "a", done = false)
        val finished = running.copy(done = true)
        val whileRunning = groupToolRuns(listOf(a, running))
        val afterItEnds = groupToolRuns(listOf(a, finished))
        val afterTheReply = groupToolRuns(listOf(a, finished, reply()))
        assertEquals(listOf(listOf("a"), listOf("b")), shape(whileRunning))
        assertEquals(listOf(listOf("a"), listOf("b")), shape(afterItEnds))
        assertEquals(listOf(listOf("a", "b"), listOf("reply")), shape(afterTheReply))
        // The run keeps the key it was drawn under throughout, so the list rebuilds a row rather
        // than losing its anchor.
        assertEquals(whileRunning.first().key, afterItEnds.first().key)
        assertEquals(whileRunning.first().key, afterTheReply.first().key)
    }
    @Test
    fun a_run_of_finished_calls_is_one_group_once_something_follows_it() {
        val rows =
            groupToolRuns(
                listOf(call("a"), call("b", runId = "a"), call("c", runId = "a"), reply())
            )
        assertEquals(listOf(listOf("a", "b", "c"), listOf("reply")), shape(rows))
        assertTrue(rows.first() is TranscriptRow.Tools, "$rows")
    }
 }
@@ -0,0 +1,185 @@
 package com.example.aiapp
 import kotlin.test.Test
 import kotlin.test.assertEquals
 import kotlin.test.assertTrue
 /**
 * Where one turn ends and the next begins, which is the part of the fold that had no way of saying
 * anything was wrong: two replies run together read as one long answer, and the seam is somewhere
 * in the middle of a sentence.
 */
 class TranscriptItemsTest {
    private var seq = 0L
    private fun fold(items: List<TranscriptItem>, event: SessionEvent) =
        foldEvent(items, SeqEvent(seq = ++seq, ts = 1.0, event = event))
    private fun fold(vararg events: SessionEvent) =
        events.fold(emptyList<TranscriptItem>()) { items, event -> fold(items, event) }
    private fun texts(items: List<TranscriptItem>) =
        items.filterIsInstance<TranscriptItem.AssistantMsg>().map { it.text }
    @Test
    fun an_authentication_failure_stays_visible_as_an_error_row() {
        val entry =
            SeqEvent(
                seq = 7,
                ts = 1.0,
                event = SessionEvent.AuthenticationRequired("sign in again"),
            )
        assertEquals(
            TranscriptItem.ErrorMsg(7, "sign in again"),
            foldEvent(emptyList(), entry).single(),
        )
    }
    @Test
    fun text_after_the_turn_ended_is_a_new_reply_rather_than_more_of_the_last_one() {
        val items =
            fold(
                SessionEvent.AssistantText("You'll get the one-line notice when it lands."),
                SessionEvent.Status("idle"),
                SessionEvent.AssistantText("Dev Updater fix is pushed."),
            )
        assertEquals(
            listOf("You'll get the one-line notice when it lands.", "Dev Updater fix is pushed."),
            texts(items),
        )
    }
    @Test
    fun deltas_of_one_reply_still_accumulate_into_it() {
        val items =
            fold(
                SessionEvent.AssistantText("Still "),
                SessionEvent.AssistantText("running "),
                SessionEvent.Status("running"),
                SessionEvent.AssistantText("its tests."),
            )
        assertEquals(listOf("Still running its tests."), texts(items))
    }
    @Test
    fun completed_text_replaces_provisional_deltas_live() {
        val items =
            fold(
                SessionEvent.AssistantText("I'll inspect the color-c concrete implementation"),
                SessionEvent.AssistantTextFinal(
                    "I’ll inspect the color-correction TODO and the relevant design."
                ),
            )
        assertEquals(
            listOf("I’ll inspect the color-correction TODO and the relevant design."),
            texts(items),
        )
    }
    @Test
    fun completed_text_discards_provisional_deltas_across_a_page_boundary() {
        val earlier = fold(SessionEvent.AssistantText("1. provisional section\n\n"))
        val later =
            fold(
                SessionEvent.AssistantTextFinal("1. final first section\n\n2. final second section")
            )
        assertEquals(
            listOf("1. final first section\n\n2. final second section"),
            texts(joinPages(earlier, later)),
        )
    }
    @Test
    fun a_final_value_after_a_settled_reply_is_a_new_message_across_a_page_boundary() {
        val earlier =
            fold(
                SessionEvent.AssistantText("Previous answer."),
                SessionEvent.Status("idle"),
            )
        val later = fold(SessionEvent.AssistantTextFinal("Next answer."))
        assertEquals(
            listOf("Previous answer.", "Next answer."),
            texts(joinPages(earlier, later)),
        )
    }
    /**
     * The rule that replaced the wall of reports. A turn that starts with nothing recorded in front
     * of it -- a subagent finishing, the CLI picking a conversation back up -- leaves two replies
     * abutting, and only the break says they are two.
     */
    @Test
    fun two_replies_that_meet_are_separated_by_a_rule_and_nothing_else() {
        val items =
            fold(
                SessionEvent.AssistantText("Launched it."),
                SessionEvent.Status("waiting"),
                SessionEvent.AssistantText("Noted."),
            )
        assertEquals(3, items.size, "$items")
        assertTrue(items[1] is TranscriptItem.TurnBreak, "$items")
        assertEquals(listOf("Launched it.", "Noted."), texts(items))
        // Distinct keys: the break shares the reply's seq, and two items with one key take the
        // app down.
        assertEquals(3, items.map { it.key }.toSet().size, "$items")
    }
    /**
     * A reply after anything that draws a row of its own needs no rule: that row is the boundary.
     */
    @Test
    fun a_reply_after_a_row_of_its_own_gets_no_rule() {
        val items =
            fold(
                SessionEvent.AssistantText("Launched it."),
                SessionEvent.Status("idle"),
                SessionEvent.UserMessage("carry on", null, emptyList()),
                SessionEvent.AssistantText("Noted."),
            )
        assertTrue(items.none { it is TranscriptItem.TurnBreak }, "$items")
    }
    @Test
    fun a_repeated_tool_start_is_still_one_row() {
        val start = SessionEvent.ToolStart("exec-1", "Bash", "{\"command\":\"cargo test\"}")
        val items =
            fold(
                start,
                SessionEvent.AssistantText("The test run is still going."),
                start,
                SessionEvent.ToolEnd("exec-1", "finished"),
            )
        val tools = items.filterIsInstance<TranscriptItem.ToolRun>()
        assertEquals(1, tools.size, "$items")
        assertEquals("finished", tools.single().output)
        assertTrue(tools.single().done)
    }
    /**
     * The page-join half of the same rule. A boundary that cuts one reply leaves an unfinished half
     * to be rejoined; a boundary that lands between two turns must not join anything, or paging
     * back puts the run-together paragraph straight back.
     */
    @Test
    fun paging_back_rejoins_a_cut_reply_and_leaves_two_finished_ones_apart() {
        val cut =
            joinPages(
                listOf(TranscriptItem.AssistantMsg(1, "half a ")),
                listOf(TranscriptItem.AssistantMsg(2, "sentence", settled = true)),
            )
        assertEquals(listOf("half a sentence"), texts(cut))
        val whole =
            joinPages(
                listOf(TranscriptItem.AssistantMsg(1, "One turn.", settled = true)),
                listOf(TranscriptItem.AssistantMsg(2, "The next.", settled = true)),
            )
        assertEquals(listOf("One turn.", "The next."), texts(whole))
        // And the rule between them, which the fold that would have made it never got to see.
        assertTrue(whole.any { it is TranscriptItem.TurnBreak }, "$whole")
    }
 }
@@ -1,28 +0,0 @@
 # The P0 benchmark fixture
 `transcript.jsonl` is a synthetic transcript in the app's own event model (the JSON lines
 `GET /sessions/{id}/transcript` returns; see `Events.kt`'s `parseSeqEvent` and
 `server/src/session/driver.rs`) -- never a real one. It is what both the Compose `bench` build
 and iris's bench build open with no server, so the two apps draw exactly the same content and a
 frame-time comparison is measuring the renderer rather than the data.
 Generated by `./generate.py` (Python stdlib only, seeded -- `SEED = 20260905` -- so re-running it
 reproduces the same file byte for byte). It writes into `assets/` -- a separate directory from this
 script and README, because the Compose `bench` build type points its own asset source set straight
 at `assets/` (`app/androidApp/build.gradle.kts`'s `sourceSets { getByName("bench") }`), and a Python
 script and a markdown file have no business inside an APK:
 - `transcript.jsonl` -- 3,601 events. The first 3,200 (`BACKLOG_COUNT`) are the scrolled-back
  history the benchmark opens with: user turns, tool calls with kilobyte-scale input/output,
  assistant replies built from headings, bold/italic/inline code, a link, fenced code blocks that
  rotate through rust/kotlin/python/sh/json/toml, a markdown table, two embedded images, and
  periodic `usageDelta`/`compacted` events. The remaining 400 (`STREAM_COUNT`) are not part of the
  opening window -- both bench harnesses replay them at a fixed rate (20/s) through the same live
  fold path a real SSE reply arrives on, which is P0's "streaming phase."
 - `bench1.png`, `bench2.png` -- tiny (8x8) flat-colour PNGs, base64-free on disk but served the
  same way a real attachment is (`GET /sessions/{id}/files/{name}`), referenced by the two
  `"type":"image"` events in the transcript.
 Regenerate after changing the shape (a new event type, a different backlog/stream split) with
 `./generate.py`, and commit the result -- it is checked in rather than generated at build time so
 both apps' bench builds embed the identical bytes without needing this script at build time.
@@ -1,186 +0,0 @@
 #!/usr/bin/env python3
 """Generates transcript.jsonl -- the synthetic fixture P0's benchmark opens in both apps.
 Deterministic (fixed seed), so a Compose bench APK and an iris bench APK draw byte-identical
 content: the point of the fixture is a like-for-like comparison, not a realistic one.
 Never a real transcript -- see AGENTS.md's ui-sandbox.sh, which this borrows its vocabulary
 style from (headings, code fences, a table, a link) rather than reusing its Claude-Code JSONL
 shape. This file's shape is the *app's own event model* instead: one JSON object per line,
 matching what GET /sessions/{id}/transcript returns and what Events.kt's parseSeqEvent reads
 (server/src/session/driver.rs is the source of truth for the field names).
    ./generate.py                      writes transcript.jsonl and bench1.png/bench2.png here
 BACKLOG_COUNT events (seq 1..BACKLOG_COUNT) are the scrolled-back history the benchmark opens
 with. A further STREAM_COUNT events (seq BACKLOG_COUNT+1..) are not part of the opening window;
 both bench harnesses replay them at a fixed rate as the "streaming reply" phase, appended through
 the same live path a real SSE reply arrives on. Keeping both halves in one file means one
 generator and one seed to keep in sync, rather than two fixtures that can drift apart.
 """
 import base64
 import json
 import random
 import struct
 import zlib
 from pathlib import Path
 SEED = 20260905
 BACKLOG_COUNT = 3200
 STREAM_COUNT = 400
 HERE = Path(__file__).resolve().parent / "assets"
 random.seed(SEED)
 LANGUAGES = ["rust", "kotlin", "python", "sh", "json", "toml"]
 CODE_SNIPPETS = {
    "rust": '''fn fold_event(items: Vec<Item>, seq: u64) -> Vec<Item> {
    // a comment worth keeping: this is the fold the app's own screen runs
    let mut out = items;
    out.push(Item::new(seq));
    out
 }''',
    "kotlin": '''fun foldEvent(items: List<TranscriptItem>, entry: SeqEvent): List<TranscriptItem> {
    // mirrors the server's own event model, one item per line
    return items + TranscriptItem.from(entry)
 }''',
    "python": '''def render_report(frames, cpu_ms, rss_kb):
    # printed for a human to paste back, so every number carries its unit
    return f"{frames} frames, {cpu_ms}ms cpu, {rss_kb}kb peak rss"''',
    "sh": '''#!/bin/sh
 # scripted scroll loop, the shape transcript-bench.sh drives on a phone
 for i in $(seq 1 24); do
    ui-trace record --do "swipe 540 700 540 1600 200"
 done''',
    "json": '{"seq": 1, "type": "status", "state": "running"}',
    "toml": '''[package]
 name = "bench-fixture"
 version = "0.1.0"''',
 }
 HEADINGS = [
    "## Plan",
    "## What changed",
    "## Why this approach",
    "### Open questions",
    "## Results",
 ]
 WORDS = (
    "session render report frame budget scroll transcript fold event cache "
    "cursor probe stream backlog swipe fixture bench compose iris widget layout "
    "measure place draw tool call token context window anchor"
 ).split()
 def paragraph(n=24):
    words = [random.choice(WORDS) for _ in range(n)]
    words[0] = words[0].capitalize()
    text = " ".join(words) + "."
    # Sprinkle markdown inline spans so the syntax highlighter/markdown parser sees a real mix.
    text = text.replace(" fold ", " **fold** ", 1)
    text = text.replace(" cursor ", " *cursor* ", 1)
    text = text.replace(" cache ", " `cache` ", 1)
    if "bench" in text:
        text = text.replace(
            " bench ", " [bench](https://example.com/bench) ", 1
        )
    return text
 def make_png(rgb, size=8):
    """A tiny, valid PNG -- flat colour, no external dependency."""
    def chunk(tag, data):
        c = tag + data
        return struct.pack(">I", len(data)) + c + struct.pack(">I", zlib.crc32(c))
    sig = b"\x89PNG\r\n\x1a\n"
    ihdr = struct.pack(">IIBBBBB", size, size, 8, 2, 0, 0, 0)
    raw = b""
    for _ in range(size):
        raw += b"\x00" + bytes(rgb) * size
    idat = zlib.compress(raw)
    return sig + chunk(b"IHDR", ihdr) + chunk(b"IDAT", idat) + chunk(b"IEND", b"")
 def main():
    HERE.mkdir(exist_ok=True)
    lines = []
    seq = 1
    ts = 1_788_000_000.0
    def emit(type_, **fields):
        nonlocal seq, ts
        obj = {"seq": seq, "ts": round(ts, 3), "type": type_}
        obj.update(fields)
        lines.append(json.dumps(obj, separators=(",", ":")))
        seq += 1
        ts += random.uniform(0.05, 2.0)
    emit("status", state="running")
    emit("settings", model="bench-model", permissionMode="auto")
    image_refs = []
    turn = 0
    while seq <= BACKLOG_COUNT:
        turn += 1
        emit("userMessage", text=f"Turn {turn}: {paragraph(12)}", id=None, attachments=[])
        # A tool call with kilobyte-scale input/output every few turns.
        if turn % 3 == 0:
            tool_id = f"tool-{turn}"
            big_input = json.dumps({"path": f"/repo/file_{turn}.rs", "content": paragraph(400)})
            emit("toolStart", id=tool_id, tool="Edit", input=big_input)
            big_output = "\n".join(paragraph(60) for _ in range(20))
            emit("toolUpdate", id=tool_id, output=big_output[: len(big_output) // 2])
            emit("toolEnd", id=tool_id, output=big_output)
        # A reply: a heading, prose, a fenced block in a rotating language, a table, then deltas.
        emit("assistantText", delta=f"{random.choice(HEADINGS)}\n\n")
        emit("assistantText", delta=paragraph(30) + "\n\n")
        lang = LANGUAGES[turn % len(LANGUAGES)]
        emit("assistantText", delta=f"```{lang}\n{CODE_SNIPPETS[lang]}\n```\n\n")
        if turn % 5 == 0:
            emit(
                "assistantText",
                delta="| column | value |\n|---|---|\n| a | " + paragraph(3) + " |\n\n",
            )
        # A run of small deltas -- the shape a live reply actually streams in.
        for _ in range(random.randint(3, 8)):
            emit("assistantText", delta=paragraph(6) + " ")
        # A couple of images, base64 PNGs, the way a real transcript embeds a screenshot.
        if turn in (10, 40):
            ref = f"bench{len(image_refs) + 1}.png"
            image_refs.append(ref)
            emit("image", ref=ref, about=None)
        emit("usageDelta", tokens=random.randint(200, 4000), context=random.randint(2000, 180000))
        if turn % 15 == 0:
            emit(
                "compacted",
                preTokens=180000,
                postTokens=20000,
                trigger="auto",
            )
    # The streaming-phase tail: one long reply, built entirely from text deltas, the shape a
    # bench harness replays at a fixed events/sec through the live fold path.
    emit("userMessage", text="One more, streamed live for the benchmark's timing phase.", id=None, attachments=[])
    while seq <= BACKLOG_COUNT + STREAM_COUNT:
        emit("assistantText", delta=paragraph(5) + " ")
    emit("status", state="idle")
    (HERE / "transcript.jsonl").write_text("\n".join(lines) + "\n")
    (HERE / "bench1.png").write_bytes(make_png((220, 90, 90)))
    (HERE / "bench2.png").write_bytes(make_png((90, 150, 220)))
    print(f"wrote {len(lines)} events ({BACKLOG_COUNT} backlog + {STREAM_COUNT} stream) to transcript.jsonl")
 if __name__ == "__main__":
    main()
@@ -4,11 +4,6 @@
 #   ./build-apk.sh            the release build, signed (what the phone runs)
 #   ./build-apk.sh debug      the debug build, for reproducing something the
 #                             emulator scripts would build anyway
 #   ./build-apk.sh bench      P0's benchmark build (own app id, "AI Sessions
 #                             bench" label, opens straight onto the fixture
 #                             session -- see docs/RUST.md's P0 box and
 #                             app/bench-fixture/README.md). Signed the same
 #                             as release; never touches the CA it pins.
 #
 # Dev Updater's `.dev-updater.ron` at the checkout root spells these out as
 # build modes, one command line each; it passes nothing else, so the word
@@ -30,9 +25,8 @@ VARIANT=${1:-release}
 case "$VARIANT" in
 release) TASK=assembleRelease ;;
 debug) TASK=assembleDebug ;;
 bench) TASK=assembleBench ;;
 *)
-    echo "build-apk.sh: unknown variant '$VARIANT' (release, debug, bench)" >&2
+    echo "build-apk.sh: unknown variant '$VARIANT' (release, debug)" >&2
    exit 2
    ;;
 esac
@@ -87,7 +81,7 @@ fi
 # uninstalling it first: the signatures differ, and Android refuses to
 # update across them.
 KEYSTORE="${AI_APP_KEYSTORE:-${XDG_CONFIG_HOME:-$HOME/.config}/ai-app/release.jks}"
-if { [ "$VARIANT" = release ] || [ "$VARIANT" = bench ]; } && [ ! -f "$KEYSTORE" ]; then
+if [ "$VARIANT" = release ] && [ ! -f "$KEYSTORE" ]; then
    KEYTOOL="${JAVA_HOME:+$JAVA_HOME/bin/keytool}"
    KEYTOOL="${KEYTOOL:-keytool}"
    if ! command -v "$KEYTOOL" >/dev/null 2>&1; then
@@ -103,7 +97,7 @@ if { [ "$VARIANT" = release ] || [ "$VARIANT" = bench ]; } && [ ! -f "$KEYSTORE"
        -keyalg RSA -keysize 2048 -validity 10000 \
        -storepass "$PASSWORD" -keypass "$PASSWORD" -dname "CN=ai-app" >/dev/null 2>&1)
 fi
-if [ "$VARIANT" = release ] || [ "$VARIANT" = bench ]; then
+if [ "$VARIANT" = release ]; then
    AI_APP_KEYSTORE="$KEYSTORE"
    AI_APP_KEYSTORE_PASSWORD=$(cat "$KEYSTORE.password")
    export AI_APP_KEYSTORE AI_APP_KEYSTORE_PASSWORD
@@ -45,6 +45,7 @@ GLYPHS=(
    U+F0193  # md-content_save
    U+F0224  # md-file_outline
    U+F201   # fa-line_chart -- Font Awesome's, asked for by name
    U+F035C  # md-menu -- the burger, as a row's drag handle
 )
 url=https://github.com/ryanoasis/nerd-fonts/releases/latest/download/NerdFontsSymbolsOnly.zip
@@ -120,10 +120,10 @@ TOKEN=$(grep -o 'token=[A-Za-z0-9_-]*' "$WORK/server.log" | head -1 | cut -d= -f
 api() { curl -s --cacert "$CERTS/ca.pem" -H "Authorization: Bearer $TOKEN" "$@"; }
 echo "==> Importing"
-SETUP=$(api "https://127.0.0.1:$PORT/setups" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p' | head -1)
+MACHINE=$(api "https://127.0.0.1:$PORT/machines" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p' | head -1)
 SESSION=$(api -H 'Content-Type: application/json' -X POST \
    "https://127.0.0.1:$PORT/sessions" \
-    -d "{\"setup\":\"$SETUP\",\"provider\":\"claude-cli\",\"title\":\"$PROJECT\",\"import\":\"$ID\"}" \
+    -d "{\"machine\":\"$MACHINE\",\"provider\":\"claude-cli\",\"title\":\"$PROJECT\",\"import\":\"$ID\"}" \
    | sed -n 's/.*"id":"\([^"]*\)".*/\1/p' | head -1)
 echo "    session $SESSION, $(wc -l < "$WORK/sessions/$SESSION/transcript.jsonl") events"
@@ -1,34 +0,0 @@
 #!/bin/sh
 # RUST.md's I5 "Where iris's frame time goes" pass (2026-09-05). The same
 # 24-swipe/6-cycle loop as transcript-bench.sh's, extracted for iris's own
 # demo app -- transcript-bench.sh itself is Compose-specific (opens by
 # session title through the Compose app's own UI) and cannot be called
 # directly against dev.iris.android.demo.
 #
 # MUST be run from inside this checkout (not /tmp): ui-trace/adb pick which
 # emulator to target from the current directory's basename (the
 # per-checkout-AVD rule), and a previous pass lost two attempts to a `cd`
 # into /tmp that made this resolve to a nonexistent "tmp" checkout.
 set -eu
 cd "$(dirname "$0")"
 . ./android-env.sh >/dev/null 2>&1
 cycles=${1:-6}
 ui-trace record -d 3000 --do "tap 'Reset frame report'" -o /tmp/iris-bench-reset.txt >/dev/null
 adb logcat -c
 DO=""
 i=0
 while [ "$i" -lt "$cycles" ]; do
    DO="$DO --do 'swipe 540 700 540 1600 200' --do 'wait 500'"
    DO="$DO --do 'swipe 540 700 540 1600 200' --do 'wait 500'"
    DO="$DO --do 'swipe 540 1600 540 700 200' --do 'wait 500'"
    DO="$DO --do 'swipe 540 1600 540 700 200' --do 'wait 500'"
    i=$((i + 1))
 done
 eval ui-trace record -d $((cycles * 16000 + 20000)) $DO -o /tmp/iris-bench-scroll.txt >/dev/null
 ui-trace record -d 3000 --do "tap 'Frame report'" -o /tmp/iris-bench-report.txt >/dev/null
 sleep 1
 adb logcat -d -s iris-android-app:I | grep "iris frame report:"
@@ -9,7 +9,7 @@
 # emulator" is three places for the memory check that was missing from all of
 # them.
 #
-# Environment setup (SDK location, PATH, ...) lives in ./android-env.sh,
+# Environment machine (SDK location, PATH, ...) lives in ./android-env.sh,
 # which can also be sourced directly for one-off commands.
 set -eu
@@ -17,11 +17,6 @@ dependencyResolutionManagement {
 include(":androidApp")
 // E3 (RUST.md): the Kotlin/Java shell over android-shell's JNI bridge, a
 // separate module from :androidApp so the ~13,000 lines of working Compose
 // UI there are untouched. See shellApp/build.gradle.kts's module comment.
 include(":shellApp")
 // The app half of wg-app-link, resolved by path through the submodule so
 // this checkout and the crate it consumes move together -- the same
 // arrangement `server/` uses for the Rust half. See that repo's README.
@@ -1,163 +0,0 @@
 plugins { alias(libs.plugins.androidApplication) }
 // E3 (RUST.md): the Kotlin/Java shell being replaced by a thin JNI bridge
 // into Rust (`../../android-shell`). Deliberately its own module rather
 // than a rewrite of `:androidApp` in place -- that module is ~13,000 lines
 // of working Compose UI this experiment does not touch, and the two can be
 // installed side by side on the same development device (see
 // `settings.SCHEME`'s doc in `android-shell` for why the deep-link scheme
 // and Keystore alias are not the production app's). No Compose plugin, no
 // Kotlin source of its own: `MainActivity`/`NotificationService` are plain
 // Java, and the CA constant below is generated as Java too.
 //
 // The CA this build pins is baked in the same way `androidApp`'s does --
 // see that module's `build.gradle.kts` comment for the reasoning (the
 // trust boundary follows the machine that builds, never a pasted copy).
 // `PinnedCa.java`'s package must match `android-shell`'s
 // `settings::load_pinned_ca` lookup (`com/example/aiapp/shell/PinnedCa`).
 val pinnedCaPath: String =
    System.getenv("AI_APP_CA")
        ?: "${System.getenv("XDG_CONFIG_HOME") ?: "${System.getProperty("user.home")}/.config"}" +
            "/ai-app/certs/ca.pem"
 abstract class GeneratePinnedCa : DefaultTask() {
    @get:Input abstract val caPath: Property<String>
    @get:InputFile
    @get:Optional
    @get:PathSensitive(PathSensitivity.NONE)
    abstract val caCertificate: RegularFileProperty
    @get:OutputDirectory abstract val outputDir: DirectoryProperty
    @TaskAction
    fun generate() {
        val path = caPath.get()
        val ca = File(path)
        if (!ca.isFile) {
            throw GradleException(
                "No CA certificate at $path.\n" +
                    "Start ai-server (or app/ui-sandbox.sh) once on this machine first -- it " +
                    "generates the CA this build pins.\n" +
                    "Set AI_APP_CA=/path/to/ca.pem to build against a different one."
            )
        }
        val pem = ca.readText().trim()
        if (!pem.startsWith("-----BEGIN CERTIFICATE-----")) {
            throw GradleException("$path is not a PEM certificate.")
        }
        val dir = outputDir.get().dir("com/example/aiapp/shell").asFile
        dir.mkdirs()
        // Same reasoning as androidApp's generatePinnedCert: the text block
        // must start immediately after the opening `"""`, or
        // CertificateFactory stops recognising the "-----BEGIN" preamble.
        File(dir, "PinnedCa.java")
            .writeText(
                """
                |// Generated from $path by the generatePinnedCa task. Do not edit.
                |package com.example.aiapp.shell;
                |
                |public final class PinnedCa {
                |    private PinnedCa() {}
                |    public static final String PINNED_CA_PEM = ""${'"'}
                |$pem""${'"'};
                |}
                |"""
                    .trimMargin()
            )
    }
 }
 val generatePinnedCa =
    tasks.register<GeneratePinnedCa>("generatePinnedCa") {
        val ca = file(pinnedCaPath)
        caPath.set(pinnedCaPath)
        if (ca.isFile) {
            caCertificate.set(ca)
        }
    }
 android {
    namespace = "com.example.aiapp.shell"
    compileSdk = 37
    defaultConfig {
        applicationId = "com.example.aiapp.shell"
        minSdk = 24
        targetSdk = 37
        versionCode = 1
        versionName = "1.0"
    }
    // Same reasoning and same key as androidApp's (see that module's comment): E5 (RUST.md)
    // signs its own, Gradle-free build with this same keystore, and the two can only
    // `adb install -r` over each other if they carry the same certificate.
    val keystore = System.getenv("AI_APP_KEYSTORE")
    signingConfigs {
        if (keystore != null) {
            create("release") {
                storeFile = file(keystore)
                storePassword = System.getenv("AI_APP_KEYSTORE_PASSWORD")
                keyAlias = "ai-app"
                keyPassword = storePassword
            }
        }
    }
    buildTypes {
        getByName("release") {
            isMinifyEnabled = false
            if (keystore != null) signingConfig = signingConfigs.getByName("release")
        }
    }
    compileOptions {
        sourceCompatibility = JavaVersion.VERSION_21
        targetCompatibility = JavaVersion.VERSION_21
    }
 }
 // E5 (RUST.md): the xtask dexes and packages this module's Java sources itself, but it does
 // not resolve Maven dependencies -- reimplementing a dependency resolver was out of scope for a
 // packaging step, so this one task is the single place Gradle still runs in that pipeline. It
 // asks the dependency graph for the *post-transform* jars (AARs already unpacked to a classes
 // jar, the same artifact type AGP's own dexing task consumes) rather than the raw configuration,
 // which would hand back .aar files d8 cannot read directly.
 val artifactType = Attribute.of("artifactType", String::class.java)
 tasks.register("printRuntimeClasspathJars") {
    description = "Writes the resolved release runtime classpath jars, one per line, for xtask."
    val outputFile = layout.buildDirectory.file("xtask/runtime-classpath.txt")
    outputs.file(outputFile)
    val jars =
        configurations
            .getByName("releaseRuntimeClasspath")
            .incoming
            .artifactView { attributes.attribute(artifactType, "android-classes-jar") }
            .files
    // Captured as a plain FileCollection (not the ArtifactView itself, which the
    // configuration cache cannot serialize) so this task is still cacheable.
    inputs.files(jars)
    doLast {
        val file = outputFile.get().asFile
        file.parentFile.mkdirs()
        file.writeText(jars.joinToString("\n") { it.absolutePath })
    }
 }
 androidComponents {
    onVariants { variant ->
        variant.sources.java?.addGeneratedSourceDirectory(generatePinnedCa, GeneratePinnedCa::outputDir)
    }
 }
 dependencies {
    // The Keystore-sealed enrollment (ServerStore/ServerSettings) --
    // android-shell's settings.rs calls into this Kotlin class directly
    // over JNI rather than re-sealing the token in Rust; see that file's
    // module doc.
    implementation(project(":link"))
    // NotificationCompat/NotificationManagerCompat/NotificationChannelCompat/
    // ServiceCompat -- android-shell's notify.rs calls these classes over
    // JNI so the pre-26 fallback behaviour (no channels) lives once, in
    // the library that already has it, rather than being re-derived as a
    // set of Build.VERSION.SDK_INT branches in Rust.
    implementation(libs.androidx.core.ktx)
 }
@@ -1,62 +0,0 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools">
    <!-- Mirrors androidApp's manifest (AGENTS.md: reuse it rather than
         re-deriving it) for the permissions and declarations E3 actually
         exercises. Not carried over: the QR scanner activity (this
         experiment enrolls via the aiappshell://enroll deep link directly,
         per AGENTS.md's ui-sandbox.sh banner) and the app icon warning
         suppression below, for the same reason androidApp's is there. -->
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.ACCESS_LOCAL_NETWORK" />
    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
    <application
        android:label="AI Sessions (shell)"
        android:allowBackup="true"
        android:theme="@android:style/Theme.Material.Light.NoActionBar"
        tools:ignore="MissingApplicationIcon">
        <activity
            android:name=".MainActivity"
            android:exported="true"
            android:launchMode="singleTop">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
            <!-- Enrollment: aiappshell://enroll?host=...&port=...&token=...,
                 per AGENTS.md's ui-sandbox.sh banner (fed to this app with
                 `adb shell am start -a android.intent.action.VIEW -d
                 'aiappshell://enroll?...'`, or -n'd at this component
                 directly if a second app also claims the aiapp scheme). -->
            <intent-filter>
                <action android:name="android.intent.action.VIEW" />
                <category android:name="android.intent.category.DEFAULT" />
                <category android:name="android.intent.category.BROWSABLE" />
                <data android:scheme="aiappshell" android:host="enroll" />
            </intent-filter>
            <!-- The share sheet - see android-shell's share.rs. -->
            <intent-filter>
                <action android:name="android.intent.action.SEND" />
                <action android:name="android.intent.action.SEND_MULTIPLE" />
                <category android:name="android.intent.category.DEFAULT" />
                <data android:mimeType="*/*" />
            </intent-filter>
        </activity>
        <!-- specialUse, not dataSync, for the reason androidApp's manifest
             gives: a connection that has to keep listening overnight
             cannot accept dataSync's six-hour cap. -->
        <service
            android:name=".NotificationService"
            android:exported="false"
            android:foregroundServiceType="specialUse">
            <property
                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
                android:value="E3 experiment: holds one connection to the sandbox server so a
                    session that needs an answer can be reported while the app is closed." />
        </service>
    </application>
 </manifest>
@@ -1,50 +0,0 @@
 package com.example.aiapp.shell;
 import android.app.Activity;
 import android.content.Context;
 import android.content.Intent;
 import android.os.Bundle;
 import android.os.Handler;
 import android.os.Looper;
 import android.widget.Toast;
 /**
 * E3's floor, per RUST.md's "How much Java is unavoidable": a class the framework
 * constructs by name from the manifest, with its lifecycle methods handing straight to Rust
 * (android-shell's {@code share::handle_intent}). No Compose, no layout -- there is no screen to
 * draw yet (that is E4's job, on iris); {@link #toast} is this experiment's stand-in for showing
 * something happened.
 */
 public class MainActivity extends Activity {
    static {
        System.loadLibrary("android_shell");
    }
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        NotificationService.sync(this);
        nativeHandleIntent(this, getIntent());
    }
    // launchMode="singleTop": a notification tap or a share while this activity is already on
    // top lands here rather than in a second instance -- same reasoning as MainActivity.kt's.
    @Override
    protected void onNewIntent(Intent intent) {
        super.onNewIntent(intent);
        setIntent(intent);
        nativeHandleIntent(this, intent);
    }
    /**
     * Called from android-shell, sometimes from a background thread (a share's network call is
     * never made on the calling thread -- see share.rs). {@code Toast} itself is main-thread-only,
     * so this hops there with a {@link Handler} rather than assuming the caller already has.
     */
    static void toast(Context context, String message) {
        new Handler(Looper.getMainLooper())
                .post(() -> Toast.makeText(context, message, Toast.LENGTH_LONG).show());
    }
    private static native void nativeHandleIntent(Activity activity, Intent intent);
 }
@@ -1,45 +0,0 @@
 package com.example.aiapp.shell;
 import android.app.Service;
 import android.content.Context;
 import android.content.Intent;
 import android.os.IBinder;
 /**
 * E3's second unavoidable Java class (RUST.md): a foreground service constructed by the framework
 * from the manifest, existing only to hand its lifecycle to android-shell's {@code notify} module
 * -- the SSE follow loop, deciding what a notification says, and posting it are all Rust reached
 * through these three native calls. See {@code Notifications.kt}'s {@code NotificationService} for
 * the Kotlin original this mirrors.
 */
 public class NotificationService extends Service {
    static {
        System.loadLibrary("android_shell");
    }
    @Override
    public IBinder onBind(Intent intent) {
        return null;
    }
    @Override
    public int onStartCommand(Intent intent, int flags, int startId) {
        return nativeOnStartCommand(this);
    }
    @Override
    public void onDestroy() {
        nativeOnDestroy();
    }
    /** Starts this service if there is a server to connect to, and stops it otherwise. */
    static void sync(Context context) {
        nativeSync(context);
    }
    private static native void nativeSync(Context context);
    private static native int nativeOnStartCommand(Service service);
    private static native void nativeOnDestroy();
 }